Add ExportDBCFiles console command

Companion to ExportInterfaceFiles: dumps every .dbc table the client
loads to DBFilesClient\ next to the exe. Reuses the same MPQ
enumeration + file-read pipeline (factored into a shared WriteFiles),
and unions two sources for a complete set:

  1. MPQ (listfile) under DBFilesClient\ — catches archive files with
     no loader (e.g. wowerror_strings.dbc).
  2. A .text scan for the DBC path-getter pattern
     (mov eax, &"DBFilesClient\X.dbc"; ret) — the authoritative list of
     what the build loads. The master DBC init (FUN_0053f8b0) is
     straight-line with no iterable name table, so the per-DBC getters
     are the registry; scanning for them is the technique that built
     docs/DBCs.md. Bounded reads, can't fault.

Listfile alone yielded 137; the union yields 155 (+18 cosmetic
anim/sound/lookup DBCs the listfile omits, 0 lost). Results deduped
case-insensitively. Verified in-game: old vs new extract diff is
exactly the 18 expected additions.

Author: brues-code

README.md

@@ -99,6 +99,7 @@ when launching with `-console`), not as Lua functions. See the
 |---------|--------------|
 | `ExportInterfaceFiles code` | Extracts Blizzard's UI source (`.lua`/`.xml`/`.toc`/`.xsd`) from the MPQs to `BlizzardInterfaceCode\` |
 | `ExportInterfaceFiles art` | Extracts Blizzard's UI art (`.blp`/`.tga`) from the MPQs to `BlizzardInterfaceArt\` |
+| `ExportDBCFiles` | Extracts the client's `.dbc` tables from the MPQs to `DBFilesClient\` |
 
 ### Events
 

docs/API.md

@@ -35,6 +35,7 @@ build instructions.
 
 - [Console](#console)
   - [`ExportInterfaceFiles art|code` (console command)](#exportinterfacefiles-artcode-console-command)
+  - [`ExportDBCFiles` (console command)](#exportdbcfiles-console-command)
 
 - [Container](#container)
   - [`C_Container.GetContainerItemID(bagIndex, slotIndex)`](#c_containergetcontaineritemidbagindex-slotindex)
@@ -878,6 +879,37 @@ Notes:
 - It runs synchronously and briefly freezes the client while it walks
   `Interface\` — expected for a one-shot extraction.
 
+### `ExportDBCFiles` (console command)
+
+A ClassicAPI-original companion to `ExportInterfaceFiles` that dumps
+every `.dbc` table the client loads to `DBFilesClient\` under the working
+directory (next to `WoW.exe`). No subcommand — there's only one thing to
+export.
+
+```
+> ExportDBCFiles
+ExportDBCFiles: wrote 155 .dbc file(s) to DBFilesClient\
+```
+
+Unlike the MPQ `(listfile)` alone (which omits ~18 of the tables the
+client actually loads — mostly cosmetic animation/sound/lookup DBCs that
+Blizzard left out of the index), this unions two sources for a complete
+set:
+
+1. the **MPQ `(listfile)`** under `DBFilesClient\` — catches files that
+   ship in the archives without a loader (e.g. `wowerror_strings.dbc`);
+2. a **`.text` scan for the DBC path-getter pattern**
+   (`mov eax, &"DBFilesClient\X.dbc"; ret`) — the authoritative list of
+   what this build loads. The master DBC init (`FUN_0053f8b0`) is
+   straight-line with no iterable name table, so the per-DBC getters
+   *are* the registry; scanning for them is the same technique that
+   built [docs/DBCs.md](DBCs.md).
+
+Results are deduped case-insensitively. Handy for a local DBC dump to
+inspect schemas/values directly — e.g. verifying a record's column
+layout against a known row, the way `C_Item.GetEnchantInfo`'s effect
+columns were confirmed — without a standalone MPQ extraction tool.
+
 ## Container
 
 ### `C_Container.GetContainerItemID(bagIndex, slotIndex)`

src/interface/Export.cpp

@@ -20,6 +20,14 @@
 //   code → .lua / .xml / .toc / .xsd  →  BlizzardInterfaceCode\...
 //   art  → .blp / .tga                →  BlizzardInterfaceArt\...
 //
+// `ExportDBCFiles` — ClassicAPI-original companion that dumps every
+// `.dbc` table the client loads to `DBFilesClient\`. It unions the MPQ
+// `(listfile)` with a scan of `.text` for the DBC path-getter pattern
+// (`mov eax, &"DBFilesClient\X.dbc"; ret`) — the latter is the
+// authoritative "what does this build load" list, since the master DBC
+// init is straight-line (no name table), and it catches the ~18 DBCs the
+// listfile doesn't index. See `ScanPathGetters`.
+//
 // Files land relative to the client's working directory, mirroring the
 // retail command's `BlizzardInterface{Code,Art}\<relative-path>`
 // layout. On completion it writes a "wrote N files" line back to the
@@ -55,6 +63,7 @@
 
 #include <cstdint>
 #include <cstdio>
+#include <cstring>
 #include <string>
 #include <unordered_set>
 #include <vector>
@@ -145,69 +154,123 @@ bool WriteFileToDisk(const std::string &relPath, const void *data, unsigned int
     return ok;
 }
 
-// Length of the "Interface\" prefix we strip from MPQ paths before
-// re-rooting under the destination folder.
-constexpr size_t kRootPrefixLen = 10; // strlen("Interface\\")
-
 const char *const kCodeExts[] = {"lua", "xml", "toc", "xsd"};
 const char *const kArtExts[] = {"blp", "tga"};
+const char *const kDbcExts[] = {"dbc"};
 
 enum Mode { MODE_CODE, MODE_ART };
 
-// Collector for the MPQ enumeration callback. File-static because
-// FUN_00401470 hands the callback only the path string; enumeration is
-// synchronous and single-threaded, so a file-static sink is safe.
+std::string LowerCopy(const char *s) {
+    std::string out;
+    for (const char *p = s; *p; ++p) {
+        char c = *p;
+        if (c >= 'A' && c <= 'Z') c = static_cast<char>(c + ('a' - 'A'));
+        out.push_back(c);
+    }
+    return out;
+}
+
+// Collector for the MPQ enumeration callback (and the path-getter scan).
+// File-static because FUN_00401470 hands the callback only the path
+// string; enumeration is synchronous and single-threaded, so a
+// file-static sink is safe.
 struct Collector {
     const char *const *exts = nullptr;
     int extCount = 0;
     std::vector<std::string> files;
-    std::unordered_set<std::string> seen; // dedup across archives
+    std::unordered_set<std::string> seen; // lowercased keys — dedup across sources
+
+    // Case-insensitive dedup so the listfile and the path-getter scan
+    // (which may differ in casing) never write the same DBC twice.
+    void Add(const char *path) {
+        if (seen.insert(LowerCopy(path)).second)
+            files.emplace_back(path);
+    }
 };
 Collector *g_collector = nullptr;
 
 // MPQ enumeration callback — one call per listfile entry under the
-// "Interface\" prefix. Keep going (return 1) regardless.
+// active prefix. Keep going (return 1) regardless.
 int __fastcall CollectCb(const char *fullPath) {
     Collector *c = g_collector;
     if (c != nullptr && fullPath != nullptr &&
-        HasExtension(fullPath, c->exts, c->extCount)) {
-        if (c->seen.insert(fullPath).second)
-            c->files.emplace_back(fullPath);
-    }
+        HasExtension(fullPath, c->exts, c->extCount))
+        c->Add(fullPath);
     return 1; // 0 would stop enumeration
 }
 
-// Enumerate every MPQ file under Interface\ whose extension matches
-// `mode`, read each, and write it under the destination root. Returns
-// the number of files successfully written.
-int ExportTree(Mode mode) {
-    auto MpqEnumFiles = reinterpret_cast<MpqEnumFiles_t>(Offsets::FUN_MPQ_ENUM_FILES);
-    auto FileRead = reinterpret_cast<FileRead_t>(Offsets::FUN_FILE_READ);
-    auto SMemFree = reinterpret_cast<SMemFree_t>(Offsets::FUN_STORM_SMEM_FREE);
-
-    const char *dstRoot =
-        (mode == MODE_ART) ? "BlizzardInterfaceArt" : "BlizzardInterfaceCode";
+// --- DBC path-getter scan ---------------------------------------------
+//
+// The DBC loaders aren't driven by any iterable name table — the master
+// init (`FUN_0053f8b0`) is straight-line, calling ~150 per-DBC loaders in
+// sequence, each of which calls its own one-instruction path-getter:
+//
+//     B8 <&"DBFilesClient\Foo.dbc">   mov eax, <strVA>
+//     C3                              ret
+//
+// So the authoritative, dynamic list of "what DBCs does this build load"
+// is the set of those getters. We recover it the same way docs/DBCs.md
+// did — scan `.text` for the `B8 imm32 C3` pattern and keep matches whose
+// immediate points at a `.dbc` string. This catches every loaded table,
+// including the ~18 the MPQ `(listfile)` doesn't index.
+
+// Build-specific bounds (this 1.12.1 client). `.text` per CLAUDE.md; the
+// image range bounds candidate string pointers so the suffix check never
+// dereferences unmapped memory. Getter strings live in `.data` (e.g.
+// Spell.dbc at 0x00859E30), comfortably inside the image.
+constexpr uintptr_t kTextStart = 0x00401000;
+constexpr uintptr_t kTextEnd = 0x007FEDAC;
+constexpr uintptr_t kImageStart = 0x00400000;
+constexpr uintptr_t kImageEnd = 0x00D26000;
+
+// True if `s` (bounded, never reading past the image) names a ".dbc" file.
+bool LooksLikeDbcString(const uint8_t *s) {
+    const uint8_t *limit = reinterpret_cast<const uint8_t *>(kImageEnd);
+    size_t n = 0;
+    while (n < 260 && s + n < limit && s[n] != '\0')
+        ++n;
+    if (s + n >= limit || s[n] != '\0' || n < 4) // not terminated, or too short
+        return false;
+    return EqualsCI(reinterpret_cast<const char *>(s + n - 4), ".dbc");
+}
 
-    Collector collector;
-    collector.exts = (mode == MODE_ART) ? kArtExts : kCodeExts;
-    collector.extCount = (mode == MODE_ART) ? 2 : 4;
+// Scan .text for the DBC path-getter pattern and add each referenced
+// ".dbc" path to the collector. Synchronous, reads only our own image.
+void ScanPathGetters(Collector &c) {
+    const uint8_t *p = reinterpret_cast<const uint8_t *>(kTextStart);
+    const uint8_t *end = reinterpret_cast<const uint8_t *>(kTextEnd) - 6;
+    for (; p <= end; ++p) {
+        if (p[0] != 0xB8 || p[5] != 0xC3) // mov eax, imm32 ; ret
+            continue;
+        uint32_t imm;
+        std::memcpy(&imm, p + 1, sizeof(imm));
+        if (imm < kImageStart || imm >= kImageEnd)
+            continue;
+        const uint8_t *s = reinterpret_cast<const uint8_t *>(imm);
+        if (LooksLikeDbcString(s))
+            c.Add(reinterpret_cast<const char *>(s));
+    }
+}
 
-    g_collector = &collector;
-    MpqEnumFiles(kArchiveSelector, "Interface\\", &CollectCb, nullptr);
-    g_collector = nullptr;
+// Read each collected source path from the MPQs and write it under
+// `dstRoot`, re-rooted by stripping the leading `prefixLen` chars (the
+// "Interface\" / "DBFilesClient\" prefix). Returns the number written.
+int WriteFiles(const std::vector<std::string> &files, size_t prefixLen,
+               const char *dstRoot) {
+    auto FileRead = reinterpret_cast<FileRead_t>(Offsets::FUN_FILE_READ);
+    auto SMemFree = reinterpret_cast<SMemFree_t>(Offsets::FUN_STORM_SMEM_FREE);
 
-    const std::vector<std::string> &files = collector.files;
     int written = 0;
     for (const std::string &src : files) {
         void *buf = nullptr;
         unsigned int size = 0;
         if (FileRead(0, src.c_str(), &buf, &size, 0, 1, 0) == 0 || buf == nullptr)
             continue;
 
-        // Re-root: "Interface\FrameXML\Foo.lua" -> "<dstRoot>\FrameXML\Foo.lua".
+        // Re-root: "<prefix>Sub\Foo.ext" -> "<dstRoot>\Sub\Foo.ext".
         std::string dst = dstRoot;
         dst.push_back('\\');
-        dst.append(src, kRootPrefixLen, std::string::npos);
+        dst.append(src, prefixLen, std::string::npos);
 
         if (WriteFileToDisk(dst, buf, size))
             ++written;
@@ -217,6 +280,47 @@ int ExportTree(Mode mode) {
     return written;
 }
 
+// Enumerate every MPQ file under `pathPrefix` whose extension matches
+// one of `exts`, read each, and write it under `dstRoot`. Returns the
+// number of files successfully written.
+int ExportTree(const char *pathPrefix, const char *const *exts, int extCount,
+               const char *dstRoot) {
+    auto MpqEnumFiles = reinterpret_cast<MpqEnumFiles_t>(Offsets::FUN_MPQ_ENUM_FILES);
+
+    Collector collector;
+    collector.exts = exts;
+    collector.extCount = extCount;
+
+    g_collector = &collector;
+    MpqEnumFiles(kArchiveSelector, pathPrefix, &CollectCb, nullptr);
+    g_collector = nullptr;
+
+    return WriteFiles(collector.files, std::strlen(pathPrefix), dstRoot);
+}
+
+// Export the DBC tables. Unions two sources, deduped case-insensitively:
+//   1. the MPQ (listfile) under DBFilesClient\ (catches files that ship
+//      in the archives without a loader, e.g. wowerror_strings.dbc), and
+//   2. the .text path-getter scan (the authoritative set the client
+//      actually loads — catches the ~18 DBCs absent from the listfile).
+// Every DBC path is "DBFilesClient\Name.dbc", so re-rooting strips that
+// 14-char prefix and writes under `dstRoot`.
+int ExportDBC(const char *dstRoot) {
+    auto MpqEnumFiles = reinterpret_cast<MpqEnumFiles_t>(Offsets::FUN_MPQ_ENUM_FILES);
+
+    Collector collector;
+    collector.exts = kDbcExts;
+    collector.extCount = 1;
+
+    g_collector = &collector;
+    MpqEnumFiles(kArchiveSelector, "DBFilesClient\\", &CollectCb, nullptr);
+    g_collector = nullptr;
+
+    ScanPathGetters(collector);
+
+    return WriteFiles(collector.files, std::strlen("DBFilesClient\\"), dstRoot);
+}
+
 // Console-command handler ABI: edx = the argument text after the
 // command name ("" when bare). Mirrors 4.3.4's `art`/`code` dispatch.
 bool FirstTokenEquals(const char *s, const char *token) {
@@ -246,7 +350,11 @@ int __fastcall Console_ExportInterfaceFiles(void * /*unused*/, const char *args)
         return 1;
     }
 
-    const int written = ExportTree(mode);
+    const int written = ExportTree(
+        "Interface\\",
+        (mode == MODE_ART) ? kArtExts : kCodeExts,
+        (mode == MODE_ART) ? 2 : 4,
+        (mode == MODE_ART) ? "BlizzardInterfaceArt" : "BlizzardInterfaceCode");
 
     char msg[160];
     snprintf(msg, sizeof(msg), "ExportInterfaceFiles: wrote %d %s file(s) to %s\\",
@@ -256,6 +364,21 @@ int __fastcall Console_ExportInterfaceFiles(void * /*unused*/, const char *args)
     return 1;
 }
 
+// `ExportDBCFiles` — ClassicAPI-original companion to ExportInterfaceFiles.
+// Dumps every `.dbc` table the client loads to `DBFilesClient\` under the
+// working directory. No subcommand — there's only one thing to export.
+// Unions the MPQ (listfile) with a `.text` path-getter scan so it gets
+// the complete set the client loads, including DBCs the listfile omits.
+int __fastcall Console_ExportDBCFiles(void * /*unused*/, const char * /*args*/) {
+    const int written = ExportDBC("DBFilesClient");
+
+    char msg[96];
+    snprintf(msg, sizeof(msg),
+             "ExportDBCFiles: wrote %d .dbc file(s) to DBFilesClient\\", written);
+    Game::Console::Write(msg);
+    return 1;
+}
+
 // Register the console command. A console command is process-global
 // (not Lua-state-bound) and persists for the whole session, so the
 // single registration at glue boot — the earliest hook, firing at
@@ -272,6 +395,11 @@ void EnsureRegistered() {
         Game::Console::CATEGORY_DEBUG,
         "Extracts Blizzard's UI files from the MPQs to disk. "
         "Usage: ExportInterfaceFiles art|code");
+    Game::Console::RegisterCommand(
+        "ExportDBCFiles", &Console_ExportDBCFiles,
+        Game::Console::CATEGORY_DEBUG,
+        "Extracts the client's .dbc tables from the MPQs to disk. "
+        "Usage: ExportDBCFiles");
 }
 
 const Game::GlueModuleAutoRegister _autoreg{&EnsureRegistered};