@Allnightcity
• 4 min read • Need for Speed, Static Recompilation, Reverse Engineering, PC Gaming, DirectX, Preservation, ARM64

Need for Speed Underground 2 Recompiled: 27,000 Functions Lifted from x86 to C as Native PC Port Roars to Life

The rain-slicked streets of Bayview are running natively. Using pcrecomp, developer codepdbh has statically recompiled Need for Speed Underground 2's x86 binary into 8.9M lines of C with zero lift failures, achieving native Direct3D 9 rendering and paving the way for an ARM64 Android port.

Need for Speed Underground 2 Recompiled: 27,000 Functions Lifted from x86 to C as Native PC Port Roars to Life

Released in late 2004, EA Black Box’s Need for Speed: Underground 2 defined an entire era of tuner car culture, open-world street racing, and neon-drenched night aesthetics. For modern PC players, however, running the vintage 32-bit Windows title has long meant wrestling with widescreen patches, no-CD executable hacks, and brittle compatibility wrappers. Now, a monumental engineering effort is changing that forever: developer codepdbh has achieved a working static recompilation of Need for Speed Underground 2, lifting the entire retail x86 game executable directly into native C code.

The project—hosted on GitHub as codepdbh/nfsu2-recompiled—utilizes the advanced pcrecomp binary translation toolchain. Rather than emulating the x86 architecture or reverse-engineering high-level C++ classes from scratch, the tool lifts machine instructions straight into compilable C. The result is a native desktop binary executing the original game logic, Direct3D 9 graphics pipeline, and menu systems with zero emulation overhead.

The pcrecomp Lifting Pipeline: 8.9 Million Lines of C

Static recompilation of complex, closed-source x86 PC binaries is notoriously harder than recompiling fixed-hardware console binaries like the Nintendo 64 or GameCube. Modern PC executables are packed with intricate C++ virtual method tables (vtables), Runtime Type Information (RTTI), complex Win32 API calls, and compiler-generated SIMD vectorization. The nfsu2-recompiled pipeline conquers this through a multi-stage lifting strategy:

Zero Lift Failures Across 27,742 Functions: The lifting pipeline analyzed EA’s retail SPEED2.EXE (a 4.8 MB unpacked image built February 9, 2005) and successfully translated 27,742 discrete functions across 8.9 million lines of generated C without a single translation failure.

  • PE Normalization & Relocations: A custom Python harness (normalize_exe.py) cleans the original PE headers and reconstructs the base relocation directory from raw sections, creating an analysis binary with fully verifiable pointer offsets.
  • RTTI & Virtual Method Harvesting: Using heuristics derived from Microsoft Visual C++ ABI layouts, the tool extracts virtual method tables and class inheritance hierarchies, establishing precise seed addresses for every indirect call.
  • Block Analysis & SIMD Translation: disasm32 parses basic instruction blocks via Capstone, passing assembly streams to lift32 (supplemented by simd32 patches), which maps x86 registers, SSE floating-point operations, and CPU flags into standard C variables.
  • MSVC Recompilation: The generated 8.9 million lines of C compile under MSVC x86 with zero compilation errors in roughly 4.5 minutes across 16 parallel threads.

Milestone Roadmap & Bring-Up Status

The project has advanced through critical milestones, transitioning from initial syntax verification to real-time interactive game execution:

Milestone Engine Layer Current Operational Status
M0 C Generation DONE: 27,742 functions, 8.9M lines of C, 0 lift failures.
M1 – M2 Compilation & Linking DONE: MSVC x86 clean compile, zero linker errors.
M3 – M5 Startup & WinMain DONE: Recompiled CRT, registry queries, CPU detection, file I/O threads.
M6 – M8 Direct3D 9 Device DONE: Win32 window creation, D3D9 device initialization, first frames rendered.
M9 – M10 Intros & Input WORKING: FMV intro sequences play smoothly; frontend menus accept keyboard/gamepad inputs.
Geometry Fix Car Rendering FIXED: Resolved visual artifacting by repairing signed-flags propagation in lifted assembly.
Race Loading Track Initialization FIXED: Corrected miscompiled signed 16-bit conditional branches that caused null-pointer crashes.
Validation Full Race Loop IN PROGRESS: 55-second smoke test completed 4,462 frames cleanly; end-to-end race validation underway.

Debugging the Details: Flags and 16-Bit Arithmetic

The journey to rendered pixels required hunting down subtle nuances in how 2000s-era x86 compilers handled arithmetic flags. Early builds suffered from distorted vehicle geometry and catastrophic null-pointer crashes upon entering race events:

  • Vehicle Mesh Restoration: Initial test renders produced glitchy vehicle surfaces. Developer codepdbh traced the fault to subtle edge cases in how the lifter handled signed arithmetic flags (Sign Flag SF and Overflow Flag OF) following comparison instructions. Once corrected in the translation rules, car models in the showroom and garage rendered flawlessly.
  • The 16-Bit Branch Bug: Transitioning from the menu to Bayview’s streets previously triggered an instant null-pointer crash during world streaming. Deep-dive debugging revealed a miscompilation pattern in signed 16-bit register comparisons (CMP AX, DX). Patching the lifter’s branch synthesis eliminated the fault, allowing the engine to survive a rigorous 4,462-frame smoke test.

The Long-Term Prize: Native ARM64 and Android

While the current bring-up runs on Windows calling native Win32 and Direct3D 9 APIs, the ultimate objective of nfsu2-recompiled reaches far beyond PC compatibility:

Cross-Platform Portability Without Emulation: Because the game’s core logic has been translated into pure, compilable C, the underlying simulation is no longer bound to x86 silicon. By swapping the platform-specific Win32 and Direct3D 9 backends for cross-platform SDL2 and Vulkan/OpenGL ES wrappers, Need for Speed Underground 2 can be compiled into a native ARM64 binary for Android, Linux handhelds (like the Retroid Pocket or Steam Deck), and Apple Silicon—delivering full performance without the thermal penalties or overhead of Box64 or FEX-Emu.

In accordance with software preservation standards, the repository contains no copyrighted EA game code, textures, audio banks, music, or binaries. The workflow is entirely local and reproducible:

# Prepare environment and normalize retail executable
source scripts/vsenv.sh x86
python scripts/normalize_exe.py "$GAME/SPEED2.EXE" work/SPEED2.analysis.exe

# Scan vtables, RTTI, and generate function catalog
python ../pcrecomp/tools/cpp/vtable_scan.py work/SPEED2.analysis.exe --seeds work/vtable_seeds.json
python ../pcrecomp/tools/cpp/rtti.py        work/SPEED2.analysis.exe --seeds work/rtti_seeds.json
python scripts/run_lift.py catalog work/SPEED2.analysis.exe work/seeds_all.json work/catalog.json

# Lift 27,742 functions to C and compile with Ninja
python scripts/run_lift.py lift work/SPEED2.analysis.exe work/catalog.json src/recomp/gen
scripts/build.sh
scripts/run.sh

Users must point the build scripts at a legally owned retail installation of Need for Speed Underground 2 with the verified v1.2 North American executable (SHA-256: f9dd86c054878ce6276beb07c1fd61874f7a1e4bf1f241b084c65b73e24168a7).

A New Milestone for PC Recompilation

While console static recompilations have become common for retro platforms, recompiling a massive, commercial, mid-2000s PC game executable into standard C is an extraordinary technical milestone. nfsu2-recompiled demonstrates that even closed-source, highly optimized x86 PC games can be successfully disassembled, analyzed, and lifted into maintainable code—guaranteeing that iconic titles like Underground 2 remain playable for decades to come.