alex/sots-re
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
sots-re/findings/01-fingerprint.md

2.8 KiB
Raw Blame History

P0 — binary fingerprint

Target: Sword of the Stars.exe (GOG Complete Collection v1.8.1, build 19833), 7.5 MB, extracted via innoextract to /srv/re-lab/sots-game/.

PE / toolchain

  • PE32, i386 (32-bit), subsystem Windows GUI 5.01, 5 sections, ImageBase 0x00400000, SizeOfImage 0x007b3000, entry 0x00925794.
  • Compiler: MSVC 2010 (VC++ 10.0) — MajorLinkerVersion 10; imports MSVCR100.dll + MSVCP100.dll. Resolves the earlier VS2003/2005/2008 uncertainty. Implications: RTTI present (C++ class hierarchy recoverable), MSVC-2010 name mangling (Ghidra demangles), VS2010 Dinkumware STL — expect heavily inlined std::vector/map/string.
  • COFF characteristics 0x12F → includes IMAGE_FILE_LARGE_ADDRESS_AWARE (0x20): LAA is already enabled in this build. The 2 GB→4 GB mitigation is baked in; the memory ceiling only needs allocator work if large-battle crashes still occur. RELOCS_STRIPPED set (so the ASLR flag in DllCharacteristics 0x8140 is effectively inert).

Imported subsystems (from the import table)

  • Graphics: DirectX 9 — d3d9.dll + d3dx9_42.dll (D3DX June 2010). Anchor for the renderer: Direct3DCreate9 → CreateDevice → present loop.
  • Audio: DSOUND.dll (DirectSound). Video: binkw32.dll (RAD Bink).
  • Net: WSOCK32.dll + IPHLPAPI.DLL (multiplayer).
  • Std Win32: KERNEL32, USER32, GDI32, ADVAPI32, SHELL32, SHLWAPI, WINMM, ole32.

Data

  • sots.gob (1.45 GB) + sots_local_en.gob (599 MB) — renamed uncompressed ZIPs (per community docs); openable directly. Modding is ./Mods/ override.

Consequences for the plan

  • Battle-load becomes the primary bug target (LAA already done).
  • The RTTI analyzer should hand us the class hierarchy — the fastest path into the object model (goal #1), to be cross-referenced with the community save-editor structs.
  • D3D9 device init is a clean, well-anchored first renderer target.

Fingerprint captured 2026-09-07 via objdump on CT111.

Update — RTTI reality + scale (2026-09-07)

  • RTTI is fully present: 1,924 type descriptors, 41,411 functions. RTTI was not stripped. Full class inventory extracted → findings/objects/00-inventory.md.
  • Engine namespace is Mars (SOTS1's engine; SOTS2 later used Mercury); game logic in Game. 194 Mars (engine) classes, 1,404 Game classes, 179 serializable types.
  • Ghidra's headless RTTI analyzer ran but produced 0 SymbolType.CLASS namespaces on our query — a ReVa/Ghidra tooling detail to resolve (re-run/point the right analyzer); the RTTI data itself is intact and was read straight from the binary.
  • Consequence: the object model (goal #1) is strongly de-risked — named classes + hierarchy hints come free from RTTI; serializable-types.txt maps closely to the save data model.