# Running the original's renderer on a snapshot of the game

## What to know

*2026-10-24, Hardwar's `snapemu.py`, Hardwar's `render_truth.py`.*

A software renderer needs the whole loaded game to draw anything: the world's objects, the
shapes, the textures, the remap tables, the back end's tables. Building that in an emulator by
hand is not practical. A whole-process snapshot (Hardwar's `vm_snapshot.py`) already holds it
all. Mapped back into Unicorn, the game's own `flight_display` and `scene_draw` draw a frame
exactly as the game would, from the snapshot's state, and nothing but the window's sizes needs
setting. That gives an exact 8-bit reference frame (and every polygon Draw3D rasterises) for a
state the port can also load (the snapshot was taken after loading save 3).

How:

- Map every region of the snapshot at its address; the image's code is in it too (Wine maps
  the sections writable). Point the import table at stubs; stop on any import without one.
- **Give Unicorn a GDT.** Watcom code saves and restores GS (`push gs` ... `pop gs`, 0x450888).
  With no descriptor table, Unicorn's `pop gs` left the stack segment 16-bit and the next push
  wrote at `ESP & 0xffff` ("invalid access at 0xdf94"). One flat data descriptor loaded into
  DS, ES, SS, FS and GS fixes it.
- Set the x87 control word again (0x0c7f): a snapshot holds memory, not registers.
- Enter below the DirectX calls: `flight_draw` touches DirectInput and DirectDraw objects whose
  code is not in the snapshot. Build the packet with `flight_display` (0x4962cc, EAX the pilot
  from `player_pilot` 0x447d48) and call `scene_draw` (0x48cfac) with it.
- For an 8-bit frame: `0x55468c` = 0, the row table `0x55469c` over a buffer, base `0x554690`,
  pitch `0x554694`, height `0x554698`, screen size `0x5999dc`/`0x5999e0`/`0x599a28`/`0x599a2c`,
  window `0x59a160`..`0x59a16c`. A paused console leaves 640 × 400 in several of these; miss
  one and the frame stops at row 400.
- The clipper loops for ever on a polygon with no inside vertex; its callers drop those first
  (the AND of the outcodes). A random-input harness must do the same.
- A polygon's `+0x20` is a resource handle, not a material: map handles to sprites by matching
  the texture's pixels (`res_lock` 0x499acc) against the pack's `.SPR` files.

Candidate for GameFrame (a snapshot mode for pe32_emu, and the GDT pitfall).