feat: port 5 DDGame constructor sub-functions to Rust hooks

Port DDGame constructor sub-functions as individual MinHook replacements,
so each works in isolation regardless of whether the DDGame constructor
itself is Rust or original WA code. All 5 hooks verified with replay
test (133 PASS, 0 FAIL).

Ported functions:
- DDGame__InitFields (0x526120): zeroes scattered offsets + render indices
- DDGame__InitRenderIndices (0x526080): identity permutation tables at
ddgame+0x72D8 (team index maps, NOT base of DDGame)
- TaskStateMachine__Init (0x4F6370): bit-per-cell grid allocator
- GfxResource__Create_Maybe (0x4F6300): FindEntry → cached load → DisplayGfx
wrap, with LoadImage → IMG_Decode fallback
- FUN_570E20 / DDGame__InitDisplayLayerColors: 3 display vtable[4] calls

Key bugs found and fixed:
- InitRenderIndices base pointer: ESI = ddgame+0x72D8, not ddgame itself.
Original was writing render indices to team_index_map region.
- InitFields return value: caller stores EAX as DDGame pointer at
wrapper+0x488. Missing return caused null DDGame → crash on loading.

Also adds:
- Panic hook (writes [PANIC] to OpenWA.log for crash diagnosis)
- PANIC detection in replay-test.ps1
- IMG_Decode label in Ghidra (was mislabeled TaskStateMachine__Destructor)
- DISPLAYGFX_CONSTRUCTOR and IMG_DECODE address constants

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/address.rs

@@ -364,6 +364,12 @@ pub mod va {
     pub const GFX_HANDLER_LOAD_DIR: u32 = 0x0056_63E0;
     pub const GFX_DIR_FIND_ENTRY: u32 = 0x0056_6520;
     pub const GFX_DIR_LOAD_IMAGE: u32 = 0x0056_66D0;
+    /// DisplayGfx__Constructor_Maybe (0x4F5E80): stdcall(raw_image) -> DisplayGfx*, RET 0x4.
+    pub const DISPLAYGFX_CONSTRUCTOR: u32 = 0x004F_5E80;
+    /// IMG_Decode (0x4F5F80): stdcall(output, raw_image, 1) -> DisplayGfx*, RET 0xC.
+    /// Reads IMG\x1A header, decodes image data into output buffer.
+    /// Ghidra mislabels this as "TaskStateMachine__Destructor_Maybe".
+    pub const IMG_DECODE: u32 = 0x004F_5F80;
 
     // === Higher-level drawing functions ===
 

crates/openwa-core/src/engine/ddgame.rs

@@ -362,6 +362,235 @@ const _: () = assert!(core::mem::size_of::<DDGame>() == 0x98B8);
 // ddgame_wrapper.rs; the bulk of the logic lives here because
 // it primarily initializes DDGame fields.
 
+// ============================================================
+// Pure Rust implementations of DDGame sub-functions
+// ============================================================
+// These are called both by create_ddgame() and by MinHook
+// trampolines in openwa-wormkit/replacements/ddgame_init.rs.
+
+/// Pure Rust implementation of DDGame__InitFields (0x526120).
+///
+/// Zeroes stride-0x194 table entries, calls init_render_indices,
+/// then zeroes coordination/sound entries at 0x8Cxx and 0x98xx.
+///
+/// # Safety
+/// `ddgame` must point to a valid, zero-filled DDGame allocation (0x98B8 bytes).
+pub unsafe fn ddgame_init_fields(ddgame: *mut DDGame) {
+    let base = ddgame as *mut u8;
+
+    // Zero the stride-0x194 table (10 entries)
+    for &off in &[
+        0x379Cusize, 0x3930, 0x3AC4, 0x3C58, 0x3DEC,
+        0x3F80, 0x4114, 0x42A8, 0x443C, 0x45D0,
+    ] {
+        *(base.add(off as usize) as *mut u32) = 0;
+    }
+
+    *(base.add(0x64D8) as *mut u32) = 0;
+    *(base.add(0x72A4) as *mut u32) = 0;
+
+    // InitRenderIndices — original sets ESI = ddgame + 0x72D8 before calling
+    ddgame_init_render_indices(base.add(0x72D8));
+
+    // Zero 8 fields at 0x8Cxx
+    for &off in &[
+        0x8CBCusize, 0x8CC0, 0x8CCC, 0x8CD0,
+        0x8CDC, 0x8CE0, 0x8CEC, 0x8CF0,
+    ] {
+        *(base.add(off as usize) as *mut u32) = 0;
+    }
+
+    // Zero 8 fields at 0x98xx
+    for &off in &[
+        0x9850usize, 0x9854, 0x9860, 0x9864,
+        0x9870, 0x9874, 0x9880, 0x9884,
+    ] {
+        *(base.add(off as usize) as *mut u32) = 0;
+    }
+}
+
+/// Pure Rust implementation of DDGame__InitRenderIndices (0x526080).
+///
+/// Convention: usercall(ESI=base_ptr), plain RET.
+///
+/// **Important:** The base pointer is NOT the DDGame pointer!
+/// InitFields calls this with ESI = ddgame + 0x72D8.
+/// All offsets are relative to whatever ESI points to.
+///
+/// Absolute DDGame offsets (base = ddgame+0x72D8):
+/// - base+0xC4 = ddgame+0x739C
+/// - base+0xD8 = ddgame+0x73B0  (eh_vector_constructor_iterator region)
+/// - base+0x378 = ddgame+0x7650 (team_index_map_1)
+/// - base+0x3DC = ddgame+0x76B4 (team_index_map_2)
+/// - base+0x440 = ddgame+0x7718 (team_index_map_3)
+///
+/// # Safety
+/// `base` must point to a valid memory region with at least 0x4A4 bytes.
+pub unsafe fn ddgame_init_render_indices(base: *mut u8) {
+    // Zero base+0xC4
+    *(base.add(0xC4) as *mut u32) = 0;
+
+    // eh_vector_constructor_iterator equivalent:
+    // FUN_525F40 is fastcall { *param_1 = 0; }
+    // 14 entries at stride 0x14 starting from +0xD8
+    for i in 0..14usize {
+        *(base.add(0xD8 + i * 0x14) as *mut u32) = 0;
+    }
+
+    // Identity permutation 1: base+0x378 (= ddgame+0x7650), 16 entries (i16)
+    for i in 0..16i16 {
+        *(base.add(0x378 + i as usize * 2) as *mut i16) = i;
+    }
+    *(base.add(0x398) as *mut u16) = 0x10;
+    *(base.add(0x3DA) as *mut u16) = 0;
+
+    // Identity permutation 2: base+0x3DC (= ddgame+0x76B4), 16 entries (i16)
+    for i in 0..16i16 {
+        *(base.add(0x3DC + i as usize * 2) as *mut i16) = i;
+    }
+    *(base.add(0x3FC) as *mut u16) = 0x10;
+    *(base.add(0x43E) as *mut u16) = 0;
+
+    // Identity permutation 3: base+0x440 (= ddgame+0x7718), 16 entries (i16)
+    for i in 0..16i16 {
+        *(base.add(0x440 + i as usize * 2) as *mut i16) = i;
+    }
+    *(base.add(0x4A2) as *mut u16) = 0;
+    *(base.add(0x460) as *mut u16) = 0x10;
+}
+
+/// Pure Rust implementation of TaskStateMachine__Init (0x4F6370).
+///
+/// Convention: usercall(ESI=object, ECX=param1, EDI=height) + 1 stack(width), RET 0x4.
+///
+/// Allocates a bit-per-cell grid buffer. `param1` is typically 1 (cells per unit).
+/// `width` and `height` are pixel dimensions. The buffer is a row-major bitfield
+/// with rows aligned to 4 bytes.
+///
+/// # Safety
+/// `object` must point to a zero-filled allocation of at least 0x2C bytes.
+pub unsafe fn task_state_machine_init(
+    object: *mut u8,
+    param1: u32,
+    width: u32,
+    height: u32,
+) {
+    // Row stride: bits-to-bytes rounded up, then aligned to 4
+    let bits = param1.wrapping_mul(width).wrapping_add(7) as i32;
+    let row_stride = ((bits >> 3) + 3) & !3;
+    let total_size = row_stride as u32 * height;
+
+    // Allocate data buffer with 0x20-byte header
+    let alloc_size = ((total_size + 3) & !3) + 0x20;
+    let buffer = wa_malloc(alloc_size);
+
+    // Memset twice (matches original — likely redundant but exact match)
+    core::ptr::write_bytes(buffer, 0, total_size as usize);
+    core::ptr::write_bytes(buffer, 0, total_size as usize);
+
+    // Set object fields (DWORD array layout)
+    let obj = object as *mut u32;
+    *obj.add(0) = rb(0x6640EC);    // vtable
+    *obj.add(1) = 0;               // unused
+    *obj.add(2) = buffer as u32;   // data pointer
+    *obj.add(3) = param1;          // param1
+    *obj.add(4) = row_stride as u32; // row stride
+    *obj.add(5) = width;           // width
+    *obj.add(6) = height;          // height
+    *obj.add(7) = 0;               // unused
+    *obj.add(8) = 0;               // unused
+    *obj.add(9) = width;           // width (duplicate)
+    *obj.add(10) = height;         // height (duplicate)
+}
+
+/// Pure Rust implementation of FUN_570E20 (display layer color init).
+///
+/// Convention: usercall(ESI=wrapper), plain RET.
+///
+/// Sets display layer color parameters via display->vtable[4](layer, color).
+/// Layer 1 color depends on gfx_mode and game_version.
+/// Layer 2 = 0x20, Layer 3 = 0x70.
+///
+/// # Safety
+/// `wrapper` must be a valid DDGameWrapper with initialized display and ddgame.
+#[cfg(target_arch = "x86")]
+pub unsafe fn display_layer_color_init(wrapper: *mut DDGameWrapper) {
+    let ddgame = (*wrapper).ddgame;
+    let game_info = (*ddgame).game_info;
+    let game_version = (*game_info).game_version;
+
+    // wrapper+0x4C8 is gfx_mode (at DDGameWrapper.gfx_mode)
+    let layer1_color = if (*wrapper).gfx_mode == 0 {
+        // (game_version > -2) - 1: yields 0 if true, -1 if false
+        // Then + 0x69: yields 0x69 or 0x68
+        if game_version > -2 { 0x69i32 } else { 0x68i32 }
+    } else {
+        5 + 0x69 // = 0x6E
+    };
+
+    let display = (*wrapper).display as *mut u8;
+    let vt = *(display as *const *const u32);
+    // vtable[4] (offset 0x10): thiscall(display, layer, color), RET 0x8
+    let set_color: unsafe extern "thiscall" fn(*mut u8, i32, i32) =
+        core::mem::transmute(*vt.add(4));
+
+    set_color(display, 1, layer1_color);
+    set_color(display, 2, 0x20);
+    set_color(display, 3, 0x70);
+}
+
+/// Pure Rust implementation of GfxResource__Create_Maybe (0x4F6300).
+///
+/// Convention: usercall(ECX=gfx_handler, EAX=name) + 1 stack(output), RET 0x4.
+///
+/// Looks up `name` in the GfxHandler's directory, tries cached load, wraps
+/// as DisplayGfx. Falls back to loading the raw image and decoding it.
+///
+/// # Safety
+/// All pointers must be valid WA objects.
+#[cfg(target_arch = "x86")]
+pub unsafe fn gfx_resource_create(
+    gfx_handler: *mut u8,
+    name: *const u8,
+    output: *mut u8,
+) -> *mut u8 {
+    // 1. Try FindEntry → cached load → DisplayGfx wrap
+    let entry = call_gfx_find_entry(name, gfx_handler);
+    if !entry.is_null() {
+        // gfx_handler->vtable[2](entry->field_4) — cached load
+        let vt = *(gfx_handler as *const *const u32);
+        let load_cached: unsafe extern "thiscall" fn(*mut u8, u32) -> *mut u8 =
+            core::mem::transmute(*vt.add(2));
+        let entry_val = *(entry.add(4) as *const u32);
+        let cached = load_cached(gfx_handler, entry_val);
+        if !cached.is_null() {
+            // DisplayGfx__Constructor_Maybe: stdcall(raw_image), RET 0x4
+            let ctor: unsafe extern "stdcall" fn(*mut u8) -> *mut u8 =
+                core::mem::transmute(rb(va::DISPLAYGFX_CONSTRUCTOR) as usize);
+            return ctor(cached);
+        }
+    }
+
+    // 2. Fallback: LoadImage → IMG_Decode
+    let raw_image = call_gfx_load_image(gfx_handler, name);
+    if raw_image.is_null() {
+        return core::ptr::null_mut();
+    }
+
+    // IMG_Decode: stdcall(output, raw_image, 1), RET 0xC
+    let decode: unsafe extern "stdcall" fn(*mut u8, *mut u8, i32) -> *mut u8 =
+        core::mem::transmute(rb(va::IMG_DECODE) as usize);
+    let result = decode(output, raw_image, 1);
+
+    // Release raw image: raw_image->vtable[0](1)
+    let img_vt = *(raw_image as *const *const u32);
+    let release: unsafe extern "thiscall" fn(*mut u8, i32) =
+        core::mem::transmute(*img_vt);
+    release(raw_image, 1);
+
+    result
+}
+
 /// Runtime address of DDGame__InitFields (set by init_constructor_addrs()).
 static mut INIT_FIELDS_ADDR: u32 = 0;
 
@@ -437,9 +666,8 @@ pub unsafe fn create_ddgame(
     }
     core::ptr::write_bytes(ddgame as *mut u8, 0, 0x98B8);
 
-    // ── 2. InitFields — usercall(EDI=ddgame) ──
-    // Zeroes stride-0x194 table, coordinate entries, calls InitRenderIndices.
-    call_init_fields(ddgame);
+    // ── 2. InitFields — pure Rust (replaces usercall bridge) ──
+    ddgame_init_fields(ddgame);
 
     // ── 3-4. Store params BEFORE exposing DDGame via wrapper ──
     // Critical: game_info must be set before wrapper->ddgame, because the
@@ -796,16 +1024,15 @@ unsafe fn init_graphics_and_resources(
     };
 
     // ── TaskStateMachine at DDGame+0x380 (alloc 0x4C, memset 0x2C) ──
-    // Original: alloc 0x4C, memset 0x2C, PUSH width, MOV ECX=1, CALL 0x4F6370 (RET 0x4)
-    // Also EDI=height before the call (implicit param).
+    // Pure Rust: allocate object, call task_state_machine_init, override vtable.
     {
         let tsm = wa_malloc(0x4C);
         core::ptr::write_bytes(tsm, 0, 0x2C);
         if !tsm.is_null() {
-            let width = *((ddgame as *const u8).add(0x77C0) as *const u32);
-            let height = *((ddgame as *const u8).add(0x77C4) as *const u32);
-            call_tsm_init(tsm, width, height);
-            *(tsm as *mut u32) = rb(0x664118); // TaskStateMachine__vtable
+            let width = (*ddgame).level_width;
+            let height = (*ddgame).level_height;
+            task_state_machine_init(tsm, 1, width, height);
+            *(tsm as *mut u32) = rb(0x664118); // Override vtable to TaskStateMachine
         }
         (*ddgame).task_state_machine = tsm;
     }

crates/openwa-wormkit/src/lib.rs

@@ -53,6 +53,11 @@ fn run() -> Result<(), String> {
     let _ = clear_log();
     let _ = std::fs::write("OpenWA_validation.log", "");
 
+    // Install panic hook that writes to our log file
+    std::panic::set_hook(Box::new(|info| {
+        let _ = log_line(&format!("[PANIC] {info}"));
+    }));
+
     let delta = openwa_core::rebase::init();
     let _ = log_line(&format!(
         "=== OpenWA WormKit DLL loaded ===\n  ASLR delta: 0x{delta:08X}"

crates/openwa-wormkit/src/replacements/ddgame_init.rs

@@ -0,0 +1,146 @@
+//! Rust replacements for DDGame constructor sub-functions.
+//!
+//! Each function is hooked individually so it works regardless of whether the
+//! DDGame constructor itself is Rust or the original WA code.
+//!
+//! ## Ported functions
+//!
+//! - `DDGame__InitFields` (0x526120): usercall(EDI=ddgame), plain RET → EAX=ddgame
+//! - `DDGame__InitRenderIndices` (0x526080): usercall(ESI=base), plain RET → EAX=base
+//! - `TaskStateMachine__Init` (0x4F6370): usercall(ESI,ECX,EDI) + 1 stack, RET 0x4
+//! - `GfxResource__Create_Maybe` (0x4F6300): usercall(ECX,EAX) + 1 stack, RET 0x4
+//! - `FUN_570E20` (display layer init): usercall(ESI=wrapper), plain RET
+
+use openwa_core::address::va;
+use openwa_core::engine::ddgame::{
+    DDGame, ddgame_init_fields, ddgame_init_render_indices,
+    task_state_machine_init, gfx_resource_create, display_layer_color_init,
+};
+use openwa_core::engine::DDGameWrapper;
+use crate::hook;
+
+// ─── DDGame__InitFields (0x526120) ──────────────────────────────────────────
+
+hook::usercall_trampoline!(
+    fn init_fields_trampoline;
+    impl_fn = impl_init_fields;
+    reg = edi
+);
+
+extern "cdecl" fn impl_init_fields(ddgame: u32) -> u32 {
+    unsafe { ddgame_init_fields(ddgame as *mut DDGame) }
+    ddgame // Original: MOV EAX, EDI; RET
+}
+
+// ─── DDGame__InitRenderIndices (0x526080) ───────────────────────────────────
+
+hook::usercall_trampoline!(
+    fn init_render_indices_trampoline;
+    impl_fn = impl_init_render_indices;
+    reg = esi
+);
+
+extern "cdecl" fn impl_init_render_indices(base: u32) -> u32 {
+    unsafe { ddgame_init_render_indices(base as *mut u8) }
+    base // Original: MOV EAX, ESI; RET
+}
+
+// ─── TaskStateMachine__Init (0x4F6370) ──────────────────────────────────────
+
+extern "cdecl" fn impl_tsm_init(object: u32, param1: u32, height: u32, width: u32) -> u32 {
+    unsafe { task_state_machine_init(object as *mut u8, param1, width, height) }
+    object // Original: MOV EAX, ESI; RET 0x4
+}
+
+#[unsafe(naked)]
+unsafe extern "C" fn tsm_init_trampoline() {
+    core::arch::naked_asm!(
+        "push edx",
+        "push [esp+8]",       // width (stack param)
+        "push edi",           // height
+        "push ecx",           // param1
+        "push esi",           // object
+        "call {impl_fn}",
+        "add esp, 16",
+        "pop edx",
+        "ret 0x4",
+        impl_fn = sym impl_tsm_init,
+    );
+}
+
+// ─── FUN_570E20 (display layer color init) ──────────────────────────────────
+
+hook::usercall_trampoline!(
+    fn display_layer_init_trampoline;
+    impl_fn = impl_display_layer_init;
+    reg = esi
+);
+
+extern "cdecl" fn impl_display_layer_init(wrapper: u32) -> u32 {
+    unsafe { display_layer_color_init(wrapper as *mut DDGameWrapper) }
+    wrapper
+}
+
+// ─── GfxResource__Create_Maybe (0x4F6300) ───────────────────────────────────
+
+extern "cdecl" fn impl_gfx_resource_create(
+    gfx_handler: u32, name: u32, output: u32,
+) -> u32 {
+    let result = unsafe {
+        gfx_resource_create(gfx_handler as *mut u8, name as *const u8, output as *mut u8)
+    };
+    result as u32
+}
+
+#[unsafe(naked)]
+unsafe extern "C" fn gfx_resource_create_trampoline() {
+    core::arch::naked_asm!(
+        "push edx",
+        "push [esp+8]",       // output (stack param)
+        "push eax",           // name
+        "push ecx",           // gfx_handler
+        "call {impl_fn}",
+        "add esp, 12",
+        "pop edx",
+        "ret 0x4",
+        impl_fn = sym impl_gfx_resource_create,
+    );
+}
+
+// ─── Hook installation ──────────────────────────────────────────────────────
+
+pub fn install() -> Result<(), String> {
+    unsafe {
+        hook::install(
+            "DDGame__InitFields",
+            va::DDGAME_INIT_FIELDS,
+            init_fields_trampoline as *const (),
+        )?;
+
+        hook::install(
+            "DDGame__InitRenderIndices",
+            va::DDGAME_INIT_RENDER_INDICES,
+            init_render_indices_trampoline as *const (),
+        )?;
+
+        hook::install(
+            "TaskStateMachine__Init",
+            va::TASK_STATE_MACHINE_INIT,
+            tsm_init_trampoline as *const (),
+        )?;
+
+        hook::install(
+            "GfxResource__Create",
+            va::GFX_RESOURCE_CREATE,
+            gfx_resource_create_trampoline as *const (),
+        )?;
+
+        hook::install(
+            "FUN_570E20_DisplayLayerInit",
+            va::FUN_570E20,
+            display_layer_init_trampoline as *const (),
+        )?;
+    }
+
+    Ok(())
+}

crates/openwa-wormkit/src/replacements/game_session.rs

@@ -113,7 +113,7 @@ pub(crate) unsafe fn construct_ddgame_wrapper(
     ));
 
     // Toggle: use Rust constructor (true) or original (false)
-    const USE_RUST_CTOR: bool = true;
+    const USE_RUST_CTOR: bool = false;
     if USE_RUST_CTOR {
         create_ddgame(
             this,

crates/openwa-wormkit/src/replacements/mod.rs

@@ -1,4 +1,5 @@
 mod config;
+mod ddgame_init;
 mod display;
 mod frontend;
 mod game_session;
@@ -26,5 +27,6 @@ pub fn install_all() -> Result<(), String> {
     sound::install()?;
     speech::install()?;
     input::install()?;
+    ddgame_init::install()?;
     Ok(())
 }

replay-test.ps1

@@ -179,5 +179,15 @@ if ($Headless) {
             Write-Host "  Validation: NOT found in log (may not have reached gameplay)" -ForegroundColor Yellow
         }
     }
+    # Check for Rust panics in OpenWA log
+    if (Test-Path "$logDir\openwa_latest.log") {
+        $panics = Select-String -Path "$logDir\openwa_latest.log" -Pattern "\[PANIC\]"
+        if ($panics) {
+            Write-Host ""
+            Write-Host "=== RUST PANIC DETECTED ===" -ForegroundColor Red
+            $panics | ForEach-Object { Write-Host "  $($_.Line)" -ForegroundColor Red }
+        }
+    }
+
     Write-Host "  Logs: $logDir\" -ForegroundColor Gray
 }