Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions Info.txt
Original file line number Diff line number Diff line change
Expand Up @@ -265,5 +265,13 @@ const int _Moho_SSTICommandIssueData_Destructor = 0x0057ABB0;
// MSVCR80.dll
#define _memmove_s = 0x00A824E7;

// Range ring rendering (hull cull patch)
// func_RenderRings: 0x007EF5A0 — renders N ring positions via stencil pipeline
// Moho::WeaponExtractor::Range: 0x007EC650 — extracts per-unit weapon ranges
// sWldMap: 0x010A6438 — global pointer to the world map
// Ring entry layout: [0]=worldX, [1]=worldZ, [2]=innerRadius, [3]=outerRadius (16 bytes)
// sub_7F32E0: processes input vector into fill + edge buffers (1 fill + 2 edges per entry)
// sub_7EDC80: per-entry ring geometry builder called by sub_7F32E0

// New unit categories.
const char* sCQUEMOV = "CQUEMOV";
5 changes: 5 additions & 0 deletions changelog.md
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,11 @@ These don't matter except for other assembly patches
- hooks/HRangeRings2.cpp
- section/RangeRings2.cpp

- Range ring hull cull for dense crowds (drops interior rings whose outer circle is fully covered by neighbours, ~16 FPS → ~80 FPS with 600+ units)

- hooks/RangeRingCluster.hook
- section/RangeRingCluster.cpp

- Range ring performance improvement (don't render each ring twice)

- hooks/RangeRings.cpp
Expand Down
7 changes: 7 additions & 0 deletions hooks/RangeRingCluster.hook
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
// Replace the 5-byte `mov eax, ds:0x10a6438` (sWldMap) at 0x007EF5E2 with a
// 5-byte JMP into our trampoline. The trampoline runs a greedy hull-cull
// compaction (gated by ui_RangeRingClusterHull), re-executes the displaced
// instruction and jumps back to 0x007EF5E7.

0x007EF5E2:
jmp @RangeRingClusterTrampoline
Comment on lines +6 to +7
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Inspect trampoline register/flag preservation:"
rg -n -C5 'RangeRingClusterTrampoline|pushad|popad|pushfd|popfd|0x007EF5E7|0x10a6438' section/RangeRingCluster.cpp

echo
echo "Inspect any documented disassembly around 0x007EF5E2/0x007EF5E7 (if present):"
fd -i 'Info.txt' | xargs -r rg -n -C8 '007EF5E2|007EF5E7|7EF5E'

Repository: FAForever/FA-Binary-Patches

Length of output: 1884


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Search for any references to 0x007EF5E7 or 0x7EF5E7 in codebase ==="
rg -i '0x*7EF5E7|RangeRingCluster' --max-count=20

echo
echo "=== Check for test files or additional documentation ==="
fd -i 'test|spec|info|readme' | head -20

echo
echo "=== Look for any conditional code patterns after the hook site ==="
fd -i '\.cpp$|\.asm$|\.txt$' | xargs -r rg -l 'func_RenderRings|RangeRingCluster' 2>/dev/null | head -10

Repository: FAForever/FA-Binary-Patches

Length of output: 1140


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Reading Info.txt to find RangeRingCluster or 0x7EF5E context ==="
rg -n -B5 -A10 'RangeRingCluster|0x7EF5E|007EF5E2|007EF5E7' Info.txt

echo
echo "=== Full Info.txt file size and structure ==="
wc -l Info.txt
head -50 Info.txt

Repository: FAForever/FA-Binary-Patches

Length of output: 139


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Check Info.txt structure ==="
head -100 Info.txt

echo
echo "=== Search for any binary info or disassembly files ==="
find . -type f \( -name '*.txt' -o -name '*.md' -o -name '*disasm*' \) | head -20

echo
echo "=== Examine the hook file directly ==="
cat hooks/RangeRingCluster.hook

Repository: FAForever/FA-Binary-Patches

Length of output: 3642


Add pushfd/popfd to preserve EFLAGS across the C call in the trampoline.

The trampoline executes add esp, 8 after the C call, which modifies EFLAGS (ZF, CF, OF, SF, AF, PF). These flags are never restored before the re-executed mov and return to 0x007EF5E7. The code's own comment states the goal is "so the original code at 0x7EF5E7 sees the same machine state it would have without the hook," but the current implementation contradicts this by leaking flag changes.

Add pushfd immediately after pushad and popfd immediately before popad to preserve flags across the flag-modifying stack adjustment.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@hooks/RangeRingCluster.hook` around lines 6 - 7, The trampoline at
RangeRingClusterTrampoline currently preserves registers with pushad/popad but
not EFLAGS; modify the trampoline to pushfd immediately after pushad and popfd
immediately before popad so EFLAGS are saved and restored across the C call
(i.e., add pushfd right after the existing pushad and add popfd just before the
existing popad) ensuring the original code at 0x7EF5E7 sees the same EFLAGS
state as without the hook.

184 changes: 184 additions & 0 deletions section/RangeRingCluster.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,184 @@
#include "magic_classes.h"

// Hull culling for range rings.
//
// func_RenderRings (0x007EF5A0) gets a vector of N ring positions and
// renders every single one. With dense crowds (600+ units) the per-ring
// setup cost dominates frame time.
//
// This patch hooks at 0x007EF5E2 and runs a greedy compaction pass that
// keeps only units whose outer-circle samples are NOT fully covered by
// already-kept neighbours. Interior units get dropped; boundary and
// isolated units survive. The engine's stencil-based outline rendering
// then produces the same merged hull from fewer rings.
//
// Disabled by default. Enable: `ui_RangeRingClusterHull 1`.

float g_RingClusterHull = 0.0f;

ConDescReg ring_cluster_hull_reg{
"ui_RangeRingClusterHull",
"If non-zero, cull range rings whose outer circle is fully covered by "
"already-kept neighbours (greedy 24-sample geometric test). Only boundary "
"and isolated units render. Large FPS gain in dense crowds.",
&g_RingClusterHull};

// Each ring position entry in the vector is 16 bytes laid out as 4 floats.
// Layout was verified by reading Moho::WeaponExtractor::Range (0x7EC650),
// which writes the buffer that gets pushed onto the position vector via
// sub_7F0310 in func_ExtractRanges:
//
// [0] = world X
// [1] = world Z (NOT Y -- SCFA uses Y as elevation, the ground plane
// is XZ)
// [2] = inner radius (= min weapon range across all weapons of the
// unit's category, can be 0 for solid disks)
// [3] = outer radius (= max weapon range across all weapons of the
// unit's category, always > 0)
//
// Multiple units of DIFFERENT sizes can co-exist in a single
// func_RenderRings call: func_ExtractRanges iterates every army unit
// through one shared RangeExtractor, so e.g. an ACU's main gun and a T1
// bot's main gun both end up in the "Direct Fire" call with their own
// per-entry [innerR, outerR].
//
// === Greedy hull culling ===
//
// The naive "for each unit, check if covered by ALL OTHER units" test has
// a fatal flaw: it can cull units whose covering neighbours will THEMSELVES
// be culled, leaving the surviving kept-set with holes that don't actually
// cover the original union. The visual symptom is fragmented partial-ring
// outlines inside the cluster (kept boundary units' inward edges showing
// through gaps in the stencil mask where culled units used to fill).
//
// The fix is to make the test order-aware: a candidate P is checked only
// against the ALREADY-KEPT set (not against units that may yet be culled).
// We compact the input vector in place during the same pass:
//
// * data[0 .. writeIdx) is the keep set so far
// * data[i] is the candidate being inspected
// * If P is fully covered by data[0..writeIdx), drop it
// * Otherwise copy P to data[writeIdx] and bump writeIdx
//
// This guarantees: every kept unit is NOT covered by other kept units, AND
// every culled unit IS fully covered by some subset of kept units (and
// therefore by the entire kept set). The keep-set's stencil mask is then
// equivalent to the full original mask.
//
// Coverage test: 24 samples (every 15 degrees) on P's outer circle. Each
// sample must lie in some kept neighbour's [innerR, outerR] band. Outer
// loop early-exits on first uncovered sample.
extern "C" int ClusterRingPositions(float *data, int count)
{
if (g_RingClusterHull == 0.0f || count <= 4) return count;

// 24 unit vectors at 15-degree intervals around the outer circle.
// The engine draws rings as 45 segments (8 deg each); 24 samples at
// 15 deg catches gaps down to ~2 segments, reducing outline choppiness.
static const float COSDIR[24] = {
1.00000000f, 0.96592583f, 0.86602540f, 0.70710677f,
0.50000000f, 0.25881905f, 0.00000000f, -0.25881905f,
-0.50000000f, -0.70710677f, -0.86602540f, -0.96592583f,
-1.00000000f, -0.96592583f, -0.86602540f, -0.70710677f,
-0.50000000f, -0.25881905f, 0.00000000f, 0.25881905f,
0.50000000f, 0.70710677f, 0.86602540f, 0.96592583f
};
static const float SINDIR[24] = {
0.00000000f, 0.25881905f, 0.50000000f, 0.70710677f,
0.86602540f, 0.96592583f, 1.00000000f, 0.96592583f,
0.86602540f, 0.70710677f, 0.50000000f, 0.25881905f,
0.00000000f, -0.25881905f, -0.50000000f, -0.70710677f,
-0.86602540f, -0.96592583f, -1.00000000f, -0.96592583f,
-0.86602540f, -0.70710677f, -0.50000000f, -0.25881905f
};

int writeIdx = 0;

for (int i = 0; i < count; ++i) {
// Snapshot the candidate locally so it survives any in-place
// overwrite at data[writeIdx] further down.
float px = data[i * 4 + 0];
float pz = data[i * 4 + 1];
float pInner = data[i * 4 + 2];
float pOuter = data[i * 4 + 3];

// First unit always kept (nothing to be covered by).
bool fully_covered = (writeIdx > 0);

for (int k = 0; k < 24 && fully_covered; ++k) {
float tx = px + pOuter * COSDIR[k];
float tz = pz + pOuter * SINDIR[k];

bool sample_covered = false;
for (int j = 0; j < writeIdx; ++j) { // ONLY already-kept set
float *Q = data + j * 4;
float dx = Q[0] - tx;
float dz = Q[1] - tz;
float distSq = dx * dx + dz * dz;

float qOuter = Q[3];
if (distSq > qOuter * qOuter) continue;

float qInner = Q[2];
if (qInner > 0.0f && distSq < qInner * qInner) continue;
Comment on lines +108 to +123
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Outer-circle coverage is not enough for annuli.

fully_covered is decided only from samples on pOuter, but pInner never participates in the cull test. For mixed [innerR, outerR] batches, that can drop a ring whose outer boundary is hidden while its min-range hole is still visible in the merged stencil. Please either add an inner-circle coverage check when pInner > 0, or conservatively skip culling annuli until both boundaries are proven hidden.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@section/RangeRingCluster.cpp` around lines 108 - 123, The current cull loop
only samples the outer radius (pOuter) to set fully_covered, so annuli with a
visible inner hole can be incorrectly culled; update the loop that iterates k
(the 24-direction samples) to also test samples at pInner when pInner > 0 using
the same coverage logic against existing kept entries (writeIdx, data, Q) and
require both the outer and inner sample to be covered before marking
fully_covered, or alternatively, if you prefer simpler conservative behavior,
skip annulus culling when pInner > 0 (i.e., do not set fully_covered for rings
with pInner > 0). Ensure you reference and reuse the same distance/inner/outer
checks (distSq vs qOuter*qOuter and qInner*qInner) as currently used for pOuter.


sample_covered = true;
break;
}

if (!sample_covered) {
fully_covered = false;
}
}

if (!fully_covered) {
float *dest = data + writeIdx * 4;
dest[0] = px;
dest[1] = pz;
dest[2] = pInner;
dest[3] = pOuter;
writeIdx++;
}
}

return writeIdx;
}

// Trampoline installed at 0x007EF5E2 (replaces the 5-byte
// `mov eax, ds:0x10a6438` -- sWldMap -- which we re-execute on the way out).
//
// Live registers at the patch site, deduced from the surrounding asm:
// ecx = vector pointer (last arg `i` to func_RenderRings)
// [ecx+4] = data start, [ecx+8] = data end
// ebp = ring count (= (end - start) >> 4), already shifted, non-zero
// esi = edx0 arg (Camera-related), must preserve
// ebx = saved original ecx, must preserve
//
// We modify `ebp` to the new (clustered) count by patching the saved-ebp
// slot in the pushad frame, so popad restores the smaller value.
asm(R"(
.section .text,"ax"
.global RangeRingClusterTrampoline
RangeRingClusterTrampoline:
pushad

# ecx still holds the vector pointer; ebp still holds the original count.
push ebp # arg2: count
mov eax, [ecx+4] # data start = vec->begin
push eax # arg1: data
call _ClusterRingPositions
add esp, 8

# popad pop order: edi, esi, ebp, esp(skipped), ebx, edx, ecx, eax
# so the saved-ebp slot lives at [esp+8] right now.
mov [esp+8], eax # write the clustered count into ebp's slot

popad

# Re-execute the displaced instruction `mov eax, ds:0x10a6438` (sWldMap)
# so the original code at 0x7EF5E7 sees the same machine state it would
# have without the hook.
mov eax, ds:0x10a6438

jmp 0x007EF5E7
)");