feat: replace PlayFeSfx and PlayFanfare_Default with full Rust implementations

Convert two speech passthrough hooks into full replacements that build
file paths in Rust via heapless::CString and delegate WAV playback to
WA's WavPlayer functions through naked asm wrappers (WavPlayerHandle).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Cargo.lock

@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
 [[package]]
 name = "cc"
 version = "1.2.56"
@@ -18,6 +24,25 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
+[[package]]
+name = "hash32"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d60b12902ba28e2730cd37e95b8c9223af2808df9e902d4df49588d1470606"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "heapless"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af2455f757db2b292a9b1768c4b70186d443bcb3b316252d6b540aec1cd89ed"
+dependencies = [
+ "hash32",
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "libc"
 version = "0.2.182"
@@ -71,6 +96,7 @@ version = "0.1.0"
 name = "openwa-wormkit"
 version = "0.1.0"
 dependencies = [
+ "heapless",
  "minhook",
  "openwa-lib",
  "openwa-types",
@@ -107,6 +133,12 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
 [[package]]
 name = "syn"
 version = "2.0.117"

crates/openwa-types/src/address.rs

@@ -313,19 +313,33 @@ pub mod va {
     // === WAV Player ===
 
     /// Opens WAV via mmioOpenA, parses RIFF chunks, creates IDirectSoundBuffer.
-    /// usercall(ESI=result_out) + 3 stack params, RET 0xC.
+    /// usercall(ESI=result_out) + stack(player, path, 0), RET 0xC.
     pub const WAV_PLAYER_LOAD_AND_PLAY: u32 = 0x0059_9B40;
 
     /// Calls IDirectSoundBuffer::Play on loaded buffer.
-    /// usercall(EDI=result_out) + 2 stack params, RET 0x8.
+    /// usercall(EDI=result_out) + stack(player, volume), RET 0x8.
     pub const WAV_PLAYER_PLAY: u32 = 0x0059_96E0;
 
     /// Stops and releases current DirectSound buffer.
-    /// usercall(ESI=ctx, EDI=result_out), plain RET.
+    /// usercall(ESI=player, EDI=result_out), plain RET.
     pub const WAV_PLAYER_STOP: u32 = 0x0059_9670;
 
     // === Fanfare / FE SFX ===
 
+    /// FeSfx WavPlayer global instance (used by PlayFeSfx).
+    pub const FESFX_WAV_PLAYER: u32 = 0x006A_C888;
+
+    /// Fanfare WavPlayer global instance (used by PlayFanfare_Default).
+    pub const FANFARE_WAV_PLAYER: u32 = 0x006A_C890;
+
+    /// WA data path string buffer (char[0x81]).
+    pub const WA_DATA_PATH: u32 = 0x0088_E282;
+
+    /// Team config fanfare name lookup — jump table with 49 cases (0-48).
+    /// usercall(ECX=index_0based, EAX=output_buf), plain RET.
+    /// Writes null-terminated country/config name into buffer at EAX.
+    pub const GET_TEAM_CONFIG_NAME: u32 = 0x004A_62A0;
+
     /// Builds `\user\Fanfare\<name>.wav`, plays via WavPlayer.
     /// stdcall(team_config_index), RET 0x4.
     pub const PLAY_FANFARE_DEFAULT: u32 = 0x004D_7500;

crates/openwa-wormkit/Cargo.toml

@@ -10,6 +10,7 @@ crate-type = ["cdylib"]
 [dependencies]
 openwa-types = { path = "../openwa-types" }
 openwa-lib = { path = "../openwa-lib" }
+heapless = "0.9"
 minhook = "0.9"
 
 [target.'cfg(target_os = "windows")'.dependencies]

crates/openwa-wormkit/src/replacements/speech.rs

@@ -1,27 +1,146 @@
-//! Speech / fanfare / FE SFX passthrough hooks.
-//!
-//! Logs speech-related function calls without replacing behavior.
-//! All hooks call the original WA.exe function via MinHook trampoline.
+//! Speech / fanfare / FE SFX hooks.
 //!
 //! Hooks:
-//! - PlayFeSfx (0x4D7960): stdcall(sfx_name), RET 0x4
-//! - PlayFanfare_CurrentTeam (0x4D78E0): usercall(EAX=index), plain RET
-//! - DSSound_LoadSpeechBank (0x571660): usercall(EAX=DDGame) + 3 stack, RET 0xC
+//! - PlayFeSfx (0x4D7960): stdcall(sfx_name), RET 0x4 — REPLACED
+//! - PlayFanfare_Default (0x4D7500): stdcall(team_type), RET 0x4 — REPLACED
+//! - PlayFanfare_CurrentTeam (0x4D78E0): usercall(EAX=index), plain RET — passthrough
+//! - DSSound_LoadSpeechBank (0x571660): usercall(EAX=DDGame) + 3 stack, RET 0xC — passthrough
 
-use std::ffi::CStr;
+use std::ffi::{c_char, CStr};
 use std::sync::atomic::{AtomicU32, Ordering};
 
+use heapless::CString;
+
+use openwa_lib::rebase::rb;
 use openwa_types::address::va;
 
 use crate::hook::{self, usercall_trampoline};
 use crate::log_line;
 
+/// Windows MAX_PATH (260 bytes including nul terminator).
+const MAX_PATH: usize = 260;
+
 // ============================================================
-// PlayFeSfx passthrough (0x4D7960)
+// WavPlayerHandle — typed wrapper for WA's WavPlayer instances
 // ============================================================
-// stdcall(sfx_name: *const u8), RET 0x4
 
-static ORIG_PLAY_FE_SFX: AtomicU32 = AtomicU32::new(0);
+/// Handle to a WA.exe WavPlayer instance (opaque, unknown size).
+///
+/// Known globals:
+/// - `va::FESFX_WAV_PLAYER` (0x6AC888) — frontend sound effects
+/// - `va::FANFARE_WAV_PLAYER` (0x6AC890) — team fanfares
+#[derive(Clone, Copy)]
+struct WavPlayerHandle(u32);
+
+impl WavPlayerHandle {
+    /// Read a WavPlayerHandle from a Ghidra global address.
+    unsafe fn from_global(ghidra_addr: u32) -> Self {
+        Self(rb(ghidra_addr))
+    }
+
+    /// Stop and release the current DirectSound buffer.
+    /// WavPlayer_Stop: usercall(ESI=player, EDI=&result), plain RET.
+    unsafe fn stop(self) {
+        wav_player_stop_raw(self.0, rb(va::WAV_PLAYER_STOP));
+    }
+
+    /// Open a WAV file, parse RIFF, create DirectSound buffer.
+    /// WavPlayer_LoadAndPlay: usercall(ESI=&result) + stack(player, path, 0), RET 0xC.
+    unsafe fn load(self, path: *const c_char) {
+        wav_player_load_raw(self.0, path.cast(), rb(va::WAV_PLAYER_LOAD_AND_PLAY));
+    }
+
+    /// Play the loaded buffer at the given volume.
+    /// WavPlayer_Play: usercall(EDI=&result) + stack(player, volume), RET 0x8.
+    unsafe fn play(self, volume: u32) {
+        wav_player_play_raw(self.0, volume, rb(va::WAV_PLAYER_PLAY));
+    }
+}
+
+// Naked asm wrappers for WavPlayer usercall functions.
+// ESI/EDI are LLVM-reserved, so we must use naked functions.
+
+/// cdecl(player, func_addr) — sets ESI=player, EDI=&result, calls func.
+#[unsafe(naked)]
+unsafe extern "cdecl" fn wav_player_stop_raw(_player: u32, _func: u32) {
+    core::arch::naked_asm!(
+        "push esi",
+        "push edi",
+        "sub esp, 4",           // result on stack
+        "mov esi, [esp + 16]",  // player (arg1, past saved esi+edi+result)
+        "lea edi, [esp]",       // &result
+        "call [esp + 20]",      // func (arg2)
+        "add esp, 4",           // drop result
+        "pop edi",
+        "pop esi",
+        "ret",
+    );
+}
+
+/// cdecl(player, path, func_addr) — pushes stack params, sets ESI=&result, calls func.
+/// Stack layout after push esi + sub esp,4:
+///   ESP+0=result, +4=saved_esi, +8=retaddr, +12=player, +16=path, +20=func
+/// Callee expects stack params: [ESP+4]=player, [ESP+8]=path, [ESP+12]=0
+#[unsafe(naked)]
+unsafe extern "cdecl" fn wav_player_load_raw(_player: u32, _path: *const u8, _func: u32) {
+    core::arch::naked_asm!(
+        "push esi",
+        "sub esp, 4",              // result on stack
+        "lea esi, [esp]",          // ESI = &result
+        // Push in reverse order: 0, path, player
+        "push 0",                  // third param=0 (ESP: +16=player, +20=path, +24=func)
+        "push dword ptr [esp+20]", // second param=path (ESP: +20=player, +24=path, +28=func)
+        "push dword ptr [esp+20]", // first param=player (ESP: +28=path, +32=func)
+        "call dword ptr [esp+32]", // call func; RET 0xC cleans 3 params
+        "add esp, 4",              // drop result
+        "pop esi",
+        "ret",
+    );
+}
+
+/// cdecl(player, volume, func_addr) — pushes stack params, sets EDI=&result, calls func.
+/// Stack layout after push edi + sub esp,4:
+///   ESP+0=result, +4=saved_edi, +8=retaddr, +12=player, +16=volume, +20=func
+/// Callee expects stack params: [ESP+4]=player, [ESP+8]=volume
+#[unsafe(naked)]
+unsafe extern "cdecl" fn wav_player_play_raw(_player: u32, _volume: u32, _func: u32) {
+    core::arch::naked_asm!(
+        "push edi",
+        "sub esp, 4",              // result on stack
+        "lea edi, [esp]",          // EDI = &result
+        // Push in reverse order: volume, player
+        "push dword ptr [esp+16]", // second param=volume (ESP: +16=player, +24=func)
+        "push dword ptr [esp+16]", // first param=player (ESP: +28=func)
+        "call dword ptr [esp+28]", // call func; RET 0x8 cleans 2 params
+        "add esp, 4",              // drop result
+        "pop edi",
+        "ret",
+    );
+}
+
+
+// ============================================================
+// WA function wrappers
+// ============================================================
+
+/// GetTeamConfigName: usercall(ECX=index_0based, EAX=output_buf), plain RET.
+/// Jump table with 49 cases (0-48). Writes null-terminated country/config
+/// name (e.g. "Finland", "Simple", "USA") into the buffer at EAX.
+unsafe fn get_team_config_name(index_0based: u32, buf: *mut u8) {
+    core::arch::asm!(
+        "call {func}",
+        func = in(reg) rb(va::GET_TEAM_CONFIG_NAME),
+        in("ecx") index_0based,
+        in("eax") buf as u32,
+        clobber_abi("C"),
+    );
+}
+
+// ============================================================
+// PlayFeSfx replacement (0x4D7960)
+// ============================================================
+// stdcall(sfx_name: *const u8), RET 0x4
+// Builds "fesfx\<name>.wav", plays on FESFX_WAV_PLAYER.
 
 unsafe extern "stdcall" fn hook_play_fe_sfx(sfx_name: *const u8) {
     let name = if !sfx_name.is_null() {
@@ -33,9 +152,58 @@ unsafe extern "stdcall" fn hook_play_fe_sfx(sfx_name: *const u8) {
     };
     let _ = log_line(&format!("[Speech] PlayFeSfx: \"{}\"", name));
 
-    let orig: unsafe extern "stdcall" fn(*const u8) =
-        core::mem::transmute(ORIG_PLAY_FE_SFX.load(Ordering::Relaxed) as usize);
-    orig(sfx_name);
+    // Build null-terminated path: "fesfx\<name>.wav"
+    let mut path = CString::<MAX_PATH>::new();
+    let _ = path.extend_from_bytes(b"fesfx\\");
+    let _ = path.extend_from_bytes(name.as_bytes());
+    let _ = path.extend_from_bytes(b".wav");
+
+    let player = WavPlayerHandle::from_global(va::FESFX_WAV_PLAYER);
+    player.stop();
+    player.load(path.as_ptr());
+    player.play(0);
+}
+
+// ============================================================
+// PlayFanfare_Default replacement (0x4D7500)
+// ============================================================
+// stdcall(team_type: u32), RET 0x4
+// If team_type in 1..=49, looks up config name; else "Simple".
+// Builds "<wa_path>\user\Fanfare\<name>.wav", plays on FANFARE_WAV_PLAYER.
+
+unsafe extern "stdcall" fn hook_play_fanfare_default(team_type: u32) {
+    // Get the fanfare name
+    let mut name_buf = [0u8; 64];
+    if (1..=49).contains(&team_type) {
+        get_team_config_name(team_type - 1, name_buf.as_mut_ptr());
+    } else {
+        name_buf[..7].copy_from_slice(b"Simple\0");
+    }
+    let name = CStr::from_ptr(name_buf.as_ptr() as *const i8)
+        .to_str()
+        .unwrap_or("Simple");
+
+    // Read WA data path
+    let wa_path = CStr::from_ptr(rb(va::WA_DATA_PATH) as *const i8)
+        .to_str()
+        .unwrap_or(".");
+
+    let _ = log_line(&format!(
+        "[Speech] PlayFanfare_Default: team_type={} name=\"{}\"",
+        team_type, name
+    ));
+
+    // Build null-terminated path: "<wa_path>\user\Fanfare\<name>.wav"
+    let mut path = CString::<MAX_PATH>::new();
+    let _ = path.extend_from_bytes(wa_path.as_bytes());
+    let _ = path.extend_from_bytes(b"\\user\\Fanfare\\");
+    let _ = path.extend_from_bytes(name.as_bytes());
+    let _ = path.extend_from_bytes(b".wav");
+
+    let player = WavPlayerHandle::from_global(va::FANFARE_WAV_PLAYER);
+    player.stop();
+    player.load(path.as_ptr());
+    player.play(0);
 }
 
 // ============================================================
@@ -124,12 +292,17 @@ unsafe extern "cdecl" fn load_speech_bank_impl(
 
 pub fn install() -> Result<(), String> {
     unsafe {
-        let trampoline = hook::install(
+        hook::install(
             "PlayFeSfx",
             va::PLAY_FE_SFX,
             hook_play_fe_sfx as *const (),
         )?;
-        ORIG_PLAY_FE_SFX.store(trampoline as u32, Ordering::Relaxed);
+
+        hook::install(
+            "PlayFanfare_Default",
+            va::PLAY_FANFARE_DEFAULT,
+            hook_play_fanfare_default as *const (),
+        )?;
 
         let trampoline = hook::install(
             "PlayFanfare_CurrentTeam",