The Esoteric Path — 1.13c grimoire

A reverse-engineering canon for Diablo II: Lord of Destruction 1.13c (32-bit). 744 records covering functions, globals, structs, hooks and findings — every one carrying an explicit trust level, because most of them are not independently verified.

Read this before using any address.

Only 26 of 744 records are trust: verified. 360 are trusted, 267 are sourced (community corpus), 91 are untagged. Many sourced records carry the note "addresses may be 1.10f-era — rebase to 1.13c + verify before use." Treat an unverified record as a lead, not a fact.
Stock file bytes ≠ live process bytes. A running install is patched in memory by PlugY, SGD2FreeRes, D2DX and d2fps. An address that decodes one way on disk may be detoured at runtime. Record which you measured.
Never trust a cross-version mapping whose only evidence is a matching export ordinal. A 56-row stratified audit of ordinal-equality mappings between 1.10f and 1.13c failed 54/56 (96.4% raw; D2Common failed 16/16) — the export table was reordered between versions, so equal ordinal number does not mean same function. This is measured, not assumed.
Verify against the binary before you act. Every address here is an invitation to check, not a licence to patch.

Files

File	Size	Use it for
symbols.jsonl	557 KB	Start here if you are a program or a model. Line-delimited JSON — one record per line, parse with a loop. The canonical form; everything else is derived from it.
GRIMOIRE.md	394 KB	The same corpus as prose Markdown, grouped and cross-referenced. Better for reading and reasoning end-to-end; worse for lookup.
search.html	1.6 MB	Human browsing — self-contained page with client-side search over every record. Not useful to a crawler: the search needs JavaScript, so fetch the two files above instead.

Record schema

Two shapes coexist. The older, dominant shape is keyed on desc; 39 newer records use title/body. Handle both.

{
  "id":      "D2Client.DrawGame",      // unique key, referenced by refs[]
  "kind":    "function",               // see distribution below
  "module":  "D2Client",               // owning module (85% of records)
  "rva":     "0x44230",                // offset from module base (24% of records)
  "status":  "verified",               // sourced | verified | confirmed | open | testing | closed | noted
  "trust":   "verified",               // verified | trusted | sourced   <-- READ THIS FIELD
  "desc":    "main world render entry…",
  "source":  "['re:esoteric']",        // provenance; 'discord:…' = community corpus
  "note":    "corpus-sourced; may be 1.10f-era — rebase + verify",
  "locator": "…", "value": "…", "refs": ["other.record.id"], "fields": […]
}

Kinds (744 total)

function 291global 155struct 115 note 107finding 53openquestion 10 reference 5hook 4other 4

Trust

verified 26trusted 360 sourced 267untagged 91

Module bases (1.13c)

VA = module_base + rva. Bases are the stock load addresses; ASLR is not in play for these DLLs on a normal install, but confirm against your own process before trusting a computed VA.

Module	Base	Module	Base
D2Client.dll	`0x6FAB0000`	D2Common.dll	`0x6FD50000`
D2Game.dll	`0x6FC20000`	D2Win.dll	`0x6F8E0000`
D2Gfx.dll	`0x6FA80000`	D2Glide.dll	`0x6F850000`
Fog.dll	`0x6FF50000`

Note: D2Win's 1.10f base is 0x6F8A0000 and its 1.13c base is 0x6F8E0000 — a frequent source of bogus cross-version conclusions.

If you are a model, start here

Fetch symbols.jsonl and parse line-by-line.
Filter to trust == "verified" first — that is the load-bearing set.
Follow refs[] to assemble context; kind:"finding" and kind:"note" records carry the reasoning, not just the addresses.
Check kind:"openquestion" (10 records) — those are the known-unknowns, and the most useful place to contribute.
Treat anything sourced as a hypothesis to test against the binary.