Downloaded AEGIS material and remaining evidence
Timeline · Mechanics history · Research gaps · ภาษาไทย
Inspection edition: 2026-10-28. This appendix records what was recovered from the local AEGIS collection and what still requires historical evidence. Decoded data is a candidate profile until its region, build and effective period are established. Historical dates and release-readiness flags are unchanged.
Inspection and extraction coverage
The original collection contains 12,040 regular files, excluding macOS metadata. Every loose file has a coverage record: text/workbook extraction, image/asset or PE inspection, a dedicated archive/database/GRF analysis, media/manual extraction, or an explicit opaque-format entry. The inspection summary joins these records. It does not claim that every native program's behavior has been reverse engineered.
| Material | Recovered result | Detailed evidence |
|---|---|---|
| Archives and packaged executables | 622 carrier references, 333 unique candidates: 142 fully decoded and hashed, 163 PE resource inventories, 20 unrecognized format probes and 8 partial payload boundaries | Carrier coverage |
| GRFs | 11 recovered carriers; 543,761 decoded files and 1,306,479,077 decoded bytes; no payload decode/length failures | GRF summary, findings |
| Alpha GRF | All 3,259 members decoded and extracted; 31 complete map triples | Full Alpha inventory |
| SQL Server files | Hashed database variants, catalog tables, primary-row candidates and candidate stored procedure/view text; physical source locations retained | Database summary, decoder validation |
| Text and spreadsheets | Every loose text candidate and all 14 loose XLS/XLSX occurrences preserved; including archive variants, 13 distinct workbook byte sets and 144 sheets exported (8 distinct cell profiles) | Text and workbook ledger |
| Native/managed programs | 184 unique loose PE candidates inspected structurally; all 11 managed PE candidates inspected with REA metadata tools | Binary headers, managed Evidence summary |
| Other loose material | Word installation guide and PDF manual text extracted; WAV payloads and MP3 metadata inspected; 70 helper/debug/other files initially listed by header/hash; 12 loose PDB occurrences additionally inventoried as symbols | Miscellaneous coverage |
Raw assets, source, SQL exports and decoder Evidence are retained locally under archives/aegis-derived/. Raw account/session/database exports are outside the site's automatic research-JSON publication. The original downloads were read without running their game programs, SQL procedures, scripts or macros.
The raw BIFF check found no Formula/Array/SharedFormula records in the 12 XLS byte variants; the remaining workbook is XLSX, for which stored formula text and cached values are separately retained. See formula coverage. This inspection does not execute macros or recalculate cells.
Alpha map material now recovered
alpha.grf has SHA256 b9479c2822aeb635c2c008f3625f900a938107fc5ff7900e97f4b319b82fc2df, inside alpha-maps.zip with SHA256 ab9e456de078510bc9c944510812bce09e40fc5a201f3a10de56989d445bde7d. Its format version is 0x103. All 3,259 members, totaling 277,259,996 decoded bytes, passed stream-completion and declared-length checks.
There are 31 complete GAT/GND/RSW map triples covering candidate Prontera, Morroc, Geffen, field, interior and dungeon resources. The payload also contains 350 RSM models, 2,006 BMPs, 323 TGAs, 230 STR files, 19 ASE model-source files and two PSDs. The complete map names, GAT dimensions/cell types, ground/model texture references and decoded-file hashes are retained in the inventory.
Known ground-texture, model-texture and supported scene-model references resolve within this GRF. Twenty-nine scene layouts parse through the supported reference audit. prt_dugn00 and prt_dugn01 each end in an unresolved 72-byte legacy type-2 record containing a sprite name; the raw tails are preserved. Particle/effect mappings, water-animation families and other unsupported references remain outside that audit. Resource decoding is not proof of a successful historical-client render.
The pack is not a demonstrated complete 2001 client. Its lookup tables reference absent b1_* maps, including Beta-named Alberta, Payon and Lutie entries; map-category data includes guild/siege/PvP flags. The ZIP's six MP3 files contain five unique recordings because 2.mp3 and 6.mp3 are identical. Their names do not directly match the music table's zero-padded references. No server monster, EXP, drop or recovery dataset was identified in the GRF's text entries.
The old “Alpha GRF has not been inspected” gap is closed. Exact historical map selection, resource/client pairing and period rules remain open. The two legacy scene tails are a local decoder task, not evidence that their bytes are lost.
What the database extraction establishes
The final readable set contains 83 unique MDFs: 61 loose files and 22 additional archived variants. It exposes 1,017 table catalogs, 75,348 primary-row candidates and 5,882 candidate procedure/view texts across snapshots, including repeated schemas and administration/account tables. These are not counts of independent historical gameplay records.
The MDF inspector reads copies offline. It restores SQL torn-page sector bits in memory, uses allocation metadata to identify table pages, accounts for hidden clustered-index variable prefixes, and retains database hash plus page, slot and byte offsets for decoded rows. Original files remain unchanged.
These details matter: the uncorrected parser omitted level-one EXP, misaligned monster names and returned zero rows for a rebuilt monster table. Real-file negative controls demonstrate the changes: 98 to 99 EXP rows including level 1 with raw EXP 4; a shifted name field corrected to PORING; and 0 to 1,471 candidate monster rows after allocation mapping. The validation record preserves the controls and their scope.
| Comparison | Observed raw difference | Interpretation |
|---|---|---|
| Poring Base EXP | Some ASB3/EP10 database candidates contain 14; EP7/ASB4 candidates contain 2 | A sevenfold data difference; do not assume a common neutral baseline or infer Thai activation dates. |
| Mummy Base EXP | ASB5.5 candidate 800; EP7/ASB4 candidate 488 | Keep different candidate profiles and identify the applicable historical version. |
| Poring card slot | EP7 candidate raw rate 20; ASB4/ASB5.5 candidate 1 | Raw units and roller semantics still need verification before interpreting probability. |
| Red Potion weight | EP7 candidate raw value 10; later candidate 70 | Do not silently normalize or substitute one file's weight for another. |
| ASB4 Poring HP | Database candidate 50; loose MonParameter.scp contains 25 | Conflicting records inside one package; a file's presence does not prove the engine loads it. |
The exports include candidates for monsters, eight-slot drops, healing items, equipment, EXP, maps and supporting systems. They do not authenticate Thai beta data or a sequence of official Thai snapshots. All 30 raw monster fields for Poring, Mummy and Baphomet in one ASB4 MDF agree with the separately decoded English workbook sample; this supports byte-decoding consistency, while the sources can still share an ancestor.
Ghost/forwarded MDF records are counted and excluded; some variable tails, LOB pointers, bit fields, decimal scales and uncommon types remain qualified. Raw procedure/view text is a candidate extraction until coherence and dependencies are checked. The log follow-up below improves physical evidence without certifying a recovered database state.
LDF records recovered, with replay still open
All 83 unique LDFs, totaling 117,080,064 bytes, now have a bounded offline record inspection. The reader distinguishes the observed SQL 2000 and SQL 2005+ layouts, restores sector parity bytes in memory and validates VLF, block, slot and record boundaries. It retained 49,265 blocks and 476,748 record occurrences across 431 VLFs. These include INSERT, DELETE, MODIFY, begin/commit/abort and checkpoint records; repeated snapshots can contain the same changes. See log inventory.
All 83 logs have a candidate MDF pairing by container and database basename. In 24 logs, 8,226 bounded row-content elements exactly match the bytes of the paired MDF's current primary-row candidates at the recorded page and slot. This includes selected monster rows; it corroborates physical decoding, rather than independently authenticating gameplay values. Raw log records and account identifiers remain private. See row-image correlation.
The validation pass rehashed every retained block and record span against original bytes and passed six real-file controls for parity restoration, corrupted-sector rejection and truncated-VLF rejection. All original LDF hashes remain unchanged. Eleven rejected record spans are quarantined privately. There are 368,655 same-transaction predecessor links, 162 unresolved links to a different transaction identifier and 260 missing predecessors; these are not complete committed transaction chains. No supported card-page INSERT/DELETE image resolved the ASB5.5 card catalog's 538-versus-537 row discrepancy.
The “LDFs only hashed” gap is closed. SQL Server recovery is still open. No redo/undo replay, active checkpoint/MinLSN selection, page/log checksum verification, database-GUID pairing or engine consistency check has been performed. Stale/reused VLF generations and aborted work must not be applied as current rows. A compatible isolated engine comparison remains a local technical task, separate from outside historical sources.
Native debug symbols and bounded code observations
The symbol pass inspected 20 unique non-Saga PDBs from 36 loose/archive occurrences: 13 MSF7 and 7 legacy SmallMSF2 files. It exported 788,088 symbol-record occurrences; these are not 788,088 unique functions. Sixteen PDBs match declared CodeView identities and ages in 21 available PE variants; four remain unmatched. Patched executables can retain those declarations, so this pairing is not cryptographic authentication of an original build. See symbol findings and inventory.
Full module/source-file/symbol records are retained privately. Two legacy TPI versions remain semantically unsupported, with complete raw record fallback preserved. The initial 16 assembly snippets are now supplemented by a targeted recovery trace: 49 routine spans per build, with exact bytes, function callers, parameter/state writers, import bindings and bounded control-flow ledgers. See native findings, byte evidence, validation and cited-range validation.
The earliest matched candidate is the 20060113ZoneEP60Russian PE, SHA256 7644991da5054afd4686714fb2341296a2b09f9c9f5cfea42ccb9cd1d5f2dec9. Its loader reads [SETTING] NEWHPSP from RO.inf, with default and initialized value 1. That is an available configuration, not an observed historical deployment. Let H/S be effective MaxHP/MaxSP, V/I total effective VIT/INT, L character level and k passive skill level. Division below uses truncation toward zero; the simplified forms assume ordinary nonnegative values.
| Candidate branch | Verified ordinary arithmetic or threshold |
|---|---|
NEWHPSP=1, natural HP, no acceleration bonus | max(1, floor(H/200)) + floor(V/5); there is no additional unconditional +1. |
NEWHPSP=1, natural SP, no acceleration bonus | floor(S/100) + 1 + floor(I/6), plus floor((I-112)/2) when I >= 120. |
| New-mode HP interval | 6,000 ms ordinary / 3,000 ms sitting; IsMyAgitCase halves it, then a 1,000 ms minimum. Moving Recovery can permit moving HP at twice the resulting threshold. |
| New-mode SP interval | 8,000 ms ordinary / 4,000 ms sitting; Magnificat and IsMyAgitCase each halve it, then a 1,000 ms minimum. |
NEWHPSP=0, natural recovery | Flat +1; HP starts with T=(200-V)*15-14*L, SP with T=(125-I)*60, in milliseconds. |
| Ordinary passive skills | HP 5*k + trunc(k*H/500); SP 3*k + trunc(k*S/500) in new mode, with the SP maximum term omitted in old mode. Ordinary timer is 10,000 ms. |
Acceleration is not safe to simplify by flooring every term early. In the 2006 HP path, F=max(1,f32(f32(H)*0.5/100)), A=trunc(V/5), B=trunc((F+A)*f32(P)/100), then deltaHP=trunc(f32(B)+f32(A)+F), where P is HPAcceleration. Fractional H/200 survives until the percentage calculation and final conversion. For SP, A=trunc(S/100)+1+trunc(I/6) and deltaSP=A+trunc(A*Q/100)+C, where Q is SPAcceleration and C is the high-INT extra above; C is outside that percentage. The ledger retains floating-point/store and signed-width limits.
In old mode, a negative initial T becomes 100; the path then computes max(100,T-trunc(T*P/100)) for HP, or Q for SP, followed by separate sitting and Magnificat halves. There is no final 100 ms clamp after those halves. Do not assign this embedded old branch to Alpha or Thai beta without period evidence.
The timer import resolves to Windows timeGetTime, in milliseconds. Ordinary positive recovery uses unsigned now-last > T, so equality is not due; a successful check sets last to now, without a multi-tick catch-up loop. Actual delivery also depends on the server update loop. The 2006 ordinary natural path blocks at integer weight percentage >=50; movement suppresses passive timers and ordinary natural HP unless Moving Recovery applies, while natural SP remains eligible. Monk/effect paths are exceptions. Blocked states reset some timestamps but gate natural SP without resetting its timestamp; the ledger records the differences.
Passive NotifyRecoveryValue clamps to the supplied maximum. Natural recovery goes through parameter-update/HP/SP handlers with conditional cap fields whose full identities remain unresolved; these increments are not a universal guarantee of final applied gain. The 2013 Malaysia/Singapore candidate retains the ordinary arithmetic but changes floating-point details and adds later effect/weight branches. It must not replace the earlier implementation wholesale.
All 98 routine spans and two earlier exploratory spans rehash against the exact PEs; two wrong-age pairing controls and 14 arithmetic controls pass. All 41 cited VA ranges have aligned instruction bounds and byte hashes. These checks validate a reviewed static transcription. Remaining local work includes cap/one-shot flag lifecycles, every modifier route, overflow/precision edges and runtime comparison. The handler-constant-only gap is closed for these two candidates. Alpha/Beta formulas, Thai activation dates and exact regional configurations remain outside-evidence gaps.
Packaging and source corrections
Eleven loose EP10 .sc paths contain binary-like 1,024-byte data that exactly matches palette-file hashes. These include Sphinx, Prontera maze, Payon dungeon and several field-spawn files. The integrity ledger records every path and hash. Other bundles contain readable scripts with matching filenames, but none is automatically an authenticated same-era replacement.
Both LagnaroK NSIS installers now unpack without execution. One yields fdata.grf with 9,357 decoded files and three map triples; its client executable declares 2010-06-23 metadata. This is later resource material, not an authenticated Alpha client. Some of its resource references still require a matching base client. The archive integrity pass rejects CRC-mismatched or incomplete decoder output rather than treating full-length garbage as recovered data.
The previously missing seven ASB5.5 scripts are readable in its ZIP. Old Morroc's RAR payload, previously blocked by a compression-method limit, has now been decoded with a temporary official UnRAR build. Archive identities and decoder-tool provenance are recorded without overwriting the neighboring extracted folders.
Both LegendEmu_Source.rar and Saga_Legacy_Source.rar positively identify RO2 in their documentation or code. They do not supply original-RO AEGIS engine source. ROv1.3.rar is a later client overlay, without a literal base data.grf; Release2013.zip wraps later server/client/component ZIPs. The media packs are presentation assets. The file named 5. client.rar contains an encrypted video tutorial, not a complete game client; its payload remains unverified. Installer fragments and unsupported/protected formats remain explicit coverage boundaries in the archive ledger.
Internet search and additional downloads
The early-client search recovered a fuller Alpha client candidate from Sasami's retained download and Internet Archive. The two ZIP containers differ, but all 41 member payloads have identical SHA256 hashes and passed ZIP CRC checks. The IA container has SHA256 898cecaf0c298b0248abfa5f04c820bac9e8666b479a803f033f37c4dd5b9916.
Its data.grf and pdata000.grf through pdata025.grf use an older GRFv0/LZSS format. All 27 carriers decoded: 5,083 file records and 384,460,334 decoded bytes, with no length/span errors. Applying base data then numeric patches as an explicit static model produces 4,581 paths and 37 complete map triples; 2,528 overlay entries have payload hashes absent from the previously decoded Keldon GRFs. The package adds native client executables, sprite/animation/UI/audio assets and patch carriers. The claimed 2001-08-30 identity is corroborated by package/PE metadata, without a signed official lineage. Runtime loading order, deletion semantics, launch/login and protocol compatibility remain untested; this is one retained client revision, not every Alpha release. No matching official Alpha server, server source, numeric rules or maintenance sequence was found. Ridley's accessible NPC/Beta-map assets add community material, with provenance limits recorded separately.
The later-package search verified live AEGIS downloads, including ASB6/7. Four inspected AEGIS packages contain binaries/data but no original engine C/C++/C# source. Their documented content is Renewal-era; ASB7 Beta2 explicitly imports rAthena EXP/HP/SP/stat/monster/timing data. Its distribution version is not an episode number. Five downloaded archives, including a partial C# InterServer reimplementation, passed decompression/CRC checks. That InterServer source is not the complete Gravity engine.
The often-cited preserved ASB Mega folder is named AEGIS keldon: all 12,040 relative file paths and lengths match the existing download, with zero missing paths or size differences. This is a metadata comparison, not a fresh content-hash comparison. A larger live map pack adds later maps rather than a missing pre-Renewal chain. No fuller authenticated pre-Renewal AEGIS release chain was verified in this bounded search. That conclusion does not establish that no such archive exists.
Wider search for pre-Renewal and Alpha/Beta servers
A second search used three agents across early-server archives, European/Russian/Brazilian releases and Chinese/Japanese/Thai/Korean sources. The supporting catalog pass ran six Internet Archive queries returning 554 distinct records, then read metadata and original-file directories for all 241 software items from its broad Ragnarok query. Authenticated GitHub code search added native class/configuration identifiers. The comparison corpus contains 46,723 SHA256 identities from the previously inspected Keldon loose files, CRC-clean nested archives and decoded GRFs; new downloads are excluded from that baseline. See catalog search bounds.
| Downloaded material | Verified addition relative to Keldon | Historical qualification |
|---|---|---|
Archived Rentus rAegis.rar | 283 CRC-clean files, including 39 file occurrences absent from the previous loose/archive corpus; additional zone/loader variants, five MDF and five LDF variants and custom content | Its changelog identifies a community rAegis 2.1.4 release dated 2004-12-27. The two zone executables' code sections differ by only 2 and 6 bytes from the existing ASB2.0.1 family; this is a patch variant, not a new engine generation or an original Alpha/Beta server. |
| Xenophase source repository | Pinned commit c7bf89281c95a3c5cf909a14d0568eb940ad7449; all 5,433 ZIP members pass CRC and match the Git checkout. It adds substantial reconstructed Account/Character code, headers and hook interfaces | The repository has four application project definitions and seven DLL targets, but no tracked engine executable, PDB or database corpus. Guidelines explicitly discuss Hex-Rays reconstruction and debug symbols; many methods forward to absent target binaries. The 2009-named China tree includes third-job identifiers and Renewal-related branches, so its name does not identify a clean pre-Renewal build. |
| Preserved RagnarokHQ data/import tree | Pinned, hash-checked data and import tools; a distinct readable abyss.sc candidate where one loose EP10 path contains palette bytes | The monster table exactly matches existing ASB2/EP7 data, so it is not independent numerical proof. Most newly hashed server-data references differ only in line endings. The new Abyss script names H4D3S and prints 8/02/2006; that header does not authenticate a Thai date or a same-era replacement. |
The pre-Renewal package ledger distinguishes new container hashes, byte-level patches and semantic database differences. Some rAegis account/character/item-log primary values already match existing equivalents; its script database contains custom conversions/rate helpers and changed content. A novel MDF hash alone is not a new historical gameplay profile. Failed archive-decoder output is excluded from recovered-file counts.
A supplementary package audit rehashed all 283 retained rAegis files, totaling 31,228,727 bytes. Its five additional LDF hashes yield 2,134 bounded physical record occurrences whose retained spans rehash against the decoded source bytes. These are additional candidates, separate from the original 83-log corpus; they have no redo/undo or SQL-engine consistency qualification. The search also recovered a three-file InterEmuTest package containing an 8.5-zone packet database, a community test component rather than a complete authenticated server. Exact ASB3/rAegis installer duplicates and custom asset archives are recorded without treating them as new engine coverage.
The Alpha/Beta and source ledger records the reconstructed-source limits and early-server search outcomes. The Asian-source ledger separates recovered data from old ASB mirror text whose payload links are missing, a blocked 2004 Chinese client lead and other unverified source claims. Metadata, unavailable links and public page allegations are not downloaded server files.
The RagnarokHQ acquisition is pinned to 1c9dd27930fdb65db948da7cad141d7049d1821b: all 776 selected files match Git blob identities; 633 match the existing loose/archive corpus, and 142 file occurrences remain absent after including decoded GRF hashes. Of 28 differing server-data references, 25 are line-ending variants. Its importer reads eight drop slots and divides raw rates by 100 for website display; this is consumer-code context, not proof of the server's probability roller. The early-source lane also recovered four CRC-clean 2005 community skill-translation tables, which add client-side reference material without server rules.
This wider pass adds genuine AEGIS patch/data variants and useful reconstruction context. It does not provide a fuller authenticated, ready-to-run pre-Renewal installation or original Alpha/Beta server/source. No target executable, SQL procedure or downloaded script was run. No historical date, regional rule or release-readiness flag is changed by these findings.
Gaps that still need outside sources
| Historical gap | Evidence still needed |
|---|---|
| Exact Alpha build identity | Authenticated distribution/patch lineage for the retained 2001-08-30 client candidate, matching server evidence and missing intermediate revisions; two mirrors and timestamps do not establish official identity. |
| Early numerical rules | Region- and version-specific Alpha/Beta/Thai CBT/OBT recovery, combat, skill, EXP, monster, drop and economy records, or controlled period observations. Later repack data cannot supply earlier dates. |
| Complete patch sequence | Weekly/emergency maintenance and completion records, postponements, minor changes and rollbacks. The milestone list is not every historical release. |
| Thai applicability of conflicting profiles | Thai snapshots or period records binding actual values to a realm/build and effective period. English/Russian/China/community labels do not establish that binding. |
| Matching client and patch lineage | Original era executables, resource sets, patch manifests, Thai localization and protocol evidence at each necessary compatibility boundary. |
| Realm/events/final pre-Renewal state | Realm-specific settings, eligibility, stacking, reward activation/expiry and the exact successful 2009–2010 maintenance state before November 9, 2010. |
| Wipes, conversions and bug lifetimes | Dated reset/migration rules, before/after state and defect/fix evidence. A continuous local character is a separate design policy where history used resets or separate services. |
| Missing-period engine behavior | Matching original-RO period source/binaries or sufficient independent behavioral evidence. Source code is one possible route to proof, not the only route. |
The machine-readable gap register keeps these outside-evidence needs separate from local work: SQL-engine reconciliation, native-function analysis, legacy scene decoding, unresolved installers, candidate script replacement and release implementation. Those technical limits must not be described as proof that historical evidence is absent.
Reproduction and validation
The optional offline inspection tools are retained separately under archives/aegis-derived/tooling/, with identities in the tooling manifest. They are not part of the reader setup or runtime. Their ledgers retain input identities, tool/parser references, output locations and limits. Raw payloads are deduplicated by hash. The large palette index is compressed privately to avoid creating more than half a million ordinary files.
The inspection summary and validation record distinguish successful payload decoding, candidate SQL rows, structural metadata and unresolved coverage. No stage becomes historically qualified because extraction succeeded.