re: recover PlayerEvent destruction ABI

This commit is contained in:
alex 2026-09-09 23:48:10 -04:00
parent 8f3106ae10
commit 04d2ec8287
14 changed files with 10775 additions and 10 deletions

View file

@ -41,7 +41,7 @@
"path": "/home/alex/sots-re"
}
},
"checkpoint": "campaign/runtime/checkpoints/research-live-record-bridge-e25bb2cbc914031f4572ad84.json",
"checkpoint": "campaign/runtime/checkpoints/research-live-record-bridge-44636263a545a95b40066550.json",
"dependencies": [
"research-completion-abi"
],

View file

@ -114,6 +114,13 @@
"eh_analysis": "verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/player-event-copy-eh-analysis.json",
"scope": "Read-only callable copy-constructor and MSVC unwind capture; static planning evidence only, not live allocator or exception execution."
},
"player_event_destructor_capture": {
"session": "run-a4f6a9922bf5800747bfdfc6",
"manifest": "verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/manifest.json",
"destructor_stdout": "verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/player-event-dtor-exact.stdout.txt",
"context_stdout": "verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/player-event-dtor-context.stdout.txt",
"scope": "Read-only complete callable destructor and boundary capture; static planning evidence only, not live allocator or destruction execution."
},
"operations": {
"observed_tech_default_construct": {
"va": "0x008562a0",
@ -370,6 +377,31 @@
"verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/manifest.json"
]
},
"player_event_destruct": {
"va": "0x0061ae90",
"rva": "0x0021ae90",
"callable_entry": true,
"prototype": "void __thiscall player_event_destruct(PlayerEvent *value)",
"receiver": "ECX = one fully constructed live-layout 0x74-byte PlayerEvent",
"arguments": [],
"stack_cleanup": "no stack arguments; helper ends in plain ret",
"return": "no supported return-value contract; EAX is untouched on the all-SSO path and otherwise may retain an incidental scalar-delete result",
"ordered_writes": [
"destroys EvImg first: when capacity +0x64 is at least 0x10, frees the owned buffer pointer at +0x50 through scalar-delete thunk 0x00924faa; then sets capacity +0x64 to 0x0f, size +0x60 to zero and first inline byte +0x50 to zero",
"destroys EvMsg second: when capacity +0x38 is at least 0x10, frees the owned buffer pointer at +0x24 through scalar-delete thunk 0x00924faa; then sets capacity +0x38 to 0x0f, size +0x34 to zero and first inline byte +0x24 to zero",
"destroys EvDsc last: when capacity +0x1c is at least 0x10, frees the owned buffer pointer at +0x08 through scalar-delete thunk 0x00924faa; then sets size +0x18 to zero, capacity +0x1c to 0x0f and first inline byte +0x08 to zero",
"after all three strings are empty, replaces PlayerEvent vptr 0x00a21958 with base vptr 0x009e22bc at +0x00"
],
"ownership": "Consumes the three independent PlayerEvent string ownerships exactly once in reverse member-construction order EvImg, EvMsg, EvDsc. SSO strings cause no free; heap strings each use the matching original-runtime scalar-delete thunk. This complete-object destructor does not take scalar-deleting flags and does not free the enclosing PlayerEvent storage. Reuse requires complete reconstruction; a second call is forbidden.",
"exception_boundary": "The callable has no local SEH frame and performs only capacity tests, optional scalar-delete calls, empty-string state writes and the base-vptr transition. The original scalar-delete service is treated as nonthrowing by this static path, but no live destruction, allocator failure or exception behavior was executed; the bridge boundary must still prevent any exception from crossing its exported WINAPI entry.",
"boundary": "The exact callable is 0x0061ae90..0x0061aefb inclusive, followed by int3 padding at 0x0061aefc..0x0061aeff and the next prologue at 0x0061af00.",
"captures": [
"verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/player-event-dtor-exact.stdout.txt",
"verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/player-event-dtor-context.stdout.txt",
"verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/manifest.json",
"verify/results/research-completion-abi-independent/integration-lead-20260910/player-dtor-control.stdout.txt"
]
},
"string_assign_substr": {
"va": "0x00425430",
"rva": "0x00025430",
@ -428,6 +460,6 @@
],
"readiness": {
"complete": false,
"reason": "The ObservedTech default-construction, copy-construction, vector-append/growth and scalar-deleting destruction, PlayerEvent default-construction and copy-construction, and shared string-assignment rows are reconciled here. PlayerEvent append/destruction, every TurnEvents operation, and remaining exposed allocation operations still require exact generated rows and bound captures before implementation."
"reason": "The ObservedTech default-construction, copy-construction, vector-append/growth and scalar-deleting destruction, PlayerEvent default-construction, copy-construction and destruction, and shared string-assignment rows are reconciled here. PlayerEvent append, every TurnEvents operation, and remaining exposed allocation operations still require exact generated rows and bound captures before implementation."
}
}

View file

@ -1,6 +1,6 @@
# Live-record bridge readiness architecture
Status: **planning draft; contract remains proposed**. This is acceptance-before-implementation
Status: **planning draft; contract remains needs-revision**. This is acceptance-before-implementation
for `research-live-record-bridge`, not live-safety evidence. No game, VM, allocator, constructor,
or bridge code was executed while producing it.
@ -62,6 +62,17 @@ destruction, then completed EvMsg destruction. Construction state advances befor
allocating string assignment, so the currently failing string is not treated as complete. This is
static partial-copy ownership only; no allocation failure, throw or live destructor was executed.
The dedicated package now also records the complete PlayerEvent destructor `0x0061ae90`
(`ECX=this`, no stack words, plain `ret`, no supported return value) in
`verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/`. It destroys the three
independent strings in reverse construction order: EvImg, EvMsg, then EvDsc. Each capacity-at-least-
`0x10` branch frees that string's owned buffer through scalar-delete thunk `0x00924faa`, and every
path resets the string to empty SSO before proceeding. Only after all three strings are empty does
the helper replace PlayerEvent vptr `0x00a21958` with base vptr `0x009e22bc`. It takes no deleting
flags and never frees enclosing PlayerEvent storage. The exact capture byte-matches both accepted
dependency and integrated independent captures. This remains static ownership evidence; no live
destruction, allocator or exception behavior was executed.
The dedicated package now also records ObservedTech vector append `0x007b7320`
(`ECX=vector`, stack source, `ret 4`, no supported return). It distinguishes source inside the live
range from source outside it, reserves one slot through `0x007b5820` only when full, deep-copies at
@ -174,8 +185,8 @@ one mutation after all evidence is bound to one integrated source manifest.
## 6. Readiness blockers and exact next probe
The contract remains proposed. Missing items are the generated address header and exact prototypes
for PlayerEvent append/destruction, remaining allocation, and TurnEvents calls;
The contract remains needs-revision. Missing items are the generated address header and exact
prototypes for PlayerEvent append, remaining allocation, and TurnEvents calls;
verified VS2010 toolchain identity; controller and failure-containment implementation; literal VM144
identity/preflight; expected records; checker; and immutable manifests.
@ -192,9 +203,11 @@ exceptional ownership qualification. PlayerEvent default construction at `0x0084
complete, including exact writes across the 0x74-byte layout, three string initialization states,
ABI/return and static exceptional partial-construction cleanup. PlayerEvent copy construction at
`0x007693f0` is now complete, including the full ordered write set,
three independent deep-copy states, ABI/return and static partial-copy unwind. The next discriminating
static check is PlayerEvent destruction at `0x0061ae90`: bind the complete callable window and encode
the exact reverse string-destruction order, vptr transition, ABI/return behavior and any exceptional
qualification before relying on it for fixture cleanup.
three independent deep-copy states, ABI/return and static partial-copy unwind. PlayerEvent destruction
at `0x0061ae90` is now complete, including reverse EvImg/EvMsg/EvDsc cleanup, conditional matching-
family frees, empty-SSO resets, final base-vptr transition, ABI/no-return contract and static-only
exception qualification. The next discriminating static check is PlayerEvent vector append at
`0x0086c580`: bind its complete callable and growth windows and encode source-location branches,
capacity growth, copy/destruction order, header publication, ABI/return and partial-copy unwind.
Do not begin bridge implementation until every exposed ABI row is encoded in the dedicated
generated-address package.

View file

@ -0,0 +1,27 @@
{
"actor": "live-record bridge architect",
"artifacts": [
{
"path": "campaign/research/research-live-record-bridge.md",
"sha256": "59414fc28eae12ed284ea78ec83e4b198c5b39aa1c1474a0c7b60b6fb84c98fb"
},
{
"path": "campaign/research/research-live-record-addresses.json",
"sha256": "b9f810c50bde678c6736e1c48cf375dbbaad4cddb0c8ba02397f1bd272bc30ad"
},
{
"path": "verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/manifest.json",
"sha256": "7aa204a738d9f1311fb7a1fe24b2b738aefbd85445cda40d0665ec2ac22a3fd2"
}
],
"basis": "6fbcc78291fc02d5e549106bbd3affe29c5f458d742017c91e8d5c9272165cd8",
"contract": "research-live-record-bridge",
"id": "13bb7dd724ab75fa2063ccef",
"model": "openai/gpt-5.6-sol",
"next_action": "Run the read-only pinned-binary objdump capture for the complete PlayerEvent destructor callable at 0x0061ae90 into verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/.",
"role": "architecture-review",
"schema": "sots-checkpoint/1",
"session": "run-a4f6a9922bf5800747bfdfc6",
"summary": "Pre-experiment recovery checkpoint. OBSERVATIONS: canonical contract is needs-revision; campaign validation passes; dependency research-completion-abi is accepted; all nine recorded campaign surprises are resolved and this contract has no open surprise. Requested model openai/gpt-5.6-sol is present in opencode models and matches campaign/models.json. Paired worktrees match baseline HEAD/common directories: engine /tmp/opencode/sots-final-research-engine at 7741d42fc5e4e761e6449bdaf0e4a61d00036a23, /home/alex/sots-engine/.git, source digest ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; RE /tmp/opencode/sots-final-research-re at 3bfde5a70d874a723e797a695bbd847fd82c0aa7, /home/alex/sots-re/.git, digest 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Both contain expected pre-existing dirty/untracked content; no source edits have been made this quantum. Input dumps/sots.exe hashes to 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841; /usr/bin/objdump is GNU 2.38 and hashes to 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd. vm144 lease is released; no resource is acquired or mutated. DECISION: perform only the checkpoint-directed read-only pinned-binary PlayerEvent destructor capture and architecture encoding. No implementation, VM, Ghidra or build-host action is authorized. BLOCKERS: contract remains needs-revision and implementation stays blocked pending all required ABI rows and readiness artifacts.",
"timestamp": "2026-09-10T03:41:00.630208+00:00"
}

View file

@ -0,0 +1,31 @@
{
"actor": "live-record bridge architect",
"artifacts": [
{
"path": "campaign/research/research-live-record-bridge.md",
"sha256": "6d06db189b6b7466a1a6d92fc97021c21cc94322757d7a1464aa78f19d4b6e1f"
},
{
"path": "campaign/research/research-live-record-addresses.json",
"sha256": "53720a926eea95a98caa7f999c8c0e84c75f2d3c9ec988ad2ec4514347e1cd14"
},
{
"path": "verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/manifest.json",
"sha256": "6d08488148a2036590335e1e0d95edc9cdacfe8aafbde2b0de0840433b4d3d3c"
},
{
"path": "verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/player-event-dtor-exact.stdout.txt",
"sha256": "db8d7b77b942234aec85ed9773b7fd8f363655c7e5aed5fc2cbecd0f5d1a133e"
}
],
"basis": "6fbcc78291fc02d5e549106bbd3affe29c5f458d742017c91e8d5c9272165cd8",
"contract": "research-live-record-bridge",
"id": "44636263a545a95b40066550",
"model": "openai/gpt-5.6-sol",
"next_action": "In a fresh bounded Sol architecture quantum, checkpoint before a read-only experiment, capture PlayerEvent vector append at 0x0086c580 and its growth helper at 0x00869500 into a new immutable run directory, then encode exact source-location branches, capacity growth, copy/destruction order, header publication, ABI/return behavior and partial-copy unwind in campaign/research/research-live-record-addresses.json.",
"role": "architecture-review",
"schema": "sots-checkpoint/1",
"session": "run-a4f6a9922bf5800747bfdfc6",
"summary": "Quantum-end architecture checkpoint. Requested/active model openai/gpt-5.6-sol; actor live-record bridge architect; role architecture-review; session run-a4f6a9922bf5800747bfdfc6. OBSERVATIONS: canonical contract remains needs-revision; dependency research-completion-abi is accepted; campaign validation passes; no open surprise exists. Paired identities remained engine /tmp/opencode/sots-final-research-engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 common-dir /home/alex/sots-engine/.git digest ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd and RE /tmp/opencode/sots-final-research-re HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7 common-dir /home/alex/sots-re/.git digest 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8; expected pre-existing dirty source content remains. Pinned dumps/sots.exe SHA256 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841 and GNU objdump 2.38 SHA256 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd were used read-only. New immutable package verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/ captures the complete PlayerEvent destructor 0x0061ae90..0x0061aefb plus boundary context. Exact stdout is 1985 bytes/SHA256 db8d7b77b942234aec85ed9773b7fd8f363655c7e5aed5fc2cbecd0f5d1a133e and byte-matches both accepted dependency and integrated independent captures. Static instructions establish ECX receiver/no stack args/plain ret/no supported EAX result; reverse EvImg, EvMsg, EvDsc cleanup; independent capacity>=0x10 scalar-delete calls through 0x00924faa; empty-SSO resets; final base-vptr 0x009e22bc; and no enclosing-storage free. No live destructor, allocator, exception, game process, VM, Ghidra or build-host operation ran. DECISIONS: encode this row as planning understanding only, not live-safety evidence; implementation remains blocked. The architecture and dedicated address JSON now select PlayerEvent vector append 0x0086c580 as the next discriminating static boundary. TESTS: both JSON files parse; manifest verified four captured file byte counts/hashes; exact capture independently byte-compared; operation semantic assertions passed; git diff --check passed; campaign validate passed; source binding was unchanged. RESOURCES: vm144 lease was observed released; no lease acquired, no resource mutation, no side effects or cleanup required. BLOCKERS: generated address header, PlayerEvent append, TurnEvents operations, remaining allocator rows, VS2010 identity, fixture/controller/failure containment, VM144 preflight, expected records/checker and immutable runtime manifests remain unresolved. No commits, staging, pushes or delegation occurred.",
"timestamp": "2026-09-10T03:46:49.278379+00:00"
}

View file

@ -1,5 +1,5 @@
{
"contract": "research-live-record-bridge",
"run": "run-36c401e90eb0ec1db4d35865",
"run": "run-a4f6a9922bf5800747bfdfc6",
"status": "complete"
}

File diff suppressed because it is too large Load diff

File diff suppressed because one or more lines are too long

View file

@ -0,0 +1,86 @@
{
"schema": "sots-live-record-static-capture/1",
"session": "run-a4f6a9922bf5800747bfdfc6",
"scope": "Read-only PlayerEvent complete-destructor callable, boundary, ordered-write and ownership reconciliation; static planning evidence only, with no original-runtime, allocator, VM, Ghidra or build-host execution.",
"cwd": "/home/alex/sots-re",
"environment": {
"mode": "empty base environment",
"PATH": "/usr/bin:/bin",
"LC_ALL": "C"
},
"source_binding": {
"engine": {
"path": "/tmp/opencode/sots-final-research-engine",
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd",
"git_common_dir": "/home/alex/sots-engine/.git"
},
"re": {
"path": "/tmp/opencode/sots-final-research-re",
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
"sha256": "6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8",
"git_common_dir": "/home/alex/sots-re/.git"
}
},
"input": {
"path": "dumps/sots.exe",
"bytes": 7898624,
"sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841"
},
"tools": [
{
"path": "/usr/bin/objdump",
"version": "GNU Binutils 2.38",
"sha256": "1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd"
}
],
"commands": [
{
"name": "player-event-destructor-context",
"argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x0061ae80", "--stop-address=0x0061af20", "dumps/sots.exe"],
"returncode": 0,
"stdout": "player-event-dtor-context.stdout.txt",
"stderr": "player-event-dtor-context.stderr.txt"
},
{
"name": "player-event-destructor-exact",
"argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x0061ae90", "--stop-address=0x0061aefc", "dumps/sots.exe"],
"returncode": 0,
"stdout": "player-event-dtor-exact.stdout.txt",
"stderr": "player-event-dtor-exact.stderr.txt"
}
],
"checks": {
"all_commands_returned_zero": true,
"all_command_stderr_empty": true,
"exact_callable_ends_plain_ret_at_0x0061aefb": true,
"context_shows_following_int3_padding_and_next_prologue": true,
"exact_callable_capture_matches_accepted_dependency_bytes": true,
"three_string_destructions_are_reverse_order": true,
"each_heap_buffer_uses_scalar_delete_thunk_0x00924faa": true,
"all_three_strings_are_reset_empty_sso": true,
"base_vptr_transition_is_last": true,
"enclosing_object_storage_is_not_freed": true
},
"observations": [
"ECX is one fully constructed 0x74-byte PlayerEvent; there are no stack arguments and the helper returns with plain ret. EAX is not assigned on the all-SSO path, so no return value is supported.",
"The exact callable destroys EvImg at +0x50, then EvMsg at +0x24, then EvDsc at +0x08. Each capacity >=0x10 branch frees that string buffer through 0x00924faa; every branch then resets the string to empty SSO.",
"After string cleanup, the helper writes base vptr 0x009e22bc over PlayerEvent vptr 0x00a21958. It has no scalar-deleting flags and does not free enclosing object storage.",
"The exact 1985-byte stdout is byte-identical to both the accepted dependency repair capture and the integrated independent control capture."
],
"accepted_dependency_captures": [
"verify/results/research-completion-abi/run-79357a65226f61d6a86c042d/player-dtor-audit.stdout.txt",
"verify/results/research-completion-abi-independent/integration-lead-20260910/player-dtor-control.stdout.txt",
"verify/results/research-completion-abi-independent/integration-lead-20260910/manifest.json"
],
"limitations": [
"Static planning evidence only; no live destructor, allocator, exception, game process or bridge operation was executed.",
"This package reconciles only PlayerEvent complete destruction and does not make the contract ready."
],
"files": [
{"path": "verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/player-event-dtor-context.stdout.txt", "bytes": 3454, "sha256": "df0a22e9c8b2aab2c8d5b7a0a63e180aabd9f305bea784d2e14553b61e82fc73"},
{"path": "verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/player-event-dtor-context.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/player-event-dtor-exact.stdout.txt", "bytes": 1985, "sha256": "db8d7b77b942234aec85ed9773b7fd8f363655c7e5aed5fc2cbecd0f5d1a133e"},
{"path": "verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/player-event-dtor-exact.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"}
]
}

View file

@ -0,0 +1,74 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0061ae80 <.text+0x219e80>:
61ae80: 00 cc add ah,cl
61ae82: cc int3
61ae83: cc int3
61ae84: cc int3
61ae85: cc int3
61ae86: cc int3
61ae87: cc int3
61ae88: cc int3
61ae89: cc int3
61ae8a: cc int3
61ae8b: cc int3
61ae8c: cc int3
61ae8d: cc int3
61ae8e: cc int3
61ae8f: cc int3
61ae90: 53 push ebx
61ae91: 56 push esi
61ae92: 8b f1 mov esi,ecx
61ae94: 83 7e 64 10 cmp DWORD PTR [esi+0x64],0x10
61ae98: 72 0c jb 0x61aea6
61ae9a: 8b 46 50 mov eax,DWORD PTR [esi+0x50]
61ae9d: 50 push eax
61ae9e: e8 07 a1 30 00 call 0x924faa
61aea3: 83 c4 04 add esp,0x4
61aea6: 33 db xor ebx,ebx
61aea8: c7 46 64 0f 00 00 00 mov DWORD PTR [esi+0x64],0xf
61aeaf: 89 5e 60 mov DWORD PTR [esi+0x60],ebx
61aeb2: 88 5e 50 mov BYTE PTR [esi+0x50],bl
61aeb5: 83 7e 38 10 cmp DWORD PTR [esi+0x38],0x10
61aeb9: 72 0c jb 0x61aec7
61aebb: 8b 4e 24 mov ecx,DWORD PTR [esi+0x24]
61aebe: 51 push ecx
61aebf: e8 e6 a0 30 00 call 0x924faa
61aec4: 83 c4 04 add esp,0x4
61aec7: c7 46 38 0f 00 00 00 mov DWORD PTR [esi+0x38],0xf
61aece: 89 5e 34 mov DWORD PTR [esi+0x34],ebx
61aed1: 88 5e 24 mov BYTE PTR [esi+0x24],bl
61aed4: 83 7e 1c 10 cmp DWORD PTR [esi+0x1c],0x10
61aed8: 72 0c jb 0x61aee6
61aeda: 8b 56 08 mov edx,DWORD PTR [esi+0x8]
61aedd: 52 push edx
61aede: e8 c7 a0 30 00 call 0x924faa
61aee3: 83 c4 04 add esp,0x4
61aee6: 89 5e 18 mov DWORD PTR [esi+0x18],ebx
61aee9: c7 46 1c 0f 00 00 00 mov DWORD PTR [esi+0x1c],0xf
61aef0: 88 5e 08 mov BYTE PTR [esi+0x8],bl
61aef3: c7 06 bc 22 9e 00 mov DWORD PTR [esi],0x9e22bc
61aef9: 5e pop esi
61aefa: 5b pop ebx
61aefb: c3 ret
61aefc: cc int3
61aefd: cc int3
61aefe: cc int3
61aeff: cc int3
61af00: 55 push ebp
61af01: 8b ec mov ebp,esp
61af03: 83 ec 10 sub esp,0x10
61af06: 33 c0 xor eax,eax
61af08: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
61af0b: 89 45 f4 mov DWORD PTR [ebp-0xc],eax
61af0e: 89 45 f8 mov DWORD PTR [ebp-0x8],eax
61af11: 89 45 fc mov DWORD PTR [ebp-0x4],eax
61af14: a1 40 d5 b2 00 mov eax,ds:0xb2d540
61af19: 56 push esi
61af1a: 8b f1 mov esi,ecx
61af1c: 8b 48 74 mov ecx,DWORD PTR [eax+0x74]
61af1f: 8b mov edx,DWORD PTR [ecx]

View file

@ -0,0 +1,42 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0061ae90 <.text+0x219e90>:
61ae90: 53 push ebx
61ae91: 56 push esi
61ae92: 8b f1 mov esi,ecx
61ae94: 83 7e 64 10 cmp DWORD PTR [esi+0x64],0x10
61ae98: 72 0c jb 0x61aea6
61ae9a: 8b 46 50 mov eax,DWORD PTR [esi+0x50]
61ae9d: 50 push eax
61ae9e: e8 07 a1 30 00 call 0x924faa
61aea3: 83 c4 04 add esp,0x4
61aea6: 33 db xor ebx,ebx
61aea8: c7 46 64 0f 00 00 00 mov DWORD PTR [esi+0x64],0xf
61aeaf: 89 5e 60 mov DWORD PTR [esi+0x60],ebx
61aeb2: 88 5e 50 mov BYTE PTR [esi+0x50],bl
61aeb5: 83 7e 38 10 cmp DWORD PTR [esi+0x38],0x10
61aeb9: 72 0c jb 0x61aec7
61aebb: 8b 4e 24 mov ecx,DWORD PTR [esi+0x24]
61aebe: 51 push ecx
61aebf: e8 e6 a0 30 00 call 0x924faa
61aec4: 83 c4 04 add esp,0x4
61aec7: c7 46 38 0f 00 00 00 mov DWORD PTR [esi+0x38],0xf
61aece: 89 5e 34 mov DWORD PTR [esi+0x34],ebx
61aed1: 88 5e 24 mov BYTE PTR [esi+0x24],bl
61aed4: 83 7e 1c 10 cmp DWORD PTR [esi+0x1c],0x10
61aed8: 72 0c jb 0x61aee6
61aeda: 8b 56 08 mov edx,DWORD PTR [esi+0x8]
61aedd: 52 push edx
61aede: e8 c7 a0 30 00 call 0x924faa
61aee3: 83 c4 04 add esp,0x4
61aee6: 89 5e 18 mov DWORD PTR [esi+0x18],ebx
61aee9: c7 46 1c 0f 00 00 00 mov DWORD PTR [esi+0x1c],0xf
61aef0: 88 5e 08 mov BYTE PTR [esi+0x8],bl
61aef3: c7 06 bc 22 9e 00 mov DWORD PTR [esi],0x9e22bc
61aef9: 5e pop esi
61aefa: 5b pop ebx
61aefb: c3 ret