# A privileged instruction under Wine, from a Windows 95 port probe

## Symptoms

The game stops at once with "A privileged instruction was executed at ADDRESS". The exception
code is `0xc0000096` (`EXCEPTION_PRIV_INSTRUCTION`).

## Cause

Windows 95 let a program read and write hardware ports with `in` and `out`, and run `cli` and
`sti`. Windows NT and Wine do not. Many games of 1995 to 1998 probed the CPU this way. POD reads
the Cyrix configuration registers through ports `0x22` and `0x23` (*observed*). Other probes
read the timer at ports `0x40` to `0x43`, the joystick at `0x201` and a Sound Blaster at `0x220`.

## Evidence

The address in the message is the address of the instruction. Disassemble it, or list every
port instruction of the program with `insns`.

## What to do

Patch the probe in a copy of the program so it returns the answer a modern CPU would give,
without running the port instruction. For a Cyrix probe that is "not a Cyrix" (POD's routine
returns `0xff`).

1. `./gameframe run insns game/GAME.EXE '^(in|out|ins|outs|cli|sti)' --functions analysis/export/functions.tsv`
   lists every such instruction and its function. Do this before the first run of any
   Windows 9x game, so every probe is known.
2. Find what the function's callers expect, and return that from the function's start.
3. Write the patch as a script that checks the original bytes first, and record it as a
   Deviation. Never change the player's own file.