Data Map

This appendix tracks important globals, tables, structures, virtual tables, and persistent buffers. See Runtime UI Memory Map for process-relative pointer chains, Pane tree traversal, class-specific UI fields, and safe snapshot guidance. C Structure Layouts provides packed C99 views of the same established fields without replacing the detailed offset tables below.

GameButtons content fields

These offsets are relative to the GameButtons owner found through the Screen or Event hierarchy. They connect persistent visible content to the owner even though the owner itself does not have a static root. The Runtime UI Memory Map records the full traversal and class-specific layout.

Worker queue and bounded ring layouts

The dispatcher, EventMan, and Socket begin with the same 0x68-byte worker base. These fields establish the in-process wake point and the native queue state relevant to an Event Proxy.

Each native work record is 0x18 bytes. Asynchronous posting sets the final three fields to zero.

The ring object pointed to by worker +0x54 has this established state:

Programmer-oriented layouts follow. They are documentation types, not recovered source declarations.

typedef uint32_t client_ptr32;

typedef struct worker_record_421 {
    uint32_t code;
    client_ptr32 data;
    int32_t value;
    client_ptr32 completion_event;
    client_ptr32 result_buffer;
    int32_t result_buffer_size;
} worker_record_421;

typedef struct worker_queue_base_421 {
    client_ptr32 vtable;
    uint8_t unknown_04[8];
    uint32_t wait_timeout_ms;
    uint8_t wait_handle_count;
    uint8_t unknown_11[3];
    client_ptr32 wait_handles[16];
    client_ptr32 work_queue;
    client_ptr32 completion_monitor;
    client_ptr32 completion_waiters;
    client_ptr32 worker_thread;
    uint32_t worker_thread_id;
} worker_queue_base_421;

typedef struct bounded_ring_421 {
    client_ptr32 vtable;
    uint8_t unknown_04[8];
    client_ptr32 monitor;
    client_ptr32 not_full_condition;
    client_ptr32 not_empty_condition;
    int32_t element_size;
    int32_t capacity;
    client_ptr32 buffer;
    int32_t element_count;
    int32_t head_index;
    int32_t tail_index;
} bounded_ring_421;

The Socket and EventMan constructors pass capacity 0x80; the dispatcher passes 0x400. An observer can sample element_count, but the value may change concurrently and external code should not write queue metadata. For a worker-affine proxy wake, validate the root and vtable, read wait_handles[0], and call ReleaseSemaphore without touching the native ring.

Event dispatcher fields

Offsets below are from the object stored in event_dispatcher. The earlier fields belong to its worker-queue base.

Event timer record

Event manager input fields

Offsets below are from the object stored in event_manager_instance. They are used by the window-message input queue and the EventMan worker.

Socket fields used by binary TCP

Offsets below are from the Socket object passed as this. They are established by the constructor and the mapped receive and send paths. The complete class layout is not yet named.

Socket Event fields

The Event object created for a decoded packet has these fields:

Structures should use unknown_XX for an established field location whose meaning remains unknown.