{"scope":"direct little-endian dword references in loaded EXE sections","sourceSelector":"0:0","targetSelector":"1:0","currentSelector":"2:0","selectedPointerGlobalHex":"0x0059de30","selectorGroupTableHex":"0x00442d35","currentSelectorRootHex":"0x00540714","currentCodeRefCount":0,"noStaticDirectCurrentSelectorCodeRef":true,"selectedPointerGlobalTextRefCount":6,"selectedPointerHookAccessCounts":{"read":2,"write":4},"selectedPointerWriterHookCount":4,"selectedPointerReaderHookCount":2,"selectedPointerWriterHookVas":["0x004234ba","0x0040adb8","0x0040ae37","0x0040ae4a"],"selectedPointerReaderHookVas":["0x0040add6","0x0040adfe"],"selectedPointerWriteMechanisms":["save-loader-writer","opcode07-indexed-writer","opcode09-mode0-writer","opcode09-mode1-writer"],"selectedPointerReadMechanisms":["opcode08-zero-check","opcode08-activator-read"],"selectedPointerHandlerContextCount":4,"selectedPointerHandlerContextsVerified":true,"selectedPointerHandlerContexts":[{"name":"save-loader-selector-store","handlerVaHex":"0x0042349c","hookVaHexes":["0x004234ba"],"verified":true,"byteChecks":[{"label":"read selector group byte 0x004576da","vaHex":"0x004234a3","expectedBytes":"a0 da 76 45 00","actualBytes":"a0 da 76 45 00","matches":true},{"label":"index selector group table 0x00442d35","vaHex":"0x004234a8","expectedBytes":"8b 04 85 35 2d 44 00","actualBytes":"8b 04 85 35 2d 44 00","matches":true},{"label":"read selector slot byte 0x004576db","vaHex":"0x004234b1","expectedBytes":"8a 0d db 76 45 00","actualBytes":"8a 0d db 76 45 00","matches":true},{"label":"store selected pointer global 0x0059de30","vaHex":"0x004234ba","expectedBytes":"a3 30 de 59 00","actualBytes":"a3 30 de 59 00","matches":true}],"contextEffect":"save bytes 0x0002/0x0003 select a group/slot row, then store the selected root into 0x0059de30","routeImplication":"a captured save must contain selector group 2 slot 0 before this store can prove 0x00540714","traceHook":"watch write 0x004234ba or load a real selector 2:0 savedat"},{"name":"opcode07-indexed-store","handlerVaHex":"0x0040ad9b","hookVaHexes":["0x0040adb8"],"verified":true,"byteChecks":[{"label":"load current stream pointer from context+0x40","vaHex":"0x0040ada4","expectedBytes":"8b 40 40","actualBytes":"8b 40 40","matches":true},{"label":"read zero-extended slot byte at stream+1","vaHex":"0x0040ada9","expectedBytes":"8a 48 01","actualBytes":"8a 48 01","matches":true},{"label":"read pointer table at stream+4","vaHex":"0x0040adb2","expectedBytes":"8b 40 04","actualBytes":"8b 40 04","matches":true},{"label":"select table entry by slot byte","vaHex":"0x0040adb5","expectedBytes":"8b 04 88","actualBytes":"8b 04 88","matches":true},{"label":"store selected pointer global 0x0059de30","vaHex":"0x0040adb8","expectedBytes":"a3 30 de 59 00","actualBytes":"a3 30 de 59 00","matches":true},{"label":"advance stream by 8","vaHex":"0x0040adc0","expectedBytes":"83 40 40 08","actualBytes":"83 40 40 08","matches":true}],"contextEffect":"selected pointer = dword[[context+0x40]+4 + zero_extend(byte[[context+0x40]+1]) * 4]","routeImplication":"non-current roots would need an opcode 0x07 row selecting 0x00540714; current scans find none","traceHook":"break on 0x0040adb8 and inspect eax before store"},{"name":"opcode08-activator","handlerVaHex":"0x0040adc9","hookVaHexes":["0x0040add6","0x0040adfe"],"verified":true,"byteChecks":[{"label":"advance stream by 4 before selected-pointer test","vaHex":"0x0040add2","expectedBytes":"83 40 40 04","actualBytes":"83 40 40 04","matches":true},{"label":"test selected pointer global for zero","vaHex":"0x0040add6","expectedBytes":"83 3d 30 de 59 00 00","actualBytes":"83 3d 30 de 59 00 00","matches":true},{"label":"push return stream into context stack","vaHex":"0x0040adf3","expectedBytes":"89 44 8a 44","actualBytes":"89 44 8a 44","matches":true},{"label":"read selected pointer global 0x0059de30","vaHex":"0x0040adfe","expectedBytes":"a1 30 de 59 00","actualBytes":"a1 30 de 59 00","matches":true},{"label":"replace context+0x40 with selected pointer","vaHex":"0x0040ae06","expectedBytes":"89 41 40","actualBytes":"89 41 40","matches":true}],"contextEffect":"if 0x0059de30 is nonzero, save the current stream and set context+0x40 = 0x0059de30","routeImplication":"0x0040adfe is the narrowest runtime proof point for showing selector 2:0 becomes active bytecode","traceHook":"break on 0x0040adfe and require eax/0x0059de30 == 0x00540714"},{"name":"opcode09-stream-store","handlerVaHex":"0x0040ae0e","hookVaHexes":["0x0040ae37","0x0040ae4a"],"verified":true,"byteChecks":[{"label":"load current stream pointer from context+0x40","vaHex":"0x0040ae1a","expectedBytes":"8b 40 40","actualBytes":"8b 40 40","matches":true},{"label":"read mode byte at stream+1","vaHex":"0x0040ae1f","expectedBytes":"8a 48 01","actualBytes":"8a 48 01","matches":true},{"label":"mode 0 stores post-advance stream pointer","vaHex":"0x0040ae37","expectedBytes":"a3 30 de 59 00","actualBytes":"a3 30 de 59 00","matches":true},{"label":"mode 1 stores stream+4 operand pointer","vaHex":"0x0040ae4a","expectedBytes":"a3 30 de 59 00","actualBytes":"a3 30 de 59 00","matches":true},{"label":"dispatch mode 0","vaHex":"0x0040ae60","expectedBytes":"83 7d fc 00","actualBytes":"83 7d fc 00","matches":true},{"label":"dispatch mode 1","vaHex":"0x0040ae6a","expectedBytes":"83 7d fc 01","actualBytes":"83 7d fc 01","matches":true}],"contextEffect":"mode 0 stores the current active stream, mode 1 stores dword[stream+4], other modes fall through without a selected-pointer store","routeImplication":"opcode 0x09 only promotes if the active stream or operand is already in selector 2:0; current evidence is internal only","traceHook":"break on 0x0040ae37/0x0040ae4a and classify the stored pointer range"}],"routePromotionStatus":"blocked","promotionStatus":"blocked","proofFound":false,"selectedPointerUsageProofFound":false,"failedSelectedPointerUsageGateIds":["static-current-selector-text-ref","selected-pointer-runtime-current-root","opcode08-current-root-activation","real-selector-2-0-savedata","strict-hotspot-or-runtime-producer"],"missingEvidence":[".text reference or decoded control-flow selecting current selector root 0x00540714","runtime watchpoint showing 0x0059de30 becomes 0x00540714","opcode 0x08 activation at 0x0040adfe with context+0x40 set from 0x00540714","captured save bytes 0x0002=0x02 and 0x0003=0x00","strict map1_01a source hotspot or equivalent runtime producer selecting selector 2:0"],"evidenceRefs":[{"path":"Hwanse2.exe","fields":["selectedPointerGlobalHex","selectedPointerWriterHookVas","selectedPointerReaderHookVas","selectedPointerHandlerContexts"]},{"path":"out/save_scene_selectors.json","fields":["currentSelector","currentSelectorRootHex","fieldMaps"]},{"path":"out/save_loader_trace.json","fields":["frontierExample.selectedPointerHex","frontierExample.secondLevelPointerHex","frontierExample.leafPointerHex"]},{"path":"out/save_selector_real_savedata_evidence_gap.json","fields":["currentSelectorRealSaveCount","selectedPointerRealSaveCount","proofFound"]},{"path":"out/runtime_selected_pointer_poll.json","fields":["currentRootHex","observedSelectors","anyReachedRouteSelectorContext"]}],"evidenceRefCount":5,"watchValues":[{"name":"selected-pointer-global","valueHex":"0x0059de30","targetSection":".data","role":"runtime global holding the selected scene/progress pointer","refCount":6,"textRefCount":6,"dataRefCount":0,"sectionCounts":{".text":6},"refs":[{"section":".text","refVaHex":"0x0040adb9","fileOffsetHex":"0x00a1b9","bytesAround":"40 8b 40 04 8b 04 88 a3 30 de 59 00 8b 45 08 83 40 40 08 5f","instructionVaHex":"0x0040adb8","instruction":"mov dword [imm32], eax","access":"write"},{"section":".text","refVaHex":"0x0040add8","fileOffsetHex":"0x00a1d8","bytesAround":"45 08 83 40 40 04 83 3d 30 de 59 00 00 0f 84 26 00 00 00 8b","instructionVaHex":"0x0040add6","instruction":"cmp dword [imm32], imm8","access":"read"},{"section":".text","refVaHex":"0x0040adff","fileOffsetHex":"0x00a1ff","bytesAround":"8b 45 08 66 ff 40 5c a1 30 de 59 00 8b 4d 08 89 41 40 5f 5e","instructionVaHex":"0x0040adfe","instruction":"mov eax, dword [imm32]","access":"read"},{"section":".text","refVaHex":"0x0040ae38","fileOffsetHex":"0x00a238","bytesAround":"04 8b 45 08 8b 40 40 a3 30 de 59 00 e9 38 00 00 00 8b 45 08","instructionVaHex":"0x0040ae37","instruction":"mov dword [imm32], eax","access":"write"},{"section":".text","refVaHex":"0x0040ae4b","fileOffsetHex":"0x00a24b","bytesAround":"08 8b 40 40 8b 40 04 a3 30 de 59 00 8b 45 08 83 40 40 08 e9","instructionVaHex":"0x0040ae4a","instruction":"mov dword [imm32], eax","access":"write"},{"section":".text","refVaHex":"0x004234bb","fileOffsetHex":"0x0228bb","bytesAround":"db 76 45 00 8b 04 88 a3 30 de 59 00 e9 16 01 00 00 6a 01 68","instructionVaHex":"0x004234ba","instruction":"mov dword [imm32], eax","access":"write"}]},{"name":"selector-group-table","valueHex":"0x00442d35","targetSection":".data","role":"save selector group table indexed by save offset 0x0002","refCount":1,"textRefCount":1,"dataRefCount":0,"sectionCounts":{".text":1},"refs":[{"section":".text","refVaHex":"0x004234ab","fileOffsetHex":"0x0228ab","bytesAround":"a0 da 76 45 00 8b 04 85 35 2d 44 00 33 c9 8a 0d db 76 45 00","instructionVaHex":"0x004234a8","instruction":"mov eax, dword [imm32 + eax*4]","access":"read"}]},{"name":"source-selector-row-0:0","valueHex":"0x00500c3c","targetSection":".data","role":"row pointer for source-side selector 0:0","refCount":1,"textRefCount":0,"dataRefCount":1,"sectionCounts":{".data":1},"refs":[{"section":".data","refVaHex":"0x00442d35","fileOffsetHex":"0x040d35","bytesAround":"03 00 00 00 25 2d 44 00 3c 0c 50 00 b4 6a 47 00 28 f3 53 00","instructionVaHex":"0x00442d35","instruction":"dword literal/data pointer","access":"literal"}]},{"name":"source-selector-root-0:0","valueHex":"0x00501808","targetSection":".data","role":"selected pointer root for source-side selector 0:0","refCount":1,"textRefCount":0,"dataRefCount":1,"sectionCounts":{".data":1},"refs":[{"section":".data","refVaHex":"0x00500c3c","fileOffsetHex":"0x0fec3c","bytesAround":"ec 18 50 00 40 17 50 00 08 18 50 00 6d 69 64 64 61 74 61 2e","instructionVaHex":"0x00500c3c","instruction":"dword literal/data pointer","access":"literal"}]},{"name":"target-selector-row-1:0","valueHex":"0x00476ab4","targetSection":".data","role":"row pointer for target-side selector 1:0","refCount":1,"textRefCount":0,"dataRefCount":1,"sectionCounts":{".data":1},"refs":[{"section":".data","refVaHex":"0x00442d39","fileOffsetHex":"0x040d39","bytesAround":"25 2d 44 00 3c 0c 50 00 b4 6a 47 00 28 f3 53 00 fc 8f 4c 00","instructionVaHex":"0x00442d39","instruction":"dword literal/data pointer","access":"literal"}]},{"name":"target-selector-root-1:0","valueHex":"0x00478364","targetSection":".data","role":"selected pointer root for target-side selector 1:0","refCount":1,"textRefCount":0,"dataRefCount":1,"sectionCounts":{".data":1},"refs":[{"section":".data","refVaHex":"0x00476ab4","fileOffsetHex":"0x074ab4","bytesAround":"e0 7c 47 00 58 8f 47 00 64 83 47 00 6d 69 64 64 61 74 61 2e","instructionVaHex":"0x00476ab4","instruction":"dword literal/data pointer","access":"literal"}]},{"name":"current-selector-row-2:0","valueHex":"0x0053f328","targetSection":".data","role":"row pointer for current selector 2:0","refCount":1,"textRefCount":0,"dataRefCount":1,"sectionCounts":{".data":1},"refs":[{"section":".data","refVaHex":"0x00442d3d","fileOffsetHex":"0x040d3d","bytesAround":"3c 0c 50 00 b4 6a 47 00 28 f3 53 00 fc 8f 4c 00 d4 94 44 00","instructionVaHex":"0x00442d3d","instruction":"dword literal/data pointer","access":"literal"}]},{"name":"current-selector-root-2:0","valueHex":"0x00540714","targetSection":".data","role":"selected pointer root for current selector 2:0","refCount":1,"textRefCount":0,"dataRefCount":1,"sectionCounts":{".data":1},"refs":[{"section":".data","refVaHex":"0x0053f328","fileOffsetHex":"0x13d328","bytesAround":"6c 01 54 00 8c 01 54 00 14 07 54 00 6d 69 64 64 61 74 61 2e","instructionVaHex":"0x0053f328","instruction":"dword literal/data pointer","access":"literal"}]},{"name":"current-second-level-table-2:0","valueHex":"0x005429dc","targetSection":".data","role":"second-level table used by selector 2:0","refCount":2,"textRefCount":0,"dataRefCount":2,"sectionCounts":{".data":2},"refs":[{"section":".data","refVaHex":"0x005404f4","fileOffsetHex":"0x13e4f4","bytesAround":"f0 04 54 00 5a 00 00 00 dc 29 54 00 4b 03 00 00 07 03 00 00","instructionVaHex":"0x005404f4","instruction":"dword literal/data pointer","access":"literal"},{"section":".data","refVaHex":"0x0054071c","fileOffsetHex":"0x13e71c","bytesAround":"6d 01 00 00 5a 00 00 00 dc 29 54 00 4b 03 00 00 07 03 00 00","instructionVaHex":"0x0054071c","instruction":"dword literal/data pointer","access":"literal"}]},{"name":"current-frontier-leaf-2:0","valueHex":"0x00542ac0","targetSection":".data","role":"sample frontier leaf for map1_01a -> map2_02d under selector 2:0","refCount":1,"textRefCount":0,"dataRefCount":1,"sectionCounts":{".data":1},"refs":[{"section":".data","refVaHex":"0x005429f4","fileOffsetHex":"0x1409f4","bytesAround":"ac 2a 54 00 80 2e 54 00 c0 2a 54 00 80 2e 54 00 d4 2a 54 00","instructionVaHex":"0x005429f4","instruction":"dword literal/data pointer","access":"literal"}]},{"name":"current-frontier-reader-2:0","valueHex":"0x00542b0c","targetSection":".data","role":"frontier reader/resource gate row before map1_01a -> map2_02d records","refCount":0,"textRefCount":0,"dataRefCount":0,"sectionCounts":{},"refs":[]},{"name":"current-source-record-map1_01a","valueHex":"0x00542b44","targetSection":".data","role":"current selector field-map record for map1_01a","refCount":0,"textRefCount":0,"dataRefCount":0,"sectionCounts":{},"refs":[]},{"name":"current-target-record-map2_02d","valueHex":"0x00542bac","targetSection":".data","role":"current selector field-map record for map2_02d","refCount":0,"textRefCount":0,"dataRefCount":0,"sectionCounts":{},"refs":[]}],"runtimeTraceHookPoints":[{"vaHex":"0x004234ba","present":true,"access":"write","instruction":"mov dword [imm32], eax","mechanism":"save-loader-writer","meaning":"save loader stores selector group/slot result into selected-pointer global","routeRequirement":"captured save bytes must select group 2 slot 0"},{"vaHex":"0x0040adb8","present":true,"access":"write","instruction":"mov dword [imm32], eax","mechanism":"opcode07-indexed-writer","meaning":"opcode 7 stores indexed pointer into selected-pointer global","routeRequirement":"opcode 7 selected slot must resolve to selector 2:0 root"},{"vaHex":"0x0040add6","present":true,"access":"read","instruction":"cmp dword [imm32], imm8","mechanism":"opcode08-zero-check","meaning":"opcode 8 checks whether selected-pointer global is zero before jumping","routeRequirement":"selected-pointer global must already contain selector 2:0 root"},{"vaHex":"0x0040adfe","present":true,"access":"read","instruction":"mov eax, dword [imm32]","mechanism":"opcode08-activator-read","meaning":"opcode 8 reads selected-pointer global and jumps active stream to it","routeRequirement":"selected-pointer global must already contain selector 2:0 root"},{"vaHex":"0x0040ae37","present":true,"access":"write","instruction":"mov dword [imm32], eax","mechanism":"opcode09-mode0-writer","meaning":"opcode 9 mode 0 stores current stream pointer into selected-pointer global","routeRequirement":"current stream must already be inside selector 2:0 range"},{"vaHex":"0x0040ae4a","present":true,"access":"write","instruction":"mov dword [imm32], eax","mechanism":"opcode09-mode1-writer","meaning":"opcode 9 mode 1 stores stream operand pointer into selected-pointer global","routeRequirement":"stream operand must point into selector 2:0 range"}],"nextEvidenceNeeded":["construct or capture a savedata sample with save offsets 0x0002=2 and 0x0003=0","watch writes to 0x0059de30 and verify whether the value becomes 0x00540714","break at opcode 8 handler 0x0040adfe and prove context+0x40 is set from 0x00540714 on the route path","find a strict map1_01a hotspot or runtime producer that selects selector 2:0"],"conclusion":"Selector 2:0 is present as data reachable from the save selector table, but this exact scan finds no .text direct reference to the current selector row/root/leaf/route records. Static evidence still points to the selected-pointer global 0x0059de30 as the runtime choke point: prove group/slot 2:0 by save bytes or catch 0x0059de30 containing 0x00540714 before opcode 8 switches context+0x40 to that stream."}