feat: add openwa-wormkit DLL with FrontendChangeScreen replacement

New crate openwa-wormkit (wkOpenWA.dll) that replaces WA.exe functions
with Rust reimplementations, starting with FrontendChangeScreen (0x447A20).

- Naked ASM trampoline captures ESI (implicit dialog this pointer)
- Full reimplementation of both code paths (init + normal EndDialog)
- ScreenId enum expanded to 35 variants with correct semantics:
screen IDs (main-loop dispatch targets) vs result codes (sub-dialog
exit values like offline/online pairs 35/36 and 37/38)
- New globals: g_CurrentScreen (0x6B3504), g_SkipToMainMenu, etc.
- New addresses: Frontend__MainNavigationLoop, DoModal wrapper, etc.
- Validator: removed FrontendChangeScreen hook (conflicts with wormkit),
silenced constructor hooks to reduce log noise

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Cargo.lock

@@ -68,6 +68,15 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "openwa-wormkit"
+version = "0.1.0"
+dependencies = [
+ "minhook",
+ "openwa-types",
+ "windows-sys",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"

crates/openwa-types/src/address.rs

@@ -165,12 +165,18 @@ pub mod va {
 
     // === Frontend / menu screens ===
 
+    /// Main navigation loop (CWinApp::Run override) — dispatches on g_CurrentScreen
+    pub const FRONTEND_MAIN_NAVIGATION_LOOP: u32 = 0x004E_6440;
     pub const FRONTEND_CHANGE_SCREEN: u32 = 0x0044_7A20;
+    /// Wraps DoModal: palette transition + custom DoModal
+    pub const FRONTEND_DO_MODAL_WRAPPER: u32 = 0x0044_7960;
     pub const FRONTEND_FRAME_CONSTRUCTOR: u32 = 0x004E_CCA0;
     pub const FRONTEND_DIALOG_CONSTRUCTOR: u32 = 0x0044_6BA0;
     pub const FRONTEND_PALETTE_ANIMATION: u32 = 0x0042_2180;
     pub const FRONTEND_LOAD_TRANSITION_PAL: u32 = 0x0044_7AA0;
     pub const FRONTEND_PRE_TRANSITION_CLEANUP: u32 = 0x004E_4AE0;
+    /// Post-screen cleanup: destroys previous dialog
+    pub const FRONTEND_POST_SCREEN_CLEANUP: u32 = 0x004E_B450;
     pub const FRONTEND_ON_INITIAL_LOAD: u32 = 0x0042_9830;
     pub const FRONTEND_LAUNCH_SINGLE_PLAYER: u32 = 0x0044_1D80;
     pub const FRONTEND_ON_MULTIPLAYER: u32 = 0x0044_E850;
@@ -179,6 +185,8 @@ pub mod va {
     pub const FRONTEND_ON_OPTIONS_ACCEPT: u32 = 0x0048_DAB0;
     pub const FRONTEND_ON_START_GAME: u32 = 0x004F_14A0;
     pub const CDIALOG_DO_MODAL_CUSTOM: u32 = 0x0040_FD60;
+    /// Custom message pump (replaces MFC's RunModalLoop)
+    pub const CDIALOG_CUSTOM_MSG_PUMP: u32 = 0x0040_FBE0;
 
     // === Lobby / network ===
 
@@ -201,10 +209,18 @@ pub mod va {
 
     // === Global variables (in .data) ===
 
+    /// Current screen ID driving the main navigation loop dispatch
+    pub const G_CURRENT_SCREEN: u32 = 0x006B_3504;
     /// Main frontend frame window (CWnd*)
     pub const G_FRONTEND_FRAME: u32 = 0x006B_3908;
     /// Main frontend HWND
     pub const G_FRONTEND_HWND: u32 = 0x006B_390C;
+    /// Skip-to-main-menu flag (set after intro movie)
+    pub const G_SKIP_TO_MAIN_MENU: u32 = 0x007A_083D;
+    /// Auto-network mode flag
+    pub const G_AUTO_NETWORK_FLAG: u32 = 0x007A_083F;
+    /// Main menu active flag (0xFF during screen 18)
+    pub const G_MAIN_MENU_ACTIVE: u32 = 0x007C_0A20;
     /// Network mode (0=LAN, nonzero=WormNET)
     pub const G_NETWORK_MODE: u32 = 0x007C_0D40;
     /// Network sub-type selector

crates/openwa-types/src/frontend.rs

@@ -1,51 +1,122 @@
-/// Frontend screen identifiers.
+/// Frontend screen/result IDs used by the navigation state machine.
 ///
-/// Used by FrontendChangeScreen (0x447A20) to transition between
-/// menu screens. The screen ID is passed to CDialog::EndDialog as
-/// the result code, then returned from DoModal to drive navigation.
+/// The main navigation loop lives at 0x4E6440 (CWinApp::Run override).
+/// It reads `g_CurrentScreen` (0x6B3504) and dispatches to a dialog via
+/// DoModal. FrontendChangeScreen (0x447A20) calls EndDialog(screen_id),
+/// which becomes the DoModal return value, stored back into g_CurrentScreen.
 ///
-/// The frontend uses MFC CDialog modal dialogs, not the CTask hierarchy.
-/// The main frame window is stored at global 0x6B3908.
+/// IDs fall into two categories:
+/// - **Screen IDs** (10-30, 1700-1707): valid dispatch targets in the main loop,
+///   each corresponding to a specific dialog constructor.
+/// - **Result codes** (0-5, 32, 35-39, 50-58): returned by EndDialog but NOT
+///   dispatched by the main loop. They either signal "cancel/back" (0), trigger
+///   exit (unknown IDs hit default → exit), or are only meaningful within
+///   sub-dialog contexts (e.g., button handlers that launch the game before
+///   the main loop sees the code).
 ///
-/// Source: Ghidra decompilation of 65 call sites + wkJellyWorm Lobby.cpp
+/// Source: Ghidra decompilation of Frontend__MainNavigationLoop (0x4E6440),
+///         65 FrontendChangeScreen call sites, wkJellyWorm Lobby.cpp,
+///         + runtime observation via openwa-wormkit
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 #[repr(i32)]
 pub enum ScreenId {
-    /// Return to previous screen / cancel action
+    // --- Dialog result codes (not main-loop dispatch targets) ---
+
+    /// Cancel / return to previous screen (EndDialog result only)
     Cancel = 0,
-    /// Main menu screen
-    MainMenu = 10,
-    /// Local multiplayer setup
+    /// Splash / intro trigger (result code)
+    Splash = 1,
+    /// Network option result A
+    NetworkOptionA = 2,
+    /// Single player prep result
+    SinglePlayerPrep = 4,
+    /// Single player confirm result
+    SinglePlayerConfirm = 5,
+
+    // --- Valid main-loop screen IDs ---
+
+    /// Deathmatch setup dialog (constructor 0x440F40)
+    Deathmatch = 10,
+    /// Local multiplayer setup dialog (constructor 0x49C420)
     LocalMultiplayer = 11,
-    /// Window minimized / inactive state (checked via IsIconic)
-    Minimized = 15,
-    /// Initial game loading screen
-    InitialLoad = 16,
-    /// Single player game (Deathmatch)
+    /// Training mode dialog (constructor 0x4E0880)
+    Training = 12,
+    /// Missions dialog (constructor 0x499190)
+    Missions = 14,
+    /// Exit frontend — cleans up and returns from CWinApp::Run
+    Exit = 15,
+    /// Post-init main menu (constructor 0x4C91B0)
+    PostInitMenu = 16,
+    /// Redirect to MainMenu (sets g_CurrentScreen = 18)
+    MainMenuRedirect = 17,
+    /// Main menu dialog (constructor 0x4866C0)
+    MainMenu = 18,
+    /// Single player game dialog (constructor 0x4D69F0)
     SinglePlayer = 21,
-    /// Network options sub-screen
-    NetworkSubScreen = 26,
-    /// Start game path A (game setup, param+0x244 == 0)
-    StartGameA = 35,
-    /// Start game path B (game setup fallthrough)
-    StartGameB = 36,
-    /// Network setup path A (param+0x140 == 0)
-    NetworkSetupA = 37,
-    /// Network setup path B (fallthrough)
-    NetworkSetupB = 38,
-    /// Options accepted / theme saved (writes current.thm)
-    OptionsAccept = 39,
-    /// Network provider selection screen
-    NetworkSelection = 1700,
-    /// LAN game
+    /// Campaign selection A dialog (constructor 0x4A2B70)
+    CampaignA = 22,
+    /// Campaign selection B dialog (constructor 0x4A24D0)
+    CampaignB = 23,
+    /// Advanced settings dialog (constructor 0x4279E0)
+    AdvancedSettings = 24,
+    /// Intro/splash movie screen (constructor 0x470870, hardcodes next=18)
+    IntroMovie = 25,
+    /// Network host setup dialog (constructor 0x4ADCA0)
+    NetworkHostSetup = 27,
+    /// Network online setup dialog (constructor 0x4ACBC0)
+    NetworkOnlineSetup = 28,
+    /// Network dialog A (constructor 0x4BC970)
+    NetworkDialogA = 29,
+    /// Network dialog B (constructor 0x4BBC00)
+    NetworkDialogB = 30,
+
+    // --- Dialog result codes (not main-loop dispatch targets) ---
+    //
+    // These are returned by EndDialog from sub-dialogs (button handlers,
+    // options screens, etc.). If they reach the main loop, they hit the
+    // default case → exit. But by then the game has already launched or
+    // the action has been taken.
+    //
+    // 35/36 and 37/38 form offline/online pairs:
+    //   Start Game path: this+0x244 flag → 35 (no network) / 36 (network)
+    //   Multiplayer path: this+0x140 flag → 37 (no network) / 38 (network)
+
+    /// Scheme/weapon editor done — return from editor
+    SchemeEditorDone = 32,
+    /// Start game, network unavailable (offline/local path)
+    StartGameOffline = 35,
+    /// Start game, network available (online path)
+    StartGameOnline = 36,
+    /// Multiplayer, network unavailable (local play path)
+    MultiplayerLocal = 37,
+    /// Multiplayer, network available (online play path)
+    MultiplayerOnline = 38,
+    /// Options accepted — return screen after applying options + saving theme
+    OptionsAccepted = 39,
+    /// Sub-dialog result: in-game state A (hits default → exit)
+    InGameA = 50,
+    /// Sub-dialog result: in-game state B (hits default → exit)
+    InGameB = 52,
+    /// Sub-dialog result: in-game state C (hits default → exit)
+    InGameC = 58,
+
+    // --- Network/lobby screen IDs (high range, 0x6A4-0x6AB) ---
+
+    /// Network provider selection dialog (constructor 0x4A7990)
+    NetworkProviderSelect = 1700,
+    /// Network settings dialog (constructor 0x4C23C0)
+    NetworkSettings = 1701,
+    /// LAN game dialog (constructor 0x480A80)
     Lan = 1702,
-    /// WormNET online lobby
+    /// WormNET online lobby dialog (constructor 0x472400)
     WormNet = 1703,
-    /// Lobby as host
+    /// Lobby host dialog (constructor 0x4B0160)
     LobbyHost = 1704,
-    /// Lobby as client / join game
+    /// Lobby host continued (fall-through from 1704 setup)
+    LobbyHostContinued = 1705,
+    /// Lobby client / join game dialog
     LobbyClient = 1706,
-    /// Lobby game start
+    /// Lobby game start dialog (constructor 0x4BDBE0)
     LobbyGameStart = 1707,
 }
 
@@ -55,21 +126,42 @@ impl TryFrom<i32> for ScreenId {
     fn try_from(value: i32) -> Result<Self, Self::Error> {
         match value {
             0 => Ok(Self::Cancel),
-            10 => Ok(Self::MainMenu),
+            1 => Ok(Self::Splash),
+            2 => Ok(Self::NetworkOptionA),
+            4 => Ok(Self::SinglePlayerPrep),
+            5 => Ok(Self::SinglePlayerConfirm),
+            10 => Ok(Self::Deathmatch),
             11 => Ok(Self::LocalMultiplayer),
-            15 => Ok(Self::Minimized),
-            16 => Ok(Self::InitialLoad),
+            12 => Ok(Self::Training),
+            14 => Ok(Self::Missions),
+            15 => Ok(Self::Exit),
+            16 => Ok(Self::PostInitMenu),
+            17 => Ok(Self::MainMenuRedirect),
+            18 => Ok(Self::MainMenu),
             21 => Ok(Self::SinglePlayer),
-            26 => Ok(Self::NetworkSubScreen),
-            35 => Ok(Self::StartGameA),
-            36 => Ok(Self::StartGameB),
-            37 => Ok(Self::NetworkSetupA),
-            38 => Ok(Self::NetworkSetupB),
-            39 => Ok(Self::OptionsAccept),
-            1700 => Ok(Self::NetworkSelection),
+            22 => Ok(Self::CampaignA),
+            23 => Ok(Self::CampaignB),
+            24 => Ok(Self::AdvancedSettings),
+            25 => Ok(Self::IntroMovie),
+            27 => Ok(Self::NetworkHostSetup),
+            28 => Ok(Self::NetworkOnlineSetup),
+            29 => Ok(Self::NetworkDialogA),
+            30 => Ok(Self::NetworkDialogB),
+            32 => Ok(Self::SchemeEditorDone),
+            35 => Ok(Self::StartGameOffline),
+            36 => Ok(Self::StartGameOnline),
+            37 => Ok(Self::MultiplayerLocal),
+            38 => Ok(Self::MultiplayerOnline),
+            39 => Ok(Self::OptionsAccepted),
+            50 => Ok(Self::InGameA),
+            52 => Ok(Self::InGameB),
+            58 => Ok(Self::InGameC),
+            1700 => Ok(Self::NetworkProviderSelect),
+            1701 => Ok(Self::NetworkSettings),
             1702 => Ok(Self::Lan),
             1703 => Ok(Self::WormNet),
             1704 => Ok(Self::LobbyHost),
+            1705 => Ok(Self::LobbyHostContinued),
             1706 => Ok(Self::LobbyClient),
             1707 => Ok(Self::LobbyGameStart),
             _ => Err(value),

crates/openwa-validator/src/hooks/detour.rs

@@ -33,23 +33,6 @@ unsafe fn install_hook(ghidra_addr: u32, detour_fn: *const (), name: &str) -> Re
     Ok(trampoline_addr)
 }
 
-// ---------------------------------------------------------------------------
-// FrontendChangeScreen hook
-// ---------------------------------------------------------------------------
-
-static ORIG_FRONTEND_CHANGE_SCREEN: AtomicU32 = AtomicU32::new(0);
-
-/// Hook for FrontendChangeScreen (0x447A20).
-/// Called on every menu screen transition. Logs the screen ID.
-///
-/// RET 0x4 → stdcall with 1 param (screen_id). ESI = dialog this (implicit).
-unsafe extern "stdcall" fn hook_frontend_change_screen(screen_id: u32) {
-    let _ = log_line(&format!("[HOOK] FrontendChangeScreen(screen_id={screen_id})"));
-    let orig: unsafe extern "stdcall" fn(u32) =
-        core::mem::transmute(ORIG_FRONTEND_CHANGE_SCREEN.load(Ordering::Relaxed));
-    orig(screen_id);
-}
-
 // ---------------------------------------------------------------------------
 // CTask::Constructor hook
 // ---------------------------------------------------------------------------
@@ -62,12 +45,7 @@ static ORIG_CTASK_CONSTRUCTOR: AtomicU32 = AtomicU32::new(0);
 unsafe extern "stdcall" fn hook_ctask_constructor(this: u32, parent: u32, ddgame: u32) -> u32 {
     let orig: unsafe extern "stdcall" fn(u32, u32, u32) -> u32 =
         core::mem::transmute(ORIG_CTASK_CONSTRUCTOR.load(Ordering::Relaxed));
-    let result = orig(this, parent, ddgame);
-    // Log after calling original (so vtable is set)
-    let _ = log_line(&format!(
-        "[HOOK] CTask::ctor(this=0x{this:08X}, parent=0x{parent:08X}, ddgame=0x{ddgame:08X}) -> 0x{result:08X}"
-    ));
-    result
+    orig(this, parent, ddgame)
 }
 
 // ---------------------------------------------------------------------------
@@ -82,11 +60,7 @@ static ORIG_CGAMETASK_CONSTRUCTOR: AtomicU32 = AtomicU32::new(0);
 unsafe extern "stdcall" fn hook_cgametask_constructor(this: u32, parent: u32, param3: u32, param4: u32) -> u32 {
     let orig: unsafe extern "stdcall" fn(u32, u32, u32, u32) -> u32 =
         core::mem::transmute(ORIG_CGAMETASK_CONSTRUCTOR.load(Ordering::Relaxed));
-    let result = orig(this, parent, param3, param4);
-    let _ = log_line(&format!(
-        "[HOOK] CGameTask::ctor(this=0x{this:08X}, parent=0x{parent:08X}) -> 0x{result:08X}"
-    ));
-    result
+    orig(this, parent, param3, param4)
 }
 
 // ---------------------------------------------------------------------------
@@ -95,14 +69,6 @@ unsafe extern "stdcall" fn hook_cgametask_constructor(this: u32, parent: u32, pa
 
 pub fn install() -> Result<(), String> {
     unsafe {
-        // FrontendChangeScreen — called on every menu navigation
-        let trampoline = install_hook(
-            va::FRONTEND_CHANGE_SCREEN,
-            hook_frontend_change_screen as *const (),
-            "FrontendChangeScreen",
-        )?;
-        ORIG_FRONTEND_CHANGE_SCREEN.store(trampoline, Ordering::Relaxed);
-
         // CTask::Constructor — base class constructor
         let trampoline = install_hook(
             va::CTASK_CONSTRUCTOR,
@@ -120,6 +86,6 @@ pub fn install() -> Result<(), String> {
         ORIG_CGAMETASK_CONSTRUCTOR.store(trampoline, Ordering::Relaxed);
     }
 
-    let _ = log_line("  3 inline hooks installed via MinHook");
+    let _ = log_line("  2 inline hooks installed via MinHook");
     Ok(())
 }

crates/openwa-wormkit/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "openwa-wormkit"
+version = "0.1.0"
+edition = "2021"
+description = "WormKit DLL that replaces WA.exe functions with Rust reimplementations"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+openwa-types = { path = "../openwa-types" }
+minhook = "0.9"
+
+[target.'cfg(target_os = "windows")'.dependencies]
+windows-sys = { version = "0.59", features = ["Win32_System_Memory"] }

crates/openwa-wormkit/src/lib.rs

@@ -0,0 +1,66 @@
+#![allow(non_snake_case)]
+
+use std::ffi::c_void;
+
+pub mod rebase;
+pub mod wa_call;
+mod replacements;
+
+// ---------------------------------------------------------------------------
+// DllMain
+// ---------------------------------------------------------------------------
+
+const DLL_PROCESS_ATTACH: u32 = 1;
+
+#[no_mangle]
+unsafe extern "system" fn DllMain(
+    _module: *mut c_void,
+    reason: u32,
+    _reserved: *mut c_void,
+) -> i32 {
+    if reason == DLL_PROCESS_ATTACH {
+        std::thread::spawn(|| {
+            if let Err(e) = run() {
+                let _ = log_line(&format!("[FATAL] {e}"));
+            }
+        });
+    }
+    1 // TRUE
+}
+
+// ---------------------------------------------------------------------------
+// Logging
+// ---------------------------------------------------------------------------
+
+pub fn log_line(msg: &str) -> std::io::Result<()> {
+    use std::io::Write;
+    let mut f = std::fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open("OpenWA.log")?;
+    writeln!(f, "{msg}")?;
+    Ok(())
+}
+
+fn clear_log() -> std::io::Result<()> {
+    std::fs::write("OpenWA.log", "")?;
+    Ok(())
+}
+
+// ---------------------------------------------------------------------------
+// Main entry
+// ---------------------------------------------------------------------------
+
+fn run() -> Result<(), String> {
+    let _ = clear_log();
+
+    let delta = rebase::init();
+    let _ = log_line(&format!(
+        "=== OpenWA WormKit DLL loaded ===\n  ASLR delta: 0x{delta:08X}"
+    ));
+
+    replacements::install_all()?;
+
+    let _ = log_line("=== All replacements installed ===");
+    Ok(())
+}

crates/openwa-wormkit/src/rebase.rs

@@ -0,0 +1,26 @@
+//! ASLR rebasing — convert Ghidra VAs to runtime addresses.
+
+use std::ffi::c_void;
+use std::sync::atomic::{AtomicU32, Ordering};
+
+use openwa_types::address::va;
+
+/// Delta to add to Ghidra addresses to get runtime addresses.
+static REBASE_DELTA: AtomicU32 = AtomicU32::new(0);
+
+/// Rebase a Ghidra VA to the actual runtime address.
+#[inline]
+pub fn rb(ghidra_addr: u32) -> u32 {
+    ghidra_addr.wrapping_add(REBASE_DELTA.load(Ordering::Relaxed))
+}
+
+extern "system" {
+    fn GetModuleHandleA(lpModuleName: *const u8) -> *mut c_void;
+}
+
+pub fn init() -> i32 {
+    let base = unsafe { GetModuleHandleA(std::ptr::null()) } as u32;
+    let delta = base.wrapping_sub(va::IMAGE_BASE);
+    REBASE_DELTA.store(delta, Ordering::Relaxed);
+    delta as i32
+}

crates/openwa-wormkit/src/replacements/frontend.rs

@@ -0,0 +1,118 @@
+//! FrontendChangeScreen replacement.
+//!
+//! Original: 0x447A20, stdcall(screen_id), ESI = dialog this (__usercall).
+//! Navigates between frontend menu screens via MFC CDialog::EndDialog.
+
+use std::ffi::c_void;
+use std::sync::atomic::{AtomicU32, Ordering};
+
+use minhook::MinHook;
+
+use crate::log_line;
+use crate::rebase::rb;
+use crate::wa_call;
+use openwa_types::address::va;
+use openwa_types::frontend::ScreenId;
+
+/// Trampoline to the original FrontendChangeScreen (for fallback if needed).
+static ORIG_FRONTEND_CHANGE_SCREEN: AtomicU32 = AtomicU32::new(0);
+
+/// Naked trampoline that captures ESI (the implicit dialog this pointer)
+/// and routes it to our cdecl Rust implementation.
+///
+/// Stack on entry (from MinHook redirect):
+///   [ESP+0] = return address
+///   [ESP+4] = screen_id
+///   ESI     = dialog this (MSVC __usercall convention)
+#[unsafe(naked)]
+unsafe extern "stdcall" fn trampoline(_screen_id: u32) {
+    core::arch::naked_asm!(
+        "push [esp+4]",       // push screen_id
+        "push esi",           // push dialog this
+        "call {impl_fn}",    // cdecl call: impl(dialog, screen_id)
+        "add esp, 8",        // clean our two pushes
+        "ret 0x4",           // clean original screen_id from caller's stack
+        impl_fn = sym frontend_change_screen_impl,
+    );
+}
+
+/// Rust reimplementation of FrontendChangeScreen.
+///
+/// Two code paths based on g_FrontendFrame:
+/// - If 0 (initializing): store screen_id in dialog fields
+/// - If nonzero (normal): disable window → palette anim → vtable calls → EndDialog
+unsafe extern "cdecl" fn frontend_change_screen_impl(dialog: u32, screen_id: u32) {
+    let g_frontend_frame = wa_call::read_global(va::G_FRONTEND_FRAME);
+
+    if g_frontend_frame == 0 {
+        // Init path: store screen_id, clear flag bit 0x10
+        let flags = *((dialog + 0x3c) as *const u32);
+        if (flags & 0x18) != 0 {
+            *((dialog + 0x44) as *mut u32) = screen_id;
+            *((dialog + 0x3c) as *mut u32) = flags & 0xFFFF_FFEF;
+        }
+    } else {
+        // Normal path: full screen transition
+
+        // CWnd::EnableWindow(dialog, FALSE)
+        wa_call::thiscall_1(0x5C647A, dialog, 0);
+
+        // Frontend__PaletteAnimation(&DAT_007be560, [dialog+0x134])
+        // Note: original also loads [ESI+0x12c] into EAX before the call.
+        // We replicate this with inline asm to set EAX as the implicit param.
+        let palette_param = *((dialog + 0x134) as *const u32);
+        let eax_value = *((dialog + 0x12c) as *const u32);
+        let palette_anim_addr = rb(va::FRONTEND_PALETTE_ANIMATION);
+        let palette_data_addr = rb(0x7be560);
+        core::arch::asm!(
+            "push {param}",
+            "push {palette}",
+            "call {func}",
+            param = in(reg) palette_param,
+            palette = in(reg) palette_data_addr,
+            func = in(reg) palette_anim_addr,
+            in("eax") eax_value,
+            clobber_abi("C"),
+        );
+
+        // Virtual calls: vtable[0x15C](1) then vtable[0x15C](2)
+        for i in 1u32..=2 {
+            let vtable = *(dialog as *const u32);
+            wa_call::thiscall_indirect_1(vtable + 0x15C, dialog, i);
+        }
+
+        // CWnd::EnableWindow(dialog, TRUE)
+        wa_call::thiscall_1(0x5C647A, dialog, 1);
+
+        // CDialog::EndDialog(dialog, screen_id)
+        wa_call::thiscall_1(0x5CAB72, dialog, screen_id);
+    }
+
+    // Log the transition
+    let name = ScreenId::try_from(screen_id as i32)
+        .map(|s| format!("{s:?}"))
+        .unwrap_or_else(|v| format!("Unknown({v})"));
+    let _ = log_line(&format!("[FrontendChangeScreen] screen_id={screen_id} ({name})"));
+}
+
+pub fn install() -> Result<(), String> {
+    unsafe {
+        let target = rb(va::FRONTEND_CHANGE_SCREEN) as *mut c_void;
+        let detour = trampoline as *const () as *mut c_void;
+
+        let trampoline_ptr = MinHook::create_hook(target, detour)
+            .map_err(|e| format!("MinHook create_hook failed for FrontendChangeScreen: {e}"))?;
+
+        MinHook::enable_hook(target)
+            .map_err(|e| format!("MinHook enable_hook failed for FrontendChangeScreen: {e}"))?;
+
+        ORIG_FRONTEND_CHANGE_SCREEN.store(trampoline_ptr as u32, Ordering::Relaxed);
+
+        let _ = log_line(&format!(
+            "  [REPLACE] FrontendChangeScreen: target 0x{:08X}, trampoline 0x{:08X}",
+            target as u32, trampoline_ptr as u32
+        ));
+    }
+
+    Ok(())
+}

crates/openwa-wormkit/src/replacements/mod.rs

@@ -0,0 +1,6 @@
+mod frontend;
+
+pub fn install_all() -> Result<(), String> {
+    frontend::install()?;
+    Ok(())
+}

crates/openwa-wormkit/src/wa_call.rs

@@ -0,0 +1,46 @@
+//! Helpers for calling WA.exe functions by Ghidra address.
+//!
+//! These handle ASLR rebasing and calling convention translation.
+
+use crate::rebase::rb;
+
+/// Read a u32 global variable at a Ghidra address.
+#[inline]
+pub unsafe fn read_global(ghidra_addr: u32) -> u32 {
+    *(rb(ghidra_addr) as *const u32)
+}
+
+/// Call a thiscall method (ECX = this) with 1 stack argument.
+/// Uses the fastcall trick: ECX = this, EDX = dummy.
+#[inline]
+pub unsafe fn thiscall_1(ghidra_addr: u32, this: u32, arg1: u32) {
+    let f: unsafe extern "fastcall" fn(u32, u32, u32) =
+        core::mem::transmute(rb(ghidra_addr));
+    f(this, 0, arg1);
+}
+
+/// Call a thiscall method (ECX = this) with 1 stack argument, returning u32.
+#[inline]
+pub unsafe fn thiscall_1_ret(ghidra_addr: u32, this: u32, arg1: u32) -> u32 {
+    let f: unsafe extern "fastcall" fn(u32, u32, u32) -> u32 =
+        core::mem::transmute(rb(ghidra_addr));
+    f(this, 0, arg1)
+}
+
+/// Call a thiscall method via an indirect pointer (vtable entry).
+/// Reads the function pointer from `vtable_slot_addr` then calls it.
+#[inline]
+pub unsafe fn thiscall_indirect_1(vtable_slot_addr: u32, this: u32, arg1: u32) {
+    let fn_ptr = *(vtable_slot_addr as *const u32);
+    let f: unsafe extern "fastcall" fn(u32, u32, u32) =
+        core::mem::transmute(fn_ptr);
+    f(this, 0, arg1);
+}
+
+/// Call a stdcall function with 2 arguments.
+#[inline]
+pub unsafe fn stdcall_2(ghidra_addr: u32, arg1: u32, arg2: u32) {
+    let f: unsafe extern "stdcall" fn(u32, u32) =
+        core::mem::transmute(rb(ghidra_addr));
+    f(arg1, arg2);
+}