Where in the code is Carmen Sandiego? Eeer..., where is that damn 1E device scan limit - for the technically triggered ones...
009037: 56 push esi 009038: 68F80C0000 push 000000CF8 00903D: 6A00 push 000 00903F: E84994FFFF call 00000248D 009044: 83C40C add esp,00C 009047: 68FE0C0000 push 000000CFE 00904C: 6A00 push 000 00904E: E8AF92FFFF call 000002302 009053: 83C408 add esp,008 009056: A880 test al,080 ;"€" 009058: 753C jne 000009096 00905A: 81042400080000 add d,[esp],000000800 009061: FF442414 inc d,[esp][00014] 009065: 8044241808 add b,[esp][00018],008 00906A: 837C24141E cmp d,[esp][00014],01E 00906F: 0F8642FFFFFF jbe 000008FB7 009075: FF442404 inc d,[esp][00004] 009079: 66FF44240A inc w,[esp][0000A] 00907E: 817C2404FF000000 cmp d,[esp][00004],0000000FF 009086: 0F8604FFFFFF jbe 000008F90 00908C: 31C0 xor eax,eax 00908E: 83C420 add esp,020 ;" " 009091: 5D pop ebpChange 1E to 1F at position 906Eh (36974 decimal) with your favourite disk editor, or use "poke": POKE.EXE NBI.NLM 36974 1F
007C73: 8B442408 mov eax,[esp][00008] 007C77: 0D00000080 or eax,080000000 007C7C: C744241400000000 mov d,[esp][00014],000000000 007C84: 8944240C mov [esp][0000C],eax 007C88: 8A442414 mov al,[esp][00014] 007C8C: C0E003 shl al,003 007C8F: C7042400000000 mov d,[esp],000000000 007C96: 88442418 mov [esp][00018],al 007C9A: EB17 jmps 000007CB3 007C9C: 81042400080000 add d,[esp],000000800 007CA3: FF442414 inc d,[esp][00014] 007CA7: 8044241808 add b,[esp][00018],008 007CAC: 837C24141E cmp d,[esp][00014],01E 007CB1: 77A9 ja 000007C5C 007CB3: C744241000000000 mov d,[esp][00010],000000000 007CBB: 8A442418 mov al,[esp][00018] 007CBF: 8B2C24 mov ebp,[esp] 007CC2: 31FF xor edi,edi 007CC4: 8844241C mov [esp][0001C],al 007CC8: EB11 jmps 000007CDB 007CCA: FF442410 inc d,[esp][00010] 007CCE: 81C700010000 add edi,000000100 007CD4: 837C241007 cmp d,[esp][00010],007Change 1E to 1F at position 7CB0h (31920 decimal) with your favourite disk editor, or use "poke": POKE.EXE NBI.NLM 31920 1F