Skip to content

Reverse Engineering Notes

Jump to bottom
LordBlacksun edited this page Sep 9, 2026 · 1 revision

Reverse-Engineering Notes

Provenance

Findings come from static analysis of a decrypted image of the game, performed on a legally owned copy. The analyzed build: 32-bit PE, ImageBase 0x400000, 1,151,021 bytes, OEP 0x004D1210, 2,200 functions. The original ships behind SafeDisc 1.40.004; analysis is done on a decrypted, non-executing image (read as data in a disassembler) — the game itself is never run as part of this work.

Method

  1. Decompilation — Ghidra headless auto-analysis + decompile-all (≈2,205 functions, ~113k lines of pseudo-C, plus strings + symbol dumps).
  2. Subsystem clustering — map_engine.py (original tooling) tags each function by the debug strings it references (Ghidra inlines them as s_<text>_<addr>) and the distinctive APIs it calls, then parses the caller→callee graph (FUN_ references) and propagates each subsystem's ownership down into the untagged helper functions it dominates (multi-subsystem callers are down-weighted to limit noise).
  3. Verification — the per-subsystem facts in this wiki were then confirmed by reading the decompiled functions directly (struct offsets, globals, constants, control flow).

Coverage of this build: 276 functions carry direct string/API evidence; ~759 more are attributed by the call graph; ~1,165 are shared leaf/math/util helpers; 7,349 intra-image call edges.

Reading the addresses

The binary is stripped, so functions appear as FUN_<addr> and globals as DAT_<addr> — the names in this wiki are Ghidra placeholders or our own labels. Addresses are build-specific (ImageBase 0x400000). Claims are marked [verified] (read in code) or [inferred]/[open]. Starlancer is unusually legible for a stripped release because it retains verbose diagnostic strings that name source files (hud.cpp, Create.cpp, gameobj.cpp, …) and internal structures.

Middleware credits

  • Surrender — 3D scene renderer (SR_*, srAPI.cpp, srddraw.dll, srmemory.dll).
  • WinVFX — 2D/overlay library (John Miles).
  • Miles Sound System — audio (mss32, AIL_*; John Miles / RAD Game Tools).
  • Bink Video — FMV (binkw32; RAD Game Tools).
  • DirectX 7 (DirectDraw / Direct3D / DirectInput / DirectPlay) — Microsoft.

Scope & ethics

This is documentation for preservation, interoperability, and modding of a game the user legally owns. It records behaviour, addresses, and file formats as original analysis. It does not contain or redistribute the game's source code, binaries, or assets, and no decrypted/derivative game binary is published. Patches produced from this research should target the user's own installed game.

Open items (good first contributions)

  • Disassemble the set-projection routine behind the DAT_00588730 + 0x40 vtable to settle the projection scale/centre math (the last step for a correct Hor+ widescreen FOV).
  • Enumerate the .DTE action opcodes (+0x16) from the executor FUN_00453210.
  • Field-map the IFF 'MISS' save chunk and the 0xD0 profile.bin blob against real files.
  • Document the .SHP model format end-to-end (loader FUN_004A44D0).

Clone this wiki locally