UI, Input, and Packet Flows

This page connects visible in-game UI behavior to the internal Event system and the client and server packet actions that drive it. The most important distinction is ownership. Some panes are persistent and are only shown or hidden. Some are allocated in response to a server packet. Bulletin and mail use a longer-lived session object that repeatedly replaces its active child dialog.

The packet action byte is the first byte of the decoded logical packet. Packet offsets in this page are relative to that action byte unless stated otherwise.

High-level operation

End-to-end architecture

flowchart LR
    win["Win32 mouse and key messages"] --> queue["EventMan input queue"]
    queue --> input["Pane Event types 0 through 8"]
    input --> local["Pane mouse and key handlers"]
    local --> transition["Create, show, hide, or remove pane"]
    local --> builder["Client packet builder"]
    builder --> send["net_c_queue_send"]
    send --> encode["Sequence, XOR, and TCP frame"]
    encode --> server["Game server"]

    server --> tcp["TCP frame receive and XOR decode"]
    tcp --> socket["Pane socket Event type 9"]
    socket --> map["MapPane and registered child handlers"]
    map --> parser["Server-action parser"]
    parser --> transition
    parser --> state["Persistent pane or dialog fields"]
    state --> transition

    timer["Pane timers"] --> delay["Spell delay controller"]
    delay --> builder

Win32 messages do not call game panes directly. win_main_window_proc queues input in EventMan. The event worker converts it to internal Events, and the dispatcher calls the relevant pane virtual handler. Client packet builders then submit logical packets to net_c_queue_send.

The reverse path begins when the Socket worker completes and decodes a frame. EventMan creates Event type 9 and traverses the registered pane hierarchy. MapPane owns most in-game server actions, while persistent child panes such as the equipment, skill, and spell panes claim the actions that update their own state.

Pane transition models

Server actions that affect UI

No established server action directly selects the persistent A/S/D/F/G content pane. Server status, skill, spell, and equipment actions update those panes even while another content pane is visible.

Client actions that affect UI or packets

Bulletin and mail child replacement

The session owns a ten-entry dialog history array beginning at session +0xF8, the current index at +0xF5, and the active child at +0x120. Each successful response constructs a new dialog, detaches or queues deletion of superseded children, stores the new child in the history, sets the child’s back-pointer to the session, and invokes the child’s class-specific build/register virtual.

Article-list and mail-list responses are accepted only while the session’s request-wait flag at +0x124 is set. This prevents an unsolicited list response from replacing the active child.

Spell-delay sequence

The spell slot builds the final action before the delay begins. The delay controller copies that logical packet into its own buffer and records its length, so the final timer callback does not reconstruct the cast.

sequenceDiagram
    participant Input as Spell slot input
    participant Delay as Spell delay controller
    participant Queue as Client send queue
    participant Server as Server

    Input->>Delay: Hold packet 0x0F, slot
    alt delay is zero
        Delay->>Queue: Queue held 0x0F packet
    else delay is positive
        Delay->>Queue: CSpellDelayRequest 0x4D, seconds
        loop once per second
            Delay->>Queue: CSpellDelaySay 0x4E, configured phrase
            Delay->>Delay: Schedule next 1000 ms timer
        end
        Delay->>Queue: Queue held 0x0F packet
    end
    Queue->>Server: Sequence, XOR, and frame each logical packet

The phrases are loaded from SpellBook.cfg and matched against the current spell name. A runtime packet hook that only watches the initial mouse event will therefore miss the later timer-owned final send.

Runtime observation roots and useful fields

The Runtime UI Memory Map gives the complete read-only Screen and Event tree traversal, vtable discriminators, field layouts, and stable snapshot procedure.

The virtual addresses below assume image base 0x00400000. External tools should use loaded_module_base + RVA.

These pointers are observation roots, not synchronization primitives. Dialog removal may use deferred deletion, and the Screen and Event registries can change while another thread reads them. Validate the pane vtable and take a stable registry snapshot before following dynamic children. Writing a visible flag alone is unsafe because Screen composition, Event eligibility, capture, timers, and owner pointers must agree.

Code-level flow

Persistent content selection

ui_game_buttons_handle_key_event accepts Event type 8 and maps A/S/D/F/G to indices 0 through 4. ui_game_buttons_select_content dispatches to the relevant selector. A selector hides the previous pane through vslot +0x18, shows the new pane through +0x14, stores it at owner +0x124, updates the associated button layout, and redraws.

Equipment has an additional same-pane branch. ui_game_buttons_select_inventory calls ui_pane_is_visible. A visible current equipment pane is hidden. A hidden current pane causes net_c_send_self_look to queue action 0x2D, then the pane is shown. This order means the old equipment data can become visible before the asynchronous SSelfLook reply arrives.

Equipment and self-look

ui_equip_pane_ctor publishes ui_equip_pane, while its destructor clears the pointer. ui_equip_pane_handle_server_packet claims only actions 0x37, 0x38, and 0x39.

ui_equip_pane_add_item reads the slot at packet +1, a big-endian identifier at +2, the name length at +4, and name bytes at +5. ui_equip_pane_remove_item reads the slot at +1 and clears the corresponding fields. ui_equip_pane_apply_self_look replaces the larger appearance, identity, and legend state before invalidating the pane.

Skill and spell inventories

ui_skill_inventory_handle_server_packet dispatches 0x2C, 0x2D, and 0x3F. ui_spell_inventory_handle_server_packet dispatches 0x17, 0x18, and 0x3F. Both add handlers first remove an existing pane at the packet-selected index, then allocate a class-specific slot object and add it to both registries. Both remove handlers perform the inverse sequence and clear the slot pointer.

ui_skill_slot_handle_mouse_event constructs SkillBookDialog on right-button down inside the slot. The activation branch sends the optional action 0x4E phrase and then net_c_send_use_skill, which emits [0x3E, slot].

ui_spell_slot_handle_mouse_event constructs SpellBookDialog on right-button up inside the slot. Its activation dispatcher selects immediate cast, targeted cast, or an input dialog from the spell type at slot +0xF8. ui_spell_slot_begin_cast builds [0x0F, slot] and passes it to ui_spell_delay_begin. A nonzero configured delay sends action 0x4D, installs a 1000 ms callback, emits action 0x4E phrases, and releases the held cast in ui_spell_delay_handle_timer.

Bulletin and mail

ui_window_buttons_show_bulletin_session allocates 0x12C bytes and calls ui_bulletin_session_ctor in client-opened mode. The constructor publishes ui_bulletin_session, adds and registers the session below BackgroundPane, then calls net_c_send_bulletin_start.

An unsolicited SBulletin reaches ui_map_handle_bulletin. When no session exists and the packet flag allows creation, the map handler allocates the same object in server-opened mode and passes the original packet to the constructor. When a session already exists, its registered socket handler claims the packet directly.

ui_bulletin_session_process_packet reads packet +1 and dispatches to the five child processors. Each processor handles history cleanup, attaches the new child, sets the session back-pointer, and calls the child build virtual. Article and mail identifiers of zero produce a small “No More” dialog instead of an Article or Mail child.

Users, paper, and server menus

Window button Q calls ui_window_buttons_show_option_pane, which allocates 0x578 bytes and constructs OptionPane. ui_option_pane_ctor installs ui_option_pane_vtable, builds the controls, and adds and registers the pane below BackgroundPane. Its mouse, key, socket, and timer vslots are all class-specific. Option controls call net_c_send_user_setting; a registered OptionPane claims SSelfSaveOk and constructs the local confirmation dialog. Its X shortcut constructs the exit-wait pane, beginning the two-step CQuit and SReconnect orderly-exit exchange.

Window button E always calls net_c_send_who_request. On first use it also allocates Users Dialog Pane, publishes ui_users_dialog_pane, adds and registers it, and immediately calls vslot +0x18 to keep it hidden. ui_map_handle_show_users later obtains that static object, calls ui_users_dialog_parse_server_list, and then ui_users_dialog_show.

ui_map_handle_show_paper allocates Paper in mode 1. SEnterEditingMode uses the same constructor in mode 0. Both parsers eventually call ui_paper_dialog_build_content, which creates the controls, adds the dialog below BackgroundPane, and registers it.

ui_paper_dialog_handle_completion reads the text control, changes carriage returns to tab bytes, serializes CExitEditingMode, and closes the dialog when its completion conditions permit submission. net_c_send_exit_editing_mode uses the same packet layout without owning the close transition.

ui_map_handle_screen_menu allocates and constructs one full-screen menu pane for action 0x2F. Menu interaction functions serialize CMenuCode action 0x39. ui_map_handle_pursuit_menu reads packet +1 and allocates one of seven message classes. The two friendly question class names are proven by constructor diagnostics and vtable installation. Their answer virtuals serialize CMessage action 0x3A.

Function table