# Emulating a range of code inside a big message handler

## What to know

*2026-10-24, Hardwar's `flight.py`.*

VhSlotControl (`0x47b1e0`) is one 12.9 KB function with a `0x1f0`-byte frame; the flight
step is a stretch of its `0x104` case, not a function. GameFrame's `pe32_emu.call` sets ESP
just under its stack top, so `[ESP+0x1ec]` lies past the mapped stack and the run fails.

What works: allocate a block on the emulator's heap, point ESP into the middle of it, write
the handler's frame words the range reads (here `+0x1ec` the slot index, `+0x1c8` a pointer
to `dt_ms`, `+0x1bc` the slot's user area), set the registers the range expects (`EBP` the
vehicle, `EDI` a pointer to `dt_fix`) and run `uc.emu_start(start, end)`. Calls inside the
range push below ESP, inside the block. Read which frame words a range uses with a grep for
`esp +` over its disassembly first.

A routine with side effects outside the state under test (here the event routine `0x432328`,
sound and HUD) can be made a `RET` by writing `0xc3` over its first byte and hooking the
address to record EAX: `uc.hook_add(UC_HOOK_CODE, fn, begin=addr, end=addr)`.

Linear disassembly of the whole code section (`objdump -d` on a copy of the EXE with the
sections' virtual sizes set to their raw sizes and the data directories cleared) desyncs at
jump tables, such as the ten words at `0x47b1b8`, but resynchronises within a few
instructions; check a function's first instruction by address before reading it.