Everquest-Decomp-Recomp/docs/MATCHING.md

Matching notes (MSVC 7.1, eqgame.exe)

These are things learned while matching. Each one changes the generated bytes.

Translation units matter

• MSVC 7.1 compiles a .cpp's functions callee-first and remembers which registers each callee clobbers. Calls to a callee in the same file can skip reloads (ecx, …) or use add esp,4 instead of pop ecx. Calls to a callee in another file assume the worst.
  • Example: 0x401bb1 only matches when GetSpellByID (0x401b28) is in a different file, even though the two are adjacent in .text.
  • Example (EQPlayer): 0x480130 only matches when EQPlayer::HairType (0x47a523) is defined in the same file.
• So callers and callees tell you where file boundaries are. Own whole files, not address ranges.
• Inline/template functions (header code) are placed by the linker in the first object that emitted them. Put them in include/ with annotations; any object may emit them.

Finding file boundaries

Every game .cpp includes a header with a static const int[5] = {2000, 2500, 3000, 4000, 10000}, so each object's .rdata starts with that table: 261 of them. python3 tools/eq.py tus writes config/eqgame/tus.txt, which maps each block to the code that references its strings and vtables. Read CODE_LO as where the file starts, and the end as the next file's start. Shared constants and pooled literals (/GF) are filtered out, but treat the estimate as a hint and confirm it with the register-usage rule above.

Flags

Global: /O1 /MT /GX /GS /Gy. /MT matters: without _MT, Dinkumware's locale/stream code compiles without locks and STL instances don't match.

Template and compiler-generated instances

Write the real STL usage (e.g. std::list<Record> with push_back, remove, sort) and let MSVC emit the instances. Then python3 tools/eq.py pair src/eqgame/X.cpp --range 0xSTART-0xEND --write appends // FUNCTION: / // LIBRARY: annotations for every compiled function with a unique byte match in the range. It checks relocations to tell ICF-folded twins apart, and std:: members become LIBRARY.

Code generation clues

Original shows	Source had
and dword ptr [x],0, push 0x6; pop eax, pop ecx after cdecl calls	/O1 (global flag)
mov eax,cookie … call @__security_check_cookie@4	/GS with a char buffer (global flag)
mov eax,handler; call __EH_prolog	EH frame under /O1: an object with a dtor, or new of a class with a ctor
delete[] calls 0x60d682 rather than 0x60d0d5	#include <new> (declares operator delete[])
only a vptr store, no mov eax,ecx	a destructor; a ctor returns this
vptr of the derived class only, no base vptr store	base class is __declspec(novtable)
ret N but ecx never read	a member function that doesn't use this
push ebp; mov ebp,esp in a small function, param slot reused for a local	member function taking the address of a local/param; let MSVC coalesce, don't fake it
member store order differs from declaration order	assign in the body, not the init list
a std::string temporary lands in a different stack slot	construct from const char* directly (istringstream in(p)), let the conversion make the temp
a small local shares a slot with a dead one	the local is smaller than you think, e.g. a 4-byte event base struct, not the 12-byte derived one
a bool result kept in bl across two returns	those returns return a variable, the others a constant
an if/else whose tails merge after a hoisted load	write the else branch explicitly rather than a fall-through if (!x) x = …
two jmp-only functions in a row (jmp Reset)	out-of-line copies of inline dtors, used by EH unwind funclets

Library code

python3 tools/eq.py libscan tools/probes/stl.cpp --apply marks copies of Dinkumware STL instances as lib. They need no decompiling, because any file that includes the same headers and uses the same types emits them. A probe function only counts if every callee is itself library code. That stops game classes' deleting destructors (same bytes, different callee) from being misclassified.

Some std::basic_stringbuf members (e.g. seekoff at 0x40224b) differ from the probe's copy in register allocation. Most likely the same-file callee effect above, so the probe's surrounding code matters. These are still listed as fn.