Lj9dZddlmZddlZddlZddlZddlmZddlm Z ddl m Z m Z m Z ddlmZeej#j$dZed z Zed z Zed z Zed z Zed z ZdZdZdZdZdZdZdZdZ dZ!d&d'dZ"d(dZ#d)dZ$d*dZ%d+dZ&d,dZ'd-dZ(d.d/dZ)d0d1dZ*d2d Z+d3d!Z,d4d"Z-d5d#Z.d6d$Z/e0d%k(re/yy)7aPTrace the HUD top-menu VM graph around the remaining opener boundary. The x86 and descriptor-stack reviews already proved the #6/#3/#4 HUD menu payload and ruled out a number of direct opener shapes. This pass focuses on the nearby VM command/data graph so later analysis does not accidentally promote table bytes as command streams. ) annotationsN)Path)Any) offset_to_va read_sections va_to_offset) decode_streamz Hwanse2.exeoutwebz&hud_menu_vm_graph_frontier_review.jsonz&hud_menu_vm_graph_frontier_review.htmli8Di8@i$GidGipGiGiGilMi,Jc|dSd|d|dS)N-0x0x)valuewidths 0tools/build_hud_menu_vm_graph_frontier_review.pyhxr)s#-3;r%%z):%;;cVtj|ddSt|dS)NT)quote)htmlescapestr)rs rhr-s% ;;U]r$ GGE $ GGrc|y|D]?}t|d}|t|dz}||cxkr|ks.n1t|dcSy)Nvaraw_sizename)intr)sectionsr sectionstartends rsection_name_forr(1s\ z(GDM"c'*-.. B  wv' ' ( rcvt||}||dzt|kDrytjd||dS)N KKOhhvsQw' ) Krc g}t|D]`}||dzz}t|||}|j||t||t||t ||xsddundt ||db|S)Nr*rF)indexentryVa entryVaHexrvalueHexisVar%)ranger1r9rrr()r/r$start_vacountrowsr?entry_vars r dword_rowsrIVs!#Du  eai'h1 # luIJOJ[ Xuz:$Faf+He<     Krc t||||d}g}|jdgD]}|j|jd|jd|jd|jd|jdxsd |jd |jd |jd xsgd ||d<|S)Ni`) max_commands max_bytescommandsvaHex opcodeHex opcodeNamelengthsummaryr targetVaHex payloadVaHexpointerOperands)rNrOrPrQrRrSrTrU)r getr9)r/r$r rMdecodedcompactrows rstream_previewrZisC2HPUVGG{{:r*  ) WW[1!ggl3''(+779-3"ww}5 # 7#&77+<#=#C    "GJ Nrct||}|gSg}|}|t|krt||kr|jd|}|dkr |S|||}t|dk\r3td|Dr! |j |j d|dz}|t|krt||kr|S#t $r%|j |j ddYQwxYw) Nrr*c3<K|]}d|cxkxrdkncyw) Nr).0bytes r z(resource_list_preview..s E!4!4!4 Esasciireplace)errorsr )rr,r8allr9decodeUnicodeDecodeError) r/r$rErFr0stringscursorr'raws rresource_list_previewrl}s x *C { G F 3s8 G u 4hhw' 7  N&o s8q=S E EE Fszz'23q 3s8 G u 4 N& Fszz')zDE Fs1 B55+C#"C#c tj}t|}t||tdz}t ||t d}|dd}t|duxrt||du}t|duxr|dzdk(}t||t}t||t}t||t} t||t} t||t} t||t} t||t} t||t}g}| dD]}|jdd k7r|jd xsg}|s0|djd}t!|t"sU|j%|jd t'|t|||d didt'|d|t(k(dt't dt'|d|d|d|xr| dt+|d|Dcgc] }t'|c}dt+|dt+| d| Dcgc] }t'|c}dt+| dt-||t.dddd }d!d"d#|t'tt't0t't t'tt'tt'tt't.d$|| | | |d%|gd&gd'd( Scc}wcc}w))NPrrrMrO0x07rUrN)rM)sourceCommandVaHexchildScriptVaHexpreviewopcode14DispatchVaHexopcode14DispatchMatchesExpectedpostSelectedRootTableVaHexpostSelectedRootFirstDwordHex.postSelectedRootFirstDwordLowByteLooksOpcode14postSelectedRootFirstDwordIsVa(postSelectedRootRejectedAsLinearOpcode14gateDirectRefCountgateDirectRefsHexwrapperDirectRefCounttopSequenceDirectRefCounttopSequenceDirectRefsHexparentDirectRefCountintroTitleResourcePreviewnormalFieldEscOpenerPromotedFdecisionaThe VM graph still does not prove the normal-field ESC/X opener. 0x0047e624 creates supporting child objects, stores selectedRoot from the inline 0x004a2cb0 intro/title resource list, and calls selectedRoot. The only top-menu sequence reference remains the wrapper's opcode 0x04 operand at 0x0047e6ac. The apparent 0x14 byte at 0x0047e670 is rejected as a linear command because its overlapped first dword is not a valid VA; the later 0x0047e688 pointer is a table entry/reference to the wrapper gate, not opener proof.z(hwanse-hud-menu-vm-graph-frontier-reviewz0tools/build_hud_menu_vm_graph_frontier_review.pyz/top-menu-vm-graph-grounded-opener-still-pending) parentContextselectedRootStorepostSelectedRootTablegatewrapper topSequenceintroTitleResourceList)rrrr)zm0x0047e670 is not accepted as a linear opcode 0x14 command because dword[0x0047e670] is not a file-backed VA.zM0x0047e688 is referenced only as a table entry from 0x0047e678 in this graph.zH0x004ddc6c is only referenced by the wrapper call operand at 0x0047e6b0.zt0x004a2cb0 is the compile/aaa/logo/title/btl_k intro-title resource list, so the parent remains intro/title-context.)ziFind a non-intro field state/root stream that reaches a menu-equivalent wrapper or descriptor attachment.zsIf opcode 0x14 is used elsewhere as a branch command, accept it only when dword[stream] is a file-backed target VA.zuTrace producers of object+0x40 stream pointers for the normal field mode rather than promoting nearby pointer tables.) kindsourcestatusrR watchedVapostSelectedRootTableRowsstreamPreviewsparentChildScriptsnegativeEvidence nextFrontier)EXE read_bytesrr1GENERAL_VM_TABLE_VArI$TOP_MENU_POST_SELECTED_ROOT_TABLE_VAboolrr=TOP_MENU_GATE_VATOP_MENU_WRAPPER_VATOP_MENU_SEQUENCE_VATOP_MENU_PARENT_CONTEXT_VArZrV isinstancer#r9rOPCODE14_HANDLER_VAr,rlINTRO_TITLE_RESOURCE_LIST_VA&TOP_MENU_PARENT_SELECTED_ROOT_STORE_VA)r/r$opcode14_dispatch post_rows first_dwordfirst_dword_is_valow_byte_looks_opcode14 gate_refs wrapper_refstop_sequence_refs parent_refs parent_stream gate_streamwrapper_streamtop_sequence_stream child_scriptscommandoperandschild_varefrRs r build_reportrsV .. CS!H h0Ch0NO3*NPQRIA,w'K[4hhP[9\dh9hi";d#:#[ d@RW[?[\3*:;Ic8-@AL"32FGS(,FGK"32LMM h0@AK#C3FGN(h8LMM , ;;{ #v - ;;017R A;??7+ h $  *1++g*>(*8 -c8XPQR  $5!6)+<@S+S %b)M&N (K  9:Q  )*;  34K4eTePe c)n ;#bg; \!2 $S):%; #8I$JRW$J K 0 $%:3Jf%g '  E#G8;DC :;!#$J!K%'(L%M'(-.23&()E&F &/*%.  ,  9! !%<%Ks 4K&Kcg}|D]1|jddjfd|Dzdz3djd|D}d|ddj|dS) Nzrc3`K|]%\}}dtj|d'yw)zzN)rrV)r`key_labelrYs rrbzrender_table..s+O VQswws|_-U3Os+.zc3@K|]\}}dt|dyw)zzNr)r`_keylabels rrbzrender_table..s!EkdET!E(5)Eszz
)r9join)rGcolumnsbodyheadrYs @r render_tablers{ D  ggOwOO P   77EWE ED v%9"''$-HX YYrc|jdxsg}g}|D]}|jdt|jddt|jddt|jddt|jd dt|jd d d d j|zdzS)NrMzrNzrOz
rPz rQrRz z\rr)rVr9rr)streamrGrrYs rrender_commandsrs ::j ! 'RD D   3777+,-.377;/01Qsww|?T=Uz z Nr)r`kvs rrbzrender_html..s/fX\XY[\/!vZ!v]Sf(*r))r?#)rAentry)rBr)rCzis VA)r%r%c3XK|]"\}}dt|dt|d$yw)z

z

Nrr)r`r"rs rrbzrender_html..s5 D& $yof&=%>jIrrc 3|K|]4}dt|ddt|ddt|dd6yw)z

Child ruz

from rtz

rvrNr)r`rYs rrbzrender_html.."su  a$6 7899LQsSgOhMiLjjuwFGJKTGUwVvWWa bs:<rc3:K|]}dt|dywz
  • z
    • Nrr`items rrbzrender_html..&sU$$qwiu-Urc3:K|]}dt|dywrrrs rrbzrender_html..'sR44$y.RrrF) ensure_asciiu[ HUD Menu VM Graph Frontier

    HUD Menu VM Graph Frontier

    top-menu wrapper/sequence 주변 VM graph와 0x14/table false promotion 방지 리포트.

    z0

    Decision

    rzG

    Post SelectedRoot Table

    z
    z z4

    Negative Evidence

      z)

    Next Frontier

      z~

    Raw JSON

    
  
    
  


)rritemsjsondumpsr)
reportrRcards	card_html
post_tablestreamschildren	negatives
next_itemspayloads
          rrender_htmlrsYG	6(#$	!89:	(R ST	g234	W89:	79:;

Ef`effI*+sJgg"#34::<Gww./HU&AS:TUUIR6.;QRRJjje4G2 [!	
'*
 L
)*
	
		I_44rc t}tjdtjdtjt
j|dddtjt|dtdy)	NT)exist_okF)rindentzutf-8)encodingz$hud_menu_vm_graph_frontier_review ok)rOUTmkdirWEBJSON_OUT
write_textrrHTML_OUTrprint)rs rmainr`sg
^FIItIIItI

6aHSZ[F+g>	
01r__main__)rs)r
int | Nonerr#returnr)rrrr)r$list[dict[str, Any]]r rrz
str | None)r/bytesr$rr r#rr)
r/rr$rr r#r3r#rr)r/rr$rrr#rz	list[int])
r/rr$rrEr#rFr#rr))
r/rr$rr r#rMr#rdict[str, Any])
)
r/rr$rrEr#rFr#rz	list[str])rr)rGrrzlist[tuple[str, str]]rr)rrrr)rrrr)rNone)1__doc__
__future__rrrr-pathlibrtypingrprobe_exe_scene_tablesrrr'summarize_object_payload_442c75_callersr	__file__resolveparentsROOTrrrrrrrrrrrrrrrrr(r1r4r=rIrZrlrrrrr__name__rrrr	s#
LLAH~''*
]
Ul
Ul9999  ')3&'1$ !)<H1!	&((`F	ZONb2zFr
    VAopcodelensummary