QLLj{pdZddlmZddlZddlZddlZddlZddlmZddl m Z ddl m Z e e jjdZedz Zed z Zed z Zej(j+deed z dd lmZmZmZd ZdZdZdZdZdZ d#dZ!d$dZ"d%dZ#d&dZ$d'dZ%d(dZ&d)dZ'd)dZ(d*dZ)d+dZ*d,dZ+d-dZ,d.dZ-d/d Z.d0d!Z/e0d"k(re/yy)1a;Consolidate the generic object/display VM stream producer frontier. The generic runner at 0x00402321 is now grounded in several separate reviews: manual movement overlap, object +0xec payloads, active-object delayed scripts, display/battle VM child streams, and save-selector/selected-root helpers. This report keeps those surfaces in one place and makes the boundary explicit: which paths write or feed object +0x40, which paths are only consumers/helpers, and whether any path currently promotes to a scene/map transition, encounter, or selected-root route producer. ) annotationsN)Counter)Path)Anyoutwebz Hwanse2.exetools) offset_to_va read_sections va_to_offseti!#@8Di`#@iy@iCi/CcVtj|ddSt|dS)NT)quote)htmlescapestrvalues 9tools/build_generic_vm_stream_producer_frontier_review.pyhr)s% ;;U]r$ GGE $ GGc|dSd|dS)N0x08xrs rhxr-s=465+&66rcp|js|Stj|jdS)Nutf-8encoding)existsjsonloads read_text)pathfallbacks r load_jsonr)1s* ;;= ::dnngn6 77rctt|z i}t|tsiS|j d}t|tr|S|S)Nsummary)r)OUT isinstancedictget)namedatar+s r summary_ofr27sC S4Z $D dD ! hhy!G $/79T9rcr|D]2}t|d}|t|dz}||cxkr |ks.|cS4y)Nrawraw_sizeint)sectionsoffsetsectionstartends rsection_for_offsetr=?sOGEN#c'*-.. F S N ! rcr|D]2}t|d}|t|dz}||cxkr |ks.|cS4y)Nvar5r6)r8r?r:r;r<s rsection_for_var@HsOGDM"c'*-.. B  N  rc&g}td|Dd}|s|St|d}|t|dz}t|d}|||}tdtdt |dz D]} || dk7r t j d|| d zd} || z} | dz| z} | |k7r<|j| t| t|d |t||| zd z t||| zd zjd t| d|S)Nc3JK|]}|jddk(s|yw)r0.textN)r/).0r:s r z$find_direct_calls..Ss SWGKK4G74RSs##r4r5r?rztjd|}g}|j|}|dk7rnt||}t ||}|r9|7|j |t ||jdt|d|j||dz}|dk7rn|S)Nzopcode 0x5e mode1 loads new object+0x40 from dword [payload+8]zMa1 a8 dd 59 00 89 45 08 8b 45 08 8b 80 ec 00 00 00 8b 40 08 8b 4d 08 89 41 40znested-runner-wrapper zv0x00402360 saves current object+0x40, runs a supplied child stream through 0x00402321, then restores the parent cursorzt8b 45 08 8b 40 40 89 45 fc 8b 45 0c 8b 4d 08 89 41 40 8b 45 08 50 e8 9d ff ff ff 83 c4 04 8b 45 fc 8b 4d 08 89 41 40zopcode-0x2a-fanout-list-selectiW@z`opcode 0x2a reads stream+1 as active-object list index and stream+2 as optional object+0x14 maskzM55 8b ec 83 ec 0c 53 56 57 8b 45 08 8b 40 40 33 c9 8a 48 01 83 e1 7f 89 4d f4z'opcode-0x2a-fanout-restore-child-cursoriX@zxopcode 0x2a high-bit branch saves target object+0x40, runs stream+4 through 0x00402321, then restores target object+0x40z8b 45 f8 8b 40 40 89 45 fc 8b 45 08 8b 40 40 8b 40 04 8b 4d f8 89 41 40 8b 45 f8 50 e8 6d ca ff ff 83 c4 04 8b 45 fc 8b 4d f8 89 41 40z*opcode-0x2a-fanout-persistent-child-cursoriX@zuopcode 0x2a normal branch writes stream+4 to target object+0x40 and keeps the advanced target cursor after 0x00402321zP8b 45 08 8b 40 40 8b 40 04 8b 4d f8 89 41 40 8b 45 f8 50 e8 44 ca ff ff 83 c4 04rui0Czvfield active object timer route runs object+0x64 through 0x00402321 and stores the advanced cursor back to object+0x64z8b 45 f8 8b 40 40 89 45 fc 8b 45 f8 8b 40 64 8b 4d f8 89 41 40 8b 45 f8 50 e8 73 f2 fc ff 83 c4 04 8b 45 f8 8b 40 40 8b 4d f8 89 41 64 8b 45 fc 8b 4d f8 89 41 40rXr?rrrrJ)rvaHexrmatches expectedHex actualHex) MANUAL_OVERLAP_BRIDGE_VANESTED_RUNNER_VAbytesfromhexrr r7rSrVrrX)rZr8snippetsr\rowexpectedr9actuals rverified_snippetsrsm,eY  -*bn  2Wb  *"T)PJ  3yb  <R\  ?Oe  7Pw  W1Hd"$D  ==SZ1hCI79?9KVfs8}45QT $iCD N+y>!X-"5z#ZZ_     Krc tj}t|}td}td}td}td}td}td}td}t t dz i} t t d z i} t ||t} t||t} t ||t} t||t}t||}d d d d dddddd d|jdd|jdd|jddddddd d|jdd|jd d!|jd"d#d$dd%d&d d'|jd(d)|jd*d+|jd,d-d.dd/d0d d1|jd2d3d4|jd5d3d6|jd7d3d8|jd9d3d:d;dd|jd?d@|jdAdB|jdCdD|jdEdFdGddHdId dJ|jdKdL|jdMdN|jdOdPdQddRdSd dT|jdUdV|jdWdX|jdYdZ| jd[d\d]dd^d_d d`| jdadb| jdcxsijdddedfdg }ttdg| D}idhttdittdjttdkt!| dl|dm|jdnd3dot#dp| Ddq|jd2d3dr|jd5d3ds|jd7d3dt|jd9d3dut!| dvt!| dwt!|dxt#dy|Ddzt!|d{t!|t#d||D|jd|jd|jd*|jdUd}uxr(|jdWd}uxr|jdYd}ud d~d}ddd||| | | ||gdgdd S)Nz#object_script_payload_producer.jsonz#manual_movement_trigger_bridge.jsonz0field_active_object_trigger_boundary_review.jsonz$map_animation_tick_route_review.jsonz/field_encounter_tick_route_boundary_review.jsonz.selected_root_live_writer_frontier_review.jsonz-generic_vm_opcode2a_parent_stream_review.jsonz)save_selector_dispatch_table_context.jsonz$battle_display_vm_static_decode.jsonz generic object/display VM runnerzgrounded-consumerFzF0x00402321 reads object+0x40 and dispatches opcode through 0x00440538.zcThis is a consumer/dispatcher. It does not itself select a map, scene root, or encounter formation.z+Hwanse2.exe snippet generic-runner-dispatch)surfacestatusproducerPromotedevidence routeImpactsourcez)opcode 0x5e object +0xec payload producerzgrounded-non-route-producerzobjectEcProducerFound=objectEcProducerFoundz; mode1 candidates=mode1CandidateCountz ; map CNS refs in payload heads=mapCnsRefCountInPayloadHeadszCreates/transitions transient display/object VM payloads, but current static payload scan does not prove field-map transition payloads.'out/object_script_payload_producer.jsonzmanual movement overlap bridgezgrounded-trigger-consumerz bridgeFound='manualMovementToObjectScriptBridgeFoundz ; routeProof=routeProofFoundz; manual opcodes=manualScriptOpcodeCountzsObject overlap can copy object+0xec into object+0x40, but strict inventory found no concrete map transition target.'out/manual_movement_trigger_bridge.jsonz"active object delayed script routezgrounded-indirect-candidatez tick route=fieldTickRouteVaHexz; active route grounded=&activeObjectDelayedScriptRouteGroundedz; visible motion producer=visibleMotionProducerFoundzhCan run object+0x64/+0x40 scripts from the field tick, but no animated-map tile-write root is bound yet.(out/map_animation_tick_route_review.jsonz'opcode 0x2a linked-object script fanoutzgrounded-fanout-primitivezhandler table 0x004405e0 -> 0x004057eb; stream+1 selects active-object list slot, stream+2 optionally filters target object+0x14, stream+4 supplies the child script; direct runner calls at 0x004058af and 0x004058d8; active +0xec hits=activeObjectEcOpcode2aCountrz, raw candidates=rawCandidateCountz, boundary-shaped=boundaryCandidateCountz , promoted=promotedParentProducerCountzExecutes a supplied child stream on linked active objects. This narrows object script propagation, but it is not a root producer without a parent stream source.zSHwanse2.exe opcode 0x2a handler + out/generic_vm_opcode2a_parent_stream_review.jsonz$field active object script inventoryznegative-route-inventoryzstrict initializers=strictInitializerCountz; unique +ec scripts=uniqueObjectEcScriptCountz; route proof scripts=routeProofScriptCountz; map CNS operand scripts=!mapCnsOperandCandidateScriptCountz\Large active-object script inventory exists, but no route/map CNS operand proof is promoted.4out/field_active_object_trigger_boundary_review.jsonzfield encounter tick routeznegative-encounter-producerzknown field windows=knownFieldWindowCountz; promotable calls=/promotableKeyDirectCallsInsideKnownFieldWindowsz; formation exact refs=&formationCandidateExactPointerRefCountzTNo field walking/tick route currently selects battle resources or formation streams.3out/field_encounter_tick_route_boundary_review.jsonzselected-root stream primitivesz grounded-separated-global-streamzselector writer grounded=selectorByteWriterGroundedz; selectedRoot writer grounded=selectedRootWriterGroundedz; executor found=selectedRootExecutorFoundz'; save-selector runtime dispatch proof=0saveSelectorSliceDirectRuntimeDispatchProofFoundzqSelected-root VM primitives use global selectedRoot/current stream flow, not a proven object+0x40 route producer.zbout/selected_root_live_writer_frontier_review.json + out/save_selector_dispatch_table_context.jsonzbattle/display VM child streamszgrounded-battle-display-domainzstatus=rz; display runner=displayVmRunner runnerVaHexzIUseful for battle/effect rendering, but not a field scene/route producer.(out/battle_display_vm_static_decode.jsonc3&K|] }|d yw)rONrrDrs rrEzbuild_report..|s+ZcC0@,A+ZsgenericRunnerVaHexgenericHandlerTableVaHexnestedRunnerVaHexdirectCallCountdirectCallClassificationCountsunclassifiedDirectCallCountrzlinkedObjectFanoutCallCountc3\K|]$}t|djds!d&yw)rOz opcode-0x2a-rN)r startswithrs rrEzbuild_report..s-+ S1A-B)C)N)N~)^A+ s",,opcode2aActiveObjectEcHitCountopcode2aRawCandidateCountopcode2aBoundaryCandidateCount#opcode2aPromotedParentProducerCountpointerRefCountnestedRunnerDirectCallCountnestedRunnerPointerRefCountverifiedSnippetCountc3,K|] }|ds dyw)rrNrrs rrEzbuild_report..s#L#S^A#L verifiedSnippetTotal surfaceCountc3,K|] }|ds dyw)rrNrrs rrEzbuild_report..s+]#SI[E\A+]rTaThe generic VM stream frontier is now consolidated. 0x00402321/object+0x40 is a grounded dispatcher; all direct calls are now classified, including the nested runner wrapper, opcode 0x2a linked-object fanout, and active-object delayed scripts. Current surfaces remain support/display/object domains or negative route inventories. None promotes to a concrete scene route, map transition, field encounter, or selected-root gameplay producer.)promotedProducerSurfaceCountmanualMovementBridgeFoundrrselectedRootPrimitiveGroundedrouteProducerPromoteddecisionz1hwanse-generic-vm-stream-producer-frontier-reviewz9tools/build_generic_vm_stream_producer_frontier_review.pyzBgeneric-vm-stream-frontier-consolidated-no-route-producer-promoted)zlDo not re-open 0x00402321 itself as an unknown; treat it as a grounded generic object/display VM dispatcher.zDo not treat opcode 0x2a as a route producer by itself; it is a linked-object script fanout that still needs a parent stream source.zOpcode 0x2a is absent from the strict active object +0xec script inventory; raw data-section candidates remain review-only until a gameplay parent/root source is found.zgFor scene route, look above selected-root writer/executor primitives for the live root/stream producer.zFor map transition, require an active-object script/root that binds a concrete map target or map resource, not just object+0xec -> +0x40.zcFor encounter, require field walking/tick state to bridge into battle resource/formation consumers.zlFor map animation, require an animated-map object/root that reaches tile-write handlers from the tick route.) rrrz1out/generic_vm_opcode2a_parent_stream_review.jsonrrz2out/selected_root_live_writer_frontier_review.jsonz-out/save_selector_dispatch_table_context.jsonr) kindrrr+verifiedSnippetsdirectCallRowspointerRefRowsnestedRunnerDirectCallRowsnestedRunnerPointerRefRowssurfaces nextFrontiersourceArtifacts)EXErsr r2r)r,reGENERIC_RUNNER_VArprrr/r.rrGENERIC_HANDLER_TABLE_VArSsum)rZr8object_payload manual_bridge active_objectmap_tick field_tickselected_writeropcode2a_parentdispatch_context battle_vm direct_calls pointer_refs nested_calls nested_refsrrdirect_call_class_countsr+s r build_reportrs .. CS!H EFNDEMQRM@AHMNJ !QRO !PQO 'R!RTVW# FFKI$S(4EFL"32CDL$S(4DEL!#x1ABK h/H:) %`AC  C3 %(););0 %&}'8'89Q'R&ST&&3&7&78S&T%UV''4'8'89P'Q&RS++8+<+<=`+a*bd zL 43 %&z~~6M'N&OP$$.NN3d$e#fg((27_(`'acrK 98 %+O,?,?@\,]+^_00?0C0CD`0a/bc""1"5"56Q"R!ST88H8L8LM9A8BC Oz 96 %)--123"#,==1B#C#Ir"N"N}"]!^`g@ GnH` $G+Z\+Z$Z[%b!23%"B'?$@% R 01% 3|, % )*B % &'?'C'CDegh'i % &s+ %+ ( % )/*=*=>[]^*_% $_%8%89La%P% )/*=*=>VXY*Z% ./B/BC`bc/d% 3|,% &s<'8% &s;'7!%" #L#L L#%$ H %%& H '%(),+]+](]%2%6%67`%a!/!3!34K!L2:,,?g2h    < = E I##$@ATI I##$?@DH!& S?%GPDMV$&&&2&1   ) rc|d}d|dfd|dfd|dfd|dfd |d fd |d fd |dfd|dfd|dd|dfd|dfg }djd|D}djd|dD}djd|dDxsd}djd|dDxsd}djd |d!D}djd"|d#D}djd$|d%D} tj|d&'} d(t|d)d*|d+|d,|d-|d.|d/|d0| d1t| d2S)3Nr+rrunnerrz direct callsrzunclassified directrzopcode 0x2a fanout callsrz0x2a active +ec hitsrz0x2a raw candidatesrz pointer refsrrr/rzpromoted producersrrc3XK|]"\}}dt|dt|d$yw)z
z z
Nr)rDkvs rrEzrender_html..s/fX\XY[\/!vZ!v]Sfs(*c3K|]a}dt|ddt|ddt|ddt|ddt|ddt|dd cy w) r rrrrrNrrs rrEzrender_html..s   Y !"X !'()*+Z!"#]#$%&s8}%&'   sA'A)rc 3|K|]4}dt|ddt|ddt|dd6yw)rLrOrrNrNrrs rrEzrender_html..s_   s;'()*%&'()s<()*+ :<rz"nonec 3|K|]4}dt|ddt|ddt|dd6yw)rrirr:rrOz Nrrs rrEzrender_html..s]   s:'()Y !"%&'() rrc3K|]R}dt|ddt|ddt|ddt|ddt|d d Ty w) rrz
rrrrrrrrNrrs rrEzrender_html..s}   T|nJqW&78Y !"Y !"s;'()*  sAArc3:K|]}dt|dyw)z
  • z
    • NrrDitems rrEzrender_html..sPagYe,Prc3:K|]}dt|dyw)z
  • z
    • Nrrs rrEzrender_html..sat*QtWI\:arrF) ensure_asciia Generic VM Stream Producer Frontier
    index remaining work dispatch table context mode/state frontier opcode 0x2a parent streams

    Generic VM Stream Producer Frontier

    rz

    z

    Surfaces

    z
    surfacestatusproducer promotedevidenceroute impactsource

    Verified Snippets

    z
    snippetmatchesmeaningactual bytes

    Direct Calls to 0x00402321

    z
    callclassificationcontext

    Dword Refs to 0x00402321

    zM
    refsectionclassification

    Next Frontier

      zE

    Source Artifacts

      z

    Raw JSON

    
  
    

    




)joinr$dumpsr)reportr+cards	card_htmlsurface_rows	call_rowsref_rowssnippet_rowsfrontier	artifactspayloads           rrender_htmlrs\YG	6(#$	7/01	!234	(E FG	#W-J%KL	)I!JK	(C DE	!234	 678'BX:Y9Z[\	w'EFG
Ef`effI77
*%

L*+
.
.ww*+
.
.
77,-LwwP9OPPHavN_G`aaIjje4G"D
!{#YZfYggpq}o}~_`i^ij^_g]gh	

	
234G*>CIIrcFt}tjdtjdtdzj	tj|dddzd	td
zj	t|d	td|dd
dy)NT)exist_okz/generic_vm_stream_producer_frontier_review.jsonF)rindent
r r!z/generic_vm_stream_producer_frontier_review.htmlz+wrote generic VM stream producer frontier (r+rz promoted producers))	rr,mkdirWEB
write_textr$r
rprint)rs rmainrIs
^FIItIIItI<<HH

6a84?I	<<HHFI
	9<=>>R	Tr__main__)rrreturnr)rz
int | Noner!z
str | None)r'rr(rr!r)r0rr!dict[str, Any])r8list[dict[str, Any]]r9r7r!dict[str, Any] | None)r8r#r?r7r!r$)rZrr8r#r[r7r!r#)
rZrr8r#r?r7rrr7r!r)rcr7r!r)ror7r!r)rZrr8r#r!r#)r!r")rr"r!r)r!None)1__doc__
__future__rrr$rTsyscollectionsrpathlibrtypingr__file__resolveparentsROOTr,rrr'insertrprobe_exe_scene_tablesrrr
rrrOBJECT_EC_PRODUCER_HANDLER_VAr%ACTIVE_OBJECT_DELAYED_SCRIPT_ROUTE_VArrr)r2r=r@rerprsrYrlrrrr__name__rrrr5s
#

H~''*
Ul
Ul
]3tg~&'LL% *%(2%H78:<(0-8&BJK\D$zFr