Generic VM Stream Producer Frontier
The generic VM stream frontier is now consolidated. 0x00402321/object+0x40 is a grounded dispatcher; all direct calls are now classified, including the nested runner wrapper, opcode 0x2a linked-object fanout, and active-object delayed scripts. Current surfaces remain support/display/object domains or negative route inventories. None promotes to a concrete scene route, map transition, field encounter, or selected-root gameplay producer.
statusgeneric-vm-stream-frontier-consolidated-no-route-producer-promoted
runner0x00402321
direct calls4
unclassified direct0
opcode 0x2a fanout calls2
0x2a active +ec hits0
0x2a raw candidates53
pointer refs83
snippets8/8
promoted producers0
Surfaces
| surface | status | producer promoted | evidence | route impact | source |
|---|---|---|---|---|---|
| generic object/display VM runner | grounded-consumer | False | 0x00402321 reads object+0x40 and dispatches opcode through 0x00440538. | This is a consumer/dispatcher. It does not itself select a map, scene root, or encounter formation. | Hwanse2.exe snippet generic-runner-dispatch |
| opcode 0x5e object +0xec payload producer | grounded-non-route-producer | False | objectEcProducerFound=True; mode1 candidates=7; map CNS refs in payload heads=0 | Creates/transitions transient display/object VM payloads, but current static payload scan does not prove field-map transition payloads. | out/object_script_payload_producer.json |
| manual movement overlap bridge | grounded-trigger-consumer | False | bridgeFound=True; routeProof=False; manual opcodes=15 | Object overlap can copy object+0xec into object+0x40, but strict inventory found no concrete map transition target. | out/manual_movement_trigger_bridge.json |
| active object delayed script route | grounded-indirect-candidate | False | tick route=0x00411476; active route grounded=True; visible motion producer=False | Can run object+0x64/+0x40 scripts from the field tick, but no animated-map tile-write root is bound yet. | out/map_animation_tick_route_review.json |
| opcode 0x2a linked-object script fanout | grounded-fanout-primitive | False | handler table 0x004405e0 -> 0x004057eb; stream+1 selects active-object list slot, stream+2 optionally filters target object+0x14, stream+4 supplies the child script; direct runner calls at 0x004058af and 0x004058d8; active +0xec hits=0, raw candidates=53, boundary-shaped=23, promoted=0 | Executes a supplied child stream on linked active objects. This narrows object script propagation, but it is not a root producer without a parent stream source. | Hwanse2.exe opcode 0x2a handler + out/generic_vm_opcode2a_parent_stream_review.json |
| field active object script inventory | negative-route-inventory | False | strict initializers=723; unique +ec scripts=722; route proof scripts=0; map CNS operand scripts=0 | Large active-object script inventory exists, but no route/map CNS operand proof is promoted. | out/field_active_object_trigger_boundary_review.json |
| field encounter tick route | negative-encounter-producer | False | known field windows=7; promotable calls=0; formation exact refs=0 | No field walking/tick route currently selects battle resources or formation streams. | out/field_encounter_tick_route_boundary_review.json |
| selected-root stream primitives | grounded-separated-global-stream | False | selector writer grounded=True; selectedRoot writer grounded=True; executor found=True; save-selector runtime dispatch proof=False | Selected-root VM primitives use global selectedRoot/current stream flow, not a proven object+0x40 route producer. | out/selected_root_live_writer_frontier_review.json + out/save_selector_dispatch_table_context.json |
| battle/display VM child streams | grounded-battle-display-domain | False | status=static-vm-walk-for-promoted-and-phase-table-player-actions; display runner=0x00402321 | Useful for battle/effect rendering, but not a field scene/route producer. | out/battle_display_vm_static_decode.json |
Verified Snippets
| snippet | matches | meaning | actual bytes |
|---|---|---|---|
generic-runner-dispatch0x00402327 | True | reset stop flag, read object+0x40 stream opcode, dispatch through 0x00440538 | c7 05 b8 a1 55 00 00 00 00 00 83 3d b8 a1 55 00 00 0f 85 1d 00 00 00 8b 45 08 50 8b 45 08 8b 40 40 33 c9 8a 08 ff 14 8d 38 05 44 00 |
object-ec-to-cursor-copy0x00431fbb | True | manual overlap bridge copies object+0xec payload pointer into object+0x40 | 33 c0 a0 33 45 57 00 85 c0 0f 85 14 00 00 00 8b 45 fc 8b 80 ec 00 00 00 8b 4d fc 89 41 40 |
opcode-5e-cursor-from-payload0x00407abc | True | opcode 0x5e mode1 loads new object+0x40 from dword [payload+8] | a1 a8 dd 59 00 89 45 08 8b 45 08 8b 80 ec 00 00 00 8b 40 08 8b 4d 08 89 41 40 |
nested-runner-wrapper0x00402369 | True | 0x00402360 saves current object+0x40, runs a supplied child stream through 0x00402321, then restores the parent cursor | 8b 45 08 8b 40 40 89 45 fc 8b 45 0c 8b 4d 08 89 41 40 8b 45 08 50 e8 9d ff ff ff 83 c4 04 8b 45 fc 8b 4d 08 89 41 40 |
opcode-0x2a-fanout-list-select0x004057eb | True | opcode 0x2a reads stream+1 as active-object list index and stream+2 as optional object+0x14 mask | 55 8b ec 83 ec 0c 53 56 57 8b 45 08 8b 40 40 33 c9 8a 48 01 83 e1 7f 89 4d f4 |
opcode-0x2a-fanout-restore-child-cursor0x00405893 | True | opcode 0x2a high-bit branch saves target object+0x40, runs stream+4 through 0x00402321, then restores target object+0x40 | 8b 45 f8 8b 40 40 89 45 fc 8b 45 08 8b 40 40 8b 40 04 8b 4d f8 89 41 40 8b 45 f8 50 e8 6d ca ff ff 83 c4 04 8b 45 fc 8b 4d f8 89 41 40 |
opcode-0x2a-fanout-persistent-child-cursor0x004058c5 | True | opcode 0x2a normal branch writes stream+4 to target object+0x40 and keeps the advanced target cursor after 0x00402321 | 8b 45 08 8b 40 40 8b 40 04 8b 4d f8 89 41 40 8b 45 f8 50 e8 44 ca ff ff 83 c4 04 |
active-object-delayed-script-route0x00433090 | True | field active object timer route runs object+0x64 through 0x00402321 and stores the advanced cursor back to object+0x64 | 8b 45 f8 8b 40 40 89 45 fc 8b 45 f8 8b 40 64 8b 4d f8 89 41 40 8b 45 f8 50 e8 73 f2 fc ff 83 c4 04 8b 45 f8 8b 40 40 8b 4d f8 89 41 64 8b 45 fc 8b 4d f8 89 41 40 |
Direct Calls to 0x00402321
| call | classification | context |
|---|---|---|
0x0040237f | nested-runner-wrapper-self-call | 89 45 fc 8b 45 0c 8b 4d 08 89 41 40 8b 45 08 50 e8 9d ff ff ff 83 c4 04 8b 45 fc 8b 4d 08 89 41 40 c7 05 b8 a1 55 00 00 |
0x004058af | opcode-0x2a-linked-object-script-fanout-restore | 8b 40 40 8b 40 04 8b 4d f8 89 41 40 8b 45 f8 50 e8 6d ca ff ff 83 c4 04 8b 45 fc 8b 4d f8 89 41 40 e9 1b 00 00 00 8b 45 |
0x004058d8 | opcode-0x2a-linked-object-script-fanout-persistent | 8b 40 40 8b 40 04 8b 4d f8 89 41 40 8b 45 f8 50 e8 44 ca ff ff 83 c4 04 e9 3d ff ff ff 8b 45 08 83 40 40 08 c7 05 b8 a1 |
0x004330a9 | active-object-delayed-script-route | 8b 45 f8 8b 40 64 8b 4d f8 89 41 40 8b 45 f8 50 e8 73 f2 fc ff 83 c4 04 8b 45 f8 8b 40 40 8b 4d f8 89 41 64 8b 45 fc 8b |
Dword Refs to 0x00402321
| ref | section | classification |
|---|---|---|
0x004022fc | .text | unclassified-pointer-ref |
0x0040255d | .text | unclassified-pointer-ref |
0x00406b11 | .text | unclassified-pointer-ref |
0x0040796f | .text | generic-object-script-handler-family |
0x00407a8f | .text | generic-object-script-handler-family |
0x0040e929 | .text | unclassified-pointer-ref |
0x0040e94c | .text | unclassified-pointer-ref |
0x0040e9b1 | .text | unclassified-pointer-ref |
0x0040ef68 | .text | unclassified-pointer-ref |
0x004117a5 | .text | unclassified-pointer-ref |
0x00411811 | .text | unclassified-pointer-ref |
0x0041183d | .text | unclassified-pointer-ref |
0x00411909 | .text | unclassified-pointer-ref |
0x0041194a | .text | unclassified-pointer-ref |
0x00411a53 | .text | unclassified-pointer-ref |
0x00411a89 | .text | unclassified-pointer-ref |
0x00411b53 | .text | unclassified-pointer-ref |
0x00411c60 | .text | unclassified-pointer-ref |
0x00411d6b | .text | unclassified-pointer-ref |
0x00411e7c | .text | unclassified-pointer-ref |
0x00411f8d | .text | unclassified-pointer-ref |
0x00412099 | .text | unclassified-pointer-ref |
0x004121aa | .text | unclassified-pointer-ref |
0x004122b8 | .text | unclassified-pointer-ref |
0x004123c9 | .text | unclassified-pointer-ref |
0x00412487 | .text | unclassified-pointer-ref |
0x0041256b | .text | unclassified-pointer-ref |
0x004125f3 | .text | unclassified-pointer-ref |
0x004126c4 | .text | unclassified-pointer-ref |
0x00412793 | .text | unclassified-pointer-ref |
0x00412888 | .text | unclassified-pointer-ref |
0x004128f9 | .text | unclassified-pointer-ref |
0x004129cf | .text | unclassified-pointer-ref |
0x00412a7c | .text | unclassified-pointer-ref |
0x00412b53 | .text | unclassified-pointer-ref |
0x00412bf4 | .text | unclassified-pointer-ref |
0x00412c9e | .text | unclassified-pointer-ref |
0x00412d9b | .text | unclassified-pointer-ref |
0x00412efd | .text | unclassified-pointer-ref |
0x004130fc | .text | unclassified-pointer-ref |
0x004131a8 | .text | unclassified-pointer-ref |
0x0041329f | .text | unclassified-pointer-ref |
0x004133c6 | .text | unclassified-pointer-ref |
0x00413546 | .text | unclassified-pointer-ref |
0x00413677 | .text | unclassified-pointer-ref |
0x00413815 | .text | unclassified-pointer-ref |
0x00413999 | .text | unclassified-pointer-ref |
0x00413ada | .text | unclassified-pointer-ref |
0x00413b7b | .text | unclassified-pointer-ref |
0x00413c3e | .text | unclassified-pointer-ref |
0x00413d40 | .text | unclassified-pointer-ref |
0x00413e67 | .text | unclassified-pointer-ref |
0x00413eed | .text | unclassified-pointer-ref |
0x00413fad | .text | unclassified-pointer-ref |
0x00414088 | .text | unclassified-pointer-ref |
0x00414148 | .text | unclassified-pointer-ref |
0x00414278 | .text | unclassified-pointer-ref |
0x004143da | .text | unclassified-pointer-ref |
0x00414499 | .text | unclassified-pointer-ref |
0x00414509 | .text | unclassified-pointer-ref |
0x00414591 | .text | unclassified-pointer-ref |
0x004146a3 | .text | unclassified-pointer-ref |
0x004147ce | .text | unclassified-pointer-ref |
0x004148da | .text | unclassified-pointer-ref |
0x004149e5 | .text | unclassified-pointer-ref |
0x00414ab4 | .text | unclassified-pointer-ref |
0x00414d13 | .text | unclassified-pointer-ref |
0x00414e1a | .text | unclassified-pointer-ref |
0x00414ed5 | .text | unclassified-pointer-ref |
0x00414f7f | .text | unclassified-pointer-ref |
0x00415088 | .text | unclassified-pointer-ref |
0x0041b72a | .text | unclassified-pointer-ref |
0x0041be1c | .text | unclassified-pointer-ref |
0x0041d559 | .text | unclassified-pointer-ref |
0x0041febb | .text | unclassified-pointer-ref |
0x004284f2 | .text | unclassified-pointer-ref |
0x004321d7 | .text | field/object-runtime-code-ref |
0x004322cc | .text | field/object-runtime-code-ref |
0x004323e7 | .text | field/object-runtime-code-ref |
0x004324ea | .text | field/object-runtime-code-ref |
0x00432729 | .text | field/object-runtime-code-ref |
0x0043281e | .text | field/object-runtime-code-ref |
0x00433131 | .text | field/object-runtime-code-ref |
Next Frontier
- Do not re-open 0x00402321 itself as an unknown; treat it as a grounded generic object/display VM dispatcher.
- Do not treat opcode 0x2a as a route producer by itself; it is a linked-object script fanout that still needs a parent stream source.
- Opcode 0x2a is absent from the strict active object +0xec script inventory; raw data-section candidates remain review-only until a gameplay parent/root source is found.
- For scene route, look above selected-root writer/executor primitives for the live root/stream producer.
- For map transition, require an active-object script/root that binds a concrete map target or map resource, not just object+0xec -> +0x40.
- For encounter, require field walking/tick state to bridge into battle resource/formation consumers.
- For map animation, require an animated-map object/root that reaches tile-write handlers from the tick route.
Source Artifacts
out/object_script_payload_producer.jsonout/manual_movement_trigger_bridge.jsonout/field_active_object_trigger_boundary_review.jsonout/generic_vm_opcode2a_parent_stream_review.jsonout/map_animation_tick_route_review.jsonout/field_encounter_tick_route_boundary_review.jsonout/selected_root_live_writer_frontier_review.jsonout/save_selector_dispatch_table_context.jsonout/battle_display_vm_static_decode.json