Runtime Trace Feasibility

objective: runtime trace feasibility for Hwanse2.exe route blocker proof
proof found: False
failed runtime trace gates: runtime-trace-capture-unavailable,stable-watchpoint-session-unavailable,equivalent-selected-root-proof-missing
missing evidence count: 3
evidence refs: 17
can run runtime trace now: False
dpkg architecture: amd64
foreign architectures: i386
wine loader smoke: wine-9.0 (Ubuntu 9.0~repack-4build3)
qemu wine loader smoke: wine-9.0 (Ubuntu 9.0~repack-4build3)
qemu wine child exec smoke: Microsoft Windows 10.0.19043
qemu-i386 binfmt: enabled
binfmt consistency: summary enabled True, execution probe enabled True
promotion status: blocked

Wine, winedbg, Xvfb, gdb, and i386 package prerequisites are installed, but the bounded execution probe still fails before a stable route trace can be captured. The notepad control probes fail too, so this is a qemu-i386/WineDbg debugger-path issue rather than Hwanse-specific route proof. A /proc process-memory snapshot can read the relocated Hwanse2.exe image (loadedBase=0x00120000, selectedPointer=0x004a2d38, currentRootSelected=False), but it is an idle sample, not a watchpoint/control-flow trace. A bounded input probe found Hwanse2.exe windows and readable input memory, held X keydown reached the DirectInput cache=True, synthetic X key events changed the selected pointer=False, and cached-key-buffer pokes changed it=True to selector context 50:0. A bounded key-sequence probe tried 28 direct key-buffer sequence(s) after startup wait 14.0s; route selector 2:0 reached=False. A supplemental input-path prelude key-sequence probe tried 3 sequence(s); observed selectors=8:0,50:0, route selector 2:0 reached=False. A non-debugger selected-pointer poll sampled 1550 state(s) across 8 key-buffer sequence(s) at 0.02s intervals; observed selectors=8:0, route selector 2:0 reached=False, current root reached=False. A supplemental input-path selected-pointer poll sampled 491 state(s) across 3 key-buffer sequence(s) at 0.02s intervals; observed selectors=8:0,50:0, route selector 2:0 reached=False, current root reached=False. A supplemental long selected-pointer poll sampled 1928 state(s) across 5 custom key-buffer sequence(s) at 0.02s intervals; observed selectors=8:0,50:0, route selector 2:0 reached=False, current root reached=False. A supplemental late-start selected-pointer poll waited 45.0s before input and sampled 1122 state(s) across 1 key-buffer sequence(s) at 0.02s intervals; observed selectors=8:0,50:0, route selector 2:0 reached=False, current root reached=False. A supplemental route watch-value poll sampled 1123 state(s) across 1 key-buffer sequence(s); observed selectors=8:0,50:0, watchValues=opcode24CurrentObjectIndex=0x00x1123; opcode24Mode1Source=0x00x1123; opcode24RuntimeFlag=0x00x783,0x01x340, route selector 2:0 reached=False. A supplemental standalone synthetic selector 2:0 poll staged a save-shaped file under SaveData\savedat1.dat, ran the input-path prelude with case aliases, and sampled 374 state(s) across 2 load-menu candidate sequence(s); input quality=pid=2/2 base=2/2 keyWrites=2/2 pressedSeq=2/2 pressedEvents=18 offsets=28,208; staged selectors=2:0, observed selectors=8:0, observed staged selector=False, route selector 2:0 reached=False. This leaves the standalone synthetic file non-promoting and contrasts with the patched public-base diagnostic. A supplemental patched public-base selector 2:0 diagnostic poll staged a public save with only selector/position bytes patched under SaveData\savedat1.dat, ran the input-path prelude with case aliases, and sampled 375 state(s) across 2 load-menu candidate sequence(s); input quality=pid=2/2 base=2/2 keyWrites=2/2 pressedSeq=2/2 pressedEvents=138 offsets=28,208; staged selectors=2:0, observed selectors=2:0,10:0, observed staged selector=True, route selector 2:0 reached=True. This proves the current load path can select a constructed 2:0 save-shaped diagnostic, but not a captured gameplay save. A supplemental SaveData file-I/O trace probe placed the same public save under SaveData/savedat1.dat with backend=winedebug; inputTraceUsable=False, pidRuns=0/1, keyWriteRuns=0/1, savedat1Access=False. This is backend-feasibility evidence only. A supplemental strace SaveData file-I/O probe placed the same public save under SaveData/savedat1.dat with backend=strace; inputTraceUsable=False, pidRuns=0/1, keyWriteRuns=0/1, savedat1Access=False. This is backend-feasibility evidence only. A supplemental attached strace SaveData file-I/O probe placed the same public save under SaveData/savedat1.dat with backend=strace-attach; inputTraceUsable=True, pidRuns=1/1, keyWriteRuns=1/1, savedat1Access=False. This makes the bounded file-I/O window usable, but absent savedat lines still only cover that load-menu candidate sequence. A broader attached strace SaveData file-I/O probe placed the same public save under SaveData/savedat1.dat with backend=strace-attach; inputTraceUsable=True, pidRuns=8/8, keyWriteRuns=8/8, savedat1Access=False. This makes all covered load-menu candidate file-I/O windows usable, but it still only rules out savedat access for those bounded inputs. A case-alias attached strace SaveData file-I/O probe placed the same public save under SaveData/savedat1.dat with backend=strace-attach; caseAliases=True, inputTraceUsable=True, pidRuns=8/8, keyWriteRuns=8/8, savedat1Access=False. The aliases reduce resource lookup trace noise, but no savedat access was observed in the same bounded windows.

Missing Evidence

stable runtime trace capture session for Hwanse2.exe
watchpoint or breakpoint path that observes selected pointer 0x0059de30 on the route path
equivalent selected-root proof if runtime tracing remains unavailable

Evidence Refs

out/runtime_trace_execution_probe.json: canCaptureTraceNow, blockers, probes, promotionStatus, proofFound, runtimeTraceExecutionProofFound, failedRuntimeTraceExecutionGateIds, missingEvidence, evidenceRefs, evidenceRefCount
out/runtime_memory_snapshot.json: loadedBaseHex, memory, promotionStatus
out/runtime_input_path_probe.json: heldKeyPressedDetected, baselineSelectedPointerContext, finalSelectedPointerContext
out/runtime_key_sequence_probe.json: sequenceCount, anyReachedRouteSelectorContext
out/runtime_key_sequence_prelude_probe.json: sequenceCount, anyReachedRouteSelectorContext
out/runtime_selected_pointer_poll.json: sampleCount, observedSelectors, anyReachedRouteSelectorContext
out/runtime_selected_pointer_prelude_poll.json: sampleCount, observedSelectors, anyReachedRouteSelectorContext
out/runtime_selected_pointer_long_poll.json: sampleCount, observedSelectors, anyReachedRouteSelectorContext
out/runtime_selected_pointer_late_poll.json: sampleCount, observedSelectors, anyReachedRouteSelectorContext
out/runtime_route_watch_values_poll.json: sampleCount, observedWatchValues, anyReachedRouteSelectorContext
out/runtime_selected_pointer_synthetic_selector_2_0_input_path_case_alias_poll.json: sampleCount, publicSaveSelectors, anyReachedRouteSelectorContext
out/runtime_selected_pointer_patched_public_selector_2_0_input_path_case_alias_poll.json: sampleCount, publicSaveSelectors, anyReachedRouteSelectorContext
out/runtime_save_file_io_probe.json: backend, inputTraceUsable, anySavedat1DatAccess
out/runtime_save_file_io_strace_probe.json: backend, inputTraceUsable, anySavedat1DatAccess
out/runtime_save_file_io_strace_attach_probe.json: backend, inputTraceUsable, anySavedat1DatAccess
out/runtime_save_file_io_strace_attach_load_candidates_probe.json: backend, inputTraceUsable, anySavedat1DatAccess
out/runtime_save_file_io_strace_attach_load_candidates_case_alias_probe.json: backend, inputTraceUsable, anySavedat1DatAccess

Tool Availability

command	available	path
`wine`	True	`/bin/wine`
`winedbg`	True	`/bin/winedbg`
`wineboot`	True	`/bin/wineboot`
`gdb`	True	`/bin/gdb`
`gdb-multiarch`	True	`/bin/gdb-multiarch`
`Xvfb`	True	`/bin/Xvfb`
`xvfb-run`	True	`/bin/xvfb-run`
`xdotool`	True	`/bin/xdotool`
`xwininfo`	True	`/bin/xwininfo`
`qemu-i386`	True	`/bin/qemu-i386`
`strace`	True	`/bin/strace`

Apt Packages

package	installed	candidate
`wine`	`9.0~repack-4build3`	`9.0~repack-4build3`
`wine32`	`9.0~repack-4build3`	`9.0~repack-4build3`
`wine64-tools`	`9.0~repack-4build3`	`9.0~repack-4build3`
`qemu-user-binfmt`	`1:8.2.2+ds-0ubuntu1.16`	`1:8.2.2+ds-0ubuntu1.16`
`gdb-multiarch`	`15.1-1ubuntu1~24.04.1`	`15.1-1ubuntu1~24.04.1`

QEMU Wine Smoke

check	status	first line
`qemu-i386 /usr/lib/wine/wine --version`	0	`wine-9.0 (Ubuntu 9.0~repack-4build3)`
`env WINEDEBUG=-all qemu-i386 /usr/lib/wine/wine cmd /c ver`	0	`Microsoft Windows 10.0.19043`

Execution Probe

can capture trace now: False

report: out/runtime_trace_execution_probe.json

Process Memory Snapshot

can read process memory: True; loaded base: 0x00120000; selected pointer static value: 0x004a2d38; selected pointer equals current root: False; current root relocation looks valid: True.

report: out/runtime_memory_snapshot.json

Input Path Probe

xdotool path: /bin/xdotool; loaded base: 0x00120000; baseline selected pointer: 0x004a2d38; baseline selector context: 8:0; initial selected pointer: 0x004a2d38; final selected pointer: 0x004d0584; final selector context: 50:0; held-key pressed detected: True; held-key changed selected pointer: False; X event changed selected pointer: False; key-buffer poke changed selected pointer: True.

report: out/runtime_input_path_probe.json

Key Sequence Probe

sequence count: 28; startup wait seconds: 14.0; any reached current root: False; any reached route selector 2:0: False.

report: out/runtime_key_sequence_probe.json

Key Sequence Prelude Probe

sequence count: 3; prelude: input-path; observed selectors: 8:0, 50:0; any reached current root: False; any reached route selector 2:0: False.

report: out/runtime_key_sequence_prelude_probe.json

Selected-Pointer Poll

sequence count: 8; sample count: 1550; poll interval seconds: 0.02; observed selectors: 8:0; any reached current root: False; any reached route selector 2:0: False.

report: out/runtime_selected_pointer_poll.json

Selected-Pointer Prelude Poll

sequence count: 3; sample count: 491; prelude: input-path; poll interval seconds: 0.02; observed selectors: 8:0, 50:0; any reached current root: False; any reached route selector 2:0: False.

report: out/runtime_selected_pointer_prelude_poll.json

Selected-Pointer Long Poll

sequence count: 5; sample count: 1928; prelude: input-path; poll interval seconds: 0.02; observed selectors: 8:0, 50:0; any reached current root: False; any reached route selector 2:0: False.

report: out/runtime_selected_pointer_long_poll.json

Selected-Pointer Late Poll

sequence count: 1; sample count: 1122; startup wait seconds: 45.0; prelude: focus-only; poll interval seconds: 0.02; observed selectors: 8:0, 50:0; any reached current root: False; any reached route selector 2:0: False.

report: out/runtime_selected_pointer_late_poll.json

Selected-Pointer Synthetic Selector 2:0 Input-Path Case-Alias Poll

sequence count: 2; sample count: 374; startup wait seconds: 18.0; prelude: input-path; poll interval seconds: 0.02; case aliases: enabled=True; removed=Gense.fld,middata.mlk,pcmdata.wlk; input quality: pid=2/2 base=2/2 keyWrites=2/2 pressedSeq=2/2 pressedEvents=18 offsets=28,208; staged selectors: 2:0; observed selectors: 8:0; observed staged selectors: -; any reached staged selector: False; any reached current root: False; any reached route selector 2:0: False.

promotion note: standalone synthetic save-shaped file; non-promoting.

report: out/runtime_selected_pointer_synthetic_selector_2_0_input_path_case_alias_poll.json

Selected-Pointer Patched Public-Base Selector 2:0 Input-Path Case-Alias Poll

staged save kind: patched public-base diagnostic; sequence count: 2; sample count: 375; startup wait seconds: 18.0; prelude: input-path; poll interval seconds: 0.02; case aliases: enabled=True; removed=Gense.fld,middata.mlk,pcmdata.wlk; input quality: pid=2/2 base=2/2 keyWrites=2/2 pressedSeq=2/2 pressedEvents=138 offsets=28,208; staged selectors: 2:0; observed selectors: 2:0, 10:0; observed staged selectors: 2:0; any reached staged selector: True; any reached current root: True; any reached route selector 2:0: True.

promotion note: constructed from a public save by patching selector/position bytes; diagnostic-only.

report: out/runtime_selected_pointer_patched_public_selector_2_0_input_path_case_alias_poll.json

Runtime Save File I/O Probe

backend: winedebug; temporary save: SaveData/savedat1.dat; sequence count: 1; pid runs: 0; key-write runs: 0; input trace usable: False; matched file-I/O lines: 0; any savedat1.dat access: False.

report: out/runtime_save_file_io_probe.json

Runtime Save File I/O Strace Probe

backend: strace; temporary save: SaveData/savedat1.dat; sequence count: 1; pid runs: 0; key-write runs: 0; input trace usable: False; matched file-I/O lines: 0; any savedat1.dat access: False.

report: out/runtime_save_file_io_strace_probe.json

Runtime Save File I/O Strace Attach Probe

backend: strace-attach; temporary save: SaveData/savedat1.dat; sequence count: 1; pid runs: 1; key-write runs: 1; input trace usable: True; matched file-I/O lines: 0; any savedat1.dat access: False.

report: out/runtime_save_file_io_strace_attach_probe.json

Runtime Save File I/O Strace Attach Load Candidates Probe

backend: strace-attach; temporary save: SaveData/savedat1.dat; sequence count: 8; pid runs: 8; key-write runs: 8; input trace usable: True; matched file-I/O lines: 0; any savedat1.dat access: False.

report: out/runtime_save_file_io_strace_attach_load_candidates_probe.json

Runtime Save File I/O Strace Attach Load Candidates Case-Alias Probe

backend: strace-attach; temporary save: SaveData/savedat1.dat; case aliases: enabled=True; removed=Gense.fld,middata.mlk,pcmdata.wlk; sequence count: 8; pid runs: 8; key-write runs: 8; input trace usable: True; matched file-I/O lines: 0; any savedat1.dat access: False.

report: out/runtime_save_file_io_strace_attach_load_candidates_case_alias_probe.json

Blockers

execution probe: WineDbg attach fails even for a notepad control process under qemu-i386
execution probe: WineDbg launch crashes even for a notepad control process under qemu-i386
execution probe: Hwanse2.exe startup crashes or exits before a useful route trace can be captured
execution probe: Hwanse2.exe stays alive in virtual desktop mode, but WineDbg attach/watchpoint still fails
execution probe: no Wine debugger path reaches a stable watchpoint-capable session
execution probe: QEMU gdbstub connects, but route watchpoint/breakpoint insertion is not stable

Trace Points

name	kind	address	purpose
mode1 source write watchpoint	`watch-write-byte`	`0x0059e348`	break on any runtime producer of opcode 0x24 mode1 source before the handler reads it
opcode24 mode1 read	`execute-breakpoint`	`0x0040c675`	confirm the value consumed by opcode 0x24 mode1 on the map1_01a->map2_02d path
current blocker frontier reader	`execute-breakpoint`	`0x00542b0c`	confirm the control path reaches the branch reader and capture selectionBuffer[0x20]
gate-time context base proof	`execute-breakpoint`	`0x005428c4`	capture context+0xa8 base and gate index before the first inherited gate

Commands To Try

sudo dpkg --add-architecture i386 && sudo apt-get update
sudo apt-get install wine32 wine64-tools xvfb gdb qemu-user-binfmt
sudo apt-get install gdb-multiarch
if native i386 exec is unavailable, register qemu-i386 binfmt for EM_386 ELF binaries
xvfb-run -a wineboot -u
python3 tools/probe_runtime_trace_execution.py
WINEDEBUG=-all xvfb-run -a winedbg --gdb Hwanse2.exe
gdb -q -ex 'target remote :<winedbg-port>' -ex 'watch *(unsigned char*)0x0059e348' -ex 'hbreak *0x0040c675'
python3 tools/probe_runtime_memory_snapshot.py
python3 tools/probe_runtime_input_path.py
python3 tools/probe_runtime_key_sequences.py
python3 tools/probe_runtime_selected_pointer_poll.py
python3 tools/probe_runtime_selected_pointer_poll.py --prelude input-path --sequence-name accept --sequence-name accept-accept --sequence-name accept-down-accept --output-prefix runtime_selected_pointer_prelude_poll
python3 tools/probe_runtime_selected_pointer_poll.py --startup-wait 45 --output-prefix runtime_selected_pointer_late_poll --sequence 'late-menu-explore=Return,Return,z,Return,Down,Return,Down,Return,Up,Return,Escape,Return,space,Return,x,Return,c,Return,Right,Return,Left,Return,Down,Down,Return'
python3 tools/probe_runtime_selected_pointer_poll.py --startup-wait 45 --hold 0.35 --gap 0.5 --interval 0.02 --output-prefix runtime_route_watch_values_poll --sequence 'late-menu-explore=Return,Return,z,Return,Down,Return,Down,Return,Up,Return,Escape,Return,space,Return,x,Return,c,Return,Right,Return,Left,Return,Down,Down,Return'
place a non-synthetic savedat under SaveData\savedat1.dat, then run python3 tools/probe_runtime_selected_pointer_poll.py --startup-wait 18 --output-prefix runtime_selected_pointer_savedata_load_poll with load-menu candidate sequences
python3 tools/probe_runtime_selected_pointer_multislot_savedata_poll.py
python3 tools/probe_runtime_selected_pointer_multislot_savedata_poll.py --case-aliases --output-prefix runtime_selected_pointer_multislot_savedata_load_case_alias_poll
python3 tools/probe_runtime_selected_pointer_multislot_savedata_poll.py --prelude input-path --case-aliases --output-prefix runtime_selected_pointer_multislot_savedata_load_input_path_case_alias_poll
python3 tools/probe_runtime_selected_pointer_multislot_savedata_poll.py --prelude input-path --case-aliases --staged-kind 'patched public-base diagnostic' --slot-source 1=out/runtime_patched_public_savedat_selector_2_0.dat --sequence input-path-slot1-down-enter=Down,Return --sequence input-path-slot1-down-enter-enter=Down,Return,Return --output-prefix runtime_selected_pointer_patched_public_selector_2_0_input_path_case_alias_poll
python3 tools/probe_runtime_save_file_io.py --backend strace --sequence load-down-enter=Down,Return --output-prefix runtime_save_file_io_strace_probe
python3 tools/probe_runtime_save_file_io.py --backend strace-attach --sequence load-down-enter=Down,Return --output-prefix runtime_save_file_io_strace_attach_probe
python3 tools/probe_runtime_save_file_io.py --backend strace-attach --output-prefix runtime_save_file_io_strace_attach_load_candidates_probe --sequence load-down-enter=Down,Return --sequence load-down-z=Down,z --sequence load-down-space=Down,space --sequence load-down-x=Down,x --sequence load-return-down-z=Return,Down,z --sequence load-return-down-space=Return,Down,space --sequence load-return-down-x=Return,Down,x --sequence load-down-enter-enter=Down,Return,Return
python3 tools/probe_runtime_save_file_io.py --backend strace-attach --case-aliases --output-prefix runtime_save_file_io_strace_attach_load_candidates_case_alias_probe --sequence load-down-enter=Down,Return --sequence load-down-z=Down,z --sequence load-down-space=Down,space --sequence load-down-x=Down,x --sequence load-return-down-z=Return,Down,z --sequence load-return-down-space=Return,Down,space --sequence load-return-down-x=Return,Down,x --sequence load-down-enter-enter=Down,Return,Return
qemu-i386 /usr/lib/wine/wine --version
env WINEDEBUG=-all qemu-i386 /usr/lib/wine/wine cmd /c ver