{"source":"map1_01a","target":"map2_02d","selector":"2:0","rootHex":"0x00540714","frontierReaderHex":"0x00542b0c","opcode2cHandler":{"opcode":44,"opcodeHex":"0x2c","entryVaHex":"0x004407d0","handlerVa":4247680,"handlerVaHex":"0x0040d080","handlerSection":".text","nextHandlerVaHex":"0x0040d248","oldAnalyzerScanBytes":131,"fullHandlerSpanBytes":456,"oldAnalyzerFixedAdvances":[],"fullHandlerFixedAdvances":[{"vaHex":"0x0040d23f","offsetHex":"0x1bf","bytes":4}],"correctedFixedAdvances":[4],"correctedFixedAdvanceBytes":4,"retSites":[{"vaHex":"0x0040d102","offsetHex":"0x82"},{"vaHex":"0x0040d247","offsetHex":"0x1c7"}],"trueRetVaHex":"0x0040d247","falseRetSites":[{"vaHex":"0x0040d102","offsetHex":"0x82","reason":"byte is the first displacement byte of a near jmp, not a ret opcode","instructionVaHex":"0x0040d101","instructionBytesHex":"e9 c3 ff ff ff"}],"oldNoFixedAdvanceIsScannerArtifact":true},"routePairDescriptorCount":2,"oldNoFixedAdvanceStopCount":2,"correctedTraceReachesReaderCount":2,"correctedTraceAllRoutePairDescriptorsReachReader":true,"strictHotspotFound":false,"runtimeSelectionProven":false,"proofFound":false,"opcode2cRoutePairProofFound":false,"failedOpcode2cRoutePairGateIds":["normal-route-descriptor-selection","frontier-reader-target-linkage","strict-source-hotspot"],"missingEvidence":["normal runtime selector/root execution selecting corrected route-pair descriptors","frontier reader branch outcome and field-map target linkage on a real route path","strict map1_01a source coordinate or hotspot"],"evidenceRefs":[{"path":"Hwanse2.exe","fields":[".text","handler table","opcode 0x2c"]},{"path":"out/save_selector_route_pair_descriptor_context.json","fields":["rows","frontierReaderHex","descriptorTrace","geometryExitWordHitCount"]}],"evidenceRefCount":2,"promotionStatus":"blocked","rows":[{"index":6,"entryVaHex":"0x005429f4","descriptorHex":"0x00542ac0","childPointerHex":"0x00542e10","oldDescriptorTrace":{"streamKind":"leaf","streamVaHex":"0x00542ac0","stepCount":4,"opcodes":["0x3f","0x10","0x26","0x2c"],"stopVaHex":"0x00542acc","stopOpcodeHex":"0x2c","stopReason":"no-fixed-advance","containsFrontierReader":false},"correctedTrace":{"stepCount":18,"opcodes":["0x3f","0x10","0x26","0x2c","0x01","0x3f","0x48","0x26","0x2c","0x01","0x12","0x38","0x16","0x10","0x12","0x63","0x50","0x11"],"reachesFrontierReader":true,"frontierReaderStep":17,"stopVaHex":"0x00542b0c","stopOpcodeHex":"0x11","stopReason":"frontier-reader"},"correctedTraceRows":[{"step":0,"va":5515968,"vaHex":"0x00542ac0","value":63,"valueHex":"0x0000003f","opcode":63,"opcodeHex":"0x3f","entryVaHex":"0x0044081c","handlerVa":4203423,"handlerVaHex":"0x0040239f","handlerSection":".text","isDefaultHandler":true,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[],"overrideReason":null},{"step":1,"va":5515972,"vaHex":"0x00542ac4","value":5516816,"valueHex":"0x00542e10","opcode":16,"opcodeHex":"0x10","entryVaHex":"0x00440760","handlerVa":4240542,"handlerVaHex":"0x0040b49e","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x0c","vaHex":"0x0040b4aa","streamOffset":2,"streamOffsetHex":"0x02"}],"overrideReason":null,"pointer":true,"pointerHex":"0x00542e10"},{"step":2,"va":5515976,"vaHex":"0x00542ac8","value":2109478,"valueHex":"0x00203026","opcode":38,"opcodeHex":"0x26","entryVaHex":"0x004407b8","handlerVa":4245832,"handlerVaHex":"0x0040c948","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0xe1","vaHex":"0x0040ca29","streamOffset":12,"streamOffsetHex":"0x0c"}],"overrideReason":null},{"step":3,"va":5515980,"vaHex":"0x00542acc","value":5501740,"valueHex":"0x0053f32c","opcode":44,"opcodeHex":"0x2c","entryVaHex":"0x004407d0","handlerVa":4247680,"handlerVaHex":"0x0040d080","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x2d","vaHex":"0x0040d0ad","streamOffset":1,"streamOffsetHex":"0x01"}],"overrideReason":"full handler scan finds add [context+0x40], +4 after the old analyzer clipped on a jmp displacement byte","pointer":true,"pointerHex":"0x0053f32c"},{"step":4,"va":5515984,"vaHex":"0x00542ad0","value":1,"valueHex":"0x00000001","opcode":1,"opcodeHex":"0x01","entryVaHex":"0x00440724","handlerVa":4203423,"handlerVaHex":"0x0040239f","handlerSection":".text","isDefaultHandler":true,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[],"overrideReason":null},{"step":5,"va":5515988,"vaHex":"0x00542ad4","value":63,"valueHex":"0x0000003f","opcode":63,"opcodeHex":"0x3f","entryVaHex":"0x0044081c","handlerVa":4203423,"handlerVaHex":"0x0040239f","handlerSection":".text","isDefaultHandler":true,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[],"overrideReason":null},{"step":6,"va":5515992,"vaHex":"0x00542ad8","value":5516872,"valueHex":"0x00542e48","opcode":72,"opcodeHex":"0x48","entryVaHex":"0x00440840","handlerVa":4255455,"handlerVaHex":"0x0040eedf","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":true,"streamReads":[{"handlerOffsetHex":"0x50","vaHex":"0x0040ef2f","streamOffset":1,"streamOffsetHex":"0x01"},{"handlerOffsetHex":"0xd3","vaHex":"0x0040efb2","streamOffset":1,"streamOffsetHex":"0x01"},{"handlerOffsetHex":"0xe7","vaHex":"0x0040efc6","streamOffset":1,"streamOffsetHex":"0x01"}],"overrideReason":null,"pointer":true,"pointerHex":"0x00542e48"},{"step":7,"va":5515996,"vaHex":"0x00542adc","value":2109478,"valueHex":"0x00203026","opcode":38,"opcodeHex":"0x26","entryVaHex":"0x004407b8","handlerVa":4245832,"handlerVaHex":"0x0040c948","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0xe1","vaHex":"0x0040ca29","streamOffset":12,"streamOffsetHex":"0x0c"}],"overrideReason":null},{"step":8,"va":5516000,"vaHex":"0x00542ae0","value":5501740,"valueHex":"0x0053f32c","opcode":44,"opcodeHex":"0x2c","entryVaHex":"0x004407d0","handlerVa":4247680,"handlerVaHex":"0x0040d080","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x2d","vaHex":"0x0040d0ad","streamOffset":1,"streamOffsetHex":"0x01"}],"overrideReason":"full handler scan finds add [context+0x40], +4 after the old analyzer clipped on a jmp displacement byte","pointer":true,"pointerHex":"0x0053f32c"},{"step":9,"va":5516004,"vaHex":"0x00542ae4","value":1,"valueHex":"0x00000001","opcode":1,"opcodeHex":"0x01","entryVaHex":"0x00440724","handlerVa":4203423,"handlerVaHex":"0x0040239f","handlerSection":".text","isDefaultHandler":true,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[],"overrideReason":null},{"step":10,"va":5516008,"vaHex":"0x00542ae8","value":667666,"valueHex":"0x000a3012","opcode":18,"opcodeHex":"0x12","entryVaHex":"0x00440768","handlerVa":4240735,"handlerVaHex":"0x0040b55f","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x11","vaHex":"0x0040b570","streamOffset":1,"streamOffsetHex":"0x01"},{"handlerOffsetHex":"0x46","vaHex":"0x0040b5a5","streamOffset":2,"streamOffsetHex":"0x02"}],"overrideReason":null},{"step":11,"va":5516012,"vaHex":"0x00542aec","value":5501752,"valueHex":"0x0053f338","opcode":56,"opcodeHex":"0x38","entryVaHex":"0x00440800","handlerVa":4251255,"handlerVaHex":"0x0040de77","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[8],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[],"overrideReason":null,"cns":"map_a1.cns"},{"step":12,"va":5516020,"vaHex":"0x00542af4","value":733206,"valueHex":"0x000b3016","opcode":22,"opcodeHex":"0x16","entryVaHex":"0x00440778","handlerVa":4241983,"handlerVaHex":"0x0040ba3f","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[8],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x0c","vaHex":"0x0040ba4b","streamOffset":4,"streamOffsetHex":"0x04"}],"overrideReason":null},{"step":13,"va":5516028,"vaHex":"0x00542afc","value":1048592,"valueHex":"0x00100010","opcode":16,"opcodeHex":"0x10","entryVaHex":"0x00440760","handlerVa":4240542,"handlerVaHex":"0x0040b49e","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x0c","vaHex":"0x0040b4aa","streamOffset":2,"streamOffsetHex":"0x02"}],"overrideReason":null},{"step":14,"va":5516032,"vaHex":"0x00542b00","value":888850,"valueHex":"0x000d9012","opcode":18,"opcodeHex":"0x12","entryVaHex":"0x00440768","handlerVa":4240735,"handlerVaHex":"0x0040b55f","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x11","vaHex":"0x0040b570","streamOffset":1,"streamOffsetHex":"0x01"},{"handlerOffsetHex":"0x46","vaHex":"0x0040b5a5","streamOffset":2,"streamOffsetHex":"0x02"}],"overrideReason":null},{"step":15,"va":5516036,"vaHex":"0x00542b04","value":5502051,"valueHex":"0x0053f463","opcode":99,"opcodeHex":"0x63","entryVaHex":"0x004408ac","handlerVa":4259919,"handlerVaHex":"0x0041004f","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x18","vaHex":"0x00410067","streamOffset":1,"streamOffsetHex":"0x01"}],"overrideReason":null,"cns":"face_01.cns"},{"step":16,"va":5516040,"vaHex":"0x00542b08","value":5242960,"valueHex":"0x00500050","opcode":80,"opcodeHex":"0x50","entryVaHex":"0x00440860","handlerVa":4203423,"handlerVaHex":"0x0040239f","handlerSection":".text","isDefaultHandler":true,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[],"overrideReason":null,"pointer":true,"pointerHex":"0x00500050"},{"step":17,"va":5516044,"vaHex":"0x00542b0c","value":2134033,"valueHex":"0x00209011","opcode":17,"opcodeHex":"0x11","entryVaHex":"0x00440764","handlerVa":4240614,"handlerVaHex":"0x0040b4e6","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[8],"canJumpToDwordAtPlus4":true,"writesStream":true,"streamReads":[{"handlerOffsetHex":"0x11","vaHex":"0x0040b4f7","streamOffset":1,"streamOffsetHex":"0x01"},{"handlerOffsetHex":"0x37","vaHex":"0x0040b51d","streamOffset":2,"streamOffsetHex":"0x02"},{"handlerOffsetHex":"0x5f","vaHex":"0x0040b545","streamOffset":4,"streamOffsetHex":"0x04"}],"overrideReason":null,"branchTargetHex":"0x0053f46f","fallthroughVaHex":"0x00542b14","stopReason":"frontier-reader"}],"geometryExitWordHitCount":0,"sourceToTargetAdjacent":true},{"index":8,"entryVaHex":"0x005429fc","descriptorHex":"0x00542ad4","childPointerHex":"0x00542e48","oldDescriptorTrace":{"streamKind":"leaf","streamVaHex":"0x00542ad4","stepCount":4,"opcodes":["0x3f","0x48","0x26","0x2c"],"stopVaHex":"0x00542ae0","stopOpcodeHex":"0x2c","stopReason":"no-fixed-advance","containsFrontierReader":false},"correctedTrace":{"stepCount":13,"opcodes":["0x3f","0x48","0x26","0x2c","0x01","0x12","0x38","0x16","0x10","0x12","0x63","0x50","0x11"],"reachesFrontierReader":true,"frontierReaderStep":12,"stopVaHex":"0x00542b0c","stopOpcodeHex":"0x11","stopReason":"frontier-reader"},"correctedTraceRows":[{"step":0,"va":5515988,"vaHex":"0x00542ad4","value":63,"valueHex":"0x0000003f","opcode":63,"opcodeHex":"0x3f","entryVaHex":"0x0044081c","handlerVa":4203423,"handlerVaHex":"0x0040239f","handlerSection":".text","isDefaultHandler":true,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[],"overrideReason":null},{"step":1,"va":5515992,"vaHex":"0x00542ad8","value":5516872,"valueHex":"0x00542e48","opcode":72,"opcodeHex":"0x48","entryVaHex":"0x00440840","handlerVa":4255455,"handlerVaHex":"0x0040eedf","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":true,"streamReads":[{"handlerOffsetHex":"0x50","vaHex":"0x0040ef2f","streamOffset":1,"streamOffsetHex":"0x01"},{"handlerOffsetHex":"0xd3","vaHex":"0x0040efb2","streamOffset":1,"streamOffsetHex":"0x01"},{"handlerOffsetHex":"0xe7","vaHex":"0x0040efc6","streamOffset":1,"streamOffsetHex":"0x01"}],"overrideReason":null,"pointer":true,"pointerHex":"0x00542e48"},{"step":2,"va":5515996,"vaHex":"0x00542adc","value":2109478,"valueHex":"0x00203026","opcode":38,"opcodeHex":"0x26","entryVaHex":"0x004407b8","handlerVa":4245832,"handlerVaHex":"0x0040c948","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0xe1","vaHex":"0x0040ca29","streamOffset":12,"streamOffsetHex":"0x0c"}],"overrideReason":null},{"step":3,"va":5516000,"vaHex":"0x00542ae0","value":5501740,"valueHex":"0x0053f32c","opcode":44,"opcodeHex":"0x2c","entryVaHex":"0x004407d0","handlerVa":4247680,"handlerVaHex":"0x0040d080","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x2d","vaHex":"0x0040d0ad","streamOffset":1,"streamOffsetHex":"0x01"}],"overrideReason":"full handler scan finds add [context+0x40], +4 after the old analyzer clipped on a jmp displacement byte","pointer":true,"pointerHex":"0x0053f32c"},{"step":4,"va":5516004,"vaHex":"0x00542ae4","value":1,"valueHex":"0x00000001","opcode":1,"opcodeHex":"0x01","entryVaHex":"0x00440724","handlerVa":4203423,"handlerVaHex":"0x0040239f","handlerSection":".text","isDefaultHandler":true,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[],"overrideReason":null},{"step":5,"va":5516008,"vaHex":"0x00542ae8","value":667666,"valueHex":"0x000a3012","opcode":18,"opcodeHex":"0x12","entryVaHex":"0x00440768","handlerVa":4240735,"handlerVaHex":"0x0040b55f","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x11","vaHex":"0x0040b570","streamOffset":1,"streamOffsetHex":"0x01"},{"handlerOffsetHex":"0x46","vaHex":"0x0040b5a5","streamOffset":2,"streamOffsetHex":"0x02"}],"overrideReason":null},{"step":6,"va":5516012,"vaHex":"0x00542aec","value":5501752,"valueHex":"0x0053f338","opcode":56,"opcodeHex":"0x38","entryVaHex":"0x00440800","handlerVa":4251255,"handlerVaHex":"0x0040de77","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[8],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[],"overrideReason":null,"cns":"map_a1.cns"},{"step":7,"va":5516020,"vaHex":"0x00542af4","value":733206,"valueHex":"0x000b3016","opcode":22,"opcodeHex":"0x16","entryVaHex":"0x00440778","handlerVa":4241983,"handlerVaHex":"0x0040ba3f","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[8],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x0c","vaHex":"0x0040ba4b","streamOffset":4,"streamOffsetHex":"0x04"}],"overrideReason":null},{"step":8,"va":5516028,"vaHex":"0x00542afc","value":1048592,"valueHex":"0x00100010","opcode":16,"opcodeHex":"0x10","entryVaHex":"0x00440760","handlerVa":4240542,"handlerVaHex":"0x0040b49e","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x0c","vaHex":"0x0040b4aa","streamOffset":2,"streamOffsetHex":"0x02"}],"overrideReason":null},{"step":9,"va":5516032,"vaHex":"0x00542b00","value":888850,"valueHex":"0x000d9012","opcode":18,"opcodeHex":"0x12","entryVaHex":"0x00440768","handlerVa":4240735,"handlerVaHex":"0x0040b55f","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x11","vaHex":"0x0040b570","streamOffset":1,"streamOffsetHex":"0x01"},{"handlerOffsetHex":"0x46","vaHex":"0x0040b5a5","streamOffset":2,"streamOffsetHex":"0x02"}],"overrideReason":null},{"step":10,"va":5516036,"vaHex":"0x00542b04","value":5502051,"valueHex":"0x0053f463","opcode":99,"opcodeHex":"0x63","entryVaHex":"0x004408ac","handlerVa":4259919,"handlerVaHex":"0x0041004f","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[{"handlerOffsetHex":"0x18","vaHex":"0x00410067","streamOffset":1,"streamOffsetHex":"0x01"}],"overrideReason":null,"cns":"face_01.cns"},{"step":11,"va":5516040,"vaHex":"0x00542b08","value":5242960,"valueHex":"0x00500050","opcode":80,"opcodeHex":"0x50","entryVaHex":"0x00440860","handlerVa":4203423,"handlerVaHex":"0x0040239f","handlerSection":".text","isDefaultHandler":true,"fixedAdvances":[4],"canJumpToDwordAtPlus4":false,"writesStream":false,"streamReads":[],"overrideReason":null,"pointer":true,"pointerHex":"0x00500050"},{"step":12,"va":5516044,"vaHex":"0x00542b0c","value":2134033,"valueHex":"0x00209011","opcode":17,"opcodeHex":"0x11","entryVaHex":"0x00440764","handlerVa":4240614,"handlerVaHex":"0x0040b4e6","handlerSection":".text","isDefaultHandler":false,"fixedAdvances":[8],"canJumpToDwordAtPlus4":true,"writesStream":true,"streamReads":[{"handlerOffsetHex":"0x11","vaHex":"0x0040b4f7","streamOffset":1,"streamOffsetHex":"0x01"},{"handlerOffsetHex":"0x37","vaHex":"0x0040b51d","streamOffset":2,"streamOffsetHex":"0x02"},{"handlerOffsetHex":"0x5f","vaHex":"0x0040b545","streamOffset":4,"streamOffsetHex":"0x04"}],"overrideReason":null,"branchTargetHex":"0x0053f46f","fallthroughVaHex":"0x00542b14","stopReason":"frontier-reader"}],"geometryExitWordHitCount":0,"sourceToTargetAdjacent":true}],"conclusion":"The previous route-pair descriptor traces stopped at opcode 0x2c because the generic handler scanner clipped the handler at a 0xc3 byte inside a near-jump displacement. A full handler-span scan shows opcode 0x2c ends by advancing the stream pointer by four bytes. With that local correction, both non-negative current route-pair descriptors can be linearly traced to the frontier reader 0x00542b0c. This removes opcode 0x2c as the immediate trace blocker, but it does not promote map1_01a -> map2_02d because a strict source coordinate/hotspot and normal runtime selector execution proof are still missing.","remainingProofs":["normal runtime selector/root execution selecting corrected route-pair descriptors","frontier reader branch outcome and field-map target linkage on a real route path","strict map1_01a source coordinate or hotspot"]}