TeslaSuite/410console/CONSOLE-4.10-DECOMP.md

Console 4.10 — Decompilation & Documentation

Reverse-engineering notes for the classic Mac OS operator console that commanded the networked Virtual World Entertainment (VWE) BattleTech / Red Planet pods. Part of the VWE Tesla restoration project.

• Target dir: c:\VWE\TeslaRel410\410console\4_10-console-extracted\
• Binary: Console 4.10 (728,064 bytes) — classic Mac OS fat application (68K CODE resources + PowerPC PEF/CFM fragment in the data fork).
• Internal identity: type APPL, creator vwe4, version resource 2.4.0b3 / "Console 2.4.0b3", © 1995–1997 FASA Interactive, Inc. (The "4.10" in the folder name is the site/config release, not the app's own vers.)
• Analysis method: custom Python PEF/PPC + resource-fork tooling (no Ghidra on this machine); capstone in PPC big-endian mode. See 410console/tools/.
• Status: read-only analysis. Nothing in the target was modified.

---

0. TL;DR — what the console does

The console is a document-based Mac app (Metrowerks PowerPlant framework, CodeWarrior C++). Each open document is a Mission. The operator picks an Adventure (Solo/Team × BattleTech/Red Planet), a Location (arena) and a Scenario, assigns pilots/vehicles, then drives a fleet of cockpit pods through a mission lifecycle. It talks to two networks:

1. Pod command/control — one MacTCP TCP stream per pod on port 1501 (console 200.0.0.1, pods 200.0.0.11–200.0.0.120). This is the protocol that matters for the emulator. Commands (Load / Translocate / Stop / End / Reset) go out as small binary packets; pods stream back a one-byte Cockpit State (0–12) that the console records in Console Log.
2. 4th Dimension (4D) database — a second client link to a 4D server for the pilot roster and mission scheduling ("Get Next Departure", Add/Delete/ Lookup Pilot, scoring). Evidenced by the _4D_Select4DServer / _4D_Find4DServer error strings; the wire protocol for 4D was not reverse-engineered (it is ACI's proprietary 4D client library).

The rest of this document backs every claim above with offsets, string refs, resource dumps and log excerpts.

---

1. File inventory & formats

File	Size	Format / role
Console 4.10	728 KB	The application. Fat binary: PEF/PPC in data fork, 68K CODE + all UI resources in the resource fork (see §5).
Console Log	5.3 MB	Runtime log, CR-terminated records. Ground truth for the pod protocol (§7).
Console.ini	92 KB	Live config: 586 ::-namespaced sections — pods, adventures, locations, scenarios, vehicles (§8).
Console.ini copy	91 KB	Prior copy of the above.
Stationary.ini	98 KB	The stationery/template master config (Mac "stationery" = template document) used to seed a fresh Console.ini.
ini Folder/DB<City>/	—	Per-venue config overrides: Atlanta, Chicago, Cincinnati, Denver, Detroit, Houston, Miami, Ontario, Pittsburgh, San Jose, Toronto, LaZerPark.
ConsoleSorter/ + Console Log Sorter, Console Log.rpl	0 B here	A companion log-sorter tool (data forks empty in this extraction; only Instructions survived).
FRC.rsrc, KR.rsrc, US.rsrc	225 B each	Tiny locale resource stubs (French / Korean / US).
Fonts/ (Killmark, Stencil)	0 B	Bitmap/suitcase fonts for kill-marker/stencil display (data forks empty here).
PlainText16 Folder/	173 KB	PlainText support (text traits).
.finf/	32 B each	Mac Finder-info sidecars from extraction (type/creator).
__MACOSX/._*	—	AppleDouble sidecars — these carry the resource forks. ._Console 4.10 is 3.38 MB and holds the app's entire resource fork (§5).

Resource-fork location: the app's resource fork was preserved inside __MACOSX/._Console 4.10 (AppleDouble magic 0x00051607, entry id 2 = resource fork at file offset 0x52, length 0x3391CA). Finder info at offset 0x32 reads APPLvwe4 → type APPL, creator vwe4.

---

2. PEF container structure

First 16 bytes: 4A6F7921 70656666 70777063 00000001 = Joy! peff pwpc v1 (classic Mac OS CFM PowerPC container, big-endian).

Container header (40 bytes):

Field	Value
tag1 / tag2 / arch	Joy! / peff / pwpc
formatVersion	1
dateTimeStamp	0xAF4A5504
currentVersion	0
sectionCount	3
instSectionCount	2

Section table (each header 28 bytes; bodies follow the name table):

#	Kind	default	total	unpacked	packed	file off	notes
0	Code (0)	0	625,536	625,536	625,536	0x003840	PPC text (0x98B80 bytes).
1	PatternInitData (2)	0	127,204	122,866	88,128	0x09C3C0	RLE-packed data/TOC/strings; unpacks to 0x1DFF2.
2	Loader (4)	0	0	0	14,272	0x000080	Imports/exports/relocs/entry.

Entry points (from the Loader header):

• main = data-section transition vector at offset 0x5154 → [code 0x00082E5C, TOC 0x00008000]. So main executes at code 0x82E5C and the runtime TOC/r2 = data offset 0x8000. (This TOC value is the key that lets us resolve all r2-relative constant loads — see §6.)
• init = none (-1), term = none (-1).
• exported symbols = 0 (nothing is exported; this is a leaf application, not a shared library).
• imported libraries = 3, imported symbols = 448, reloc sections = 1.

Tool: py -3.13 tools/pefparse.py "Console 4.10" header|loader|strings|dump|dis.

---

3. CFM imports (448 symbols across 3 libraries) — interpreted

Only three shared libraries are imported. Notably absent: OpenTransport, AppleTalk, and any TCP shared library — so the console does not use Open Transport. Its IP networking is done the older way, through the MacTCP .IPP driver via the Device Manager (see the PBControlAsync/Sync + PBOpenSync imports and the CTCPDriver/.IPP strings in §6).

MathLib (6)

num2dec, dec2num, str2dec, dec2str (SANE-style decimal ↔ string) and fetestexcept, feclearexcept (FP exception flags). Used for numeric formatting of scores/stats.

InterfaceLib (436) — the Mac Toolbox surface

Grouped by subsystem (representative, not exhaustive):

• QuickDraw / GWorld / PICT: InitGraf, OpenCPort, NewGWorld*(via UGWorld), LockPixels, CopyBits(implied), OpenCPicture, DrawPicture(implied), PlotCIcon, PlotIconID, RGBBackColor, FrameRoundRect, InvertRgn, ClipRect … — draws the console windows, pod photos (PICT), mech/vehicle art, kill markers.
• Window Manager: NewCWindow, GetNewCWindow, ZoomWindow, SelectWindow, HiliteWindow, FindWindow, BeginUpdate/EndUpdate, DragWindow(implied) …
• Menu Manager: NewMenu, InsertMenu(implied), DeleteMenu, DrawMenuBar, MenuKey, HiliteMenu, EnableItem, CountMItems, GetItemMark …
• Control Manager: NewControl, TrackControl, FindControl, Draw1Control, SetControlValue/Min/Max, HiliteControl, SetControlAction … (scrollers, buttons, the toolbar).
• List / Dialog / TextEdit: LGetSelect, LSetSelect, LSetCell, LGetCell (List Manager — player/network tables), CautionAlert, ParamText, TEInsert, TEActivate, TEGetHeight, TECut, TEUpdate (mission notes / fields).
• File Manager: FSpOpenDF, FSpCreate, FSpDelete, FSRead, FSWrite, FSClose, PBOpenSync, PBReadSync, PBWriteSync, PBHCreateSync, PBGetEOFSync, PBSetEOFSync, FSpCreateResFile, FSpOpenResFile, HOpenResFile … — reads Console.ini, writes Console Log, loads/saves mission egg files.
• Device Manager (→ MacTCP): PBOpenSync, PBControlAsync, PBControlSync — open the .IPP driver and issue TCP control calls (TCPCreate/ActiveOpen/Send/Rcv/Close) — the pod network layer.
• Printing Manager: PrOpen, PrOpenDoc, PrOpenPage, PrCloseDoc, PrClose — prints score sheets / mission highlights.
• Apple Event Manager: AEInstallEventHandler, AEProcessAppleEvent, AECreateAppleEvent, AESend, AEGetParamDesc, AEGetNthDesc, AEPutParamDesc, AECreateList, AEGetAttributePtr, AEResolve(+ObjectSupportLib) … (see §9).
• Misc: Random, BlockMove, GetScrap, SysEnvirons, ExitToShell, NewRoutineDescriptor/NewFatRoutineDescriptor (68K↔PPC mixed-mode glue).

ObjectSupportLib (6) — Apple Event object model

AEResolve, AESetObjectCallbacks, AEInstallObjectAccessor, CreateObjSpecifier, AEObjectInit, CreateOffsetDescriptor — the app is an AppleScript object-model server over its window/document objects (standard PowerPlant UAppleEventsMgr).

---

4. Code organization (from the 27 named CODE segments)

Because this is a fat binary, the resource fork still carries the CodeWarrior 68K segment names, which are a clean module map of the whole program (the PPC side is the same code, differently packaged):

 1 Main            10 Utilities       19 RP Panes
 2 Commanders      11 Libraries       20 Data Objects
 3 Connection      12 Debug           21 BT Data Objects
 4 Panes           13 TCP/IP          22 RP Data Objects
 5 Table           14 MUNGA           23 Printing
 6 Files           15 Console Menus    24 RP Printing
 7 Apple Events    16 Console Windows  25 BT Printing
 8 Array           17 Console Panes    26 Console Features
 9 Features        18 BT Panes

• Connection / TCP/IP = the pod networking (CTCPDriver, CTCPStream, CTCPEndpoint, CTCPAsyncCall, CTCPResolverCall, NetworkEndpoint).
• MUNGA = data marshalling (the mission/egg (de)serializer — "munge").
• BT / RP split = per-game code (BattleTech vs Red Planet) for panes, data objects, and printing.

.cp source-module names recovered from the binary (the CodeWarrior debug string table) include, among ~140 files: ConsoleApp, ConsoleDoc, ConsoleWindow, PrefsDoc, NetworkEndpoint, NetworkEndpointList, NetworkTable, NetworkWindow, CTCPDriver, CTCPStream, CTCPEndpoint, CTCPAsyncCall, CTCPResolverCall, MissionObject, MissionEvent, MissionEventQueue, MissionView, MissionGraphView, MissionGraphWindow, MissionClockView, Participant, TeamList, TeamPrtcpntList, PlayerTable, BTScenario, BTVehicle, BTLocation, RPScenario, RPVehicle, RPLocation, Vehicle, Weather, Experience, Adventure, ScoreSheetView, DamageMatrix, BTKillMarker and the PowerPlant framework classes (LApplication, LDocument, LWindow, LView, LPane, LTableView, LCommander, LListener/LBroadcaster(implied), UAppleEventsMgr, UGWorld, UMemoryMgr, UReanimator, UModalDialogs).

---

5. Resource fork (550 resources, 39 types)

Parsed from __MACOSX/._Console 4.10 with tools/rsrcparse.py. Highlights:

• cfrg (1) — the Code Fragment resource that points the CFM loader at the PEF in the data fork (confirms the fat-binary layout).
• vers (2) — 2.4.0b3, "Console 2.4.0b3", © 1995–1997 FASA Interactive, Inc.
• SIZE / BNDL / FREF / ICN#… — standard app packaging; icm#/ics# application icons.
• ºMWC (32000) — Metrowerks CodeWarrior project stamp (confirms toolchain).

Operator commands & UI

• Toolbar buttons (ICN#/icl4/icl8, ids 1000–1011): Get Next Departure, Translocate, Load Mission, Add Pilot, Delete Pilot, Lookup.
• MENU/Mcmd (10): Apple, File (New / Close / Save / Save a Copy… / Page Setup… / Print / Quit), Edit, Configuration, Adventure, BattleTech, Red Planet + scenario menus (BTScenario, RPScenario).
• WIND/PPob (windows): RPMR ConsoleWindow, RPMF ConsoleWindow, BTFA ConsoleWindow, BTSB ConsoleWindow (the four game-mode console layouts), Mission Graph, Toolbar, Network Diagnostic, Lookup.
• ALRT/DITL: About Box, Save-before-closing/quitting, Confirm Revert, Low Memory Warning, TCP Warning, Landscape/Portrait mode.

Data/game resources

• Mech/MWpn/MDgZ (×24/×24/×22) — BattleTech mechs + weapons + damage zones: BlackHawk, Loki, MadCat, Owens, Thor, Vulture, Avatar, Sunder, TimberWolf, Satyr, Hellbringer, Summoner, …
• PICT (×98) — pod photos (Carpe Diem, Calamity Jane, Man O' War,…) and faction crests (Davion, Kurita, Steiner, Liao, Marik, Comstar, VGL). These match pictID= in Console.ini.
• Txtr (×57) — named text traits (fonts/styles for each field, plasma screen, mission clock).

String lists (STR#) — the semantic vocabulary

61 STR# resources. The protocol-relevant ones:

• STR# 131 "Mission State" — the console-side (document) mission state descriptions, index 0..6:
  1. Mission data is incomplete.
  2. The mission is ready to load.
  3. The mission is being loaded.
  4. The mission is ready for translocation.
  5. The mission is being translocated.
  6. The mission is in progress.
  7. The mission has been completed.
• STR# 130 "Network Endpoints" — the 50-name roster: cockpits (Frequent Flyer, Privateer, Man O' War, Divine Wind, Carpe Diem, Gypsy, Puck, Icarus, Calamity Jane, Valkyrie, Pegasus,…), cameras (Alpha/Beta/Gamma/Delta/Epsilon Camera), Mission Review stations, and PC/test targets (BrownCartPC, GaugeCartPC, ZabswareTarget). Index 0 = Bogon Alert! (invalid), <Available> = a free slot.
• STR# 1002/1003 "Network Errors" — explicitly a 4D database client: _4D_Select4DServer, _4D_Find4DServer, "connection to the database", "asynchronous mode query already in progress", "invalid connection handle".
• STR# 1001 Database Errors, 1004 Database Tasks, 1005 General Errors, 128 General Strings ("%s Mission %s", "Mission Time & Date: %s, %s", Show/Hide Toolbar, Show/Hide Network), 300 Adventure Strings (BattleTech, Red Planet), plus large game tables (scenarios, drop zones, roles, kill/death/damage strings, textures, football positions, …).
• eTbl (3) — error tables named Database Errors, Network Errors, 4D Open Errors (again confirming the 4D backend).

---

6. Pod command/control protocol (MacTCP, port 1501)

This is the highest-value result. Evidence chain: binary strings → disassembly (TOC-resolved) → Console Log → Console.ini.

6.1 Transport

• Custom C++ classes CTCPDriver / CTCPStream / CTCPEndpoint / CTCPAsyncCall / CTCPResolverCall wrap MacTCP. The literal driver name .IPP appears at data 0x1053F right next to CTCPDriver — this is the classic MacTCP IP driver opened with PBOpenSync, then driven with PBControlAsync/Sync.
• One TCP connection per pod. From Console.ini each [NetworkEndpoint::Cockpit::*] sets classID=Ptcp, defaultPort=1501, localHostPort=1501, and the pod's addressIP (200.0.0.11…200.0.0.117, etc.). Console host = 200.0.0.1; pods 200.0.0.11–200.0.0.120 (from the log). The many Ptcp sub-keys (openTimeout, listenTimeout, delay, throughput, reliability, precedence, fragment, timeToLive, security, queryTimeout) are MacTCP TCP/IP ULP parameters passed to TCPActiveOpen / the IP header — further proof this is MacTCP, not OT.

6.2 Receive path — pod → console "Cockpit State"

Message dispatch lives at code 0x63B3C (inside the participant's message handler). The received message's low byte is the type:

0x63B3C  clrlwi  r0, r31, 0x18      ; r0 = msg & 0xFF   (message type)
0x63B40  cmplwi  r0, 0xC            ; 0..12 valid
0x63B44  bgt     0x63BEC            ; >12 → default → "Unknown message type!!!"
0x63B48  lwz     r3, -0x6CA4(r2)    ; TOC[data 0x135C] = jump table @ data 0x17B1C
0x63B4C  slwi    r0, r0, 2
0x63B50  lwzx    r3, r3, r0         ; handler = jumptable[type]
0x63B54  mtctr   r3 ; bctr

Every case calls SetCockpitState(participant+0x30C, type) at 0x62720:

0x62720 SetCockpitState:
   stb   r4, 0x289(r6)     ; participant->cockpitState = type   (field at +0x289)
   li    r4, 0xBBC ; bl BroadcastMessage   ; notify the UI panes/graph

(0x62778 is the matching getter: lbz r3, 0x289(r3).) The console then logs "<IP> Cockpit State: <type>". So the pod's message-type byte is literally the Cockpit State number, 0–12; type > 12 logs "Unknown message type!!!" (seen twice in the 5.3 MB log). The jump table at data 0x17B1C (13 code pointers, default 0x63BEC) is the physical proof of the 0–12 range.

6.3 Send path — console → pod commands

Commands are transmitted by NetworkEndpoint::Send at 0x629EC, called as Send(endpoint, &msgHeaderWord, payloadObj, payloadLen). It frames a packet = 16-byte header + payload:

buf = alloc(len + 0x10)
memcpy(buf+0x10, payloadObj, len)     ; body
buf[0..3]  = *msgHeaderWord           ; message-class word  (observed 0x04000000)
buf[4..7]  = 0
buf[8..11] = value from 0x3CB38       ; sequence / timestamp
CTCPStream::Write(endpoint, buf, len+0x10)   ; via 0x39748 → 0x3BD28

The payload object is a small serialized struct whose byte[0] = its size and byte[4] = the command code. Two confirmed by disassembling the object constructors:

Command	Ctor	payload size	command code (byte[4])	Verb logged	Sender
Translocate mission	0x3EC74	0x0C	5	Translocating Mission…	0x67438
Stop mission	0x3ECC8	0x10	6	Stopping Mission…	0x6755C

Other senders (same shape, codes not yet pinned): Loading Mission (0x64xxx/Received egg file 0x648C0), Ending Mission 0x66464 (uses a variant send 0x5E474 that packs the destination IP from a 4-byte struct field +0x10..0x13), Reset Mission 0x6769C. Command codes for these are recoverable with the same method (find the li r0,N; stb r0,-0x10(r1) that seeds object byte[4]) — see Open Questions.

6.4 Internal PowerPlant command/broadcast IDs

The app's own command constants cluster in 0xBBA–0xBDF (decimal 3002–3039). Confirmed meanings: 0xBBC = cockpit-state-changed broadcast, 0xBC5 = "received egg file", 0xBCB = ending mission, 0xBBA/0xBBB = handled in the participant ListenToMessage at 0x628D8. (0xBC1 is the most frequent; others 0xBCE– 0xBDF map to menu/toolbar commands.)

6.5 Observed mission lifecycle (from the log)

A full run for one pod, with the two state machines interleaved (Cockpit State N = pod→console; verbs = console actions):

Cockpit State 2  (present/connected)
Cockpit State 1  (ready)
Loading Mission…            → console loads the egg
Cockpit State 6
Cockpit State 7
Received egg file           → egg in hand; "Ready to translocate"
Cockpit State 8
Translocating Mission…      → console sends egg/mission to pod   (cmd code 5)
Cockpit State 9
Cockpit State 10 (in progress / running)
Stopping Mission…           (cmd code 6)
Cockpit State 11
Ending Mission…
Cockpit State 12
Cockpit at <IP> initiated close!!!   → pod closed its TCP stream
Cockpit State 3  (closed/disconnected)
Reset Mission…              → console rearms for the next departure
Cockpit State 2 …

Cockpit-state frequencies in the sample log: 1:3997 2:13258 3:12809 6:3098 7:3093 8:3262 9:2852 10:2852 11:2990 12:2890 (states 0, 4, 5 never appear in this log though the dispatch table has slots for them — likely transient/internal). Verb counts: initiated close 24702, Loading 3129, Received egg 3124, Stopping 2996, Ending 2905, Translocating 2882, Reset 953.

---

7. Console Log format

• Encoding: Mac Roman. Records are CR-terminated (0x0D; classic Mac, no LF — 98,910 CRs for ~91,607 records in the sample). 0xC9 = "…" ellipsis inside the mission verbs (13,415 occurrences).
• Record grammar: M/D/YYYY HH:MM:SS␠AM|PM␠<message> CR where <message> is usually <pod-IP> <text> (state/verb lines) or the IP-embedded form Cockpit at <pod-IP> initiated close!!!.
• The timestamps in this capture read year 1956 — the logging Mac's clock was unset (default RTC), not a real date. Times of day are valid.
• 72 distinct message templates; the load-bearing ones: "<IP> Cockpit State: <N>", "Cockpit at <IP> initiated close!!!", "<IP> Loading|Translocating|Stopping|Ending|Reset Mission…", "<IP> Received egg file", "<IP> Unknown message type!!!".
• Log writer: each line is assembled by a string-append helper (0x85324, repeatedly) and flushed by 0x851C4; the leading date/time comes from the global at TOC -0x77CC(r2) (data 0x834). Field separator string is at data 0x17B8.

---

8. Console.ini schema

INI-style but with no newlines — sections are [Name] headers and key=value pairs run together; parse by splitting on [. Section names use a :: hierarchical namespace. 586 sections total in the live file.

Section families (by count): RP 342, BT 196, rpl4 34, NetworkEndpoint 10, Adventure 3, NetworkEndpointList 1.

Every object carries a 4-char classID (an OSType tag naming its C++ class). Confirmed: Ptcp (TCP endpoint), Advn (adventure), RPLn (Red Planet location); BT/RP scenario & vehicle classes follow the same pattern.

8.1 Network endpoints (the pods)

[NetworkEndpointList]
  networkEndpoint = NetworkEndpoint::Cockpit::Frequent Flyer
  networkEndpoint = NetworkEndpoint::Cockpit::Privateer
  … (10 active endpoints)

[NetworkEndpoint::Cockpit::Frequent Flyer]
  classID=Ptcp   hostType=0   state=0   addressUse=0
  addressIP=200.0.0.11
  defaultPort=1501   localHostPort=1501   openInterval=40   openTimeout=10
  listenTimeout=0
  resourceID=130   resourceIndex=2   pictID=308         ; STR# 130 name + PICT photo
  ; MacTCP TCP/IP ULP parameters:
  delay=1 throughput=1 reliability=1 precedence=0 fragment=0
  timeToLive=60 security=0 queryTimeout=60
  loadQueryInterval=1 inProgressQueryInterval=10

resourceID=130 + resourceIndex selects the pod's display name from STR# 130; pictID selects its photo PICT.

8.2 Adventure → Location → Scenario tree (populates the menus)

[Adventure::Solo::Red Planet]      classID=Advn  adventureType=2  resourceID=300 resourceIndex=2  list=RP::Solo::LocationList
[RP::Solo::LocationList]           location=rpl4::Solo::Location::Yip's Yahoorama …
[rpl4::Solo::Location::Wiseguy's Wake]  classID=RPLn resourceID=4000 resourceIndex=3 tag=wise pictID=601 list=RP::Wiseguy's Wake::Solo::ScenarioList
[BT::Cavern::ScenarioList]         scenario=BT::Cavern::NoReturn  scenario=BT::Cavern::FreeForAll
[BT::Solo::LocationList]           location=BT::Solo::Ravines / Arena1 / Polar4 / Cavern …

Four top-level adventures exist in the binary: Adventure::{Solo,Team}::{BattleTech,Red Planet} — matching the four console windows BTFA/BTSB/RPMF/RPMR ConsoleWindow.

8.3 Key inventory

classID, resourceID, resourceIndex, pictID, tag, list, scenario, location, default, value, max, time (structural) and the game-object keys vehicle/vehicel(sic)/vehicleClass, mechID, camo, color, texture, emblem, killMarker, experience, role, position, dropZone, weather, temperature, adventureType, language, scriptCode plus the full Ptcp network key set.

Stationary.ini is the same schema used as a template to regenerate a site's Console.ini; the per-city ini Folder/DB<City> files are venue overrides.

---

9. Apple Events

The app installs standard AE handlers (AEInstallEventHandler) and is a full AppleScript object-model server (ObjectSupportLib + UAppleEventsMgr.cp). Its aete (id 0, "English") declares only the standard suites — Required (reqd: run/open/print/quit), Standard/Core (CoRe: close/get/set/make/save/ data size), and Miscellaneous Standards (misc: revert/select) — over the generic application/window/document classes. aedt (3) = Required Suite, Core Suite, Misc Standards.

Conclusion: Apple Events are used for OS/Finder integration (open-documents = open mission/ini files, print score sheets, quit), not for commanding pods. Pod command is exclusively the MacTCP protocol in §6. (No custom application scripting suite is defined.)

---

10. Tooling written (410console/tools/)

Reusable, dependency-light (Python 3.13 + capstone):

• pefparse.py — PEF container parser + PIDATA (RLE) unpacker + loader (imports/exports/entry) + string extractor + capstone PPC disassembler. header | loader | strings [minlen] | dump <sec> <off> <len> | dis <sec> <off> <count>.
• ppcxref.py — TOC-aware annotator (r2 = data 0x8000): resolves r2-relative constant loads to data addresses/strings and builds a string→code cross-reference. annotate <start> <count> | xref <substr> | toc <off>.
• rsrcparse.py — classic Mac resource-fork parser (reads the AppleDouble ._ sidecar). map | names <TYPE> | strn [id] | dump <TYPE> [id].

Example: py -3.13 tools/rsrcparse.py "4_10-console-extracted/__MACOSX/._Console 4.10" strn 131.

---

11. Confidence & open questions

High confidence (multiple corroborating sources):

• Fat PEF/PPC app, PowerPlant/CodeWarrior, FASA Interactive, creator vwe4, vers 2.4.0b3. (PEF header + resource fork + strings.)
• MacTCP .IPP, port 1501, per-pod TCP, addressing scheme. (imports + CTCPDriver/.IPP string + ini + log.)
• Cockpit State machine 0–12, pod→console, dispatch at 0x63B3C, stored at Participant +0x289, logged verbatim. (disasm + jump table + log stats.)
• Send framing = 16-byte header + payload; command payload byte[0]=size, byte[4]=code; Translocate=5, Stop=6. (disasm of 0x629EC + two ctors.)
• Mission lifecycle ordering. (log, thousands of runs.)
• ini schema and 4D-database backend. (ini + STR#/eTbl + error strings.)

Open questions / next steps:

1. Finish the command-code table. Pin byte[4] for Load, End, Reset, Get-Next-Departure (method: disassemble each sender's object ctor near 0x3EBxx–0x3EFxx for li r0,N; stb r0,-0x10(r1)). Also decode the header word-2 (0x3CB38) — sequence counter vs. timestamp.
2. Header semantics. Confirm whether the pod reads packet byte[0] (class=4) or a payload byte as its "message type", and map the console's command codes to the resulting Cockpit State transitions (5→9, 6→11 observed).
3. Egg transfer mechanism. Determine whether the .egg mission bundle (note the Egg.ini string at data 0x98E9, and the MUNGA segment) travels to the pod over the same 1501 stream during "Translocate", or via a separate transfer. Received egg file is logged console-side — clarify direction (console reads egg from disk vs. receives from DB/pod).
4. States 0/4/5. Never seen in this log; identify their handlers (jumptable[0]=0x63BEC default, [4]/[5]=0x63B78) and meaning.
5. 4D protocol. Out of scope here (proprietary ACI 4D client); the console↔ 4D link governs scheduling ("Get Next Departure") and the pilot roster.
6. Relocations. pefparse does not yet apply the Loader relocation opcode stream (reloc_instr_offset); constant addresses were resolved via the TOC value instead, which was sufficient. A full reloc pass would make every data pointer absolute for deeper xref.

---

Appendix A — key addresses (code section, base 0)

Addr	Role
0x82E5C	program main (via TVector @ data 0x5154)
0x63B3C	received-message dispatch (msg&0xFF → jumptable @ data 0x17B1C)
0x62720	SetCockpitState(participant, state) → Participant +0x289, broadcast 0xBBC
0x62778	GetCockpitState (lbz +0x289)
0x629EC	NetworkEndpoint::Send (16-byte header + payload)
0x39748→0x3BD28	CTCPStream::Write
0x3EC74 / 0x3ECC8	Translocate (code 5) / Stop (code 6) command-object ctors
0x66464 / 0x67438 / 0x6755C / 0x6769C / 0x648C0	senders: Ending / Translocating / Stopping / Reset / Received-egg
0x85324 / 0x851C4	log-line append / flush
data 0x8000	TOC base (r2)
data 0x17B1C	13-entry cockpit-message jump table

Appendix B — reproduce

cd c:\VWE\TeslaRel410\410console
py -3.13 tools\pefparse.py "4_10-console-extracted\Console 4.10" loader
py -3.13 tools\ppcxref.py xref "Mission"
py -3.13 tools\ppcxref.py annotate 0x629ec 0x60
py -3.13 tools\rsrcparse.py "4_10-console-extracted\__MACOSX\._Console 4.10" map
py -3.13 tools\rsrcparse.py "4_10-console-extracted\__MACOSX\._Console 4.10" strn 131