# XP installed game source and executable identity (r397)

The XP VM's display adapter is not suitable for a retail visual capture, but its backing disk supplies installed game files for static analysis. QEMU reports `/home/jhylands/vms/winxp/winxp.qcow2` as the read-only backing image and `/tmp/nfsu2-user-xp-capture-overlay.qcow2` as the running VM's writable overlay. I did not read or alter the live overlay. The base disk contains one NTFS partition beginning at byte 32,256. I made a sparse read-only raw copy of the backing disk and extracted files with `ntfscat`.

The local source files are retained under `reverse-engineering/source/pc-install/` for offline work; the executable and raw source assets are not copied into the served `dist/` tree.

## Identity and match

| File | SHA-256 | Size |
| --- | --- | ---: |
| `SPEED2.EXE` | `f9dd86c054878ce6276beb07c1fd61874f7a1e4bf1f241b084c65b73e24168a7` | 4,800,512 bytes |
| `GLOBAL/GLOBALB.BUN` | `07e1c37a2e5ba4b3e6a17b257e653409c31d5f0b3f9df3464aec36adbbced9d0` | — |
| `CARS/240SX/GEOMETRY.BIN` | `122342b8ed9418ccc05515bcad1d2b5720ec45ee90c4fcaedab28751612bd18a` | 7,675,600 bytes |
| `CARS/240SX/TEXTURES.BIN` | `797953b0aad7be50ebbf81144dedfb39c9fab513a41a02886935026c879d0ea1` | 940,480 bytes |
| `CARS/240SX/VINYLS.BIN` | `6d6801b524a605ff3e24a4c2f5bb86ef5dbda9119cce90c1eb1b795677bcb39a` | 13,971,328 bytes |

The GLOBALB hash matches the one already used in the vehicle-physics audit, tying this executable to the audited asset tables. `SPEED2.EXE` is PE32/i386 with image base `0x00400000`. Its embedded changelist text includes revision `126890`, dated 2005-02-09, with comment `Bump PC version number.` The PE timestamp is a fixed linker value (1987), not a release date.

The constructor at `0x0063b850` contains the previously reported store `mov [esi+0x904], 0x007f3e10`. The routine at `0x004061c0` loads `0x007e9e88` and calls the curve sampler at `0x005764d0`; the executable bytes match the existing static steering audit.

## Controller curve descriptor

The descriptor at `0x007e9e88` is 20 bytes: count 21 at `+0x00`, minimum `-1.0` at `+0x04`, maximum `+1.0` at `+0x08`, scale `10.0` at `+0x0c`, and sample pointer `0x007e92d8` at `+0x10`. The sampler uses the count, subtracts the minimum, multiplies by the scale, truncates the interval index, then interpolates adjacent samples through that pointer. The 21 floats at `0x007e92d8` are:

```text
-1, -0.8, -0.615, -0.483, -0.388, -0.288, -0.22, -0.161, -0.111, -0.057,
0, 0.057, 0.111, 0.161, 0.22, 0.288, 0.388, 0.483, 0.615, 0.8, 1
```

These already match `RETAIL_CONTROLLER_STEERING_PROFILE` in the viewer. The separate array at `0x007e9280` belongs to the preceding descriptor and is not used by this active-controller branch. No steering change was needed.

This extraction confirms source-file provenance and the existing controller curve. It does not make the XP guest renderable or resolve the remaining runtime player steering-to-yaw, tire-force, paint-selection, and glass-blend state. Host Chrome remains the visual-review path.