Files

T

docs(reverse): transcribe the fixed-point physics core

Add a standalone, syntax-checked C transcription of the recovered ball state,
10 ms substep, launcher repeat/release arithmetic, one-sided type-2 response,
swept type-1 response, and previous-position contact application. Link the
source to the authoritative raw function addresses and initialized object
ledger.

Keep unresolved persistent-contact and special-rule branches in the raw Ghidra
artifact rather than filling the readable reference with guesses.

Test Plan:
- strict C11 `clang -Wall -Wextra -Werror -fsyntax-only` -- passed
- `git diff --cached --check` -- passed

2026-08-22 21:29:41 +02:00

3.0 KiB

Raw Blame History

TDKPIN.EXE decompilation

Target

File: TDKPIN.EXE
SHA-256: a9022f1894e3e6e21fc42e8f6c932f7c549ca77f63aaa0c488bb9d55d9d0174c
Format: Windows 3.x New Executable (NE), 16-bit protected-mode x86
NE entry point: segment 1, offset fd85 (Ghidra address 1000:fd85)
Image: five executable segments, one data segment, and 63 resource blocks
Companion import: MMTIMER.DLL

The executable contains a Borland runtime copyright string, but it does not retain useful original function or variable names. The FUN_... and DAT_... names in the output are therefore analysis-generated identifiers.

Outputs

TDKPIN_GHIDRA_RAW.c: C-like Ghidra output for every recovered in-image function.
TDKPIN_PHYSICS_RESTORED.c: syntax-checked, address-linked transcription of the fixed-point state and recovered type-1/type-2 response arithmetic.
FUNCTIONS.tsv: address ledger separating in-image functions from imported APIs.
COVERAGE.tsv: executable-block, instruction, function-body, and undefined-range audit.
OBJECTS.tsv: all 175 initialized collision/rule records, including geometry, Real48 response values, flags, layers, scores, and render bounds.
tools/ExportDecompilation.java: deterministic decompiler exporter.
tools/SeedMissingEntrypoints.java: seeds one missed NE export and the NE startup entry.
tools/AuditCoverage.java: regenerates the byte-coverage audit.
tools/decompile.sh: runs the import, repair, export, and audit from scratch.
tools/dump_original_objects.py: regenerates the initialized object ledger from a traceable Wine process without patching the executable.

Accounting

301/301 NE exported entry points have corresponding in-image functions.
62 additional internal/startup functions were recovered.
363 in-image functions were submitted to the decompiler.
363 produced C-like output; none returned a decompiler failure.
292 imported Win16 APIs are recorded separately and are not represented as fake bodies.
91,332/93,064 executable-segment bytes (98.14%) are instructions in recovered function bodies.
1,730 executable-segment bytes remain undefined. Most are islands in the runtime-heavy fifth segment and may include embedded tables or alignment, but they have not been fully classified.

Ghidra's initial NE analysis missed export ordinal 10 at 1000:eab1 and the program entry at 1000:fd85. Both were verified as code from the image bytes, explicitly disassembled, and included in the final output.

Fidelity boundary

TDKPIN_GHIDRA_RAW.c is a decompilation artifact, not recovered original source and not yet a buildable replacement. In particular, Ghidra still emits guessed parameter lists, generic data types, unnamed globals, and several warnings around segmented pointers, stack tracking, and one indirect jump table. The source has not been executed against Windows 3.x or compared differentially with the original program. Consequently, the current result establishes broad static code coverage, not source-level semantic parity or a reproducible binary build.

3.0 KiB Raw Blame History