alex/sots-re
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

p2-m0 evidence: shim log + menu screenshot; Initialize signature caution

Browse source
This commit is contained in:
alex 2026-09-07 17:22:21 -04:00
parent d76f0fd491
commit 5614940650
3 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
campaign/open-questions.md
View file

@ -29,3 +29,4 @@ Each links to the finding that raised it. Promoted to backlog or closed by **re-
- **(parked) Combat loader job API** — does tactical-battle loading go through the job helpers `0x8fc160`/`0x8fa5b0` with the `TryEnterCriticalSection→Sleep(1000)` completion poll (`0x0071ea60`)? If yes, that is a plausible many-core stall (lost try-lock = +1 s per poll). End Turn also has a deliberate `Sleep(computed)` ≈0.85 s at `0x00838da9`. (from [[battle-load-profile]])
- **Ship-design code rules (Ghidra, from SHIP_DESIGN_RULES.md §8)** — hidden default rider designs are built WITHOUT tech gating (where?); is section class-equality enforced or merely unoffered; confirm the turret class-accept table (`standard ← {standard,missile,grapple}`, `strafe ← {standard}`; grapple weakest); hull-class tech injection (`IND_CruisCon`/`IND_DreadCon`) + station exemption; option defaults/auto-upgrade and what `option_cost` multiplies; weapon cost per bank vs per mount; mass/speed formulas; `faiDes`/`dWep` meaning. (from [[SHIP_DESIGN_RULES]])
- **Corrections from turn internals** — `ServerPlayer+0xf9` is the AI flag (not bTurnDone); `FUN_007d7f70` is encounter detection; ProcessTurn phase 2 is trade, not diplomacy; the spine's `FUN_00840fe0` 'income' is special projects — income is `FUN_00863030` ComputeBudget. `TECHBEN_*` data blocks are inert (effects hard-coded via the 116-entry tech-name table @0x00a19718). Open: TRA/TRP producers, `FPsp2` derivation, `PERGATETRAFFIC_*` readers, exact BnkEl/BnkPr expression. (from [[strategic-turn-internals]])
- **`Mars::Application::Initialize` signature (P2-M0 finding)** — a C++ `__thiscall` detour that called the original crashed inside Initialize; the trace hook now uses a convention-agnostic asm stub. Verify the real signature (stack args? EDX use? return value?) before any `compare`/`replace` hook on it. Same caution for every `[unverified]` entry in `ghidra/addresses.json`. (from [[m0]])

BIN
verify/results/shim/m0-main-menu.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 408 KiB

16
verify/results/shim/m0.log Normal file
View file

@ -0,0 +1,16 @@
17:17:38.944 [tid 4396] ==== sots-engine shim (binkw32 proxy) build 4a15301-20260907T2115Z ====
17:17:38.944 [tid 4396] exe: C:\SOTS\Sword of the Stars.exe
17:17:38.944 [tid 4396] exe base=0x00e80000 (link-time image base 0x00400000, ASLR delta +11010048) pid=6396 shim=730c0000
17:17:38.944 [tid 4396] addresses: Source: sots-re ghidra/addresses.json @ daea98f, generated 2026-09-07 by tools/gen_addresses.py
17:17:38.944 [tid 4396] config: hooks=off
17:17:38.944 [tid 4396] hook: disabled by config
17:18:55.309 [tid 7380] ==== sots-engine shim (binkw32 proxy) build 4a15301-20260907T2118Z ====
17:18:55.309 [tid 7380] exe: C:\SOTS\Sword of the Stars.exe
17:18:55.309 [tid 7380] exe base=0x00e80000 (link-time image base 0x00400000, ASLR delta +11010048) pid=3808 shim=730c0000
17:18:55.309 [tid 7380] addresses: Source: sots-re ghidra/addresses.json @ daea98f, generated 2026-09-07 by tools/gen_addresses.py
17:18:55.309 [tid 7380] config: hooks=trace
17:18:55.309 [tid 7380] hook: Mars_Application_Initialize rva=0x004a0e50 -> va=01320e50
17:18:55.309 [tid 7380] hook: MH_Initialize -> MH_OK
17:18:55.309 [tid 7380] hook: MH_CreateHook -> MH_OK (trampoline=00e50fe0)
17:18:55.324 [tid 7380] hook: MH_EnableHook -> MH_OK
17:18:55.340 [tid 7380] Application::Initialize called (this=035c8128)