Reverse Engineering Research

Reverse Engineering Research

This index contains every Markdown research note from re_probes. The pages preserve the original measurements, failed approaches, uncertainty, and hand-off instructions while presenting them in English.

Research Briefs

• Identity — source: re_probes/agent_briefs/cfilekey2.md
• Identity — source: re_probes/agent_briefs/cmdtable.md
• Identity — source: re_probes/agent_briefs/cmfmt.md
• Mission: Retail Command Execution — source: re_probes/agent_briefs/command_queue.md
• Identity — source: re_probes/agent_briefs/cvartable.md
• Identity — source: re_probes/agent_briefs/datahash.md
• Research Task: DLC-/Patch Container and Priority — source: re_probes/agent_briefs/dlc_primary.md
• Identity — source: re_probes/agent_briefs/entitypipe.md
• Identity — source: re_probes/agent_briefs/execcarrier.md
• Investigation Task: IDCL Header Hash at +0x08 — source: re_probes/agent_briefs/hash08.md
• Identity — source: re_probes/agent_briefs/idclhash.md
• Identity — source: re_probes/agent_briefs/idclwriter.md
• Search Task: Loose Assets and External Load Paths — source: re_probes/agent_briefs/loose_assets.md
• Identity — source: re_probes/agent_briefs/map_bundle_v3.md
• Research Task: Map/DLC Selection Logic — source: re_probes/agent_briefs/map_selection.md
• Identity — source: re_probes/agent_briefs/mapmanifest.md
• Identity — source: re_probes/agent_briefs/matpipe.md
• Identity — source: re_probes/agent_briefs/meshfmt.md
• Identity — source: re_probes/agent_briefs/save_integrity_v3.md
• Mission: TNC Savegame/Menu Load Path — source: re_probes/agent_briefs/save_load_route.md
• Identity — source: re_probes/agent_briefs/savestructure.md
• Identity — source: re_probes/agent_briefs/saveverify.md
• Identity — source: re_probes/agent_briefs/texdbkey.md
• Identity — source: re_probes/agent_briefs/vtrest.md

Research Reports

• Asset Tab for Wolfenstein II (assetviewer) — source: re_probes/agent_reports/assetviewer.md
• c2v1-Alias: File-Corrupt-Identitaet — source: re_probes/agent_reports/c2v1_identity.md
• cfile — Key derivation found, corpus decrypted, round-trip byte-exact — source: re_probes/agent_reports/cfilekey2.md
• packagechunklist.json in TNC-Retail: Clear Negative — source: re_probes/agent_reports/chunklist.md
• TNC Command Registry – Runtime Image Analysis — source: re_probes/agent_reports/cmdtable.md
• cm (Collision): Layout, Round-Trip, Box-Hull, Binding — source: re_probes/agent_reports/cmfmt.md
• Static Research: Retail Command Queue (TNC) — source: re_probes/agent_reports/command_queue.md
• TNC custom-save registration investigation — source: re_probes/agent_reports/custom_save_registration.md
• TNC Cvar Catalog – Runtime Image Analysis — source: re_probes/agent_reports/cvartable.md
• entry+0x50 (data_hash) and entry+0x60 (hash_0x60) — from the code — source: re_probes/agent_reports/datahash.md
• dlc_4 Map plus cfile:wolfsdk_test.cfg — source: re_probes/agent_reports/dlc4_cfile.md
• Override-Chunk: Custom edits under the Retail card name c2v1 — source: re_probes/agent_reports/dlc4_override.md
• DLC-/Patch Container as Primary Source — Static Finding — source: re_probes/agent_reports/dlc_primary.md
• Entity-Pipeline: Custom map on Retail geometry via .entities — source: re_probes/agent_reports/entitypipe.md
• The cfile Carrier: Smallest DLC to Carry a Resource — source: re_probes/agent_reports/execcarrier.md
• Explosive Pistol Does Not Explode: Diagnosis — source: re_probes/agent_reports/explosivpistole_diag.md
• TNC Gore-Runtime: Findings and Next Test Path — source: re_probes/agent_reports/gore_runtime.md
• Hash08 static probe report — source: re_probes/agent_reports/hash08.md
• IDCL Header +0x08 — Solved (derived from code, not a hash sweep) — source: re_probes/agent_reports/idclhash.md
• IDCL-Writer: Write the four hashes instead of copying — source: re_probes/agent_reports/idclwriter.md
• TNC Retail: lose/external load paths (read-only findings only) — source: re_probes/agent_reports/loose_assets.md
• Alias Package v3 — source: re_probes/agent_reports/map_bundle_v3.md
• Map/DLC Selection Logic (Static Findings) — source: re_probes/agent_reports/map_selection.md
• Map-Manifest: What a map must know about an asset — source: re_probes/agent_reports/mapmanifest.md
• 3D Map View: Server, CLI, and Loader Button — source: re_probes/agent_reports/mapview.md
• matpipe: material → image → texdb, end-to-end — source: re_probes/agent_reports/matpipe.md
• Mesh Format (model / modelAsset / modelstream): Resolved, Box is writable — source: re_probes/agent_reports/meshfmt.md
• Mission Builder Kit: Custom Missions for the Gestapo Office Map (c2v1) — source: re_probes/agent_reports/missions.md
• Offline Save Repair v3 — source: re_probes/agent_reports/save_integrity_v3.md
• TNC Save-/Menu Load Path (Static Research) — source: re_probes/agent_reports/save_load_route.md
• Why the edited save state was rejected — Structure of checkpoint.dat — source: re_probes/agent_reports/savestructure.md
• .verify in Wolfenstein II — Generation, Verification, and Its Role During Loading — source: re_probes/agent_reports/saveverify.md
• TNC Small Custom Map Prototype — source: re_probes/agent_reports/small_custom_map.md
• TNC texdb / custom-map alias: findings — source: re_probes/agent_reports/texdb_rewrite.md
• The TexDB Key — Solved (from the code, not a hash sweep) — source: re_probes/agent_reports/texdbkey.md
• TNC: Custom Map Registration and Load Path (Read-Only Finding) — source: re_probes/agent_reports/tnc_custom_maps.md
• R2 — AI and Navigation for a Custom TNC Map — source: re_probes/agent_reports/r2_ainav.md
• R2 — Kit Map Quality: Lighting New Geometry, and Walkable Stairs — source: re_probes/agent_reports/r2_maplightstairs.md
• R2 — Custom TNC Maps Without Owning Any DLC — source: re_probes/agent_reports/r2_mapnodlc.md
• R2 — Skeleton (.md6skl) and Animation (.md6anim) Format — source: re_probes/agent_reports/r2_md6anim.md
• R2 — Custom Objective Shows in Journal but Not in the HUD Banner — source: re_probes/agent_reports/r2_missionhud.md
• R2 — Adding Brand-New Decl Entries (Not Just Replacing) in TNC — source: re_probes/agent_reports/r2_newassets.md
• R2 — Texture Database Codec 2: Tile Chains for Large BC4/BC5 Mips — source: re_probes/agent_reports/r2_tilechain.md
• R2 — TNO Model Formats: Static Solved, Skinned Vertex/Index Block Now Decoded — source: re_probes/agent_reports/r2_tnomodels.md
• R2 — Cutscene and Loading Video (.bk2) Replacement — source: re_probes/agent_reports/r2_videoreplace.md
• R2 — Sound Replacement Write Path (TNC Wwise Audio) — source: re_probes/agent_reports/r2_wwisereplace.md
• R3 — Animation Decode: the Geist System Behind the Bind-Pose Puzzle — source: re_probes/agent_reports/r3_animdecode.md
• R3 — Kiscule Node Reference for Modders — source: re_probes/agent_reports/r3_kisculeref.md
• R3 — A Custom TNC Map That Needs No DLC at All — source: re_probes/agent_reports/r3_mapselfcontained.md
• R3 — Fixing the Missing HUD Objective Banner for Out-of-Order Missions — source: re_probes/agent_reports/r3_missionsetter.md
• R3 — Navigation Data in TNC Maps: Format, Toggleable Regions, and the Kit Map — source: re_probes/agent_reports/r3_navdata.md
• R3 — Appending Brand-New Decl Entries: Independent Re-Verification — source: re_probes/agent_reports/r3_newassetsv.md
• R3 — Weapon Decl Anatomy and Building a New Weapon End to End — source: re_probes/agent_reports/r3_newweapon.md
• R3 — NPC Model and Skin Swap: Reskinning vs. Replacing a Model — source: re_probes/agent_reports/r3_npcswap.md
• R3 — The SWF-Based UI: Format, Menu Entries, and HUD Restyling — source: re_probes/agent_reports/r3_swfui.md
• R3 — Texture Codec 2 Tile Chains: Inner Pixel Layout (Still Unsolved) — source: re_probes/agent_reports/r3_tileinner.md
• R3 — TNO Skinned Models: Mesh-Count Rule and a Corpus-Proven Reader — source: re_probes/agent_reports/r3_tnoskinned.md
• R4 — AI Decl Hierarchy and Difficulty (TNC) — source: re_probes/agent_reports/r4_aidecl.md
• R4 — The Console Command Gate (TNC) — source: re_probes/agent_reports/r4_consolecmds.md
• R4 — Importing OBJ/GLB Models into TNC — source: re_probes/agent_reports/r4_modelimport.md
• R4 — Pickups, Givers and Start Loadouts (TNC) — source: re_probes/agent_reports/r4_pickups.md
• R4 — Save Structure, Chapter Selection and Loadout (TNC) — source: re_probes/agent_reports/r4_savegame.md
• R4 — TNC String Tables and the Key Hash — source: re_probes/agent_reports/r4_strings.md
• R4 — AI Spawn Waves: Trigger → Spawner → Wave — source: re_probes/agent_reports/r4_aispawnwaves.md
• R4 — Where TNC Verifies Data: A Map of Every Integrity Check — source: re_probes/agent_reports/r4_integrity.md
• R4 — Material Decls: Render-Program "Flags" and Adding a New Material — source: re_probes/agent_reports/r4_materials.md
• R4 — Adding a New Wwise Sound Event (TNC) — source: re_probes/agent_reports/r4_soundevents.md
• R4 — TNO Custom Maps: How Maps Load, and Why There Is No dlc_0-Style Route — source: re_probes/agent_reports/r4_tnocustom.md
• R5 — Kiscule Command Nodes Run Through the Same Unrestricted Path as resourceExec — source: re_probes/agent_reports/r5_kisculecmd.md
• R6 — TNC Dynamic Lights: Classes, Fields, Budgets, and Whether They Can Light New Kit Geometry — source: re_probes/agent_reports/r6_dynlights.md
• R6 — Engine Limits: Entities, AI, Lights, Map Size, Streaming, Decls, Physics, Strings — source: re_probes/agent_reports/r6_enginelimits.md
• R6 — FX, Particle, Impact and Gore Effect Decls: Format, Reference Chains, and Two Decl-Only Mods — source: re_probes/agent_reports/r6_fxdecls.md
• R6 — Photocam: A Free Camera / Photo-Mode Cfg and Keybind Set for The New Colossus — source: re_probes/agent_reports/r6_photocam.md
• R6 — Physics: Havok Parameters Reachable by Decl/Cvar in TNC and TNO — source: re_probes/agent_reports/r6_physics.md
• R6 — Player Systems: Movement, Perks, Contraptions, Dual Wield, Weapon Upgrade Kits — source: re_probes/agent_reports/r6_playersys.md
• R6 — TNC Graphics Beyond Ultra: Non-Exposed Render and Streaming Cvars — source: re_probes/agent_reports/r6_renderplus.md
• R6 — TNO Sound Replacement: The Write Path, Round-Tripped — source: re_probes/agent_reports/r6_tnoaudio.md
• R6 — TNO Console and Cvars: Does the TNC Restriction Model Carry Over? — source: re_probes/agent_reports/r6_tnoconsole.md
• R6 — TNO Decl System: Catalogue, Loader Capability, New Entries, Load-Order Traps — source: re_probes/agent_reports/r6_tnodecls.md
• R6 — Tnodump: A Read-Only Runtime Capture Tool for TNO, and the Ghidra Import Prepared for the Moment a TNO Image Exists — source: re_probes/agent_reports/r6_tnodump.md
• R6 — TNO MegaTexture (virtualtextures/*.pages): Page Table, Codec, One Decoded Region, and a Round-Trip-Proven Writer — source: re_probes/agent_reports/r6_tnomegatex.md
• R6 — Tnoscript: How The New Order Drives Map Events (Trigger Graph + a Real idTech4 Script VM) — source: re_probes/agent_reports/r6_tnoscript.md
• R7 — Adding New Entries to TNO Archives: Format, Runtime Lookup, a Working Writer — source: re_probes/agent_reports/r7_tnoaddentry.md
• R7 — TNO Cheat Gate: The Actual Code, Now That .text Is Decrypted — source: re_probes/agent_reports/r7_tnocheatgate.md
• R7 — TNO Console Commands: Registration, Flags, and What's Reachable Right Now — source: re_probes/agent_reports/r7_tnocommands.md
• R7 — TNO Engine Limits from Decompiled Code: Entities, AI, Script VM, Physics, Decls, Audio, Render — source: re_probes/agent_reports/r7_tnolimits.md
• R7 — TNO Map Loading in Code: Command Handlers, Map_f, Chunk Mounting, and a Working DLC-Extension Pipeline — source: re_probes/agent_reports/r7_tnomaploading.md
• R7 — Tnoscriptvm: The DoomScript VM, Read from the Decrypted TNO Runtime Image — source: re_probes/agent_reports/r7_tnoscriptvm.md
• R8 — Verification of mods/tnc_devmenu_fix (Static Only, runtime_87400 Snapshot) — source: re_probes/agent_reports/r8_devmenufix_verify.md
• R8 — TNO Cvar Registry, Loader Audit, and Delivery Fix — source: re_probes/agent_reports/r8_tnocvars.md
• R9 — A Box Map Under a New Map Name (game/wolfsdk/box) — source: re_probes/agent_reports/r9_boxmap.md
• R9 — Dev Starts After Map Load (kce) Restored Through Marker Layers — source: re_probes/agent_reports/r9_devstarts.md
• R10 — A Developer Map for Testing Mods (game/wolfsdk/modtest) — source: re_probes/agent_reports/r10_modtestmap.md

Kit-Based Map Research

• Kitmap c2v1: Level Design "Atriumhall" — source: re_probes/kitmap/design/BERICHT.md
• Kit-Survey c2v1: Components for a New Map — source: re_probes/kitmap/kit/bericht.md
• Skeleton for a new map in c2v1 — source: re_probes/kitmap/skeleton/BERICHT.md

Mission Research

• Mission Anatomy: How Wolfenstein II Builds a Mission (c2v1 "Gestapo Office") — source: re_probes/missions/anatomy/anatomy.md
• Writing Kiscule – Scripts for Custom Missions — source: re_probes/missions/kiscule/BERICHT.md
• Mission Text Sources: Where Goal and HUD Text Comes From and What a DLC Folder Can Change — source: re_probes/missions/text/text.md

Custom-Map Prototypes

• TNC c3v1_custom – Alias Prototype — source: re_probes/tnc_custom_map_c3v1_custom/README.md

DLC Runtime Tests

• Primary DLC Test c02p0 — source: re_probes/tnc_dlc_test/runtime_primary_c02/RESULT.md

Weapon Research

• Pistol: Decl Chain and Explosive Pistol — source: re_probes/weapons/pistole_explosiv.md