# Apache Ghidra workspace

These scripts import the recovered symbols and export annotated pseudocode for local research. They do not modify the original executable or supply code to the reconstruction.

The current workspace uses Ghidra 12.2 and Java 25. Its project is `work/ghidra/Apache`, outside hidden directories because Ghidra rejects hidden project paths. The reference program is the January 1998 Windows software `APACHE95.EXE`.

## Reproduce the setup

Run from the repository root, with Ghidra unpacked locally:

```sh
.venv/bin/python -B tools/ghidra/setup.py .tools/ghidra_12.2_PUBLIC
.tools/ghidra_12.2_PUBLIC/support/analyzeHeadless work/ghidra Apache \
  -import extracted/cd_2000_10_eu/files/FILES/SOFTWARE/APACHE95.EXE \
  -processor x86:LE:32:default -cspec watcom \
  -scriptPath tools/ghidra \
  -preScript ApacheSymbols.java .tools/ghidra-project/symbols.tsv \
  -postScript ApacheTypes.java .tools/ghidra-project/floating-data.tsv \
  -postScript ApacheStack.java \
  -postScript ApacheData.java \
  -postScript ApacheReturns.java \
  -postScript ApacheDecompile.java analysis/engine/decompiled '.*' \
  -max-cpu 4
```

For an existing project, replace `-import ... -processor ... -cspec ...` with `-process APACHE95.EXE -noanalysis` and run only the needed post-scripts. The setup script derives its compiler specification from Ghidra's stock Windows x86 specification. It modifies only that local Ghidra installation and generated import manifests.

## Calling convention and arithmetic

Watcom passes integer arguments in EAX, EDX, EBX and ECX, then on the stack. Callees preserve unused general registers. The supplied `watcall-prototype.xml` models that convention; `ApacheStack` reads each routine's actual RET cleanup rather than assigning a uniform stack rule.

Watcom's `__CHP` temporarily changes x87 rounding to truncate ST0. The call fixup must also consume the four-byte return address pushed by Ghidra's call model. Without that stack adjustment, return addresses contaminate local-variable expressions. `get_mat_` takes three stack doubles and a pointer; it has an explicit prototype. Variadic printing/scanning routines use cdecl.

The setup script finds floating-point data operands and generates 592 type annotations. Integer x87 loads are excluded. Three labels in executable sections actually name data tables: `_forces_info`, `_air_drone_characteristics` and `_patch_info`. They are excluded from function creation.

Register inference can still invent a 64-bit return where EDX is simply preserved. Verify such results, integer conversions and reassociated arithmetic against `tools/disassemble.py` and the native comparisons. The recovered debug overlay contains names and source units, not full C type information.

`ApacheReturns` clears a false non-returning annotation on `set_map_tool_none_`, removes its call-return flow overrides, and repairs the seven affected callers. This recovers the second half of briefing and debrief functions. Re-running the symbol importer after this repair also creates local functions which the earlier unreachable-code analysis omitted. The genuine abort routine remains non-returning.