Extracting music from EMFINTRO

In October of 1991, a demo group called EMF released a small intro called ‘EMFINTRO’:


It was one of the first demos I remember seeing. This little gem featured excellent music by Purple Motion. The audio was generated through a DIY digital-to-analog converter made up of resistors connected to the parallel printer port of my PC. This crude music system was called a COVOX. At the time, it was a major step up from the beep-only speaker and I didn’t have a Soundblaster.

I always wanted to have the tracker module of the music but was never able to find it. Today I decided to try and extract the module from the executable.

First I downloaded and installed DOSBox and ran the intro. It worked and played the soundtrack through an emulated Soundblaster! Hoping for an easy score, I ran several module extractor programs on the executable. No luck there! The executable was compressed using PKLite, a popular exe-packer at the time.

Of course, this wasn’t a new problem. People developed tools to decompress the executables ever since PKLite was invented. Unfortunately, the EMF coders messed with the headers because none of the 7 tools I tried would unpack it. Some did nothing, some crashed DOSBox, still others didn’t recognise the PKLite version. So far for the easy way out…

It turns out that DOSBox has a version with a built-in debugger! So, I ran EMFINTRO and halted the simulated CPU by entering debug mode at the sound setup screen, hoping that the executable had decompressed itself completely in memory. Using the debugger, I dumped the entire 640K memory into a binary file and opened it up in a HEX viewer:


Succes! The executable has unpacked itself into memory. Now to search for the module..

Again, I ran module extraction software on the dumped binary file. No luck. It is either in a format that the tools don’t recognize, or it’s in a proprietary format. So I started searching for things that looked like a module; it’s surprising what you can find just by looking at the ASCII representation:


Bingo! There’s Purple Motion’s signature (PM) and a tracker name that I recognize: ScreamTracker. However, I’ve never seen this particular ‘!Scream!’ ID tag before. A bit of Googling revealed this to be a ScreamTracker 2 signature. I also found an example of a valid ScreamTracker 2 module (.STM) file and found out there should be 19 bytes containing the module name before the ‘!Scream!’ ID tag.

Knowing that module players generally don’t care how long the module file is; they’ll load only the bits they need, I had enough information to dump the tracker module.

Luckily there are still copies of ScreamTracker 2 on the internet! So, I downloaded it and installed it in DOSBox. Loading the dumped module into ST2 worked like a charm! It played it just like the intro itself!

To cut off the excess bytes of the original dump, I used ST2’s ‘save module’ to write the module to disk. Hey Presto! A 69Kb STM module appeared on my harddrive.

As a final test, I opened the module in OpenMPT, a modern module player. There are some differences in the way OpenMPT plays it. The channels are not panned correctly; something that is easy to fix. As an added bonus, I saved the module in ScreamTracker 3 format as this is more widely supported and has fewer playback bugs. Even good old WinAMP plays S3Ms more or less correctly but fails miserably playing the STM version.

I’ve submitted the STM and S3M versions to the Mod Archive. Or listen to it on SoundCloud.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s