diff --git a/CLAUDE.md b/CLAUDE.md index c679d40..0541bb3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1203,6 +1203,32 @@ WAVE 8), (2) the `owner*` shims redirected to real Mech motion/mass/motion-gain mover**, so it must be reconciled with the gait cutover FIRST (both would feed the mover) before enabling. Factory now: **15 of 20 cases wired to real classes** (remaining: ProjectileWeapon/0xBCE/MissileLauncher 0xBCD/0xBD0 [WAVE 7], SubsystemMessageManager 0xBD3 [WAVE 8], Gyroscope 0xBC4 [deferred]). + +**✅ WAVE 7 (projectile/missile weapon families) — Phase A DONE: the three weapon SUBSYSTEMS are wired +byte-exact (un-mislabeled per VDATA.h enum); Phase B (flying projectile/missile ENTITIES) deferred.** +An 8-agent decomp-mapping workflow (scratchpad/wave7_maps.txt) mapped every ctor + fire/spawn path. +**KEY IDENTITY CORRECTION (VDATA.h enum, base 3000=0xBB8):** 0xBCD=**ProjectileWeapon**, 0xBCE=**GaussRifle** +(NOT MissileLauncher!), 0xBD0=**MissileLauncher** (NOT BallisticWeapon). The factory ctor-address COMMENTS were +right but the built CLASS names were stubs/base. Un-mislabeled + wired via `CreateSubsystem` bridges +(mirroring CreateEmitterSubsystem): **0xBCD→ProjectileWeapon** (@4bc3fc : MechWeapon, sizeof **0x448** — FIX: +`AmmoBinConnection` was an empty 1B struct → retyped to the binary's 0xC SharedData::Connection, was making the +object 8B short); **0xBD0→MissileLauncher** (@4bcff0 : ProjectileWeapon, sizeof **0x44C** — FIX: deleted +`muzzleVelocity` [ALIAS of inherited `launchVelocity@0x410`] + `salvoCount` [SHADOW of `damageData.burstCount@0x3d4`], +keeping `missileCount@0x448`); **0xBCE→GaussRifle** (@4bdcb4 : Emitter, sizeof **0x484** = Emitter+Vector3D +muzzleVelocity — a DEDICATED bridge, not CreateEmitter, because its FireWeapon is a NO-OP `mov [eax+0x414],0` += a non-functional weapon in this 1995 build; also fixed GAUSS.CPP's discharge write `rechargeLevel`→`currentLevel@0x414` +per the binary). All three `static_assert`-locked (offsetof/sizeof). Verified: Mad Cat (LRM/ballistic) + BLH +construct the real weapon classes + tick authentic charge/ammo/heat/recoil, DESTROYED-in-8, 0 crashes, +heapcheck-clean through construction. Factory now **18 of 20** (remaining: SubsystemMessageManager 0xBD3 +[WAVE 8], Gyroscope 0xBC4 [deferred]). **⚠ Phase A safe-stubs FireWeapon (no spawn):** ProjectileWeapon/ +MissileLauncher FireWeapon consume a round + recoil but do NOT spawn the projectile/missile — the reconstructed +**Projectile (@4be1bc, 0x340) + Missile (@4bf5b4, 0x368) ENTITY classes are NOT spawn-ready** (they carry +Entity-BASE phantom members that overflow their `New()` alloc → heap corruption; `New()` takes `(int)this` +instead of the 0xD4 descriptor MakeMessage; the Entity base size is unconfirmed 2007-vs-1995, the Mech +0x638-vs-0x854 problem). **Phase B = the entity byte-exactness + descriptor build + `New(MakeMessage*)` + +engine-integration** so a fired shot becomes a flying entity that damages — a distinct follow-up (the workflow's +adversarial verify flagged the live spawn as a heap-overflow hazard and recommended exactly this phasing). The +energy weapons (Emitter/PPC) already damage via the mech4 beam path, so combat is unaffected. **✅ HEAT-FLOW LINKAGE CONNECTED — weapon heat now conducts to the central sink** (verified: `[heat] conduct self.E=.. -> other.E`, sustained fire `FIRED #1..#21+`, combat intact, no crash). THREE fixes, each faithful to the decomp (no stand-ins): diff --git a/game/original/BT/GAUSS.CPP b/game/original/BT/GAUSS.CPP index 09cc06a..7fabddd 100644 --- a/game/original/BT/GAUSS.CPP +++ b/game/original/BT/GAUSS.CPP @@ -71,7 +71,7 @@ void // // Fire the weapon // - rechargeLevel = 0.0f; // was outputVoltage: the Emitter dup was removed (== inherited rechargeLevel@0x320) + currentLevel = 0.0f; // binary @004bdcb4/@004bdca4 write [this+0x414] == inherited Emitter currentLevel (discharge) Check_Fpu(); } @@ -90,7 +90,7 @@ GaussRifle::GaussRifle( { Check(owner); Check_Pointer(subsystem_resource); - rechargeLevel = 0.0f; // was outputVoltage: the Emitter dup was removed (== inherited rechargeLevel@0x320) + currentLevel = 0.0f; // binary @004bdcb4/@004bdca4 write [this+0x414] == inherited Emitter currentLevel (discharge) Check_Fpu(); } @@ -151,3 +151,20 @@ Logical return IsDerivedFrom(ClassDerivations); } + + +//===========================================================================// +// WAVE 7 factory bridge -- GaussRifle (factory case 0xBCE, "MissileWeapon" +// mislabel). VDATA.h enum: 0xBCE == GaussRifleClassID. GaussRifle : Emitter +// (sizeof 0x484 = Emitter 0x478 + Vector3D muzzleVelocity). ctor @004bdcb4, +// no-op FireWeapon @004bdca4 (just zeros currentLevel -- a non-functional weapon +// in this 1995 build), so it needs a DEDICATED bridge (CreateEmitterSubsystem +// would build a plain Emitter that WOULD deal damage). Was building a +// MissileLauncher RECON_SUBSYS stub. alloc 0x484. +//===========================================================================// +Subsystem *CreateGaussRifleSubsystem(Mech *owner, int id, void *seg) +{ + Check(sizeof(GaussRifle) <= 0x484); + return (Subsystem *) new (Memory::Allocate(0x484)) + GaussRifle(owner, id, (GaussRifle::SubsystemResource *)seg, GaussRifle::DefaultData); +} diff --git a/game/original/BT/GAUSS.HPP b/game/original/BT/GAUSS.HPP index 77785e3..d4bab58 100644 --- a/game/original/BT/GAUSS.HPP +++ b/game/original/BT/GAUSS.HPP @@ -136,8 +136,14 @@ class Projectile; FireWeapon(); Vector3D - muzzleVelocity; + muzzleVelocity; // @0x478 (past Emitter 0x478) -- ends 0x484 + friend struct GaussRifleLayoutCheck; + }; + + struct GaussRifleLayoutCheck { + static_assert(offsetof(GaussRifle, muzzleVelocity) == 0x478, "GaussRifle::muzzleVelocity @0x478 (Emitter must end 0x478)"); + static_assert(sizeof(GaussRifle) == 0x484, "sizeof(GaussRifle) 0x484 (== factory alloc)"); }; diff --git a/game/reconstructed/mech.cpp b/game/reconstructed/mech.cpp index 25bff48..493fda9 100644 --- a/game/reconstructed/mech.cpp +++ b/game/reconstructed/mech.cpp @@ -201,6 +201,9 @@ extern Subsystem *CreateSearchlightSubsystem(Mech *, int, void *); // 0xBD8 (WAV extern Subsystem *CreateThermalSightSubsystem(Mech *, int, void *); // 0xBDE (WAVE 4 readouts -- de-shimmed + gate fixed) extern Subsystem *CreateAmmoBinSubsystem(Mech *, int, void *); // 0xBCB (WAVE 4 -- AmmoBin : HeatWatcher, layout locked) extern Subsystem *CreateMyomersSubsystem(Mech *, int, void *); // 0xBC6 (WAVE 6 -- mover-coupled drive; INERT, gated BT_MYOMERS) +extern Subsystem *CreateProjectileWeaponSubsystem(Mech *, int, void *); // 0xBCD (WAVE 7 -- ammoBinLink 0xC, layout locked; FireWeapon no-spawn Phase A) +extern Subsystem *CreateMissileLauncherSubsystem(Mech *, int, void *); // 0xBD0 (WAVE 7 -- shadows deleted, layout locked; FireWeapon no-spawn Phase A) +extern Subsystem *CreateGaussRifleSubsystem(Mech *, int, void *); // 0xBCE (WAVE 7 -- Emitter subclass, no-op FireWeapon; dedicated bridge) // CreateGyroSubsystem (0xBC4) is reconstructed + ready in gyro.cpp (layout re-based, // joint I/O real), but NOT wired -- the gyro ctor/integrator reconstruction is // incomplete (garbage output); see the 0xBC4 case below. @@ -820,21 +823,25 @@ Mech::Mech( subsystemArray[id] = CreateAmmoBinSubsystem(this, id, seg); // FUN_004bd5c4 break; - case MechWeaponClassID: // 0xBCD - subsystemArray[id] = (Subsystem *) - new (Memory::Allocate(0x448)) MechWeapon(this, id, seg, MechWeapon::DefaultData); // FUN_004bc3fc + case MechWeaponClassID: // 0xBCD -> real class ProjectileWeapon (ctor @004bc3fc, mislabeled) + // WAVE 7: the autocannon/ballistic ammo weapon (: MechWeapon, sizeof 0x448). + // Was building the base MechWeapon stub (pure-virtual FireWeapon trap). + subsystemArray[id] = CreateProjectileWeaponSubsystem(this, id, seg); // FUN_004bc3fc ++weaponCount; break; - case MissileWeaponClassID: // 0xBCE - subsystemArray[id] = (Subsystem *) - new (Memory::Allocate(0x484)) MissileLauncher(this, id, seg, MissileLauncher::DefaultData); // FUN_004bdcb4 + case MissileWeaponClassID: // 0xBCE -> real class GaussRifle (ctor @004bdcb4, mislabeled) + // WAVE 7: VDATA.h enum -> 0xBCE == GaussRifleClassID (NOT MissileWeapon). + // GaussRifle : Emitter (sizeof 0x484); its FireWeapon is a no-op in this + // 1995 build (just zeros the charge) -> a DEDICATED bridge, not CreateEmitter. + subsystemArray[id] = CreateGaussRifleSubsystem(this, id, seg); // FUN_004bdcb4 ++weaponCount; break; - case BallisticWeaponClassID: // 0xBD0 - subsystemArray[id] = (Subsystem *) - new (Memory::Allocate(0x44c)) BallisticWeapon(this, id, seg, BallisticWeapon::DefaultData); // FUN_004bcff0 + case BallisticWeaponClassID: // 0xBD0 -> real class MissileLauncher (ctor @004bcff0, mislabeled) + // WAVE 7: VDATA.h enum -> 0xBD0 == MissileLauncherClassID. : ProjectileWeapon + // (sizeof 0x44c). Was building a BallisticWeapon stub. + subsystemArray[id] = CreateMissileLauncherSubsystem(this, id, seg); // FUN_004bcff0 ++weaponCount; break; diff --git a/game/reconstructed/mislanch.cpp b/game/reconstructed/mislanch.cpp index 4c05c37..7e3cf67 100644 --- a/game/reconstructed/mislanch.cpp +++ b/game/reconstructed/mislanch.cpp @@ -112,10 +112,10 @@ MissileLauncher::MissileLauncher( // vtable installed by the compiler (PTR_FUN_00512570) missileCount = subsystem_resource->missileCount; // @0x448 resource +0x1d0 - muzzleVelocity = subsystem_resource->muzzleVelocity; // @0x410 resource +0x1d4 + launchVelocity = subsystem_resource->muzzleVelocity; // @0x410 (inherited ProjectileWeapon slot; was aliased "muzzleVelocity") - // per-salvo count copy + per-missile damage - this->salvoCount = missileCount; // @0x3d4 this[0xf5] + // per-salvo count copy + per-missile damage (write the inherited Damage fields) + this->damageData.burstCount = missileCount; // @0x3d4 this[0xf5] (was shadow "salvoCount") this->damageData.damageAmount /= (Scalar)missileCount; // @0x3ac this[0xeb] /= missileCount } @@ -219,23 +219,21 @@ void MissileLauncher::FireWeapon() // Begin the per-shot recharge cooldown (recoil bleeds to 0 before ReadyToFire). recoil = rechargeRate; - // Resolve the muzzle / lead geometry once for the whole salvo. - // - muzzle transform MechWeapon::GetMuzzlePoint @004b9948 - // - lead point leadPosition (ComputeTimeOfFlight, run by the sim) - // - per-missile Damage damageData (already /missileCount in the ctor) - // - muzzleVelocity this->muzzleVelocity (@0x410, resource +0x1d4) + // Resolve the muzzle / lead geometry (used to seed each missile's descriptor). Point3D muzzle; GetMuzzlePoint(muzzle); // @004b9948 + damageData.burstCount = missileCount; // @0x3d4 (was shadow "salvoCount") - // Spawn `missileCount` guided Missile entities (streamed ClassID 0xBD0). Each - // allocates 0x368 bytes and runs Missile::Missile @004bf5b4, which builds the - // Seeker + MissileThruster roster and seeds them from this launcher's target / - // muzzleVelocity. FUN_004bf8bc == Missile::New. - salvoCount = missileCount; // @0x3d4 - for (int i = 0; i < missileCount; ++i) - { - Missile::New((int)this); // @004bf8bc -> @004bf5b4 - } + // ⚠ SPAWN DEFERRED (WAVE 7 Phase B): the shipped code loops missileCount times + // building a 0xD4-byte Missile MakeMessage (muzzle transform + lead + the 12-word + // Damage descriptor + launchVelocity + owner/target) and calls Missile::New + // (@004bf8bc -> ctor @004bf5b4, allocs 0x368). The Missile ENTITY class is not + // spawn-ready (Entity-base phantom members overflow the 0x368 alloc; New() takes + // (int)this instead of the descriptor) -> a live spawn would corrupt the heap. The + // launcher SUBSYSTEM ticks authentically (charge/ammo/heat/recoil, damage split + // across missileCount) but does NOT launch until the entity work lands. See + // scratchpad/wave7_maps.txt (Missile map) + docs/SUBSYS_PLAN.md. + // for (int i = 0; i < missileCount; ++i) Missile::New(&descriptor); // <-- Phase B simulationFlags |= 0x1; // replication-dirty Check_Fpu(); @@ -264,3 +262,19 @@ Logical MissileLauncher::TestInstance() const { return ProjectileWeapon::TestInstance(); } + + +//===========================================================================// +// WAVE 7 factory bridge -- MissileLauncher (factory case 0xBD0, "BallisticWeapon" +// mislabel). VDATA.h enum: 0xBD0 == MissileLauncherClassID. The real class +// (ctor @004bcff0) is MissileLauncher : ProjectileWeapon (sizeof 0x44C); the +// factory built a BallisticWeapon RECON_SUBSYS stub. alloc 0x44C. Ticks its +// real per-frame sim (charge/ammo/heat, damage split across missileCount); +// FireWeapon consumes a round + recoils but DEFERS the missile spawn (Phase B). +//===========================================================================// +Subsystem *CreateMissileLauncherSubsystem(Mech *owner, int id, void *seg) +{ + Check(sizeof(MissileLauncher) <= 0x44C); + return (Subsystem *) new (Memory::Allocate(0x44C)) + MissileLauncher(owner, id, (MissileLauncher::SubsystemResource *)seg, MissileLauncher::DefaultData); +} diff --git a/game/reconstructed/mislanch.hpp b/game/reconstructed/mislanch.hpp index 784be3f..d21782b 100644 --- a/game/reconstructed/mislanch.hpp +++ b/game/reconstructed/mislanch.hpp @@ -146,10 +146,18 @@ class Missile; void FireWeapon(); - int missileCount; // @0x448 (this[0x112]) -- how many missiles per salvo - int salvoCount; // @0x3d4 (this[0xf5]) -- per-salvo count copy + // The ONLY own field: missileCount@0x448 (ctor param_1[0x112]). The former + // salvoCount@0x3d4 was a SHADOW of the inherited MechWeapon damageData.burstCount + // (@0x3A8+0x2C), and muzzleVelocity@0x410 an ALIAS of the inherited ProjectileWeapon + // launchVelocity -- both re-declared as own members put them at wrong (appended) + // offsets; removed. Object ends 0x44C. + int missileCount; // @0x448 (this[0x112]) -- how many missiles per salvo (LAST field) - // --- launcher-specific data appended past the ProjectileWeapon block --- - Vector3D muzzleVelocity; // @0x410 (this[0x104..0x106]) resource +0x1d4 + friend struct MissileLauncherLayoutCheck; + }; + + struct MissileLauncherLayoutCheck { + static_assert(offsetof(MissileLauncher, missileCount) == 0x448, "MissileLauncher::missileCount @0x448 (ProjectileWeapon must end 0x448)"); + static_assert(sizeof(MissileLauncher) == 0x44C, "sizeof(MissileLauncher) 0x44C (== factory alloc)"); }; #endif diff --git a/game/reconstructed/projweap.cpp b/game/reconstructed/projweap.cpp index 8dee6ec..2ce5515 100644 --- a/game/reconstructed/projweap.cpp +++ b/game/reconstructed/projweap.cpp @@ -565,13 +565,20 @@ void // DrawFiringCharge before the weapon is ReadyToFire again). recoil = rechargeRate; // this[0xfa] = this[0xf7] - // Spawn the generic tracer/ballistic round at the muzzle. The lead solution - // in leadPosition (ComputeTimeOfFlight) and launchVelocity seed the descriptor; - // the spent round is a streamed Projectile entity (FUN_004bf8bc family). - // MissileLauncher overrides this method (@004bcc60) to spawn guided Missiles. + // Resolve the live muzzle (used to seed the projectile descriptor). Point3D muzzle; GetMuzzlePoint(muzzle); // MechWeapon @004b9948 - Projectile::New((int)this); // @004be384 generic projectile + + // ⚠ SPAWN DEFERRED (WAVE 7 Phase B): the shipped code builds a ~0xD4-byte projectile + // MakeMessage here (muzzle transform + lead point + the 12-word Damage descriptor + + // owner/target) and hands it to Projectile::New (@004be384). The reconstructed + // Projectile/Missile ENTITY classes are NOT spawn-ready yet: they carry Entity-base + // phantom members that overflow their New() alloc (0x340/0x368), and New() currently + // takes (int)this instead of the descriptor -> a live spawn would corrupt the heap. + // So the weapon SUBSYSTEM ticks authentically (charge/ammo/heat/recoil) but does NOT + // spawn until the entity byte-exact base + descriptor build land. See scratchpad/ + // wave7_maps.txt (Projectile/Missile maps) + docs/SUBSYS_PLAN.md. + // Projectile::New((int)this); // <-- Phase B simulationFlags |= 0x1; // replication-dirty Check_Fpu(); @@ -689,3 +696,20 @@ int return True; } + + +//===========================================================================// +// WAVE 7 factory bridge -- ProjectileWeapon (factory case 0xBCD, "MechWeapon" +// mislabel). The real class at 0xBCD (ctor @004bc3fc) is ProjectileWeapon +// (the autocannon/ballistic ammo weapon); the factory built the base MechWeapon +// stub (whose FireWeapon is the pure-virtual trap @004ba45c). alloc 0x448 (== +// the byte-exact ProjectileWeapon sizeof). Constructs the AmmoBin connection + +// ticks its real ProjectileWeaponSimulation (charge/ammo/jam/eject); FireWeapon +// consumes a round + recoils but DEFERS the projectile spawn (Phase B). +//===========================================================================// +Subsystem *CreateProjectileWeaponSubsystem(Mech *owner, int id, void *seg) +{ + Check(sizeof(ProjectileWeapon) <= 0x448); + return (Subsystem *) new (Memory::Allocate(0x448)) + ProjectileWeapon(owner, id, (ProjectileWeapon::SubsystemResource *)seg, ProjectileWeapon::DefaultData); +} diff --git a/game/reconstructed/projweap.hpp b/game/reconstructed/projweap.hpp index 6778efc..a29b204 100644 --- a/game/reconstructed/projweap.hpp +++ b/game/reconstructed/projweap.hpp @@ -107,14 +107,19 @@ class NotationFile; static SharedData DefaultData; // Embedded ref-counted connection to the AmmoBin subsystem (resource - // AmmoBin index). The shipped layout is a SharedData::Connection; the - // reconstruction models it with this thin proxy (Construct/Connect/ - // Resolve/Destruct) so the recovered call sites compile unchanged. + // AmmoBin index). The shipped layout is a 0xC-byte SharedData::Connection + // (ctor FUN_004bcbb0->FUN_004179d4; resolver FUN_00417ab4 two-level-derefs +8), + // NOT an empty proxy -- modeling it as 1 byte made ProjectileWeapon 8 bytes + // short (0x440 vs the binary 0x448) and slid MissileLauncher's missileCount off + // 0x448. Named access (Construct/Connect/Resolve/Destruct) is unchanged + inert + // in bring-up (no plug resolves). Same 0xC pattern as SubsystemConnection. struct AmmoBinConnection { - void Construct() {} - template void Connect(T) {} - void Destruct() {} - void *Resolve() { return 0; } + void *linked; // +0x00 (SharedData::Connection; inert here) + int _reserved[2]; // pad to the binary 0xC connection + void Construct() { linked = 0; _reserved[0] = _reserved[1] = 0; } + template void Connect(T s) { linked = (void *)s; } + void Destruct() { linked = 0; } + void *Resolve() { return linked; } }; //~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -309,10 +314,21 @@ class NotationFile; // --- ammunition --- int tracerInterval; // @0x438 resource TracerInterval (+0x1BC) AmmoBinConnection - ammoBinLink; // @0x43C embedded connection to the AmmoBin subsystem - // (12 bytes; ctor @004bcbb0, dtor @004bcbcf, - // link vtable @00512424; resolved via the - // resource AmmoBin index at +0x1C0) + ammoBinLink; // @0x43C embedded 0xC connection to the AmmoBin subsystem + // (ctor @004bcbb0, dtor @004bcbcf, link vtable + // @00512424; resolved via the resource AmmoBin + // index at +0x1C0) -- LAST field, object ends 0x448 + + friend struct ProjectileWeaponLayoutCheck; }; // sizeof == 0x448 + struct ProjectileWeaponLayoutCheck { + static_assert(offsetof(ProjectileWeapon, totalTimeToEject) == 0x3F0, "ProjectileWeapon::totalTimeToEject @0x3F0 (MechWeapon must end 0x3F0)"); + static_assert(offsetof(ProjectileWeapon, launchVelocity) == 0x410, "ProjectileWeapon::launchVelocity @0x410"); + static_assert(offsetof(ProjectileWeapon, leadPosition) == 0x420, "ProjectileWeapon::leadPosition @0x420"); + static_assert(offsetof(ProjectileWeapon, tracerInterval) == 0x438, "ProjectileWeapon::tracerInterval @0x438"); + static_assert(offsetof(ProjectileWeapon, ammoBinLink) == 0x43C, "ProjectileWeapon::ammoBinLink @0x43C"); + static_assert(sizeof(ProjectileWeapon) == 0x448, "sizeof(ProjectileWeapon) 0x448 (== factory alloc)"); + }; + #endif