Okay, so, the engine does the following in engine_open() to load the WRS:

Code:
10046563 A154031F10                      mov        eax, dword [ds:0x101f0354]
10046568 50                              push       eax
10046569 E822C1FEFF                      call       sub_10032690
1004656e 83C404                          add        esp, 0x4



0x101f0354 is the address which contains the address to the WRS section inside the acknex.dll. It's akin to the following code C:

Code:
sub_10032690(*(char **)(0x101f0354));



sub_10032690() is also called by add_resource(), and it appears to first do some processing/sanity checks on the string and then call into sub_10032690(), so it's fair to assume that simply pumping anything that looks like a WRS into add_resources() will do the trick.

Ideally you would want to get the address to the WRS, hardcoding is meh because dlls change and that would break your stuff and ugh... Well, the symbol isn't exported, so no way. However, WRS has a header, the ASCII string "WRS3".

Sooo, to wrap it all up:
Load the acknex.dll into a buffer, search for the ASCII string "WRS3" (which exists twice, so you probably want to load both(?!)), and then pass the location where you found it into add_resources(). Tada, you are done.

Ideally, you look for the header at startup, store all locations, and then use the cached value, instead of looking for it over and over again.

Edit: You may be able to speed it up by starting your search around the offsets where the WRS files currently are, and only if you can't find it there (+/- 200 bytes or so), search through the whole file.

Last edited by JustSid; 01/16/14 17:16.

Shitlord by trade and passion. Graphics programmer at Laminar Research.
I write blog posts at feresignum.com