MicroslopSam/docs/NOTES.md

Notes

Registry facts

From spchapi/SPCHAPI.INF (%49000% = %25%\speech = C:\windows\speech):

• CLSID_TTSEnumerator {D67C0280-C743-11cd-80E5-00AA003E4B50} -> Speech.dll
• "Audio Destination to File Object" {D4623720-E4B9-11cf-8D56-00A0C9034A7E} -> Speech.dll
• "Audio Destination Object" {CB96B400-C743-11cd-80E5-00AA003E4B50} -> Speech.dll
• Lexicon dialog {92655FB1-ADF9-11d1-BEB9-006008317CE8} -> Speech.dll
• Phoneme converter {B9F11A96-90E3-11d0-8D77-00A0C9034A7E} -> Speech.dll

From msttsl/mstts.inf ([TTSReg]):

• Engine MSTTSSyn = {E0725551-286F-11d0-8E73-00A0C9083363} -> MSTTSSYN.dll
• Engine install dir: Common Files\microsoft shared\SpeechEngines\TTS.
• Enumerates voices by scanning *.vce in its own directory.

Flextalk registration (from the installer's setup.ins)

• Engine value: HKLM\Software\Voice\TextToSpeech\Engine "AT&T FlexTalk" = "{FFE78E00-C69C-11CE-AEC1-0000C0E9CB87}"
• Engine subkey (forces mode enumeration): ...\Engine\{FFE78E00-...} with Dirty = 1 (REG_DWORD). The runtime rewrites Count + Mode0..N and clears Dirty after enumerating.
• HKCR\CLSID\{FFE78E00-C69C-11CE-AEC1-0000C0E9CB87}\InprocServer32 = <root>\EngineDLLs\FlexTalk.dll, ThreadingModel = Apartment. Also registered: {778EAAE2-499F-11CF-B0BA-444553540000} -> same DLL.
• Directories: HKLM\Software\AT&T\Watson\2.0\FlexTalk\2.0\Directories RootDirectory = C:\FlexTalk\.
• Dictionaries: ...\FlexTalk\2.0\Dictionaries: StandardDictionary="2 ft_sdict.dll", ExceptionDictionary="0 ft_udict.dll", HomographDictionary="1 ft_hgrap.dll", ProperNameDictionary="3 ft_namsa.dll", LetterToSoundDictionary="4 ft_l2s.dll".
• Options: ...\FlexTalk\2.0\Options Gender=Male, SampleRate=11025.
• Speakers (per-voice settings; names come from these values):
  • {11260610-C84A-11ce-AEC4-0000C0E9CB87}: Mode Name / Speaker Name "Keith Bell", Pitch 27, Speaking Rate 33, Head Size 46, Expression 59, Lowering 40, Prominences 17, Age 30, Volume 100.
  • {000031CB-3699-551F-AED0-6B4893382D57}: "Kerry Watson", Pitch 65, Speaking Rate 32, Head Size 45, Expression 100, Lowering 40, Prominences 17, Age 30, Volume 100.
• Voice data: EngineData\AE1M08LC.*, AE1M11LC.* (male, 8/11 kHz) and AE2F08LC.*, AE2F11LC.* (female); .INV inventory, .NDX index, .COD codebook, plus shared DICT_CI.*, phondef, AMPRULES, ENDINGS.

Extraction: unshield -O -d extracted x installer/flextalk/data1.cab (-O = old compression; the archive.org package has no data2.cab, so the final file WatsonUNInstall.dll is incomplete).

SAPI4 runtime engine discovery (speech.dll)

• FUN_635747a4 reads HKLM\Software\Voice\TextToSpeech\Engine values (value name = engine name, data = CLSID string), validates the GUID with FUN_635712e4, then opens a subkey named by the CLSID string.
• FUN_635758b1 (TTS mode-list ctor) reads Dirty; when non-zero/missing it calls CoCreateInstance(CLSID, ..., IID @635791c0) and pulls modes via vtable+0xC into 0xaf0-byte records, writes Mode%d (REG_BINARY), Count, then clears Dirty. When Dirty=0 it reads the cached Mode%d blobs.
• Practical rule: to add an engine, register the Engine value + the CLSID InprocServer32 + an engine subkey with Dirty=1 (a missing subkey also triggers enumeration).

Environment gotchas

• Wine needs a working X display (the runtime creates windows). xvfb-run -a proved flaky here; setup/run.sh starts a persistent Xvfb :77 instead.
• Wine reports err:ole:apartment_add_dll couldn't load in-process dll when the InprocServer32 path does not exist. Check the file copy first (this bit us: a bad unshield run created empty directories).
• 32-bit engines require a 32-bit prefix (WINEARCH=win32).
• sudo on this machine requires a password; installs are manual.

Decompiled corpora (Ghidra)

• /mnt/ghidra/decomp/msttssyn.dll/ (786 functions, engine)
• /mnt/ghidra/decomp/speech.dll/ (1030 functions, SAPI4 runtime)