jan/rrt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Map shell service pump control loop

Browse source
This commit is contained in:
Jan Petykiewicz 2026-04-02 23:24:19 -07:00
commit c5dc9ca2cf
2 changed files with 24 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

11
artifacts/exports/rt3-1.06/function-map.csv
View file

@ -8,8 +8,9 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00474f70,97,effect_slot_update_attached_sprite_emitters,bootstrap,thiscall,inferred,ghidra-headless,3,Advances every sprite emitter stored in one effect-slot container by iterating its pointer list and calling 0x00555e50 with update mode zero. When the caller passes null it instead walks the global linked slot list rooted at 0x006cea74.,ghidra + rizin + llvm-objdump
0x00478200,291,shell_queue_single_world_anchor_overlay,shell,cdecl,inferred,ghidra-headless,3,Builds one world-anchor overlay packet for the current owner object. It samples the owner transform through 0x00455800 and 0x00455810 derives projected half-height and half-width through 0x00477a10 world_anchor_measure_projected_half_height and world_anchor_measure_projected_half_width and then enqueues the finished marker through shell_queue_world_anchor_marker.,ghidra + rizin + llvm-objdump
0x00478330,2432,shell_queue_world_anchor_overlay_list,shell,cdecl,inferred,ghidra-headless,3,Builds and queues a repeated world-anchor overlay list for one owner-managed collection. The routine iterates several owner sublists and state branches repeatedly derives projected extents through 0x00477a10 0x004779c0 world_anchor_measure_projected_half_height and world_anchor_measure_projected_half_width and emits one shell_queue_world_anchor_marker packet per accepted overlay entry.,ghidra + rizin + llvm-objdump
0x00483f70,352,shell_service_pump_iteration,shell,thiscall,inferred,objdump + analysis-context,4,Executes one outer shell-service iteration on the shell state rooted at 0x006cec74. The helper can queue service event 0xcc through the shell bundle at 0x006d4018 polls that bundle through 0x00483ea0 refreshes active-mode or shell-state flags ensures the controller work pointer [0x006d4024+0x28] defaults to 0x0062be68 runs several global maintenance helpers and auxiliary cleanup then dispatches shell_state_service_active_mode_frame; when shell-state flag [this+0x501] is set it also marks the controller layout dirty through 0x0051f070 before returning the loop-continue result. bootstrap_init_shell_window_services calls it in the repeating shell loop before mode transitions continue.,objdump + analysis-context + caller xrefs
0x00485750,14,shell_has_tiger_tank_viewer,shell,cdecl,inferred,ghidra-headless,4,Returns whether the dedicated TigerTank shell viewer object at 0x006cfc8c is currently active. The 0x7533 open and 0x7534 close commands both gate on this global before showing status text or mutating viewer state.,ghidra + rizin + llvm-objdump + strings
0x004840e0,863,bootstrap_init_shell_window_services,bootstrap,cdecl,inferred,ghidra-headless,4,Consumes the early bootstrap object then allocates the shell service bundle rooted at 0x006d4024 seeds a 640x480 fallback and drives the main window focus path before later startup continues.,ghidra + rizin
0x004840e0,863,bootstrap_init_shell_window_services,bootstrap,cdecl,inferred,ghidra-headless,4,Consumes the early bootstrap object then allocates and installs the shell service bundle rooted at 0x006d4024 seeds a 640x480 fallback and enters the bootstrap-owned shell loop around shell_service_pump_iteration at 0x00483f70 until shell state [this+0x10] changes; after that it drives the next shell mode transition through 0x00482ec0 before later startup continues.,ghidra + rizin + llvm-objdump
0x00484440,323,app_bootstrap_main,bootstrap,cdecl,inferred,ghidra-headless,4,Primary post-CRT bootstrap coordinator; initializes COM and branding strings then probes host state and hands off into the main application bootstrap chain.,ghidra + rizin
0x00484590,887,shell_init_graphics_preset_state,shell,cdecl,inferred,ghidra-headless,3,Initializes the shell graphics-preset state block rooted at [this+0x70]. It clears a large option buffer seeds many default fields and applies one of three coarse mode layouts from its integer argument before later preset application or config-save helpers continue.,ghidra + rizin + llvm-objdump
0x00484910,105,shell_save_graphics_config,shell,cdecl,inferred,ghidra-headless,4,Persistently writes the current shell graphics configuration to data\\configuration\\game.cfg. It optionally syncs the global display runtime through 0x0051eea0 then writes config keys 0x429 and 0x48d from the shell state block before closing the file.,ghidra + rizin + llvm-objdump + strings
@ -91,6 +92,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x00502720,144,paint_terrain_tool_init_globals,shell,thiscall,inferred,ghidra-headless,4,Initializes the PaintTerrain shell tool singleton rooted at 0x006d14bc. The constructor seeds the tool vtable and default fields registers the active instance globally and is selected directly from shell_transition_mode alongside the neighboring terrain-edit tool constructor at 0x004ee3a0.,ghidra + rizin + llvm-objdump + strings
0x00481d00,612,bootstrap_parse_command_line_flags,bootstrap,cdecl,inferred,ghidra-headless,4,Parses the startup command line from ECX handling slash and dash switches and writes multiple bootstrap globals and option buffers before shell service init.,ghidra + rizin
0x00481fd0,348,bootstrap_scan_autorun_media,bootstrap,cdecl,inferred,ghidra-headless,4,Scans drive letters for RT3 autorun marker files rt3d1.txt and rt3d2.txt using GetDriveTypeA and open or close helpers before deeper shell init.,ghidra + rizin
0x00482160,101,shell_state_service_active_mode_frame,shell,thiscall,inferred,objdump + analysis-context,4,Acts as the broader shell-state service pass around one active-mode update on the shell state rooted at 0x006cec74. The helper increments nested-service depth at [this+0x64] optionally notifies the active mode object at 0x006cec78 through 0x0051f940 and 0x00434050 primes the shell runtime at 0x006d401c through 0x00538b60 conditionally services the auxiliary object at 0x006cd8d8 through 0x00469720 and then dispatches shell_service_frame_cycle on the global shell controller at 0x006d4024 before decrementing the depth counter.,objdump + analysis-context + caller xrefs
0x004821d0,1019,shell_recompute_layout_slots,bootstrap,thiscall,inferred,ghidra-headless,4,Recomputes the shell layout-slot table after resolution or related display selectors change; derives normalized coordinates from static float tables updates 144 slot entries through the shell bundle child at [0x006d4024+0x18] and then commits the refreshed state.,ghidra + rizin
0x00482ec0,1359,shell_transition_mode,bootstrap,thiscall,inferred,ghidra-headless,4,Switches the shell state's active mode at [this+0x08] tearing down any prior mode object selecting one of seven mode-specific handlers and updating globals like 0x006cec78 before notifying the shell bundle through 0x00538e50.,ghidra + rizin
0x005a2d64,101,crt_init_exit_handlers,startup,cdecl,inferred,ghidra-headless,3,Initializes on-exit tables and registers atexit handling before control reaches application startup.,ghidra + rizin
@ -110,6 +112,7 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x0051ebc0,731,shell_reset_display_runtime_defaults,shell,cdecl,inferred,ghidra-headless,3,Resets the global display runtime defaults rooted at 0x006d4024. It clears the large display-settings block under offsets 0x11468a and above seeds default resolution and capability flags from mode 0x006d4028 and reinitializes several shell display toggles before later preset application continues.,ghidra + rizin + llvm-objdump
0x0051eea0,128,shell_save_display_runtime_config,shell,cdecl,inferred,ghidra-headless,4,Writes the larger display-runtime blob to data\\configuration\\engine.cfg. It stores version key 0x41b serializes the 0x1e4-byte runtime block rooted at [this+0x11468a] and writes an additional 0x1ec-byte companion block before closing the file.,ghidra + rizin + llvm-objdump + strings
0x0051ef20,194,shell_load_display_runtime_config_or_init_defaults,shell,cdecl,inferred,ghidra-headless,4,Loads the larger display-runtime blob from data\\configuration\\engine.cfg. When the file is missing invalid or already superseded by mode state at 0x006d4028 it falls back to 0x0051ebc0 and 0x0051eea0; otherwise it validates key 0x41b restores the 0x1e4-byte and 0x1ec-byte blocks and clears one shell display flag when [this+0x11474a] is set.,ghidra + rizin + llvm-objdump + strings
0x0051f0f0,3,shell_controller_get_window_handle,shell,thiscall,inferred,objdump + import-table,4,Returns the native shell window handle stored at [this+0x00]. Callers forward the returned handle into USER32 imports such as SetFocus SetMenu and SetCapture during shell startup and presentation interaction.,objdump + USER32 import table + callsite xrefs
0x0051f1d0,90,shell_signal_deferred_work_item_shutdown,shell,thiscall,inferred,ghidra-headless,3,Walks the shell deferred-work item queue at [this+0x1136a5] and inspects each queued payload object's nested message queue at [item+0xe4]. When intrusive_queue_peek_tail_payload finds a nonnull tail payload it clears the outer queued-handle slot at [item+0xe8] and appends a null sentinel into the nested queue through intrusive_queue_push_back before continuing iteration.,ghidra + rizin + llvm-objdump
0x0051f230,128,shell_enqueue_deferred_work_message,shell,thiscall,inferred,ghidra-headless,4,Routes one deferred-work message through the shell queue system. When the global routing gate at 0x006d4034 and shell flag [this+0x11369c] are both set it feeds the special queue at [this+0x11369d]; otherwise a nonnull payload object is queued once in [this+0x1136a5] with the returned queue-node handle cached at [item+0xe8] and the message is appended to the payload-owned nested queue at [item+0xe4] while a null payload appends directly into the fallback queue at [this+0x1136a1].,ghidra + rizin + llvm-objdump
0x0051f2b0,104,shell_post_deferred_message_type5,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the shell-owned slab rooted at [this+0x5c] using count [this+0x58] tags it as type 0x05 stores four caller dwords at offsets +0x01 +0x05 +0x09 and +0x0d and then posts the record directly into the shell deferred queue roots through [this+0x11369d] or [this+0x1136a1].,ghidra + rizin + llvm-objdump
@ -118,12 +121,14 @@ address,size,name,subsystem,calling_convention,prototype_status,source_tool,conf
0x0051f460,173,shell_enqueue_deferred_message_type1,shell,thiscall,inferred,ghidra-headless,4,Allocates one 0x5e-byte deferred-message record from the same shell-local slab fills the smaller type-0x01 payload subset mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message.,ghidra + rizin + llvm-objdump
0x0051f510,48,shell_set_gamma_ramp_scalar,shell,thiscall,inferred,ghidra-headless,4,Applies one shell gamma-ramp scalar to the active display runtime state. When the presentation service pointer at [this+0x0c] is live it forwards the scalar into 0x00547f20 for an immediate hardware upload; otherwise it only caches the requested value at [this+0x1146b9] until the service is ready.,ghidra + rizin + llvm-objdump
0x0051fd70,516,shell_update_frame_time_history,shell,thiscall,inferred,ghidra-headless,4,Updates a 256-sample frame-time history from successive GetTickCount deltas. The helper advances the ring index in 0x006d403c stores each delta under [this+0x11428a] and derives a smoothed frame scalar at [this+0x114282] for later shell frame consumers such as 0x0051ff80 and the presentation-frame path.,ghidra + rizin + llvm-objdump
0x0051ff80,7,shell_get_smoothed_frame_scalar,shell,thiscall,inferred,objdump,4,Returns the smoothed frame scalar cached at [this+0x114282]. shell_update_frame_time_history refreshes that field each frame and shell_refresh_presentation_frame consumes it during the main presentation refresh path.,objdump + callsite xrefs
0x0051ff90,24,shell_install_global_controller,shell,thiscall,inferred,objdump + analysis-context,4,Installs one shell controller as the process-global singleton at 0x006d4024 clears controller flag [this+0x114201] reruns the local state reset helper at 0x0051ea80 and returns the same controller pointer. bootstrap_init_shell_window_services calls it immediately after allocating the 0x11486e-byte controller object.,objdump + analysis-context + startup xrefs
0x00521d10,38,multiplayer_request_peer_session_control,shell,cdecl,inferred,ghidra-headless,3,Requests one direct session-control action for a resolved multiplayer peer object. When the live session transport at `0x006d40dc` is present it follows the transport-owned interface at `[ecx+0x18e]->+0x08` and invokes vtable slot `+0x68` with the target peer object and three zero trailing arguments; the current grounded callers are the `\\kick` branch and the online-peer `\\unban` follow-up path.,ghidra + rizin + llvm-objdump
0x0051fa00,56,shell_get_memory_budget_ceiling_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns the current upper memory-budget bucket in bytes for the shell display runtime. When override field [this+0x1146ca] is set it maps that tier through the shared table at 0x00624c34 containing 0 1MB 2MB and 4MB entries; otherwise it starts from baseline field [this+0x1136ad] and adjusts it by the active lower-tier delta derived from [this+0x1146c6] and [this+0x1136a9] before clamping negative results to zero.,ghidra + rizin + llvm-objdump
0x0051fa40,25,shell_get_memory_budget_floor_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns the current lower memory-budget bucket in bytes for the shell display runtime. When field [this+0x1146c6] is nonzero it maps that tier through the shared 0 1MB 2MB 4MB table at 0x00624c34; otherwise it falls back to baseline field [this+0x1136a9].,ghidra + rizin + llvm-objdump
0x0051fa60,63,shell_get_nonnegative_memory_budget_floor_bytes,shell,thiscall,inferred,ghidra-headless,3,Returns a nonnegative lower memory-budget value for float consumers in the shell and presentation paths. It prefers explicit tier field [this+0x1146ce] then the active floor bucket behind [this+0x1146c6] and finally baseline field [this+0x1136a9] using the shared 0 1MB 2MB 4MB table at 0x00624c34 and clamping negative results to zero.,ghidra + rizin + llvm-objdump
0x005204b0,128,shell_flush_deferred_work_queues,shell,thiscall,inferred,ghidra-headless,3,Flushes the shell controller's three deferred-work queue roots at [this+0x1136a1] [this+0x11369d] and [this+0x1136a5]. The helper clears the first two containers through intrusive_queue_clear_and_release then rewinds the deferred-item queue through intrusive_queue_rewind_iterator repeatedly pops each queued payload through intrusive_queue_next_iterator_node clears its outer queued-handle slot at [item+0xe8] and finally releases the remaining queue storage before returning. It is used at the end of the shell frame cycle and from the broader shell-mode helper at 0x00443a50.,ghidra + rizin + llvm-objdump
0x00520620,141,shell_service_frame_cycle,shell,thiscall,inferred,ghidra-headless,3,Services one shell frame cycle for the active controller. When pending-frame state is armed through [this+0x56] and the controller pointers at [this+0x18] [this+0x1c] and [this+0x28] are live it runs the main presentation refresh through 0x0052b990 then updates frame timing through 0x0051fd70 runs the mouse-cursor frame updater 0x0053f4e0 requests the deeper layout-state rebuild path through 0x00565110 performs a one-time ShowWindow on [this] drains deferred work through 0x005204b0 and clears the pending flags at [this+0x56] and [this+0x58].,ghidra + rizin + llvm-objdump
0x005204b0,128,shell_flush_deferred_work_queues,shell,thiscall,inferred,ghidra-headless,4,Flushes the shell controller's three deferred-work queue roots at [this+0x1136a1] [this+0x11369d] and [this+0x1136a5]. The helper clears the first two containers through intrusive_queue_clear_and_release then rewinds the deferred-item queue through intrusive_queue_rewind_iterator repeatedly pops each queued payload through intrusive_queue_next_iterator_node clears its outer queued-handle slot at [item+0xe8] and finally releases the remaining queue storage before returning. It is used at the end of shell_service_frame_cycle and from the broader shell-mode helper at 0x00443a50.,ghidra + rizin + llvm-objdump
0x00520620,141,shell_service_frame_cycle,shell,thiscall,inferred,ghidra-headless,4,Acts as the outer owner for one pending shell frame cycle on the active controller. When pending-frame state is armed through [this+0x56] and controller pointers [this+0x18] [this+0x1c] and [this+0x28] are live it runs shell_refresh_presentation_frame through 0x0052b990; otherwise it still updates frame timing through 0x0051fd70 runs the mouse-cursor frame updater 0x0053f4e0 requests the deeper layout-state rebuild path through 0x00565110 performs a one-time ShowWindow on the controller window handle at [this] drains deferred work through 0x005204b0 and clears the pending flags at [this+0x56] and [this+0x58].,ghidra + rizin + llvm-objdump
0x00521060,805,bootstrap_init_shell_service_bundle,bootstrap,cdecl,inferred,ghidra-headless,4,Builds the shell-facing singleton bundle stored through globals like 0x006d4024 0x006d402c and 0x006d4030 wiring startup width and height state and an rt3_ prefixed service path.,ghidra + rizin
0x00521390,486,bootstrap_destroy_shell_service_bundle,bootstrap,cdecl,inferred,ghidra-headless,4,Destroys the shell service bundle created by 0x00521060 releasing each global singleton and clearing 0x006d4024 0x006d402c 0x006d4030 0x006d4020 and 0x006d4018.,ghidra + rizin
0x00523d90,65,shell_commit_layout_updates,bootstrap,thiscall,inferred,ghidra-headless,3,Applies pending layout-slot changes from the shell controller into its subordinate layout-state object at [this+0x2d] by walking embedded service pointers and issuing the follow-on rebuild or refresh calls that make the updated slot table live.,ghidra + rizin

1 address size name subsystem calling_convention prototype_status source_tool confidence notes verified_against
8 0x00474f70 97 effect_slot_update_attached_sprite_emitters bootstrap thiscall inferred ghidra-headless 3 Advances every sprite emitter stored in one effect-slot container by iterating its pointer list and calling 0x00555e50 with update mode zero. When the caller passes null it instead walks the global linked slot list rooted at 0x006cea74. ghidra + rizin + llvm-objdump
9 0x00478200 291 shell_queue_single_world_anchor_overlay shell cdecl inferred ghidra-headless 3 Builds one world-anchor overlay packet for the current owner object. It samples the owner transform through 0x00455800 and 0x00455810 derives projected half-height and half-width through 0x00477a10 world_anchor_measure_projected_half_height and world_anchor_measure_projected_half_width and then enqueues the finished marker through shell_queue_world_anchor_marker. ghidra + rizin + llvm-objdump
10 0x00478330 2432 shell_queue_world_anchor_overlay_list shell cdecl inferred ghidra-headless 3 Builds and queues a repeated world-anchor overlay list for one owner-managed collection. The routine iterates several owner sublists and state branches repeatedly derives projected extents through 0x00477a10 0x004779c0 world_anchor_measure_projected_half_height and world_anchor_measure_projected_half_width and emits one shell_queue_world_anchor_marker packet per accepted overlay entry. ghidra + rizin + llvm-objdump
11 0x00483f70 352 shell_service_pump_iteration shell thiscall inferred objdump + analysis-context 4 Executes one outer shell-service iteration on the shell state rooted at 0x006cec74. The helper can queue service event 0xcc through the shell bundle at 0x006d4018 polls that bundle through 0x00483ea0 refreshes active-mode or shell-state flags ensures the controller work pointer [0x006d4024+0x28] defaults to 0x0062be68 runs several global maintenance helpers and auxiliary cleanup then dispatches shell_state_service_active_mode_frame; when shell-state flag [this+0x501] is set it also marks the controller layout dirty through 0x0051f070 before returning the loop-continue result. bootstrap_init_shell_window_services calls it in the repeating shell loop before mode transitions continue. objdump + analysis-context + caller xrefs
12 0x00485750 14 shell_has_tiger_tank_viewer shell cdecl inferred ghidra-headless 4 Returns whether the dedicated TigerTank shell viewer object at 0x006cfc8c is currently active. The 0x7533 open and 0x7534 close commands both gate on this global before showing status text or mutating viewer state. ghidra + rizin + llvm-objdump + strings
13 0x004840e0 863 bootstrap_init_shell_window_services bootstrap cdecl inferred ghidra-headless 4 Consumes the early bootstrap object then allocates the shell service bundle rooted at 0x006d4024 seeds a 640x480 fallback and drives the main window focus path before later startup continues. Consumes the early bootstrap object then allocates and installs the shell service bundle rooted at 0x006d4024 seeds a 640x480 fallback and enters the bootstrap-owned shell loop around shell_service_pump_iteration at 0x00483f70 until shell state [this+0x10] changes; after that it drives the next shell mode transition through 0x00482ec0 before later startup continues. ghidra + rizin ghidra + rizin + llvm-objdump
14 0x00484440 323 app_bootstrap_main bootstrap cdecl inferred ghidra-headless 4 Primary post-CRT bootstrap coordinator; initializes COM and branding strings then probes host state and hands off into the main application bootstrap chain. ghidra + rizin
15 0x00484590 887 shell_init_graphics_preset_state shell cdecl inferred ghidra-headless 3 Initializes the shell graphics-preset state block rooted at [this+0x70]. It clears a large option buffer seeds many default fields and applies one of three coarse mode layouts from its integer argument before later preset application or config-save helpers continue. ghidra + rizin + llvm-objdump
16 0x00484910 105 shell_save_graphics_config shell cdecl inferred ghidra-headless 4 Persistently writes the current shell graphics configuration to data\\configuration\\game.cfg. It optionally syncs the global display runtime through 0x0051eea0 then writes config keys 0x429 and 0x48d from the shell state block before closing the file. ghidra + rizin + llvm-objdump + strings
92 0x00502720 144 paint_terrain_tool_init_globals shell thiscall inferred ghidra-headless 4 Initializes the PaintTerrain shell tool singleton rooted at 0x006d14bc. The constructor seeds the tool vtable and default fields registers the active instance globally and is selected directly from shell_transition_mode alongside the neighboring terrain-edit tool constructor at 0x004ee3a0. ghidra + rizin + llvm-objdump + strings
93 0x00481d00 612 bootstrap_parse_command_line_flags bootstrap cdecl inferred ghidra-headless 4 Parses the startup command line from ECX handling slash and dash switches and writes multiple bootstrap globals and option buffers before shell service init. ghidra + rizin
94 0x00481fd0 348 bootstrap_scan_autorun_media bootstrap cdecl inferred ghidra-headless 4 Scans drive letters for RT3 autorun marker files rt3d1.txt and rt3d2.txt using GetDriveTypeA and open or close helpers before deeper shell init. ghidra + rizin
95 0x00482160 101 shell_state_service_active_mode_frame shell thiscall inferred objdump + analysis-context 4 Acts as the broader shell-state service pass around one active-mode update on the shell state rooted at 0x006cec74. The helper increments nested-service depth at [this+0x64] optionally notifies the active mode object at 0x006cec78 through 0x0051f940 and 0x00434050 primes the shell runtime at 0x006d401c through 0x00538b60 conditionally services the auxiliary object at 0x006cd8d8 through 0x00469720 and then dispatches shell_service_frame_cycle on the global shell controller at 0x006d4024 before decrementing the depth counter. objdump + analysis-context + caller xrefs
96 0x004821d0 1019 shell_recompute_layout_slots bootstrap thiscall inferred ghidra-headless 4 Recomputes the shell layout-slot table after resolution or related display selectors change; derives normalized coordinates from static float tables updates 144 slot entries through the shell bundle child at [0x006d4024+0x18] and then commits the refreshed state. ghidra + rizin
97 0x00482ec0 1359 shell_transition_mode bootstrap thiscall inferred ghidra-headless 4 Switches the shell state's active mode at [this+0x08] tearing down any prior mode object selecting one of seven mode-specific handlers and updating globals like 0x006cec78 before notifying the shell bundle through 0x00538e50. ghidra + rizin
98 0x005a2d64 101 crt_init_exit_handlers startup cdecl inferred ghidra-headless 3 Initializes on-exit tables and registers atexit handling before control reaches application startup. ghidra + rizin
112 0x0051ebc0 731 shell_reset_display_runtime_defaults shell cdecl inferred ghidra-headless 3 Resets the global display runtime defaults rooted at 0x006d4024. It clears the large display-settings block under offsets 0x11468a and above seeds default resolution and capability flags from mode 0x006d4028 and reinitializes several shell display toggles before later preset application continues. ghidra + rizin + llvm-objdump
113 0x0051eea0 128 shell_save_display_runtime_config shell cdecl inferred ghidra-headless 4 Writes the larger display-runtime blob to data\\configuration\\engine.cfg. It stores version key 0x41b serializes the 0x1e4-byte runtime block rooted at [this+0x11468a] and writes an additional 0x1ec-byte companion block before closing the file. ghidra + rizin + llvm-objdump + strings
114 0x0051ef20 194 shell_load_display_runtime_config_or_init_defaults shell cdecl inferred ghidra-headless 4 Loads the larger display-runtime blob from data\\configuration\\engine.cfg. When the file is missing invalid or already superseded by mode state at 0x006d4028 it falls back to 0x0051ebc0 and 0x0051eea0; otherwise it validates key 0x41b restores the 0x1e4-byte and 0x1ec-byte blocks and clears one shell display flag when [this+0x11474a] is set. ghidra + rizin + llvm-objdump + strings
115 0x0051f0f0 3 shell_controller_get_window_handle shell thiscall inferred objdump + import-table 4 Returns the native shell window handle stored at [this+0x00]. Callers forward the returned handle into USER32 imports such as SetFocus SetMenu and SetCapture during shell startup and presentation interaction. objdump + USER32 import table + callsite xrefs
116 0x0051f1d0 90 shell_signal_deferred_work_item_shutdown shell thiscall inferred ghidra-headless 3 Walks the shell deferred-work item queue at [this+0x1136a5] and inspects each queued payload object's nested message queue at [item+0xe4]. When intrusive_queue_peek_tail_payload finds a nonnull tail payload it clears the outer queued-handle slot at [item+0xe8] and appends a null sentinel into the nested queue through intrusive_queue_push_back before continuing iteration. ghidra + rizin + llvm-objdump
117 0x0051f230 128 shell_enqueue_deferred_work_message shell thiscall inferred ghidra-headless 4 Routes one deferred-work message through the shell queue system. When the global routing gate at 0x006d4034 and shell flag [this+0x11369c] are both set it feeds the special queue at [this+0x11369d]; otherwise a nonnull payload object is queued once in [this+0x1136a5] with the returned queue-node handle cached at [item+0xe8] and the message is appended to the payload-owned nested queue at [item+0xe4] while a null payload appends directly into the fallback queue at [this+0x1136a1]. ghidra + rizin + llvm-objdump
118 0x0051f2b0 104 shell_post_deferred_message_type5 shell thiscall inferred ghidra-headless 4 Allocates one 0x5e-byte deferred-message record from the shell-owned slab rooted at [this+0x5c] using count [this+0x58] tags it as type 0x05 stores four caller dwords at offsets +0x01 +0x05 +0x09 and +0x0d and then posts the record directly into the shell deferred queue roots through [this+0x11369d] or [this+0x1136a1]. ghidra + rizin + llvm-objdump
121 0x0051f460 173 shell_enqueue_deferred_message_type1 shell thiscall inferred ghidra-headless 4 Allocates one 0x5e-byte deferred-message record from the same shell-local slab fills the smaller type-0x01 payload subset mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message. ghidra + rizin + llvm-objdump
122 0x0051f510 48 shell_set_gamma_ramp_scalar shell thiscall inferred ghidra-headless 4 Applies one shell gamma-ramp scalar to the active display runtime state. When the presentation service pointer at [this+0x0c] is live it forwards the scalar into 0x00547f20 for an immediate hardware upload; otherwise it only caches the requested value at [this+0x1146b9] until the service is ready. ghidra + rizin + llvm-objdump
123 0x0051fd70 516 shell_update_frame_time_history shell thiscall inferred ghidra-headless 4 Updates a 256-sample frame-time history from successive GetTickCount deltas. The helper advances the ring index in 0x006d403c stores each delta under [this+0x11428a] and derives a smoothed frame scalar at [this+0x114282] for later shell frame consumers such as 0x0051ff80 and the presentation-frame path. ghidra + rizin + llvm-objdump
124 0x0051ff80 7 shell_get_smoothed_frame_scalar shell thiscall inferred objdump 4 Returns the smoothed frame scalar cached at [this+0x114282]. shell_update_frame_time_history refreshes that field each frame and shell_refresh_presentation_frame consumes it during the main presentation refresh path. objdump + callsite xrefs
125 0x0051ff90 24 shell_install_global_controller shell thiscall inferred objdump + analysis-context 4 Installs one shell controller as the process-global singleton at 0x006d4024 clears controller flag [this+0x114201] reruns the local state reset helper at 0x0051ea80 and returns the same controller pointer. bootstrap_init_shell_window_services calls it immediately after allocating the 0x11486e-byte controller object. objdump + analysis-context + startup xrefs
126 0x00521d10 38 multiplayer_request_peer_session_control shell cdecl inferred ghidra-headless 3 Requests one direct session-control action for a resolved multiplayer peer object. When the live session transport at `0x006d40dc` is present it follows the transport-owned interface at `[ecx+0x18e]->+0x08` and invokes vtable slot `+0x68` with the target peer object and three zero trailing arguments; the current grounded callers are the `\\kick` branch and the online-peer `\\unban` follow-up path. ghidra + rizin + llvm-objdump
127 0x0051fa00 56 shell_get_memory_budget_ceiling_bytes shell thiscall inferred ghidra-headless 3 Returns the current upper memory-budget bucket in bytes for the shell display runtime. When override field [this+0x1146ca] is set it maps that tier through the shared table at 0x00624c34 containing 0 1MB 2MB and 4MB entries; otherwise it starts from baseline field [this+0x1136ad] and adjusts it by the active lower-tier delta derived from [this+0x1146c6] and [this+0x1136a9] before clamping negative results to zero. ghidra + rizin + llvm-objdump
128 0x0051fa40 25 shell_get_memory_budget_floor_bytes shell thiscall inferred ghidra-headless 3 Returns the current lower memory-budget bucket in bytes for the shell display runtime. When field [this+0x1146c6] is nonzero it maps that tier through the shared 0 1MB 2MB 4MB table at 0x00624c34; otherwise it falls back to baseline field [this+0x1136a9]. ghidra + rizin + llvm-objdump
129 0x0051fa60 63 shell_get_nonnegative_memory_budget_floor_bytes shell thiscall inferred ghidra-headless 3 Returns a nonnegative lower memory-budget value for float consumers in the shell and presentation paths. It prefers explicit tier field [this+0x1146ce] then the active floor bucket behind [this+0x1146c6] and finally baseline field [this+0x1136a9] using the shared 0 1MB 2MB 4MB table at 0x00624c34 and clamping negative results to zero. ghidra + rizin + llvm-objdump
130 0x005204b0 128 shell_flush_deferred_work_queues shell thiscall inferred ghidra-headless 3 4 Flushes the shell controller's three deferred-work queue roots at [this+0x1136a1] [this+0x11369d] and [this+0x1136a5]. The helper clears the first two containers through intrusive_queue_clear_and_release then rewinds the deferred-item queue through intrusive_queue_rewind_iterator repeatedly pops each queued payload through intrusive_queue_next_iterator_node clears its outer queued-handle slot at [item+0xe8] and finally releases the remaining queue storage before returning. It is used at the end of the shell frame cycle and from the broader shell-mode helper at 0x00443a50. Flushes the shell controller's three deferred-work queue roots at [this+0x1136a1] [this+0x11369d] and [this+0x1136a5]. The helper clears the first two containers through intrusive_queue_clear_and_release then rewinds the deferred-item queue through intrusive_queue_rewind_iterator repeatedly pops each queued payload through intrusive_queue_next_iterator_node clears its outer queued-handle slot at [item+0xe8] and finally releases the remaining queue storage before returning. It is used at the end of shell_service_frame_cycle and from the broader shell-mode helper at 0x00443a50. ghidra + rizin + llvm-objdump
131 0x00520620 141 shell_service_frame_cycle shell thiscall inferred ghidra-headless 3 4 Services one shell frame cycle for the active controller. When pending-frame state is armed through [this+0x56] and the controller pointers at [this+0x18] [this+0x1c] and [this+0x28] are live it runs the main presentation refresh through 0x0052b990 then updates frame timing through 0x0051fd70 runs the mouse-cursor frame updater 0x0053f4e0 requests the deeper layout-state rebuild path through 0x00565110 performs a one-time ShowWindow on [this] drains deferred work through 0x005204b0 and clears the pending flags at [this+0x56] and [this+0x58]. Acts as the outer owner for one pending shell frame cycle on the active controller. When pending-frame state is armed through [this+0x56] and controller pointers [this+0x18] [this+0x1c] and [this+0x28] are live it runs shell_refresh_presentation_frame through 0x0052b990; otherwise it still updates frame timing through 0x0051fd70 runs the mouse-cursor frame updater 0x0053f4e0 requests the deeper layout-state rebuild path through 0x00565110 performs a one-time ShowWindow on the controller window handle at [this] drains deferred work through 0x005204b0 and clears the pending flags at [this+0x56] and [this+0x58]. ghidra + rizin + llvm-objdump
132 0x00521060 805 bootstrap_init_shell_service_bundle bootstrap cdecl inferred ghidra-headless 4 Builds the shell-facing singleton bundle stored through globals like 0x006d4024 0x006d402c and 0x006d4030 wiring startup width and height state and an rt3_ prefixed service path. ghidra + rizin
133 0x00521390 486 bootstrap_destroy_shell_service_bundle bootstrap cdecl inferred ghidra-headless 4 Destroys the shell service bundle created by 0x00521060 releasing each global singleton and clearing 0x006d4024 0x006d402c 0x006d4030 0x006d4020 and 0x006d4018. ghidra + rizin
134 0x00523d90 65 shell_commit_layout_updates bootstrap thiscall inferred ghidra-headless 3 Applies pending layout-slot changes from the shell controller into its subordinate layout-state object at [this+0x2d] by walking embedded service pointers and issuing the follow-on rebuild or refresh calls that make the updated slot table live. ghidra + rizin

32
docs/control-loop-atlas.md
View file

@ -16,13 +16,13 @@ anchor it, and where control is handed to neighboring subsystems.
## Bootstrap and Shell Service Bring-Up
- Roots: `app_bootstrap_main` at `0x00484440` and `bootstrap_init_shell_window_services` at `0x004840e0`.
- Roots: `app_bootstrap_main` at `0x00484440`, `bootstrap_init_shell_window_services` at `0x004840e0`, and `shell_install_global_controller` at `0x0051ff90`.
- Trigger/Cadence: one-time bootstrap handoff immediately after CRT completion.
- Key Dispatchers: `app_bootstrap_main`, `bootstrap_init_shell_window_services`, graphics config load or default-init helpers, runtime capability probes, and early shell service initializers under the `0x004610..0x0053f0..` branch.
- State Anchors: shell service bundle rooted at `0x006d4024`, display/runtime globals under `0x006d4024` and `0x006d4030`, host capability flags gathered by `bootstrap_probe_system_profile`.
- Subsystem Handoffs: hands control into shell/UI configuration, presentation defaults, and later per-frame shell work.
- Evidence: `startup-call-chain.md`, function-map rows for `app_bootstrap_main`, `bootstrap_init_shell_window_services`, `shell_load_graphics_config_or_init_defaults`, `shell_reset_display_runtime_defaults`, and related graphics setup helpers.
- Open Questions: where the first persistent main-loop owner object becomes stable; whether `0x0046c230` or one of the unnamed bootstrap children is the shell's first long-lived coordinator.
- Key Dispatchers: `app_bootstrap_main`, `bootstrap_init_shell_window_services`, `shell_install_global_controller`, `shell_service_pump_iteration`, graphics config load or default-init helpers, runtime capability probes, and early shell service initializers under the `0x004610..0x0053f0..` branch.
- State Anchors: global shell controller pointer `0x006d4024`, sibling display/runtime globals under `0x006d402c` and `0x006d4030`, and host capability flags gathered by `bootstrap_probe_system_profile`.
- Subsystem Handoffs: after the global shell controller has been installed the bootstrap path enters the repeating `shell_service_pump_iteration` loop, which services shell-state work and hands each iteration down into the controller frame path.
- Evidence: `startup-call-chain.md`, function-map rows for `app_bootstrap_main`, `bootstrap_init_shell_window_services`, `shell_install_global_controller`, `shell_service_pump_iteration`, `shell_load_graphics_config_or_init_defaults`, `shell_reset_display_runtime_defaults`, and related graphics setup helpers.
- Open Questions: whether `bootstrap_init_shell_window_services` remains the long-lived shell main loop for all shell modes or later hands control to another outer coordinator after certain transitions.
## Shell UI Command and Deferred Work Flow
@ -30,19 +30,19 @@ anchor it, and where control is handed to neighboring subsystems.
- Trigger/Cadence: event-driven UI command dispatch plus deferred-message queue flushing during shell activity.
- Key Dispatchers: `shell_dispatch_ui_command`, `shell_enqueue_deferred_work_message`, `shell_post_deferred_message_type5`, `shell_post_deferred_message_type6`, `shell_enqueue_deferred_message_type4`, `shell_enqueue_deferred_message_type1`.
- State Anchors: shell object at `0x0062be68`, queue roots around `[this+0x11369d]`, `[this+0x1136a1]`, and `[this+0x1136a5]`, plus global routing gates at `0x006d4034`.
- Subsystem Handoffs: routes into graphics config, scenario-text export, overlay generation, multiplayer UI, and presentation-facing deferred work.
- Subsystem Handoffs: routes into graphics config, scenario-text export, overlay generation, multiplayer UI, and presentation-facing deferred work later drained by `shell_service_frame_cycle`.
- Evidence: function-map shell rows around `0x00464410` and `0x0051f1d0..0x0051f460`.
- Open Questions: where the deferred queues are drained in the wider frame loop; whether the shell command dispatcher is also used by hotkeys or only by UI callback tables.
- Open Questions: whether the shell command dispatcher is also used by hotkeys or only by UI callback tables.
## Presentation, Overlay, and Frame Timing
- Roots: shell display runtime setup and the frame-time history path under `shell_update_frame_time_history` at `0x0051fd70`.
- Trigger/Cadence: recurring shell or presentation update loop once the window and display runtime are live.
- Key Dispatchers: `shell_update_frame_time_history`, `shell_set_gamma_ramp_scalar`, overlay builders such as `shell_queue_single_world_anchor_overlay`, `shell_queue_world_anchor_overlay_list`, and `shell_queue_indexed_world_anchor_marker`.
- State Anchors: shell frame history ring at `0x006d403c`, display/runtime state inside the shell block near `[this+0x114282]` and `[this+0x11428a]`, presentation service pointer at `[this+0x0c]`.
- Subsystem Handoffs: consumes world/object state for overlays and pushes deferred presentation messages back through shell queues.
- Evidence: function-map rows for shell frame history, gamma ramp, world-anchor overlay builders, and graphics runtime helpers.
- Open Questions: the exact outer frame pump is still unnamed; simulation cadence and shell presentation cadence may be separate loops that only rendezvous through shared shell state.
- Roots: the bootstrap-owned `shell_service_pump_iteration` at `0x00483f70`, the shell-state service pass `shell_state_service_active_mode_frame` at `0x00482160`, the installed global shell controller at `0x006d4024`, the pending frame-cycle owner `shell_service_frame_cycle` at `0x00520620`, and the frame-time history path under `shell_update_frame_time_history` at `0x0051fd70`.
- Trigger/Cadence: recurring bootstrap-owned shell service work once the active mode, controller window, and display runtime are live; special modal or content-building paths can also force immediate frame servicing inside that broader cadence.
- Key Dispatchers: `shell_service_pump_iteration`, `shell_state_service_active_mode_frame`, `shell_service_frame_cycle`, `shell_refresh_presentation_frame`, `shell_update_frame_time_history`, `shell_get_smoothed_frame_scalar`, `shell_set_gamma_ramp_scalar`, and overlay builders such as `shell_queue_single_world_anchor_overlay`, `shell_queue_world_anchor_overlay_list`, and `shell_queue_indexed_world_anchor_marker`.
- State Anchors: shell state at `0x006cec74`, active mode pointer `0x006cec78`, shell frame history ring at `0x006d403c`, display/runtime state inside the controller block near `[this+0x114282]` and `[this+0x11428a]`, presentation service pointer at `[this+0x0c]`, and the native controller window handle at `[this+0x00]`.
- Subsystem Handoffs: the bootstrap-owned pump runs shell-bundle polling and shell-state maintenance before the shell-state pass synchronizes active-mode helpers and modal-status work and dispatches the controller frame cycle, which then consumes world/object state for overlays and presentation refresh, uses the controller window handle for one-time `ShowWindow` and related UI interaction, and drains the deferred work queues at the end of the cycle.
- Evidence: function-map rows for `shell_service_pump_iteration`, `shell_state_service_active_mode_frame`, `shell_service_frame_cycle`, `shell_flush_deferred_work_queues`, frame history, gamma ramp, world-anchor overlay builders, and graphics runtime helpers.
- Open Questions: whether this bootstrap-owned shell pump also remains the steady-state owner for later shell modes and how simulation cadence rendezvous with the shell presentation cadence once gameplay takes over.
## Map and Scenario Content Load
@ -76,7 +76,7 @@ anchor it, and where control is handed to neighboring subsystems.
## Next Mapping Passes
- Name the first stable owner of the outer shell or presentation loop above the existing frame-history helpers.
- Determine whether `bootstrap_init_shell_window_services` and `shell_service_pump_iteration` remain the long-lived shell main loop after early shell transitions or later hand off to another outer coordinator.
- Connect the map bundle open path to the broader map/scenario load coordinator instead of only the database leaves.
- Identify the owner loop that repeatedly services multiplayer transport I/O and dispatch-store work.
- Ground the first real input ingest path and the first gameplay save/load dispatcher.