*Kj=LdZddlmZddlZddlZddlZddlmZddlm Z ddl m Z m Z m Z eejj dZedz Zed z Zed z Zd Zd Zd ZdZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)d0d1d Z*d2d!Z+d3d"Z,d4d#Z-d5d$Z.d5d%Z/d6d&Z0d7d'Z1d8d(Z2d9d)Z3d:d*Z4d;d+Z5dd.Z8e9d/k(r e:e8y)?aNarrow the static frontier for the normal-field ESC/X HUD menu opener. The region/window payloads and top-menu object sequence are already grounded. This pass deliberately avoids re-decoding those payloads. Instead it scans the EXE at x86-function granularity and asks a narrower question: * Do input-mask consumers and descriptor/menu materializers meet in the same function? * If they do, is the function the known cancel/back handler, a movement controller, or a plausible normal-field open-menu producer? ) annotationsN)Path)Any) offset_to_va read_sections va_to_offsetz Hwanse2.exeoutwebiYiYiBit-BivEivEiPwEi0YipYi-DiCiA%Ci##CilMiGi$Gi@iAi-CiXiZYc|dSd|d|dS)N-0x0x)valuewidths .tools/build_hud_menu_opener_frontier_review.pyhxr9s#-3;r%%z):%;;cVtj|ddSt|dS)NT)quote)htmlescapestr)rs rhr=s% ;;U]r$ GGE $ GGrc tj|jd}t |t r|SiS#t$ricYSwxYw)Nutf-8encoding)jsonloads read_textFileNotFoundError isinstancedict)pathdatas r read_jsonr*AsLzz$..'.:;dD)41r1  s%; A A cV|D]}|jddk(s|cStd)Nname.textzmissing .text section)get ValueError)sectionssections r text_sectionr2Is5 ;;v ' )N , --rcTtjd|}g}|D]}|jddk7rt|d}|t|dz}|j |||}|dk7sPt ||} | |j | |j ||dz|}|dk7r;|S)Nr?rBrCs rall_refsrFasl [[u %FD ((6 C ) (C ( > KKOhhvsQw' ) Krc `g}|D]}|jddk7rt|d}|t|dz}t|t||dz D]T}||dk7r t ||}|t j d||dzd } |dz| z|k(sD|j|V|S) Nr,r-r5r6zt t |}g} t|D]\} } t|| } | | dzt|kr|| dznt|dt|dz} | dzt|kr t|| n|}||}| j | | | t| |td|| z d| S)Nr5r6sUrr rC)startVaendVastartOffendOffsize) r2r:r;rr<sortedset enumeraterlenrK)r=r0r1 raw_startraw_endstartsrBhitrCrowsindexstart_va start_offnext_vanext_offs rfunction_rangesrgsd8$GGEN#I#gj122GF C hhW5 7  (C ( > MM" Ag CK F!#D$V, x 84   ',qy3v;'>&#CPT DVY\]deo]pYqDq6;ai#f+6M<'2SZ  H # %i2Ax)34    & Krcd|D]+}t|d|cxkrt|dks'|cS-yNrTrUr:) functionsrCrows r find_functionrms? s9~ " 8s3w<'8 8J 9 rc`|t|dt|dj|dk\S)NrVrWr)r:r;)rlr=patterns rcontains_bytesrps1 s3z?#SX%7 8 = =g F! KKrct|d}t|d}|Dcgc]}||cxkr|ksnn|c}Scc}wrirj)rlr?r@rArefs rrefs_in_functionrss> I E c'l C 6C5C#5##5C 66 6s<<c r|jDcic]5\}}t||r$|t||Dcgc] }t|c}7}}}}|jDcic]5\}}t||r$|t||Dcgc] }t|c}7}}}}|Dchc]}|jds|} }|Dchc]}|jds|} }|Dchc]}|jds|} }|Dchc]}|jds|} }t |} t |d}|t k(rd}d}d}ns|tk(rd }d}d }nc|tk(rd }d}d }nS| r | r | s | sd }d}d}nD| r | s | rd}d}d}n7| r | rd}d}d}n,| r | rd}d}d}n!| rd}d}d}n| rd}d}d}n| rd}d}d}nd}d}d}t||d}t||d }t|tt |d!|d"|||||||d# Scc}wcc}}}wcc}wcc}}}wcc}wcc}wcc}wcc}w)$Nzinput. descriptor.ztopMenu.zmap.rTknown-cancel/back-handlerznegative-static-proofzfESC/X edge bit consumer, but it unwinds active descriptor state; this is cancel/back, not normal open.display-vm-base-pointer-binderz{Command byte selects a base pointer for the display/object VM; it reads input context but does not add the menu descriptor.+active-descriptor-field-movement-controllerzConsumes current input mask, active descriptors, and map collision data for field movement/collision; not an ESC/X menu opener.zfield-movement/controllerz context-onlyz6Input and map data meet in movement/collision context.zdescriptor-materializer-helperzEDescriptor helper/materializer context without direct input evidence.input+descriptor-intersectionzcandidate-reviewzRInput and descriptor data meet in one function; inspect manually before promotion.input+top-menu-intersectionzPInput and top-menu data meet in one function; inspect manually before promotion.ztop-menu-data-contextzTop-menu payload/data context.zinput-consumerzInput consumer only.zdescriptor-consumerzDescriptor consumer only.otherz:Reference/call context does not match the opener frontier.sfYsfYrUrX) functionVaHexendVaHexrXrolerefHitscallHitshasEdgeMaskReadhasCurrentMaskRead promotionnote) itemsrsr startswithrZr:KNOWN_CANCEL_HANDLER_VADISPLAY_VM_BASE_BINDER_VA%ACTIVE_DESCRIPTOR_FIELD_CONTROLLER_VArp)rl refs_by_name calls_by_namer=r,r?rrref_hits call_hits input_namesdescriptor_names top_names map_namesmaterializer_callsrcr~rrhas_cancel_bit_testhas_current_mask_reads rclassify_functionrs',,. D$ C & "23"=>3r#w>>H(--/ D$ C & "23"=>3r#w>>I %-JD0I4JKJ)1TT__]5STT"*J$dooj.IJIJ"*F$doof.EFIFY3y>"H***+ w . ./+ M : :<+ Q +;I*" G +2D/" V ).& c ,& a &" / " % $" *" K(c3NO*35PQHs3w<()F .3  ? ? KTJFs^#HH  H'#H HH)H%H% H*!H*+H/H/ H4#H4 HHctj}t|}t||}t ||t t ||t t ||tt ||tt ||tt ||tt ||tt ||tt ||tt ||tt ||tt ||t t ||t"d }t%||t&t%||t(t%||t*t%||t,d}t/|j1Dchc] }|D]}| c}}|j1Dchc] }|D]}| c}}z}i}|D]"}t3||} | s| |t5| d<$t/|j1dD cgc]} t7| |||} } | D cgc] } | ddvr|  } } | D cgc]} | ddvr| d j9d r| !} } t;||t} |d }d d t=tdt?|t?| tAd| DtAd| Dt?| t?| t?|t?| | Dcgc] }tC|c}dd |jEDcic]\}}||Dcgc] }tC|c}!c}}}|jEDcic]\}}||Dcgc] }tC|c}!c}}}| | t/| D chc]} | d c} Dcic]tAfd| Dc}| gdd Scc}}wcc}}wcc} wcc} wcc} wcc}wcc}wcc}}}wcc}wcc}}}wcc} wcc}w)N) input.currentActionMaskinput.edgeActionMaskzdescriptor.activeCountzdescriptor.activeIdOrderzdescriptor.slotTablezdescriptor.slotPointerszdescriptor.objectPointerszdescriptor.rootTabletopMenu.objectSequenceztopMenu.intermediateRecordztopMenu.parentContextScriptzmap.collisionFlagsz map.width)call.addDescriptorzcall.removeDescriptorzcall.rebuildDescriptorzcall.inputPackerrTct|dS)NrTrj)items rzbuild_report..*sSiEYr)keyr~>rvrzryrwrx>rvrrrz&hwanse-hud-menu-opener-frontier-reviewz.tools/build_hud_menu_opener_frontier_review.pyz"normal-field-opener-still-unprovenc3RK|]}|djddhzsd!yw)rrrr N)keys.0rls r zbuild_report..Js=&NCYATATAVZsvLZMBMa&Ns''c3LK|]}td|dDsdyw)c3>K|]}|jdyw)ruN)r)rrs rrz)build_report...Ks#JClo#..YfJgJCsrr N)anyrs rrzbuild_report..Ks>+DcJCsvxAtBJCGC1+Ds$$uUx86 함수 단위 교집합에서도 normal-field ESC/X opener는 아직 증명되지 않았다. 입력 mask와 descriptor stack이 만나는 확정 함수는 cancel/back, display VM base binder, field movement/collision 계층으로 배제됐으며, top-menu object sequence 0x004ddc6c의 직접 ref는 여전히 data-context 1건뿐이다.) functionCounttouchedFunctionCountinputFunctionCountdescriptorFunctionCountintersectionFunctionCountnormalOpenCandidateCounttopMenuSequenceTextRefCounttopMenuSequenceAllRefCounttopMenuSequenceAllRefsHexdecisionc34K|]}|dk(s dyw)r~r Nr)rrlr~s rrzbuild_report..]sECV1DaEs )u입력 bit 자체가 아니라 mode/state byte가 바뀐 뒤 0x62 add-descriptor가 실행되는 selected/root command stream을 찾아야 한다.utopMenu sequence direct pointer는 data-only라서, parent/intermediate record를 고르는 selector table이나 descriptor id producer를 추적해야 한다.u0x40/0x8a/0x87 계열 object VM selector producer가 +0x2f/+0x3d를 쓰는 위치는 이미 일부 확인됐으므로, 다음은 이 object가 어떤 descriptor id로 stack에 올라오는지 역추적한다.) kindsourcer=statussummary refsByName callsByNameintersectionFunctionsnormalOpenCandidates roleCountsclassifiedFunctions nextFrontier)#EXE read_bytesrrgrDCURRENT_ACTION_MASK_VAEDGE_ACTION_MASK_VAACTIVE_DESCRIPTOR_COUNT_VAACTIVE_DESCRIPTOR_ID_ORDER_VAACTIVE_DESCRIPTOR_SLOT_TABLE_VA"ACTIVE_DESCRIPTOR_SLOT_POINTERS_VA$ACTIVE_DESCRIPTOR_OBJECT_POINTERS_VADESCRIPTOR_ROOT_TABLE_VATOP_MENU_OBJECT_SEQUENCE_VATOP_MENU_INTERMEDIATE_RECORD_VA!TOP_MENU_PARENT_CONTEXT_SCRIPT_VAMAP_COLLISION_FLAGS_VA MAP_WIDTH_VArRADD_DESCRIPTOR_ROUTINE_VAREMOVE_DESCRIPTOR_ROUTINE_VAREBUILD_DESCRIPTOR_ROUTINE_VAINPUT_PACKER_VArYvaluesrmr:rr.rFrr\sumrr)r=r0rkrrr?rC touched_vascandidate_funcsrl classified intersectionsnormal_open_candidatestop_sequence_refs_alltop_sequence_text_refsrrr,r~s `r build_reportrs  .. CS!HX.I$-S(b%c )#x9Q R"+C;V"W&/X?^&_'0h@a'b'X7MNsHl;L )h8QR!+C;W!X",S(NN2"N"NanauauawRHY]CGRH|~RTRHRTRHHIK13O7Ir* 36OCI/ 07/0028YZ  #|]C@J   v;    M !  v;; ;  O   4 5 %S(4OP)*BC9B3x6 ^$' O"%&N:&N#N'*+D +D(D),]);(+,B(C+./E+F*-.C*D=R)Sc"S')Sm "JVI[I[I]^^:4t6#bg66^JWJ]J]J_``JD$$73r#w77`!. 6zBF BC  #E:EE E  * ?$ $CORH 0*T7^7` C s`N N "N#=N($N-N2- N<:N7 N<) O6OO O2O7N<Oc l|d}d|dfd|dfd|dfd|dfd d |d d |d fg}djd|D}djd|dD}djd|dD}tj|d}dt|dd|d|xsdd|d|d S)Nrrz touched funcsrrrzopen candidatesrz top seq refsztext rz / all rrc3XK|]"\}}dt|dt|d$yw)z
z z
Nr)rkvs rrzrender_html..rs/fX\XY[\/!vZ!v]Sfs(*c3DK|]}dt|ddt|ddttj|dddttj|dddt|d d t|jd d d yw)zr|z
r~z rF ensure_asciirrz
rrzN)rr"dumpsr.rs rrzrender_html..ss   s?+,-[3v;8HIC N?@ABC O%@ABC[!"##:1SWWVR=P;Q:RS  sBB rc3:K|]}dt|dyw)z
  • z
    • Nr)rrs rrzrender_html..|sPagYe,PsrFra HUD Menu Opener Frontier Review
    index opener boundary JSON HUD menu preview descriptor stack cancel consumer

    HUD Menu Opener Frontier Review

    rz

    z

    Input / Descriptor Intersections

    z.zR
    functionrefscallspromotion
    No intersections

    Next Frontier

      z

    Raw JSON

    
  
    

    



)joinr"rr)reportrcards	card_html
inter_rowsfrontierpayloads       rrender_htmlris1YG	6(#$	'"89:	'"=>?	G$>?@	5)F!G HPWXtPuOvwx
Ef`effI12JwwP9OPPHjje4G#F
!{#
LL
MN	


129	:m;;rc2t}tjdtjdtdzj	tj|dddzd	td
zj	t|d	tdy)
NT)exist_okz$hud_menu_opener_frontier_review.jsonF)rindent
rr z$hud_menu_opener_frontier_review.htmlz"hud_menu_opener_frontier_review okr)	rOUTmkdirWEB
write_textr"rrprint)rs rmainrs
^FIItIIItI11==

6a84?>	11==k&>Q\c=d	
./r__main__))rz
int | Nonerr:returnr)rrrr)r(rrdict[str, Any])r0list[dict[str, Any]]rr)r=bytesr0rrr:r	list[int])r=rr0rrMr:rr)r=rr0rrr)rkrrCr:rzdict[str, Any] | None)rlrr=rrorrbool)rlrr?rrr)
rlrrdict[str, list[int]]rrr=rrr)rr)rrrr)rr:);__doc__
__future__rrr"r8pathlibrtypingrprobe_exe_scene_tablesrrr__file__resolveparentsROOTrrrrrrINPUT_POLL_DRIVER_VArrrrrrrrrrrrrrrrrrrr*r2rDrFrRrgrmrprsrrrr__name__
SystemExitrrrrsK
#
LLH~''*
]
Ul
Ul# !' *",%/"'1$%&) *(",$.!$&(2%#<H2."	&#LL7L^`FPf

z
TV
r