Map the world view sizing; add RE tooling
- docs/widescreen.md: render-thread frame, cWorldView0 layout and methods, view size = zoom * 1024.0/768.0 float constants and all their users, ortho projection extents, open questions (activity radius, buffers). - tools: find-imm (immediate/regex instruction search), rtti (vtables via MSVC RTTI), decompile.ps1 + Ghidra scripts for a persistent project; ApplyRtti recovers 410 vtables / ~1200 functions Ghidra misses. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
1 parent
1549464af6
commit
b2dc1338d2
8 files changed
+493
No files matched your search
@@ -0,0 +1,25 @@
|
||||
# tools
|
||||
|
||||
Node tools need `npm install` here once (iced-x86). Paths to sacred.exe are
|
||||
passed explicitly.
|
||||
|
||||
| Tool | Purpose |
|
||||
|---|---|
|
||||
| `disasm.mjs <exe> <va> [n]` | disassemble at an address, ignoring Ghidra's function boundaries |
|
||||
| `find-imm.mjs <exe> <value...>` | every instruction using an immediate value (e.g. `1024 768`) |
|
||||
| `find-imm.mjs <exe> /regex/` | every instruction whose text matches (e.g. `/96AB0h\]/`) |
|
||||
| `rtti.mjs <exe> <Class>` | vtables of an MSVC class via RTTI |
|
||||
| `decompile.ps1 <addr...>` | decompile from the persistent Ghidra project `ghidra/` |
|
||||
|
||||
## Persistent Ghidra project (`ghidra/`, not in git)
|
||||
|
||||
Created once (about 7 minutes):
|
||||
|
||||
```powershell
|
||||
$env:GHIDRA_HEADLESS_MAXMEM = "8G"
|
||||
& "$env:GHIDRA_INSTALL_DIR\support\analyzeHeadless.bat" ghidra sacred -import "<Sacred Gold>\sacred.exe"
|
||||
& "$env:GHIDRA_INSTALL_DIR\support\analyzeHeadless.bat" ghidra sacred -process sacred.exe -scriptPath tools\ghidra -postScript ApplyRtti.java
|
||||
```
|
||||
|
||||
`ApplyRtti.java` recovers the MSVC 6 RTTI that Ghidra's own script misses:
|
||||
410 vtables, ~1200 extra functions, methods named `Class::vfNN`.
|
||||
Reference in new issue
Block a user