#!/usr/bin/env python3 """Classify direct selector/selected-root writers around scene route execution. The global mode/state frontier narrowed the next proof target to live writers of 0x004576da / 0x004576db / 0x0059de30. This pass is intentionally small and strict: it enumerates every direct EXE reference to those globals, separates save/load restore from VM command handlers, and records what is grounded versus what still does not promote to a live scene/event route producer. """ from __future__ import annotations import html import json import struct from pathlib import Path from typing import Any from build_hud_menu_opener_frontier_review import ( find_function, function_ranges, hx, text_refs, ) from probe_exe_scene_tables import offset_to_va, read_sections, va_to_offset ROOT = Path(__file__).resolve().parents[1] EXE = ROOT / "Hwanse2.exe" OUT = ROOT / "out" WEB = ROOT / "web" GENERAL_DISPATCH_TABLE_VA = 0x00440538 SAVE_SELECTOR_DISPATCH_SLICE_VA = 0x00440720 SELECTOR_A_VA = 0x004576DA SELECTOR_B_VA = 0x004576DB SELECTED_ROOT_VA = 0x0059DE30 SELECTOR_ROOT_TABLE_VA = 0x00442D35 SELECTOR_BYTE_HANDLER_VA = 0x00406DBB SAVE_LOAD_RESTORE_VA = 0x00423319 SELECTED_ROOT_INDEXED_WRITER_VA = 0x0040AD9B SELECTED_ROOT_EXECUTOR_VA = 0x0040ADC9 SELECTED_ROOT_DIRECT_WRITER_VA = 0x0040AE0E def h(value: Any) -> str: return html.escape("" if value is None else str(value), quote=True) def u32(exe: bytes, sections: list[dict[str, Any]], va: int) -> int | None: off = va_to_offset(sections, va) if off is None or off + 4 > len(exe): return None return struct.unpack_from(" list[int]: needle = struct.pack(" dict[str, Any] | None: refs = dword_refs(exe, sections, handler_va) if not refs: return None entry_va = refs[0] absolute_index = (entry_va - GENERAL_DISPATCH_TABLE_VA) // 4 save_slice_index = (entry_va - SAVE_SELECTOR_DISPATCH_SLICE_VA) // 4 return { "entryVaHex": hx(entry_va), "handlerVaHex": hx(handler_va), "generalDispatchIndex": absolute_index if entry_va >= GENERAL_DISPATCH_TABLE_VA else None, "generalDispatchIndexHex": hx(absolute_index, 2) if entry_va >= GENERAL_DISPATCH_TABLE_VA else None, "saveSelectorSliceIndex": save_slice_index if entry_va >= SAVE_SELECTOR_DISPATCH_SLICE_VA else None, "saveSelectorSliceIndexHex": hx(save_slice_index, 2) if entry_va >= SAVE_SELECTOR_DISPATCH_SLICE_VA else None, } def classify_ref(function_va: int, ref_va: int, name: str) -> dict[str, Any]: if function_va == SELECTOR_BYTE_HANDLER_VA: if name in {"selectorA", "selectorB"}: return { "role": "selector-byte-writer", "promotion": "grounded-vm-writer-primitive", "evidence": "opcode handler copies stream operands +2/+3 into selector bytes, then switches to a fixed root pointer.", } if function_va == SAVE_LOAD_RESTORE_VA: return { "role": "save-load-restore", "promotion": "excluded-save-load", "evidence": "restore path reads selector bytes and writes selectedRoot after loading persistent state blocks.", } if function_va == SELECTED_ROOT_INDEXED_WRITER_VA: return { "role": "selected-root-indexed-writer", "promotion": "grounded-vm-writer-primitive", "evidence": "selectedRoot = dword table[index] where table comes from stream +4 and index from stream +1.", } if function_va == SELECTED_ROOT_DIRECT_WRITER_VA: return { "role": "selected-root-direct-or-inline-writer", "promotion": "grounded-vm-writer-primitive", "evidence": "mode 0 sets selectedRoot to inline stream+4; mode 1 sets selectedRoot to stream dword at +4.", } if function_va == SELECTED_ROOT_EXECUTOR_VA: return { "role": "selected-root-executor", "promotion": "grounded-consumer-not-producer", "evidence": "if selectedRoot is nonzero, push continuation and set current stream to selectedRoot.", } return { "role": "unclassified-ref", "promotion": "review-required", "evidence": f"direct {name} reference outside known rows.", } def build_report() -> dict[str, Any]: exe = EXE.read_bytes() sections = read_sections(exe) functions = function_ranges(exe, sections) refs_by_name = { "selectorA": text_refs(exe, sections, SELECTOR_A_VA), "selectorB": text_refs(exe, sections, SELECTOR_B_VA), "selectedRoot": text_refs(exe, sections, SELECTED_ROOT_VA), } rows: list[dict[str, Any]] = [] for name, refs in refs_by_name.items(): for ref_va in refs: function = find_function(functions, ref_va) function_va = int(function["startVa"]) if function else ref_va row = { "name": name, "refVaHex": hx(ref_va), "functionVaHex": hx(function_va), "functionEndVaHex": hx(int(function["endVa"])) if function else None, } row.update(classify_ref(function_va, ref_va, name)) rows.append(row) handler_rows = [ { "label": "selector byte setter", "handlerVaHex": hx(SELECTOR_BYTE_HANDLER_VA), "dispatch": dispatch_entry_for(exe, sections, SELECTOR_BYTE_HANDLER_VA), "semantics": [ "case 0: push continuation stream+4; jump to dword[0x004dc518]", "case 1: selectorA=stream[+2], selectorB=stream[+3]; push continuation stream+4; jump to dword[0x004dc514]", "case 2/3: call save/load restore 0x00423319 with mode 0/1", ], }, { "label": "selectedRoot indexed writer", "handlerVaHex": hx(SELECTED_ROOT_INDEXED_WRITER_VA), "dispatch": dispatch_entry_for(exe, sections, SELECTED_ROOT_INDEXED_WRITER_VA), "semantics": ["selectedRoot = streamTable[index]; advance +8"], }, { "label": "selectedRoot executor", "handlerVaHex": hx(SELECTED_ROOT_EXECUTOR_VA), "dispatch": dispatch_entry_for(exe, sections, SELECTED_ROOT_EXECUTOR_VA), "semantics": ["if selectedRoot != 0, push continuation and set current stream to selectedRoot"], }, { "label": "selectedRoot direct writer", "handlerVaHex": hx(SELECTED_ROOT_DIRECT_WRITER_VA), "dispatch": dispatch_entry_for(exe, sections, SELECTED_ROOT_DIRECT_WRITER_VA), "semantics": ["mode 0: selectedRoot = inline stream+4", "mode 1: selectedRoot = stream dword at +4"], }, ] selector_roots = [] root_table_off = va_to_offset(sections, SELECTOR_ROOT_TABLE_VA) if root_table_off is not None: for index in range(32): root = struct.unpack_from(" str: summary = report["summary"] cards = [ ("status", report["status"]), ("direct refs", summary["directRefCount"]), ("selector writer refs", summary["selectorByteWriterRefCount"]), ("selectedRoot writers", summary["selectedRootWriterRefCount"]), ("review required", summary["reviewRequiredCount"]), ] card_html = "".join(f"
{h(k)}{h(v)}
" for k, v in cards) handler_rows = "".join( "" f"{h(row['label'])}
{h(row['handlerVaHex'])}" f"{h((row.get('dispatch') or {}).get('entryVaHex'))}
{h(json.dumps(row.get('dispatch'), ensure_ascii=False))}" f"{''.join(f'
{h(item)}
' for item in row['semantics'])}" "" for row in report["handlerRows"] ) ref_rows = "".join( "" f"{h(row['name'])}
{h(row['refVaHex'])}" f"{h(row['functionVaHex'])}
{h(row['role'])}" f"{h(row['promotion'])}
{h(row['evidence'])}" "" for row in report["directReferenceRows"] ) remaining = "".join(f"
  • {h(item)}
    • " for item in report["remainingProofs"]) evidence = "".join(f"
  • {h(item)}
    • " for item in report["newEvidence"]) payload = json.dumps(report, ensure_ascii=False) return f""" Selected Root Live Writer Frontier
    index remaining work mode/state frontier text consumer selected root consumer JSON

    Selected Root Live Writer Frontier

    {h(summary["decision"])}

    {card_html}

    New Evidence

      {evidence}

    Handler Rows

    {handler_rows}
    handlerdispatch entrysemantics

    Direct References

    {ref_rows}
    global/reffunctionclassification

    Remaining Proofs

      {remaining}

    Raw JSON

    
  
    

    



"""


def main() -> int:
    report = build_report()
    OUT.mkdir(exist_ok=True)
    WEB.mkdir(exist_ok=True)
    (OUT / "selected_root_live_writer_frontier_review.json").write_text(
        json.dumps(report, ensure_ascii=False, indent=2) + "\n",
        encoding="utf-8",
    )
    (WEB / "selected_root_live_writer_frontier_review.html").write_text(render_html(report), encoding="utf-8")
    print("selected_root_live_writer_frontier_review ok")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())