UHj4dZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ejjdee ej!j"ddlmZmZmZe ej!j,dZedz Zd Zd Zd d d dZdddddddddddddddgZd(dZd)dZd*dZd+dZ d,d Z!d-d!Z"d.d"Z#d/d#Z$d/d$Z%efd0d%Z&d1d&Z'e(d'k(re'yy)2zrcd|dS)N0x08xr#s rhex32r*?s c{ rcvt||}||dzt|kDrytjd||dS)Nz>rct|}t||}g}g}|jdxsgD]}t|jd}|!t |}|s/|j |jd|jd|dt |jdxsijd|jddd |jd xsgD]} | jd tk7s| jd tk7r5t| jd } | Rt||| } t||| dz} t||| dz} t| ||}t| ||}t| ||}|j id|jdd|jdd|dd| jdd| jdd| jdd | jd d| t| ndd|dd|ddt| dzd| t| ndd|dd|ddt| dzd| t| ndd|d|dt |jdxsijd| jd | jd!d"u|d#d$|Dcgc]}|jds|}}|Dcgc]@}|jdd%k(s(|jdd%k(s|jdd%k(r|B}}|Dcgc]}|jdd%k(r|}}d&}d'ttt||t|t|t|t||||d(|d)Scc}wcc}wcc}w)*Nentries handlerVaHex opcodeHexr streamEffectcanJumpToDwordAtPlus4referenceCountr)rGrFr8rIrJ referencessourcetarget wordVaHexr,r8 streamKind streamVaHex wordIndexvalueHex valueKindr= valueMeaningr>nextDwordVaHex nextDwordHex nextDwordKindnextDwordMeaningnextNextDwordVaHexnextNextDwordHexnextNextDwordKindcnspointerTr)nextNextDwordMeaningrIr]r^rr?aObject+0x61 consumer handlers do appear in the map1_01a->map2_02d save-selector streams, but their stream operands do not point at the current frontier leaf, frontier reader, or false branch target. The only branch-capable object+0x61 row is opcode 0x2f at 0x00542e74; its dword [stream+4] is 0x00001618, a small scalar/scene-id value associated with map2_16j.cns, not a save-selector leaf pointer. This keeps the object+0x61 path blocked as route promotion evidence.zgobject+0x61 consumer handlers resolved through current map1_01a->map2_02d save-selector stream operandsblocked)scoperLrMobjectHandlerOpcodeCountobjectHandlerOpcodesrouteOperandRowCountbranchCapableRowCountdirectFrontierOperandCountbranchFrontierOperandCountbranchCapableRowsdirectFrontierOperandRowsrowspromotionStatus conclusion) rrgetr%r9appendbool ROUTE_SOURCE ROUTE_TARGETr4rCr*r-)r0script_handler_tabler1rBrjobject_handler_opcodesentryr7r8refword_var$ next_valuenext_next_value value_class next_classnext_next_classrow branch_rowsdirect_frontier_operand_rowsbranch_frontier_rowsrls r build_summaryr_sYS!HsH-G D%)))4:1uyy89   !*- %%;/!IIn56]%)599^+D+J*O*OPg*h%i#ii(8!< '  99\*0b# Cwwx L0CGGH4E4U 45GS(G4E!#x1=J&sHgkBO*5(GDK)*hHJ.'RO KKUYY{3 . 9vcggl3  sww}5  SWW[1 SWW[1E,=E%L4[0 I 6!%! "4Z5Kj 1QU F!3#Jy$9%eGaK&8 #o>YE/$:_c!"$_V%<#$)8 (B)-uyy/H/NB.S.STk.l)mwwu~779-5$]3- # 1f#'K3#''2I*J3KKK$ 77; #4 4 77? #'8 8 77& '+< < $ $# 77? #'8 8   O{$'(>$? 6 #D !$[!1&)*F&G&)*>&?(%A$  %L$ s N37N3AN8 N=cddd|dddd|dd|d d d |d d |dd|dd|dd|dd|dd|ddddddg}|dD]2}|jd|dd|d d!|d"d#|d$d#|d%d& 4|jgd'|d(D]b}|jd|d)d|dd|d d|d*d+|d,d-|d.d/|d0d1|d2d3|d4d1|d5d#|d6d#|d"d#|d7d&d|d(s|jd8|jdd9j|S):Nz+# Save Selector object+0x61 Stream OperandszScope: ra.z - route: `rLz -> rM`z- object handler opcodes: rbz- route operand rows: rdz- branch-capable rows: rez- direct frontier operands: rfz- branch frontier operands: rgz- promotion status: rkz- conclusion: rlz## Object Handler Opcodesz5| opcode | handler | group | jump [stream+4] | refs |z | --- | --- | --- | --- | ---: |rcz| `rGz` | `rFz` | r8z | rIrJz |)rz## Route Operand RowsrzV| word | opcode | handler | stream | value | next dword | next kind | group | impact |z7| --- | --- | --- | --- | --- | --- | --- | --- | --- |rjrNrP rQ[rRz]` | `rSz` rUz | `rWrYrXrz%| - | - | - | - | - | - | - | - | - | )rnextendjoin)summarylinesr|s rmarkdownrsG5 ''"#1% WX&'tGH,=+>a@ $W-G%H$IJ )?!@ AB !'*A"B!CD &w/K'L&MN &w/K'L&MN w'89:; ./0 # ?*# E&-.  #k"#5^)<(=T#g,s*+,C4D0E/Fb J   LLv  #k"#5[)9(:%N@S?TUL!"!C $6#7q[9I8JKJ 3~#6"78N#$Bs+='>&?s3CWBXX[7|nCM 232  7   6? <= LL 99U rcdjd|dD}djd|dD}djdddd tj|d d d d tj|ddtj|ddd|ddd|ddd|ddd|ddd|dddtj|dddd tj|d!d"d#d$|xsd%d&d'd(|xsd)d&gS)*Nrc 3K|]y}dtjt|ddtjt|ddtjt|dd|dd|dd {y w) rGrFzr8 rIrJ Nhtmlescaper!.0r|s r zhtml_page..s   [[S%5!6789[[S%8!9:;<{{3s7|,-./*+,-#$%&   sA?Brcc 3bK|]}dtjt|ddtjt|ddtjt|ddtjt|ddtjt|dd|d d tjt|d d tjt|d dtjt|dd tjt|ddtjt|ddtjt|ddtjt|ddyw)rrNrrGrFrPrrQrrRz]rSz
rUzrWrYrrXr8rrNrrs rrzhtml_page..s   [[S%5!6789[[S%5!6789[[S%8!9:;<[[S%6!7894;;s3}K]G^;_:``abefqbrast[[S_!567{4;;sSVWeSfOgChBij[[S%8!9:;;t{{SVWZ[mWnSoGpFqr{{3s?34567{{3s7|,-./{{3s=12345  sF-F/rjz]Save Selector object+0x61 Stream Operandszz2

Save Selector object+0x61 Stream Operands

z

Scope: raz.

z
    z
  • route: rLz -> rMz
    • z
  • object handler opcodes: rbz
    • z
  • route operand rows: rdz
  • branch-capable rows: rez
  • direct frontier operands: rfz
  • branch frontier operands: rgz
  • promotion status: rkz
z

rlz

z

Object Handler Opcodes

zxz8z
opcodehandlergroupjump [stream+4]refs
No object handler opcodes.
z

Route Operand Rows

zz4)rrr)r opcode_rows operand_rowss r html_pagers)) 12  K99 6?  L 99i y< T[[!12359 DKK(9:;74;;wW_O`CaBbbno &w/I'J&K5Q "7+A#B"C5I #G,C$D#EUK (1M)N(OuU (1M)N(OuU W5F-G!H IO dkk',/0 16) CQQ% |NN- rc|jdd|dz jtj|dddzd |d z jt |d y) NT)parentsexist_okz+save_selector_object61_stream_operands.jsonF) ensure_asciiindentrrr+save_selector_object61_stream_operands.html)mkdir write_textrdumpsr)rout_dirs r write_outputsrsf MM$M. <<HH 7q9D@I <<HHSZI[fmHnrctj}|jdttdz |jdtt dz |jdtt |j }t|jjt|ji}t||jtd|jdz y) Nz--exez Hwanse2.exe)typedefaultz--script-handler-tablezscript_handler_table.jsonz --out-dirz%wrote object+0x61 stream operands -> r)argparseArgumentParser add_argumentrROOTOUT parse_argsrr0 read_bytesrrrrrprint)parserargsrs rmainr%s  $ $ &F dD=4HI 0tSKfEfg  $<    D $++R0G'4<<( 1$,,An2n1o pqr__main__)rrrrreturnr)r$z str | Noner int | None)r$r"rr!)r0bytesr1 list[dict]r2r"rr)r7r"rz dict | None)r$rr1rrBzdict[int, str]rdict)r0rrrrrr)rrrr!)rrrrrNone)rr))__doc__ __future__rrrrr.syspathlibrtypingrrinsertr!__file__resolveparentprobe_exe_scene_tablesrrrrrrrprqrAr6rr%r*r4r9rCrrrrr__name__r)rrrs(B" 3tH~--/6678PP H~''* Ul  '!5- X / < % 7 ,8  4 ?Yx+\0f25o r zFr
wordopcodehandlerstreamvaluenext dwordnext kindgroupimpact
No route operand rows.