refactor: use FullTeamBlock structs in team/weapon hooks, add F9 dump hotkey

Refactor team.rs and weapon.rs replacements to use WormEntry and
FullTeamBlock struct field access instead of raw pointer arithmetic.
Rename HasFullHealthWorm → CheckWormState0x64 (reads state, not health).
Add named worm state constants (IDLE=0x65, ACTIVE=0x67, DEAD=0x87).
Add F9 hotkey to validator for on-demand team block dumps.
Cross-validate struct access against old raw pointer patterns (8/8 pass).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

crates/openwa-types/src/address.rs

@@ -144,9 +144,10 @@ pub mod va {
     /// Reads worm X,Y position into output pointers.
     /// usercall(EAX=team_index, ECX=worm_index, [ESP+4]=base, [ESP+8]=&x, [ESP+C]=&y), RET 0xC.
     pub const GET_WORM_POSITION: u32 = 0x0052_2700;
-    /// Checks if any team has a worm at full health (100). 11 xrefs.
+    /// Checks if any worm has state 0x64 (100). 11 xrefs in gameplay code.
+    /// Despite the comparison to 100, reads worms[].state NOT .health.
     /// usercall(EAX=base) → EAX=bool, plain RET.
-    pub const HAS_FULL_HEALTH_WORM: u32 = 0x0052_28D0;
+    pub const CHECK_WORM_STATE_0X64: u32 = 0x0052_28D0;
 
     // === Graphics / rendering ===
 

crates/openwa-types/src/ddgame.rs

@@ -119,6 +119,19 @@ pub mod offsets {
     /// GetAmmo/AddAmmo/SubtractAmmo.
     pub const TEAM_WEAPON_STATE: usize = 0x4628;
 
+    // === Team block array (7 × FullTeamBlock, stride 0x51C) ===
+    /// Start of team block array within DDGame (7 blocks, stride 0x51C).
+    /// Derived: entry_ptr(team=0) - 0x598 = 0x4628 - 0x598 = 0x4090.
+    /// Runtime-confirmed: block[0] is zeroed preamble, blocks[1-6] hold team data.
+    pub const TEAM_BLOCKS: usize = 0x4090;
+
+    /// Byte offset from TeamWeaponState base back to FullTeamBlock array start.
+    /// `blocks_ptr = (tws_base as *const u8).sub(TWS_TO_BLOCKS) as *const FullTeamBlock`
+    ///
+    /// entry_ptr(0) = DDGame+0x4628 = TEAM_BLOCKS + 0x598.
+    /// 0x598 = sizeof(FullTeamBlock) + 0x7C = one block + offset into sentinel worm[0].
+    pub const TWS_TO_BLOCKS: usize = 0x598;
+
     // === FUN_00526120 init offsets (stride 0x194, 10 entries) ===
     pub const INIT_TABLE_BASE: usize = 0x379C;
     pub const INIT_TABLE_STRIDE: usize = 0x194;
@@ -156,6 +169,106 @@ pub struct TeamEntry {
 
 const _: () = assert!(core::mem::size_of::<TeamEntry>() == 0x51C);
 
+// ============================================================
+// Per-worm and per-team block structs
+// ============================================================
+
+/// Per-worm data entry (0x9C bytes, stride between consecutive worms).
+///
+/// 8 slots per team. Slot 0 is a sentinel/header (team metadata), slots 1-7
+/// hold playable worm data. GetTeamTotalHealth iterates starting from slot 1.
+///
+/// Field offsets confirmed by runtime memory dump (validator DLL):
+/// - state at 0x00: 0x67 = active/selected, 0x65 = idle, 0x80+ = special
+/// - active_flag at 0x0C: 1 for alive worms
+/// - max_health at 0x58: initial health value (100)
+/// - health at 0x5C: current health (100 = full)
+/// - name at 0x78: null-terminated worm name string (~20 bytes)
+///
+/// Sentinel (slot 0) has different layout — see `sentinel_*` methods:
+/// - +0x6C (_unknown_60\[0x0C\]): eliminated flag
+/// - +0x78 (name\[0..4\]): worm_count
+/// - +0x80 (name\[8..12\]): alliance_id
+/// - +0x84 (name\[12..\]): team name string
+/// - +0x98 (_unknown_90\[8..12\]): value 0x190 (400), unknown purpose
+#[repr(C)]
+pub struct WormEntry {
+    /// 0x00: Worm state machine state.
+    /// Values: 0x65=idle, 0x67=active/selected, 0x68=active variant.
+    /// Special states {0x80..0x85, 0x89} = dying/drowning/special animation.
+    pub state: u32,
+    /// 0x04-0x0B: Unknown
+    pub _unknown_04: [u8; 8],
+    /// 0x0C: Active/alive flag (1 for alive worms in game, 0 otherwise).
+    pub active_flag: i32,
+    /// 0x10-0x57: Unknown
+    pub _unknown_10: [u8; 0x48],
+    /// 0x58: Max health (initial health value, typically 100).
+    pub max_health: i32,
+    /// 0x5C: Current health. Used by GetTeamTotalHealth.
+    pub health: i32,
+    /// 0x60-0x77: Unknown.
+    /// In sentinel: +0x6C = eliminated flag for the team.
+    pub _unknown_60: [u8; 0x18],
+    /// 0x78: Worm name, null-terminated ASCII string (~20 bytes).
+    /// In sentinel: +0x78 = worm_count (i32), +0x80 = alliance_id (i32),
+    /// +0x84 = team name string.
+    pub name: [u8; 0x18],
+    /// 0x90-0x9B: Unknown (zeroed in runtime dump for playable worms).
+    /// GetWormPosition reads pos_x/pos_y from +0x90/+0x94 via negative entry_ptr
+    /// arithmetic, but values appear transient — not populated at rest.
+    /// Actual worm positions live in CGameTask objects (+0x84/+0x88).
+    pub _unknown_90: [u8; 0x0C],
+}
+
+const _: () = assert!(core::mem::size_of::<WormEntry>() == 0x9C);
+
+impl WormEntry {
+    /// Read worm_count from this entry when it's a sentinel (slot 0).
+    /// Stored at self.name[0..4] (= WormEntry offset 0x78) as little-endian i32.
+    ///
+    /// # Safety
+    /// Only valid when called on a sentinel worm (slot 0 of a FullTeamBlock).
+    pub unsafe fn sentinel_worm_count(&self) -> i32 {
+        *(self.name.as_ptr() as *const i32)
+    }
+
+    /// Read eliminated flag from this entry when it's a sentinel (slot 0).
+    /// Stored at self._unknown_60[0x0C] (= WormEntry offset 0x6C) as i32.
+    /// Nonzero = team is eliminated.
+    ///
+    /// # Safety
+    /// Only valid when called on a sentinel worm (slot 0 of a FullTeamBlock).
+    pub unsafe fn sentinel_eliminated(&self) -> i32 {
+        *(self._unknown_60.as_ptr().add(0x0C) as *const i32)
+    }
+}
+
+/// Full per-team data block (0x51C bytes, 6 teams in DDGame).
+///
+/// Contains 8 WormEntry slots (0x4E0 bytes) followed by 0x3C bytes of
+/// team metadata. Slot 0 is a sentinel/header; slots 1-7 are playable worms.
+///
+/// **Block indexing**: Block 0 is unused (preamble, all zeros). Actual team
+/// data starts at block 1. entry_ptr(team=N) = DDGame+0x4628+N*0x51C, which
+/// lands at block\[N+1\].worm\[0\]+0x7C. Negative offsets reach back into
+/// block\[N\]'s worm data. So entry_ptr(1) accesses block\[1\]'s worms.
+///
+/// **Sentinel worm\[0\]** stores metadata for the team accessed by the
+/// PREVIOUS entry_ptr index:
+/// - +0x78: worm_count (accessed as entry_ptr-4)
+/// - +0x80: alliance_id (accessed as entry_ptr+4)
+/// - +0x84: team name string
+#[repr(C)]
+pub struct FullTeamBlock {
+    /// 0x000-0x4DF: 8 worm entries (stride 0x9C)
+    pub worms: [WormEntry; 8],
+    /// 0x4E0-0x51B: Team metadata (0x3C bytes)
+    pub _metadata: [u8; 0x3C],
+}
+
+const _: () = assert!(core::mem::size_of::<FullTeamBlock>() == 0x51C);
+
 /// Team weapon state area within DDGame (at DDGame + 0x4628).
 ///
 /// Contains per-team entries and an interleaved ammo/delay table.
@@ -211,27 +324,23 @@ pub struct TeamWeaponState {
 
 const _: () = assert!(core::mem::size_of::<TeamWeaponState>() == 0x2C40);
 
-/// Worm data layout relative to TeamEntry.
-/// Worm data lives at NEGATIVE offsets from the TeamEntry base pointer.
+/// Worm state constants and helpers.
 pub mod worm {
-    /// Stride between consecutive worm entries
-    pub const STRIDE: usize = 0x9C;
-    /// Worm count at team_entry - COUNT_OFFSET
-    pub const COUNT_OFFSET: usize = 0x4;
-    /// Worm array start at team_entry - ARRAY_OFFSET (stride STRIDE, health at [0])
-    pub const ARRAY_OFFSET: usize = 0x4A0;
-    /// Worm position X at team+worm addr - POS_X_OFFSET
-    pub const POS_X_OFFSET: usize = 0x508;
-    /// Worm position Y at team+worm addr - POS_Y_OFFSET
-    pub const POS_Y_OFFSET: usize = 0x504;
-    /// Worm state flag at team+worm addr - STATE_OFFSET
-    pub const STATE_OFFSET: usize = 0x598;
-    /// Full health value (used in HasFullHealthWorm)
-    pub const FULL_HEALTH: i32 = 100;
+    // --- Known state values (runtime-validated via validator dumps) ---
+
+    /// Transitional state checked by CheckWormState0x64 (0x5228D0). 11 xrefs.
+    /// Appears briefly during turn transitions.
+    pub const STATE_TRANSITIONAL: u32 = 0x64;
+    /// Idle — worm is waiting, not currently active.
+    pub const STATE_IDLE: u32 = 0x65;
+    /// Active — worm is currently selected and taking its turn.
+    pub const STATE_ACTIVE: u32 = 0x67;
+    /// Dead — worm has been killed (hp=0). Persists across turns.
+    pub const STATE_DEAD: u32 = 0x87;
 
     /// Special worm states — worm is dying/drowning/in special animation.
     /// Checked by IsWormInSpecialState (0x5226B0).
-    /// No documented names exist in third-party sources for individual states.
+    /// All values in the 0x80+ range. 0x87 (dead) is also in this set.
     pub const SPECIAL_STATES: [u32; 6] = [0x80, 0x81, 0x82, 0x83, 0x85, 0x89];
 
     /// Check if a worm state value is a "special" state.
@@ -245,19 +354,15 @@ pub const GAME_PHASE_SUDDEN_DEATH: i32 = 0x1E4; // 484
 pub const GAME_PHASE_NORMAL_MIN: i32 = -2;
 
 /// Team data offsets within TeamWeaponState (relative to base pointer).
+/// Used by CountTeamsByAlliance which accesses a different sentinel layout
+/// than the entry_ptr-based functions (offset +0x70/+0x74 vs +0x78/+0x80).
 pub mod team_data {
-    /// Offset to first team's per-team data block
+    /// Offset to first team's per-team data block (from TWS base).
+    /// Maps to block[2].worms[0]+0x70 — a separate alliance/alive pair
+    /// distinct from the entry_ptr-based alliance_id at worms[0]+0x80.
     pub const BASE_OFFSET: usize = 0x510;
     /// Alive flag within per-team data block (at +4 from team data start)
     pub const ALIVE_FLAG: usize = 4;
-    /// Eliminated flag — at team_entry - 0x10
-    pub const ELIMINATED_OFFSET: usize = 0x10;
-    /// Alternative team pointer base used in HasFullHealthWorm
-    pub const ALT_BASE_OFFSET: usize = 0x518;
-    /// Worm data offset from alt base (negative: team_ptr - 0x4F8)
-    pub const ALT_WORM_ARRAY_OFFSET: usize = 0x4F8;
-    /// Eliminated flag from alt base (negative: team_ptr - 0xC)
-    pub const ALT_ELIMINATED_OFFSET: usize = 0x0C;
 }
 
 impl TeamWeaponState {

crates/openwa-validator/Cargo.toml

@@ -12,4 +12,8 @@ openwa-types = { path = "../openwa-types" }
 minhook = "0.9"
 
 [target.'cfg(target_os = "windows")'.dependencies]
-windows-sys = { version = "0.59", features = ["Win32_System_Memory"] }
+windows-sys = { version = "0.59", features = [
+    "Win32_System_Memory",
+    "Win32_System_LibraryLoader",
+    "Win32_UI_Input_KeyboardAndMouse",
+] }

crates/openwa-validator/src/lib.rs

@@ -10,6 +10,9 @@ use openwa_types::task::{CTask, CGameTask};
 use openwa_types::ddgame::DDGame;
 use openwa_types::ddgame_wrapper::DDGameWrapper;
 
+use windows_sys::Win32::System::LibraryLoader::GetModuleHandleA;
+use windows_sys::Win32::UI::Input::KeyboardAndMouse::GetAsyncKeyState;
+
 // ---------------------------------------------------------------------------
 // ASLR rebasing
 // ---------------------------------------------------------------------------
@@ -17,6 +20,7 @@ use openwa_types::ddgame_wrapper::DDGameWrapper;
 /// Delta to add to Ghidra addresses to get runtime addresses.
 /// Computed as: actual_base - IMAGE_BASE (0x400000)
 static REBASE_DELTA: AtomicU32 = AtomicU32::new(0);
+static DUMP_COUNTER: AtomicU32 = AtomicU32::new(0);
 
 /// Rebase a Ghidra VA to the actual runtime address.
 #[inline]
@@ -24,10 +28,6 @@ pub(crate) fn rb(ghidra_addr: u32) -> u32 {
     ghidra_addr.wrapping_add(REBASE_DELTA.load(Ordering::Relaxed))
 }
 
-extern "system" {
-    fn GetModuleHandleA(lpModuleName: *const u8) -> *mut c_void;
-}
-
 fn init_rebase() -> i32 {
     let base = unsafe { GetModuleHandleA(std::ptr::null()) } as u32;
     let delta = base.wrapping_sub(va::IMAGE_BASE);
@@ -472,6 +472,151 @@ fn deferred_global_validation() {
     let _ = log_line(&format!("  Deferred {}", result.summary_line()));
 }
 
+// ---------------------------------------------------------------------------
+// Team block memory dump (for WormEntry/FullTeamBlock verification)
+// ---------------------------------------------------------------------------
+
+fn dump_team_blocks() {
+    use openwa_types::ddgame::{offsets, FullTeamBlock, TeamWeaponState};
+
+    let dump_num = DUMP_COUNTER.fetch_add(1, Ordering::Relaxed);
+    let _ = log_line("");
+    let _ = log_line(&format!("--- Team Block Dump #{} ---", dump_num));
+
+    unsafe {
+        let session_ptr = read_u32(rb(va::G_GAME_SESSION));
+        if session_ptr == 0 {
+            let _ = log_line("  No game session — skipping.");
+            return;
+        }
+
+        let wrapper_addr = read_u32(session_ptr + 0xA0);
+        if wrapper_addr == 0 {
+            let _ = log_line("  No DDGameWrapper — need to start a game first.");
+            return;
+        }
+
+        let ddgame_ptr = read_u32(wrapper_addr + 0x488);
+        if ddgame_ptr == 0 {
+            let _ = log_line("  No DDGame — need to be in gameplay.");
+            return;
+        }
+
+        let _ = log_line(&format!("  DDGame = 0x{:08X}", ddgame_ptr));
+
+        // Get TeamWeaponState via struct
+        let tws_base = (ddgame_ptr + offsets::TEAM_WEAPON_STATE as u32) as *const u8;
+        let tws = &*(tws_base as *const TeamWeaponState);
+        let _ = log_line(&format!("  team_count = {} (TeamWeaponState.team_count)", tws.team_count));
+
+        // Get FullTeamBlock array via TWS_TO_BLOCKS offset
+        let blocks = tws_base.sub(offsets::TWS_TO_BLOCKS) as *const FullTeamBlock;
+        let blocks_addr = blocks as u32;
+        let _ = log_line(&format!("  blocks_base = 0x{:08X} (DDGame+0x{:X})",
+            blocks_addr, blocks_addr - ddgame_ptr));
+
+        let mut result = ValidationResult::new();
+
+        // Validate TWS_TO_BLOCKS: blocks_base should == DDGame + TEAM_BLOCKS
+        let expected_blocks = ddgame_ptr + offsets::TEAM_BLOCKS as u32;
+        result.check("TWS_TO_BLOCKS derivation",
+            blocks_addr == expected_blocks,
+            &format!("got 0x{:08X}, expected 0x{:08X}", blocks_addr, expected_blocks));
+
+        // Validate each real team (1-indexed: blocks[1..=team_count])
+        let num_blocks = (tws.team_count as u32 + 1).max(3).min(7);
+        for b in 0..num_blocks {
+            let block = &*blocks.add(b as usize);
+            let _ = log_line(&format!("\n  === Block {} (0x{:08X}) ===",
+                b, blocks_addr + b * 0x51C));
+
+            // Sentinel: block[b+1].worms[0] holds metadata for entry_ptr(b)
+            if (b + 1) < 7 {
+                let sentinel = &(*blocks.add(b as usize + 1)).worms[0];
+                let worm_count = sentinel.sentinel_worm_count();
+                let eliminated = sentinel.sentinel_eliminated();
+
+                // Cross-check sentinel vs raw entry_ptr reads
+                let entry_ptr = tws_base.add(b as usize * 0x51C);
+                let raw_worm_count = *(entry_ptr.sub(4) as *const i32);
+                let raw_alliance = *(entry_ptr.add(4) as *const i32);
+
+                result.check(
+                    &format!("block[{}] sentinel_worm_count vs raw", b),
+                    worm_count == raw_worm_count,
+                    &format!("struct={}, raw={}", worm_count, raw_worm_count),
+                );
+
+                let _ = log_line(&format!("  sentinel: worm_count={}, eliminated={}, alliance(entry_ptr+4)={}",
+                    worm_count, eliminated, raw_alliance));
+
+                // Dump playable worms using struct field access
+                for w in 0..8usize {
+                    let worm = &block.worms[w];
+                    let active = worm.active_flag;
+                    let name_bytes = &worm.name;
+                    let name_len = name_bytes.iter().position(|&c| c == 0).unwrap_or(name_bytes.len());
+                    let name_str = core::str::from_utf8(&name_bytes[..name_len]).unwrap_or("?");
+
+                    if worm.state != 0 || worm.health != 0 || active != 0 || w == 0 {
+                        let _ = log_line(&format!(
+                            "  worm[{}]: state=0x{:04X} active={} max_hp={} hp={} name=\"{}\"",
+                            w, worm.state, active, worm.max_health, worm.health, name_str
+                        ));
+                    }
+                }
+
+                // Validate GetTeamTotalHealth pattern: sum block.worms[1..=count].health
+                if worm_count > 0 && worm_count <= 7 {
+                    let struct_total: i32 = (1..=worm_count as usize)
+                        .map(|w| block.worms[w].health)
+                        .sum();
+
+                    // Cross-check vs raw pointer method (old ARRAY_OFFSET=0x4A0 pattern)
+                    let raw_health_ptr = entry_ptr.sub(0x4A0) as *const i32;
+                    let mut raw_total = 0i32;
+                    for i in 0..worm_count {
+                        raw_total += *raw_health_ptr.add(i as usize * (0x9C / 4));
+                    }
+
+                    result.check(
+                        &format!("block[{}] health sum (struct vs raw)", b),
+                        struct_total == raw_total,
+                        &format!("struct={}, raw={}", struct_total, raw_total),
+                    );
+                }
+
+                // Validate IsWormInSpecialState pattern: block.worms[w].state
+                // Cross-check worm[1].state via struct vs raw (STATE_OFFSET=0x598)
+                if worm_count > 0 {
+                    let struct_state = block.worms[1].state;
+                    let raw_state = *(entry_ptr.sub(0x598).add(0x9C) as *const u32);
+                    result.check(
+                        &format!("block[{}] worm[1].state (struct vs raw)", b),
+                        struct_state == raw_state,
+                        &format!("struct=0x{:X}, raw=0x{:X}", struct_state, raw_state),
+                    );
+                }
+
+                // Validate CheckWormState0x64 pattern: reads worms[].state, NOT .health
+                // Show both values for each worm so we can verify
+                if worm_count > 0 {
+                    let _ = log_line(&format!("  CheckWormState0x64 field check (state vs health):"));
+                    for w in 1..=worm_count as usize {
+                        let worm = &block.worms[w];
+                        let _ = log_line(&format!(
+                            "    worm[{}]: state=0x{:04X}({}) health=0x{:04X}({})",
+                            w, worm.state, worm.state, worm.health, worm.health
+                        ));
+                    }
+                }
+            }
+        }
+
+        let _ = log_line(&format!("\n  Struct Validation {}", result.summary_line()));
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Main validation entry point
 // ---------------------------------------------------------------------------
@@ -526,5 +671,26 @@ fn run_validation() -> Result<(), Box<dyn std::error::Error>> {
     });
     let _ = log_line("  Polling thread started (10s delay).");
 
+    // 8. Team block dump — wait 30s for user to start a game
+    std::thread::spawn(move || {
+        std::thread::sleep(std::time::Duration::from_secs(30));
+        dump_team_blocks();
+    });
+    let _ = log_line("  Team block dump thread started (30s delay).");
+
+    // 9. Hotkey listener — F9 triggers a team block dump on demand
+    std::thread::spawn(|| {
+        const VK_F9: i32 = 0x78;
+        let _ = log_line("  Hotkey listener started (press F9 to dump team blocks).");
+        loop {
+            std::thread::sleep(std::time::Duration::from_millis(100));
+            let state = unsafe { GetAsyncKeyState(VK_F9) };
+            // Bit 0 = key was pressed since last call
+            if state & 1 != 0 {
+                dump_team_blocks();
+            }
+        }
+    });
+
     Ok(())
 }

crates/openwa-wormkit/src/replacements/team.rs

@@ -5,10 +5,10 @@
 //! - GetTeamTotalHealth (0x5224D0): sum worm health for a team
 //! - IsWormInSpecialState (0x5226B0): check worm state flag
 //! - GetWormPosition (0x522700): read worm X,Y coordinates
-//! - HasFullHealthWorm (0x5228D0): check if any worm has full health
+//! - CheckWormState0x64 (0x5228D0): check if any worm has state 0x64
 
 use openwa_types::address::va;
-use openwa_types::ddgame::{self, TeamWeaponState};
+use openwa_types::ddgame::{self, offsets, FullTeamBlock, TeamWeaponState};
 
 use crate::hook::{self, usercall_trampoline};
 
@@ -17,6 +17,11 @@ use crate::hook::{self, usercall_trampoline};
 // ============================================================
 // __usercall: EAX = base, EDI = alliance_id
 // plain RET
+//
+// NOTE: This function uses a DIFFERENT sentinel layout than entry_ptr-based
+// functions. It reads alliance/alive at TWS+0x510+i*0x51C (= sentinel+0x70/0x74),
+// not the entry_ptr-based sentinel+0x78/0x80. Left as raw pointer math until
+// the +0x70/+0x74 sentinel fields are better understood.
 
 unsafe extern "cdecl" fn count_teams_by_alliance_impl(base: u32, alliance_id: i32) {
     let state = &mut *(base as *mut TeamWeaponState);
@@ -25,9 +30,6 @@ unsafe extern "cdecl" fn count_teams_by_alliance_impl(base: u32, alliance_id: i3
     state.same_alliance_count = 0;
     state.enemy_team_count = 0;
 
-    // Teams are 1-indexed; iterate 1..=team_count
-    // Per-team data: base + 0x510 + (team_1based - 1) * 0x51C
-    // At [+0]: alliance field, [+4]: alive flag
     let base_ptr = base as *const u8;
     for i in 0..state.team_count {
         let team_data = base_ptr.add(ddgame::team_data::BASE_OFFSET + i as usize * 0x51C);
@@ -54,22 +56,18 @@ usercall_trampoline!(fn trampoline_count_teams_by_alliance; impl_fn = count_team
 // plain RET, returns EAX = total health
 
 unsafe extern "cdecl" fn get_team_total_health_impl(team_index: u32, base: u32) -> i32 {
-    let base_ptr = base as *const u8;
-    let team_entry = base_ptr.add(team_index as usize * 0x51C) as usize;
+    let blocks = (base as *const u8).sub(offsets::TWS_TO_BLOCKS) as *const FullTeamBlock;
+    let block = &*blocks.add(team_index as usize);
+    let sentinel = &(*blocks.add(team_index as usize + 1)).worms[0];
 
-    // Check eliminated flag at team_entry - ELIMINATED_OFFSET
-    if *((team_entry - ddgame::team_data::ELIMINATED_OFFSET) as *const i32) != 0 {
+    if sentinel.sentinel_eliminated() != 0 {
         return 0;
     }
 
-    let worm_count = *((team_entry - ddgame::worm::COUNT_OFFSET) as *const i32);
+    let worm_count = sentinel.sentinel_worm_count();
     let mut total = 0i32;
-    if worm_count > 0 {
-        let mut ptr = (team_entry - ddgame::worm::ARRAY_OFFSET) as *const u8;
-        for _ in 0..worm_count {
-            total += *(ptr as *const i32);
-            ptr = ptr.add(ddgame::worm::STRIDE);
-        }
+    for w in 1..=worm_count as usize {
+        total += block.worms[w].health;
     }
     total
 }
@@ -86,11 +84,9 @@ usercall_trampoline!(fn trampoline_get_team_total_health; impl_fn = get_team_tot
 unsafe extern "cdecl" fn is_worm_in_special_state_impl(
     team_index: u32, worm_index: u32, base: u32,
 ) -> u32 {
-    let addr = base as usize
-        + team_index as usize * 0x51C
-        + worm_index as usize * ddgame::worm::STRIDE;
-    let state_val = *((addr.wrapping_sub(ddgame::worm::STATE_OFFSET)) as *const u32);
-    if ddgame::worm::is_special_state(state_val) { 1 } else { 0 }
+    let blocks = (base as *const u8).sub(offsets::TWS_TO_BLOCKS) as *const FullTeamBlock;
+    let block = &*blocks.add(team_index as usize);
+    if ddgame::worm::is_special_state(block.worms[worm_index as usize].state) { 1 } else { 0 }
 }
 
 usercall_trampoline!(fn trampoline_is_worm_in_special_state; impl_fn = is_worm_in_special_state_impl;
@@ -102,50 +98,56 @@ usercall_trampoline!(fn trampoline_is_worm_in_special_state; impl_fn = is_worm_i
 // __usercall: EAX = team_index, ECX = worm_index,
 //   [ESP+4] = base, [ESP+8] = out_x, [ESP+C] = out_y
 // RET 0xC
+//
+// Reads pos_x/pos_y from WormEntry._unknown_90[0..4] / [4..8].
+// These values appear transient — actual worm positions live in CGameTask objects.
 
 unsafe extern "cdecl" fn get_worm_position_impl(
     team_index: u32, worm_index: u32, base: u32, out_x: *mut i32, out_y: *mut i32,
 ) {
-    let addr = base as usize
-        + team_index as usize * 0x51C
-        + worm_index as usize * ddgame::worm::STRIDE;
-    *out_x = *((addr.wrapping_sub(ddgame::worm::POS_X_OFFSET)) as *const i32);
-    *out_y = *((addr.wrapping_sub(ddgame::worm::POS_Y_OFFSET)) as *const i32);
+    let blocks = (base as *const u8).sub(offsets::TWS_TO_BLOCKS) as *const FullTeamBlock;
+    let block = &*blocks.add(team_index as usize);
+    let worm = &block.worms[worm_index as usize];
+    *out_x = *(worm._unknown_90.as_ptr() as *const i32);
+    *out_y = *(worm._unknown_90.as_ptr().add(4) as *const i32);
 }
 
 usercall_trampoline!(fn trampoline_get_worm_position; impl_fn = get_worm_position_impl;
     regs = [eax, ecx]; stack_params = 3; ret_bytes = "0xC");
 
 // ============================================================
-// HasFullHealthWorm replacement (0x5228D0)
+// CheckWormState0x64 replacement (0x5228D0)
 // ============================================================
 // __usercall: EAX = base
-// plain RET, returns EAX = bool (1 if any team has a worm at full health)
-
-unsafe extern "cdecl" fn has_full_health_worm_impl(base: u32) -> u32 {
+// plain RET, returns EAX = bool (1 if any worm has state 0x64)
+//
+// Previously named "HasFullHealthWorm" but Ghidra disassembly confirms it
+// reads worms[].state (offset +0x00), NOT worms[].health (offset +0x5C).
+// It compares to 0x64 (100 decimal). State 0x64 is likely a transitional
+// state distinct from 0x65 (idle). 11 xrefs in gameplay code.
+
+unsafe extern "cdecl" fn check_worm_state_0x64_impl(base: u32) -> u32 {
     let state = &*(base as *const TeamWeaponState);
-    let base_ptr = base as *const u8;
+    let blocks = (base as *const u8).sub(offsets::TWS_TO_BLOCKS) as *const FullTeamBlock;
 
-    for i in 0..state.team_count {
-        let team_ptr = base_ptr.add(ddgame::team_data::ALT_BASE_OFFSET + i as usize * 0x51C);
-        if *(team_ptr.sub(ddgame::team_data::ALT_ELIMINATED_OFFSET) as *const i32) != 0 {
+    // Iterate real teams (1-indexed: team 1..=team_count)
+    for i in 1..=state.team_count as usize {
+        let sentinel = &(*blocks.add(i + 1)).worms[0];
+        if sentinel.sentinel_eliminated() != 0 {
             continue;
         }
-        let worm_count = *(team_ptr as *const i32);
-        if worm_count > 0 {
-            let mut worm_ptr = team_ptr.sub(ddgame::team_data::ALT_WORM_ARRAY_OFFSET);
-            for _ in 0..worm_count {
-                if *(worm_ptr as *const i32) == ddgame::worm::FULL_HEALTH {
-                    return 1;
-                }
-                worm_ptr = worm_ptr.add(ddgame::worm::STRIDE);
+        let worm_count = sentinel.sentinel_worm_count();
+        let worm_block = &*blocks.add(i);
+        for w in 1..=worm_count as usize {
+            if worm_block.worms[w].state == 0x64 {
+                return 1;
             }
         }
     }
     0
 }
 
-usercall_trampoline!(fn trampoline_has_full_health_worm; impl_fn = has_full_health_worm_impl;
+usercall_trampoline!(fn trampoline_check_worm_state_0x64; impl_fn = check_worm_state_0x64_impl;
     reg = eax);
 
 // ============================================================
@@ -179,9 +181,9 @@ pub fn install() -> Result<(), String> {
         )?;
 
         let _ = hook::install(
-            "HasFullHealthWorm",
-            va::HAS_FULL_HEALTH_WORM,
-            trampoline_has_full_health_worm as *const (),
+            "CheckWormState0x64",
+            va::CHECK_WORM_STATE_0X64,
+            trampoline_check_worm_state_0x64 as *const (),
         )?;
     }
 

crates/openwa-wormkit/src/replacements/weapon.rs

@@ -5,7 +5,7 @@
 //! - AddAmmo (0x522640): add ammo to a weapon slot
 
 use openwa_types::address::va;
-use openwa_types::ddgame::{self, TeamWeaponState};
+use openwa_types::ddgame::{self, offsets, FullTeamBlock, TeamWeaponState};
 use openwa_types::weapon::Weapon;
 
 use crate::hook::{self, usercall_trampoline};
@@ -64,23 +64,17 @@ unsafe extern "cdecl" fn get_ammo_impl(team_index: u32, base: u32, weapon_id: u3
     state.get_ammo(idx) as u32
 }
 
-/// Returns true if more than 1 worm is alive on the team.
-///
-/// Worm data lives at negative offsets from the TeamEntry:
-/// - worm_count at team_entry_addr - 0x4
-/// - worm array at team_entry_addr - 0x4A0 (stride 0x9C, health at [0])
+/// Returns true if more than 1 worm is alive on the team (health > 0).
 unsafe fn count_alive_worms(state: &TeamWeaponState, team_index: usize) -> bool {
     let base = state as *const TeamWeaponState as *const u8;
-    let team_entry = base.add(team_index * 0x51C) as usize;
-    let worm_count = *((team_entry - ddgame::worm::COUNT_OFFSET) as *const i32);
+    let blocks = base.sub(offsets::TWS_TO_BLOCKS) as *const FullTeamBlock;
+    let block = &*blocks.add(team_index);
+    let sentinel = &(*blocks.add(team_index + 1)).worms[0];
+    let worm_count = sentinel.sentinel_worm_count();
     let mut alive = 0i32;
-    if worm_count > 0 {
-        let mut ptr = (team_entry - ddgame::worm::ARRAY_OFFSET) as *const u8;
-        for _ in 0..worm_count {
-            if *(ptr as *const i32) > 0 {
-                alive += 1;
-            }
-            ptr = ptr.add(ddgame::worm::STRIDE);
+    for w in 1..=worm_count as usize {
+        if block.worms[w].health > 0 {
+            alive += 1;
         }
     }
     alive > 1