refactor: add typed structs and named fields to hardware_init

- Extend GameInfo to 0xF91C with named fields (display_width/height,
display_flags, headless_mode, speech_enabled, etc.)
- Add 6 placeholder structs: DisplayGfx, InputCtrl, GameTimer,
StreamingAudio, DDNetGameWrapper, GameStats
- Expand DDKeyboard with construction fields and 0x33C size assert
- Fix DSSound size to 0xBE0 and rename COM fields (direct_sound,
primary_buffer, init_success)
- Type GameSession pointers: DDGameWrapper, DDKeyboard, DSSound, Palette
- Fix DDKeyboard+0x4: must store ADDRESS of GameInfo+0xF918, not value
- Fix DSSound init: check Play() result, not outer DirectSoundCreate hr

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/address.rs

@@ -664,6 +664,8 @@ pub mod va {
     pub const G_FULLSCREEN_FLAG: u32 = 0x007A_084C;
     /// Suppress-cursor flag — if non-zero, skip SetCursorPos/ClipCursor in hardware init.
     pub const G_SUPPRESS_CURSOR: u32 = 0x0088_E485;
+    /// IAT thunk for MapWindowPoints (USER32.dll import).
+    pub const IAT_MAP_WINDOW_POINTS: u32 = 0x0061_A588;
     /// Total sprite data bytes loaded (accumulated by ProcessSprite)
     pub const G_SPRITE_DATA_BYTES: u32 = 0x007A_0864;
     /// Total sprite frame count loaded

crates/openwa-core/src/ddkeyboard.rs

@@ -5,17 +5,39 @@
 /// PollKeyboardState (0x572290): drains WM_KEY messages, calls GetKeyboardState,
 /// normalizes to both `key_state` (+0x11C) and `prev_state` (+0x21C) buffers.
 ///
-/// PARTIAL: Only confirmed fields. Minimum size estimated from known offsets.
+/// Size: 0x33C bytes.
+/// Inline construction in GameEngine__InitHardware:
+///   - vtable = 0x66AEC8
+///   - dinput_device = GameInfo+0xF918
+///   - _field_008 = 1
+///   - key_state zeroed (0x100 bytes)
+///   - prev_state zeroed (0x100 bytes)
+///   - _field_014 = 0, _field_018 = 0
 #[repr(C)]
 pub struct DDKeyboard {
     /// 0x000: Vtable pointer (0x66AEC8)
     pub vtable: *mut u8,
-    /// 0x004-0x11B: Unknown
-    pub _unknown_004: [u8; 0x118],
+    /// 0x004: Pointer into GameInfo+0xF918 (shared input state location).
+    /// Stores the ADDRESS of GameInfo+0xF918, not its value.
+    pub game_info_input_ptr: u32,
+    /// 0x008: Init flag (set to 1)
+    pub _field_008: u32,
+    /// 0x00C-0x013: Unknown
+    pub _unknown_00c: [u8; 8],
+    /// 0x014: Cleared to 0 during construction
+    pub _field_014: u32,
+    /// 0x018: Cleared to 0 during construction
+    pub _field_018: u32,
+    /// 0x01C-0x11B: Unknown
+    pub _unknown_01c: [u8; 0x100],
     /// 0x11C: Current key state buffer (256 bytes).
     /// Populated by PollKeyboardState via GetKeyboardState.
     pub key_state: [u8; 256],
     /// 0x21C: Previous key state buffer (256 bytes).
     /// Copied from key_state at start of each poll cycle.
     pub prev_state: [u8; 256],
+    /// 0x31C: Unknown trailing fields
+    pub _unknown_31c: [u8; 0x20],
 }
+
+const _: () = assert!(core::mem::size_of::<DDKeyboard>() == 0x33C);

crates/openwa-core/src/ddnetgame_wrapper.rs

@@ -0,0 +1,15 @@
+/// DDNetGameWrapper — network game wrapper.
+///
+/// Constructor: DDNetGameWrapper__Constructor (0x56D1F0), stdcall(this) → DDNetGameWrapper*.
+/// Size: 0x2C bytes.
+///
+/// Created by GameEngine__InitHardware (always, after DDGameWrapper).
+/// Stored at GameSession+0xC0.
+///
+/// OPAQUE: Internal layout not yet mapped.
+#[repr(C)]
+pub struct DDNetGameWrapper {
+    pub _data: [u8; 0x2C],
+}
+
+const _: () = assert!(core::mem::size_of::<DDNetGameWrapper>() == 0x2C);

crates/openwa-core/src/display_gfx.rs

@@ -0,0 +1,16 @@
+/// DisplayGfx — main display/graphics subsystem container.
+///
+/// Constructor: DisplayGfx__Constructor (0x569C10), stdcall(this) → DisplayGfx*.
+/// Size: 0x24E28 bytes.
+///
+/// Created by GameEngine__InitHardware in normal (non-headless) mode.
+/// Stored at GameSession+0xAC.
+///
+/// OPAQUE: Internal layout not yet mapped.
+#[repr(C)]
+pub struct DisplayGfx {
+    pub vtable: *mut u8,
+    pub _unknown_004: [u8; 0x24E28 - 4],
+}
+
+const _: () = assert!(core::mem::size_of::<DisplayGfx>() == 0x24E28);

crates/openwa-core/src/dssound.rs

@@ -3,40 +3,39 @@ use crate::fixed::Fixed;
 ///
 /// Created by DSSound__Constructor (0x573D50).
 /// Vtable: 0x66AF20
+/// Size: 0xBE0 bytes (allocated by GameEngine__InitHardware).
 ///
 /// Manages sound playback through DirectSound.
 /// Has 500 sound channel slots and a master volume control.
 ///
-/// PARTIAL: Only constructor-confirmed fields.
-/// Ghidra uses DWORD-indexed offsets.
+/// PARTIAL: Only constructor-confirmed and InitHardware-confirmed fields.
 #[repr(C)]
 pub struct DSSound {
     /// 0x000: Vtable pointer (0x66AF20)
     pub vtable: *mut u8,
-    /// 0x004: Unknown
-    pub _unknown_004: [u8; 4],
-    /// 0x008: Init field (set to 0)
-    pub _field_008: u32,
-    /// 0x00C: Init field (set to 0)
-    pub _field_00c: u32,
-    /// 0x010: Init field (set to 0)
-    pub _field_010: u32,
-    /// 0x014-0x8A3: Unknown fields
+    /// 0x004: HWND (set to hwnd after construction)
+    pub hwnd: u32,
+    /// 0x008: IDirectSound* (from DirectSoundCreate)
+    pub direct_sound: *mut u8,
+    /// 0x00C: Output param from DSSOUND_INIT_BUFFERS (primary buffer caps/format)
+    pub primary_buffer_caps: u32,
+    /// 0x010: IDirectSoundBuffer* (primary buffer, from DSSOUND_INIT_BUFFERS)
+    pub primary_buffer: *mut u8,
+    /// 0x014-0x8A3: Unknown fields (includes 500-entry channel slot table)
     pub _unknown_014: [u8; 0x890],
     /// 0x8A4: Master volume (Fixed, init 0x10000 = 1.0)
     pub volume: Fixed,
-    /// 0x8A8-0xBB3: Unknown (includes 500-entry channel slot table)
+    /// 0x8A8-0xBB3: Unknown
     pub _unknown_8a8: [u8; 0x30C],
     /// 0xBB4: Status flag 1 (init 1)
     pub status_1: u32,
     /// 0xBB8: Status flag 2 (init 1)
     pub status_2: u32,
-    /// 0xBBC: Status flag 3 (init 0)
-    pub status_3: u32,
-    /// 0xBC0-end: Unknown trailing fields
-    pub _unknown_bc0: [u8; 0x10],
+    /// 0xBBC: Init success flag — set to 1 when DirectSoundCreate +
+    /// DSSOUND_INIT_BUFFERS + IDirectSoundBuffer::Play all succeed.
+    pub init_success: u32,
+    /// 0xBC0-0xBDF: Unknown trailing fields
+    pub _unknown_bc0: [u8; 0x20],
 }
 
-// Total size uncertain — this is an estimate based on constructor analysis.
-// The 500 dword channel table starts around offset 0xD4+ but exact layout unclear.
-const _: () = assert!(core::mem::size_of::<DSSound>() == 0xBD0);
+const _: () = assert!(core::mem::size_of::<DSSound>() == 0xBE0);

crates/openwa-core/src/game_info.rs

@@ -4,8 +4,9 @@
 /// `GameInfo__LoadOptions` (0x460AC0) which reads registry values and
 /// copies global data into known offsets.
 ///
-/// PARTIAL: Only fields discovered through GameInfo__LoadOptions are mapped.
-/// The actual struct is likely larger. Conservative size 0xF500.
+/// PARTIAL: Only fields discovered through GameInfo__LoadOptions and
+/// GameEngine__InitHardware are mapped. Size extended to 0xF91C to
+/// cover all known accesses.
 #[repr(C)]
 pub struct GameInfo {
     /// 0x0000-0x044B: Unknown
@@ -21,10 +22,22 @@ pub struct GameInfo {
     pub _unknown_044d: [u8; 0xD778 - 0x44D],
 
     /// 0xD778: Crosshair overflow clamp threshold (compared to 0x11E in render).
+    /// Also passed to timer constructor and input controller init.
     pub crosshair_overflow_threshold: i32,
 
-    /// 0xD77C-0xDAE7: Unknown
-    pub _unknown_d77c: [u8; 0xDAE8 - 0xD77C],
+    /// 0xD77C-0xD9DF: Unknown
+    pub _unknown_d77c: [u8; 0xD9E0 - 0xD77C],
+
+    /// 0xD9E0: Streaming audio config data (path config passed to streaming audio ctor).
+    /// Address of this field is passed as a pointer parameter.
+    pub streaming_audio_config: [u8; 0xDAA4 - 0xD9E0],
+
+    /// 0xDAA4: Speech/streaming audio enabled flag.
+    /// If nonzero, streaming audio subsystem is created in InitHardware.
+    pub speech_enabled: u8,
+
+    /// 0xDAA5-0xDAE7: Unknown
+    pub _unknown_daa5: [u8; 0xDAE8 - 0xDAA5],
 
     // --- Cluster 1: data paths ---
 
@@ -33,8 +46,14 @@ pub struct GameInfo {
     /// 0xDAEC: Land data path ("data\land.dat", 14 bytes incl. null)
     pub land_dat_path: [u8; 14],
 
-    /// 0xDAFA-0xF39F: Unknown
-    pub _unknown_dafa: [u8; 0x18A6],
+    /// 0xDAFA-0xF373: Unknown
+    pub _unknown_dafa: [u8; 0xF374 - 0xDAFA],
+
+    /// 0xF374: Display flags passed to DDDisplay::Init.
+    pub display_flags: u32,
+
+    /// 0xF378-0xF39F: Unknown
+    pub _unknown_f378: [u8; 0xF3A0 - 0xF378],
 
     // --- Cluster 2: game options (populated by LoadOptions) ---
 
@@ -60,10 +79,16 @@ pub struct GameInfo {
     pub home_lock: u8,
     /// 0xF3B1: Unknown
     pub _unknown_f3b1: [u8; 3],
-    /// 0xF3B4: Config DWORDs from globals (7 consecutive u32s).
-    /// LoadOptions writes 5 DWORDs from G_CONFIG_DWORDS_F3B4 at indices 0..5,
-    /// then 3 DWORDs from G_CONFIG_DWORDS_F3C4 at indices 4..7 (overlapping).
-    pub _config_block_f3b4: [u32; 7],
+    /// 0xF3B4: Display width — first DWORD of the config block.
+    /// Written from G_CONFIG_DWORDS_F3B4, updated by DDDisplay::Init retry loop.
+    pub display_width: u32,
+    /// 0xF3B8: Display height — second DWORD of the config block.
+    /// Written from G_CONFIG_DWORDS_F3B4, updated by DDDisplay::Init retry loop.
+    pub display_height: u32,
+    /// 0xF3BC: Remaining config DWORDs (indices 2..7 of the original block).
+    /// LoadOptions writes indices 0..5 from G_CONFIG_DWORDS_F3B4,
+    /// then indices 4..7 from G_CONFIG_DWORDS_F3C4 (overlapping at [2]).
+    pub _config_dwords_f3bc: [u32; 5],
     /// 0xF3D0: Unknown (not written by LoadOptions)
     pub _unknown_f3d0: [u8; 4],
     /// 0xF3D4: Config DWORD (from global 0x88E3B0[0])
@@ -91,11 +116,24 @@ pub struct GameInfo {
     /// 0xF485: Config data block (64 bytes copied from global 0x88DFF3)
     pub _config_block_f485: [u8; 64],
 
-    /// 0xF4C5-0xF4FF: Unknown remainder
-    pub _unknown_f4c5: [u8; 0x3B],
+    /// 0xF4C5-0xF4FF: Unknown
+    pub _unknown_f4c5: [u8; 0xF500 - 0xF4C5],
+
+    // --- Extended region (beyond original 0xF500 conservative estimate) ---
+
+    /// 0xF500-0xF913: Unknown
+    pub _unknown_f500: [u8; 0xF914 - 0xF500],
+
+    /// 0xF914: Headless/stats mode flag.
+    /// If nonzero, InitHardware creates a GameStats stub instead of display hardware.
+    pub headless_mode: u32,
+
+    /// 0xF918: Input state field — DDKeyboard+0x4 stores a pointer TO this address.
+    /// The game reads/writes through DDKeyboard's pointer, so this must stay in place.
+    pub input_state_f918: u32,
 }
 
-const _: () = assert!(core::mem::size_of::<GameInfo>() == 0xF500);
+const _: () = assert!(core::mem::size_of::<GameInfo>() == 0xF91C);
 
 struct HexU32s<'a>(&'a [u32]);
 
@@ -138,7 +176,10 @@ impl core::fmt::Debug for GameInfo {
             .field("chat_lines", &self.chat_lines)
             .field("pinned_chat_lines", &format_args!("0x{:08X}", self.pinned_chat_lines))
             .field("home_lock", &self.home_lock)
-            .field("_config_block_f3b4", &HexU32s(&self._config_block_f3b4))
+            .field("display_flags", &format_args!("0x{:08X}", self.display_flags))
+            .field("display_width", &self.display_width)
+            .field("display_height", &self.display_height)
+            .field("_config_dwords_f3bc", &HexU32s(&self._config_dwords_f3bc))
             .field("_config_dword_f3d4", &format_args!("0x{:08X}", self._config_dword_f3d4))
             .field("_config_dword_f3d8", &format_args!("0x{:08X}", self._config_dword_f3d8))
             .field("capture_transparent_pngs", &self.capture_transparent_pngs)
@@ -149,6 +190,9 @@ impl core::fmt::Debug for GameInfo {
             .field("_zeroed_f3f0", &self._zeroed_f3f0)
             .field("_conditional_config_f3f4", &HexU32s(&self._conditional_config_f3f4))
             .field("speech_path", &speech_str)
+            .field("speech_enabled", &self.speech_enabled)
+            .field("headless_mode", &self.headless_mode)
+            .field("input_state_f918", &format_args!("0x{:08X}", self.input_state_f918))
             .finish()
     }
 }

crates/openwa-core/src/game_session.rs

@@ -1,3 +1,8 @@
+use crate::ddgame_wrapper::DDGameWrapper;
+use crate::ddkeyboard::DDKeyboard;
+use crate::dssound::DSSound;
+use crate::palette::Palette;
+
 /// Top-level game session context, allocated once per game run.
 ///
 /// `G_GAME_SESSION` (0x7A0884) stores a pointer to this struct. Created by
@@ -60,15 +65,16 @@ pub struct GameSession {
     /// 0x09C: high DWORD
     pub timer_counter_hi: u32,
     /// 0x0A0: `DDGameWrapper*` — the main game object wrapper (→ `DDGame` at `+0x488`)
-    pub ddgame_wrapper: *mut u8,
+    pub ddgame_wrapper: *mut DDGameWrapper,
     /// 0x0A4: `DDKeyboard*` — 0x33C bytes, vtable `DDKeyboard_vtable` (0x66AEC8)
-    pub keyboard: *mut u8,
+    pub keyboard: *mut DDKeyboard,
     /// 0x0A8: `DSSound*` — 0xBE0 bytes, vtable `DSSound_vtable` (0x66AF20)
-    pub sound: *mut u8,
-    /// 0x0AC: `DisplayGfx*` — 0x24E28 bytes (normal), or `GameStats*` in headless mode
+    pub sound: *mut DSSound,
+    /// 0x0AC: `DisplayGfx*` — 0x24E28 bytes (normal), or `GameStats*` in headless mode.
+    /// Stays `*mut u8` because it's dual-purpose (DisplayGfx vs GameStats).
     pub display_gfx: *mut u8,
     /// 0x0B0: `Palette*` — 0x28 bytes, vtable `Palette_vtable_Maybe`
-    pub palette: *mut u8,
+    pub palette: *mut Palette,
     /// 0x0B4: streaming audio object — 0x354 bytes (`FUN_0058bc10`)
     pub streaming_audio: *mut u8,
     /// 0x0B8: input controller — 0x1800 bytes; null if `param_4 == 0` at init

crates/openwa-core/src/game_stats.rs

@@ -0,0 +1,17 @@
+/// GameStats — headless mode display stub.
+///
+/// Constructor: GameStats__Constructor (0x522DB0), stdcall(this) → GameStats*.
+/// Vtable overlay: 0x66A0F8 (applied after constructor returns).
+/// Size: 0x3560 bytes.
+///
+/// Created by GameEngine__InitHardware in headless mode (GameInfo+0xF914 != 0)
+/// instead of DisplayGfx. Stored in the same GameSession+0xAC slot.
+///
+/// OPAQUE: Internal layout not yet mapped.
+#[repr(C)]
+pub struct GameStats {
+    pub vtable: *mut u8,
+    pub _unknown_004: [u8; 0x3560 - 4],
+}
+
+const _: () = assert!(core::mem::size_of::<GameStats>() == 0x3560);

crates/openwa-core/src/game_timer.rs

@@ -0,0 +1,15 @@
+/// GameTimer — timing subsystem.
+///
+/// Constructor: FUN_0053E950, usercall(ESI=this, EAX=init_val), plain RET.
+/// Size: 0x30 bytes (header). Constructor allocates 2 × 0x20E0 internal buffers.
+///
+/// Created by GameEngine__InitHardware (always).
+/// Stored at GameSession+0xBC.
+///
+/// OPAQUE: Internal layout not yet mapped.
+#[repr(C)]
+pub struct GameTimer {
+    pub _data: [u8; 0x30],
+}
+
+const _: () = assert!(core::mem::size_of::<GameTimer>() == 0x30);

crates/openwa-core/src/input_ctrl.rs

@@ -0,0 +1,21 @@
+/// InputCtrl — input controller subsystem.
+///
+/// Initializer: FUN_0058C0D0, usercall(ESI=this) + stdcall(4 params), RET 0x10.
+/// Vtable: 0x66B3FC.
+/// Size: 0x1800 bytes.
+///
+/// Created by GameEngine__InitHardware when param4 != 0.
+/// Stored at GameSession+0xB8.
+///
+/// OPAQUE: Internal layout not yet mapped beyond vtable and a few known fields.
+#[repr(C)]
+pub struct InputCtrl {
+    /// 0x000: Vtable pointer (0x66B3FC)
+    pub vtable: *mut u8,
+    pub _unknown_004: [u8; 0xD74 - 4],
+    /// 0xD74: Set to 0x3F9 during inline construction.
+    pub _field_d74: u32,
+    pub _unknown_d78: [u8; 0x1800 - 0xD78],
+}
+
+const _: () = assert!(core::mem::size_of::<InputCtrl>() == 0x1800);

crates/openwa-core/src/lib.rs

@@ -29,3 +29,9 @@ pub mod rebase;
 pub mod wa;
 pub mod wa_call;
 pub mod wa_alloc;
+pub mod display_gfx;
+pub mod input_ctrl;
+pub mod game_timer;
+pub mod streaming_audio;
+pub mod ddnetgame_wrapper;
+pub mod game_stats;

crates/openwa-core/src/streaming_audio.rs

@@ -0,0 +1,16 @@
+/// StreamingAudio — streaming audio playback subsystem (music).
+///
+/// Constructor: FUN_0058BC10, usercall(ESI=this) + 2 stack params, RET 0x8.
+/// Size: 0x354 bytes.
+///
+/// Created by GameEngine__InitHardware when speech is enabled
+/// (GameInfo+0xDAA4 != 0) and DSSound initialized successfully.
+/// Stored at GameSession+0xB4.
+///
+/// OPAQUE: Internal layout not yet mapped.
+#[repr(C)]
+pub struct StreamingAudio {
+    pub _data: [u8; 0x354],
+}
+
+const _: () = assert!(core::mem::size_of::<StreamingAudio>() == 0x354);

crates/openwa-wormkit/src/replacements/config.rs

@@ -196,10 +196,12 @@ unsafe extern "stdcall" fn hook_load_options(gi_ptr: u32) {
     gi.detail_level = read_profile_int("Options", "DetailLevel", 5) as u8;
     gi._zeroed_f3f0 = 0;
 
-    // Copy 5 DWORDs from globals (indices 0..5 of config block)
+    // Copy 5 DWORDs from globals (display_width, display_height, + 3 more)
     let src = rb(va::G_CONFIG_DWORDS_F3B4) as *const u32;
-    for i in 0..5 {
-        gi._config_block_f3b4[i] = *src.add(i);
+    gi.display_width = *src;
+    gi.display_height = *src.add(1);
+    for i in 0..3 {
+        gi._config_dwords_f3bc[i] = *src.add(i + 2);
     }
 
     // Conditional copy: 4 DWORDs if guard == 0
@@ -219,10 +221,10 @@ unsafe extern "stdcall" fn hook_load_options(gi_ptr: u32) {
 
     gi.energy_bar = read_profile_int("Options", "EnergyBar", 1) as u8;
 
-    // 3 DWORDs from globals (overwrite indices 4..7 of config block)
+    // 3 DWORDs from globals (overwrite indices 2..5 of _config_dwords_f3bc)
     let src_c4 = rb(va::G_CONFIG_DWORDS_F3C4) as *const u32;
     for i in 0..3 {
-        gi._config_block_f3b4[4 + i] = *src_c4.add(i);
+        gi._config_dwords_f3bc[i + 2] = *src_c4.add(i);
     }
 
     gi.info_transparency = read_profile_int("Options", "InfoTransparency", 0) as u8;

crates/openwa-wormkit/src/replacements/hardware_init.rs

@@ -5,7 +5,7 @@
 //!
 //! ## Calling convention
 //!
-//! `__thiscall`: ECX = `*mut GameInfo` (≥0xF914 bytes), 3 stack params
+//! `__thiscall`: ECX = `*mut GameInfo` (≥0xF91C bytes), 3 stack params
 //! (hwnd, param3, param4), `RET 0xC`. Returns 1 on success, 0 on failure.
 //!
 //! The naked entry trampoline captures ECX, pops the return address → `SAVED_RET`,
@@ -21,21 +21,21 @@
 //! IF param4 != 0:
 //!   input ctrl (0x1800 bytes, inline vtable, FUN_0058C0D0 usercall ESI=this) → session+0xB8
 //!
-//! IF GameInfo+0xF914 == 0 (normal mode):
+//! IF GameInfo.headless_mode == 0 (normal mode):
 //!   DisplayGfx (0x24E28, stdcall ctor) → session+0xAC
 //!   DDDisplay::Init retry loop (configured → 1024×768 → 800×600 → 640×480)
 //!   screen center / cursor setup
 //!   DDKeyboard (0x33C, inline) → session+0xA4
 //!   Palette (0x28, inline) → session+0xB0
 //!   DSSound (0xBE0, usercall ctor + DirectSoundCreate + coop level) → session+0xA8
-//!   IF GameInfo+0xDAA4 != 0 AND DSSound OK: streaming audio → session+0xB4
+//!   IF GameInfo.speech_enabled != 0 AND DSSound OK: streaming audio → session+0xB4
 //!
 //! ELSE (headless):
 //!   GameStats (0x3560, stdcall ctor + vtable override) → session+0xAC
 //!   session+0xA4/0xA8/0xB0/0xB4 = null
 //!
 //! ALWAYS:
-//!   session+0x28 = (GameInfo+0xF3B0 != 0) ? 1 : 0
+//!   session+0x28 = (GameInfo.home_lock != 0) ? 1 : 0
 //!   DDGameWrapper (0x6F10) → session+0xA0  [via game_session::construct_ddgame_wrapper]
 //!   Palette vtable[4/3/2] calls + DDKeyboard poll (normal mode only)
 //!   DDNetGameWrapper (0x2C, stdcall ctor) → session+0xC0
@@ -43,11 +43,16 @@
 
 use openwa_core::address::va;
 use openwa_core::rebase::rb;
+use openwa_core::game_info::GameInfo;
 use openwa_core::game_session::GameSession;
 use openwa_core::ddgame_wrapper::DDGameWrapper;
+use openwa_core::ddkeyboard::DDKeyboard;
 use openwa_core::dddisplay::DDDisplay;
 use openwa_core::dssound::DSSound;
 use openwa_core::palette::Palette;
+use openwa_core::input_ctrl::InputCtrl;
+use openwa_core::game_timer::GameTimer;
+use openwa_core::game_stats::GameStats;
 use openwa_core::wa_alloc::WABox;
 use crate::hook;
 use crate::log_line;
@@ -88,7 +93,7 @@ static mut DSSOUND_INIT_EAX: u32 = 0;
 /// Timer constructor: `usercall(ESI=timer_ptr, EAX=d778_val)`, plain RET.
 /// Returns whatever EAX holds after the call.
 #[unsafe(naked)]
-unsafe extern "cdecl" fn call_timer_ctor(_timer_ptr: *mut u8, _d778_val: u32) -> u32 {
+unsafe extern "cdecl" fn call_timer_ctor(_timer_ptr: *mut GameTimer, _d778_val: u32) -> u32 {
     core::arch::naked_asm!(
         // [esp+0]=bridge_ret, [esp+4]=timer_ptr, [esp+8]=d778_val
         "pushl %esi",
@@ -108,7 +113,7 @@ unsafe extern "cdecl" fn call_timer_ctor(_timer_ptr: *mut u8, _d778_val: u32) ->
 /// IMPORTANT: FUN_00573D50 clobbers ECX (MOV ECX, 0x1F4 for REP STOSD).
 /// Do NOT use ECX to save bridge_ret — read it from the stack instead.
 #[unsafe(naked)]
-unsafe extern "cdecl" fn call_dssound_ctor(_dssound: *mut u8) {
+unsafe extern "cdecl" fn call_dssound_ctor(_dssound: *mut DSSound) {
     core::arch::naked_asm!(
         // [esp+0]=bridge_ret, [esp+4]=dssound
         "movl 4(%esp), %eax",    // EAX = dssound (bridge_ret stays on stack untouched)
@@ -129,19 +134,19 @@ static mut DSSOUND_INIT_SAVED_RET: u32 = 0;
 /// Caller sets `DSSOUND_INIT_EAX = dssound` before calling.
 #[unsafe(naked)]
 unsafe extern "stdcall" fn call_dssound_init_buffers(
-    _out_0x10: *mut u32,
-    _out_0x0c: *mut u32,
+    _out_primary_buffer: *mut *mut u8,
+    _out_primary_caps: *mut u32,
 ) -> u32 {
     core::arch::naked_asm!(
-        // Entry: ESP=E, [E+0]=bridge_ret, [E+4]=out_0x10, [E+8]=out_0x0c
+        // Entry: ESP=E, [E+0]=bridge_ret, [E+4]=out_primary_buffer, [E+8]=out_primary_caps
         "movl {eax_val}, %eax",      // EAX = dssound
         "movl (%esp), %ecx",         // ECX = bridge_ret (temp)
         "movl %ecx, {saved_ret}",    // save to static (ECX clobbered by FUN_00573E50)
-        "movl 4(%esp), %ecx",        // ECX = out_0x10
-        "movl 8(%esp), %edx",        // EDX = out_0x0c
+        "movl 4(%esp), %ecx",        // ECX = out_primary_buffer
+        "movl 8(%esp), %edx",        // EDX = out_primary_caps
         "addl $0xC, %esp",           // ESP = E+12 (discard bridge_ret + 2 args)
-        "pushl %edx",                // ESP = E+8,  [E+8]  = out_0x0c
-        "pushl %ecx",                // ESP = E+4,  [E+4]  = out_0x10
+        "pushl %edx",                // ESP = E+8,  [E+8]  = out_primary_caps
+        "pushl %ecx",                // ESP = E+4,  [E+4]  = out_primary_buffer
         "calll *({fn})",             // ESP = E,    [E]    = cont
                                      // FUN_00573E50 RET 0x8: pops cont → E+4, +8 → E+12
         // At cont: ESP = E+12; EAX = return value
@@ -242,43 +247,48 @@ unsafe extern "stdcall" fn call_ddisplay_init(
 // ─── Implementation ────────────────────────────────────────────────────��──────
 
 unsafe extern "cdecl" fn impl_init_hardware(
-    game_info: *mut u8,
+    game_info: *mut GameInfo,
     hwnd: u32,
     param3: u32,
     param4: u32,
 ) -> u32 {
     let _ = log_line("[hardware_init] GameEngine::InitHardware");
     let session = *(rb(va::G_GAME_SESSION) as *const *mut GameSession);
-    let game_info_d778 = *(game_info.add(0xD778) as *const u32);
+    let gi = &mut *game_info;
+    let d778_val = gi.crosshair_overflow_threshold as u32;
 
     // ── Input controller (if param4 != 0) ────────────────────────────────────
     if param4 == 0 {
         (*session).input_ctrl = core::ptr::null_mut();
     } else {
-        let ctrl_ptr = WABox::<u8>::alloc(0x1800, 0x17E0).leak();
-        // puVar3[0x35d] = 0x3f9 (original sets this; offset 0xD74)
-        *(ctrl_ptr.add(0xD74) as *mut u32) = 0x3F9;
-        *(ctrl_ptr as *mut u32) = rb(va::INPUT_CTRL_VTABLE);
-        (*session).input_ctrl = ctrl_ptr;
-
-        INPUT_CTRL_ESI = ctrl_ptr as u32;
-        let ok = call_input_ctrl_init(game_info.add(4), param3, param4, game_info_d778);
+        let ctrl = WABox::<InputCtrl>::alloc(0x1800, 0x17E0).leak();
+        (*ctrl)._field_d74 = 0x3F9;
+        (*ctrl).vtable = rb(va::INPUT_CTRL_VTABLE) as *mut u8;
+        (*session).input_ctrl = ctrl as *mut u8;
+
+        INPUT_CTRL_ESI = ctrl as u32;
+        let ok = call_input_ctrl_init(
+            (game_info as *mut u8).add(4),
+            param3,
+            param4,
+            d778_val,
+        );
         if ok == 0 {
-            let vtbl = *(ctrl_ptr as *const *const usize);
+            let vtbl = *(ctrl as *const *const usize);
             let dtor: unsafe extern "thiscall" fn(*mut u8, u32) =
                 core::mem::transmute(*vtbl);
-            dtor(ctrl_ptr, 1);
+            dtor(ctrl as *mut u8, 1);
             (*session).input_ctrl = core::ptr::null_mut();
             return 0;
         }
     }
 
     // ── Timer object (ALWAYS) ─────────────────────────────────────────────────
-    let timer_ptr = WABox::<u8>::alloc(0x30, 0x30).leak();
-    call_timer_ctor(timer_ptr, game_info_d778);
-    (*session).timer_obj = timer_ptr;
+    let timer = WABox::<GameTimer>::alloc(0x30, 0x30).leak();
+    call_timer_ctor(timer, d778_val);
+    (*session).timer_obj = timer as *mut u8;
 
-    let headless = *(game_info.add(0xF914) as *const u32) != 0;
+    let headless = gi.headless_mode != 0;
 
     if !headless {
         // ── DisplayGfx ───────────────────────────────────────────────────────
@@ -288,11 +298,9 @@ unsafe extern "cdecl" fn impl_init_hardware(
         (*session).display_gfx = display_gfx;
 
         // ── DDDisplay::Init retry loop ────────────────────────────────────────
-        // DDDisplay::Init is usercall(ECX=height) + stdcall(display_gfx, hwnd, width, flags).
-        // Use call_ddisplay_init which sets ECX from DDISPLAY_INIT_ECX before the tail-jump.
-        let flags = *(game_info.add(0xF374) as *const u32);
-        let w0 = *(game_info.add(0xF3B4) as *const u32);
-        let h0 = *(game_info.add(0xF3B8) as *const u32);
+        let flags = gi.display_flags;
+        let w0 = gi.display_width;
+        let h0 = gi.display_height;
 
         DDISPLAY_INIT_ECX = h0;
         let mut init_ok = call_ddisplay_init(display_gfx, hwnd, w0, flags) != 0;
@@ -304,8 +312,8 @@ unsafe extern "cdecl" fn impl_init_hardware(
                 (0x280, 0x1E0), // 640×480
             ];
             for &(w, h) in &fallbacks {
-                *(game_info.add(0xF3B4) as *mut u32) = w;
-                *(game_info.add(0xF3B8) as *mut u32) = h;
+                gi.display_width = w;
+                gi.display_height = h;
                 DDISPLAY_INIT_ECX = h;
                 if call_ddisplay_init(display_gfx, hwnd, w, flags) != 0 {
                     init_ok = true;
@@ -329,9 +337,7 @@ unsafe extern "cdecl" fn impl_init_hardware(
             let h = GetSystemMetrics(SM_CYSCREEN);
             (w / 2, h / 2)
         } else {
-            let w = *(game_info.add(0xF3B4) as *const i32);
-            let h = *(game_info.add(0xF3B8) as *const i32);
-            (w / 2, h / 2)
+            (gi.display_width as i32 / 2, gi.display_height as i32 / 2)
         };
 
         (*session).screen_center_x = cx;
@@ -348,8 +354,7 @@ unsafe extern "cdecl" fn impl_init_hardware(
                 let hwnd_val: HWND = *(rb(va::G_FRONTEND_HWND) as *const HWND);
                 let mut rect = RECT { left: 0, top: 0, right: 0, bottom: 0 };
                 GetClientRect(hwnd_val, &mut rect);
-                // MapWindowPoints via IAT thunk (avoids adding a new windows-sys feature).
-                let map_fn_ptr = *(rb(0x0061_A588) as *const usize);
+                let map_fn_ptr = *(rb(va::IAT_MAP_WINDOW_POINTS) as *const usize);
                 let map_fn: unsafe extern "stdcall" fn(HWND, HWND, *mut RECT, u32) -> i32 =
                     core::mem::transmute(map_fn_ptr);
                 map_fn(hwnd_val, core::ptr::null_mut(), &mut rect, 2);
@@ -358,53 +363,54 @@ unsafe extern "cdecl" fn impl_init_hardware(
         }
 
         // ── DDKeyboard (inline construction) ──────────────────────────────────
-        let kb_ptr = WABox::<u8>::alloc(0x33C, 0x31C).leak();
-        *(kb_ptr as *mut u32) = rb(va::DDKEYBOARD_VTABLE);
-        *(kb_ptr.add(4) as *mut u32) = game_info.add(0xF918) as u32;
-        *(kb_ptr.add(8) as *mut u32) = 1;
-        core::ptr::write_bytes(kb_ptr.add(0x11C), 0, 0x100);
-        core::ptr::write_bytes(kb_ptr.add(0x21C), 0, 0x100);
-        *(kb_ptr.add(0x14) as *mut u32) = 0;
-        *(kb_ptr.add(0x18) as *mut u32) = 0;
-        (*session).keyboard = kb_ptr;
+        let kb = WABox::<DDKeyboard>::alloc(0x33C, 0x31C).leak();
+        (*kb).vtable = rb(va::DDKEYBOARD_VTABLE) as *mut u8;
+        (*kb).game_info_input_ptr = &raw mut gi.input_state_f918 as u32;
+        (*kb)._field_008 = 1;
+        core::ptr::write_bytes((*kb).key_state.as_mut_ptr(), 0, 0x100);
+        core::ptr::write_bytes((*kb).prev_state.as_mut_ptr(), 0, 0x100);
+        (*kb)._field_014 = 0;
+        (*kb)._field_018 = 0;
+        (*session).keyboard = kb;
 
         // ── Palette (inline construction) ─────────────────────────────────────
-        let pal_ptr = WABox::<u8>::alloc(0x28, 0).leak();
-        *(pal_ptr as *mut u32) = rb(va::PALETTE_VTABLE_MAYBE);
-        *(pal_ptr.add(4) as *mut u32) = 0xFFFF_FFFF;
-        (*session).palette = pal_ptr;
+        let pal = WABox::<Palette>::alloc(0x28, 0).leak();
+        (*pal).vtable = rb(va::PALETTE_VTABLE_MAYBE) as *mut u8;
+        *((pal as *mut u8).add(4) as *mut u32) = 0xFFFF_FFFF;
+        (*session).palette = pal;
 
         // ── DSSound ───────────────────────────────────────────────────────────
         (*session).sound = core::ptr::null_mut();
         {
-            let snd_mem = WABox::<u8>::alloc(0xBE0, 0xBC0).leak();
-            call_dssound_ctor(snd_mem);
-            *(snd_mem.add(4) as *mut u32) = hwnd;
-            // Store DSSound pointer unconditionally — original does this before init checks.
-            // snd_mem+0xBBC = 1 only if all 3 COM init steps succeed; WA code checks this flag.
-            (*session).sound = snd_mem;
+            let snd = WABox::<DSSound>::alloc(0xBE0, 0xBC0).leak();
+            call_dssound_ctor(snd);
+            (*snd).hwnd = hwnd;
+            (*session).sound = snd;
 
             let ds_create: unsafe extern "stdcall" fn(*const u8, *mut *mut u8, *const u8) -> i32 =
                 core::mem::transmute(rb(va::DIRECTSOUND_CREATE) as usize);
-            let hr = ds_create(core::ptr::null(), snd_mem.add(8) as *mut *mut u8, core::ptr::null());
+            let hr = ds_create(
+                core::ptr::null(),
+                &mut (*snd).direct_sound,
+                core::ptr::null(),
+            );
 
             if hr == 0 {
-                DSSOUND_INIT_EAX = snd_mem as u32;
+                DSSOUND_INIT_EAX = snd as u32;
                 let hr2 = call_dssound_init_buffers(
-                    snd_mem.add(0x10) as *mut u32,
-                    snd_mem.add(0x0C) as *mut u32,
+                    &mut (*snd).primary_buffer,
+                    &mut (*snd).primary_buffer_caps,
                 );
                 if hr2 == 0 {
-                    // vtable[12] (offset 0x30) of the IDirectSoundBuffer* stored at snd_mem+0x10
-                    // by DSSOUND_INIT_BUFFERS. IDirectSoundBuffer::Play(this, 0, 0, DSBPLAY_LOOPING=1)
-                    let pds = *(snd_mem.add(0x10) as *const *const *const usize);
+                    // IDirectSoundBuffer::Play(this, 0, 0, DSBPLAY_LOOPING=1)
+                    let pds = (*snd).primary_buffer as *const *const usize;
                     let vtbl = *pds;
                     let play: unsafe extern "stdcall" fn(
                         *const *const usize, u32, u32, u32,
                     ) -> i32 = core::mem::transmute(*vtbl.add(0x30 / 4));
                     let hr3 = play(pds, 0, 0, 1);
                     if hr3 == 0 {
-                        *(snd_mem.add(0xBBC) as *mut u32) = 1;
+                        (*snd).init_success = 1;
                     }
                 }
             }
@@ -413,24 +419,26 @@ unsafe extern "cdecl" fn impl_init_hardware(
         // ── Streaming audio ───────────────────────────────────────────────────
         (*session).streaming_audio = core::ptr::null_mut();
         if !(*session).sound.is_null() {
-            let speech_flag = *(game_info.add(0xDAA4) as *const u8);
-            if speech_flag != 0 {
+            if gi.speech_enabled != 0 {
                 let stream_mem = WABox::<u8>::alloc(0x354, 0x334).leak();
-                let dssound = (*session).sound;
-                let ids = *(dssound.add(8) as *const *mut u8);
-                call_streaming_audio_ctor(stream_mem, ids, game_info.add(0xD9E0));
+                let snd = (*session).sound;
+                let ids = (*snd).direct_sound;
+                call_streaming_audio_ctor(
+                    stream_mem,
+                    ids,
+                    gi.streaming_audio_config.as_mut_ptr(),
+                );
                 (*session).streaming_audio = stream_mem;
             }
         }
     } else {
         // ── Headless / stats mode ─────────────────────────────────────────────
-        let stats_mem = WABox::<u8>::alloc(0x3560, 0x3560).leak();
+        let stats = WABox::<GameStats>::alloc(0x3560, 0x3560).leak();
         let gamestats_ctor: unsafe extern "stdcall" fn(*mut u8) -> *mut u8 =
             core::mem::transmute(rb(va::GAMESTATS_CTOR) as usize);
-        gamestats_ctor(stats_mem);
-        *(stats_mem as *mut u32) = rb(va::GAMESTATS_VTABLE);
-        let stats_ptr = stats_mem;
-        (*session).display_gfx      = stats_ptr;
+        gamestats_ctor(stats as *mut u8);
+        (*stats).vtable = rb(va::GAMESTATS_VTABLE) as *mut u8;
+        (*session).display_gfx      = stats as *mut u8;
         (*session).keyboard         = core::ptr::null_mut();
         (*session).sound            = core::ptr::null_mut();
         (*session).palette          = core::ptr::null_mut();
@@ -438,37 +446,33 @@ unsafe extern "cdecl" fn impl_init_hardware(
     }
 
     // ── Windowed/fullscreen flag → session+0x28, and session+0x24 = 1 ──────────
-    let fullscreen_word = *(game_info.add(0xF3B0) as *const u16);
+    let fullscreen_word = gi.home_lock;
     *((session as *mut u8).add(0x28) as *mut u32) = (fullscreen_word != 0) as u32;
-    // Original always sets session+0x24 = 1 unconditionally (both normal + headless).
     *((session as *mut u8).add(0x24) as *mut u32) = 1;
 
     // ── DDGameWrapper (ALWAYS) ────────────────────────────────────────────────
-    // The 7 explicit args mirror the session fields:
-    //   display_gfx (DisplayGfx*), sound (DSSound*), keyboard (DDKeyboard* — called "gfx"),
-    //   palette, streaming_audio ("music"), input_ctrl ("network").
     let wrapper = game_session::construct_ddgame_wrapper(
-        game_info,
+        game_info as *mut u8,
         WABox::<DDGameWrapper>::alloc(0x6F10, 0x6EF0).leak(),
         (*session).display_gfx as *mut DDDisplay,
-        (*session).sound as *mut DSSound,
-        (*session).keyboard,
-        (*session).palette as *mut Palette,
+        (*session).sound,
+        (*session).keyboard as *mut u8,
+        (*session).palette,
         (*session).streaming_audio,
         (*session).input_ctrl,
     );
-    (*session).ddgame_wrapper = wrapper as *mut u8;
+    (*session).ddgame_wrapper = wrapper;
 
     // ── Palette vtable[4/3/2] + keyboard poll (normal mode only) ─────────────
     if !headless {
         let pal = (*session).palette;
         if !pal.is_null() {
             let vtbl = *(pal as *const *const usize);
-            let vt4: unsafe extern "thiscall" fn(*mut u8) =
+            let vt4: unsafe extern "thiscall" fn(*mut Palette) =
                 core::mem::transmute(*vtbl.add(4));
-            let vt3: unsafe extern "thiscall" fn(*mut u8) =
+            let vt3: unsafe extern "thiscall" fn(*mut Palette) =
                 core::mem::transmute(*vtbl.add(3));
-            let vt2: unsafe extern "thiscall" fn(*mut u8, u32) =
+            let vt2: unsafe extern "thiscall" fn(*mut Palette, u32) =
                 core::mem::transmute(*vtbl.add(2));
             vt4(pal);
             vt3(pal);
@@ -477,7 +481,7 @@ unsafe extern "cdecl" fn impl_init_hardware(
 
         let kb = (*session).keyboard;
         if !kb.is_null() {
-            let kb_poll: unsafe extern "stdcall" fn(*mut u8) =
+            let kb_poll: unsafe extern "stdcall" fn(*mut DDKeyboard) =
                 core::mem::transmute(rb(va::DDKEYBOARD_POLL_KEYBOARD_STATE) as usize);
             kb_poll(kb);
         }