Incremental strategy: 7 usercall functions ported to pure Rust (Groups A-C),
10 stdcall constructors hooked individually (Groups D-G), with headful+headless
replay tests after each group.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Incremental approach: decompile and map fields, create DDGame::new()
with bridges for sub-calls, then eliminate bridges one at a time.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
docs: document replay system architecture and spacebar advance mechanism
Fully traced the spacebar-to-advance-replay chain through Ghidra:
keyboard -> TurnGame+0x1F4 -> HurryHandler -> DDGame+0x7E41 -> GameFrameEndProcessor -> local Hurry message (0x17).
Adds 11 replay/turn function addresses and 6 DDGame replay offsets to address.rs.
Creates docs/re-notes/replay-system.md with full findings including
the Option A direct control strategy (set DDGame+0x7E41 from DLL).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
feat: replay fast-forward via PostMessage + WndProc subclass
Automatically fast-forward through entire replays during testing by
posting WM_KEYDOWN/WM_KEYUP spacebar messages with 50ms gaps. Subclasses
the game's WndProc to intercept WM_ACTIVATE/WM_ACTIVATEAPP, making WA
think it always has focus so input works even when the window is in the
background.
- Add input.rs with PostMessage loop + WndProc subclass
- Update validation auto-capture: dump at 8s, 120s safety timeout
- Update replay-test.ps1 with 150s timeout
- Add DDKeyboard::PollKeyboardState address
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
refactor: add RQ_ prefix to render queue addresses, label pipeline in Ghidra
Rename all RenderQueue enqueue function constants with RQ_ prefix for
consistency (e.g., DRAW_PIXEL -> RQ_DRAW_PIXEL). Add 20 new address
constants for helpers, pipeline functions, and the type 0xE enqueue.
Label 25 functions in Ghidra including 7 RQ helpers and 7 render
pipeline functions. Document complete render queue system in
docs/re-notes/render-queue.md.
Research findings:
- All 11 standalone enqueue functions identified (types 0-14 switch,
but types 3/7/10/12 have no standalone enqueue — inlined or unused)
- DDDisplay vtable drawing method map (12 slots at 0x2C-0x58)
- Render pipeline: RenderFrame -> GameRender -> RQ_RenderDrawingQueue
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
feat: reverse engineer sprite system — docs, types, and Ghidra labels
Design for launching WA.exe with replay files for automated
validation and RE discovery. Validator DLL detects automated mode
via OPENWA_REPLAY_TEST env var and self-terminates after capture.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
docs: add configuration system design and implementation plan
Design doc and implementation plan for porting WA's configuration
subsystem (Theme I/O, Registry, GameInfo, CrashReportURL) to Rust.
These were used to guide the config.rs implementation.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
feat: add typed scheme payload structs + field accessors
Add SchemeOptions (36B), WeaponSettings (4B), and ExtendedOptions (110B)
structs with from_bytes/to_bytes for safe typed access to .wsc payload
fields. Include V3 ROM defaults, scheme weapon order table, and 8 new
tests covering typed field access, roundtrips, and version boundaries.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Document the complete frontend navigation state machine:
- Main navigation loop at 0x4E6440 (CWinApp::Run, 19KB)
- g_CurrentScreen (0x6B3504) drives screen dispatch
- 20 dialog constructors mapped to screen IDs
- Bitmap font system: 4 font sizes, glyph renderer, textbox API
- Display wrapper at 0x79D6D4 with 6 backend variants
47 new Ghidra labels applied (functions, globals, dialog ctors).
38 new address.rs constants: dialog ctors, font system, display globals.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
feat: add offline test harness that loads WA.exe and calls its functions
Loads WA.exe into a 32-bit test process via LoadLibraryExA with
DONT_RESOLVE_DLL_REFERENCES, patches the IAT (445 imports), initializes
the statically-linked MSVC CRT heap, and successfully calls WA.exe
functions including malloc and CTask::Constructor.
9 tests: PE loading, vtable validation, prologue checks, IAT patching,
malloc wrapper call, and CTask constructor call with SEH support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add ASLR rebasing (GetModuleHandleA) — WA.exe loads at 0x90000, not 0x400000
- Replace retour constructor hooks with global pointer polling (10s delay)
Hooks crashed due to retour trampoline splitting SEH prologues
- Fix DDGameWrapper constructor: __stdcall with 7 params, not __thiscall
Confirmed via RET 0x1c and stack parameter access patterns
- Fix CTask constructor: __stdcall with 3 params, not __thiscall
Confirmed via RET 0xc
- Add G_GAME_SESSION (0x7A0884) global for polling DDGameWrapper at runtime
- Fix DDGameWrapper struct: +0x4C0 is not GfxHandler, +0x4D4 is sound ptr
- Remove retour dependency (no longer needed, builds on stable Rust)
- Add missing prologue bytes: 0x64 (FS: SEH), 0x85 (test), 0x8D (lea)
Results: 78/78 static + 6/6 deferred = 84/84 all passing
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add frontend screen system: ScreenId enum and 21 named functions
Map the MFC CDialog-based menu system from 65 decompiled call sites.
Add ScreenId enum with 18 screen IDs (main menu through lobby).
Name 21 frontend/lobby functions and 4 global variables in Ghidra.
Add 25 new addresses to address.rs (14 frontend + 7 lobby + 4 globals).
Document screen transition architecture in frontend-screens.md.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add DDGame engine architecture structs and subsystem types
Define DDGame (0x98B8), DDGameWrapper, PCLandscape, DSSound, and
OpenGLState repr(C) structs with compile-time size assertions.
Add 9 subsystem vtable addresses to address.rs. Document the
engine initialization chain and update memory map with DDGame layout.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Initial openwa-types crate: enums, structs, and RE addresses
Bootstrap the Rust type foundation for WA 3.8.1 reverse engineering:
- Cargo workspace with openwa-types crate
- Enums translated from wkJellyWorm: ClassType (34), TaskMessage (83+),
Weapon (71), SoundId (126), SpriteId (696)
- Fixed-point math newtype (16.16 format, 0x10000 = 1.0)
- CTask and CGameTask struct stubs with compile-time size assertions
- 80+ known addresses: vtables, constructors, gameplay, rendering, sound
- RE documentation: task hierarchy, vtable layouts, memory map
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
