Emulating game rules on a world built by hand

What to know

2026-10-24, Hardwar's pilots_truth.py (pilots and Police).

The Police and plan routines take pointers to pilot and building records and read a dozen globals. They can be run on their own under pe32.py without loading a game:

• Records at known addresses. Map one region, put pilot i at base + i × 0x400 and the null record at index 15, and point the globals at them (the null-pilot and null-building copies 0x582138/0x595ad8 and 0x582134/0x595ad4, the faction HQs 0x585a7c to 0x585a8c, the building list 0x58214c, the limbo building 0x582150 with its installed flag 0x582148). Writing results back as indices (pilot 0x1000 + i, building 0x2000 + j) makes them comparable with a port that uses indices.
• Stub callees with a code hook. A hook on the callee's first instruction records its registers, sets EAX, pops the return address into EIP. For a callee that ends in RET n, move the return address up by n bytes first (VhGetPower 0x47f00c takes one stack word).
• Stack arguments. Watcom passes four registers (EAX, EDX, EBX, ECX) and the rest on the stack, cleared by the callee: write them above the return address before Emu32.call.
• Map tables by running the code. Rather than reading a binary-search switch, call the routine for every value: PilPlanName 0x4652c8 for each plan type gives the names, and the plan executor 0x45e2e8 with a hook on the DoPc range gives which action each type runs.
• Stack garbage in records. Some routines build a 24-byte plan on the stack and fill only the words they use; the rest is whatever the stack held, so fill the stack with a marker before the call and leave those words out of the comparison (and mark the port's choice Deviation:).

Ghidra's decompiler drops most register arguments of these routines (it shows them as placeholders named after the registers), so read them as machine code: capstone over the image, restarting after any byte it cannot decode, gives a whole-program listing in a few seconds.