ddidderr/tdkpin
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat(reconstruction): complete binary-backed C recovery

Browse Source 
Replace the partial mechanics transcriptions with a separate, readable C11
reconstruction of the complete Win16 image while preserving the original raw
Ghidra export as immutable evidence. Cover all ordinary and overlapping entry
points, Borland runtime behavior, Win16 imports, segmented data, callbacks,
resources, indirect control flow, physics, rendering, persistence, and
startup/shutdown lifecycles.

Add deterministic extraction and audit tooling plus address-linked ledgers for
functions, imports, DGROUP ranges and objects, relocations, resources, and
callbacks. The final gate records zero raw, partial, restored, unknown,
blocked, or unclassified required units. Keep the semantic-fidelity boundary
explicit: the portable C is not claimed to reproduce a byte-identical Borland
NE build.

Add strict focused harnesses for every reconstructed C unit, exact resource
round-trip checks, and a 16-bit Borland Real48 reference probe. No Rust source
or Cargo metadata is changed in this phase.

Test Plan:
- `bash original/tools/test_reconstructed_c.sh` -- passed
- `bash original/tools/probe_real48_reference.sh` -- passed bit-for-bit
- `python3 original/tools/audit_reconstruction.py --require-complete` -- passed
- `git diff --cached --check` -- passed
- `git diff HEAD -- '*.rs' Cargo.toml Cargo.lock` -- empty
This commit is contained in:
ddidderr
2026-08-23 16:41:17 +02:00
parent aef404c834
commit 8b99e9607c
253 changed files with 79031 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
original/DECOMPILATION.md
+34 -20
View File
@@ -15,15 +15,26 @@ the output are therefore analysis-generated identifiers.
## Outputs
- `TDKPIN_GHIDRA_RAW.c`: C-like Ghidra output for every recovered in-image function.
- `TDKPIN_PHYSICS_RESTORED.c`: syntax-checked, address-linked transcription of
the fixed-point state and recovered type-1/type-2 response arithmetic.
- `FUNCTIONS.tsv`: address ledger separating in-image functions from imported APIs.
- `COVERAGE.tsv`: executable-block, instruction, function-body, and undefined-range audit.
- `TDKPIN_GHIDRA_RAW.c`: preserved initial Ghidra export; immutable evidence.
- `TDKPIN_GHIDRA_COMPLETE_RAW.c`: separate regenerated C-like Ghidra output for
every currently recovered in-image function, with Win16 import signatures applied.
- `TDKPIN_PHYSICS_RESTORED.c` and `TDKPIN_MECHANICS_RESTORED.c`: preserved
historical partial transcriptions, explicitly superseded by the complete
address-linked modules under `reconstructed/`.
- `FUNCTIONS.tsv` and `COVERAGE.tsv`: preserved inventories paired with the initial raw export.
- `COMPLETE_FUNCTIONS.tsv` and `COMPLETE_COVERAGE.tsv`: regenerated inventories
paired with `TDKPIN_GHIDRA_COMPLETE_RAW.c`.
- `BINARY_FUNCTIONS.tsv`: function extents, segments, provisional conventions, and signatures.
- `REFERENCES.tsv`, `DEFINED_DATA.tsv`, and `SYMBOLS.tsv`: reproducible call/data evidence.
- `UNEXPLAINED.tsv`: exact classification of bytes not representable by a normal
non-overlapping Ghidra code/data unit.
- `FUNCTION_RECONSTRUCTION.tsv`: semantic reconstruction status for every in-image function.
- `OBJECTS.tsv`: all 175 initialized collision/rule records, including geometry,
Real48 response values, flags, layers, scores, and render bounds.
- `tools/ExportDecompilation.java`: deterministic decompiler exporter.
- `tools/SeedMissingEntrypoints.java`: seeds one missed NE export and the NE startup entry.
- `tools/SeedMissingEntrypoints.java`: classifies compiler data and seeds missed NE/runtime entries.
- `tools/ExportProgramEvidence.java`: regenerates function metadata, references,
data, symbols, and exceptional executable-byte evidence.
- `tools/AuditCoverage.java`: regenerates the byte-coverage audit.
- `tools/decompile.sh`: runs the import, repair, export, and audit from scratch.
- `tools/dump_original_objects.py`: regenerates the initialized object ledger
@@ -32,23 +43,26 @@ the output are therefore analysis-generated identifiers.
## Accounting
- 301/301 NE exported entry points have corresponding in-image functions.
- 62 additional internal/startup functions were recovered.
- 363 in-image functions were submitted to the decompiler.
- 363 produced C-like output; none returned a decompiler failure.
- 90 additional internal/startup/runtime functions were recovered.
- 391 in-image functions were submitted to the decompiler.
- 391 produced C-like output; none returned a decompiler failure.
- 292 imported Win16 APIs are recorded separately and are not represented as fake bodies.
- 91,332/93,064 executable-segment bytes (98.14%) are instructions in recovered function bodies.
- 1,730 executable-segment bytes remain undefined. Most are islands in the runtime-heavy fifth
segment and may include embedded tables or alignment, but they have not been fully classified.
- 92,780 bytes are disassembled instructions and 282 bytes are embedded compiler data.
- 93,062/93,064 executable-segment bytes have non-overlapping Ghidra code/data units.
- The remaining two bytes are fully classified in `UNEXPLAINED.tsv`: one is the
first opcode byte of an overlapping Borland alternate entry at `1020:0666`,
and one is an alignment NOP at `1020:0dea`.
Ghidra's initial NE analysis missed export ordinal 10 at `1000:eab1` and the program entry at
`1000:fd85`. Both were verified as code from the image bytes, explicitly disassembled, and
included in the final output.
`1000:fd85`, plus 28 entries in the Borland runtime segment. Each added entry was
verified from prologue/control-flow/return bytes or a direct recovered call target
before being submitted to the decompiler.
## Fidelity boundary
`TDKPIN_GHIDRA_RAW.c` is a decompilation artifact, not recovered original source and not yet a
buildable replacement. In particular, Ghidra still emits guessed parameter lists, generic data
types, unnamed globals, and several warnings around segmented pointers, stack tracking, and one
indirect jump table. The source has not been executed against Windows 3.x or compared
differentially with the original program. Consequently, the current result establishes broad
static code coverage, not source-level semantic parity or a reproducible binary build.
`TDKPIN_GHIDRA_RAW.c` remains an immutable decompilation artifact rather than the
readable deliverable. Its guessed types and names are intentionally preserved as evidence.
The separate modules under `reconstructed/` now provide the address-linked C reconstruction;
their completeness, typed data/import/resource ledgers, strict host harnesses, and focused live
Wine comparisons are tracked in `RECONSTRUCTION_PROGRESS.md`. No claim is made that rebuilding
those portable semantic modules reproduces a byte-identical Borland NE image.