decomp DBCServer_Release and inspect/document database

decomp/MessageServer_Release_x64/evidence.md

@@ -0,0 +1,82 @@
+# MessageServer_Release_x64.exe — finding ledger
+
+- SHA-256 `7911b15c4379625eaa12ff227708aa3a033bc6ac2cf6b34283136e3a62df25f1`, 1,850,368 bytes
+- PE32+ x86-64, Windows CUI, MSVC linker 10.0 (VS2010), timestamp 2013-02-06 09:50:56 UTC
+- PDB reference `c:\work\Project\Output\exe\MessageServer_Release_x64.pdb` (GUID cde07e33-d76f-49e7-887c-43afecaef251, age 1) — PDB not available
+- Imports: WS2_32, MSWSOCK, WINMM, KERNEL32, USER32, ADVAPI32, OLEAUT32, MSVCP100, RPCRT4, MSVCR100, BugTrapU-x64, ole32, dbghelp
+- Ghidra 12.1.2 via REA 6.5.0: 7,728 procedures, 1,803 defined strings (`ev_3112fedf…`)
+- Full Evidence: `evidence-bundle.json` (18 records). Static analysis only — nothing observed at runtime.
+
+## Status: first pass (RMI protocol surface). Startup, config parsing, DBC link not yet decompiled.
+
+## Language: C++ (MSVC 2010) — confirmed
+180 RTTI descriptors (`.?AV…`), `__CxxFrameHandler3`, MSVCP100 import.
+
+## Third-party libraries (all already documented in `third-party/README.md`)
+| Library | Signal in this binary |
+|---|---|
+| ProudNet (static) | 51 `Proud::` RTTI classes (`CNetServerImpl`, `CNetClientImpl`, …), assert strings |
+| TinyXML 2.5.x (static) | `TiXml*` RTTI; error table incl. `Memory allocation failed.` (removed in 2.6) |
+| BugTrap | `BugTrapU-x64.dll` import, `BT_SetAppVersion`, `BT_SetSupportEMail` |
+| dbghelp | import |
+| ATL | `CAtlException` RTTI |
+No new library found.
+
+## Outputs
+| Path | Content |
+|---|---|
+| `full/functions/<addr>.c`, `full/index.tsv` | Ghidra headless pseudocode for 7,370 functions (2 failed: `0x14000cfa0` overlapping varnodes, `0x140039f20` timeout) |
+| `full/vtables.tsv` | 2,624 RTTI vftable slots |
+| `<addr>.pseudo.c` | Copies of the analysed functions below |
+
+## Findings
+
+| # | Conclusion | Type | Evidence |
+|---|---|---|---|
+| 1 | Server-to-server chat/notice relay. RTTI classes: `RNP::Servers2MsgStub` (inbound), `RNP::Msg2ServersProxy` (outbound), `MagiMsgNetwork`/`MagiMsgServer` app classes | Observed (RTTI); role is inference | `full/vtables.tsv` |
+| 2 | `Servers2MsgStub::ProcessReceivedMessage` (`0x140011930`) dispatches 8 RMI IDs 0x3a99–0x3aa0 (table below) | Observed | `0x140011930.pseudo.c`, `ev_1d95f4cc…` |
+| 3 | Handlers are overridden in `MagiMsgNetwork` vftable `0x14015a9e8` slots 7–14 | Observed | `full/vtables.tsv` |
+| 4 | Whisper / all-chat / enchant notice / mail notify / unique-item notice / channel chat: collect **every** connected host ID from the host list (`this+0xc0`, lock `this+0x110`) and forward via the proxy — i.e. broadcast to all connected servers; target filtering is left to receivers | Observed (code); "receivers filter" is **inference** | `0x140007480.pseudo.c`, `0x1400075d0.pseudo.c`, `ev_f3d6252d…`, `ev_227d432a…` |
+| 5 | Guild chat: same broadcast but **excludes the sending host** | Observed | `0x140007340.pseudo.c`, `0x1400078e0.pseudo.c` |
+| 6 | Whisper ACK: unicast — looks up a key from the payload in a hash table (`this+0xb0`, bucket count `this+0xd0`) and forwards only if found | Observed; meaning of the key (server ID vs. char ID) **unknown** | `0x140007770.pseudo.c` |
+| 7 | Each handler logs/profiles via `FUN_1400486e0(name, …)` with `timeGetTime()` | Observed call; purpose **inference** | handlers |
+| 8 | Also links to DBC (`Servers2DbcProxy` 512 slots, `Dbc2ServersStub`, `MGDBCMsgSession`) and to Agent (`Agent2ServerStub`, `Server2AgentProxy`, `MGSAgentSession`) | Observed (RTTI) | `full/vtables.tsv` |
+| 9 | Config files referenced: `option\agent.xml`, `option\customoption.xml`, `option\patch.xml`, `option\service_control.xml` | Observed (strings); which are read **unknown** | strings |
+
+### RMI table (Servers2Msg)
+| RMI ID | Name | Handler | Routing | Proxy vfn offset |
+|---|---|---|---|---|
+| 0x3a99 | REQ_MSG_WHISPER | `0x1400075d0` | all hosts | +0x28 |
+| 0x3a9a | REQ_MSG_WHISPER_ACK | `0x140007770` | lookup → one host | +0x40 |
+| 0x3a9b | REQ_MSG_GUILD_CHATTING | `0x1400078e0` | all except sender | +0x48 |
+| 0x3a9c | REQ_MSG_ALL_CHATTING | `0x140007a30` | all hosts | +0x58 |
+| 0x3a9d | REQ_MSG_ALL_ENCHANT_NOTICE | `0x140007b80` | all hosts | +0x68 |
+| 0x3a9e | REQ_MSG_NEW_MAIL_NOTIFY | `0x140007dd0` | all hosts | +0x78 |
+| 0x3a9f | REQ_MSG_ALL_UNIQUE_ITEM_GET_NOTICE | `0x140007ca0` | all hosts | +0xa8 |
+| 0x3aa0 | REQ_MSG_CHANNEL_CHATTING | `0x140007ed0` | all hosts | +0xb8 |
+
+## Config, startup and DBC (second pass)
+Shared framework findings are written up in `docs/SHARED_FRAMEWORK.md`. The
+MessageServer-specific points are:
+
+| # | Conclusion | Type | Evidence |
+|---|---|---|---|
+| 10 | Startup (`0x140004f00`) runs these steps in order: AGENT, DB_LOAD (4 DBC session pools: GAME/LOG/CHAT/EMERGENCY), SESSION_CONNECT, SERVER_RUN. The main loop pumps `DBCSessionManager` and `AgentSession`, and retries failed connects | Observed | `full/functions/0x140004f00.c` |
+| 11 | Its default config file is `option\msg_serveroption.xml`. If `argv[1]` is numeric it runs in agent mode | Observed | `0x14012e5c0`, `0x14005c7b0` |
+| 12 | The option loader parses peers agentmanager, db_cache, db_log_cache, msg/gm/auction/manager/match/agent_server and api. It ignores gate/dungeon/pvp/guild/lobby | Observed | `0x14005dc20` |
+| 13 | The Dbc2Servers dispatcher `0x140039f20` failed to decompile (timeout) | Observed | `full/index.tsv` |
+| 14 | `0x140007480`/`0x140007340` iterate the host list at `+0xc0`. Where hosts are added to that list remains **unknown** | Open | |
+
+## Proposed names (not applied)
+| Address | Name |
+|---|---|
+| `0x140011930` | `Servers2MsgStub::ProcessReceivedMessage` |
+| `0x140007480` | `MagiMsgNetwork::CollectAllHosts` |
+| `0x140007340` | `MagiMsgNetwork::CollectAllHostsExcept` |
+| `0x1400075d0`…`0x140007ed0` | `MagiMsgNetwork::On<RMI name>` per table |
+
+## Open questions
+- Where host IDs are inserted into `this+0xc0` list and `this+0xb0` map (connect handlers / registration RMI).
+- What `dbc_chat` / `Servers2DbcProxy` is used for (chat logging?).
+- Startup/main loop, config parsing.
+- Payload layouts of each RMI (proxy marshalling functions `0x140010290`…`0x140011590`).