{"title":"Object script payload producer","summary":{"objectEcProducerFound":true,"producerOpcodeHex":"0x5e","cleanupOpcodeHex":"0x5d","routePayloadProofFound":false,"fieldMapTransitionPayloadFound":false,"mode1CandidateCount":7,"validMode1PayloadStructCandidateCount":6,"uniqueMode1PayloadCount":2,"uniqueValidMode1PayloadCount":1,"mapCnsRefCountInPayloadHeads":0,"classification":"object +0xec producer grounded; scanned static mode-1 payloads are display/object payloads, not proven field-map transition payloads"},"constants":{"genericHandlerTable":"0x00440538","genericObjectScriptRunner":"0x00402321","opcode5dHandler":"0x0040791f","opcode5eHandler":"0x004079ff","transientObjectGlobal5d":"0x0059dda4","transientObjectGlobal5e":"0x0059dda8","objectAllocator":"0x00435b5b","objectDestroy":"0x00435c9d","payloadResourceFunction":"0x00423a2f","mapLoaderFunction":"0x0042449c","objectPayloadField":"+0xec","scriptCursorField":"+0x40"},"instructionEvidence":[{"id":"opcode-5e-handler-mode-read","va":4225544,"vaHex":"0x00407a08","meaning":"opcode 0x5e reads stream byte +1 as mode","expectedHex":"8b 45 08 8b 40 40 33 c9 8a 48 01 89 4d ec","actualHex":"8b 45 08 8b 40 40 33 c9 8a 48 01 89 4d ec","matches":true},{"id":"opcode-5e-mode1-create-object","va":4225676,"vaHex":"0x00407a8c","meaning":"mode 1 allocates a transient generic-script object and stores it in 0x0059dda8","expectedHex":"6a 00 68 21 23 40 00 e8 c3 e0 02 00 83 c4 08 a3 a8 dd 59 00","actualHex":"6a 00 68 21 23 40 00 e8 c3 e0 02 00 83 c4 08 a3 a8 dd 59 00","matches":true},{"id":"opcode-5e-mode1-payload-copy","va":4225696,"vaHex":"0x00407aa0","meaning":"mode 1 copies dword [stream+4] into new object +0xec","expectedHex":"8b 45 08 8b 40 40 8b 40 04 8b 0d a8 dd 59 00 89 81 ec 00 00 00","actualHex":"8b 45 08 8b 40 40 8b 40 04 8b 0d a8 dd 59 00 89 81 ec 00 00 00","matches":true},{"id":"opcode-5e-mode1-cursor-from-payload","va":4225724,"vaHex":"0x00407abc","meaning":"mode 1 switches execution to the new object and loads object +0x40 from [payload+8]","expectedHex":"a1 a8 dd 59 00 89 45 08 8b 45 08 8b 80 ec 00 00 00 8b 40 08 8b 4d 08 89 41 40","actualHex":"a1 a8 dd 59 00 89 45 08 8b 45 08 8b 80 ec 00 00 00 8b 40 08 8b 4d 08 89 41 40","matches":true},{"id":"opcode-5e-mode1-resource-open","va":4225750,"vaHex":"0x00407ad6","meaning":"mode 1 passes [payload+0] to 0x00423a2f after cursor setup","expectedHex":"8b 45 08 8b 80 ec 00 00 00 8b 00 50 e8 48 bf 01 00","actualHex":"8b 45 08 8b 80 ec 00 00 00 8b 00 50 e8 48 bf 01 00","matches":true},{"id":"opcode-5e-mode0-resource-close","va":4225576,"vaHex":"0x00407a28","meaning":"mode 0 cleanup passes [payload+4] to 0x00423a2f, destroys the transient object, clears 0x0059dda8","expectedHex":"a1 a8 dd 59 00 8b 80 ec 00 00 00 8b 40 04 50 e8 f3 bf 01 00","actualHex":"a1 a8 dd 59 00 8b 80 ec 00 00 00 8b 40 04 50 e8 f3 bf 01 00","matches":true}],"handlerTableEvidence":{"opcode5dEntryVaHex":"0x004406ac","opcode5dHandlerVaHex":"0x0040791f","opcode5dMatchesExpected":true,"opcode5eEntryVaHex":"0x004406b0","opcode5eHandlerVaHex":"0x004079ff","opcode5eMatchesExpected":true},"mode1PayloadCandidates":[{"commandVa":4456436,"commandVaHex":"0x0043fff4","section":".data","payloadVa":4456864,"payloadVaHex":"0x004401a0","payloadDwords":["0xa1a1d6bf","0xa1b0bbb3","0xd6c1a1a1","0xf0b9a4c1"],"validPayloadStruct":false,"mapCnsRefsInFirst128Bytes":[],"payloadHeadHex":"bf d6 a1 a1 b3 bb b0 a1 a1 a1 c1 d6 c1 a4 b9 f0 c0 cc 40 02 00 00 c7 d2 be c6 b9 fc c0 bb a1 a1"},{"commandVa":4483052,"commandVaHex":"0x004467ec","section":".data","payloadVa":4467829,"payloadVaHex":"0x00442c75","payloadDwords":["0x00442c81","0x00442c95","0x00442c9d","0x000f1011"],"validPayloadStruct":true,"mapCnsRefsInFirst128Bytes":[],"payloadHeadHex":"81 2c 44 00 95 2c 44 00 9d 2c 44 00 11 10 0f 00 58 27 44 00 e1 29 44 00 0c 10 0f 00 00 00 00 00"},{"commandVa":4483348,"commandVaHex":"0x00446914","section":".data","payloadVa":4467829,"payloadVaHex":"0x00442c75","payloadDwords":["0x00442c81","0x00442c95","0x00442c9d","0x000f1011"],"validPayloadStruct":true,"mapCnsRefsInFirst128Bytes":[],"payloadHeadHex":"81 2c 44 00 95 2c 44 00 9d 2c 44 00 11 10 0f 00 58 27 44 00 e1 29 44 00 0c 10 0f 00 00 00 00 00"},{"commandVa":4483644,"commandVaHex":"0x00446a3c","section":".data","payloadVa":4467829,"payloadVaHex":"0x00442c75","payloadDwords":["0x00442c81","0x00442c95","0x00442c9d","0x000f1011"],"validPayloadStruct":true,"mapCnsRefsInFirst128Bytes":[],"payloadHeadHex":"81 2c 44 00 95 2c 44 00 9d 2c 44 00 11 10 0f 00 58 27 44 00 e1 29 44 00 0c 10 0f 00 00 00 00 00"},{"commandVa":4493308,"commandVaHex":"0x00448ffc","section":".data","payloadVa":4467829,"payloadVaHex":"0x00442c75","payloadDwords":["0x00442c81","0x00442c95","0x00442c9d","0x000f1011"],"validPayloadStruct":true,"mapCnsRefsInFirst128Bytes":[],"payloadHeadHex":"81 2c 44 00 95 2c 44 00 9d 2c 44 00 11 10 0f 00 58 27 44 00 e1 29 44 00 0c 10 0f 00 00 00 00 00"},{"commandVa":4538300,"commandVaHex":"0x00453fbc","section":".data","payloadVa":4467829,"payloadVaHex":"0x00442c75","payloadDwords":["0x00442c81","0x00442c95","0x00442c9d","0x000f1011"],"validPayloadStruct":true,"mapCnsRefsInFirst128Bytes":[],"payloadHeadHex":"81 2c 44 00 95 2c 44 00 9d 2c 44 00 11 10 0f 00 58 27 44 00 e1 29 44 00 0c 10 0f 00 00 00 00 00"},{"commandVa":5117856,"commandVaHex":"0x004e17a0","section":".data","payloadVa":4467829,"payloadVaHex":"0x00442c75","payloadDwords":["0x00442c81","0x00442c95","0x00442c9d","0x000f1011"],"validPayloadStruct":true,"mapCnsRefsInFirst128Bytes":[],"payloadHeadHex":"81 2c 44 00 95 2c 44 00 9d 2c 44 00 11 10 0f 00 58 27 44 00 e1 29 44 00 0c 10 0f 00 00 00 00 00"}],"uniquePayloadsHex":["0x004401a0","0x00442c75"],"uniqueValidPayloadsHex":["0x00442c75"],"producerSemantics":["stream[+1] selects mode","mode 1 allocates a generic object with callback 0x00402321","mode 1 stores dword stream[+4] into new object +0xec","mode 1 sets the new object +0x40 script cursor from dword [payload + 8]","mode 1 passes dword [payload + 0] to 0x00423a2f","mode 0 cleanup passes dword [payload + 4] to 0x00423a2f, destroys the transient object, and clears 0x0059dda8"],"missingEvidence":["a 0x5e mode-1 payload whose head references field map CNS resources or map-loader targets","a decoded payload script that calls map loader 0x0042449c or writes a selected map/root","runtime active object payload values for a concrete field exit object"],"nonClaims":["Opcode 0x5e grounds object +0xec production, but does not by itself prove a map transition.","The static mode-1 scan includes a text-like false-positive candidate; only valid pointer-triad payloads are treated as payload structs.","No scanned payload head is promoted to a route until its script cursor stream is decoded to a map/root change."]}