Inspect FlandersMod yourself

1Before you start

You need about an hour. The steps work on Windows, macOS or Linux.

2Check your download

First make sure your FlandersMod.exe is one of the releases this guide was written against. Compute its SHA-256 hash:

Get-FileHash .\FlandersMod.exe -Algorithm SHA256

shasum -a 256 FlandersMod.exe      # macOS
sha256sum FlandersMod.exe          # Linux

A different hash doesn't automatically mean something is wrong. It may be a newer release, or a file someone repackaged. Either way, the steps below still work, and they're how you find out what changed.

3Unpack the launcher

FlandersMod.exe is a .NET Framework 4.8 program. Everything else it installs is embedded inside it as a .NET resource: the in-game DLL, the server, the weapon-wheel art and the bundled mods. You can save them out without running anything.

Option A: with ILSpy (no code)

1. Open ILSpy and drag FlandersMod.exe onto it.
2. Expand FlandersMod → Resources. You'll see entries named embed.FlandersMP.dll, embed.FlandersMP_Server.exe, embed.ww.zip and embed.mods.*.lmlm.
3. Right-click each one → Save.

Option B: with the script

Save extract_resources.py next to the exe, then:

pip install dnfile
python extract_resources.py FlandersMod.exe unpacked

You should get files like these (the 0.0.3 list is shown):

Compare their hashes with the reference table to see whether you have the same files.

4Read the launcher's code

.NET programs decompile back to nearly the original C#. Open FlandersMod.exe in ILSpy (or dnSpyEx) and expand the FlandersMod namespace. The interesting classes:

Search tip: in ILSpy press Ctrl+Shift+F, choose "Constant", and search for http. That lists every web address the launcher contains. To keep a copy of the code, right-click the assembly → Save Code…, which writes out a C# project you can grep.

5What it sends online

Here's what the launcher's code shows (all three releases behave the same). Check each point in ILSpy against your own copy.

Usage events Core.Report

Each event is a plain web request to the author's Cloudflare Worker:

https://flandersmod-master.flandersmodcanadaservers.workers.dev/event?kind=<event>&name=<your player name>&detail=<details>

• There's no setting that turns this off. Report doesn't check any option before sending. (The Discord checkbox in Settings only controls Discord status.)
• It includes your player name as typed in the launcher, and the receiving server also sees your IP address, as with any web request.
• Events sent (search Core.Report( in Lobby):

The public event list Core.Records

The launcher also downloads …workers.dev/records, a JSON list of recent events (time, kind, player name, server) for all players, and shows it in the launcher. The client code requests it without any password or key. That's how anyone can read it.

Other connections

• Server browser: the same workers.dev address serves the official server list.
• Hosting: 0.0.2 and 0.0.3 fetch your public IP from https://api.ipify.org when you host a server list. 0.0.1 used a fixed IP address written into the program instead.
• The server program announces itself to the server list with /announce?port=…&name=…&players=…&max=…&pw=…&ip=…&owner=….
• In game, the DLL talks UDP to the multiplayer server you join (default port 7777).

6What it changes on your PC

All of these are in Core. Search for WriteAllBytes, File.Copy, Process.Start and SetEnvironmentVariable.

• Game folder: writes d3d8.dll (the FlandersMP DLL) next to Simpsons.exe, plus the weapon wheel's files. If a different d3d8.dll is already there, it leaves it alone and turns weapons and mods off.
• Next to the launcher: a FlandersMod_Data folder with the server exe, your mods and settings.
• When the game starts: it sets environment variables such as FLANDERSMP_NAME, FLANDERSMOD_MODS and FLANDERSMOD_PLUGINS (the code-mod folders), which the DLL reads.
• Hosting and co-op start FlandersMP_Server.exe in the background.
• Uninstall runs a hidden PowerShell command that deletes its files.
• Inside the game, the DLL patches Simpsons.exe in memory and hooks Direct3D, keyboard, mouse and controller input. That's how the weapons and multiplayer work. It doesn't change Simpsons.exe on disk.

7Look inside .lmlm mods

FlandersMod's .lmlm files are simple archives. Use flmod_extract.py to list or unpack them:

python flmod_extract.py list "Blood Mod.lmlm"
python flmod_extract.py extract "Blood Mod.lmlm"
python flmod_extract.py extract-all unpacked        # every .lmlm in a folder

The DLLs in the bundled mods (SimpsonsFlySim, WorldDestruction) and in Blood Mod can be opened in Ghidra exactly like the main DLL. They export FlandersMod_Init, FlandersMod_Frame, and optionally FlandersMod_Hit and FlandersMod_Draw3D.

8The in-game DLL and server optional

These are native 32-bit Windows programs built with MinGW, with no debug names, so they need Ghidra rather than ILSpy. You don't need this part to check the network and install claims above. It's for going deeper.

1. Create a Ghidra project, then File → Import FlandersMP.dll (or the server exe). Accept the defaults and run auto-analysis. It takes about a minute.
2. Search → For Strings, then filter for things like FLMP (the multiplayer packet tag), plugin, FLANDERSMOD_, workers.dev or Direct3DCreate8. Double-click a result, then use References → Show References to to jump to the code that uses it.
3. The DLL exports Direct3DCreate8 and a few other d3d8.dll functions, which is how it gets loaded as the game's Direct3D DLL. Start reading from there, and from the entry point.

Two Ghidra pitfalls with these files

• Missing functions. Ghidra misses several hundred functions in these binaries, mostly code reached only through jump tables or tail jumps. If you see gray "undefined" bytes between functions, click the first one, press D (disassemble) and then F (create function). Examples in 0.0.3: 0x66152eb0 in the DLL (the shotgun pose code), and 0x004028c0 and 0x00404ff0 in the server (the server-list announce code).
• Decompiler timeouts. A couple of very large animation functions use old-style x87 floating-point code and time out. Raise Edit → Tool Options → Decompiler → Decompiler Timeout (e.g. 600 s), or read their assembly.

In all three releases, the server program is the same build: only its timestamp changes. The DLL changes a little between releases. 0.0.2 added the code-mod loader, and 0.0.3 reworked the splash and "WASTED" screens.

9Limiting what it sends

If you decide to use FlandersMod anyway but don't want the usage events sent, you can block the worker's address. Add this line to your hosts file (C:\Windows\System32\drivers\etc\hosts, edited as administrator):

0.0.0.0 flandersmod-master.flandersmodcanadaservers.workers.dev

Trade-off: the same address also provides the official server browser, so that list will be empty. Direct connect, hosting your own server, co-op and single player don't need it. A firewall rule blocking outbound traffic from FlandersMod.exe has the same effect. It also blocks the public-IP lookup used when you host a server list.

To check it worked, keep a network monitor such as Windows' Resource Monitor (Network tab) or Wireshark open while you use the launcher.

10Reference: known files

SHA-256 hashes of the files embedded in each release, as saved in step 3. Matching hashes mean you have exactly the files this guide was written against.

Main components

Mods

The first 12 are byte-identical in all three releases.

11The two scripts

Both are short and use only Python's standard library, plus dnfile for the first. Read them before you run them, then save each under the name shown.

#!/usr/bin/env python3
"""Save every embedded resource from FlandersMod.exe WITHOUT running it.
Needs:  pip install dnfile
Usage:  python extract_resources.py FlandersMod.exe out_folder
"""
import os
import sys

import dnfile

exe, out = sys.argv[1], sys.argv[2]
os.makedirs(out, exist_ok=True)
pe = dnfile.dnPE(exe)
for res in pe.net.resources or []:
    name = getattr(res.name, "value", res.name)
    name = str(name)
    data = bytes(res.data)
    safe = "".join(c if c.isalnum() or c in "._-" else "_" for c in name)
    with open(os.path.join(out, safe), "wb") as f:
        f.write(data)
    print("%10d  %s" % (len(data), name))

#!/usr/bin/env python3
"""Extract FlandersMod (.lmlm) mod packages, as shipped inside FlandersMod.exe.

Layout:
  0x000   "LSPA", then zeros up to 0x400
  The rest is 0x200-byte sectors; every field starts 2 bytes into its sector.
  0x400   root sector: u16 entry count
  Each entry:
    name sector   u16 0, then the name in UTF-16LE (NUL-terminated)
    info sector   u64 size, u32 offset   (offset 0 => folder; the u16 at the same spot is its child count)
    pad sector    files only, all zeros
  A folder's children follow it directly (depth-first). File data is stored raw after the tree.

Usage:
  flmod_extract.py list    <mod.lmlm>
  flmod_extract.py extract <mod.lmlm> [outdir]     (default outdir: ./<mod name>)
  flmod_extract.py extract-all <folder> [outdir]   (every .lmlm in folder -> outdir/<mod name>/)
"""
import os
import struct
import sys

SECTOR = 0x200
ROOT = 0x400
MAX_DEPTH = 16


class FormatError(Exception):
    pass


def read_tree(data):
    """Return a list of (path, size, offset) for every file in the package."""
    if len(data) < ROOT + SECTOR or data[:4] != b"LSPA":
        raise FormatError("not a FlandersMod package (missing LSPA header)")
    if any(data[4:ROOT]):
        raise FormatError("not a FlandersMod package (unexpected header fields)")

    files = []
    pos = ROOT

    def need(n):
        if pos + n > len(data):
            raise FormatError("truncated package")

    def walk(prefix, depth):
        nonlocal pos
        if depth > MAX_DEPTH:
            raise FormatError("folder tree too deep")
        need(SECTOR)
        count = struct.unpack_from("<H", data, pos + 2)[0]
        pos += SECTOR
        for _ in range(count):
            need(2 * SECTOR)
            if struct.unpack_from("<H", data, pos)[0] != 0:
                raise FormatError("not a FlandersMod package (unexpected entry flags at 0x%x)" % pos)
            name = data[pos + 2:pos + SECTOR].decode("utf-16le", "replace").split("\x00")[0]
            if not name or name in (".", "..") or "/" in name or "\\" in name or ":" in name:
                raise FormatError("bad entry name %r at 0x%x" % (name, pos))
            pos += SECTOR
            size, offset = struct.unpack_from("<QI", data, pos + 2)
            if offset == 0:
                walk(prefix + name + "/", depth + 1)          # folder: children follow
            else:
                if offset + size > len(data):
                    raise FormatError("%s%s runs past the end of the package" % (prefix, name))
                files.append((prefix + name, size, offset))
                pos += 2 * SECTOR                             # info + pad sector

    walk("", 0)
    return files


def extract(path, outdir):
    data = open(path, "rb").read()
    files = read_tree(data)
    root = os.path.realpath(outdir)
    for rel, size, offset in files:
        dst = os.path.realpath(os.path.join(root, *rel.split("/")))
        if not dst.startswith(root + os.sep):
            raise FormatError("refusing to write outside %s: %s" % (outdir, rel))
        os.makedirs(os.path.dirname(dst), exist_ok=True)
        with open(dst, "wb") as f:
            f.write(data[offset:offset + size])
        print("  %-60s %10d" % (rel, size))
    print("%d files -> %s" % (len(files), outdir))


def main(argv):
    if len(argv) < 3 or argv[1] not in ("list", "extract", "extract-all"):
        print(__doc__)
        return 2
    cmd, src = argv[1], argv[2]
    try:
        if cmd == "list":
            data = open(src, "rb").read()
            files = read_tree(data)
            for rel, size, offset in files:
                print("  %-60s %10d  @0x%08x" % (rel, size, offset))
            print("%d files" % len(files))
        elif cmd == "extract":
            name = os.path.splitext(os.path.basename(src))[0]
            extract(src, argv[3] if len(argv) > 3 else name)
        else:
            out = argv[3] if len(argv) > 3 else "."
            failed = 0
            for fn in sorted(os.listdir(src)):
                if not fn.lower().endswith(".lmlm"):
                    continue
                print("== %s" % fn)
                try:
                    extract(os.path.join(src, fn), os.path.join(out, os.path.splitext(fn)[0]))
                except FormatError as e:
                    print("  skipped: %s" % e)
                    failed += 1
            return 1 if failed else 0
    except FormatError as e:
        print("error: %s" % e, file=sys.stderr)
        return 1
    return 0


if __name__ == "__main__":
    sys.exit(main(sys.argv))