Proposals / #1350

Type the NPC validator's game-data parameter as D2GameNpcStrc pointer

applied · by eejitgames · submitted 2026-11-06, applied 2026-11-06

Ghidra vwin 1971 · 9dc1ead

win 00578ae0 Stack[0x8] nNpcGameData is int32_t, but the sole caller passes a D2GameNpcStrc*. At 00578b57 CALL 00535f10 returns the record; 00578b5c saves EAX in ESI; 00578b8a PUSH ESI supplies this argument to CALL 00578b90. The lookup itself indexes records with stride 68 (00535eef..00535ef9), matching sizeof(D2GameNpcStrc). Validator 00578afc loads [record+8], pProxyInventories; 00578b05 compares each node's DWORD +4 with player GUID and 00578b0f follows DWORD +8, matching D2NpcProxyInventoryStrc nPlayerGUID/pNext. Retype only the existing stack parameter to D2GameNpcStrc*: recover typed list traversal instead of integer-address dereferences. Preserve chosen names, storage, fastcall, and all other parameters/results. Static proof only. This does not claim to resolve the separate gamble-generation crash in GitHub issue #104.

Changes 1, applied together

1. Retype variable win 0x00578ae0 Stack[0x8]

   typeint32_t→D2GameNpcStrc *