{"source":"map1_01a","target":"map2_02d","runtimeEnabledFlagHex":"0x0059e34d","handlerVaHex":"0x0040c513","flagReadInstructionVaHex":"0x0040c51e","flagPassTargetVaHex":"0x0040c538","flagFailAdvanceVaHex":"0x0040c52c","storage":{"sectionName":".data","sectionVaHex":"0x0043c000","sectionRawSizeHex":"0x0011de00","sectionVirtualSizeHex":"0x001634c0","sectionRawEndVaHex":"0x00559e00","sectionVirtualEndVaHex":"0x0059f4c0","runtimeEnabledFlagInKnownSection":true,"runtimeEnabledFlagRawOffsetHex":null,"runtimeEnabledFlagHasRawByte":false,"runtimeEnabledFlagAfterRawEndBytes":279885,"runtimeEnabledFlagAfterRawEndHex":"0x0004454d","staticInitialValue":0,"staticInitialValueHex":"0x00","staticInitialValueKind":"pe-zero-filled-section-tail","zeroInitializedByPeLoader":true},"saveReadBlocks":[{"callVaHex":"0x00423404","targetVaHex":"0x004576d8","endVaHex":"0x0045774a","saveOffsetHex":"0x0000","sizeHex":"0x0072","description":"first save block, includes scene selector bytes and tile/camera candidates","containsRuntimeEnabledFlag":false,"distanceAfterEnd":1338371,"distanceAfterEndHex":"0x00146c03"},{"callVaHex":"0x00423430","targetVaHex":"0x00457750","endVaHex":"0x004579d8","saveOffsetHex":"0x0072","sizeHex":"0x0288","description":"second save block","containsRuntimeEnabledFlag":false,"distanceAfterEnd":1337717,"distanceAfterEndHex":"0x00146975"},{"callVaHex":"0x0042345c","targetVaHex":"0x0059db60","endVaHex":"0x0059dd60","saveOffsetHex":"0x02fa","sizeHex":"0x0200","description":"third save block","containsRuntimeEnabledFlag":false,"distanceAfterEnd":1517,"distanceAfterEndHex":"0x000005ed"}],"saveReadBlockContainsRuntimeEnabledFlag":false,"directTextRefCount":12,"directReadCount":12,"directWriteCount":0,"opcode24GlobalsDirectTextRefCount":12,"opcode24GlobalsDirectReadCount":12,"opcode24GlobalsDirectWriteCount":0,"refs":[{"addressHex":"0x0059e34d","refVaHex":"0x00406b01","instructionVaHex":"0x00406b00","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"early object/event handler gate"},{"addressHex":"0x0059e34d","refVaHex":"0x00406bd5","instructionVaHex":"0x00406bd4","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"early object/event handler gate"},{"addressHex":"0x0059e34d","refVaHex":"0x00406cfa","instructionVaHex":"0x00406cf9","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"early object/event handler gate"},{"addressHex":"0x0059e34d","refVaHex":"0x0040c51f","instructionVaHex":"0x0040c51e","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"opcode 0x24 handler runtime gate"},{"addressHex":"0x0059e34d","refVaHex":"0x0040fa79","instructionVaHex":"0x0040fa78","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"adjacent object-list/object-copy handler"},{"addressHex":"0x0059e34d","refVaHex":"0x0040fb3e","instructionVaHex":"0x0040fb3d","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"adjacent object-list/object-copy handler"},{"addressHex":"0x0059e34d","refVaHex":"0x0041dde0","instructionVaHex":"0x0041dddf","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"object/stat comparison branch-state handler"},{"addressHex":"0x0059e34d","refVaHex":"0x0041df50","instructionVaHex":"0x0041df4f","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"other text routine"},{"addressHex":"0x0059e34d","refVaHex":"0x004204bf","instructionVaHex":"0x004204be","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"runtime object count/availability helper"},{"addressHex":"0x0059e34d","refVaHex":"0x004348e1","instructionVaHex":"0x004348e0","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"object stat/attribute helper"},{"addressHex":"0x0059e34d","refVaHex":"0x004352d8","instructionVaHex":"0x004352d7","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"object stat/attribute helper"},{"addressHex":"0x0059e34d","refVaHex":"0x00435399","instructionVaHex":"0x00435398","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"object stat/attribute helper"}],"opcode24GateRef":{"addressHex":"0x0059e34d","refVaHex":"0x0040c51f","instructionVaHex":"0x0040c51e","accessKind":"read","width":1,"instruction":"mov al, ds:[addr]","context":"opcode 0x24 handler runtime gate"},"runtimeFlagUnwrittenStaticSource":true,"runtimeFlagNotSavedataBacked":true,"runtimeFlagStaticInitialZero":true,"diagnosticRuntimeWatch":{"available":true,"sourcePoll":"runtime_selected_pointer_patched_public_selector_2_0_active_order_poll.json","diagnosticOnly":true,"totalSampleCount":374,"totalSequenceCount":2,"routeSampleCount":210,"routeSequenceCount":1,"routeSequenceNames":["input-path-slot1-down-enter-enter"],"observedSelectors":["50:0","2:0","10:0"],"reachedCurrentRoot":true,"reachedRouteSelector":true,"mode1SourceValueHex":"0x00","runtimeFlagValueHex":"0x00","currentObjectIndexValueHex":"0x00","allWatchedValuesStable":true,"runtimeFlagStaysDisabledInDiagnostic":true,"mode1SourceStaysZeroInDiagnostic":true,"currentObjectIndexStaysZeroInDiagnostic":true,"normalRouteProof":false,"notRoutePromotionProof":true,"promotionStatus":"diagnostic-only"},"modeDispatchRequiresRuntimeFlagOne":true,"staticEvidenceProvesModeDispatch":false,"proofFound":false,"opcode24RuntimeEnabledProofFound":false,"opcode24ModeDispatchProofFound":false,"failedOpcode24RuntimeEnabledGateIds":["runtime-enabled-flag-producer","mode1-source-runtime-producer","selected-root-or-strict-hotspot-proof"],"missingEvidence":["runtime producer for 0x0059e34d if opcode 0x24 mode dispatch is needed","runtime producer for mode1 source 0x0059e348","selector 2:0 execution order or strict map1_01a source hotspot"],"evidenceRefs":[{"path":"Hwanse2.exe","fields":[".text",".data","0x0059e34d"]},{"path":"out/save_loader_trace.json","fields":["saveReadBlocks","targetVaHex","sizeHex"]},{"path":"out/save_selector_opcode24_globals.json","fields":["rows","globalVaHex","directTextRefCount","directWriteCount"]},{"path":"out/runtime_selected_pointer_patched_public_selector_2_0_active_order_poll.json","fields":["rows","uniqueWatchValues","reachedRouteSelectorContext"]}],"evidenceRefCount":4,"promotionStatus":"blocked","remainingProofs":["capture or infer a runtime producer for 0x0059e34d if opcode 0x24 mode dispatch is needed","capture or infer the runtime producer for mode1 source 0x0059e348","prove selector 2:0 execution order or find a strict map1_01a source hotspot"],"conclusion":"Opcode 0x24 first checks runtime flag 0x0059e34d. If it is not 1, the handler advances the stream by +4 at 0x0040c52c and skips the mode-specific object-state update; if it is 1, it enters the mode dispatch at 0x0040c538. Static storage evidence puts this flag in the PE zero-filled .data tail with process-start value 0, outside the known save-loader blocks, and with no direct .text writer. The patched selector 2:0 diagnostic route row also keeps 0x0059e34d at 0x00 while reaching the constructed selector, so the diagnostic capture does not prove the mode dispatch runs. Therefore the current opcode 0x24 mode1 path is runtime-flag dependent: static and diagnostic evidence alone cannot prove that the 0x0059e348 object+0x61 write runs on the normal route path."}