{"mode1SourceHex":"0x0059e348","globalBufferBaseHex":"0x0059e310","mode1OffsetHex":"0x38","globalScanRangeHex":"0x0059e300..0x0059e350","readFileIatVaHex":"0x005a041c","readFileCallCount":30,"globalDestinationReadFileCount":2,"mode1FileReadCandidateCount":0,"mode1FileReadProducerFound":false,"globalDestinationReadFileRows":[{"callVaHex":"0x004232b1","readFileIatVaHex":"0x005a041c","destinationSetupVaHex":"0x004232a4","destinationPushVaHex":"0x004232ac","destinationHex":"0x0059e321","destinationOffsetFromGlobalBase":17,"destinationOffsetFromGlobalBaseHex":"0x11","readSize":1,"readSizeHex":"0x01","readSizeVaHex":"0x004232a2","readSizeInstruction":"push imm8","coversMode1Source":false,"setupInstruction":"mov eax, imm32; add eax, 0x11; push eax"},{"callVaHex":"0x004232e8","readFileIatVaHex":"0x005a041c","destinationSetupVaHex":"0x004232db","destinationPushVaHex":"0x004232e3","destinationHex":"0x0059e322","destinationOffsetFromGlobalBase":18,"destinationOffsetFromGlobalBaseHex":"0x12","readSize":1,"readSizeHex":"0x01","readSizeVaHex":"0x004232d9","readSizeInstruction":"push imm8","coversMode1Source":false,"setupInstruction":"mov eax, imm32; add eax, 0x12; push eax"}],"mode1FileReadCandidates":[],"proofFound":false,"opcode24Mode1FileReadProofFound":false,"failedOpcode24Mode1FileReadGateIds":["readfile-mode1-source-producer","runtime-file-io-trace","runtime-watchpoint-trace"],"missingEvidence":["ReadFile destination/size covering opcode 0x24 mode1 source 0x0059e348","runtime file-I/O trace proving a save/file read initializes 0x0059e348","runtime watchpoint trace proving the 0x0059e348 producer"],"evidenceRefs":[{"path":"Hwanse2.exe","description":"ReadFile IAT call and destination argument scan"},{"path":"out/exe_imports.json","description":"KERNEL32.ReadFile IAT address"},{"path":"out/runtime_trace_feasibility.json","description":"runtime file-I/O/watchpoint trace blocker"}],"evidenceRefCount":3,"promotionStatus":"blocked","conclusion":"The bounded ReadFile argument scan found global-buffer file reads only for offsets 0x11 and 0x12 of 0x0059e310. Both reads transfer one byte and therefore do not cover opcode 0x24 mode1 source 0x0059e348 (+0x38). This rules out the obvious file-read producer shape seen in the same global buffer function, but it is still a static argument-pattern scan rather than a full runtime watchpoint trace."}