Lj|GdZddlmZddlZddlZddlZddlmZddlm Z ddl m Z ddl m Z mZmZe ej#j$dZed z Zed z Zed z Zd Zd Zd"dZd#dZd$dZd%dZd&dZd'dZd(dZd)d*dZ d+dZ!d,dZ"d-dZ#d-dZ$d.dZ%d/dZ&ddd0dZ'd1dZ(d2d Z)e*d!k(r e+e)y)3aClassify static references to the generic display/object VM root. The generic runner at 0x00402321 is intentionally broad: battle effects, status/menu descriptors, active objects, and generic script objects can all install it as their update callback. This pass classifies every immediate reference to that root so we do not mistake generic object creation for a normal-field ESC/X HUD opener or a scene-route producer. ) annotationsN)Counter)Path)Any) offset_to_va read_sections va_to_offsetz Hwanse2.exeoutwebi!#@i[[Cc|dSd|dS)N-0x08xvalues 1tools/build_display_vm_root_ref_context_review.pyhxrs-35r%%55cVtj|ddSt|dS)NT)quote)htmlescapestrrs rhr#s% ;;U]r$ GGE $ GGrcr|D]2}t|d}|t|dz}||cxkr |ks.|cS4y)Nrawraw_sizeint)sectionsoffsetsectionstartends rsection_for_offsetr('sOGEN#c'*-.. F S N ! rcvt||}|yt||}|dSt|jddS)Nrname)r r(rget)r#var$r%s rsection_name_for_var-0sA (B 'F ~ 62G2Bc'++fb*A&BBrctd|D}t|d}|t|dz}g}|} |jd||}|dkrn%t||}||j ||dz}>t t |}g} t|D]O\} } | dzt|kr|| dznt|dt|dz} | j | | dQ| S) Nc3JK|]}|jddk(s|yw)r*.textN)r+).0r%s r z"function_ranges..9s RG7;;v3F'3QRs##rr sUrr r,)startVaendVa) nextr"findrappendsortedset enumeratelen) exer#text raw_startraw_endstartsposhitr,rowsindexstart_vanext_vas rfunction_rangesrG8s RxR RDDK I#d:.//GF C hhW5 7  (C ( > MM" Ag CK F!#D$V,=x',qy3v;'>&#CT OVYZ^_iZjVkDk 7;<= Krcd|D]+}t|d|cxkrt|dks'|cS-y)Nr3r4r!) functionsr,functions rowner_functionrKNsB x " #r BC0A,B BO C rc|y|dk(ry|dk(ryd|cxkrdkryd |cxkrd kry d |cxkrd kryd|cxkrdkryd|cxkrdkryd|cxkrdkryd|cxkrdkryyy)Nz unknown-owneri"@zgeneric-vm-object-wrapperiI%@zgeneric-vm-child-object-factoryij@i {@z$generic-object-script-handler-familyi@iP@zsave/menu/display-helper-familyiAiQA*battle-effect/helper-object-spawner-familyiAiPAz&text-status/menu-display-object-familyiBiBz"resource-or-display-object-factoryiCi)C%active-descriptor/materializer-familyi/Ci2Cz"active-object-script-update-familyzunclassified-ownerr)rEs rclassify_ownerrOUs:*:0X++5,X++0,X++;,X++7,X++3,X++6,X++3, rctt|dz ||z}t||D]B}||dk7r t||}|t j d||dzd}||dz|zfcSy)N?? rct||}|td|dd|dkDr||dz dk(rt||}t|||dz}|r|nd\}}|tk(r%d }|d k(rd } n|d k(rd } n|dk(rd} n|dk(rd} nd} nd}d} |t |t ||||| t |t ||td|dz |dzjdd S|dk\rL||dz |dk(rA|t |t ||ddddd|td|dz |dzjdd S|t |t ||ddd dd|td|dz |dzjdd S)!Nz raw offset z#xz is not mapped to a VArr rarQ)NN%object-create/install-display-vm-root0zgeneric/root display object1z$descriptor/materialized child object2z#battle/effect/display helper objectrdzruntime-selected object kindzunknown object kindzpush-reference-nonallocatorzunclassified push reference  ) refVarefVaHexr%refKind objectKindArgobjectKindDomainallocatorCallVaallocatorTargetVa contextHexr_s@object-field-callback-storerz!stores 0x00402321 into [eax+0x10]rzunclassified-dword-reference unclassified) r ValueErrorrhr]OBJECT_ALLOCATOR_VArr-maxhex) r<r#r$ref_vakind_argcallr[ target_vaclassificationdomains r classify_refrs (F +F ~;vbk1GHII zc&1*o-+C8 h ;%)T| + +DN36S?S>117.:N2F6 *8V<%% &!'{!#Ic!Vb[1FRK@DDSI  {s6A:/?B6 *8V<4 C"!$c!Vb[1FRK@DDSI  vJ&x81* #a"- <@@E  rctjdt}g}|j|}|dk7rt ||}|it |||}t |t|d}|dn t|d} | |d<t| |d<t| |d<|j||j||dz}|dk7r|S) Nrfrqr3 ownerStartVaownerStartVaHex ownerClassr ) rWpackDISPLAY_VM_ROOT_VAr6r(rrKr"rrOr7) r<r#rIneedlerCrAr%rowowner owner_starts rfind_dword_refsrs [[1 2F!#D ((6 C )$Xs3  sHc2C"9c#g,.?@E"'-$Sy9I5JK"-C %' _C! " .{ ;C  KK hhvsQw' ) KrcXg}|D]!}|jddk7rt|d}|t|dz}t|t||dz D]}||dk7r t ||}|t j d||dzd } |dz| ztk7rHt||} | dn t| d } |j|t|| t| t| |t||d z t||d zjd t|d$|S)Nr*r0rr rTrRrSr rr3rp)callVa callVaHexrrrrxr)r+r"rVr}rrWrXrrKr7rrOrUr~classify_direct_call) r<r#rIrCr%r&r'offr[r\rrs rfind_direct_callsrsK!#D ;;v ' ) GEN#c'*-..E37 34 C3x4"8S1G$$T3a8;C{S $66"9g6E"'-$Sy9I5JK KK%!#G$/')+"0"="%c%r&:ScBh=O"P"T"TUX"Y&:7&C   6 Krc4|dk(ry|dk(ry|dk(ry|dk(ryy ) Ni#@znested-runner-wrapper-self-calliX@z/opcode-0x2a-linked-object-script-fanout-restoreiX@z2opcode-0x2a-linked-object-script-fanout-persistenti0Cz"active-object-delayed-script-routezunclassified-direct-callr)r[s rrrs1*0*@*C*3 %rc tj}t|}t||}t |||}t |||}t d|D}t d|D}t d|D}t d|D}|D cgc] } | ddk(s | } } | D cgc]} | dttk(s| } } |D cgc] } | ddk(s | } } d d d id ttd ttdt|dt| dt| dt| dt|dt|dt|dt|dt|d|jddd|jdddddddd d!d"||| | gd#gd$d% } | Scc} wcc} wcc} w)&Nc3&K|] }|d yw)rsNrr1rs rr2zbuild_report..sCc)nCc38K|]}|ddk(s |dyw)rsrjrtNrrs rr2zbuild_report..s0!J#sS\~bIPI_!5!Js  c3&K|] }|d yw)rNrrs rr2zbuild_report.. sC3|,Crc3&K|] }|d yw)rNrrs rr2zbuild_report.. s O3%5!6 Orrsrjrwryr z)hwanse-display-vm-root-ref-context-reviewz1tools/build_display_vm_root_ref_context_review.pydisplayVmRootVaHexobjectAllocatorVaHex dwordRefCountobjectCreateRefCount#allocatorBackedObjectCreateRefCountfieldCallbackStoreCountdirectCallCount refKindCountsobjectKindArgCountsownerClassCountsdirectCallClassCountsbattleEffectOwnerRefCountrMrdescriptorOwnerRefCountrNnormalFieldHudOpenerPromotedFsceneRouteProducerPromotedrzQgeneric display/object VM root references classified; no opener producer promoteddecisionaImmediate references to 0x00402321 are overwhelmingly generic object creation sites that install the runner through allocator 0x00435b5b. The only non-push reference stores the same runner into an object callback field. These references prove display/object VM reuse across helper, descriptor, menu/status, and active-object domains; they do not prove the normal-field ESC/X opener or a scene/map route producer.)zg82/83 immediate dword references are allocator-backed object creation sites, not stream/root producers.z\67 allocator-backed refs use object kind 2 and cluster in battle/effect/helper spawner code.zdescriptor/materializer refs create active/display child objects, but still do not identify who schedules the normal-field HUD wrapper.zrthe sole store reference writes 0x00402321 into [eax+0x10], a callback/root field, not object+0x40 stream content.zdirect calls to 0x00402321 remain the known nested runner, opcode 0x2a fanout, and active-object delayed script route; no new opener call appears here.)zUTreat 0x00402321 as a reusable callback/runner, not as a unique HUD opener signature.zFor ESC/X opener proof, trace which producer attaches the already-grounded top-menu wrapper stream, not every object that installs the generic runner.zFor scene route proof, require an upstream gameplay state/root writer that selects a stream, not allocator references to the generic runner.) versionkindsourcesummarydirectCallRows dwordRefRowsfieldCallbackStoreRowsobjectCreateRowsnegativeEvidence nextFrontier) EXE read_bytesrrGrrrrr|rr;dictr+)r<r#rI dword_refs direct_callsref_kind_countsobject_kind_counts owner_countsdirect_call_countsrobject_create_rowsallocator_rowsfield_store_rowsreports r build_reportrs^ .. CS!HX.I h :J$S(I>LC CCO !J!JJC CCL O, OO)3q#s9~Ip7p#qq%7oc3?R;SWYZmWn;ncoNo'1eS^Gd5dee;E "%7"8 "B':$;  S_  #C(:$;  23~3F  &s+;'<   s<0  T/2  "4(:#;  \ 2  $T*<%=  ()9)9:fhi)j  &|'7'78_ab'c  +E  )% q! " O% 2'""2.  Q-F\ Meroes$ F4 F4*F9F9 F>F>x)rYcdjd|d|D}t||kDr|dt||z dz }|xsdS)Nrc3`K|]%}dt|jdxs|jddt|jddt|jddt|jdxs|jd dt|jd d d t|jd d dt|jdd dt|jdd dt|jdd(yw)zrrrzrz
rz rsrrtrz
ruzrvz
rwrxzN)rr+rs rr2zrender_table..Bs%   swwz*Bcggk.BCDEsww0123;qAV?W>XY#@sww/?'@ABC"-./tAcgg>PRT6U4V3WXsww0"5677H377SfhjKkIlHmnsww|,-./   sD,D.z... z more rows in JSONz"none)joinr;)rCrYbodys r render_tablerAs^ 77 <  D 4y5 *3t9u+<*==YZZ  777rcj|d}tj|d}djd|jD}djd|dD}djd|d D}d t |d d |d |d|dt |ddt |dd|dS)NrF) ensure_asciirc3bK|]'\}}|dk7rdt|dt|d)yw)rz
z z
Nr)r1keyrs rr2zrender_html..Us; C *  #xz!E(=Is-/c3:K|]}dt|dywz
  • z
    • Nrr1items rr2zrender_html..ZsU$$qwiu-Urc3:K|]}dt|dywrrrs rr2zrender_html..[sPagYe,PrraA Display VM Root Ref Context Review

    Display VM Root Ref Context Review

    rz

    z:

    Negative Evidence

      zB

    Next Frontier

      z

    Dword References

    rz
    refownerkindobject kindallocatorbytes

    Direct Calls

    rz
    callownerkindobject kindallocatorbytes

    Raw JSON

    
  
    

    



)jsondumpsritemsrr)rrpayloadcards	negativesfrontiers      rrender_htmlrRs*YGjje4GGG!--/
E
U&AS:TUUIwwP9OPPH @
W	
	

FGSTZ[iTjGkFllGHTU[\lUmHnGoo45<9=q==rc2t}tjdtjdtdzj	tj|dddzd	td
zj	t|d	tdy)
NT)exist_okz'display_vm_root_ref_context_review.jsonFrb)rindent
zutf-8)encodingz'display_vm_root_ref_context_review.htmlz%display_vm_root_ref_context_review okr)	rOUTmkdirWEB
write_textrrrprint)rs rmainrs
^FIItIIItI44@@

6a84?A	44@@VAT_f@g	
12r__main__)r
int | Nonereturnr)rrrr)r#list[dict[str, Any]]r$r"rdict[str, Any] | None)r#rr,r"rr)r<bytesr#rrr)rIrr,r"rr)rErrr)()
r<rr#rr$r"rYr"rztuple[int, int] | None)r<rr$r"rr)r<rr#rr$r"rdict[str, Any])r<rr#rrIrrr)r[r"rr)rr)rCrrYr"rr)rrrr)rr"),__doc__
__future__rrrrWcollectionsrpathlibrtypingrprobe_exe_scene_tablesrrr	__file__resolveparentsROOTrrrrr|rrr(r-rGrKrOr]rhrrrrrrrr__name__
SystemExitrrrrs#
LLH~''*
]
Ul
Ul 6HC, 0
;|$@	&>B>A8"GT

z
TV
r