UHjyDdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ejjdee ej!j"ddlmZmZmZe ej!j,dZedz Zd Zd Zd Zd Zd Zd ZdZdZ dZ!dZ"d"dZ#d"dZ$d#dZ%d$dZ&d%dZ'd&dZ(d'dZ)d(dZ*d)dZ+d*dZ,d+d,dZ-d-dZ.d-dZ/d.dZ0d/d Z1e2d!k(re1yy)0zr5)readr zmov al, ds:[addr]r r6)r9zmov eax, ds:[addr]r r7)writer zmov ds:[addr], alr r8)r;r:zmov ds:[addr], eaxr ) )s r9r zmov cl, byte ptr ds:[addr])s r9r:zmov ecx, dword ptr ds:[addr])s r;r zmov byte ptr ds:[addr], cl)s r;r:zmov dword ptr ds:[addr], ecx)sr9r zmov dl, byte ptr ds:[addr])sr9r:zmov edx, dword ptr ds:[addr])sr;r zmov byte ptr ds:[addr], dl)sr;r:zmov dword ptr ds:[addr], edx)sr;r mov byte ptr ds:[addr], imm8)sr;r:zmov dword ptr ds:[addr], imm32))sf r9zmov cx, word ptr ds:[addr])sf r;r=zmov word ptr ds:[addr], cxunknownz%unclassified direct address referencer) accessKindwidth instruction prefixLength)appendr0) datapos candidatesopcodeprefixaccessr@rA prefix_lengths rclassify_direct_refrK?sJ axDqM%==cAg T>   A B t^   B C t^   B C t^   C D / I*{ #f+ $sS['8"="G   vuk3v;G H I/I*{ #f+ $sS['8"="G   vuk3v;G H I #B   1;1 -FE; "%  rct|cxkr tkryt|cxkr tkryt|cxkr tdzkryyy)Nz&opcode 0x12 active-state slot selectorz(opcode 0x13/runtime-slot related handlerizstartup/runtime init routinezother text routine)OPCODE12_HANDLER_STARTOPCODE13_HANDLER_STARTOPCODE16_HANDLER_STARTSTARTUP_INIT_VA)instruction_vas rclassify_contextrRosNH2HH7IH2HH9I.B?U+BB-C rcRg}tjd|}d} |j||}|dkrn|dz}t||}||ddk7r5t ||}|Dt ||} || j dxsdz } d} | ddk(r|d zt|kr||d z} |jt|t|t| | d | d | d| | d | d ndt| |tcxkxr|| d xsdzkncd |jd|S)Nzz!scan_exact_refs..s c"45r)key) structpackfindr-rrKgetr0rCrrRACTIVE_FLAG_VAsort) r1r(addressrowsneedlesearchhitr*ref_varefrQrZs rscan_exact_refsroys\ D [[w 'F F hhvv& 7 q$Xs3 ?gfo8 h, > !#s+377>#:#?a@ } !? ?C!GcRUhDVC!G I .f %n 5l+\}-"4=4Ib30t'7 '> YGs7|GXWXz!scan_call_refs..sNG76?g3MN r&r'rr:r2z2& Z /&4- /c/2B7*DvMK -"=1y>"=1!&{!3(-j6.A(B    rc bt|}||nttdz i}t||t}g}t t tdzD]}t|||}|jt|t|tz t|||dt|||dt|td|Dtd|D|d|Dcgc] }|dd k(s |}}|Dcgc] }|dd k(s |} }|Dcgc] }|d d k(r|jd dk(r|"} }t!|t} t#||t$} d} idt&dt(dttdt||tddt||tdd| d| dudtt$dt| d| dt|dt| dt|dt| d|d|dd t+| xrt||tdk(gd!| d"Scc}wcc}wcc}w)#Nzsave_loader_trace.jsonr rrVc32K|]}|ddk(s dyw)r?r9r Nrrrr_s rrsz build_summary..sN3#l2Cv2MQNrtc32K|]}|ddk(s dyw)r?r;r Nrrs rrsz build_summary..sPC3|3D3OaPrt)rWrstaticInitialBytestaticInitialByteHexrefCount readCount writeCountrefsr?r;r9rY 0x00411306rZazThe opcode 0x12 active-selection flag is not an unknown static producer: the executable image initializes 0x00457744 to 1, and startup routine 0x00411300 writes it to 1 via a direct byte store called from 0x00401928. The same byte is also inside the first save-read block at save offset 0x006c, so a loaded save can override the startup/default value. For the current blocker this removes the static-writer mystery around byte(0x00457744), but route promotion is still blocked because the actual runtime/save value, prior selectionBuffer[0x20], secondaryBranchState contents, control path, and strict map1_01a hotspot remain unproven.sourceractiveFlagVaHexactiveFlagStaticInitialByteactiveFlagStaticInitialByteHexactiveFlagSaveSourceactiveFlagInsideSaveReadBlockstartupInitVaHexstartupInitCallCountstartupInitCallsactiveFlagRefCountactiveFlagReadCountactiveFlagWriteCountactiveFlagInitWriteCountactiveFlagRefsneighborFlagRowspromotionStatusblocked)z^actual loaded-save byte at save offset 0x006c, if a save-load path overwrites startup defaultszD]&}|jd*|dd,|d?d.|d5d6(|d>s|jd@|jgdA|jdB|dCD|jddDj|S)ENrz## Save Selector Active Flag Sourcesz - route: rz -> rz- active flag: `r`z- static initial byte: `rz- save source: `r-z` via `rwz` (r)z- startup init routine: `rz ` calls: rz- exact refs: r (reads r , writes rz- init writes to 1: rz- resolved static default: rz- promotion status: `rrz## Active Flag ReferenceszN| address | instruction | access | width | immediate | context | instruction |z,| --- | --- | --- | ---: | --- | --- | --- |rz| `rWz` | `rYz` | r?z | r@z | `r[r\rAz |)rz## Neighbor Flag Bytesrz?| address | save offset | static byte | refs | reads | writes |z(| --- | --- | --- | ---: | ---: | ---: |rrrrr)rz## Startup Init Callsrz| call | target | instruction |z| --- | --- | --- |rrxz | - | - | - |)rz## Remaining Unknownsrc3&K|] }d| yw)z- Nrrritems rrszmarkdown..5sF2dVFsr )rerCextendjoin)summaryrlinesr_s rmarkdownrs@++45;K- GH%&d78+<*=> 7#456a8 "7+K#L"MQO ;???C@AYdfiIjHkknozo~o~@MORpSoTTU V #G,>$?#@ 'RhJiIjk !567xH]@^?__hiprHjIiJJK L w'ABCD %g.E&F%GH (9 :;1=   # X6% E('(  #l#$E#.@*A)B$s)?uSI_E`Daae:s3{#3"4CL8I7J" N   LLlm)*b s3{+,E#m2D1ET#mJ\I]]_`ab % & _% LL23 LLF1D)EFF LL 99U rc|jdxsi}djd|dD}djd|dD}djd|dDxsd }d jd |d D}djd dddtj|ddtj|dd|dd|dd|jddd d|dd|dd |d!d"|d#d$|d%d&|d'd(|d)dd*tj|d+d,d-d.|d/d0d1|d/d2d3|d/d4d5|d6gS)7Nrrc3K|]}dtj|ddtj|ddtj|dd|d|dnd d tj|jd xsd dtj|d dtj|d dyw)rWrYr? r@Nrzr[r\rA )htmlescaperers rrszhtml_page..<s   [[\!2345[[%7!89:;{{3|,-./"7|7s7|SAB[[!8!?C@AB{{3y>*+,{{3}-./0  sCCrc3K|]d}dtj|ddtj|ddtj|dd|dd|dd|d d fy w) rrWrrrrrrrrrNrrrs rrszhtml_page..Hs   [[\!2345[[_!5678[[%;!<=>?: ; !< !"   sA*A,rc 3K|]R}dtj|ddtj|ddtj|ddTyw)rrwrrxrrArNrrs rrszhtml_page..Ssj   [[[!1234[[]!3456{{3}-./0 sAArz:No startup init calls found.rc3NK|]}dtj|dyw)z
  • z
    • Nrrs rrszhtml_page..[s#`4dkk$/06`s#%rzUSave Selector Active Flag Sourcesa(z*

    Save Selector Active Flag Sources

    z

    route: rz -> rz; active flag rz; static byte rz; save offset rrz .

    z

    startup init rz; calls rz ; exact refs rrrrrz); resolved static default: rz; promotion status rz

    rz

    z

    Active Flag References

    zz
    addressinstructionaccesswidthimmediatecontextinstruction
    z

    Neighbor Flag Bytes

    zz

    Startup Init Calls

    zV
    addresssave offsetstatic byterefsreadswrites
    z

    Remaining Unknowns

    z
      z
    )rerrr)rrref_rowsr call_rowsunknownss r html_pager:s++45;Kyy +,  HII -.  M  -. F Fww`7K^C_``H 99a s4 T[[!234GDKKPXHY r) argparseArgumentParser add_argumentrROOTr parse_argsrr1 read_bytesrrprint)parserargsrs rmainr}s  $ $ &F dD=4HI  $<    DDHH//12G'4<<( 7 Go8o7p qrr__main__)rrreturnstr)r"rr#rrr)r( list[dict]r)rr dict | None)r1bytesr(rr2rrz int | None)rDrrErrdict)rQrrr)r1rr(rrhrrr)r1rr(rr}rrr)rrrrrrr/)r1rrrrr)rrrr)rrrrrNone)rr)3__doc__ __future__rrrrrbsyspathlibrtypingrr"insertr__file__resolveparentprobe_exe_scene_tablesrrrrrrrrrfrrrPrMrNrOrrrr$r-r3rKrRrorrrrrrr__name__rrrr sB" 3tH~--/6678LL H~''* Ul   ###"8 -` !H("BJ0f7tjs zFr
    calltargetinstruction