5517 client source reconstruction

[0xpanadol]

I've been working for this for almost 3 weeks, completed most of the dlls and some major exe functions, ignored the network completly for now (I'll rebuild the whole network for both client and server in my own logic later)

 

https://www.youtube.com/watch?v=L2E-BuXChAw

Edited April 2 by 0xpanadol

[Airplist]

good job

[kennylovecode]

On 4/3/2026 at 9:00 AM, Airplist said:

good job

good guilao job!

 

[xFranko]

that's amazing!!

[0xpanadol]

New updates with GUI and character render pipeline (still alpha though)
 

https://www.youtube.com/watch?v=0sqabpfj5k4

[Airplist]

good job

[0xpanadol]

- More improvements in movements/jump

- More improvements in character pipeline

- Sounds with map sounds

 

https://www.youtube.com/watch?v=h3jovijSfFU

[xFranko]

I'm curious how did you reverse the dlls ? are you using IDA?

Edited April 12 by xFranko

[kennylovecode]

It should not reverse, but directly use the previously released C3SDK.

Of course, this is my guess.

Edited April 12 by kennylovecode

[xFranko]

3 hours ago, kennylovecode said:

It should not reverse, but directly use the previously released C3SDK.

Of course, this is my guess.

Hmm where are those released ?

[kennylovecode]

31 minutes ago, xFranko said:

Hmm where are those released ?

I think there should be a clone on github. You can search it.

Edited April 12 by kennylovecode

[0xpanadol]

10 hours ago, xFranko said:

I'm curious how did you reverse the dlls ? are you using IDA?

Yeah, not just SDK as kenny said
everything is being reconstructed

[0xpanadol]

Bridges

[xFranko]

1 hour ago, 0xpanadol said:

Yeah, not just SDK as kenny said
everything is being reconstructed

did you use ENV_DX9/Conquer.exe as you dll entry point and looked at the external dll imports going from there to see the flow? Because I am currently trying to reverse it so might benefit from your experience

Edited April 12 by xFranko

[0xpanadol]

36 minutes ago, xFranko said:

did you use ENV_DX9/Conquer.exe as you dll entry point and looked at the external dll imports going from there to see the flow? Because I am currently trying to reverse it so might benefit from your experience

Yes and no 

i did use the exe's decompiled output and its imports/exports/xrefs as a starting point to understand the overall architecture, but rather than purely tracing imports live from a running exe i worked from static analysis, Ghidra and Binary Ninja decompilation of both the exe and each individual DLL.

then built a dependency order that maps which DLLs depend on which, so reconstructed bottom-up foundational DLLs first (like graphic.dll, GraphicData.dll) before higher-level ones (like Role3D.dll, RoleView.dll)

it was so hard at the beginning but when you have working peaces it's only fixing bugs, and fine tuning what already built. and i gave myself some time to make sure all major dll files are reconstructed and made some tools to test the builds with game client files and folder before implementing these on the actual reconstructed exe.

[xFranko]

10 minutes ago, 0xpanadol said:

Yes and no 

i did use the exe's decompiled output and its imports/exports/xrefs as a starting point to understand the overall architecture, but rather than purely tracing imports live from a running exe i worked from static analysis, Ghidra and Binary Ninja decompilation of both the exe and each individual DLL.

then built a dependency order that maps which DLLs depend on which, so reconstructed bottom-up foundational DLLs first (like graphic.dll, GraphicData.dll) before higher-level ones (like Role3D.dll, RoleView.dll)

it was so hard at the beginning but when you have working peaces it's only fixing bugs, and fine tuning what already built. and i gave myself some time to make sure all major dll files are reconstructed and made some tools to test the builds with game client files and folder before implementing these on the actual reconstructed exe.

Thank you, that helps a lot!  Goodluck with the rest of scope! 

[0xpanadol]

- Replaced the old DirectSound engine with miniaudio
- Refactor the whole sound system and core to better and modern logic
- Made sure music, sounds are working
- Implement a basic effect audio 
- Modified client structure to keep every dll and the main exe inside bin/64 folder same as the classic conquer one doing

https://www.youtube.com/watch?v=7hCeIpIWEM0

Edited April 12 by 0xpanadol

[0xpanadol]

- Many improvements in movement/jump system
- Off-hand (left hand) motion
- Mount data loading and role part lookup
- Equipments attachments while riding
- More improvements and fixes here and there

https://www.youtube.com/watch?v=6axKZTSFi5A

 

Edited April 13 by 0xpanadol

[sunwave]

Great progress! Quick question about your texture system:

I'm working on a C3 renderer (client 5065) and have garment textures working via 3dtexture.ini + texture IDs, but armor models load with wrong/fallback textures.

The issue: Armor texture IDs (e.g., bodyType * 1000000 + armorID = 4000611) aren't in 3dtexture.ini, and the embedded texture paths in armor C3 files have encoding issues (Chinese characters like texture\սʿ-1.tga).

Did you find armor textures are indexed separately from garments, or do they use a different system entirely? Any hints on the correct armor texture → file mapping approach?

Thanks!

[Berniemack]

1 hour ago, sunwave said:

Great progress! Quick question about your texture system:

I'm working on a C3 renderer (client 5065) and have garment textures working via 3dtexture.ini + texture IDs, but armor models load with wrong/fallback textures.

The issue: Armor texture IDs (e.g., bodyType * 1000000 + armorID = 4000611) aren't in 3dtexture.ini, and the embedded texture paths in armor C3 files have encoding issues (Chinese characters like texture\սʿ-1.tga).

Did you find armor textures are indexed separately from garments, or do they use a different system entirely? Any hints on the correct armor texture → file mapping approach?

Thanks!

first the client computes a cached texture/material source id from ItemTexture.ini not from 3dtexture.ini that resulting texture id is resolved to actual .dds through the 3dtexture table so youre skipping an intermediary step it sounds like 

the actual mapping chain is something like:

1) body appearance and armor variant source
2) RoleView stored source
3) ItemTexture.ini section lookup and ColorN selector
4) resolved texture id
5) 3dtexture(.dbc/.ini)
6) actual DDS path

[sunwave]

7 minutes ago, Berniemack said:

first the client computes a cached texture/material source id from ItemTexture.ini not from 3dtexture.ini that resulting texture id is resolved to actual .dds through the 3dtexture table so youre skipping an intermediary step it sounds like 

the actual mapping chain is something like:

1) body appearance and armor variant source
2) RoleView stored source
3) ItemTexture.ini section lookup and ColorN selector
4) resolved texture id
5) 3dtexture(.dbc/.ini)
6) actual DDS path

Thanks! That makes perfect sense. So the full pipeline is:

1. Armor ID (611, 741, etc.) → ItemType ID via itemtype.dat
2. [Body + ItemType ID] lookup in ItemTexture.ini → Texture ID
3. Texture ID lookup in 3dtexture.ini → DDS path

How do I map Armor IDs to ItemType IDs? I need this for all armor variants (500, 611, 741, etc.).

Is there a tool to parse/decrypt itemtype.dat for the 5517 client? Or is there a simpler pre-extracted mapping file somewhere? Or do I need to extract it from the server-side item database?

I want to programmatically load the correct textures for any armor ID.

[xFranko]

5 minutes ago, sunwave said:

Thanks! That makes perfect sense. So the full pipeline is:

1. Armor ID (611, 741, etc.) → ItemType ID via itemtype.dat
2. [Body + ItemType ID] lookup in ItemTexture.ini → Texture ID
3. Texture ID lookup in 3dtexture.ini → DDS path

How do I map Armor IDs to ItemType IDs? I need this for all armor variants (500, 611, 741, etc.).

Is there a tool to parse/decrypt itemtype.dat for the 5517 client? Or is there a simpler pre-extracted mapping file somewhere? Or do I need to extract it from the server-side item database?

I want to programmatically load the correct textures for any armor ID.

You can use this to decrypt, there's a keys file which holds the keys for each file you would like to decrypt, for your case here it's 2537 for Item Type

File Manager (DAT Decryptor).zip

Edited April 15 by xFranko

[Berniemack]

5 minutes ago, sunwave said:

Thanks! That makes perfect sense. So the full pipeline is:

1. Armor ID (611, 741, etc.) → ItemType ID via itemtype.dat
2. [Body + ItemType ID] lookup in ItemTexture.ini → Texture ID
3. Texture ID lookup in 3dtexture.ini → DDS path

How do I map Armor IDs to ItemType IDs? I need this for all armor variants (500, 611, 741, etc.).

Is there a tool to parse/decrypt itemtype.dat for the 5517 client? Or is there a simpler pre-extracted mapping file somewhere? Or do I need to extract it from the server-side item database?

I want to programmatically load the correct textures for any armor ID.

There probably is, I dont have a tool for it specifically but I can share my parser code from my own client project that handles this. this should give you what you need ItemTexture.zip
 

[0xpanadol]

Wasn't porting new features, instead was working on improving what i have already

 

New Videos:

https://www.youtube.com/watch?v=U-oxnGij5C8

Tool for GUI (working in process): https://www.youtube.com/watch?v=2C97z9vfcHc

[0xpanadol]

everything about fonts has been built and tested with name and character info