cosninix

Dracula rises again: my 1980 text adventure, rebuilt from the EXE

Sat, 14 Nov 2026 00:00:00 +0000

Yesterday I got an e-mail from Douwe Homans in Antwerp. He played my text adventure Dracula as a child, and he had just reverse-engineered DRACULA.EXE and rewritten the game in JavaScript, as a web version. A game I wrote in 1980, whose source code I lost decades ago, was being played again. I didn't get much sleep that night.

Dracula, 1980

As a student at TU Delft I played Colossal Cave Adventure and Zork (Dungeon, as the PDP-11 version was called) on a PDP-11. I wanted one in Dutch, so I wrote it: Dracula, in BASIC, on a Commodore PET 2001, in 8 KB. To make it fit, the texts were very terse.

Later, as a developer at Data Union, I ported it to CP/M on the 8080/Z80 and wrote out all the texts in full. A Dutch linguist who worked there turned my fake old Dutch into real old Dutch. You see that best in the "Vampier Handboeck" you find in the game:

Vampieren sijn al sedert menschenheugenisse ende tiden die parasieten der menschen.

The MS-DOS version is that CP/M source recompiled with BASCOM, Microsoft's BASIC compiler, under PC-DOS 1.0, on the first IBM PC in the Netherlands, imported from the US: 4.77 MHz, 32 KB of memory and a 160 KB floppy drive. It was mostly a test of whether the compiler worked on that strange new machine. It did. The EXE needs BASRUN.EXE, the BASCOM runtime, next to it, and reads all its texts from a file called DRACULA.TXT.

In 1985 CYCO Automatisering sent it out as a New Year's card on floppy, about 200 copies. Everybody copied it, and that is how it got popular in the Netherlands. My brother drew the sleeve.

The floppy sleeve, drawn by my brother.

The BASIC source is on an 8-inch floppy that nothing can read anymore. In 2001, for the game's twentieth birthday, I put the EXE online as freeware at cosninix.com/dracula. That was all there was: a compiled program, a data file and a scan of the sleeve.

An e-mail from Antwerp

Douwe's version runs at dracula.apphost.be. You type your name, and the browser remembers your game, so you can continue later. Same rooms, same texts, same Dracula, no DOSBox needed. I played it through to the end, and it all works.

Douwe's web version.

Getting the BASIC back

Douwe's mail made me want to see my own code again. That evening I asked Claude, on claude.ai, whether it could reverse-engineer a program compiled with BASCOM. That works better than you'd think: BASCOM turns every BASIC statement into a fixed pattern of machine code that calls routines in the runtime for PRINT, INPUT, MID$ and so on. Recognise the calls and you get the statements back. The strings are in the EXE as plain text.

Just after midnight I uploaded DRACULA.EXE and BASRUN.EXE. Claude recognised my own game from the copyright string, and a quarter of an hour later there was a DRACULA.BAS of about 1,200 lines: the Dutch parser, the rooms, Dracula walking through his castle, save and load, the bug reports and the title screen.

What didn't come back is what the compiler had thrown away: variable names, comments and line numbers. R% for the room and OL%() for where the objects are, are Claude's names, not mine. Also missing: five little assembler routines that were linked into the EXE. The game checked whether it ran on an IBM PC or a Zenith Z-100. On the IBM it cleared the screen and positioned the cursor through those routines, on the Zenith with escape codes, and on anything else it just printed line after line:

11940 IF IBM% <> 0 THEN CALL CLRSCR
11950 IF ZEN% <> 0 THEN PRINT CHR$(27);"E";
11960 RETURN
11970 IF IBM% <> 0 THEN CALL CURSOR(X%,Y%)
11980 IF ZEN% <> 0 THEN PRINT CHR$(27);"Y";CHR$(Y% + 32);CHR$(X% + 32);

The first DRACULA.TXT I uploaded arrived mangled. Despite the name it is a binary file, and the upload had treated it as text and converted the encoding. Zipped, it came through intact: 1,289 records of 80 bytes with the exits per room, the room descriptions, the messages and the objects, padded with zeros to a multiple of 128 bytes. That padding is a CP/M leftover; CP/M stored files in 128-byte records.

Ten minutes to one, I was standing in my own house again, in PC-BASIC, a GW-BASIC emulator written in Python:

Je bent nu in je eigen huis. Er is een slaapkamer op het zuiden
en een kleine hal oostelijk. Er is een deur die naar het westen leidt. De
deur staat op een kier en een gure wind blaast zand en stof naar binnen.
Door een raam kan je een bos zien.
Er zit een gat in het plafond, maar je kunt het niet bereiken.
Het gat is groot genoeg om er doorheen te klimmen.
Er is een klein briefje hier.
->z
Je bent nu in de slaapkamer. De enige uitgang is naar het
noorden, waar een rommelige kamer te zien is. Het is vrij donker
hier, maar door een klein raampje valt net voldoende licht binnen
om te kunnen zien.
Er is een kleine brandende lantaren hier.
Er is een zwaar eikenhouten bed hier.
->pak lamp
Ok

1980 from the inside

This is what I love about software from that time: everything had to fit, so every byte has a job, and 44 years later you can still see every decision. The verb parser is one long chain of IFs:

740 IF V$ = "GA" OR V$ = "BETRE" OR V$ = "KRUIP" OR V$ = "LOOP" OR V$ = "KLIM" OR V$ = "VOLG" THEN 1260
750 IF V$ = "$RVW" THEN PRINT "Room";R% : INPUT "Room"; R% : GOTO 340
760 IF (V$ = "KIJK" OR V$ = "K") AND N$ = "" THEN 340

Only the first five letters of a verb and the first four of a noun count, so BETREED becomes BETRE. Colossal Cave Adventure also looked at only five letters. Line 750 is my cheat: type $RVW and the game asks which room you want to go to.

The six magic words are in DATA lines, every letter shifted by one, so they don't show up as text in the EXE:

10 DATA "WBNQJSBOJB","GMBVXFLVMB","ESBLFMTUFJOJB"
11 DATA "NJDSPTPGUFOTUFJO","JODPSPOJVN","USBOTTZMWBOJVN"

WBNQJSBOJB is VAMPIRANIA. The fourth one is MICROSOFTENSTEIN. Every game picks one at random.

There is a tester mode that writes the testers' remarks to a file, a BUG command for bug reports, a list of Dutch swear words with an answer of its own, and bugs of mine that survived all those years: saving the game forgets the ladder in the house, "Illigal item number" is spelled like that, and drinking the poison doesn't kill you, because the routine that runs every turn immediately resets the death flag. Claude kept them all.

Two bugs that weren't mine

Then I moved to Claude Code, in the project folder. Under PC-BASIC the game sometimes crashed when you opened the coffin in the tomb:

KeyError: Dereferencing detached string

That turned out to be a bug in PC-BASIC 2.0.8. INSTR, LEFT$, RIGHT$ and MID$ register their string arguments as temporary values, but skip the clean-up when they return early, for instance when INSTR finds nothing. My parser calls INSTR a few times for every command, and most of those calls find nothing. After one playthrough some 900 temporary strings had leaked, the string space was full, and the garbage collector ran every few statements, most of all in the busy-wait loop at the coffin. Sooner or later a leaked value pointed to a string that had already been freed. The current master of PC-BASIC on GitHub still has this bug.

The fix is pcbasic_fix.py, a launcher that wraps those four functions, cleans up after them and then starts PC-BASIC. It also fixes a second bug: in terminal mode PC-BASIC didn't scroll during the autoplay, so every line overwrote the one before. The crash was rare to begin with, so I can't prove it's gone, but the leak went from 900 values to zero.

And then in C

At two in the morning I asked for a C version. dracula.c is about 2,200 lines of C99, without the GOTO spaghetti: every verb is a function that returns where the BASIC would have jumped to, and one main loop does the jumping. Each function names the BASIC line it came from.

The fun part was making it play exactly the same game. RND in C uses the same generator as GW-BASIC:

rnd_zaad = (rnd_zaad * 214013 + 2531011) % RND_PERIODE;   /* RND_PERIODE = 2^24 */

And BASIC evaluates every term of an AND or OR, even when the outcome is already clear. So when RND is part of such a condition, a number is drawn every time. C stops evaluating early, so the C version draws those numbers up front; otherwise the random sequence drifts apart after a few turns. With that in place, the autoplay (the game plays its own solution from the file PLAYER) gives the same output line for line in C and in PC-BASIC, all the way to the treasure, and a saved game is byte-for-byte the same. In C you can even reincarnate after dying, which under PC-BASIC stops with "File already open".

Before three o'clock the reconstructed BASIC, the C version and a README in English and Dutch were in git.

Play it

In your browser: Douwe's web version.
The source: github.com/rvwoens/dracula, with DRACULA.BAS for PC-BASIC, dracula.c and the original EXE from 2001.
The original for DOSBox: the download on /dracula. That's the page from 2001, back at its old address.

The C version builds on macOS and Linux:

git clone https://github.com/rvwoens/dracula
cd dracula
cc -O2 -o dracula dracula.c && ./dracula

The game is in Dutch. Don't swear at it:

->shit
Zeker christelijke opvoeding gehad ?   Dacht ik al.

That's "Christian upbringing, I suppose? Thought so."

Back to Unix V6, on a PiDP-11/70 with my own VT100 and LA120

Sat, 31 Oct 2026 00:00:00 +0000

In 1978 or 1979 I programmed on a PDP-11/60 at the mathematics department of TU Delft. It was a "low boy" cabinet without blinkenlights, and you could extend its instruction set in microcode. It ran Unix V6, and what struck me most was that the complete source code of Unix was on the machine. I printed the sources of yacc and lex. As a student project we wrote a full-screen editor in C for the DEC VT100 terminals, called zed. Everybody loved it. It is lost now.

I still have a terminal from DEC's VT100 family, a VT131, and an LA120, DEC's printing terminal with a keyboard. Besides the 11/60, I also worked on PDP-11/70s in those days. So when I built a PiDP-11/70, a replica of that machine, both terminals had to be connected to it.

The PiDP-11

The PiDP-11/70 is a replica of the 11/70 front panel with a Raspberry Pi inside; mine is a Pi 3B+. The Pi runs SIMH, and the switches on the panel choose what to boot:

PiDP-11/70 boot menu - Set SR switches, depress address rotary switch to reboot
-------------------------------------------------------------------------------
0000    idled   0101    unixv1  0107    unix7   1001    idled
0001    rsx11mp 0102    211bsd  0113    sysiii  1002    blinky
0002    rsts7   0104    unix4   0115    sysv    2024    rsx11bq
0003    rt11    0105    unix5   0211    211bsd+
0004    dos11   0106    unix6   1000    nkrvs

The installer expects the default pi user. My first attempt under my own account ended in errors about /home/pi/pdp.sh and a missing rpcbind.service. With a pi user, a second run of install.sh was clean. A systemd unit starts SIMH at boot, straight into V6 (switch setting 0106). Stopping SIMH can hang, so the unit gets a timeout:

ExecStart=/opt/pidp11/bin/pdp11control.sh start 106
TimeoutStopSec=10

Backspace on V6

Out of the box, V6 erases a character with # and kills the line with @. Backspace (^H) moves the cursor back, but the character stays on the screen, and you can backspace right past the start of the line. V6 was made for paper terminals, where nothing can be erased.

Terminal handling lives in the kernel, so the fix is in C. In ttyinput() in /usr/sys/dmr/tty.c, the erase character now echoes \b \b instead of itself, so the character really disappears. Then rebuild the kernel:

# chdir /usr/sys/dmr
# cc -c -O tty.c
# ar r ../lib2 tty.o
# chdir ../conf
# mkconf < myconf
# cc -c c.c
# as l.s
# ld -x a.out m40.o c.o ../lib1 ../lib2
# cp a.out /nunix
# sync
# sync
# sync

V6 has no .profile to run stty at every login, so I changed the defaults instead:

/usr/sys/tty.h: CERASE and CKILL to 010 (^H) and 025 (^U).
/usr/source/s1/getty.c: ERASE and KILL the same, because getty sets them on the line before it starts login.
/usr/source/s1/login.c: login switches echo off and on again around the password, and in doing so it put # and @ back. Now it keeps whatever getty set.

While I was at it, the shell learned cd. The V6 shell only knows chdir; in /usr/source/s2/sh.c that is one line:

if(equal(cp1, "chdir") || equal(cp1, "cd")) {

Compile with cc -s -n -O sh.c (-n gives pure text, so all running shells share the code). To install it, mv /bin/sh /bin/osh first and then copy the new one in: V6 won't overwrite a program that is running ("text busy"), but renaming it is fine.

The LA120

The LA120.

For the serial ports I use two USB-to-RS232 adapters with an FTDI FT232R chip; the first one is Waveshare's industrial model. I measured the pins with a multimeter to see which side was which (pin 2 sits at −5.2 V, so the adapter is wired as DCE) and soldered my own cables. A udev rule per adapter, matched on the FTDI serial number, gives fixed names, /dev/la120 and /dev/vt100:

SUBSYSTEM=="tty", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6001", ATTRS{serial}=="<serial>", SYMLINK+="la120", GROUP="dialout", MODE="0660"

In SIMH, the LA120 is line 7 of the emulated DC11:

att dci line=7,connect=/dev/la120;9600-8N1
! stty -F /dev/la120 ixon opost onlcr

Each line in that second command fixed something:

Symptom	Cause	Fix
Printer runs over after about 15 lines	The LA120 sends XON/XOFF, the host ignored ^S	`ixon`
No carriage returns, text comes out as a staircase	SIMH turns output processing off	`opost onlcr`
Settings gone after SIMH starts	SIMH sets the port when it attaches	the `! stty` right after the attach

The strangest problem was an endless loop of Line hangup. The V6 DC11 driver (/usr/sys/dmr/dc.c) doesn't know 9600 baud: its speed table has a 0 there, without the bit that keeps DTR up. When getty set the line to 9600, DTR dropped, SIMH saw a hangup, reset the line, and it started over. The fix is to let getty set 1200 baud instead:

#define B1200 9

and B1200, B1200 in getty's table '2'. The real speed on the wire is whatever SIMH says, 9600-8N1, so the printer still runs at 9600.

Still on the paper: a Line hangup, two failed logins and finally a shell.

The VT131

The VT131.

The VT131 went on the second adapter. The first test showed garbage, and after that, nothing: the terminal was still in LOCAL mode.

On my old Linux box the terminal had a login banner with DEC escape codes: "Login" in double-height letters (ESC #3 for the top half, ESC #4 for the bottom half), in reverse, bold and blinking. I wanted that on V6 too. On the Pi:

printf '\033[H\033[J\033[0m\r\n\033[7m\033[1m\033[5m\r\n\033#3 Login \r\n\033#4 Login \r\n\033[0m\r\nUnix V6 on a PDP-11/70\r\n\r\n' > /tmp/issue.v

That file went into V6 through the emulated paper tape reader, cp /dev/ppt /etc/issue.v: 82 bytes, the same as on the Pi. getty got a new table 'v' for the terminal and a few lines to print the file before login:. In /etc/ttys, the entry for line 6 became 16v, and the VT131 now shows its big blinking "Login" again, this time from Unix V6.

Retrotractor: A head gasket story on my MF133's Perkins A3.144 fixed with AI

Sun, 07 Dec 2025 00:00:00 +0000

In November 2025 my Massey Ferguson 133 started running badly. It had little power, idled roughly and felt like it was running on two of its three cylinders. There was no black or white smoke at no load, but when I switched it off, the exhaust made a strange sucking, blowing noise. This is how I found out what was wrong.

Which engine is it?

Before you can order a single part for an old tractor, you need to know what is in it. The MF133 has a three-cylinder Perkins diesel, but which one? When I first read up on compression tests, in June 2025, I called it an A3.152. Tractordata lists the 1969–1974 MF133 with an AD3.144. On forums people say the early French-built 133s had the A3.144. And the parts shops sell almost everything "for A3.144/A3.152", which doesn't narrow it down.

On the engine itself I found:

GKN1308 and J12-1 cast into the cylinder head;
covers over the injection chambers, and straight injectors;
inlet and exhaust manifolds on opposite sides of the head;
the head held down by 15 nuts on studs (more about those below).

The Perkins AD engines have direct injection. Mine injects into a chamber in the head, so it can't be an AD, which rules out tractordata's AD3.144. That leaves the A3.144 or the A3.152. What settled it is that mine is a French-built MF133, and those had the A3.144: three cylinders, 144 cubic inches.

Valves first

Rocker cover off.

The first suspect was the valve gear. With the rocker cover off I checked the clearances: 0.30 mm on all six valves, cold. I hadn't adjusted anything. Turning the engine over by hand, all rockers, pushrods and valves moved as they should.

Checking valve clearance with feeler gauges.

That doesn't clear the valves, though. A valve that is burnt, or doesn't seat, still shows a perfect clearance at the rocker; it just doesn't seal at the bottom. And the noise at shut-down pointed that way. Once the engine stops, the injection pump stops too, so a blowing noise in the exhaust can't come from an injector. It has to be air, getting past a valve that doesn't close.

Compression test

Compression test: the gauge sits in the injector hole while the starter cranks the engine.

The gauge screws into the injector hole: injectors out, gauge in, crank on the starter. Counting the cylinders from the radiator:

Cylinder	Compression
1	176 psi
2	150 psi
3	178 psi

Cylinder 2 was clearly down. Then I fed compressed air into the cylinders through the injector holes. On cylinders 1 and 2 I heard it hiss in the exhaust. For me that settled it: an exhaust valve that didn't seal, probably a burnt one.

The gauge, scaled in psi and bar.

A new head, or the old one?

With a bad valve the head had to come off anyway, so I looked at replacement heads. Several shops sell a complete head with valves for the A3.144 and A3.152 under the number ZZ80048. They are aftermarket parts, and I couldn't find out who makes them or how they are checked. The alternative was reconditioning my own head: new guides, new valves, lapping them in. Either way, the head had to come off first, so I could see what I was dealing with.

Stripped down to get at the head.

Testing the injectors

One of the three injectors.

With the injectors out, I wanted to test them too. I bought a VEVOR pop tester, a hand pump with a gauge. Its outlets are M14×1.5. The fuel inlet on these injectors is supposed to be a male 9/16"-18 UNF thread, so I expected to need an adapter. ChatGPT agreed, then looked at a photo and declared it "100% M14×1.5", then went back to UNF.

The two threads are close:

	M14×1.5	9/16"-18 UNF
Outside diameter	14.00 mm	14.29 mm
Pitch	1.50 mm	1.41 mm

I measured 14 mm across the thread, and an M14×1.5 nut screwed on perfectly. On a real 9/16"-18 thread it shouldn't: the pitches differ by 0.09 mm per turn. So either this tractor, where everything else is in inches, has metric injector inlets, or a metric nut runs on a UNF thread after all. I still don't know which.

The injector's fuel inlet.

On these injector pipes the thread doesn't seal anything. The pipe ends in a cone that presses into a cone seat in the injector; the nut only pulls it in. So the test line was just a short pipe with a cone and an M14×1.5 nut, and it simply fitted. If the inlet is UNF, that is a garage trick and purists should look away; either way, no adapter needed.

Test pipe with a cone end and an M14×1.5 nut.

It worked: the joint stayed dry. The injectors opened at around 2000 psi (about 140 bar), nothing leaked, and the pressure just stayed up. All three were fine.

An injector on the pop tester, connected with the M14×1.5 test pipe.

The head comes off

Rocker shaft off, ready to lift the head.

When the head finally came off, it wasn't the valves. The head gasket had burnt through between cylinders 1 and 2, the front one and the middle one: the same two that had hissed in the air test. That explains the hiss as well. Air pushed into one of them escaped through the gasket into the other, and out through its exhaust valve if that happened to be open. The valves were fine.

Head off, old gasket still on the block.

The burnt spot between cylinders 1 and 2.

The most likely cause is a broken thermostat, or the engine having run short of oil at some point.

Does the head need skimming?

The usual advice is to skim the head whenever it is off. I cleaned the head and the block with a razor blade, corrosion included. The corrosion was only around the water passages, and between the cylinders there was no pitting: both surfaces were smooth. ChatGPT's advice: with surfaces like that and a copper head gasket, which tolerates small imperfections, it could go back on without skimming. So it did.

Nuts and studs

The head is held down by 15 nuts on studs. ChatGPT spoke of head bolts and first told me 18 (three rows of six), then 11, "like most A3.144s". Only when I showed it a drawing with 15 did it agree; I counted, and mine has 15. For the torque I read 74.8–81.6 Nm (55–60 lbf·ft); ChatGPT gave 95 Nm for this head. As far as I remember, I went with the 95 Nm.

The other fasteners are a mix too. The exhaust manifold nuts take a 1/2" spanner, and the studs measure 7.9 mm: 5/16". The prechamber cap nuts take 9/16". Yet the Perkins part number for the manifold stud, 37781251, is a 3/8" UNF × 1 5/8" stud, and one supplier sells a single 3/8" UNF stud for both the exhaust and the prechambers. On an engine this old you measure before you order.

Back together

New gasket set, new coolant hoses and a new thermostat. The leak-off pipe was leaking too: the line from the injectors' leak-off back to the filter, with branches to the tank and to the heater plug. I replaced the T-piece in the middle with a compression T.

With the tank on the tractor I couldn't see the engine, so for the first runs it got a small improvised tank, mounted above the lift pump, with the return line running back into it.

The temporary tank.

After the first heat cycle the head nuts get re-torqued. I ran the engine up to temperature with the rocker cover off, let it cool down completely, and then went over the nuts in sequence, tightening each back to torque without slackening it first. ChatGPT first told me to loosen every nut and re-torque it, and changed its mind when I asked whether it was sure.

Running again, rocker cover still off.

It runs like a train again, as we say in Dutch.

A note on ChatGPT

I worked through all of this in chats with ChatGPT. That was useful for procedures and for thinking out loud. But it gave numbers with great confidence that changed as soon as I pushed back: 18, 11 and then 15 head bolts; the injector thread was UNF, then "100% M14×1.5" after a photo, then UNF again (I still don't know which one was right). The 15 I got by counting the nuts myself.

cosninix

Dracula rises again: my 1980 text adventure, rebuilt from the EXE

#Dracula, 1980

#An e-mail from Antwerp

#Getting the BASIC back

#1980 from the inside

#Two bugs that weren't mine

#And then in C

#Play it

Back to Unix V6, on a PiDP-11/70 with my own VT100 and LA120

#The PiDP-11

#Backspace on V6

#The LA120

#The VT131

Retrotractor: A head gasket story on my MF133's Perkins A3.144 fixed with AI

#Which engine is it?

#Valves first

#Compression test

#A new head, or the old one?

#Testing the injectors

#The head comes off

#Does the head need skimming?

#Nuts and studs

#Back together

#A note on ChatGPT