[{"source":"map1_01a","target":"map2_02d","nearestWriterVaHex":"0x005428bc","frontierReaderVaHex":"0x00542b0c","firstGateTrace":[{"step":0,"vaHex":"0x005428c4","valueHex":"0x00e88111","opcodeHex":"0x11","handlerVaHex":"0x0040b4e6","branchTargetHex":"0x00000001","fallthroughVaHex":"0x005428cc","stopReason":"branch-or-fallthrough","branchNote":"if table[(context+0xa8)[stream+2]] == 1 then fall through +8; table is 0x59e370 when stream+1 is 0, otherwise 0x59e360; else jump to dword [stream+4]"}],"secondGateTrace":[{"step":0,"vaHex":"0x005428cc","valueHex":"0x00ea8211","opcodeHex":"0x11","handlerVaHex":"0x0040b4e6","branchTargetHex":"0x00000002","fallthroughVaHex":"0x005428d4","stopReason":"branch-or-fallthrough","branchNote":"if table[(context+0xa8)[stream+2]] == 1 then fall through +8; table is 0x59e370 when stream+1 is 0, otherwise 0x59e360; else jump to dword [stream+4]"}],"postGateTrace":[{"step":0,"vaHex":"0x005428d4","valueHex":"0x01e68210","opcodeHex":"0x10","handlerVaHex":"0x0040b49e","branchTargetHex":null,"fallthroughVaHex":null,"stopReason":null,"branchNote":null},{"step":1,"vaHex":"0x005428d8","valueHex":"0x01e78110","opcodeHex":"0x10","handlerVaHex":"0x0040b49e","branchTargetHex":null,"fallthroughVaHex":null,"stopReason":null,"branchNote":null},{"step":2,"vaHex":"0x005428dc","valueHex":"0x000a0021","opcodeHex":"0x21","handlerVaHex":"0x0040239f","branchTargetHex":null,"fallthroughVaHex":null,"stopReason":null,"branchNote":null},{"step":3,"vaHex":"0x005428e0","valueHex":"0x00200021","opcodeHex":"0x21","handlerVaHex":"0x0040239f","branchTargetHex":null,"fallthroughVaHex":null,"stopReason":null,"branchNote":null},{"step":4,"vaHex":"0x005428e4","valueHex":"0x0c000124","opcodeHex":"0x24","handlerVaHex":"0x0040c513","branchTargetHex":null,"fallthroughVaHex":null,"stopReason":null,"branchNote":null},{"step":5,"vaHex":"0x005428e8","valueHex":"0x00010021","opcodeHex":"0x21","handlerVaHex":"0x0040239f","branchTargetHex":null,"fallthroughVaHex":null,"stopReason":null,"branchNote":null},{"step":6,"vaHex":"0x005428ec","valueHex":"0x00210000","opcodeHex":"0x00","handlerVaHex":"0x0040239f","branchTargetHex":null,"fallthroughVaHex":null,"stopReason":null,"branchNote":null},{"step":7,"vaHex":"0x005428f0","valueHex":"0x00000003","opcodeHex":"0x03","handlerVaHex":"0x0040239f","branchTargetHex":null,"fallthroughVaHex":null,"stopReason":null,"branchNote":null},{"step":8,"vaHex":"0x005428f4","valueHex":"0x005428e8","opcodeHex":"0xe8","handlerVaHex":"0x00440c28","branchTargetHex":null,"fallthroughVaHex":null,"stopReason":"no-fixed-advance","branchNote":null}],"dispatchStopVaHex":"0x005428f4","dispatchStopOpcodeHex":"0xe8","dispatchStopHandlerVaHex":"0x00440c28","dispatchStopHandlerSection":".data","dispatchStopIsCodeHandler":false,"dispatchContext":[{"vaHex":"0x005428f4","valueHex":"0x005428e8","kind":"pointer","targetHex":"0x005428e8"},{"vaHex":"0x005428f8","valueHex":"0x00000008","kind":"scalar"},{"vaHex":"0x005428fc","valueHex":"0x00000003","kind":"scalar"},{"vaHex":"0x00542900","valueHex":"0x10000000","kind":"scalar"},{"vaHex":"0x00542904","valueHex":"0x0011e802","kind":"scalar"},{"vaHex":"0x00542908","valueHex":"0x0004ea02","kind":"scalar"},{"vaHex":"0x0054290c","valueHex":"0x0003e601","kind":"scalar"},{"vaHex":"0x00542910","valueHex":"0x0003e701","kind":"scalar"},{"vaHex":"0x00542914","valueHex":"0x00002c03","kind":"scalar"},{"vaHex":"0x00542918","valueHex":"0x00000001","kind":"scalar"}],"opcode24Boundary":{"opcodeVaHex":"0x005428e4","opcodeValueHex":"0x0c000124","handlerVaHex":"0x0040c513","streamPlus1Hex":"0x01","meaning":"Opcode 0x24 is an action/state handler. It reads stream+1 as a mode, checks runtime globals 0x0059e34d/0x0059e33e and object state fields, writes context+0x58 in several branches, and only has a simple +4 advance in the statically detected path.","nextDword":{"vaHex":"0x005428e8","valueHex":"0x00010021","kind":"scalar"},"nextLowByteOpcodeHex":"0x21","nextLowByteHandlerVaHex":"0x0040239f","nextLowByteHandlerSection":".text","nextLowByteIsCodeHandler":true},"frontierLeafPointerHex":"0x00542ae8","frontierLeafFieldRecords":[{"recordVaHex":"0x00542b44","filename":"map1_01a.cns","map":"map1_01a","sceneIdHex":"0x0518"},{"recordVaHex":"0x00542bac","filename":"map2_02d.cns","map":"map2_02d","sceneIdHex":"0x0818"},{"recordVaHex":"0x00542c14","filename":"map2_18d.cns","map":"map2_18d","sceneIdHex":"0x1818"}],"conclusion":"The nearest writer 0x005428bc does not linearly prove the frontier reader. It falls through two 0x11 gates with scalar branch targets 0x00000001/0x00000002, then reaches opcode 0x24 at 0x005428e4. Opcode 0x24 is a runtime action/state handler, so the bytes after 0x005428e4 are not proven linear bytecode by the simple stream tracer. The naive linear trace later reaches low byte 0xe8 at 0x005428f4, but its handler-table entry 0x00440c28 is in .data rather than code. The next proof step is decoding that action/state payload boundary and showing it selects leaf 0x00542ae8 before the 0x00542b0c reader."}]