diff --git a/docs/reference/render-frame.md b/docs/reference/render-frame.md index 54bcf9a..ec78020 100644 --- a/docs/reference/render-frame.md +++ b/docs/reference/render-frame.md @@ -57,6 +57,16 @@ selector `18` on the supplied object and invokes slot `+12` on that result. It does not store the supplied pointer in `stdGetCurrentCamera2`; that getter returns a Terrain global populated by selector `8` during Terrain initialization. +`Terrain.dll!LoadCamera` adds a separate factory-side contract. Its GOG entry +at RVA `0x4EBE0` is `__stdcall` with four machine-word arguments, allocates +`0x1A4` bytes, calls the constructor at RVA `0x4EC60`, and returns the interface +at object offset `+0x134`. The constructor passes arguments 3 and 4 into base +initialization at `this + 4`, writes argument 3 to `this + 0x138`, and calls a +helper at RVA `0x4CEF0` with arguments 1, 2 and 4 plus `this`. Argument 1 is a +mode string: only `REFLECTION` and `REFLECTION_SHIFTED` produce a non-zero mode +value at `this + 0x1A0`. This is factory ABI evidence, not a recovered view or +projection matrix contract. + ## Parity risks - x87 precision and rounding; diff --git a/docs/tomes/05-render.md b/docs/tomes/05-render.md index 2d529fc..96b7e52 100644 --- a/docs/tomes/05-render.md +++ b/docs/tomes/05-render.md @@ -1009,9 +1009,16 @@ thunk: it jumps through IAT `0x10020148` to `Terrain.dll!LoadCamera`. The Terrain export is at RVA `0x4EBE0` and is a `__stdcall` entry with `ret 0x10`, so it receives four machine-word arguments. It allocates a `0x1A4`-byte object, forwards those four words to its constructor, and returns a pointer at object -offset `+0x134`; the meaning and concrete types of those arguments are not yet -established. `Terrain.dll!stdGetCurrentCamera2` returns a global camera pointer, -and `stdSetCurrentCamera2` updates it through the object's interface methods. +offset `+0x134`. The constructor is at RVA `0x4EC60`: it passes arguments 3 and +4 to the base initialization at `this + 4`, stores argument 3 at `this + 0x138`, +and passes arguments 1, 2 and 4 plus `this` to its helper at RVA `0x4CEF0`. +Argument 1 is a NUL-terminated mode string at this call boundary: only the +embedded literals `REFLECTION` and `REFLECTION_SHIFTED` select a non-zero value +stored at `this + 0x1A0`. This proves that `LoadCamera` supports reflection +variants, but not the semantic types of its remaining arguments or the meaning +of the resulting value. `Terrain.dll!stdGetCurrentCamera2` returns a global +camera pointer, and `stdSetCurrentCamera2` updates it through the object's +interface methods. This establishes that original camera creation/selection is Terrain-owned and not a field that can safely be inferred from a TMA transform. It does **not**