Analysis model: GPT-5 (Codex), reasoning level not exposed

Silent Shadow Cracktro by Razor 1911 and Skillion - Technical Dissection

Silent Shadow Cracktro is a small MS-DOS VGA cracktro / intro by Razor 1911 and Skillion. Pouet lists it as a November 1990 MS-DOS cracktro. Demozoo lists the production as released in 1991 and credits Bella Besti for the crack code, Coyote for supply, Darwin for intro code, and Sector 9 for graphics. The preserved primary executable in the Scene.org ZIP is timestamped 12 June 1991, so this article records the date conflict instead of flattening it into a single certain year.

Release year: 1990 / 1991

This pass is based on the Scene.org archive, cached Pouet and Demozoo catalogue pages, direct DOSBox-X runtime capture, static COM disassembly, string-offset inspection, and a reconstructed read of the intro's RLE picture streams. No demo audio was made audible. The published MP4 is video-only.

Contact-material boundary: the full intro quickly reaches old postal / BBS / phone contact material. The published runtime excerpt stops before that section, and this article records only the file-offset boundaries of those blocks without reproducing the contact text.

Sources

• Pouet production page: https://www.pouet.net/prod.php?which=5479
• Demozoo production page: https://demozoo.org/productions/139116/
• Scene.org file page: https://files.scene.org/view/demos/compilations/lost_found_and_more/cracktro/silent_shadow_cracktro.zip

The Demozoo page includes a transcription of period contact text. That historical material is useful for identifying the production, but it is not reproduced here.

Archive And Payloads

Examined ZIP:

silent_shadow_cracktro.zip  23,992 bytes
SHA-256: 5a6bceb982e63888f042af7489818d4e088ec482a6f0df64a1323c636489d6cf

Archive contents:

file(1) calls RSINTRO.COM plain data because the first bytes do not match a modern executable signature, but it is an ordinary COM image loaded at CS:0100h. The first instructions set a private stack, copy CS into DS and ES, call the intro body, restore text mode 03h, and exit through DOS.

RAZOR01.COM contains a visible PKLITE copyright string and has a much later archive timestamp. I did not use it as the primary executable evidence for this pass.

Direct Runtime Capture

The direct run used DOSBox-X 2026.01.02 on 21 July 2026 with machine=svga_s3, cycles=fixed 8000, SDL dummy audio, nosound=true, Sound Blaster disabled, GUS disabled, PC speaker disabled, and no MIDI device.

The raw DOSBox-X MPEG-TS capture is 24.775689 seconds long, 4,456,448 bytes, and contains DOSBox-X's internal AAC stream despite the muted configuration:

capture/silent-shadow-razor/headless-captures/rsintro_000.mts
duration: 24.775689 s
video:    H.264, 640x400
audio:    AAC stream present in raw capture
SHA-256:  3f5aec82db434ec45f3af3dcda6a9746f3f684b4c0f6a2d0072c592aab0080f0

The raw capture continues into contact material. The site MP4 is therefore a short early excerpt, transcoded from the video stream only and cut before that section:

videos/silent-shadow-razor-runtime-excerpt-silent.mp4
duration: 4.050000 s
video:    H.264, 640x480, 60 fps
audio:    no audio stream
size:     70,092 bytes
SHA-256:  a9e06f667c6841e9a185251fdfa638a7124d3192ae9bff021ac55183534e6143

Selected direct frames:

At 00:01, the top Razor logo and bottom Skillion logo are stable, with the small top-line release phrase beginning between them.

At 00:03, the large center scroller is in the initial group-title phase. Later frames are not used publicly because the contact scroller begins almost immediately after this safe opening.

COM Memory Map

RSINTRO.COM is a flat COM image. File offset 0000h becomes COM memory address 0100h.

The contact-bearing text blocks are inside the text/control area. The main ones start around file offsets 0852h, 092Ah, and 0D2Fh. Those ranges are why the public runtime excerpt stops so early.

Startup And VGA Gate

The entry sequence is short and direct:

0100  mov bx,1296h
0103  dec bx
0104  mov sp,bx
0106  push cs
0107  push cs
0108  pop ds
0109  pop es
010A  call 0117h
010D  mov ax,0003h
0110  int 10h
0112  mov ax,4C00h
0115  int 21h

The body first calls the VGA check at 0487h. That routine invokes INT 10h AX=1B00h with ES:DI pointing to a 64-byte buffer. If the state buffer does not get populated, the intro switches to text mode, prints a short "no VGA" message, loops until a keypress, restores text mode again, and exits.

On the DOSBox-X svga_s3 route the probe succeeds. The program continues into mode 13h, so the visible path is a 320x200 256-colour VGA screen displayed through the capture as a 640x400 stream and published at 640x480 for 4:3 aspect.

RLE Picture Pages And Palette

The setup routine at 01C7h treats the code/data area after 1296h as two compressed page spans:

first page span:   COM 1296h, file 1196h, nominal span 1AC0h bytes
second page span:  COM 2D56h, file 2C56h, nominal span 5B8Eh bytes
expanded size:     FA00h bytes each, exactly 320 * 200 pixels

The expander at 0460h is a compact PackBits-like loop:

• a byte with high bit clear copies n + 1 literal bytes from the stream;
• a byte with high bit set repeats the following byte 256 - n + 1 times;
• DX tracks the remaining output byte count and stops at FA00h.

Reconstructed expansion results:

first RLE page:
  compressed span: 6,848 bytes
  consumed stream: 6,767 bytes
  output:          64,000 bytes
  output SHA-256:  4696a2eedbdf8f55af8e6dbda8105255af22d1ed24f0342a4e629e78ef695e29

second RLE page:
  compressed span: 23,438 bytes
  consumed stream: 23,438 bytes
  output:          64,000 bytes
  output SHA-256:  f1646e2f4420eae973a17fdaacf722eac2296c985c443742d008e0b05538330f

The first page's nominal span is slightly larger than the bytes consumed by the expander before the 64,000-byte target is reached. The second page consumes its full span. This explains the archive shape: almost all of the 34,788-byte COM is data, not code.

After the pages are expanded, the code sets 39 DAC entries with INT 10h AX=1012h, using the table at 1021h, then copies the first expanded page to A000:0000. That page supplies the static Razor / Skillion logo frame visible in the capture.

Scrollers And Frame Loop

The live frame loop at 0123h..0139h has this practical shape:

enable interrupts
wait for vertical retrace
copy / preserve the current screen band
advance the small top text writer
copy the prepared strip into the visible screen area
advance the large center scroller
poll keyboard with INT 16h AH=01h
repeat until a key is waiting

The retrace wait is the classic VGA status-port loop:

03BA  mov dx,03DAh
03BD  in  al,dx
03BE  test al,08h
03C0  je  03BDh

The small red top-line text is advanced by the routine at 0326h. It keeps a source pointer at 06F2h, a destination pointer at 06F4h, draws one 8-pixel-wide character at a time through the BIOS-font renderer, and has a short pause state when it reaches a control byte.

The large orange center scroller uses a separate control stream beginning at 0811h. Printable bytes become glyph draws through the routine at 026Fh. Control byte 00h wraps the scroller pointer, and control byte 01h updates the per-character width used for the next glyphs. The draw routine builds a 32-pixel-high glyph strip from the second expanded page and scrolls that strip through the middle of the display. The visible result is the slow, chunky Razor / Skillion title crawl seen in the public excerpt.

The exit gate is not timed. Any pending key makes INT 16h AH=01h return non-zero, the body returns to the entry wrapper, the wrapper restores text mode 03h, and the process exits through INT 21h AX=4C00h.

Technical Read

Silent Shadow Cracktro is small, but it is not just a static card:

• it has a real VGA capability branch and a text-mode fallback;
• it uses two custom RLE-compressed 320x200 picture pages;
• it installs a 39-entry DAC palette before copying the static logo page;
• it renders both a small top-line writer and a large center scroller at runtime;
• it paces the loop on VGA vertical retrace and exits cleanly on keyboard presence;
• the compressed image payloads dominate the COM size, while the executable control code is only the front part of the file.

The public media is intentionally short because the scroller reaches period contact data almost immediately. The technical evidence still covers the archive boundary, the flat COM layout, VGA probing, RLE expansion, palette installation, logo-page copy, dual-scroller runtime, retrace pacing, and exit path.