Decompilation of 3D Pinball for Windows – Space Cadet
Go to file
Muzychenko Andrey 49f6132d23 Added loader for Full Tilt .dat files, v1.
Works with some data hacks in lowest resolution.
Seems to work ok, even though BL is still 3DPB.
2021-01-31 17:29:53 +03:00
Doc Added loader for Full Tilt .dat files, v1. 2021-01-31 17:29:53 +03:00
SpaceCadetPinball Added loader for Full Tilt .dat files, v1. 2021-01-31 17:29:53 +03:00
.gitattributes Add .gitignore and .gitattributes. 2020-10-04 09:28:35 +03:00
.gitignore Sound ready. 2021-01-23 19:28:29 +03:00
CompileForDrMemory.bat Fixed uninitialized memory. 2021-01-05 15:12:54 +03:00
LICENSE Create LICENSE 2021-01-29 19:47:23 +03:00 Added 2021-01-29 19:34:45 +03:00
SpaceCadetPinball.sln Add project files. 2020-10-04 09:28:38 +03:00


Summary: Reverse engineering of 3D Pinball for Windows Space Cadet, a game bundled with Windows.

How to play: Place compiled exe into a folder containing original game resources (not included).

Source: pinball.exe from Windows XP (SHA-1 2A5B525E0F631BB6107639E2A69DF15986FB0D05) and its public PDB

Tools used: Ghidra, Ida, Visual Studio

What was done:

  • All structures were populated, globals and locals named.
  • All subs were decompiled, C pseudo code was converted to compilable C++. Loose (C) subs were assigned to classes.

Project uses C++11 features and depends on Windows libs.
Compile with Visual Studio; tested with 2017 and 2019.


  • Decompile original game
  • Resizable window, scaled graphics
  • Loader for high-res sprites from CADET.DAT
  • Maybe: cross-platform port
    • Needs UI framework with menu bar and dialog windows, like QT or Avalonia
    • Needs a way play sounds and midi
  • Maybe x2: support for other two tables
    • Table specific BL (control interactions and missions) is hardcoded, othere parts might be also patched

On 64-bit bug that killed the game:
I did not find it, decompiled game worked in x64 mode on the first try.
It was either lost in decompilation or introduced in x64 port/not present in x86 build.
Based on public description of the bug (no ball collision), I guess that the bug was in TEdgeManager::TestGridBox