11-Year Reverse Engineering Effort Brings Co-op to DOS Wing Commander

A developer spent 11 years reverse-engineering DOS Wing Commander to enable cooperative multiplayer with his brother. Starting in October 2015, he realized the entire game fit within 640K of memory and began using memory dumps and comparisons to identify coordinates. He narrowed the player ship position to address 13D3:A9C2 by analyzing which bytes changed during movement.

Finding rotation vectors proved more complex, requiring analysis of how the game encoded vectors with 256 representing 1.0. By December 2016, direct memory writes proved insufficient for complex mechanics like firing weapons, prompting him to develop a trampoline system that invoked the game’s own functions from specific memory addresses. He located a stable hook in the main loop at 0560:20E3 and disabled damage calculations on the secondary player’s instance by July 2017.

That August, he implemented a TCP client-server architecture using protobuf messages. Each frame, the leader transmits ship position, firing events, despawning, and damage information; the secondary player sends position, firing events, and catastrophic events. Each player’s instance treats their own craft as entity 0 and the opponent’s as entity 1, with incoming packets either modifying memory or queuing events for processing that frame.