Finding an Easter egg in Microsoft Bob

• April 23, 2021
• blog  
• Reverse Engineering  

Microsoft Bob was a graphical shell that installed on top of Windows to make it more user friendly and appealing to home users. Bob replaced the standard Program Manager / Explorer shell with a virtual home consisting of a number of rooms (eg. a living room) containing objects that represented applications (eg. a desk with pen and paper would represent a word processor). Bob introduced animated characters that helped to make the computing experience more social and friendly for people who hadn’t used computers before. It also included a set of home productivity applications to help you write letters, balance your home budget, and create lists to organise things.

Bob was not a big success. Despite the hype around the new “social interface”, it is estimated that only about 58,000 copies of Bob were sold. The product was soon discontinued but the animated character technology was integrated into Microsoft Office 97 as the Office Assistant. The technology was also made available to third-party software developers as Microsoft Agent, which led to the development of such virtual assistants as BonziBUDDY and, well… mostly just BonziBUDDY.

I was surprised to find that there didn’t seem to be any documented Easter egg in Bob. Microsoft loved putting Easter eggs in their products in the 90’s, so it was quite strange that Bob didn’t seem to have one. I decided to set out on an egg hunt to see what I could find.

Triaging the software

I started by installing Bob and having a look at what files are installed by default. Bob is a 16-bit application designed to run on top of Windows 3.1. Unfortunately, modern 64-bit Windows won’t run 16-bit executables unless you install a replacement for NTVDM such as WineVDM. I used VirtualBox to create a Windows XP virtual machine and install Bob in that instead. I could have just unpacked the big CAB file on the CD-ROM that holds all of the installed binaries, but then I wouldn’t have had the fun of actually using Bob.

Bob consists of executables for the main Bob shell and all of the applications, a lot of DLLs, and a bunch of Microsoft Access database files. Bob uses the Jet Red relational database to store application content and user settings. The DLLs included with Bob are a hodgepodge of early 90’s Microsoft technologies - OLE, Jet Red, Multimedia Viewer, WinG, as well as a bunch of custom libraries that provide the framework for Bob applications. The animated characters are stored in a custom file format, which has previously been reverse engineered and reimplemented in JavaScript in the aptly named Robert.js.

Many of the Bob applications are written in Visual Basic. This is an unusual choice - most multimedia software produced by Microsoft at the time was written in C/C++ or sometimes custom languages. This is good for reverse engineering though: early versions of Visual Basic compiled applications to a bytecode called P-Code instead of native code. P-Code can be decompiled to a somewhat-human-readable approximation of VB source code. The result is roughly similar to decompiling executables with Ghidra or the Hex-Rays Decompiler - you can recover the control flow but are still missing a lot of symbolic information.

Finding the Easter egg

I started my Easter egg hunt by running strings over all of the files installed by Bob. Strings are the one part of the executable that is human-readable, so it makes sense to check them first before trying to disassemble any code. I figured that most Microsoft product Easter eggs generally had a credits screen, so I searched all of the strings for “Credit”. This found quite a few strings: one of the applications bundled with Bob is the Bob Financial Guide, a home finance application which has a lot of strings related to credit cards. The finance app also includes a bunch of reference documentation to help you manage your finances. Remember that Bob was released before most homes had computers with internet access, so you couldn’t just Google “what is a credit limit” like you can now.

One of the strings looked pretty interesting: “Credit screen”, which was adjacent to the curious phrase “Rover’s Awesome All-Stars”. Rover was the name of the default animated dog character in Bob. The string was found in FINANCE.MDB, the Access database for the finance app. I searched the file for the phrase and found it was near some other strings that definitely indicated some kind of credits screen: “Developers”, “Program Managers”, “Testers”, “Marketers” and “Support”.

I decided to open up the Access database to see what was inside. Modern versions of Access refuse to open databases that were created with old versions, so I dusted off an old copy of Office 97. Sure enough, the database contained a table called “Rover’s Awesome All-Stars”, containing a list of people who worked on Microsoft Bob.

Finding the trigger

I suspected there would probably be a way to access the credits from within Bob, so I continued to investigate. I searched the executables and DLLs for references to the string “Rover’s Awesome All-Stars”. There was a single reference inside NOTEBOOK.EXE, the executable that contains the Bob Financial Guide.

Usually at this point I would open up Ghidra or IDA, find the string, and then start following cross-references to it. However, as the executable is written in Visual Basic, I thought I would try out a VB decompiler. There were a lot of errors about custom VBX controls but it did manage to extract the forms and generate VB code.

I grepped the decompiler output for “Rover’s Awesome All-Stars” and found a reference in the generated LISTNAME.BAS file. One of the methods appeared to be an event handler for a button called “btnNext”. This method appears to handle prompting the user for the name of a new list. Right at the start of the method is code that checks if the user’s string matches the magic string, and if it does, a table of the same name will be read from the database. This looked like the trigger for the Easter egg!

So, after going undiscovered for about 26 years, here is how you can access the hidden credits in Microsoft Bob:

1. Open the Bob Financial Guide
2. Click any of the options
3. When asked, click the option to create a new list
4. Enter “Rover’s Awesome All-Stars” and click Next

Here’s a video of the Easter egg in action:

Like the rest of Microsoft Bob, this Easter egg is a little underwhelming… it’s no pinball game, flight simulator, or video interview with the developers, but it’s still pretty cool to find it after all this time!