Analysis model: gpt-5.5 xhigh

Instant by Xtacy - Technical Dissection

Scope

Instant is a 1993 MS-DOS 80K intro by Xtacy, released at The Party 1993 in Herning, Denmark. The Party 1993 result file ranks it ninth in the PC intro competition with 124 points, tied on score with Ilusion's X Mas 93.

This is a useful low-table 1993 target because it is not stored as a tidy set of external assets. The public package is a PKLITE-packed real-mode executable with the music data, effect text, VGA setup, sound-output labels, tables, and the intro code all folded into one MZ image. That makes the first concrete inner loop in the public file the PKLITE depacker itself.

Release year: 1993.

Public References

The result file gives the relevant PC intro table excerpt as:

7   136  Typhoid     Sympton
8   124  X Mas 93    Ilusion
9   124  Instant     Xtacy
10   72  Eradicator  Groundzero
11   56  Wiered      Spacestation

The short instant.diz claims 8th place, but the party result file places Instant at rank 9. I use the result file for the ranking and preserve the DIZ claim as a packaging discrepancy.

Examined Packages

Scene.org HTTP metadata observed for this pass:

instant.zip   content-length 54853  last-modified Mon, 03 Apr 2000 05:49:07 GMT
instantb.zip  content-length 54308  last-modified Mon, 03 Apr 2000 05:48:59 GMT

Hashes:

dee71a4b095be16d60b2159699391da777c5b7be3a8064f7acf7b0cda8b00ad8  instant.zip
c77a99eade29016e50c0cfea633dcc2ffe0877fb15dd4471c22ed2e11fbccd66  instantb.zip
241a6de8944711b522b6cd2680e00a5ba23e1054137d4f4dc5e3bc12c24bddef  instant.diz
8cd3a357a0c4b73b1b521c649101e469f74dfdc26fce2fea7b69f06132ac71f3  instantb.diz

instant.zip contains:

FILE_ID.DIZ      120  1993-12-30 18:28
INSTANT.EXE    55710  1993-12-28 03:33
README.XTC      3133  1993-12-28 03:16

instantb.zip contains:

FILE_ID.DIZ      319  1993-12-28 06:45
INSTANT.EXE    55768  1993-12-28 03:25
README.XTC      3133  1993-12-29 03:51

The README differs in one technical sentence: the first package says the intro "takes up 65K", while the alternate package says "55K". The alternate package also has the fuller DIZ and exposes much more plaintext in the packed EXE. This pass therefore treats instantb.zip as the more informative public package, while still comparing it against the party package.

The README includes old personal contact material. It is not relevant to the runtime analysis and is deliberately omitted here.

Package-Level Story

Xtacy's README says the intro was made in roughly fourteen days. It requires a 386sx/25 and VGA, supports Sound Blaster and D/A Converter output, and warns that sound is not recommended below a faster 386DX/33 class machine. It credits Juggler and Blizzard for coding, Dranic for additional work, Mr. Smooth/SkyTech for the music, and X-cell/SkyTech for the logo.

That matches the binary shape:

MZ Layout

Both EXEs are PKLITE-packed MZ files. file(1) calls them self-extracting PKZIP archives, but unzip does not find a ZIP central directory inside either EXE. The reliable signature is the PKLITE banner near the start of the MZ load image:

PKLITE Copr. 1990-92 PKWARE Inc. All Rights Reserved

MZ header comparison:

                         instant.zip EXE    instantb.zip EXE
file size                55710              55768
declared MZ size         55710              55768
header size                 96                160
load image               55614              55608
overlay bytes                0                  0
relocations                  1                  1
minalloc                0x22ea             0x22ef
maxalloc                0xffff             0xffff
SS:SP              0x0d9a:0x0200     0x0d9e:0x0200
CS:IP              0xfff0:0x0100     0xfff0:0x0100
relocation table        0x0052             0x0052

The odd-looking CS:IP = fff0:0100 is the usual packed-EXE trick: the loader enters a small relocation/decompression stub, not the original program entry. The packed stub then copies and expands the real image, applies relocation fixups, restores the original stack, and far-returns into the depacked program.

Why The Two EXEs Differ

The party package and alternate package are not byte-identical. The alternate EXE is 58 bytes larger, its MZ header is larger by four paragraphs, and it contains plaintext fragments that are absent from the party EXE:

offset in instantb EXE   fragment
0x2be7                   xtcmod.
0x3546                   INSTANT!!
0x5540                   COMING UP
0x554d                   TWISTED
0x587c                   peaker
0x5886                   Blast
0x5891                   DAC-LPT1
0x5d1d                   M.K.

The first EXE has the PKLITE banner and the memory-failure string only. The second EXE retains larger literal islands inside the compressed stream. This does not prove that instantb is a bugfix, but it does prove that it is a different packed artifact, not merely a different DIZ.

PKLITE Entry Stub

In the alternate EXE, the DOS-visible stub begins at file offset 0x00a0. The first block checks available memory, sets a temporary stack, copies a small piece of the unpacker to a safer segment, and far-returns there:

00a0: b8 5f 30        mov ax,305fh
00a3: ba 94 0d        mov dx,0d94h
00a9: 3b 06 02 00     cmp ax,[0002h]
00ad: 73 1a           jae not_enough_memory
00af: 2d 20 00        sub ax,0020h
00b2: fa              cli
00b3: 8e d0           mov ss,ax
00b5: fb              sti
00b6: 2d 25 00        sub ax,0025h
00b9: 8e c0           mov es,ax
00bb: 50              push ax
00bc: b9 22 01        mov cx,0122h
00bf: 33 ff           xor di,di
00c1: 57              push di
00c2: be 44 01        mov si,0144h
00c5: fc              cld
00c6: f3 a5           rep movsw
00c8: cb              retf

The important detail is the rep movsw: PKLITE moves the second-stage unpacker before expanding the program. It does not try to run the main image in place.

If the memory test fails, the stub prints a DOS $-terminated string and exits:

00c9: b4 09           mov ah,09h
00cb: ba 32 01        mov dx,0132h
00ce: cd 21           int 21h
00d0: cd 20           int 20h
00d2: ...             "Not enough memory$"

PKLITE Backward Move

The next stage computes paragraph-aligned source and destination segments, then moves the packed image in high memory. The key loop is:

00fe: 8b ce           mov cx,si
0100: d1 e9           shr cx,1
0102: 4e              dec si
0103: 4e              dec si
0104: 8b fe           mov di,si
0106: 2b e8           sub bp,ax
0108: 2b d8           sub bx,ax
010a: 8e c5           mov es,bp
010c: 8e db           mov ds,bx
010e: f3 a5           rep movsw
0110: b8 00 10        mov ax,1000h
0113: b5 80           mov ch,80h
0115: fe ce           dec dh
0117: 75 ed           jne 0106h

This is a paragraph-stepping backward relocation pass. SI and DI are set near the end of a block, CX is derived from SI / 2, and the loop copies words while reducing source and destination segments by AX. Moving backward keeps the packed payload and output staging area from overwriting each other.

PKLITE Bit-Stream Inner Loop

After relocation, the depacker sets DS to the packed stream segment, restores ES to the program load segment, starts output at offset 0100h, and reads compressed bits through a 16-bit shift register in BP:

011a: 8e dd           mov ds,bp
011c: 07              pop es
011d: 06              push es
011e: bf 00 01        mov di,0100h
0121: 33 f6           xor si,si
0123: ad              lodsw
0124: 95              xchg ax,bp
0125: ba 10 00        mov dx,0010h

The literal path is compact:

015a: ad              lodsw
015b: 95              xchg ax,bp
015c: b2 10           mov dl,10h
015e: 72 08           jc 0168h
0160: a4              movsb
0161: d1 ed           shr bp,1
0163: 4a              dec dx
0164: 74 f4           je 015ah
0166: 73 f8           jae 0160h

Read this as:

  1. If the current compressed bit says "literal", copy one byte from the packed stream to the output with movsb.
  2. Shift BP right once to expose the next bit.
  3. Decrement the remaining-bit count in DX.
  4. If all 16 bits are consumed, fetch the next word from the stream.
  5. If the next bit still selects literals, stay in the tight copy path.

This loop is why PKLITE works well for executable code: runs of bytes that do not compress into matches are emitted through a tiny one-byte copy loop.

Back-Reference Copy Inner Loop

When the bit stream selects a match, the depacker builds a length in CX and distance in BX. The copy itself is the classic LZ-style self-copy:

01d5: 2e 8a bf 2c 02  mov bh,cs:[022ch+bx]
01da: ac              lodsb
01db: 8a d8           mov bl,al
01dd: 56              push si
01de: 8b f7           mov si,di
01e0: 2b f3           sub si,bx
01e2: fa              cli
01e3: f3 26 a4        rep movsb es:[si],es:[di]
01e6: fb              sti
01e7: 5e              pop si
01e8: e9 76 ff        jmp 0161h

The important trick is ES: on both sides of rep movsb. DI is the current output cursor. SI = DI - distance points backward into already-expanded program bytes. Since source and destination are both in the output segment, overlapping copies naturally repeat patterns. That is the core decompression mechanism.

The cli/sti pair is a period-correct defensive habit around segment override string copying. It makes sure an interrupt cannot observe the machine halfway through a copy with temporary registers arranged for the depacker.

Segment Boundary Handling

The depacker also has a block that advances DS, ES, SI, and DI across 64K boundaries. It aligns the current output cursor to a paragraph, adjusts the destination segment, then adjusts the compressed input pointer the same way:

025b: 50              push ax
025c: 8d 9d 00 e0     lea bx,[di-2000h]
0260: 83 e7 0f        and di,000fh
0263: 81 c7 00 20     add di,2000h
0267: b1 04           mov cl,04h
0269: d3 eb           shr bx,cl
026b: 8c c0           mov ax,es
026d: 03 c3           add ax,bx
026f: 8e c0           mov es,ax
0271: 8c d8           mov ax,ds
0273: 8b de           mov bx,si
0275: 83 e6 0f        and si,000fh
0278: d3 eb           shr bx,cl
027a: 03 c3           add ax,bx
027c: 8e d8           mov ds,ax

That is a real-mode decompressor compromise: keep ordinary 16-bit offsets in the hot loop, and repair the segment bases only when the cursor gets too far from its starting paragraph.

Relocation Fixups And Return

Once the compressed stream ends, the depacker reads relocation records and adds the load base to each target word:

02ac: 5b              pop bx
02ad: 8b eb           mov bp,bx
02af: 83 c3 10        add bx,0010h
02b2: 33 c0           xor ax,ax
02b4: ac              lodsb
02b5: 91              xchg ax,cx
02b6: e3 0f           jcxz done_reloc_block
02b8: ad              lodsw
02b9: 03 c3           add ax,bx
02bb: 8e c0           mov es,ax
02be: ad              lodsw
02bf: 97              xchg ax,di
02c0: 26 01 1d        add es:[di],bx
02c3: e2 f9           loop 02beh

The final block restores the original program stack, pushes the original program CS:IP, clears the general registers, and far-returns:

02c7: ad              lodsw
02c8: 03 c3           add ax,bx
02ca: fa              cli
02cb: 8e d0           mov ss,ax
02cd: ad              lodsw
02ce: 8b e0           mov sp,ax
02d0: fb              sti
02d1: ad              lodsw
02d2: 03 d8           add bx,ax
02d4: 53              push bx
02d5: ad              lodsw
02d6: 50              push ax
02d7: 8e c5           mov es,bp
02d9: 8e dd           mov ds,bp
02db: 33 c0           xor ax,ax
02dd: 8b d8           mov bx,ax
02df: 8b c8           mov cx,ax
02e1: 8b d0           mov dx,ax
02e3: 8b e8           mov bp,ax
02e5: 8b f0           mov si,ax
02e7: 8b f8           mov di,ax
02e9: cb              retf

This explains why the original MZ CS:IP is not useful as the intro entry: the visible entry belongs to PKLITE, and the real entry is encoded in the compressed stream.

Visible VGA Fragment

The alternate packed EXE preserves a small literal island that includes a standard VGA entry sequence:

0331: b8 13 00        mov ax,0013h
0334: cd 10           int 10h
0337: ba c4 03        mov dx,03c4h
033a: b8 04 06        mov ax,0604h
033d: ef              out dx,ax
033e: b8 02 0f        mov ax,0f02h
0343: ef              out dx,ax
0359: b8 00 a0        mov ax,0a000h
035c: 8e c0           mov es,ax

Because these bytes are still inside the packed stream, the file offset is not a callable runtime offset. The sequence itself is still meaningful:

That is the expected rendering base for a 1993 80K intro: mode 13h for chunky VGA pixels, with direct writes to A000h.

Visible Tables

The alternate EXE contains several literal numeric tables. Around 0x3546, the title and credit fragments are followed by descending and ascending byte ramps:

INSTANT!!
GGLER
BLIZZ
ARD
...
9987
665543322100/..-
@,++*))(''&%$#""
...
>?ABDEFHIKLNOQRS
UVXYZ\]^_abcdefh
ijklmnoopqr

Those are exactly the kinds of tables used by 1993 intro parts for sine-like motion, shade ramps, logo deformation, plasma phase curves, and palette fades. The strings nearby identify at least a title/credit sequence and a later "coming up" effect:

0x3546  INSTANT!!
0x5540  COMING UP
0x554d  TWISTED

The phrase is truncated in the packed literals, but it is enough to show that one planned part was introduced as a twisting effect.

Sound Path Clues

The README says the intro supports Sound Blaster and D/A Converter output. The packed EXE confirms three output choices in plaintext:

0x587c  peaker
0x5886  Blast
0x5891  DAC-LPT1

The leading S in Speaker and the rest of Sound Blaster are not preserved as a clean ASCII run in the packed stream, but the fragments line up with the README's hardware list. The xtcmod. fragment at 0x2be7 also points to an internal music block or loader label rather than an external MOD file.

There is an M.K. byte sequence at 0x5d1d, but treating it as a normal ProTracker module signature gives an impossible module base and nonsensical sample lengths. That means it is not a parseable raw MOD sitting directly in the EXE. It is either compressed music data, a literal fragment from a module, or an incidental byte sequence inside the packed stream.

Runtime Attempt

I attempted a short noninteractive DOSBox-X 2026.01.02 SDL2 run with dummy video and audio:

SDL_VIDEODRIVER=dummy SDL_AUDIODRIVER=dummy
dosbox-x -silent -fastlaunch -nopromptfolder -defaultdir /vmshare/projects/chronologia

The first run stopped at the emulator's working-folder prompt. A second run with explicit folder options did not return cleanly under dummy video and was stopped. I did not use that failed run as timing evidence. This writeup is therefore a static packed-binary analysis, not an observed frame timeline.

What The Public Binary Lets Us Say

Instant is technically a compact, rushed, packed 80K intro. The README says it was made in about two weeks and that some routines missed the party deadline; the executable shape supports that story:

For the broader 1993 pass, Instant is useful precisely because it sits between the polished top intros and the tiny one-effect examples. It shows the practical delivery layer many party intros relied on: use a packer to get a single-file executable, keep assets internal, and spend the tight deadline on visible effects instead of a clean uncompressed archive format.