maddo/Crusader_Decomp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add Ghidra coverage agents and update documentation for enhanced function analysis

Browse source 
- Introduced `Ghidra Coverage Batch Director` and `Ghidra Coverage Mini` agents for improved parallel analysis and function coverage in `CRUSADER.EXE`.
- Updated `ghidra.instructions.md` to clarify documentation practices and legacy file handling.
- Added recent verified function coverage updates to `crusader_decompilation_notes.md` and `plan-mid.md` for better tracking of analysis progress.
- Included new binary files for enhanced data handling in the project.
This commit is contained in:
Marco 2026-04-15 17:16:53 +02:00
commit 328a8ba30f
11 changed files with 282 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
crusader_decompilation_notes.md
View file

@ -4,6 +4,14 @@ This file is an index. Detailed notes have been split into the `docs/` folder by
Active live analysis target is now `CRUSADER.EXE`. Existing `CRUSADER-RAW.EXE` notes remain in scope as cross-reference evidence and should be cited alongside live NE addresses when they support a rename, variable role, or behavior claim.
Recent verified NE function-coverage follow-up: a broad live MCP `CRUSADER.EXE` continuation wave pushed three caller-first `1000` buffered-I/O bundles, one `1078/1060` ItemCache relink bundle, and one `1348/1360` SpriteNode-NewGump geometry bundle. The durable rename set in this wave is `1000:5c9d = stream_count_buffered_newlines`, `1000:5d1f = buffered_stream_seek`, `1000:5e7f = fwrite_buffered`, `1078:01c8 = ItemCache_RelinkForwardLink_1078`, `1078:01f9 = ItemCache_RelinkMovedBlockLinks_1078`, `1078:023e = ItemCache_RelinkAroundMovedBlock_1078`, `1360:0b65 = sprite_tree_update_dirty_state`, and `1360:0bb2 = sprite_tree_relink_child_after_head`; the same wave also strengthened neutral evidence comments on `1000:578a`, `1000:58c8`, `1000:6c73`, `1000:5d9f`, `1000:5f0a`, `1000:5f48`, `1000:5fc0`, `1060:1c70`, `1060:0ecf`, `1348:0b39`, `1348:0c92`, `1348:0d07`, and `1348:0d81`, while confirming the already-named geometry anchors `1360:0b43 = sprite_tree_point_in_bounds` and `1360:0c00 = sprite_tree_sum_x_offset`. Starting from the prior verified `1095` unnamed baseline, these eight additional safe renames move the working coverage floor to `1087` unnamed overall. Current best next step remains caller/callee closure in the still-dense `1000` stdio/buffer family, especially the `Filespec_1238_032e` / `UProcess_1420_062f` context around `1000:58c8`, `1000:578a`, `1000:6c73`, and the still-comment-only sync helper `1000:5d9f`, with a secondary caller-first pass on the `1348` SpriteNode/NewGump wrappers now that the adjacent `1360` geometry lane is better anchored.
Recent verified NE function-coverage follow-up: a third live `CRUSADER.EXE` MCP coverage wave ran as six parallel `Ghidra Decomp Mini` passes at `4` target functions each. The durable rename set in this batch is `1000:3ce9 = vsscanf_number_parser`, `1000:3f6f = dos_apply_datetime_from_words`, `1000:3faf = dos_get_datetime_words`, `1000:5886 = refill_buffers_for_open_files`, `1000:58f3 = parse_fopen_mode_flags`, `1000:59af = open_stream_with_mode`, `1078:0000 = DList_InsertBeforeHead_1078`, `1078:00cf = DList_UnlinkNode_1078`, `1078:0106 = DList_InsertAfterNode_1078`, `1078:013c = DList_SpliceNode_1078`, `1190:0000 = rect_intersect_inplace`, `1190:01d9 = list_pop_front`, `1190:022c = list_push_back`, `1348:0000 = spritenode_invoke_0x4c`, `1348:00b5 = spritenode_invoke_0x50`, `1348:00d8 = spritenode_create_and_invoke_0x50`, `1348:0124 = spritenode_create`, `1360:02a5 = list_find_entry_by_type`, `1360:02e4 = list_find_entry_by_high_byte`, and `1360:031f = list_find_entry_by_two_byte_key`; the same wave also added neutral evidence comments at `1000:3cbe`, `1000:58c8`, `1190:01b4`, and `1360:0269`. Current best next step is caller/callee closure around the remaining `1000` stdio/buffer helpers and follow-through on the surrounding `1190`/`1348` helper families, not another broad pass over the already named list-entry and SpriteNode wrappers.
Recent verified NE function-coverage follow-up: a second live `CRUSADER.EXE` MCP coverage wave ran as six parallel `Ghidra Decomp Mini` passes with explicit quotas of `3/3/3/3/3/6` functions. The durable rename set in this batch is `1000:37ca = vsscanf_engine`, `1000:37de = advance_dest_by_char_size`, `1000:56bd = buffer_normalize_and_refill`, `11d0:15f2 = FindLinearCapableProcessForItemType`, `1078:0046 = DList_InsertAfterHead_1078`, `1078:0098 = DList_UnlinkNode_1078`, `1190:006d = rect_union_inplace`, `1190:00da = global_list_pop_head_1478_2cc3`, `1190:0112 = global_list_push_head_1478_2cc3`, `1348:0023 = spritenode_create_and_invoke_0x50`, `1348:006f = spritenode_invoke_0x50`, `1348:0092 = spritenode_invoke_0x50_alt`, `1360:00c7 = alloc_init_1360_obj`, and `1360:0113 = destroy_1360_obj`; the same batch also added neutral evidence comments on `1000:578a`, `11d0:0255`, `11d0:04cd`, `1360:0161`, `1360:017a`, `1360:01c7`, and `1360:0218`. Coverage improved from `3032/1140 unnamed` to `3032/1126 unnamed`. Current best workload rule for future GPT-5.4 mini passes is `4` functions by default, with `6` reserved for bundles dominated by small wrappers or loop/search helpers rather than deeper subsystem reasoning.
Recent verified NE function-coverage follow-up: live MCP sanity checks on active `CRUSADER.EXE` succeeded normally, and a six-`Ghidra Decomp Mini` coverage sweep plus one direct MCP edit-plan follow-up landed new evidence-backed names/comments in selectors `1000`, `10e8`, `11d0`, `1078`, `1190`, `1348`, and `1360`. The durable rename set in this batch is `1000:626f = itoa`, `1000:636e = memmove`, `10e8:00c9 = NPC_SavegameWrite`, `10e8:00f2 = NPC_SavegameRead`, `11d0:2491 = kernel_process_snapshot_writer`, and `11d0:39e6 = read_bios_keyboard_shift_cache`; smaller helpers in `1078`, `1190`, `1348`, and `1360` now also carry neutral evidence comments rather than raw placeholders. Current best next step is caller-driven closure of the still-ambiguous `1000` DOS/file-I/O wrapper cluster (`37b0..37ff`, `56bd..5825`) and the heavier `11d0` table/dispatch families, not another blind sweep over already annotated small wrappers.
Recent verified PSX CLUT override-routing follow-up: [docs/psx/art-binding-recovery.md](docs/psx/art-binding-recovery.md) now records a 2026-04-12 live MCP closure pass on `0x80041458`, `0x80041144`, `0x80044bdc`, `0x80044e9c`, `0x800a9f48`, and `0x800a9f66`. Current best read is now exporter-critical and executable-backed: main-visible injects authored high-byte palette token while special-visible does not, override selection is gated by `flags & 0xfffffff0`, active override resolution diverges by submitter/resource-format lane, and token `0` is effectively no-override in the world-object draw path.
Recent verified PSX palette/export follow-up: [docs/psx/art-binding-recovery.md](docs/psx/art-binding-recovery.md) now records the 2026-04-12 lock-in for the prior VRAM-dump `mode 1` palette proof. Current best read is now export-explicit: `mode 1` bundles should render against a shared contiguous 256-entry CLUT equivalent to live row `0xF0`, `x=0`, while the bundle header palette index stays diagnostic only as `defaultPaletteIndex`. The same follow-up also records that the processed PSX catalog already carried `62` maps, so the user-visible "single map" issue was export inclusion rather than cache enumeration.