Wreckless: The Yakuza Missions

A static recompilation of the original Xbox game Wreckless: The Yakuza Missions (Bunkasha / Activision, 2002; internal codename DSTEAL / Double Steal) into a native Windows executable.

The game's original x86 machine code is translated into portable C, which is then compiled to a native x86-64 binary. There is no emulation at runtime — the game's own logic executes directly on your CPU.

Built with xboxrecomp. This repository is the per-title work: the toolkit is a dependency, not a copy.

Join the sp00nznet recomp Discord — the community hub for sp00nznet's recomp projects. Good place to ask questions, show a port you are working on, or find out what people are stuck on before you duplicate the effort.

You must provide your own copy of the game. No game code or assets are included here, and none are distributed.

Status

Boots, starts its game thread, and runs initialisation. Not yet rendering.

Phase	Status	Details
XBE parsing	Done	11 sections, 113 kernel imports
Disassembly	Done	3,470 functions
Function ID	Done	9 CRT, 1 SEH prolog/epilog pair; custom engine
ABI recovery	Done	3,464 entries (94 thiscall)
Recompilation	Done	468,799 lines of C, 0 failed, 20 stubs
Kernel layer	Done	113/113 resolved (68 bridged, 45 stub)
Build	Done	bin/wreckless.exe
Boot	Done	15 kernel calls, no crash; exits via HalReturnToFirmware
Graphics (D3D8→D3D11)	Scaffolded	Toolkit layer, not yet exercised
Audio (DSound→XAudio2)	Scaffolded	Toolkit layer, not yet exercised
Input (XPP→XInput)	Scaffolded	Toolkit layer, not yet exercised
Gameplay	Not started

Where it stops

PsCreateSystemThreadEx  routine=0x000E8A42 ctx1=0x000EB50F
RtlInitializeCriticalSection, KeInitializeEvent x2
[ICALL] Failed to resolve VA 0x000F0418        <-- the current blocker
NtOpenSymbolicLinkObject  \Device\Harddisk0\partition1\
MmAllocateContiguousMemory  4096 bytes
HalReturnToFirmware  routine=2 - title is exiting

The unresolved indirect call is to 0x000F0418, which is inside sub_000F02C0 (0xF02C0–0xF04AB). It is therefore a mid-function target, not a function start, and must not be added to seed_functions.json: seeding an address that is not a function start truncates the function containing it. It needs handling as an in-function label instead. That is the next piece of work.

Building

Prerequisites

• Windows with Visual Studio 2022 (MSVC) and CMake 3.20+
• Python 3.10+ with capstone
• A checkout of xboxrecomp beside this one (../xboxrecomp), or set -DXBOXRECOMP_DIR=<path>
• Your own default.xbe, in game/Wreckless - The Yakuza Missions/

Regenerate and build

./regen.sh                                   # XBE -> C, via the toolkit
cmake -S . -B build/cmake
cmake --build build/cmake --config Release
./bin/wreckless.exe

regen.sh runs disassembly, XDK naming, function identification, ABI recovery and lifting in the one order that works — see the comments in it. Re-run CMake after a regeneration that changes the number of generated .c files, since the source list is globbed at configure time.

seed_functions.json

Two entry points are seeded because nothing in .text calls them, so the detector cannot find them:

Address	Why
0x000E8A42	Thread start routine, handed to PsCreateSystemThreadEx. Without it the game thread never starts and the process exits cleanly having done nothing — which reads as success.
0x000EB50F	The thread's real entry, passed as ctx1 and reached through the indirect call inside the shim above.

Add seeds one at a time and verify each. An address that is not a function start truncates the function containing it, and the damage is not obvious.

XBE analysis

Property	Value
Title	Wreckless: The Yakuza Missions
Title ID	0x4156000A
Base address	0x00010000
Entry point	0x000EB57E
Code size	~947 KB (.text)
Sections	11
Kernel imports	113

0x00011000 - 0x000F8760  .text     (947 KB)   Game code
0x000F8760 - 0x0010A068  D3D       (73 KB)    Direct3D library
0x0010A080 - 0x00126CD0  D3DX      (115 KB)   D3DX extensions
0x00126CE0 - 0x00128E0C  XGRPH     (8 KB)     Xbox graphics
0x00128E20 - 0x00132494  DSOUND    (38 KB)    DirectSound
0x001324A0 - 0x001477F0  WMVDEC    (85 KB)    WMV video decoder
0x00147800 - 0x0014EF1C  XPP       (30 KB)    Xbox Platform Plugin
0x0014EF20 - 0x00154FF4  .rdata    (24 KB)    Constants
0x00155000 - 0x001D1E0C  .data     (500 KB)   Data + BSS
0x001D1E20 - 0x001D8BB8  DOLBY     (27 KB)    Dolby audio
0x001D8BC0 - 0x001DB3C0  $$XTIMAGE (10 KB)    Title image

Technical notes

• Custom engine, not RenderWare, so function identification is harder than on the RenderWare titles and less carries over from them.
• Heavy use of XDK libraries (D3D, D3DX, DSOUND, WMVDEC) in their own PE sections, which at least isolates game-specific code cleanly.
• __SEH_prolog / __SEH_epilog sit at 0x000F0954 / 0x000F098D. These used to be hardcoded here; the toolkit now detects them per title by signature and independently finds the same pair.
• The thread entry wrapper at 0x000E8A42 copies init data and calls the game's main through a context pointer — hence both seeds above.
• Regional XBE variants exist (US, UK, FR, GR, JP). The JP/FR/GR builds are larger (~1.9 MB vs ~1.4 MB), suggesting extra content.

Relationship to xboxrecomp

This project used to carry its own copy of the toolkit and of all four runtime libraries. They were never a fork — the copies were byte-identical to another project's, and the only local change anywhere was a hardcoded pair of SEH addresses. They were simply the toolkit frozen on the day this project was scaffolded.

It now builds against ../xboxrecomp directly, so a fix made there arrives here. Bringing it across found two bugs in the toolkit itself, both since fixed upstream: stale generated chunk files that were never cleaned up, and a template that declared the guest registers without RECOMP_TLS after the runtime made them thread-local.

License

MIT — see LICENSE.

That covers this repository's own code: the runtime scaffold, the build, and the project-specific glue. It does not cover the game. No game code, data or assets are included here, and the recompiled output is derived from a copy you must supply yourself.

The toolkit is licensed separately — see xboxrecomp's LICENSE and NOTICE. Some of its components are LGPL-2.1 (the MCPX APU sources and the NV2A register definitions, extracted from xemu); this project links only the MIT-licensed ones (xbox_kernel, xbox_d3d8, xbox_dsound, xbox_input) and has never contained any xemu-derived code.