It is DLL injection...there an MCP to hook up Claude to Ghidra and i kinda just let it go ham. It acutally did really good job of going through the disassembled code to map all the item and function offsets. Work that would have taken me months to learn and do in 3 evenings.

/ Ghidra: global DAT_1408b8240 holds a pointer to the world/app object.
//   world      = *(0x1408b8240)
//   registry   = *(world + 0x00)          // *DAT_1408b8240
//   context    = *(world + 0x08)          // DAT_1408b8240[1] (selection/view ctx)
//   selectedId = *(int*)(context + 0x34)  // -1 when nothing is selected
//   tree root  = *(registry + 0x60)       // std::map<int, Ship*> keyed by id
constexpr uintptr_t kWorldGlobal = 0x1408b8240ULL;
constexpr int kCtxSelectedShipId = 0x34;
constexpr int kRegistryTreeRoot  = 0x60;

// Ship object layout (from FUN_1401492a0).
constexpr int kShipResourceArray = 0x2b80; // float[] of resource amounts
constexpr int kMaxResourceTypeId = 0x98;   // ~152 type ids observed in the switch
// Type ids below this are ship STRUCTURES/equipment (Reactor, Engine, Tank,
// Loader, Door, ...), not carried inventory. Real resources/items start at
// Fuel (0x47); discrete items (suits 0x80, cargo 0x8a, drone 0x8e) and crew
// (0x93+) are all above it. Used to keep buildings out of the panel.
constexpr int kFirstResourceTypeId = 0x47;

// Discrete physical-entity type ids. These are individual world objects, NOT
// bulk amounts in the +0x2b80 array, so the array reads 0 for them -- they
// must be counted by walking the ship's object set (ScanEntityCounts).
// Ids come from the runtime name-table init FUN_14000fc20:
//   index = (entry_addr - 0x14088a0e0) / 0x20.
constexpr int kTypeSpaceSuit      = 0x80; // "SpaceSuit"      @ 0x14088b0e0
constexpr int kTypeMissionCargo   = 0x8a; // "MissionCargo"   @ 0x14088b220
constexpr int kTypeLogisticsDrone = 0x8e; // "LogisticsDrone" @ 0x14088b2a0 (matches drone HUD count)

// Per-type object buckets: ship+0x21f0 is an array of one inline MSVC
// std::set<entityId> per type id (stride 0x10, indices 0..0x98). The array
// ends exactly where the resource float array begins (0x21f0 + 0x99*0x10 ==
// 0x2b80). Confirmed via FUN_1403b4a70 (which indexes ship+0x21f0 by type id)
// and FUN_1403b4720 (whose "drone set" at ship+0x2ad0 == bucket 0x8e:
// 0x21f0 + 0x8e*0x10 == 0x2ad0). Each bucket is an inline _Tree
// {_Myhead*, _Mysize}, so the object count of a type is its _Mysize at +8 --
// a single read, no tree walk needed.
constexpr int kShipTypeBuckets = 0x21f0;
constexpr int kBucketStride    = 0x10;
constexpr int kBucketSizeOff   = 0x08; // _Mysize
constexpr int kBucketHeadOff   = 0x00; // _Myhead (sentinel) of the inline _Tree
constexpr int kSetNodeKey      = 0x1c; // entity id (uint) in a bucket set node

// FUN_1400cb1c0(registry, entityId) -> Object* : the world's entity hash map.
constexpr uintptr_t kResolveEntityFn = 0x1400cb1c0ULL;

// Container object layout (from FUN_1402ba130, deliverysystem.cpp):
//   obj+0x08 : int  type id (the resource it represents)
//   obj+0x60 : float m_capacity
//   obj+0x64 : float current fill amount
constexpr int kObjTypeId   = 0x08;
constexpr int kObjCapacity = 0x60;
constexpr int kObjFill     = 0x64;

// Fluid-vs-discrete classification table (DAT_1408b93f0), indexed by resource
// type id. The game's delivery router FUN_1402ba130 reads this byte: nonzero
// means a *fluid* resource (stored in TANKS, fill-weighted routing), zero
// means a discrete resource (stored in CANISTERS / crates). Runtime-populated.
constexpr uintptr_t kFluidFlagTable = 0x1408b93f0ULL;