Skip to content

Yokimitsuro/FFXIVLegacyClientStructs

BranchesTags

Repository files navigation

FFXIVLegacyClientStructs

Reverse-engineered client structures for Final Fantasy XIV 1.0 (version 1.23b, the final patch before the Calamity shutdown).

Inspired by aers/FFXIVClientStructs which covers the modern FFXIV client. That project is completely incompatible with 1.0 — different architecture (x64 vs x86), different engine (Luminous-derived vs Crystal Tools), different memory layouts. This project fills that gap.

Target Binary

Property Value
Executable ffxivgame.exe
Game Version 2012.09.19.0001
Boot Version 2010.09.18.0000
Architecture x86 (32-bit)
ImageBase 0x00400000
SizeOfImage 0x00F99000 (15.6 MB)
Engine Crystal Tools (SQEX::CDev::Engine)
Renderer DirectX 9
Sound XAudio2
UI Framework Sqwt (Square Enix Widget Toolkit)
Physics Phieg (custom, not Havok)
Networking Custom RUDP2 over WinSock2 + WinHTTP

Since 1.23b was the last patch ever released, all addresses are frozen forever — no signature scanning needed (though it's included for documentation purposes).

What's Inside

RTTI Database

4,358 classes extracted from the binary with full MSVC mangled/demangled names, vtable virtual addresses, virtual function counts, and inheritance hierarchies (via ClassHierarchyDescriptor → BaseClassArray chain). 3,877 classes have vtable addresses resolved.

Top-level namespaces:

  • SQEX::CDev::Engine (1,492 classes) — Core Crystal Tools engine: Framework, Rendering (Dw), Layout (Stella/Lay), Sound (Sd), VFX (Qix), Physics (Phieg), Cutscene scheduler (Cut), Memory management
  • Application::Scene::Actor (273) — Game actors: CharaActor, CameraActor, GameManagerActor, Map instances
  • Application::Lua::Script (242) — Lua scripting bindings (166 documented Lua API functions)
  • Application::Main::Element (221) — UI elements and HUD
  • Application::Network (300+) — Three IPC channels: Zone, Lobby, Chat (each with packet builders and connection managers)
  • Sqwt (685 classes) — Full WPF-inspired UI framework with XAML markup, data binding, templates, routed events, animations, dependency properties, visual tree, input system, document model

C# Struct Library

2,569 explicit-layout structs across 104 files, organized to mirror the original C++ namespace hierarchy. Key structs with confirmed data from RE:

Struct Size VTable VFuncs Notes
CharaActor 0x2BB0 (11,184 bytes) 0x00FC0D34 188 Player/NPC/enemy actor. 40 embedded sub-objects including CharaActionController, CutSceneManager, OcclusionBoundary, 2x TargetInfo
CharaElement 0xEF0 (3,824 bytes) 0x00FA7C50 14 Character UI element
TargetActor ~0x09C0 0x00FB83CC 160 Base for system actors. 79 fields, 16 sub-objects, 37-entry property array at +0x0914
GameManagerActor ~0x09C0 0x00FB8134 164 Central manager. PostEffectController (15 screen-space filters), inherits TargetActor
BootupActor ~0x09C0 0x00FB86C4 164 Boot/login sequence. Near-identical to TargetActor, inherits through CDevActor
CameraActor ~0x400 0x00FB906C 164 Camera manager. 11 context types (FPS/TPS/WoW/CharaCreate/CharaFocus/CharaSelect)
PostEffectController ~0x410 0x00FB7DC8 3 15 PostFilterBase-derived filters: Blur, ColorCorrection, CrossFade, DoF, Fog, Gamma, Glare, Latitude, LUT, PlaneFade, Shadow, SSAO, TargetEffect ×3, VolLight
Actor (base) ~0x100 0x0109CA94 89 Base for all scene actors
SocketBase 0x1A4 (420 bytes) 0x011132DC 18 WinSock2 abstraction. Mutex, ring buffers, stats counters, endpoint info
RUDPImpl ~0x300 0x01113378 14 RUDP2 state machine. Retransmission, selective ACK, keepalive

Crystal Tools Engine (1,002 structs across 39 files)

Complete mapping of all Crystal Tools engine subsystems extracted via RTTI from the 1.23b binary:

Subsystem Structs Files Key Types
Fw — Framework 28 2 ApplicationConfiguration (12 config types), SceneObject Actor (16 base actor types)
Common 36 3 ISceneObject hierarchy (30 types), Task system (5), Timer
Memory 42 1 IAllocator, SystemHeap, Alternative heap families (Separate/Removable/Receivable/Detachable/System × Block+Space+Debug, nested Serializer/Chunk)
Math 2 1 DelegateHolderBase, TDynamicArrayFloatPoint3
Media 5 1 Media subsystem base types
Dw — Rendering 183 5 Renderer (109), SceneGraph (36), Animation (28), RenderInterface (6), ResourceLoader (4)
Lay — Layout 150 6 Stella engine: Layout (65), Default (44), External (17), StellaCore (12), Display (10), Resource (2)
Cut — Cutscene 175 3 Plugins (100 clip/actor/scheduler types), Scheduler (59 state machine types), CutScene (16 listeners)
Vfx + CDevVfx — VFX 183 8 VfxResourceFormat (48 nested attributes), Qix (44 graph/node), CDevVfx (37), IVfxObject (19 interfaces), VfxResourceModel (11), Common/Renderer/RenderInterface (24)
Sd — Sound 102 3 Driver (77 incl. 27 XA2 XAPO processors), Layout (22 spatial sound), Whiz (3)
Phieg — Physics 96 6 ClothDynamics (30 constraints/forces), RigidDynamics (21), Collision (14 GJK convex), Controller (13 IK/ragdoll/wind), IKDynamics (10), Base (8)

Sqwt UI Framework (685 RTTI classes)

Square Enix Widget Toolkit — a full WPF-inspired UI framework used for all of FFXIV 1.0's interface: character creation, HUD, menus, chat, config, map screen, nameplate overlays, and login screens.

Core hierarchy mirrors WPF: Object → DependencyObject → Visual → UIElement → FrameworkElement → Control → ...

Subsystem Struct Count Key Types
Core 20+ AllocatorBase, DependencyObject, DependencyPropertyInfoBase, ControlTemplate, DataTemplate, Style, TriggerBase, Trigger, Setter, EventArgs, Delegate
Visual Tree 10+ Visual (23 vfuncs), UIElement (39), FrameworkElement (65), Window (79), InputElement (72), Brush, SolidColorBrush, Transform, DrawingContext (44), Matrix
Controls 35+ Control (70), ContentControl (71), Button (73), CheckBox (76), ComboBox (72), TabControl (72), Panel (68), StackPanel, Canvas, Border, Image, ProgressBar (73), ScrollContentPresenter, TextChangedEventArgs
Controls::Primitives 15+ ToggleButton (76), RepeatButton (73), Selector (72), ScrollBar (73), TextBoxBase (94 — largest), Thumb (71), Track (67), Popup (65), BulletDecorator, IScrollInfo (31)
Input 30+ InputDevice, KeyboardDevice (7), Mouse, Keyboard, InputGesture (11), KeyGesture, MouseGesture, PadGesture, CharGesture, ICommand (4), NullCommand, CommandBinding, Cursor (65), Anchor (65), MouseElement
Animation 15+ Animatable (14), TimelineGroup (24), ParallelTimeline (24), Storyboard (24), AnimationTimeline (24), DoubleAnimation (24), BeginStoryboard, PauseStoryboard, ResumeStoryboard, StopStoryboard, StringKeyFrame
Markup (XAML) 80+ ConfigurationFactor (8), ControlCreateBase (9), XamlReader, XamlReaderAsync, 40+ MarkupObject types, 30+ ConfigurationFactor-derived factories
Data 5+ BindingBase (4), Binding (6), IValueConverter (18), SqwtXmlDataMaker (17), XmlAttr (10)
DocumentModel 8+ TextDocument (23), Element (5), LineTextDocument, WrapTextDocument, LineTextElement, WrapTextElement
Threading 4 Mutex, Thread (4), Timer, ParameterizedThreadStartBase
Xml 3 XmlDocument (3), XmlElemenBase (8), XmlElement (3)
Utility 5 EditorControler, File, WidgetParts, WidgetPartsActual, WidgetPartsRefference

Application Scene (421 structs across 9 files)

Scene-side game systems extracted via RTTI:

Subsystem Structs Files Key Types
Scene::Cut — Cutscene Playback 298 2 Clip (271 BaseClipImpl template instantiations + 7 light/listener clips), CutScene (27 Scheduler/Listeners/Register/CutScenePlayer)
Scene::Actor — Game Actors 53 6 CharaActor (188 vfuncs), TargetActor, GameManagerActor, CameraActor, BootupActor, MapActors
Scene Systems 70 1 Vfx (22 VfxActor/Controller types), Command::Window::DrawParam (12), Query (8 spatial), Controllers (5), System (3), misc (20)

Application Lua Scripting (221 structs across 8 files)

Complete Lua runtime and scripting bindings:

Subsystem Structs Files Key Types
Client::Control 66 1 58 control types (CharaBase, NpcBase, PlayerBase, WidgetBase, WorldMaster, SpreadSheet, CutScene, DesktopWidget) + TypeChecker templates
Client::Command 52 1 Network (31 packet receivers), System (11), Item (10 item commands)
Client::Event 29 1 28 event types + ExecutionClientSideBlockEvent
Client::Group 16 1 Group management (PropertyUpdater, MemberInfoUpdater, Entry)
Client (misc) 16 1 TextModuleAdapter, BehaviorLogger, RaptureSystemProxy, DisplayNameResolver
LuaTypes (existing) 28 1 Bindings (166 API functions), Work types (11 Information variants), Memory containers
InterfaceToSqwt 6 1 Lua↔Sqwt bridge (property/storyboard processors)
Common 4 1 NetworkParameterUnpacker, Control::Debug, Control::Global

Application Main UI (405 structs across 11 files)

Game UI windows, menus, and system elements:

Subsystem Structs Files Key Types
SqwtInterface 93 1 51 CustomControl types + 38 bridge types + XamlRaptureSsdDataReader
Menu::Bootup 79 1 CharacterCreation (34), Bootup root (30), Patch (17), Retainer (5)
Element::Window::Widget 75 1 80 game window widgets (inventory, chat, party, action bar, etc.)
Element (misc) 43 1 Chara (8), Form (13), Map (3), Effect (3), Light, root elements (16)
Menu (non-Bootup) 38 1 Common (14), MessageDialog (6), ErrorDialog (6), Installer (6), Controls (2)
Element::System 27 1 Phase system (15), CameraElement, TargetElement, WeatherElement
Element::Window::Debug 26 1 Debug windows (16) + LuaDebug (6) + Start (4)
Main (root) 9 1 MainModule, Shell, RaptureModule
Element::Window (misc) 3 1 WindowPositionConfig
CharaElement (existing) 6 1 CharaElement, BootupElement, CameraElement, CustomControlElement, CommonResourceElement, TargetInfo
Widgets (existing) 6 1 CommunicationWidget, ActionEquipWidget, ConfigWidget, AetheryteListWidget, CommunityMenuWidget, BazaarEditWidget

Component Modules (147 structs across 13 files)

Framework-level modules:

Module Structs Key Types
Lua::GameEngine 65 LuaControl, WorkMemory (21 detail types), Work (18), MetamethodArray2D, Parameter, LpbLoader, Functor
Text 17 TextModule, Localize (MacroDecoder/Encoder, FontCode), TextModuleInterface
Excel 12 ExcelModule, ExcelSheet, ExcelEntry, language events, PAVExcelEntry cache types
Install 10 InstallWriter, InstallDecoder, InstallModuleInterface, WriterEntry
Patch 9 ZiPatch (file, chunks), PatchPhaseControl
Resource 7 ResourceManager, ResourceEvent, loaders
Network/IPC (existing) 6 IpcChannelTypes
Xml 5 DOM_Text, DOM_Node, DOMParser wrappers
Sound 5 SoundModule, SoundCache
Font 5 BitmapFont, OsFont, FontModule
Completion 4 Achievement/completion system
GAM (existing) 4 GAM module types
Log 2 LogModule

Sqex SDK (51 structs)

Platform SDK types outside the engine:

Module Structs Key Types
Input 15 Keyboard, Mouse, Pad, Cicero IME, TextService, SoftKeyboard
File 10 DivFile, LocalFile, LocalDir (Copy/Find/Remove executors), ResourceSafePath
Crypt 5 Cert, Crc32, ShuffleString, SimpleString, CryptInterface
Http 5 HttpClient, HttpRequest, HttpHeader
Upnp 4 UpnpService, UpnpPortMapping, UpnpDeviceFinder
Thread 4 Mutex, ReadWriteLock, ThreadManager
Data 3 BlockMemory, PackRead, PackWrite
Socket (existing) 14 SocketBase, RUDPImpl, SocketWinsock, Poller
Misc 3 Config, AnyType, NonCopyable

Application::Misc (19 structs)

Configuration and support modules: GameConfig, UserConfig, SystemConfig, ResourceConfig (with ConfigChangeEvent), FontModule, LogModule, MacroModule, SoundModule, TextureManager, RaptureSupportModule, StringTable, AsyncWork.

Network Architecture

Three IPC channels, each with its own connection manager, packet builder, socket thread, and buffer infrastructure:

Channel Opcodes Purpose
ZoneProtoChannel 199 Game world: movement, combat, inventory, NPCs, status effects
LobbyProtoChannel 14 Login: auth, character list/create/delete, world entry. Has crypto engine
ChatProtoChannel 10 Chat: say, shout, tell, party, linkshell, system messages

Transport stack: SocketBase → SocketWinsock → SocketImpl → RUDPSocket → RUDP2::RUDPImpl

RUDP2 segment types: SYN, ACK, DAT, EAK (selective ack), NUL (keepalive), RST (reset) — follows RFC 908/1151 naming.

Project Meteor Cross-Reference

Server-side field names from Project Meteor mapped to client binary structures:

  • Modifier enum (132 entries) — stat/property IDs used in SetActorProperty (0x0137) and buff system
  • BattleTemp.generalParameter[35] — runtime stat indices (STR=3, VIT=4, DEX=5, INT=6, MND=7, PIE=8, elemental resist 9–14, Acc/Eva/Atk/Def 15–18, magic 23–28, craft 30–34)
  • SubState bitfield — breakage, chantId, guard, waste, mode, motionPack
  • 28 AppearanceSlot indices — character visual state (gear slots 5–27, face/body 0–4)
  • ParameterSave — HP[8], MP, 40 recast timers, skill slots, ability cost points
  • Zone opcodes (150+) — AddActor 0x00CA, SetPosition 0x00CE, SetAppearance 0x00D6, SetState 0x0134, CommandResult 0x0139, SetStatus 0x0177, etc.
  • Wire format — BasePacket (0x10) → SubPacket (0x10) → GameMessage (0x10, opcode at +0x02)

Lua Script API (166 bindings)

Complete extraction of the Lua-exposed client API. 242 RTTI classes under Application::Lua::Script, with 109 bindings mapped to exact registration addresses in the 0x00749900–0x00757100 range. Organized into 13 categories:

Category Count Address Range Key Functions
World/Zone 9 0x7499D9–0x74A459 _getRegion, _getZoneName, _canRideChocobo, _isInn
Character/Actor 22 0x74A5A9–0x74C289 _getPosition, _getDirection, _getActorMainStat, _getSubStat*
Party/Group 12 0x74C529–0x74D789 _getMember, _countMember, _getMemberLocation
Items/Inventory 21 0x74DB79–0x7561D9 _getItem, _getCatalogID, _isStackable, _isRare
Grand Company 4 0x74F319–0x74F709 _getGMRank, _getBelongGrandCompany
Interaction 9 0x74F8F9–0x750B59 _play, _isTalkable, _isEmotable, _isPushable
UI/Widgets 7 0x750F49–0x757049 _getParentWidget, _getChildWidget, _setKeyboardFocusedWidget
Target/Cursor 5 0x751339–0x7521A9 _getTargetCharacter, _getLookAtCharacter, _getLastAttacker
Config/Macro 5 0x751B19–0x752059 _getUserConfig, _parseTextCommand, _getUserMacro*
Player/Time 12 0x752839–0x753B29 _getMyPlayer, _getServerTime, _getHydaelynHour/Day/Time/Moon
Nameplate 3 0x72E979–0x72EC19 _setNameplateIcon/Gauge/Visible

Engine infrastructure: GameEngine (ErrorHandler 68 vfuncs, SharedWorkInterface 28 vfuncs, StackOperator 9 vfuncs), 11 Work::Information types (29 vfuncs each), Memory subsystem (Container 20 vfuncs, Operator 16 vfuncs), 50+ Command::Network packet receivers, 9 Item command types.

Analysis Tools

The FFXIVClientStructs.Tools.CLI project provides automated analysis directly from the exe:

--rtti              Dump full RTTI database (4,358 classes with inheritance)
--imports           Dump import table (21 DLLs, ~400 functions)
--vtable <class>    Dump complete vtable for any RTTI class
--vtfuncs <class>   Analyze vtable functions: size, params, stub/pure detection
--analyze <class>   Extract struct layout from constructor: field offsets, sizes, embedded sub-objects, base ctor chain
--hierarchy <class> Show full inheritance tree (base classes + derived classes)
--search <pattern>  Search classes by name pattern
--strings <class>   Extract string references from class constructor and vtable functions
--findstr <string>  Find all cross-references to a string literal in .text
--all               Run all dumps (rtti + imports)
--exe <path>        Override path to ffxivgame.exe

Examples:

dotnet run -- --analyze CharaActor

// Application::Scene::Actor::Chara::CharaActor
// VTable: 0x00FC0D34 (188 vfuncs)
// Ctor:   0x0065F180
// Size:   0x2BB0 (11184 bytes)
//
// === Base Class Constructors ===
//   RaptureActor (ctor=0x..., vt=0x00FEA50C, 12 fields)
//
// === Fields (from constructor init) === [44 total]
// +0x0154 [float ] = xmm0
// +0x0158 [float ] = xmm0
// +0x1170 [dword ] = 0x000000ED
// +0x1178 [dword ] = 0x000000C9
// ...
// === Embedded Sub-Objects === [40 total]
// +0x2858 CharaActionController (vt=0x0103E468)
// +0x2B60 CharaCutVisualCtrl (vt=0x0104447C)

dotnet run -- --hierarchy CharaActor

// Inheritance hierarchy for: Application::Scene::Actor::Chara::CharaActor
//
// Direct + transitive bases:
//   <- Application::Scene::Actor::CDevActor
//   <- Application::Scene::RaptureActor (vt=0x00FEA50C)
//   <- SQEX::CDev::Engine::Fw::SceneObject::Actor (vt=0x0109CA94)
//   <- SQEX::CDev::Engine::Common::ISceneObject::IActor
//   <- SQEX::CDev::Engine::Common::Misc::NonCopyable

dotnet run -- --vtfuncs CharaActor

// Summary: 188 total, 0 pure virtual, 30 stubs
// vt[  0] 0x00669E20 (6B) thiscall(this) [STUB]
// vt[  1] 0x006207D0 (135B) thiscall(this)
// vt[ 23] 0x00661F00 (140B) thiscall(this, arg1, arg2)
// ...

Building

Requires .NET 8.0 SDK.

dotnet build --configuration Release

Project Structure

FFXIVClientStructs/
  Attributes/         Custom attributes for marking RE data
  Interop/            SignatureScanner, Memory, Pointer<T>, GameInfo
  STD/                MSVC x86 std::string, std::vector, std::map
  SQEX/CDev/Engine/   Crystal Tools engine (1,002 structs)
    Fw/               Framework, SceneObject Actor (28)
    Common/           ISceneObject, Task, Timer (36)
    Memory/           Allocators, Alternative heap families (42)
    Math/             DelegateHolderBase, TDynamicArray (2)
    Media/            Media subsystem (5)
    Dw/               Rendering: Renderer, Animation, SceneGraph, RenderInterface, ResourceLoader (183)
    Lay/              Layout: Stella engine + Default (150)
    Cut/              Cutscene: Plugins, Scheduler, Listeners (175)
    Vfx/              VFX: Qix, VfxResourceFormat/Model, Common, Renderer, RenderInterface (146)
    CDevVfx/          VFX bridge layer (37)
    Sd/               Sound: Driver/XA2, Layout, Whiz (102)
    Phieg/            Physics: ClothDynamics, RigidDynamics, Collision, Controller, IK (96)
  FFXIV/Application/  Game-layer structs (1,085 structs)
    Scene/            Actor (53), Cut (298 clip types), SceneSystems (70)
    Script/Lua/       Lua scripting: Client (179), InterfaceToSqwt (6), Common (4), LuaTypes (28)
    Main/             UI: Element (175), SqwtInterface (93), Menu (117), MainTypes (9)
    Network/          ZoneProto, LobbyProto, ChatProto channels (43)
    Misc/             Config, support modules (19)
    Game/             GameEnums
  FFXIV/Component/    Framework modules (147 structs)
    Lua/              GameEngine runtime (65)
    Text/             Localization (17)
    Excel/            Spreadsheet data (12)
    Install/          Installer (10)
    Patch/            ZiPatch (9)
    Resource/         Resource loading (7)
    Sound/, Font/, Xml/, Completion/, Log/ (21 combined)
  SQEX/SqexSDK.cs     Platform SDK: Input, File, Crypt, Http, Upnp, Thread, Data (51)
  Sqex/Socket/        Transport layer (SocketBase, RUDP2 segments, Poller) (14)
  Sqwt/               UI framework (685 classes)
    SqwtCore.cs        Core types, templates, triggers, dependency properties
    Visual.cs          Visual tree, UIElement, FrameworkElement, Window, Media types
    Controls/          Controls (35+) and Primitives (15+)
    Input/             Input devices, gestures, commands, bindings, visual overlays
    Media/             Animation system (timelines, storyboards)
    Markup/            XAML parsing, control factories, markup objects (80+)
    Data/              Data binding, value converters
    DocumentModel/     Text document model for TextBox/LogControl
    Threading/         Mutex, Thread, Timer
    Xml/               XML DOM wrappers
    Utility/           Editor and widget helpers
  Tools/              RttiDumper, ImportTableDumper, StructAnalyzer, VtableAnalyzer, StringExtractor

FFXIVClientStructs.Tools.CLI/
  Console tool for automated binary analysis

ffxiv_1.0_rtti.txt      Full RTTI database (pre-generated)
ffxiv_1.0_imports.txt   Import table dump (pre-generated)

Status

This is an active RE project. The infrastructure, tools, and RTTI database are complete. Individual struct field mappings are being filled in progressively through static analysis and runtime verification. Contributions welcome — the binary is frozen, so all findings are permanent.

Related Projects

License

MIT

About

Reverse-engineered client structures for Final Fantasy XIV 1.0 (1.23b) — Crystal Tools engine. 4,358 RTTI classes, vtable maps, Lua API bindings, and automated struct analysis tools.

Resources

Readme

License

MIT license
Activity

Stars

1 star

Watchers

0 watching

Forks

0 forks
Report repository

Releases 1

v1.0.0 — Complete RTTI Mapping (2,569 structs) Latest
May 18, 2026

Packages

 
 
 

Contributors

Languages