# Player paint and window runtime handoff, r334

## Result of the source-backed pass

No new player body-paint or glass image, binding, or material conversion was
found in the installed car catalogs, shared `GLOBALB.BUN` textures, named
paint-state records, or the exporter. The known recoveries remain the shared
`DRIVER`, `REAR_DEFROSTER` (`0xd195be56`), and `CARBOTTOM` textures documented
in [r295](player-car-shared-textures-r295.md). The 240SX body slot
`0x3c84d757` and main rear-pane slot `0x7b220ddf` still have no source image.
The defroster is a separate alpha-blended overlay and cannot stand in for the
pane or body finish.

Static executable analysis confirms the player paint and glass appearances
are assembled from runtime-selected material state. Named resources such as
`REGPAINTRED` and `WINDSHIELD` contain shader inputs, not final pixel colors;
their names do not establish that the primary player's draw uses them. The
body draw receives a state through render owner `+0x384` and material key
`0xd6d6080a`. Glass uses the separate owner field `+0x38c`, while pane
transparency additionally depends on its bound texture alpha, selected
technique, texture-layer descriptor, and blend state. See the detailed
[paint handoff audit](player-paint-runtime-gap-r267.md),
[windshield state audit](player-windshield-state-record-audit-r330.md), and
[rear-glass audit](rear-glass-source-audit-r329.md).

The stock geometry/export itself is not a missing-texture diagnosis: paint
subsets and the `WINDSHIELD` hash survive export. The Miata opposite-door
assembly omission was corrected from the installed XP geometry in r319; that
fix supplies missing geometry, not paint or glass state.

## Minimal next capture

One live XP gameplay session with the 240SX is sufficient. Keep a known body
color and finish selected, then capture one body draw and one front or rear
glass draw from the same frame. For body paint, run
[`tools/capture_nfsu2_paint_state.gdb`](../tools/capture_nfsu2_paint_state.gdb)
to log the class-`0x3f` descriptor selector, chosen `0x6ba02c05` row, resolved
owner `+0x384` state, and incoming replacement pointer for `0xd6d6080a`.
Correlate the draw with the primary player object and record its active
technique, 40-float harmonic-light packet at `+0x120`, and any texture bound
to the body material. Repeat once after one deliberate paint or finish change
while holding the camera and lighting fixed.

For glass in that same session, record owner `+0x38c`, material key
`0x471a1dca` for the defroster or the actual pane key, selected state/tint
handle, active technique/pass, stage-0 texture and its alpha, and the relevant
texture-layer descriptor bytes `+0x55/+0x56`. Also record the five BlendState
words at `0x0086ead8` and the final diffuse-alpha or texture-factor-alpha
inputs. That is the smallest correlated capture that can distinguish a
missing image from runtime tint/opacity/blend selection and support a
source-backed exporter or viewer change.

The local XP image reached the product-activation screen in the previous
capture attempt, so no gameplay draw has yet supplied these values. Until a
valid XP session produces the handoff, no new body color, texture binding, or
window opacity change is justified.

## r338 paint and windshield capture coverage (2026-10-16)

The XP GDB capture now covers both material replacement paths in one session.
Its existing hardware breakpoint at `0x0048d860` accepts either the body key
`0xd6d6080a` or windshield key `0x471a1dca`. For each matching draw it logs
the caller, geometry record, incoming 0xa0-byte state record, and the matching
old/incoming material-row state pointers. The combined conditional uses one
hardware breakpoint, so the script keeps its previous four-breakpoint count.

This records the source-backed `+0x384` and `+0x38c` state handoffs, but does
not yet capture the selected technique, actual bound texture/alpha, or
BlendState at draw submission. Those values still need a live XP frame and a
separate breakpoint at the material submission path. Source and packaged
scripts are identical at `tools/capture_nfsu2_paint_state.gdb`.