ab1c2296a1
saved-state writer under combat FUN_007d5a00's six callees, read from the instruction stream to the next function start, plus 18 helpers. Lane J named this "the real per-phase combat pipeline"; the identification of it as the most tractable target was right and the characterisation was not. It is one subsystem -- destinations, group, classify, split, execute, destroy -- and it is StarFleet retreat. Seven saved fields or containers move on this path: ship->fleet membership, StarFleet objects created and destroyed in the master list, the system fleet lists, fleet position/location/flight plan/flags, the ServerSystem presence and explored masks, the per-player PlayerView, and ServerPlayer.GTraf. Closes struct-recovery.md section 7's open "OID allocation (R2's x16)": the allocator is at 0x008b8ae0, the counter lives per network node at IDMap->+0x08 + node*0x14 + 0x10, it is pre-incremented and never issues 0, and an id is (counter << 4) | (node & 0xF). R2's x16 is the shl 4. A partial retreat mints one id per group, and that counter is almost certainly the save's NMnx tag -- labelled hypothesis, with a falsifiable prediction written down before any run. New rule: retreating from a system you had not explored marks it explored for you, writing EFlags and refreshing the PlayerView. New diplomacy rule: a system whose owner captured it on the current turn loses that owner's ceasefire cover in the hostile-presence test. RNG recomputed independently from a different root and with a different tool: 327 functions in the closure once E9 tail-call thunks are followed (the first pass missed an 8-byte jmp thunk and with it the whole id-allocator chain), zero calls to the four primitives, zero inlined MT tempering immediates, and one false-positive 0x11c stride that is StarFleet.FtMS being initialised to -1. Bound, not proof: 152 indirect call sites in 91 of the 327, four of them on the main line and flagged for the vtable lane. Corrects my own first reading of the fleet-creation call: a ret-N tail-call thunk in the middle of an argument list makes three pushes look like they belong to the wrong call. Checking ret N against the push count catches it. The honest limit stands: none of this has ever executed under an instrument. combat-resolver.md section 10.3's workload now needs a second condition -- the battle must produce a retreat, or all six phases are no-ops. |
||
|---|---|---|
| campaign | ||
| findings | ||
| ghidra | ||
| guides | ||
| notes | ||
| objects | ||
| scripts | ||
| tools | ||
| verify | ||
| .gitignore | ||
| README.md | ||
sots-re
Reverse-engineering worklog for Sword of the Stars (2006, SOTS1) — the 32-bit DX9 original + expansions. The nitty-gritty: static/dynamic analysis notes, Ghidra & ReVa scripts, function/struct maps, D3D9 call traces, decomp progress, findings.
Where this runs
Analysis lab on spicy (PVE, 192.168.3.201):
- CT111
sots-re— Linux workspace: Ghidra + headless ReVa server, radare2/rizin/cutter, binwalk. Hosts the Samba share and this repo's working tree at/srv/re-lab/notes. - VM140
sots-re-win10— Win10 runtime + dynamic analysis (x64dbg, Cheat Engine, RenderDoc/apitrace, DXVK→CPU-Vulkan for GPU-less rendering).
Infra (guests, storage, network, share, ReVa endpoint) is documented from the
system-maintainer POV in trikilli → services/re-lab.md. This repo is everything else.
Layout
findings/— the running findings log (append-only), one file per subsystem.ghidra/— exported scripts, data-type archives, struct definitions.traces/— D3D9 / Win32 API call captures + analysis.scripts/— helper tooling (loaders, extractors, parsers).notes/— session notes, scratch, hypotheses.
Ownership / legality
Game binaries come from the owner's own GOG/Steam copy. RE is for personal
interoperability, bug-fixing, and preservation. Binaries themselves are not committed
here (see .gitignore) — they live on the lab's Samba share /srv/re-lab/samples.
Campaign (how this repo is run)
A 4-agent crew (defined in ~/.claude/agents/re-*.md) runs the exploration:
re-quartermaster (backlog + board) → re-analyst (maps via ReVa) →
re-verifier (proves vs real data; old-vs-new differential once reimpl starts) →
re-scribe (files the note, links it, commits).
campaign/board.md— live status board (start here).- Live tracking = Forgejo issues on
alex/sots-re(labelsstatus/*are the kanban columns;type/*,conf/*).campaign/board.mdis the editable mirror — publish withscripts/forgejo_campaign.py bootstrap(needsFORGEJO_TOKEN). campaign/backlog.md— prioritized target queue.campaign/open-questions.md— unresolved threads.findings/_template.md— the record format every finding follows.findings/{objects,control-flow,subsystems}/— the growing engine map.verify/{parsers,traces,harness,results}/— validation: struct parsers now, golden-trace replay + shim compare-mode for reimplementation.ghidra/— exported scripts + datatype archives.
Approach & north star: findings/00-strategy.md. Binary facts: findings/01-fingerprint.md.
Sibling repo
alex/sots-engine — the from-scratch engine source (clean-room, public-capable). This repo keeps the
evidence + planning for both; binary facts cross over only via ghidra/addresses.json → tools/gen_addresses.py.
guides/re-windows-2000s-howto.md— annotated bibliography + how-to for RE of mid-2000s MSVC/DX9 Windows games, with our-experience call-outs.