File size: 10,011 Bytes
fd99160 e639531 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 | # Native engines, libraries and DLL analysis
Date: 2026-10-11. All addresses belong to the binary SHA-256 in the corresponding image report. Inputs were read only; no image or library was loaded/executed. Full disassembly, raw headers and strings are derived Xet assets under `assets/analysis/native/`; section/import/symbol inventories and selected dispatch evidence are normal Git reports here.
## NAT-001: complete supplied image inventory — observed
| Image | Format / CPU | Symbol records | Defined function symbol records | STABS records |
| --- | --- | ---: | ---: | ---: |
| Windows dedicated | PE32 / i386 | 4,633 | 1,637 | 0 |
| Linux dedicated i386 | ELF32 / i386 | 2,336 | 1,514 | 0 |
| Linux dedicated x86_64 | ELF64 / x86_64 | 2,373 | 1,537 | 0 |
| macOS client | Mach-O64 / x86_64 | 4,844 | 2,893 | 34 |
| bundled SDL dylib | Mach-O64 / x86_64 | 6,343 | 1,014 | 4,719 |
| Windows client | PE32 / i386 | 9,225 | 3,349 | 0 |
| Linux client i386 | ELF32 / i386 | 4,951 | 2,765 | 0 |
| Linux client x86_64 | ELF64 / x86_64 | 4,991 | 2,790 | 0 |
Counts describe symbol-table records, not unique recovered functions. ELF dynamic/static tables can overlap. Mach-O STABS are excluded from function counts. Executable-section Mach-O names are candidates for function entries; aliases are not collapsed. None of these counts establishes behavior or reachability.
The script verifies all 39 original files against the snapshot and examines every one of the 9,835 extracted member prefixes independently of filename suffix. It finds the eight standalone native images above, **zero native archive member prefixes**, and zero packaged DLL filenames. Nonzero native-signature occurrences inside images are recorded and subjected to the supported structural parser: none passes. This limited signature scan cannot rule out compressed/encrypted/headerless embedded code or unrecognized formats. Signature rejection is not proof that an image has no embedded implementations.
Layouts were checked using small Python parsers and independently dumped by LLVM. The scripts distinguish file offsets, section-relative COFF values, PE RVAs and preferred virtual addresses. ELF imports come from dynamic metadata; PE dependencies and imported function names/ordinals come from descriptor/thunk tables; Mach-O records library load commands, identity/version fields, symbols and section relocations. ELF relocation counts, PE directories and Mach-O load commands are inventoried; exhaustive relocation/bind/resource interpretation remains pending. Mach-O thread/main entry decoding is also pending.
Format references are [the ELF ABI](https://gabi.xinuos.com/elf/02-eheader.html), [Microsoft PE/COFF specification](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format), and [Apple Mach-O load-command declarations](https://github.com/apple-oss-distributions/xnu/blob/main/EXTERNAL_HEADERS/mach-o/loader.h). The implemented readers intentionally support the supplied little-endian ELF32/64, PE32/64 and thin little-endian Mach-O64 layouts; additional architectures/fat images fail rather than being guessed.
## NAT-002: direct imports versus dynamic library candidates
The prior direct-import inventory is reproduced by new parsing tests for all six ELF/PE executables. Windows client imports eight external DLLs; dedicated server imports seven. They include Windows system/runtime networking, timing, input/graphics and C-library APIs, with `ole32.dll` additionally present in the client. These DLLs are **dependencies, not supplied files**. Linux clients directly depend on SDL 1.2, pthread, X11, Xxf86vm, dl, math and libc; dedicated servers directly depend on dl, math and libc. Mach-O reports preserve all framework/system library dependencies and the app-relative SDL path.
The [static SDL usage matrix](library-usage.json) identifies 42 distinct SDL imports in each Linux client and 54 in the macOS client. All 54 macOS names have matching external definitions among the bundled dylib's 201 SDL-prefixed external symbol names. APIs cover audio, events, joystick input, OpenGL setup, synchronization, threads and library loading. The macOS client's own `SDL_main` definition is not a library implementation. Static imports do not establish that every API is called at runtime. The Windows engines and dedicated Linux engines have no SDL-prefixed import/definition symbols in these tables; trace their distinct platform implementations rather than presuming SDL is universal.
String evidence also names prospective dynamic loads: Linux `libcurl.so.4`, `libGL.so.1` and game-module `%sx86_64.so`; Windows `libcurl-4.dll`, `dinput8.dll`, `dsound.dll`, `wldap32.dll` and `%sx86.dll`; macOS `libcurl.dylib`, OpenGL's library path and `%sx86_64.dylib`. Other library strings may be compiler/runtime error text or unused branches. A string is **not** a proven runtime load, dependency version, or packaged library. Trace loader call sites/search rules and exercise these paths in isolated reference sessions before establishing Rust replacements.
Native metadata and strings preserve build clues. All seven engine executables contain the 4.3.4 engine version. Both Windows COFF timestamps are `540159010` (1987), inconsistent with the observed game release; they are stored as untrusted metadata, not accepted build dates. The client resource directory declares 353,788 bytes; the dedicated server's resource directory is absent. Resource leaf decoding, TLS/init behavior and tail-data classification remain tasks.
## NAT-003: SDL 1.2.15 and debug information — observed
The bundled library's STABS source-directory records identify an SDL-1.2.15 source tree. More directly, symbol `_version` at virtual address/file offset **`0x68d00`** contains bytes **`01 02 0f`**. The `_SDL_Linked_Version` disassembly at **`0x1cb0`** loads a pointer to that exact symbol and returns. Together these establish a **static reported version of 1.2.15**; they do not establish an unmodified upstream build.
Its dylib identity is `@executable_path/libSDL-1.2.0.dylib`; the load-command current/compatibility version integers describe the dylib ABI and should not be mistaken for the SDL API version. Source/function/type STABS survive in the SDL library (4,719 records) and a small subset in the app (34). No `.debug*`/`__debug*` sections are present in these parsed images. This corrects any implication that lack of DWARF sections means lack of all debug information. Full STABS type decoding and correspondence with SDL source remain RE-017/RE-024 work.
## NAT-004: syscall tables bridge native and QVM evidence
The recognizer validates a bound check followed by an absolute eight-byte pointer-table jump in the **two Linux x86_64 images**. Every table target maps to a decoded executable instruction. It records all numeric slots, groups sharing targets and up to 24 instructions per distinct destination. Shared destinations may be default handlers or aliases; they do not establish supported unique services.
| Image / dispatcher | Entry address | Table address | Maximum slot | Distinct destinations |
| --- | --- | --- | ---: | ---: |
| Linux dedicated / game | `0x40b13c` | `0x4b0050` | 603 | 199 |
| Linux client / game | `0x4730ac` | `0x573158` | 603 | 199 |
| Linux client / cgame | `0x404838` | `0x566a38` | 111 | 100 |
| Linux client / ui | `0x4229c6` | `0x569cd8` | 108 | 101 |
Selected game cases agree at the named-function level between client and dedicated server:
| Trap | Dedicated target | Client target | Direct call evidence |
| --- | --- | --- | --- |
| 600 | `0x40d48a` | `0x4753fa` | address parsing and VM pointer conversion |
| 601 | `0x40d4b1` | `0x475421` | address parsing, VM pointer conversion, packet sending |
| 603 | `0x40d4fa` | `0x47546a` | VM pointer conversion and `SV_Auth_DropClient` |
qagame has observed constant-call sites for all three numbers. Case 603 reads two pointer arguments, checks a client index against zero and `sv_maxclients`, forms a client pointer using stride `0x2df40`, and calls the authentication drop function. The stride is an **observed field-address calculation in these binaries**, not yet a recovered whole `client_t` definition or portable Rust ABI. Error paths and precise string/result contracts remain unverified.
UI case 88 at `0x422a60` calls address parsing; case 90 at `0x422ac9` also calls packet sending. The ui module uses both numbers, which the pinned upstream UI import enum does not name. No service endpoints were contacted by analysis, and packet format/authentication semantics are not inferred from these call names.
The 100-series memory/math traps illustrate module-specific numbering: game slot 111's case calls ceiling, while cgame slot 111 calls an arccosine helper. Numeric IDs cannot be assigned a global meaning across modules. Argument widths and engine additions must be mapped per dispatcher.
## Coverage limits and next work
All eight images have complete static section/symbol and LLVM disassembly artifacts, but their functions are mostly unreviewed. ELF64 switch recovery covers four dispatchers only; i386/Windows/macOS correspondence needs separate recognizers and validation. Dynamic loads, transitive dependencies, DLL runtime behavior, resources, STABS types, full relocation/bind metadata, native CFGs and source correspondence remain open. Preserve each binary's distinct address space/hash when tracing the same named function across platforms.
Use the generated `*.symbols.jsonl` and `anchors` lists to import analysis tools and prioritize VM loading/calls, pointer validation, syscall dispatch, filesystem order and frame loops. Follow the QVM call sites into their argument layouts before writing Rust services.
## Metadata follow-up
[META-001–003](METADATA.md) recover all retained Mach-O debug-map records and paired ranges, plus Windows resource variants, string contents and a reconstructed ICO. Function implementation comparison and icon surplus interpretation remain open.
|