Pushover Protection Format

THEMES/THEME.DAT is an encrypted real-mode x86 copy-protection payload used by Pushover. Despite its location and name, it contains no theme graphics. It is not RNC-compressed.

File format

The examined file is 7025 bytes. Decrypt every byte using a 15-bit Fibonacci LFSR seeded with 0x0ACE. Advance the state before using its low byte:

state = 0x0ACE
for each byte:
    feedback = (state & 1) ^ ((state >> 1) & 1)
    state = (state >> 1) | (feedback << 14)
    output = input XOR (state & 0xFF)

The same operation encrypts and decrypts. This cipher is distinct from RNC's 0x1984 literal-run key.

The result contains executable disk-media checks. Research identifies DOS media descriptor comparisons against 0xFD and 0xF9 and a protection canary involving 0x8035. Gameplay later checks the canary, producing a delayed failure rather than necessarily refusing at startup. There is no established image, tile or music structure inside this file.

Notes

The repository includes a decrypted research dump, but no general theme-data parser because this is executable protection code. The relationship between the P00000 screen and protection failure remains a separate hypothesis.

Source code

From pushover, the open-source browser port and its reverse-engineering notes:

• docs/formats/theme-dat.md – reverse-engineering documentation
• docs/re-notes/function-renames.md – named loader and protection routines

Credits

This file format was reverse engineered by VorticonCmdr. If you find this information helpful in a project you're working on, please give credit where credit is due. (A link back to this wiki would be nice too!)