FlandersMod — reverse-engineering documentation
Notes from unpacking FlandersMod.exe and decompiling the two native binaries it carries.
Everything here was produced by static analysis only — nothing was executed.
Contents
| Doc | What's in it |
|---|---|
| architecture.md | How the pieces fit together: the .NET launcher, the d3d8-proxy DLL, the server, and the .lmlm mods |
| decompilation-notes.md | How the decompile was done, tool versions, and the limits of the output |
| issues.md | The issue register — every problem found, with evidence, location and a fix |
Source material (in the repo)
decomp/payload/— the 18 files extracted fromFlandersMod.exedecomp/native/FlandersMP_dll/— decompiledFlandersMP.dlldecomp/native/FlandersMP_Server/— decompiledFlandersMP_Server.exedecomp/*.txt,decomp/resources_manifest.json— the .NET launcher's metadata and strings
How to read a finding
Each issue in issues.md has a confidence tag:
- Confirmed — the decompiled code or a string literal shows it directly.
- Likely — strongly implied by strings/structure, but I didn't trace every path.
- Needs verification — a concern worth checking by hand in the Ghidra GUI.
Nothing here is a judgement that the mod is malware. It's a code-quality and robustness review of a hobby project, plus the security notes you'd want before running the server on a public port.