Executables and surviving symbols

The January 1998 Windows software and 3dfx executables retain appended ELF/DWARF debug information. The June 1998 Voodoo2 executable retains it too. The PE debug directory is empty, so inspecting that directory alone misses the symbols.

The final sixteen bytes contain a TIS\0 marker and the total overlay size. Subtracting that size from the file length locates a 32-bit little-endian ELF image. Its .debug_info and .debug_abbrev sections contain compilation units, global labels and variables. They do not contain source text, line tables or full C types.

The paths distinguish Apache code, such as E:\apache\source\models\model.c, from Digital Integration's shared libraries under E:\library\. The names cover the flight models, weapons, avionics, menus, terrain renderer, object renderer, sound, networking, configuration and war simulation. Watcom runtime names identify the compiler family.

Symbol addresses are relative to the first PE section, at 0x401000 in the software build. They are not relative to the PE image base at 0x400000. Disassembly and original execution have verified this distinction.

The abbreviation section lacks its final zero table terminator. Our reader stays within its declared length. An independent pyelftools check, with that terminator supplied in an in-memory copy of the debug section, agrees on all 18,544 symbol records across the three builds. The source executables remain unchanged.

Working tools

tools/executable.py reads the debug overlays and inventories all engine builds. tools/disassemble.py produces named x86 listings with source paths, call targets and string references. Duplicate static names can be selected with --source.

tools/native.py maps the original Windows executable into Unicorn. Selected routines run with explicit hooks for host services such as file reads and allocation. This is an analysis instrument, not a component of the C++ game.

Current native comparisons cover model and texture relocation, model packet sizes, drawing-program control flow, attached model construction, grid coordinates and all 242 IFF images. The image comparison checks dimensions, indexed pixels and palette bytes, covering 57,344,504 pixels.

The DOS engine has been installed from the chosen disc in installs/cd_2000_10_eu/drive_c/DI/APACHE. DOSBox 0.74-3 crashes during its startup on this host. DOSBox Staging 0.75 runs the menus and flight mode; reference screenshots and private-session input automation are working. All input runs on an isolated X server.

Evidence

• executables/index.json: executable hashes, source paths and available symbols.
• executables/*.symbols.json: recovered source units and symbol records.
• executables/independent-debug-check.json: independent DWARF comparison.
• models/native-*-check.json: model loader, interpreter and construction comparisons.
• media-art/native-image-check.json: original image-loader comparison.

The October 2000 European disc is the primary data source. The shared files on the September 1998 disc are identical. Earlier engines and the June 1998 Voodoo2 patch remain separate comparison subjects.

Decompiler workspace

The local Ghidra setup records the Watcom register convention, recovered stack cleanup, x87 data types and truncation helper fixup. The original instruction comparisons remain the final check on decompiler expressions and inferred types.

Engine revisions

The instruction and execution comparison maps routines in all three 1996 Windows builds, separates compiler rearrangements from data-layout changes, and records their relationship to the selected software and 3dfx engines.