$gLj1LdZddlmZddlZddlZddlmZddlmZddl m Z ddl m Z m Z mZeej!j"dZed z Zed z Zed z Zd Zd ZdZdZddZdddZd dZd!dZd"dZd#dZd$dZ d%dZ!d"dZ"d&dZ#d'dZ$d(dZ%e&dk(re%yy))aoReview indirect producers for the status/comment selector byte +0. Direct absolute writes to 0x004576d8+0 are absent. The remaining plausible writer class is an object/text VM command that writes to object+0xa8[offset]. This report scans known object-VM dynamic selector writer opcodes and keeps the status/menu +0 consumers next to the negative producer evidence. ) annotationsN)Counter)Path)Any) offset_to_va read_sections va_to_offsetz Hwanse2.exeoutwebiNiNi.NiNcVtj|ddSt|dS)NT)quote)htmlescapestr)values =tools/build_status_comment_indirect_selector_writer_review.pyhrs% ;;U]r$ GGE $ GGc|yd|d|dS)Nr0x0x)rwidths rhxr#s" } awaZ !!rc tjt|z jd}t |t r|SiS#t$ricYSwxYw)Nutf-8encoding)jsonloadsOUT read_textFileNotFoundError isinstancedict)namedatas r load_jsonr+)sSzz3:00'0BCdD)41r1  s,A AAc\|D]}|jd|k(s|cStd|)Nr)zmissing section )get RuntimeError)sectionsr)sections rsection_by_namer11s< ;;v $ &N )$0 11rc8td}|jd}g}t|trX|D]S}t|jdts#t|jdtsC|j |U|j d|S)Nz#selector_root_structure_review.jsonrootsrootVa rangeEndVact|dS)Nr4int)rows rzroot_contexts..@sc#h-0r)key)r+r-r'listr8appendsort)r*r3rowsroots r root_contextsrA8s : ;D HHW E D% "D$((8,c2z$((s4 +='> >K ? rc|d}|dk(r|ddk(rdd|dd|ddd d S|d k(r|ddk(rd d |dd|dddd S|dk(r|ddk(rdd|d|d|dddd Sy)Nr0x8czselector-next-enabled-producerr 0x0040b55fuiavailability array 0x0059e360/0x0059e370에서 다음 enabled row를 찾아 object+0xa8[target]에 기록) opcodeHexrole targetOffsetselectorOffsetsourceStateByte handlerVaHexmeaning0x8dz"descriptor-match-selector-producer 0x0040b696uWactive descriptor row +0x48/+0x4a 계열 비교 결과를 object+0xa8[target]에 기록0x8fz&global-state-derived-selector-producer 0x0040b84aukobject+0xa8[selector] 값을 switch로 삼아 0x00457744..49 상태를 읽고 object+0xa8[target]에 기록r)rawops rclassify_opcoderZKs QB Tzc!fk4F""1v(C   Tzc!fk8F""1v(p   Tzc!fk<F!!f"1v(E   rc"t|d}t|d}|t|dz}t}g}t||dz D]D}||dvr |||dz}t |} | s"t ||} | 1t || } t| cxkxr tknc} t| cxkxr tknc} |jt| |jdd| t| dd | d t| d d nd | dd k(| | | r| jd gng| r| jdnd | r| jdnd | r| jdnd | r| jdgng| r| jdgngd G|S)Nz.datarXraw_size>rFrRrU ) commandVaHexrawHexrMrIrNrr selectorKeys rootVaHex rangeEndVaHex rootClass fieldMaps linkedCns) targetOffsetHexselectorOffsetHex#targetsStatusCommentSelectorOffset0inStatusMenuPayloadRangeinStatusCommentPayloadRangerootSelectorKeysrbrootRangeEndVaHexrdrerf)r1r8rArangerZrrDSTATUS_MENU_MINSTATUS_MENU_MAXSTATUS_COMMENT_PAYLOAD_MINSTATUS_COMMENT_PAYLOAD_MAXr=rhexr-)exer/r*startendr3r?posrXdecodedrCr@in_status_menuin_status_comments rscan_dynamic_writersr{ns 8W -D U E #d:&' 'C OE!#DUC!G$  s8- - #a !#&  (C ( : eR((B@@6"Y?YY "2''#,  $&gn&=q#AIPQaIbInR0@(A1%Etv7>~7NRS7S,:/@DHDHH^R$@b6:TXXk2BFTXXo%>B6:TXXk2:>TXXk26B:>TXXk26B   > Krc td}g}dD]}t|j|tr|j|gngD]}|jddk(s|jddk(s-|j ||jd|jd|jd |jd |jd |jd d |S)Nz status_menu_vm_table_review.json)opcode13Tablesopcode14Tables sourceModeHex0x03sourceOffsetHex0x00 recordVaHexclassificationsourceExpression itemCountentryTableVaHex recordRawHex)tablerrrrrr)r+r'r-r<r=)r*r? table_namer9s rsource_consumersrs 7 8D D:  /9$((::NPT/U488J+[] Cww'61cgg>O6PTZ6Z !+'*ww}'=*-''2B*C,/GG4F,G%(WW[%9+.773D+E(+(?    Krc Btj}t|}t||}|Dcgc] }|ds | }}|Dcgc] }|ds | }}|Dcgc] }|ds | }}t d|D}t d|D}t } t |t |t |t |t | t|t|jdt|t|dd } d d d | | ||||d Scc}wcc}wcc}w) Nrirjrkc3&K|] }|d yw)rgNr.0r9s r zbuild..sCsC 12Cc3&K|] }|d yw)rKNrrs rrzbuild..s#HC $4#Hr a0Object-VM dynamic selector writers 0x8c/0x8d/0x8f do have target offset +0 candidates elsewhere, but none are inside the status/menu payload range and none are inside the status-comment payload. The status/comment +0 producer therefore remains unresolved; the known +0 records are consumers, not writers.) dynamicWriterCandidateCounttarget0CandidateCounttarget0InStatusMenuPayloadCount"target0InStatusCommentPayloadCountsourceOffset0ConsumerCounttarget0OpcodeCountstopTargetOffsets)statusCommentSelectorIndirectWriterProvenstatusMenuTarget0WriterProvendecisionr z5hwanse-status-comment-indirect-selector-writer-reviewz=tools/build_status_comment_indirect_selector_writer_review.py) versionkindsourcesummarysourceOffset0Consumerstarget0WriterCandidatestarget0StatusMenuCandidatestarget0StatusCommentCandidatesdynamicWriterRows) EXE read_bytesrr{rrlenr( most_commonbool) rtr/r?r9target0target0_status_menutarget0_status_comment target_countstarget0_opcode_counts source_rowsrs rbuildrs6 .. CS!H X .D"Qsc*O&PsQGQ*1U3S9S5T3UU-4[c?59:P5Q)-.A)B |G"GQ"-#*':*@!  -RU[s" DD DD D%Dc |d}djd|jD}djd|dD}djd|dD}dt|d d |d |d |d S)Nrrc3bK|]'\}}|dk7rdt|dt|d)yw)rz
z z
Nr)rkvs rrzrender_html..s: Aq ? !vZ!v]Cs-/c3K|]a}dt|ddt|ddt|ddt|ddt|ddt|d d cy w) zrzrr rrrzNrrs rrzrender_html..s   W s=)*+,%&'()'()*+[!"#$s,-./0   sA'A)rc3K|]}dt|ddt|ddt|ddt|ddt|ddt|d dt|d dtd j|jd xsgdtd j|jd xsgdyw)zr_zr`rrKrrLrgrjrkz, rlrez N)rjoinr-rs rrzrender_html..s   s>*+,-s8}%&'[!"#$V~&'()*/012323456377#56<"=>?@377;/526789  sCCruL Status Comment Indirect Selector Writer Review

Status Comment Indirect Selector Writer Review

object+0xa8[+0]을 읽는 status/menu selector record와, object VM dynamic writer opcode 0x8c/0x8d/0x8f의 +0 write 후보를 대조합니다.

결론: rz
z

Source Offset +0 Consumers

a
tablerecordclasssourcecountentry table

Dynamic Writer Target +0 Candidates

z&
commandrawoproletargetstatus/menustatus/commentroot selectorsfield maps
)ritemsr)r*scards consumer_rows target_rowss r render_htmlrs YA GGGGI E GG 01  M'' 12  K(4)*!J-(8'9:WGHUGVVCDOCPPE% %rcPtjdtjdt}tdz j t j |dddtd z j t|d|d }td |d d |ddy)NT)exist_okz3status_comment_indirect_selector_writer_review.jsonF),:) ensure_ascii separatorsrr z3status_comment_indirect_selector_writer_review.htmlrz>wrote status comment indirect selector writer review (target0=rz , statusMenu=r)) r$mkdirWEBr write_textr"dumpsrprint)r*rs rmainrsIItIIItI 7D @@LL 4e CM @@LLDM YA  -./}Q?`=ars# LL H~''* ] Ul Ul''H" 22  F%P($NEP& zFr