0x401b28 returns EQPlayer* from the 3000-entry spawn table (callers in
EQPlayer::Die etc. use it as a spawn). ~EQString is an inline header
function; 0x4482fb is its out-of-line copy, which compiler-generated
destructors call instead of inlining.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Each game object's .rdata starts with a header's static int[5]
{2000,2500,3000,4000,10000}: 261 blocks. config/eqgame/tus.txt maps
each block to the code referencing its own (non-pooled) strings and vtables.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
CAssetList reads one entry per line; CHR,<prefix>,<name> lines become
character-model entries. Base class is __declspec(novtable). Fixed EQString:
0x571f70 is operator=(const EQString&), 0x571fc0 operator=(const char*),
0x572300 c_str(). 5 of 7 functions match; ctor 0x40515e and Load 0x4051cd are
NONMATCHING (register/scheduling only).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PROGRESSION/BRANCH/TEMPLATE parser over std::istringstream into nested
std::lists; 1.6 KB of parser code plus ~100 STL instances byte-exact.
ReadKeyword is NONMATCHING (block layout).
Findings: the client was compiled with /MT (Dinkumware locking code differs
without _MT). Tools: diff disassembles compiled bytes directly; pair
auto-annotates template/compiler-generated instances by unique byte match,
classifying std:: members as LIBRARY via undname and checking relocations
to tell ICF-folded twins apart.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
GetSpellByID only matches its caller when it lives in a separate file: MSVC 7.1
tracks callee register use within a translation unit, so TU boundaries show
up in the generated code. docs/MATCHING.md collects these lessons.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Compile a probe of common Dinkumware instantiations and find byte-identical
copies in .text (relocations masked; every callee must itself be library/CRT
code). 255 functions reclassified from fn to lib. Known gap: some stringbuf
members (e.g. seekoff 0x40224b) differ slightly from the probe and remain fn.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
CChunkedArray<T>/CRefPtr<T> instances, vector-deleting dtors and implicit dtors
kept by the linker from this object (0x4016c5-0x40198e), plus EQString::~EQString
(0x4482fb). The original included <new>: delete[] goes to operator delete[].
Tools: header annotations resolve against every object, build tracks headers,
check --inline lists template/inline instances. 41 MATCH, 1 NONMATCHING.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Rename identifiers that came from third-party offset headers to neutral names
(only CDisplay and StringTable are proven by the binary's own strings).
Annotate the four in-class virtual bodies (0x401430-0x401450); all match.
Totals: 25 MATCH, 1 NONMATCHING.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
21 of 22 functions byte-exact; ShowSpent is NONMATCHING (memory-operand reload).
Base CMerchantCurrency is __declspec(novtable); its default slots are shared
one-line stubs, so the original link used /OPT:ICF.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Drop the names taken from an external offset header (functions and
globals), keeping only names the binary itself proves: _WinMain@16 from
the CRT entry call, and Class::Method names from the client's own log
strings. The six functions Ghidra missed stay in the map under neutral
FUN_ names, justified by vtable/pointer references. NAMES.md, README
and ROADMAP no longer point at third-party offset lists.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- // FUNCTION: / GLOBAL: / LIBRARY: annotations in source name symbols, so
decompiling never needs edits to the shared symbols.txt
- check follows compiler-generated EH handlers into .text$x and verifies
string literals / float constants by content
- link rebuilds eqgame.exe from compiled objects with relocations resolved
through the map and checks the SHA1 (currently identical)
- Ghidra pseudo-C export script; docs/ROADMAP.md for the full-relink plan
- /GS confirmed; 0x401022-0x4013e1 (13 functions, spell casting particle
points) match byte-for-byte
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Seed names from the MacroQuest2 eqgame.h for the Oct 31 2005 10:33:37 build
(version-string address matches this binary), validated against function
starts, plus names proven by self-referencing log strings. Sources,
confidence and unconfirmed candidates in config/eqgame/NAMES.md.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
MSVC 7.1 (cl 13.10.3077) under Wine, PE/COFF matcher with relocation
verification, side-by-side diff, progress, Ghidra-seeded symbol map
(15,323 functions), and the first three matched functions (/O1).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
SalastilandClaude Opus 5.5