# Wreckless: The Yakuza Missions — Static Recompilation

A static recompilation of the original Xbox game **Wreckless: The Yakuza
Missions** (Bunkasha / Activision, 2002; internal codename **DSTEAL** /
*Double Steal*) into a native Windows executable.

The game's original x86 machine code is translated into portable C, which is
then compiled to a native x86-64 binary. There is no emulation at runtime — the
game's own logic executes directly on your CPU.

Built with **[xboxrecomp](https://github.com/sp00nznet/xboxrecomp)**. This
repository is the per-title work: the toolkit is a dependency, not a copy.

**[Join the sp00nznet recomp Discord](https://discord.gg/CRpzGWZFcu)** — the
community hub for sp00nznet's recomp projects. Good place to ask questions, show
a port you are working on, or find out what people are stuck on before you
duplicate the effort.

> **You must provide your own copy of the game.** No game code or assets are
> included here, and none are distributed.

## Status

Boots, starts its game thread, and runs initialisation. Not yet rendering.

| Phase | Status | Details |
|-------|--------|---------|
| XBE parsing | Done | 11 sections, 113 kernel imports |
| Disassembly | Done | 3,470 functions |
| Function ID | Done | 9 CRT, 1 SEH prolog/epilog pair; custom engine |
| ABI recovery | Done | 3,464 entries (94 thiscall) |
| Recompilation | Done | 468,799 lines of C, 0 failed, 20 stubs |
| Kernel layer | Done | 113/113 resolved (68 bridged, 45 stub) |
| Build | Done | `bin/wreckless.exe` |
| Boot | Done | 15 kernel calls, no crash; exits via `HalReturnToFirmware` |
| Graphics (D3D8→D3D11) | Scaffolded | Toolkit layer, not yet exercised |
| Audio (DSound→XAudio2) | Scaffolded | Toolkit layer, not yet exercised |
| Input (XPP→XInput) | Scaffolded | Toolkit layer, not yet exercised |
| Gameplay | Not started | |

### Where it stops

```
PsCreateSystemThreadEx  routine=0x000E8A42 ctx1=0x000EB50F
RtlInitializeCriticalSection, KeInitializeEvent x2
[ICALL] Failed to resolve VA 0x000F0418        <-- the current blocker
NtOpenSymbolicLinkObject  \Device\Harddisk0\partition1\
MmAllocateContiguousMemory  4096 bytes
HalReturnToFirmware  routine=2 - title is exiting
```

The unresolved indirect call is to `0x000F0418`, which is **inside**
`sub_000F02C0` (0xF02C0–0xF04AB). It is therefore a mid-function target, not a
function start, and must **not** be added to `seed_functions.json`: seeding an
address that is not a function start truncates the function containing it. It
needs handling as an in-function label instead. That is the next piece of work.

## Building

### Prerequisites

- Windows with **Visual Studio 2022** (MSVC) and **CMake 3.20+**
- **Python 3.10+** with `capstone`
- A checkout of [xboxrecomp](https://github.com/sp00nznet/xboxrecomp) beside
  this one (`../xboxrecomp`), or set `-DXBOXRECOMP_DIR=<path>`
- Your own `default.xbe`, in `game/Wreckless - The Yakuza Missions/`

### Regenerate and build

```bash
./regen.sh                                   # XBE -> C, via the toolkit
cmake -S . -B build/cmake
cmake --build build/cmake --config Release
./bin/wreckless.exe
```

`regen.sh` runs disassembly, XDK naming, function identification, ABI recovery
and lifting in the one order that works — see the comments in it. Re-run CMake
after a regeneration that changes the number of generated `.c` files, since the
source list is globbed at configure time.

### seed_functions.json

Two entry points are seeded because nothing in `.text` calls them, so the
detector cannot find them:

| Address | Why |
|---------|-----|
| `0x000E8A42` | Thread start routine, handed to `PsCreateSystemThreadEx`. Without it the game thread never starts and the process exits cleanly having done nothing — which reads as success. |
| `0x000EB50F` | The thread's real entry, passed as `ctx1` and reached through the indirect call inside the shim above. |

Add seeds **one at a time and verify each**. An address that is not a function
start truncates the function containing it, and the damage is not obvious.

## XBE analysis

| Property | Value |
|----------|-------|
| Title | Wreckless: The Yakuza Missions |
| Title ID | 0x4156000A |
| Base address | 0x00010000 |
| Entry point | 0x000EB57E |
| Code size | ~947 KB (.text) |
| Sections | 11 |
| Kernel imports | 113 |

```
0x00011000 - 0x000F8760  .text     (947 KB)   Game code
0x000F8760 - 0x0010A068  D3D       (73 KB)    Direct3D library
0x0010A080 - 0x00126CD0  D3DX      (115 KB)   D3DX extensions
0x00126CE0 - 0x00128E0C  XGRPH     (8 KB)     Xbox graphics
0x00128E20 - 0x00132494  DSOUND    (38 KB)    DirectSound
0x001324A0 - 0x001477F0  WMVDEC    (85 KB)    WMV video decoder
0x00147800 - 0x0014EF1C  XPP       (30 KB)    Xbox Platform Plugin
0x0014EF20 - 0x00154FF4  .rdata    (24 KB)    Constants
0x00155000 - 0x001D1E0C  .data     (500 KB)   Data + BSS
0x001D1E20 - 0x001D8BB8  DOLBY     (27 KB)    Dolby audio
0x001D8BC0 - 0x001DB3C0  $$XTIMAGE (10 KB)    Title image
```

## Technical notes

- **Custom engine**, not RenderWare, so function identification is harder than
  on the RenderWare titles and less carries over from them.
- Heavy use of XDK libraries (D3D, D3DX, DSOUND, WMVDEC) in their own PE
  sections, which at least isolates game-specific code cleanly.
- `__SEH_prolog` / `__SEH_epilog` sit at `0x000F0954` / `0x000F098D`. These used
  to be hardcoded here; the toolkit now detects them per title by signature and
  independently finds the same pair.
- The thread entry wrapper at `0x000E8A42` copies init data and calls the game's
  main through a context pointer — hence both seeds above.
- Regional XBE variants exist (US, UK, FR, GR, JP). The JP/FR/GR builds are
  larger (~1.9 MB vs ~1.4 MB), suggesting extra content.

## Relationship to xboxrecomp

This project used to carry its own copy of the toolkit and of all four runtime
libraries. They were never a fork — the copies were byte-identical to another
project's, and the only local change anywhere was a hardcoded pair of SEH
addresses. They were simply the toolkit frozen on the day this project was
scaffolded.

It now builds against `../xboxrecomp` directly, so a fix made there arrives
here. Bringing it across found two bugs in the toolkit itself, both since
fixed upstream: stale generated chunk files that were never cleaned up, and a
template that declared the guest registers without `RECOMP_TLS` after the
runtime made them thread-local.

## License

**MIT** — see [LICENSE](LICENSE).

That covers this repository's own code: the runtime scaffold, the build, and the
project-specific glue. It does **not** cover the game. No game code, data or
assets are included here, and the recompiled output is derived from a copy you
must supply yourself.

The toolkit is licensed separately — see
[xboxrecomp's LICENSE and NOTICE](https://github.com/sp00nznet/xboxrecomp).
Some of its components are LGPL-2.1 (the MCPX APU sources and the NV2A register
definitions, extracted from [xemu](https://github.com/xemu-project/xemu)); this
project links only the MIT-licensed ones (`xbox_kernel`, `xbox_d3d8`,
`xbox_dsound`, `xbox_input`) and has never contained any xemu-derived code.