// HACKER NEWS — CYBERSECURITY
Show HN: Automatically detect and patch walking-dead states in Sierra games
Static analysis for 30-year-old adventure games. This tool decompiles a Sierra SCI game,
abstract-interprets the decompiled scripts into a graph of guarded room transitions, item
movements and plot-flag writes, finds the softlocks — states where the game still accepts
input but victory has quietly become impossible — and derives, verifies, compiles and installs
guards that prevent them. Nothing about any title is declared: the start room, the victory room,
the death signal and the debug flags are all discovered from the game's own code.
Sierra games, unlike LucasArts ones, let you get stuck. Forget the sunscreen in Los Angeles,
board the cruise ship, and you die days later on a raft with no way back. This finds these traps
automatically and blocks the crossing that causes them — at the last moment you can still comply.
Four games analyzed and play-tested — Leisure Suit Larry 2 (SCI0, 1988), King's Quest IV (SCI0, 1988), King's Quest VI (SCI1.1, 1992),
and Laura Bow 2 (SCI1.1, 1992) — same engine, no game-specific analysis code.
King's Quest IV, patched — the whale, the night clock and seven stranded items, all guarded:
Abridged from a real run on Leisure Suit Larry 2 (python3 -m pipeline ):
The analyzer discovered the ship boarding as a one-way crossing, derived which items must cross
with you, re-verified the guarded model to prove the guards introduce no new softlocks, and
recompiled the touched scripts into Sierra's own loose-patch format.
Note rm131 -> rm138: (not (gEgo has: 13)). Guards carry negative literals too: the Spinach Dip
is fatal to be holding in rm138, so the fix is to refuse the crossing while you still have it —
placed where you can still throw it overboard, because demanding you drop something you can no
longer drop is a wall, which this project treats as worse than the bug. The pipeline refuses to
emit anything if the guards fail verification, or if a script it edited will not compile.
A patched game plays normally — the patch mechanism is how Sierra shipped its own bug fixes, and
the originals are never modified (delete the patch files to revert). You can set the guard
behavior in-game: Full prevents every dangerous action; Lite prevents it once, then
allows it with a warning; Off turns the guards off.
Some deaths are deliberately left in — the ones you can still avoid from where you are. The
analysis distinguishes unwinnable states from avoidable deaths by reachability, not by death
conditions. In Leisure Suit Larry 2, walking onto the KGB beach without the full disguise kills
you. Some pieces of the disguise exist only on the cruise ship, so the analyzer refuses to let
you leave the ship without them. But the rest is obtainable on the island — from the very place
the death occurs — so that death stays in: it is how Sierra games hint at what you need to do.
As Al Lowe says, "Save Early, Save Often!"
Four games done, spanning the engine's two major eras (SCI0 1988 → SCI1.1 1992), with nothing
declared per title — start room, victory room, death signal and debug flags are all derived
from each game's own code.