Proposals / #733

Type ESCMENU_FreeLoadedImages input as existing menu rows

applied · by Commit-Will · submitted 2026-11-01, applied 2026-11-02

Ghidra v1804 · 39698f0

EDX pMenuTable points to D2EscMenuItemStrc rows. All six incoming call sites in ESCMENU_Shutdown pass one of seven existing typed row arrays, including both expansion/classic branches. ESCMENU_Initialize passes those identical addresses to the already typed loader, which writes the same image-pointer fields. The destructor derives EDI=base+0x120, accesses row type+0, count+0x120, main DC6*+0x53c and four subimage pointers+0x540, then advances0x550: all match the current1360-byte row definition. Full original target region, shared halt bytes, shutdown, loader and initialization regions equal live instruction bytes; all six EDX definitions were checked. Retype only pMenuTable void* to D2EscMenuItemStrc*, preserving its name, EDX, ECX int* count, fastcall and void return. Sole normal exit is bare RET0047dfbc. No field, global, helper, allocation or runtime/build claim.

Changes 1, applied together

1. Retype variable win 0x0047df00 EDX

   typevoid *→D2EscMenuItemStrc *