#!/usr/bin/env python3 """Review indirect producers for the status/comment selector byte +0. Direct absolute writes to 0x004576d8+0 are absent. The remaining plausible writer class is an object/text VM command that writes to object+0xa8[offset]. This report scans known object-VM dynamic selector writer opcodes and keeps the status/menu +0 consumers next to the negative producer evidence. """ from __future__ import annotations import html import json from collections import Counter from pathlib import Path from typing import Any from probe_exe_scene_tables import offset_to_va, read_sections, va_to_offset ROOT = Path(__file__).resolve().parents[1] EXE = ROOT / "Hwanse2.exe" OUT = ROOT / "out" WEB = ROOT / "web" STATUS_MENU_MIN = 0x004E8000 STATUS_MENU_MAX = 0x004EC000 STATUS_COMMENT_PAYLOAD_MIN = 0x004E842E STATUS_COMMENT_PAYLOAD_MAX = 0x004E86A0 def h(value: Any) -> str: return html.escape("" if value is None else str(value), quote=True) def hx(value: int | None, width: int = 8) -> str: if value is None: return "" return f"0x{value:0{width}x}" def load_json(name: str) -> dict[str, Any]: try: data = json.loads((OUT / name).read_text(encoding="utf-8")) except FileNotFoundError: return {} return data if isinstance(data, dict) else {} def section_by_name(sections: list[dict[str, Any]], name: str) -> dict[str, Any]: for section in sections: if section.get("name") == name: return section raise RuntimeError(f"missing section {name}") def root_contexts() -> list[dict[str, Any]]: data = load_json("selector_root_structure_review.json") roots = data.get("roots") rows = [] if isinstance(roots, list): for root in roots: if isinstance(root.get("rootVa"), int) and isinstance(root.get("rangeEndVa"), int): rows.append(root) rows.sort(key=lambda row: int(row["rootVa"])) return rows def context_for_va(roots: list[dict[str, Any]], va: int) -> dict[str, Any] | None: for root in roots: if int(root["rootVa"]) <= va < int(root["rangeEndVa"]): return root return None def classify_opcode(raw: bytes) -> dict[str, Any] | None: op = raw[0] if op == 0x8C and raw[3] == 0: return { "opcodeHex": "0x8c", "role": "selector-next-enabled-producer", "targetOffset": raw[2], "selectorOffset": None, "sourceStateByte": raw[1], "handlerVaHex": "0x0040b55f", "meaning": "availability array 0x0059e360/0x0059e370에서 다음 enabled row를 찾아 object+0xa8[target]에 기록", } if op == 0x8D and raw[3] == 0: return { "opcodeHex": "0x8d", "role": "descriptor-match-selector-producer", "targetOffset": raw[2], "selectorOffset": None, "sourceStateByte": raw[1], "handlerVaHex": "0x0040b696", "meaning": "active descriptor row +0x48/+0x4a 계열 비교 결과를 object+0xa8[target]에 기록", } if op == 0x8F and raw[3] == 0: return { "opcodeHex": "0x8f", "role": "global-state-derived-selector-producer", "targetOffset": raw[1], "selectorOffset": raw[2], "sourceStateByte": raw[2], "handlerVaHex": "0x0040b84a", "meaning": "object+0xa8[selector] 값을 switch로 삼아 0x00457744..49 상태를 읽고 object+0xa8[target]에 기록", } return None def scan_dynamic_writers(exe: bytes, sections: list[dict[str, Any]]) -> list[dict[str, Any]]: data = section_by_name(sections, ".data") start = int(data["raw"]) end = start + int(data["raw_size"]) roots = root_contexts() rows: list[dict[str, Any]] = [] for pos in range(start, end - 8): if exe[pos] not in {0x8C, 0x8D, 0x8F}: continue raw = exe[pos : pos + 8] decoded = classify_opcode(raw) if not decoded: continue va = offset_to_va(sections, pos) if va is None: continue root = context_for_va(roots, va) in_status_menu = STATUS_MENU_MIN <= va < STATUS_MENU_MAX in_status_comment = STATUS_COMMENT_PAYLOAD_MIN <= va < STATUS_COMMENT_PAYLOAD_MAX rows.append( { "commandVaHex": hx(va), "rawHex": raw.hex(" "), **decoded, "targetOffsetHex": hx(decoded["targetOffset"], 2), "selectorOffsetHex": hx(decoded["selectorOffset"], 2) if decoded["selectorOffset"] is not None else "", "targetsStatusCommentSelectorOffset0": decoded["targetOffset"] == 0, "inStatusMenuPayloadRange": in_status_menu, "inStatusCommentPayloadRange": in_status_comment, "rootSelectorKeys": root.get("selectorKeys", []) if root else [], "rootVaHex": root.get("rootVaHex") if root else "", "rootRangeEndVaHex": root.get("rangeEndVaHex") if root else "", "rootClass": root.get("rootClass") if root else "", "fieldMaps": root.get("fieldMaps", []) if root else [], "linkedCns": root.get("linkedCns", []) if root else [], } ) return rows def source_consumers() -> list[dict[str, Any]]: data = load_json("status_menu_vm_table_review.json") rows = [] for table_name in ("opcode13Tables", "opcode14Tables"): for row in data.get(table_name, []) if isinstance(data.get(table_name), list) else []: if row.get("sourceModeHex") == "0x03" and row.get("sourceOffsetHex") == "0x00": rows.append( { "table": table_name, "recordVaHex": row.get("recordVaHex"), "classification": row.get("classification"), "sourceExpression": row.get("sourceExpression"), "itemCount": row.get("itemCount"), "entryTableVaHex": row.get("entryTableVaHex"), "recordRawHex": row.get("recordRawHex"), } ) return rows def build() -> dict[str, Any]: exe = EXE.read_bytes() sections = read_sections(exe) rows = scan_dynamic_writers(exe, sections) target0 = [row for row in rows if row["targetsStatusCommentSelectorOffset0"]] target0_status_menu = [row for row in target0 if row["inStatusMenuPayloadRange"]] target0_status_comment = [row for row in target0 if row["inStatusCommentPayloadRange"]] target_counts = Counter(row["targetOffsetHex"] for row in rows) target0_opcode_counts = Counter(row["opcodeHex"] for row in target0) source_rows = source_consumers() summary = { "dynamicWriterCandidateCount": len(rows), "target0CandidateCount": len(target0), "target0InStatusMenuPayloadCount": len(target0_status_menu), "target0InStatusCommentPayloadCount": len(target0_status_comment), "sourceOffset0ConsumerCount": len(source_rows), "target0OpcodeCounts": dict(target0_opcode_counts), "topTargetOffsets": dict(target_counts.most_common(12)), "statusCommentSelectorIndirectWriterProven": bool(target0_status_comment), "statusMenuTarget0WriterProven": bool(target0_status_menu), "decision": ( "Object-VM dynamic selector writers 0x8c/0x8d/0x8f do have target offset +0 candidates elsewhere, " "but none are inside the status/menu payload range and none are inside the status-comment payload. " "The status/comment +0 producer therefore remains unresolved; the known +0 records are consumers, not writers." ), } return { "version": 1, "kind": "hwanse-status-comment-indirect-selector-writer-review", "source": "tools/build_status_comment_indirect_selector_writer_review.py", "summary": summary, "sourceOffset0Consumers": source_rows, "target0WriterCandidates": target0, "target0StatusMenuCandidates": target0_status_menu, "target0StatusCommentCandidates": target0_status_comment, "dynamicWriterRows": rows, } def render_html(data: dict[str, Any]) -> str: s = data["summary"] cards = "".join( f"
{h(k)}{h(v)}
" for k, v in s.items() if k != "decision" ) consumer_rows = "".join( "" f"{h(row['table'])}" f"{h(row['recordVaHex'])}" f"{h(row['classification'])}" f"{h(row['sourceExpression'])}" f"{h(row['itemCount'])}" f"{h(row['entryTableVaHex'])}" "" for row in data["sourceOffset0Consumers"] ) target_rows = "".join( "" f"{h(row['commandVaHex'])}" f"{h(row['rawHex'])}" f"{h(row['opcodeHex'])}" f"{h(row['role'])}" f"{h(row['targetOffsetHex'])}" f"{h(row['inStatusMenuPayloadRange'])}" f"{h(row['inStatusCommentPayloadRange'])}" f"{h(', '.join(row.get('rootSelectorKeys') or []))}" f"{h(', '.join(row.get('fieldMaps') or []))}" "" for row in data["target0WriterCandidates"] ) return f""" Status Comment Indirect Selector Writer Review

Status Comment Indirect Selector Writer Review

object+0xa8[+0]을 읽는 status/menu selector record와, object VM dynamic writer opcode 0x8c/0x8d/0x8f의 +0 write 후보를 대조합니다.

결론: {h(s['decision'])}
{cards}

Source Offset +0 Consumers

{consumer_rows}
tablerecordclasssourcecountentry table

Dynamic Writer Target +0 Candidates

{target_rows}
commandrawoproletargetstatus/menustatus/commentroot selectorsfield maps
""" def main() -> None: OUT.mkdir(exist_ok=True) WEB.mkdir(exist_ok=True) data = build() (OUT / "status_comment_indirect_selector_writer_review.json").write_text( json.dumps(data, ensure_ascii=False, separators=(",", ":")), encoding="utf-8", ) (WEB / "status_comment_indirect_selector_writer_review.html").write_text( render_html(data), encoding="utf-8", ) s = data["summary"] print( "wrote status comment indirect selector writer review " f"(target0={s['target0CandidateCount']}, statusMenu={s['target0InStatusMenuPayloadCount']})" ) if __name__ == "__main__": main()