Wolfenstein Modloader Buy me a coffeeKaffee spendieren

Wiki / Research briefsForschungsaufträge

Research brief: Cvartable

OpenOffen Original page in the GitHub wikiOriginalseite im GitHub-Wiki

In plain wordsIn einfachen Worten

Task description for rebuilding the list of console variables (cvars) of Wolfenstein II (TNC). The existing list of 2,231 entries shown in the mod tool was known to be too large and partly mislabeled. The worker should read a memory image of the running game and deliver a true list with flags, default values, descriptions and which cvars are locked in the retail version.

  • The game itself listed only 8 cvars for 'g_' and none for 'bot_'.
  • Two methods, a code scan and a list walk, must agree with each other.
  • Every cvar from the game's own output must appear with the same description.
  • A deliberately wrong starting address must produce nothing, not a plausible-looking table.
  • Contradictions with cvars measured as locked must be reported, not hidden.

Aufgabenbeschreibung für den Neuaufbau der Liste der Konsolenvariablen (Cvars) von Wolfenstein II (TNC). Die vorhandene Liste mit 2.231 Einträgen, die das Mod-Werkzeug anzeigt, war bekanntermaßen zu groß und teils falsch beschriftet. Der Worker soll ein Speicherabbild des laufenden Spiels lesen und eine echte Liste liefern, mit Flags, Standardwerten, Beschreibungen und der Angabe, welche Cvars in der Verkaufsversion gesperrt sind.

  • Das Spiel selbst listete für „g_“ nur 8 Cvars und für „bot_“ gar keine.
  • Zwei Methoden, ein Code-Scan und ein Listendurchlauf, müssen übereinstimmen.
  • Jede Cvar aus der eigenen Ausgabe des Spiels muss mit derselben Beschreibung auftauchen.
  • Eine absichtlich falsche Startadresse darf nichts liefern, keine plausibel wirkende Tabelle.
  • Widersprüche zu als gesperrt gemessenen Cvars müssen gemeldet, nicht geglättet werden.

Technical detailsTechnische Details

Der technische Teil ist auf Englisch – so, wie er im Wiki steht. Unterstrichene Begriffe haben eine Erklärung auf Deutsch.

Worker w-cvartable-a1; task cvartable2; research (read-only RE). Read .agent-cache/WORKER.md. Bus: python "%USERPROFILE%/.claude/skills/agent-cache-orchestrator/scripts/acbus.py" Parallel: w-texdbkey-a1 reads the same image read-only. Stay in your lane.

Objective

Rebuild the Wolfenstein II cvar catalogue from the unpacked runtime image, the way w-cmdtable-a1 rebuilt the command table today.

This fixes a shipped artifact, not just a research question. docs/stand.md records two admissions about the current data:

  • docs/cvars_tnc.json with 2231 entries "is too high". The engine itself answers listCvars - help g_ with EIGHT cvars and bot_ with "0 cvars listed". Most mined names are not registered cvars at all. The file is a candidate list being presented as a catalogue.
  • Its descriptions are partly attached to the wrong cvar. Measured example: com_assertNoDialog is "bypass the popup assert dialog" per the engine, while the file carried another cvar's text.

The loader GUI shows this data to the user. So the deliverable is a catalogue that is true.

Answer:

  1. The list of actually registered cvars, with flags, default value, type and the engine's own description string where one exists.
  2. Which of them are locked in retail, derived from the flags - and how that compares to the measured RETAIL_BLOCKED list in wolfsdk/cvars.py.
  3. A drop-in replacement dataset plus a diff against docs/cvars_tnc.json saying how many of the 2231 are real, how many are phantoms, how many descriptions were misattached.

Sources / starting points

  • re_probes/runtime_87400/module.bin - read-only capture of the RUNNING, SteamStub-unpacked NewColossus_x64vk.exe. Virtual RVA layout: file offset == RVA. Sections/base in manifest.json, .pdata for function bounds.
  • tools/probe_cmdtable.py is your template, read it first. The cvar system sits next to the command system in this engine and yields to the same two attacks: registration call sites in .text, plus a registrar/linked-list walk in .data, cross-checked against each other. re_probes/agent_reports/cmdtable.md documents the pattern, including the anchor check that makes the data walk refuse a wrong offset. Reuse the approach; do not import its files. Useful adjacent facts from it: the command system object is at RVA 0x4104420, AddCommand at 0x1264840, and flags are compile-time constants at the call site.
  • capstone 5.0.7 vendored: PYTHONPATH=re_probes/python_deps python ...
  • Ground truth for the positive control - this is the valuable part, use it: docs/cvars_tnc_echt.json holds the subset that came from the engine itself via listCvars - help. Anything in there must appear in your table with the same description. docs/cvars-tnc-vergleich.md and docs/cvars_tnc_tabelle.json show the earlier merge attempts and where they went wrong.
  • wolfsdk/cvars.py (read-only) holds the measured RETAIL_BLOCKED list and the ALWAYS list - both came from real launches, so they are evidence.
  • tools/cvar_table.py and tools/mine_cvars_tnc.py are the earlier static attempts against the PACKED exe - read them to see what failed and why, do not extend them.

Ownership

tools/probe_cvartable.py (new), re_probes/cvartable/ (new dir, including the proposed replacement dataset as cvars_tnc_v2.json), and re_probes/agent_reports/cvartable.md (new). Do NOT write docs/cvars_tnc.json or any other docs/ file - propose the replacement in your own directory and let a master merge it.

Forbidden / do not touch

No game launch, no process attach, no writes under the Steam install or "%USERPROFILE%/Saved Games". Do not touch other workers' files: tools/probe_cmdtable.py, tools/probe_idclhash.py, tools/probe_datahash.py, tools/probe_saveverify.py, tools/probe_texdbkey.py, tools/tnc_.py, tools/vtpixel.py, re_probes/{cmdtable,idclhash,datahash,saveverify,texdbkey,vtrest}/, docs/, wolfsdk/*, config.json. No pip install.

Hard constraints

Python 3.11, stdlib plus vendored capstone. Reproducible from the command line, no running game required.

Acceptance criteria

  • Every cvar in docs/cvars_tnc_echt.json appears in your table, with a matching description. If one does not, your enumeration is incomplete - say so and fix it rather than shipping a partial list as complete.
  • The count must be plausible against the engine's own behaviour: `listCvars
    • help g_returned 8. If your table claims hundreds ofg_` cvars, something is wrong and you must explain it before proceeding.
  • Cross-check: the call-site scan and the data walk must agree. Report the diff if they do not - the diff is a finding.
  • Negative control: a deliberately wrong section base or anchor must make the walk refuse or return nothing, never a plausible-looking table.
  • The flag decoding must be checked against the measured locked/working cvars in wolfsdk/cvars.py. If the flags say a cvar is free but a real launch measured it as reset, that contradiction is important - report it, do not smooth it over.

Verification expectations

Every important assurance needs a check that fails if it is false. A string that looks like a cvar name in .rdata is NOT a registered cvar - that mistake is exactly what produced the 2231-entry file. Keep "name present in the binary", "registered at runtime" and "settable in retail" strictly apart.

Failure honesty

If the registration layout does not yield, report the obstacle with offsets. Partial but honest beats complete but invented - the current file is what "complete but invented" looks like and it is the thing being replaced.

Coordination / deliverable

Checkpoint at milestones. Publish a bus fact with the headline count (real vs phantom). Concise German report in re_probes/agent_reports/cvartable.md. Finish the bus task when done.