UHjAg dZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ejjdee ej!j"ddlmZmZe ej!j*dZedz Zd Zd Zgd Zgd Zd dddddddddddgZdZdZdZdZ dZ!dZ"dZ#dddd d!d"d#d$d%d%d&d"d'dd(d)d*d"d+dd,d-d.d"d/dd0d1d2d"d3dd4d5d6d"d7d$d%d%d8d"d9Z$dNd:Z%dNd;Z&dOd<Z'dPd=Z(dQd>Z)dRd?Z*dSd@Z+dTdAZ,dUdBZ-dVdCZ.dVdDZ/dWdEZ0dXdFZ1dYdGZ2 dZ d[dHZ3d\dIZ4d\dJZ5efd]dKZ6d^dLZ7e8dMk(re7yy)_zDSummarize opcode 0x20 nested script paths that can set context+0xa8.) annotationsN)Path)Any) read_sections va_to_offsetoutmap1_01amap2_02d)zruntime-object-script-selectionzgate-time-context-a8-basezgate-offset-fallthrough-proofzstrict-source-hotspot)z4runtime object script selected by opcode 0x20 mode 0z2context+0xa8 base value at the 0xe8/0xea gate timezVcontrol-flow proof that the inherited gate offsets fall through to the frontier readerzstrict map1_01a source hotspot Hwanse2.exezCopcode 0x20 handler, nested runner, and general handler table bytes)path descriptionz+out/save_selector_current_writer_paths.jsonz0current opcode 0x20 activation row at 0x005428a8z*out/save_selector_gate_offset_sources.jsonz+0xe8/0xea gate offset source classificationz-out/save_selector_selection_buffer_bases.jsonz@context+0xa8 base candidates and unresolved runtime pointer modei Di8Di(Ti(Ti@i!#@i`#@z'save/load selection-buffer base pointerTzdword[0x0059dd70 + stream[2]*4] 0x0040575azfmode 1 restores context+0xa8 from the saved pointer table; mode 0 stores context+0x58 into that table.)namewritesContextA8baseExpression evidenceVaHexmeaningzcall stream+4 helperF-zpasses dword [stream+4] to 0x00423a2f; this handler is adjacent to the base-mode group but does not directly write context+0xa8.zselect global selection buffer 0x0059e310 0x00406405z1sets context+0xa8 to the global selection buffer.zselect indexed save blockz0x00457750 + stream[1] * 0xd8 0x0040643dz6computes a save/runtime block slot base from stream+1.zselect runtime object pointerzFdword[0x0059db30 + context[0xf2]*4] or dword[0x0059db30 + stream[2]*4]z0x00406480, 0x004064a0zKselects an object pointer table entry either from context+0xf2 or stream+2.zselect save/runtime block base 0x004576d8 0x004064dez1sets context+0xa8 to the save/runtime block base.zruntime setup helperzgcalls 0x00421509 and may call 0x0041b579; it does not directly write context+0xa8 in this handler body.)(?@ABCDcd|dS)N0x08xvalues O/home/exedev/hwanse/tools/summarize_save_selector_opcode20_nested_base_modes.pyhex32r)r c{ cd|dS)Nr#02xr%r&s r(hex8r.vr*r+cp|js|Stj|jdS)Nutf-8encoding)existsjsonloads read_text)r fallbacks r( load_jsonr8zs* ;;= ::dnngn6 77r+cvt||}||dzt|kDrytjd||dS)Nzr?r@sizerAs r(bytes_atrEs6 (B 'F ~$S1 vv} %%r+c\|y|D]$}|d}||dz}||cxkr|ksn|dcSy)Nr@raw_sizerr%)r?r@sectionstartends r(section_name_for_varKsM z# gj)) B  6? " # r+c||dzz}t|||}|t|t|| t|ndt||dS)Nr:)opcode opcodeHex entryVaHex handlerVaHexhandlerSection)rBr.r)rK)r?r>table_varMentry_va handler_vas r( table_handlerrUsR&1*$H#x2J&\Ho-7-Cj)-h C  r+c |t||dzt|dz|dz dzt|dz dz|dz dzt|dz dz|dz dzt|dz dzd S)N) r'valueHexrMrN streamPlus1streamPlus1Hex streamPlus2streamPlus2Hex streamPlus3streamPlus3Hex)r)r.r&s r(decode_stream_valuerbs%L$,%$,' d* d23 t+ t34 t+ t34  r+c|D]}|jdttk7r%|jdxsijdxsg}|D]s}|jdttk(s%|jd|jd|jdxsg|jdxsg|dccSy) N writerVaHexactivationContext contextRowsvaHexrootHex rootLabels rootFieldMaps)rdrhrirj activationRow)getr)CURRENT_WRITER_VACURRENT_OPCODE20_VA)current_writer_pathsrow context_rows context_rows r("current_opcode20_from_writer_pathsrss#  77= !U+<%= =  34:?? NTRT ' Kw'51D+EE#&77=#9"wwy1"%'',"7"=2%(WW_%=%C%0    r+c t||td}dtjdfdtjdfdtjdfdtjd fd tjd fd tjd fdtjdfg}t ||Dcgc] \}}|||vdc}}dScc}}w)Nzreads stream+1 mode8a4801z loops save slot count 0x004576e8 a0e8764500z9loads slot descriptor pointer from 0x00457750 + slot*0xd88b84c050774500z&mode 0 uses descriptor+4 nested stream8b4004zcalls nested runner 0x00402360 e8145fffffz&mode 1 uses descriptor+0 nested stream8b00z"advances save-selector stream by 483404004)labelfound)handlerBytesScannedsignatureMatches)rEOPCODE20_HANDLERbytesfromhexr;)r>r?code signaturesr}patterns r(opcode20_signature_summaryrs C#3T :D  h 78 +U]]<-HI DemmTdFef 15==3JK )5==+FG 15==3HI -u}}Z/HIJ #4y #-  w D     s>Cc t||td}t||td}ttttttt j d|v|jt j ddk\ddS)Nrff148d38054400894140z0x00402360 saves context+0x40, runs the nested stream through dispatcher 0x00402321, then restores context+0x40. The dispatcher uses handler table 0x00440538, not the save-selector table.)nestedRunnerVaHexnestedDispatcherVaHexnestedHandlerTableVaHexdispatcherUsesGeneralTable#runnerTemporarilySwapsContextStreamr)rENESTED_DISPATCHER NESTED_RUNNERr)GENERAL_HANDLER_TABLErrcount)r>r? dispatcherrunners r(nested_runner_summaryrsz#x):DAJ c8]D 9F"=1!&'8!9#()>#?&+mm4D&E&S/5||EMM(r?rowsrMnoterps r(general_handler_rowsrsS D-335 Hc+@&I 4 C Kr+c |jdxsg}|Dcgc]h}|jddvrS|jd|jd|jd|jd|jddj}}|jd |jd |jd xsg|d Scc}w) NgatesselectionBufferOffsetHex>0xe80xea gateVaHex currentRootWriterBeforeGateCountglobalWriterCountsourceClassification)rrrrrcontrolPathGateStatuscontrolPathProofStatusgateOffsetsHex)rrrrrl)gate_offset_sourcesrrp gate_rowss r( gate_summaryrs  # #G , 2E   77- .2B B-(+0J(K038Z0[!$)z build_summary..EsVC#f+:UCVs #knownStaticGateOffsetDirectRefCounta<The current activation row at 0x005428a8 is save-selector opcode 0x20 with mode 0. Mode 0 does not directly choose map1_01a -> map2_02d; it iterates runtime save/object slots, calls nested runner 0x00402360 with descriptor+4 script pointers, and those nested scripts dispatch through general handler table 0x00440538. Several general handlers can replace context+0xa8 with different selection-buffer bases. Because the actual runtime object scripts and selected base before the 0xe8/0xea gates are still not proven, this narrows the blocker but does not promote the route.sourcetargetcurrentWriterVaHexcurrentOpcode20VaHexcurrentOpcode20ValueHexr[currentOpcode20OpcodeHexrNcurrentOpcode20StreamPlus1Hexr]currentOpcode20StreamPlus2Hexr_rzmode currentModeHexcurrentModeIsNestedObjectPlus4r saveSelectorOpcode20HandlerVaHexrP*saveSelectorOpcode20HandlerMatchesExpected"saveSelectorOpcode20HandlerSectionrQopcode20SignatureSummary nestedRunnermodescurrentModeRowgeneralHandlerTableVaHexgeneralHandlerRowsdirectContextA8SetterCountruntimePointerModeStillRequiredgateOffsetProofStatusrblockedrrgateRowsrstaticGateOffsetDirectRefCountre proofFoundFopcode20NestedBaseProofFoundfailedOpcode20NestedBaseGateIdsmissingEvidence evidenceRefsevidenceRefCount)promotionStatus conclusion)rr8OUTrBrn ValueErrorr)rbrUSAVE_SELECTOR_HANDLER_TABLErsrrlnextrrSOURCETARGETrmr.rrrrr;$FAILED_OPCODE20_NESTED_BASE_GATE_IDS%OPCODE20_NESTED_BASE_MISSING_EVIDENCE"OPCODE20_NESTED_BASE_EVIDENCE_REFS)r>rorselection_buffer_basesr? current_valuecurrent_decoded save_handlercurrent_context general_rowsrpdirect_base_setterscurrent_mode_row gate_infostatic_direct_ref_countrrs @r( build_summaryr%s S!H3G3S/Yb 77 Z2E1P-V_ 66 W8N7Y3_h 99 ` S(,?@MB5I\C]B^_``)-8Ox D(E"5677JKLL 30KTRL89MNO'X6L*6]3#''BS:TX\:\3]]"=1LV9;VV01I4889^_ _% &% &%  e$56%  &9 : %  "?:#> %  #OK$@ %  (9I)J%  (9I)J%  |n-%  $|,%  ),!*;%  +L,<,<^,L%  5l6F6F~6VZ_`pZq6q%  -l.>.>?O.P%  #$>sH$M%  -c8+% , *4-% . /G!H!UI/% 0 /F!G1% 2 )--(89?R3% 4 IMM'*0b5% 6 )*A7% 8 _9% : e;% < '=% > *+O?% @ @A% B :C% D C BCE% F% I% %^s J54J5c|djdxsg}td|D}|d}ddd|dd |d d |d d d|dd|dd d|dd|ddd|dd d|dt|d|dd d|dd|d d!|d"d d#|d$d%d&jd'|d(Dxsd)d*|d+d d,|d-d.|d/d d0|d1d d2|d3d d|d4dd5dg}|j d6|d7D|j gd8|j d9|d:D|j gd;|j d<|d=D|j gd>|d?D]>}|j d@|dAdB|ddC|dDdE|dFdE|dGdE|dHdB|dIdJ@|j gdK|D] }|j dL|dMdN|dOdJ"|j ddPddQ|dd dR|dSd dT|dUd dV|ddW|d dX|dIg |j gdY|dZD]8}|j d@|d[dE|d\dB|d]dC|d^dE|d_dB|dIdJ :|j gd`|daD]2}|j d@|dbdE|dcdB|dddN|dedN|dfdJ 4|j ddgj|S)hNrrc3DK|]}|jdsdyw)r~rNrrrps r(rzmarkdown..|sSc#'''BRSs  rz-# Save Selector Opcode 0x20 Nested Base Modesz - route: rz -> rz- current writer: `r`z- current opcode 0x20 row: `rz ` value `rz- stream+1 mode: `rz` (r)z- save-selector handler: `rz(- opcode 0x20 handler signatures found: /z- nested runner: `rz0- nested dispatcher uses general handler table: rz/- nested runner swaps/restores context stream: rz- nested dispatcher table: `rz:- direct context+0xa8 setter count in nested table slice: rz- gate offsets: z, c3(K|] }d|d yw)rNr%ritems r(rzmarkdown..s$WTqa[$Wrrz- gate offset proof status: `rz'- runtime pointer mode still required: rz- proofFound: `rz!- opcode20NestedBaseProofFound: `rz- promotion status: `rrz## Failed Gatesc3(K|] }d|d yw)- `rNr%rs r(rzmarkdown..sV43tfAVrr)rz## Missing Evidencerc3&K|] }d| yw)z- Nr%rs r(rzmarkdown..sD2dVDsr)rz## Evidence Refsrc38K|]}d|dd|dyw)rr z`: rNr%rs r(rzmarkdown..s/  c&k]#c-012sr)rz## Opcode 0x20 ModesrzL| mode | current | slot count | slot base | nested stream | call | meaning |z+| --- | --- | --- | --- | --- | --- | --- |rz| `rz` | z | `rz` | `rrrrz |)rz## Handler Signaturesrz| signature | found |z | --- | --- |z| r}z | r~z## Nested Runnerz - runner: `z- dispatcher: `rz- general handler table: `rz!- dispatcher uses general table: z+- runner temporarily swaps context stream: z - meaning: )rz## Nested General HandlersrzQ| opcode | handler | writes context+0xa8 | base expression | evidence | meaning |z%| --- | --- | --- | --- | --- | --- |rrNrPrrr)rz ## Gate RowsrzN| gate | offset | current-root writers before gate | global writers | source |z!| --- | --- | ---: | ---: | --- |rrrrrr )rlsumr;joinextendr)summarysignature_matchessignature_found_count nested_runnerlinesrps r(markdownrzs :;??@RSYWYS->SSN+M7 GH%&d78+<*=> g&:; &w/E'F&GyQXYrQsPttuv W%DEFc'R_J`Iaabc $W-O%P$QQRS 23H2I3O`KaJbc ]+>?@B :=Ie;f:gh 9-Hm:n9op &w/I'J&K1M DWMiEjDkl 499$WWEU=V$WW^[^_` '0G(H'IK 1':[2\1]^ ',/02 +G4R,S+TTUV (9 :;1=    1 E4 LLV73T+UVV LL  LLD1B)CDD LL  LL>* LLw  #i.!c-&8%9cBV>W=XY()*%4L0M/NOK !c)n%5R 9   LL!= r#g,s3w<.;<= LL  m$789; -(?@AC $]3L%M$NaP +M:V,W+XY 5mDi6j5kl mI./0   LL+,  #k"#5^)<(=T#FWBXAYZ$%&eC,@+Ac)nEUUW Y   LLz"  #k"#5-G)H(I567s3?R;S:TTW)*+2 /   LL 99U r+cdjd|dD}djd|dD}djd|dD}g}|dD]}|jd tj|d d |d d tj|ddtj|ddtj|ddtj|dd tj|ddg}|dD]}|jd tj|ddtj|dxsdd |dd tj|ddtj|dd tj|dd g}|dD]w}|jd tj|dxsddtj|dxsdd |dd |d!d tj|d"xsdd yg}|d#d$D]3}|jd%tj|d&d |d'd5d(jgd)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=tj|d>d?tj|d@dAtj|dBdCtj|dDdEtj|dFdGtj|dHdIdJtj|dKdLtj|dMdN|dOdP|dQdRtj|dSdTdUtj|dVdWdXdY|dZd[dY|dZd\dY|dZd]d^|d_d`da|d_dbdc|d_ddde|d_dfdgdS)hNrc3NK|]}dtj|dyw)
  • z
    • Nhtmlescapers r(rzhtml_page..s+  T[[&'|4#%rc3NK|]}dtj|dyw)z
  • 
    • Nrrs r(rzhtml_page..s+  t{{4 !'rrc3K|]9}dtj|ddtj|dd;yw)rr z : rrNrrs r(rzhtml_page..sE  T[[V-.i C DV8W7XX]^s?Arrzrzrzrzrrrrz rrNrPrrrrrrrrz rrrrzr}r~r zzzz zF z< Save Selector Opcode 0x20 Nested Base Modesz zzz6

    Save Selector Opcode 0x20 Nested Base Modes

    z

    route rz -> rz; current row rz value rz; stream+1 mode rz; nested runner rrz; handler table rz(; gate offset proof status rz.; runtime pointer mode still required: rz; proofFound rz ; promotion status rz .

    z

    rz

    z

    Failed Gates

    z
      z
    z

    Missing Evidence

    z

    Evidence Refs

    z

    Opcode 0x20 Modes

    z z
    modecurrentslot countslot basenested streamcallmeaning
    z"

    Nested General Handlers

    z z

    Gate Rows

    z
    opcodehandlerwrites context+0xa8base expressionevidencemeaning
    z

    Signatures

    zH
    gateoffsetroot writers before gateglobal writerssource
    zz)r rrr) r  failed_gatesmissing_evidence evidence_refsmode_rows_htmlrphandler_rows_htmlgate_rows_htmlsignature_rows_htmls r( html_pager$s77=>Lww-.GG>*MNw   S^456}%&'S)=%>?@AS)=%>?@AS)A%BCDES%5678;;s9~./0    +,     S%5678S%8%?C@AB()*+S)9%:;<=S%9:;<;;s9~./0     Nz"   S%5%<=>?S)C%D%KLMN9:;<*+,-;;s#9:AcBCD     123EF "" ;;s7|,-.w<.!    99000 0 # 0 Q 0 G 0 0 r0 10 70 :0 G0 f0 t0 Q0 '!0" #0$ %0& '0( A)0* dkk'("345WT[[QYIZ=[<\\pquq|q|~EF\~]r^q__stxtt@GHa@btcsddABFBMBMNUVuNvBwAxxUVZVaVabijxbyzMbNVOUPPmnrnynyzAB\z]n^m__GHLHSHST[\sTtHuGvvd e l m N e O d P P c d k l x d y c z z Z [ _ [ f [ f g n o @ g A [ B Z C C O P +0,  GL12348-0. "/00 e$102 &304 !"%(506 #708 u%90: ';0< h=0> ?0@ A0B -C0D gE0F G0H I0J K0L VM0N O0P Q0R S0T SU0V W0X Y0Z [0\ ]0^ _00 0r+c|jdd|dz jtj|dddzd |d z jt |d y) NT)parentsexist_okz-save_selector_opcode20_nested_base_modes.jsonFr) ensure_asciiindentr r0r1-save_selector_opcode20_nested_base_modes.html)mkdir write_textr4dumpsr$)r out_dirs r( write_outputsr/Ssf MM$M. >>JJ 7q9D@K >>JJ9U\K]hoJpr+cvtjt}|jdtt dz |jdtt |j}t|jj}t||jtd|jdz y)N)rz--exer )typedefaultz --out-dirz5wrote save selector opcode 0x20 nested base modes -> r*)argparseArgumentParser__doc__ add_argumentrROOTr parse_argsrr> read_bytesr/r.print)parserargsr s r(mainr=\s  $ $ 9F dD=4HI  $<    DDHH//12G'4<<( A$,,RACABB CDr+__main__)r'intreturnstr)r rr7rr@r)r>rr? list[dict]r@r?r@ int | None) r>rr?rBr@r?rDr?r@r)r?rBr@rCr@z str | None) r?rBr>rrRr?rMr?r@dict)r'r?r@rD)rorBr@ dict | None)r>rr?rBr@rD)r@rB)r>rr?rBr@rB)rrDr@rD)NNN) r>rrozlist[dict] | NonerrErrEr@rD)r rDr@rA)r rDr.rr@None)r@rF)9r5 __future__rr3rr4r<syspathlibrtypingrr insertrA__file__resolveparentprobe_exe_scene_tablesrrr&r7rrrrrrrrrnrmrrrrr)r.r8rBrErKrUrbrsrrrrrrrr$r/r=__name__r%r+r(rQs\J" 3tH~--/6678> H~''* Ul  ($ )%\ >I =D @Y&"&)"  :;%{  ' V  1&%F  ,9%K  0b1`  1&%F  ' |  W2j8 4&  ".  6./3'+*. R R+R%R( R  RjiXjZ25qD zFr+
    signaturefound