lane V2: vtable inversion — resolve indirect call edges image-wide
Every call-graph result in this repo was computed over direct (E8) edges.
5,045 of the 5,207 functions named by a vftable slot have zero direct call
sites, so all of those results were lower bounds. Lane Z's dominant RNG
consumer hung off exactly such an edge.
tools/vtable_map.py builds, from the RTTI walk plus a full sweep to the next
function start (rule 17):
* vftable -> class -> sub-object offset -> slot -> target, and its inverse
* the class hierarchy from the RTTI base lists, so an abstract interface
with one concrete override resolves uniquely
* constructor-derived member typing (ctor result -> [this+d])
* the slot index at every indirect call site, with a backward register
resolver that refuses to cross a branch target rather than guess
* `this`-carrier spans and this/member call-graph propagation of class
Validation (12/12): rediscovers ServerTradeManagerImpl slot 10 ->
GenerateTradeRaidEncounters from the dispatch at 0x007d8469 with nothing
hand-fed, and re-derives the *Impl rule for both managers. Receiver-class
pinning reaches only 2.5% of the 6,398 virtual sites, at 0.6% out-of-range
against a 70% chance baseline; the displacement-only route measured worse
than random (81% vs 58%) and is rejected outright.
Closes lane K's tier-4 blind spot: all nine phase-23 calls and both phase-33
calls named. Four of the eleven reach a draw on the strategic generator
(StrategyServer+0x16c) at eight instruction-verified sites, none ever
observed firing — so "the tail draws nothing" is a property of eight turns,
not of the code. Also resolves the nine parked inlined-draw functions to
their vtable roots (correcting how that was recorded: none is itself in a
vftable; their topmost ancestors are), and finds 14,958 inter-function tail
jump edges without which three of them look like dead code.
This commit is contained in:
alex
parent
7645399f97
commit
648028db67
5 changed files with 1961 additions and 0 deletions
380
findings/control-flow/indirect-edges.md
Normal file
380
findings/control-flow/indirect-edges.md
Normal file
|
|
@ -0,0 +1,380 @@
|
|||
# Indirect call edges — the vtable inversion, and what it closes
|
||||
|
||||
Lane V2, 2026-09-08. Program `sots` / "Sword of the Stars.exe", ImageBase 0x00400000, all addresses VAs.
|
||||
|
||||
**Why this lane exists.** Lane Z's live hooking found that the single largest RNG consumer of a strategic
|
||||
turn, `ServerTradeManager::GenerateTradeRaidEncounters` 0x00893290, has **zero direct call sites** in the
|
||||
41,411-function image. Its only reference is the `Game::ServerTradeManagerImpl` vftable entry at 0x00a31b9c,
|
||||
dispatched by `call edx` at 0x007d8469 — **one instruction before** a direct call lane I's closure did
|
||||
follow. Lane I said plainly that its closure was direct-edge only. That caveat turned out to be
|
||||
load-bearing, and it is systemic, not a one-off.
|
||||
|
||||
**How systemic.** Measured here:
|
||||
|
||||
| | count |
|
||||
|---|---|
|
||||
| functions named by at least one vftable slot | **5,207** |
|
||||
| of those, functions with **zero** direct (`E8 rel32`) call sites | **5,045** |
|
||||
| indirect call sites image-wide | 17,577 |
|
||||
| of those, proven virtual dispatches (a vptr load then a slot load) | **6,398** |
|
||||
|
||||
Every reachability claim, closure size and "no caller" result this campaign has published was computed over
|
||||
direct edges. **All of them are lower bounds.** This document is the tool that lifts that, the honest
|
||||
measurement of how far it lifts it, and the three questions it answers.
|
||||
|
||||
Tool: `tools/vtable_map.py` (build → `dumps/vtables.json`). Ghidra writeback:
|
||||
`scripts/lane_v2_writeback.py`. Addresses: `ghidra/addresses.d/lane-v2.json`. Curated receiver assertions:
|
||||
`ghidra/vtable-owners.json`.
|
||||
|
||||
---
|
||||
|
||||
## 1. Validation first — the known case, rediscovered blind
|
||||
|
||||
`uv run python3 tools/vtable_map.py validate`, 12 checks, 12 pass. Nothing below was given to the tool; the
|
||||
only inputs are the PE, Ghidra's 41,089 function starts, and the RTTI walk `tools/rtti_map.py` already
|
||||
produced.
|
||||
|
||||
```
|
||||
V1 the known case -- lane Z's virtual edge, rediscovered blind
|
||||
PASS site 0x007d8469 classified virtual virtual
|
||||
PASS slot recovered = 10 10
|
||||
PASS receiver = member +0x158 {'k':'field','base':'esi','disp':344,'this':True}
|
||||
PASS receiver class = Game::ServerTradeManagerImpl
|
||||
PASS target = 0x00893290 GenerateTradeRaidEncounters
|
||||
PASS 0x00893290 named by exactly one vtable slot [0x00a31b74, ServerTradeManagerImpl, +0, slot 10]
|
||||
PASS 0x00893290 has zero direct call sites 0
|
||||
|
||||
V2 the *Impl rule -- abstract interface, one concrete override
|
||||
PASS Game::ServerTradeManager is abstract 21/22 purecall
|
||||
PASS exactly one derived class ['Game::ServerTradeManagerImpl']
|
||||
PASS Impl overrides every slot 22 slots
|
||||
PASS Game::ServerSpyManager is itself concrete (no *Impl) 18 slots, derived=None
|
||||
PASS ServerSpyManager derives IServerSpyManager/ISpyManager/IStreamable
|
||||
```
|
||||
|
||||
The chain the tool walks, with nothing hand-fed:
|
||||
|
||||
```
|
||||
0x007d845d mov ecx,[esi+0x158] <- receiver: member +0x158 of a proven `this` carrier
|
||||
0x007d8463 mov eax,[ecx] <- vptr load: this is what makes it a virtual dispatch and not
|
||||
a function pointer
|
||||
0x007d8465 mov edx,[eax+0x28] <- slot 0x28/4 = 10
|
||||
0x007d8469 call edx
|
||||
```
|
||||
|
||||
and then the *member* typing, which is the part that turns a slot number into a function:
|
||||
|
||||
```
|
||||
StrategyServer ctor 0x007d78d0 (identified by its vptr stores of 0x00a26084 at +0 and 0x00a26034 at +4)
|
||||
0x007d7d81 call 0x00858f70 ; mov [esi+0x158],eax 0x00858f70 installs vftable 0x00a31b74
|
||||
-> +0x158 : Game::ServerTradeManagerImpl*
|
||||
0x007d7d8e call 0x00832a30 ; mov [esi+0x15c],eax 0x00832a30 installs vftable 0x00a3073c
|
||||
-> +0x15c : Game::ServerSpyManager*
|
||||
```
|
||||
|
||||
**Second, independent witness, under a non-trivial transform.** `0x007dcf90` is, per the RTTI inverse map,
|
||||
`Game::StrategyServer` vftable 0x00a26034 slot 14 at sub-object **+4**. It calls the same two constructors
|
||||
and stores their results at `[esi+0x154]` and `[esi+0x158]` — exactly four bytes lower, which is what a
|
||||
`this` of `obj+4` requires. Two constructions, two frames, one answer. This also re-derives lane T's
|
||||
`StrategyServer_off_TradeManager = 0x154` (S+4 frame) from a completely different direction.
|
||||
|
||||
**The `*Impl` rule, re-derived.** `Game::ServerTradeManager` (vftable 0x00a311a4, 22 slots) has 21 slots
|
||||
pointing at `purecall` 0x00924fb0 — an abstract interface. The RTTI base lists give it exactly one derived
|
||||
class, `Game::ServerTradeManagerImpl`, whose vftable 0x00a31b74 overrides all 22. So slot *N* of that
|
||||
interface resolves **uniquely**. `Game::ServerSpyManager` is the opposite shape and is worth stating because
|
||||
the naming misleads: there is no `ServerSpyManagerImpl`. `ServerSpyManager` is itself concrete (18 slots,
|
||||
none purecall) over `IServerSpyManager` / `ISpyManager` / `Mars::IStreamable`; the `?$StreamableHelper@V`**`IServerSpyManager`**`@Game@@` template is the tell that the interface exists but the implementation is
|
||||
not separately named.
|
||||
|
||||
---
|
||||
|
||||
## 2. False-positive rate, stated the way lane X stated its scanner's
|
||||
|
||||
Two things are being measured and they have very different precision. **Say which one a claim rests on.**
|
||||
|
||||
### 2a. The map (exact, no inference)
|
||||
|
||||
vftable → class → sub-object offset → slot → target, and its inverse, come from walking
|
||||
`TypeDescriptor ← COL ← vftable[-1]`. 2,172 vftables, 1,924 type descriptors. **No false positives are
|
||||
possible here** — a vftable is only recognised when a Complete Object Locator sits at `[vftable-4]` and its
|
||||
`pTypeDescriptor` lands on a real mangled name. This half is complete and I make no hedged claims about it.
|
||||
|
||||
### 2b. Slot recovery at call sites (exact, but with declared refusals)
|
||||
|
||||
Of 17,577 indirect call sites:
|
||||
|
||||
| kind | n | what it is |
|
||||
|---|---|---|
|
||||
| `call-abs` | 7,415 | `call [disp32]` — import thunks and global function pointers, **not** vtable dispatch |
|
||||
| **`virtual`** | **6,398** | vptr load proven, **slot index exact** |
|
||||
| `vptr-unresolved` | 1,653 | the register holding the vptr has no provable definition (a branch target intervenes) |
|
||||
| `call-reg-unresolved` | 1,295 | same, for `call reg` |
|
||||
| `not-vptr` | 545 | the "vptr" register was not loaded from `[obj+0]` — a function-pointer member, not a vtable |
|
||||
| `call-reg-nonmem`, `non-slot-disp`, `vptr-unmodelled`, `vptr-global` | 271 | declared refusals |
|
||||
|
||||
The backward resolver **refuses to cross an intra-function branch target** and stops at any opcode not in
|
||||
its write-set model. That is why 2,948 sites report "unresolved" rather than a guess: a definition separated
|
||||
from its use by a label is not a definition proven to reach it (rule 4's discipline applied to registers
|
||||
instead of to `if`s).
|
||||
|
||||
### 2c. Receiver typing (hard; only 2.5% of virtual sites, at ~99% precision)
|
||||
|
||||
This is the genuinely difficult half — it is the devirtualization problem, and **it is not solved here.**
|
||||
Of the 6,398 virtual sites:
|
||||
|
||||
| route | sites | slot out of the pinned class's vtable range | same test against a random vtable |
|
||||
|---|---|---|---|
|
||||
| `self` — receiver is a proven `this` carrier, enclosing class known | 144 | **0.7 %** (1) | 70.3 % |
|
||||
| `field` — member of a proven `this` carrier, both classes known | 19 | **0.0 %** | 43.3 % |
|
||||
| `field-nonthis` — member of a register not proven to be `this` | 850 | *not pinned* | |
|
||||
| `stack` — receiver is `[ebp±d]`, an argument or local | 1,027 | *not pinned* | |
|
||||
| `disp-only` — displacement matched image-wide, no owner class | 403 | **81.1 %** | 58.1 % |
|
||||
| `unpinned` | 3,955 | | |
|
||||
|
||||
**163 of 6,398 sites (2.5%) get a receiver class.** On those the out-of-range falsification test fires on 1
|
||||
site in 163 (**0.6%**) against a 70% chance baseline, so the routes that do resolve are trustworthy. The
|
||||
`disp-only` route was **measured worse than picking a vtable at random** (81% vs 58% out-of-range) and is
|
||||
therefore **rejected outright**, not merely flagged — this is rule 9 with the ranker turned off entirely
|
||||
rather than used as a filter. Its 403 sites are counted and discarded.
|
||||
|
||||
Three bugs the falsification test caught, each of which had produced confident wrong answers before it ran:
|
||||
|
||||
* treating `[ebp+8]` as a member of `this` (it is argument 1) — accounted for **every** out-of-range result
|
||||
in the first `field` run;
|
||||
* giving a constructor the sub-object offset of whichever vftable it installs, when a ctor always receives
|
||||
the **complete** object — this registered every member at both `+d` and `+d+4` and made the class's own
|
||||
member typings ambiguous one slot away;
|
||||
* ending a `this`-carrier's span at the function's end rather than at the `pop esi` in the epilogue, which
|
||||
silently deleted every carrier in every function with a standard epilogue.
|
||||
|
||||
**Honest summary: the call-site side stays partial.** The complete vftable→slot→target map is delivered and
|
||||
exact; the slot index at 6,398 sites is delivered and exact; the receiver's *class* is delivered for 163 of
|
||||
them. `ghidra/vtable-owners.json` exists so that one hand-verified assertion propagates through the
|
||||
`this`-passing call graph and lights up a whole subtree — two entries were enough for everything in §3.
|
||||
|
||||
---
|
||||
|
||||
## 3. `ServerTradeManager` phase 23 — lane K's tier-4 blind spot, closed
|
||||
|
||||
Lane K: *"Phase 23 is nine virtual calls in a row and not one of them is identified … the largest blind spot
|
||||
in the map."* The tool reproduces lane K's byte-level transcription exactly and independently — same sites,
|
||||
same order, same slot numbers, same two receivers — and then names the targets.
|
||||
|
||||
`uv run python3 tools/vtable_map.py resolve 0x007d92a0`:
|
||||
|
||||
| # | site | recv | slot | class | target |
|
||||
|---|---|---|---|---|---|
|
||||
| 1 | 0x007d97a7 | S+0x158 | 14 (+0x38) | ServerTradeManagerImpl | **0x008590d0** |
|
||||
| 2 | 0x007d97b6 | S+0x158 | 8 (+0x20) | ServerTradeManagerImpl | **0x0088e8d0** (one pushed arg) |
|
||||
| 3 | 0x007d97c3 | S+0x158 | 12 (+0x30) | ServerTradeManagerImpl | **0x0088e920** |
|
||||
| 4 | 0x007d97d0 | S+0x158 | 11 (+0x2c) | ServerTradeManagerImpl | **0x00848570** |
|
||||
| 5 | 0x007d97dd | S+0x158 | 9 (+0x24) | ServerTradeManagerImpl | **0x00868060** |
|
||||
| 6 | 0x007d97ea | S+0x158 | 7 (+0x1c) | ServerTradeManagerImpl | **0x0088ad60** |
|
||||
| 7 | 0x007d97f7 | S+0x158 | 13 (+0x34) | ServerTradeManagerImpl | **0x0088ef80** |
|
||||
| 8 | 0x007d9804 | S+0x158 | 15 (+0x3c) | ServerTradeManagerImpl | **0x0082cca0** |
|
||||
| 9 | 0x007d9811 | **S+0x15c** | 13 (+0x34) | **ServerSpyManager** | **0x008877b0** |
|
||||
|
||||
and phase 33, the two lane K also listed:
|
||||
|
||||
| | site | recv | slot | class | target |
|
||||
|---|---|---|---|---|---|
|
||||
| 10 | 0x007d989b | S+0x15c | 14 (+0x38) | ServerSpyManager | **0x0088db80** |
|
||||
| 11 | 0x007d98a8 | S+0x15c | 15 (+0x3c) | ServerSpyManager | **0x00887f30** |
|
||||
|
||||
All eleven are now labelled and plate-commented in Ghidra (`ServerTradeManagerImpl_vslotN`,
|
||||
`ServerSpyManager_vslotN`) with their provenance and their dispatch site.
|
||||
|
||||
**All eleven have zero direct call sites.** They were unreachable to every sweep this campaign has run.
|
||||
|
||||
### 3.1 Four of them can draw on the strategic generator
|
||||
|
||||
This is the part that matters beyond bookkeeping. Closures below are direct calls **plus inter-function tail
|
||||
jumps** (see §5); "draws" means an RNG entry point or one of lane I's eleven inlined-draw functions is in the
|
||||
closure.
|
||||
|
||||
| target | slot | closure | draws |
|
||||
|---|---|---|---|
|
||||
| 0x008590d0 | trade 14 | 143 | — |
|
||||
| 0x0088e8d0 | trade 8 | 86 | — |
|
||||
| 0x0088e920 | trade 12 | 193 | — |
|
||||
| 0x00848570 | trade 11 | 188 | — |
|
||||
| 0x00868060 | trade 9 | 185 | — |
|
||||
| 0x0088ad60 | trade 7 | 189 | — |
|
||||
| **0x0088ef80** | **trade 13** | 84 | **NextFloat, NextInt** |
|
||||
| **0x0082cca0** | **trade 15** | 54 | **NextFloat, Chance** |
|
||||
| **0x008877b0** | **spy 13** | 69 | **NextFloat, NextInt, Chance** |
|
||||
| **0x0088db80** | **spy 14 (ph 33)** | 64 | **NextFloat, Chance** |
|
||||
| 0x00887f30 | spy 15 (ph 33) | 230 | — |
|
||||
|
||||
And the draws are on **the strategic generator**, `StrategyServer+0x16c` — verified at the instruction, not
|
||||
inferred from the call graph:
|
||||
|
||||
| draw site | in | generator load |
|
||||
|---|---|---|
|
||||
| 0x00887c8a `Chance` | 0x008877b0 (spy 13) | `mov ecx,[ecx+0x16c]` |
|
||||
| 0x00840929 `Chance` | 0x008408e0 ← spy 13 | `mov ecx,[eax+0x16c]` |
|
||||
| 0x00840a3c `Chance` | 0x008408e0 ← spy 13 | `mov ecx,[edx+0x16c]` |
|
||||
| 0x008409c7 `NextInt` | 0x008408e0 ← spy 13 | (arg) |
|
||||
| 0x0088dc43 `Chance` | 0x0088db80 (spy 14) | `mov ecx,[eax+0x16c]` |
|
||||
| 0x0082cdb8 `Chance` | 0x0082cca0 (trade 15) | `mov eax,[eax+0x16c]` at 0x0082cda4, then `mov ecx,eax` |
|
||||
| 0x00820e18 `NextFloat` | 0x00820ca0 ← trade 13 | `mov ecx,[reg+0x16c]`, `lea ecx,[ecx+4]` |
|
||||
| 0x0088b613 `NextInt` | 0x0088b440 ← trade 13 | `mov ecx,[ecx+0x16c]` at 0x0088b5fc, `add ecx,4` |
|
||||
|
||||
**None of these has ever been observed firing.** Lane Z's boundary instrument measured **0 tail words on
|
||||
every one of 8 turns**, so on those workloads every one of the four is gated off. That does not make them
|
||||
absent; it makes them rule 6 — a path no save exercises is a hypothesis, and this is now a *named* one with
|
||||
a hook site.
|
||||
|
||||
**This is the correction the tail ledger needs.** `tail-rng-ledger.md`'s "the tail draws nothing" is a
|
||||
measured property of eight turns, not a property of the code. The tail contains at least **eight** draw
|
||||
sites on the strategic generator behind four virtual slots, plus the node-line decay `Chance` lane Z already
|
||||
found. Rule 18 applies directly: the next move is a hook on those four callees, not more reading — a word
|
||||
count cannot distinguish "the trade/spy end-of-turn work found nothing to do" from "it never runs".
|
||||
|
||||
---
|
||||
|
||||
## 4. The RNG re-check over indirect edges
|
||||
|
||||
### 4.1 What did *not* change
|
||||
|
||||
Lane I's 22-site inventory and lane Z's zero-residual ledger are untouched. Nothing here adds a draw to the
|
||||
turns lane Z measured; the residual is still zero and `GenerateTradeRaidEncounters` is still 16 of ~20 words.
|
||||
The tool re-derives lane Z's edge from scratch (§1) rather than contradicting it.
|
||||
|
||||
### 4.2 The nine "unreachable" inlined-draw functions, resolved
|
||||
|
||||
Lane I parked nine of its eleven inlined-draw functions as reachable only through a vtable slot with no
|
||||
direct caller. **Correction to how that was recorded:** none of the eleven is itself in a vftable — no dword
|
||||
equal to any of those eleven addresses exists anywhere in the image. What is in a vftable is each one's
|
||||
*topmost direct-call ancestor*. Resolved:
|
||||
|
||||
| inlined-draw fn | topmost ancestor | vtable slot it sits in |
|
||||
|---|---|---|
|
||||
| 0x004b1f20 | 0x00453e80 | `Game::CombatNetworkClient` slot 3 |
|
||||
| 0x00507ac0 | 0x005348b0 | `Game::CrowRuinsEncounter` slot 11 |
|
||||
| 0x005232a0 | 0x00533e10 | `Game::SwarmEncounter` slot 11 |
|
||||
| 0x006ec720 / 0x006f65f0 / 0x006f7890 | 0x007cda40 / 0x007cf260 / 0x007cfd00 | `Game::StrategyNetworkServer` slots 4 / 7 / 3 |
|
||||
| 0x0079f7d0 | 0x007612b0, 0x00784640 | `Game::StrategyNetworkClient` slots 3 and 6 |
|
||||
| 0x007c2fa0 | 0x00664320 | `Game::StrategyLobbyScreen` slot 3 |
|
||||
| 0x007c4140 | 0x007612b0 | `Game::StrategyNetworkClient` slot 3 |
|
||||
| 0x007a7f30 | 0x00784640 | `Game::StrategyNetworkClient` slot 6 — **and in the tail's closure directly** |
|
||||
| 0x007aa240 | 0x00784640 | — **in `ProcessTurn`'s closure directly** (lane I, depth 4) |
|
||||
|
||||
Three of these ancestries only exist once **inter-function jump edges** are included (§5); 0x007c2fa0 and
|
||||
the `StrategyNetworkServer` group have no `E8` caller at all and are entered by a tail `jmp`.
|
||||
|
||||
`CrowRuinsEncounter` and `SwarmEncounter` are **not** `SVScriptObject`s — they derive from
|
||||
`Game::CombatEncounterBase` and their offset-0 vtables have 16 slots. Their slot 11 is reachable only from a
|
||||
dispatch on a `CombatEncounterBase`-family receiver, which is a different family from the scripted-scenario
|
||||
hooks in §4.3. The slot-11 dispatch inside `ProcessTurn` is **not** a route to them.
|
||||
|
||||
### 4.3 The one genuinely new draw surface: the `SVScriptObject` hooks
|
||||
|
||||
`StrategyServer+0x1b4` (lane T's `StrategyServer_off_ScriptObject`, 0x1b0 in the S+4 frame) is dispatched:
|
||||
|
||||
* in `ProcessTurn`: 0x007dcb8e slot 4 (with `push 6` — a hook **id**), 0x007dcb97 slot 11, then
|
||||
0x007dcbb6 slot 4, 0x007dcbbf slot 30;
|
||||
* in `OnAllCombatDone_Tail`: 0x007d9767/0x007d9770 slots 4/25, 0x007d9783/0x007d978c slots 4/27,
|
||||
0x007d9838/0x007d9841 slots 4/30.
|
||||
|
||||
Each block is guarded by `mov edi,[esi+0x1b4]; cmp edi,ebx; je` — the whole surface is optional, which is
|
||||
why lane T and lane K both recorded it as null in a normal game.
|
||||
|
||||
30 classes derive from `Game::SVScriptObject`. The base's empty body is 0x0080c5a0, which makes the real
|
||||
overrides countable:
|
||||
|
||||
| slot | non-stub overrides (of 30) | overrides whose closure reaches a draw |
|
||||
|---|---|---|
|
||||
| 4 | 14 | **11** — SVSOSlaversRefuel, SVSOPuppetMaster, SVSOSystemKiller, SVSOSwarm, SVSOTournament, SVSOJewelsOfTheCrown, SVSOCivilWar, SVSOUpstartApes, SVSOHolyLands, SVSOHiverInvasion, SVSOSots |
|
||||
| 11 | 7 | **4** — SVSOCrowRuins, SVSOOrtgay, SVSOVonNeumann, SVSOCrowDefenders |
|
||||
| 25 | 8 | **2** — SVSOSwarmQueen, SVSOProgressionWars |
|
||||
| 27 | 0 | — |
|
||||
| 30 | 1 | 0 |
|
||||
|
||||
Example path: `SVSOCrowRuins` slot 11 = 0x00518340 → 0x004f4210 → `Mars_RNG_IntRangeBell` 0x008e6d80 →
|
||||
`RNG_NextInt` 0x004271c0.
|
||||
|
||||
**Two limits on this, stated plainly.** (a) The draws are at depth 2–4 and the generator arrives as an
|
||||
argument (`lea ecx,[obj+4]`), so **which** generator these use is not established — it may be the strategic
|
||||
one at `S+0x16c` or a different instance. (b) `StrategyServer+0x1b4`'s type is a hypothesis: the shape
|
||||
(slot 30 exists, so ≥31 slots; the `push <id>` gate; lane T's independent reading) all point at
|
||||
`SVScriptObject`, but **no constructor store into +0x1b4 was found**, so the class is inferred from the
|
||||
dispatch, not proven. Lane T recorded it as `verified`; this lane could not re-derive that from the
|
||||
constructor and records it as the weaker claim.
|
||||
|
||||
### 4.4 So what is the strengthened statement?
|
||||
|
||||
Not "there is no twenty-third mechanism". Honestly:
|
||||
|
||||
> Over direct edges **plus every indirect edge whose receiver this lane could pin**, `ProcessTurn`'s closure
|
||||
> grows from 1,430 to 1,486 functions and `OnAllCombatDone_Tail`'s from 1,424 to 1,668, and the only draw
|
||||
> sites those 300 added functions contribute are the eight in §3.1 — all inside the trade/spy end-of-turn
|
||||
> block, all gated, none observed firing on the eleven turns lane Z instrumented.
|
||||
|
||||
The maximal over-approximation — every indirect site dispatching to every slot-matching target image-wide —
|
||||
puts 19,697 of 41,089 functions in `ProcessTurn`'s closure. **That bound is useless and I am not going to
|
||||
dress it up**: at half the image it says "maybe", not "yes". The tractable statement is the pinned one
|
||||
above, plus the one-hop enumeration in §4.2/§4.3 of exactly which vtable slots could bridge into the parked
|
||||
subtrees.
|
||||
|
||||
**Rule 18 stands.** The right instrument for "does the trade/spy tail block ever draw?" is a hook on
|
||||
0x0088ef80 / 0x0082cca0 / 0x008877b0 / 0x0088db80 and a save with active trade routes and an active spy
|
||||
program. That is ten minutes of the lab against another lane of reading.
|
||||
|
||||
---
|
||||
|
||||
## 5. A second lower bound found on the way: tail-jump edges
|
||||
|
||||
Every call graph in the repo is built from `E8 rel32`. Sweeping for jumps that land on **another function's
|
||||
start** finds **14,958** more control-flow edges — tail calls, and Ghidra function splits. They matter:
|
||||
|
||||
| closure | E8 only | + tail jumps | + pinned indirect |
|
||||
|---|---|---|---|
|
||||
| `StrategyServer::ProcessTurn` 0x007dc6c0 | 1,395 | 1,430 | 1,486 |
|
||||
| `OnAllCombatDone_Tail` 0x007d92a0 | 1,377 | 1,424 | 1,668 |
|
||||
|
||||
Lane I's closure was 1,426; with tail jumps this lane gets 1,430, which is the same closure to within edge
|
||||
bookkeeping. Three of the nine parked inlined-draw functions in §4.2 have **no** `E8` caller anywhere and
|
||||
are reachable only over these edges — 0x007c2fa0 is entered by a jump from 0x00898a50, and the whole
|
||||
`StrategyNetworkServer` group through 0x006fcc60 from 0x006fde40. A sweep that had stopped at `E8` would
|
||||
have called all four dead code.
|
||||
|
||||
---
|
||||
|
||||
## 6. What this lane did **not** do
|
||||
|
||||
* **Receiver type inference is not solved.** 2.5% of virtual sites get a class. The other 97.5% break down
|
||||
into 1,027 stack receivers, 850 members of a register not proven to be `this`, and 3,955 where the object
|
||||
pointer's definition could not be proven to reach the use. All are enumerated in `dumps/vtables.json` with
|
||||
the reason; none is guessed at.
|
||||
* **No callee bodies were read.** Every "draws / draw-free" verdict in §3.1 and §4.3 is a closure computation
|
||||
over the call graph, not a reading. Rule 16 applies to the negative half of that: a function whose closure
|
||||
contains no RNG *call* can still contain an **inlined** draw. The eleven functions lane I's tempering-
|
||||
immediate scan found are checked for explicitly, so the verdict is "no call-graph draw and not one of the
|
||||
eleven known inlined-draw functions" — which is a lower bound on drawing, not a proof of not drawing.
|
||||
* **The `disp-only` route is discarded, not fixed.** 403 virtual sites whose receiver is a member of an
|
||||
unknown object would resolve if their enclosing classes were typed. `ghidra/vtable-owners.json` is the
|
||||
mechanism; it currently has two entries.
|
||||
* **`StrategyServer+0x1b4`'s class was not proven** (§4.3b), and consequently the SVSO hook analysis is
|
||||
conditional on lane T's identification being right.
|
||||
* **Nothing was measured.** Every claim here is static. The four gated tail draw paths are the obvious next
|
||||
hook, and until one runs, "never observed firing" means eight turns of one workload.
|
||||
|
||||
## 7. Reproducing
|
||||
|
||||
```
|
||||
uv run python3 tools/rtti_map.py build # -> dumps/rtti.json (2,172 vftables)
|
||||
uv run python3 tools/vtable_map.py build # -> dumps/vtables.json (~5 s)
|
||||
uv run python3 tools/vtable_map.py validate # 12 checks, and the false-positive tables of 2c
|
||||
uv run python3 tools/vtable_map.py who 0x00893290
|
||||
uv run python3 tools/vtable_map.py vt 0x00a31b74
|
||||
uv run python3 tools/vtable_map.py sites 0x007d92a0
|
||||
uv run python3 tools/vtable_map.py resolve 0x007d92a0
|
||||
uv run python3 tools/vtable_map.py field 0x158
|
||||
uv run python3 tools/vtable_map.py impls Game::ServerTradeManager
|
||||
```
|
||||
|
||||
`owner <funcVA> <reg>` also exists — an IDF-weighted ranker of candidate owner classes by overlap with each
|
||||
class constructor's member-write footprint. It put `Game::StrategyServer` at rank 2 for
|
||||
`OnAllCombatDone_Tail`'s `ebx` and nowhere useful for `ProcessTurn`'s `esi`. **It is a weak ranker and no
|
||||
claim in this document rests on it** — the receiver typings in §3 come from constructors, not from it.
|
||||
102
ghidra/addresses.d/lane-v2.json
Normal file
102
ghidra/addresses.d/lane-v2.json
Normal file
|
|
@ -0,0 +1,102 @@
|
|||
{
|
||||
"entries": [
|
||||
{
|
||||
"name": "StrategyServer_off_SpyManager",
|
||||
"offset": "0x158",
|
||||
"convention": "member",
|
||||
"prototype": "Game::ServerSpyManager* StrategyServer::SpyManager, in lane T's S+4 frame (absolute StrategyServer+0x15c). StrategyServer ctor 0x007d78d0: `call 0x00832a30` (the ServerSpyManager ctor, identified by its store of vftable 0x00a3073c) then `mov [esi+0x15c],eax` at 0x007d7d8e. Corroborated independently by 0x007dcf90, which the RTTI inverse map shows is Game::StrategyServer vftable 0x00a26034 slot 14 at sub-object +4: it calls the same two ctors and stores at [esi+0x154] and [esi+0x158], exactly 4 lower than the base-frame 0x158/0x15c, as a +4 `this` requires. Sits immediately after StrategyServer_off_TradeManager (lane T, 0x154 in the same frame)",
|
||||
"status": "verified"
|
||||
},
|
||||
{
|
||||
"name": "ServerSpyManager_vftable",
|
||||
"addr": "0x00a3073c",
|
||||
"convention": "data",
|
||||
"prototype": "void* Game::ServerSpyManager::vftable[18] // sub-object +0, COL 0x00a87ed4, bases Game::IServerSpyManager / Game::ISpyManager / Mars::IStreamable. Unlike the trade manager there is no *Impl: ServerSpyManager is itself concrete (no purecall slots) and has no derived class. A second vftable 0x00a30728 sits at sub-object +4 with 3 slots",
|
||||
"status": "verified"
|
||||
},
|
||||
{
|
||||
"name": "ServerTradeManagerImpl_vslot7",
|
||||
"addr": "0x0088ad60",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (Game::ServerTradeManagerImpl* this) // vftable 0x00a31b74 slot 7 (+0x1c). Reached ONLY virtually, from 0x007d97ea in StrategyServer::OnAllCombatDone_Tail phase 23 (call 6 of 8). Zero direct call sites. Body not read; its direct+tail-jump closure is 189 functions and contains no RNG entry point and none of the eleven inlined-draw functions",
|
||||
"status": "mapped"
|
||||
},
|
||||
{
|
||||
"name": "ServerTradeManagerImpl_vslot8",
|
||||
"addr": "0x0088e8d0",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (Game::ServerTradeManagerImpl* this, int arg1) // vftable 0x00a31b74 slot 8 (+0x20). Reached ONLY virtually, from 0x007d97b6 in OnAllCombatDone_Tail phase 23 (call 2 of 8); the site pushes one argument. Closure 86 functions, draw-free",
|
||||
"status": "mapped"
|
||||
},
|
||||
{
|
||||
"name": "ServerTradeManagerImpl_vslot9",
|
||||
"addr": "0x00868060",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (Game::ServerTradeManagerImpl* this) // vftable 0x00a31b74 slot 9 (+0x24). Reached ONLY virtually, from 0x007d97dd (phase 23, call 5 of 8). Closure 185 functions, draw-free",
|
||||
"status": "mapped"
|
||||
},
|
||||
{
|
||||
"name": "ServerTradeManagerImpl_vslot11",
|
||||
"addr": "0x00848570",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (Game::ServerTradeManagerImpl* this) // vftable 0x00a31b74 slot 11 (+0x2c). Reached ONLY virtually, from 0x007d97d0 (phase 23, call 4 of 8). Closure 188 functions, draw-free",
|
||||
"status": "mapped"
|
||||
},
|
||||
{
|
||||
"name": "ServerTradeManagerImpl_vslot12",
|
||||
"addr": "0x0088e920",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (Game::ServerTradeManagerImpl* this) // vftable 0x00a31b74 slot 12 (+0x30). Reached ONLY virtually, from 0x007d97c3 (phase 23, call 3 of 8). Closure 193 functions, draw-free",
|
||||
"status": "mapped"
|
||||
},
|
||||
{
|
||||
"name": "ServerTradeManagerImpl_vslot13",
|
||||
"addr": "0x0088ef80",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (Game::ServerTradeManagerImpl* this) // vftable 0x00a31b74 slot 13 (+0x34). Reached ONLY virtually, from 0x007d97f7 (phase 23, call 7 of 8). REACHES THE STRATEGIC GENERATOR: -> 0x00820ca0, NextFloat at 0x00820e18 with the generator loaded as [reg+0x16c] then `lea ecx,[ecx+4]`; and -> 0x0088b440, NextInt at 0x0088b613 with `mov ecx,[ecx+0x16c]; add ecx,4`. Neither was ever observed firing: lane Z measured 0 tail words on 8 turns",
|
||||
"status": "mapped"
|
||||
},
|
||||
{
|
||||
"name": "ServerTradeManagerImpl_vslot14",
|
||||
"addr": "0x008590d0",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (Game::ServerTradeManagerImpl* this) // vftable 0x00a31b74 slot 14 (+0x38). Reached ONLY virtually, from 0x007d97a7 (phase 23, call 1 of 8). Closure 143 functions, draw-free",
|
||||
"status": "mapped"
|
||||
},
|
||||
{
|
||||
"name": "ServerTradeManagerImpl_vslot15",
|
||||
"addr": "0x0082cca0",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (Game::ServerTradeManagerImpl* this) // vftable 0x00a31b74 slot 15 (+0x3c). Reached ONLY virtually, from 0x007d9804 (phase 23, call 8 of 8). REACHES THE STRATEGIC GENERATOR: Chance at 0x0082cdb8, generator loaded at 0x0082cda4 as `mov eax,[eax+0x16c]` then `mov ecx,eax`. Never observed firing",
|
||||
"status": "mapped"
|
||||
},
|
||||
{
|
||||
"name": "ServerSpyManager_vslot13",
|
||||
"addr": "0x008877b0",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (Game::ServerSpyManager* this) // vftable 0x00a3073c slot 13 (+0x34). Reached ONLY virtually, from 0x007d9811 in OnAllCombatDone_Tail phase 23 -- the ninth call of the block, and the only one whose receiver is StrategyServer+0x15c rather than +0x158. REACHES THE STRATEGIC GENERATOR: Chance at 0x00887c8a on `mov ecx,[ecx+0x16c]`, and through 0x008408e0 Chance at 0x00840929 and 0x00840a3c plus NextInt at 0x008409c7, all on [reg+0x16c]. Never observed firing",
|
||||
"status": "mapped"
|
||||
},
|
||||
{
|
||||
"name": "ServerSpyManager_vslot14",
|
||||
"addr": "0x0088db80",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (Game::ServerSpyManager* this) // vftable 0x00a3073c slot 14 (+0x38). Reached ONLY virtually, from 0x007d989b in OnAllCombatDone_Tail phase 33 (call 1 of 2). REACHES THE STRATEGIC GENERATOR: Chance at 0x0088dc43 on `mov ecx,[eax+0x16c]`. Never observed firing",
|
||||
"status": "mapped"
|
||||
},
|
||||
{
|
||||
"name": "ServerSpyManager_vslot15",
|
||||
"addr": "0x00887f30",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (Game::ServerSpyManager* this) // vftable 0x00a3073c slot 15 (+0x3c). Reached ONLY virtually, from 0x007d98a8 in OnAllCombatDone_Tail phase 33 (call 2 of 2). Closure 230 functions, draw-free",
|
||||
"status": "mapped"
|
||||
},
|
||||
{
|
||||
"name": "SVScriptObject_EmptyOverride",
|
||||
"addr": "0x0080c5a0",
|
||||
"convention": "thiscall",
|
||||
"prototype": "void (void* this) // the do-nothing body every Game::SVScriptObject-derived class inherits in the hook slots it does not override. Occupies most of slots 4/11/25/27/30 across the 30 SVSO classes, which is what makes the non-stub overrides countable: 14 at slot 4, 7 at slot 11, 8 at slot 25, 1 at slot 30, 0 at slot 27",
|
||||
"status": "mapped"
|
||||
}
|
||||
]
|
||||
}
|
||||
38
ghidra/vtable-owners.json
Normal file
38
ghidra/vtable-owners.json
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
{
|
||||
"_readme": [
|
||||
"Hand-asserted receiver typings for functions that appear in NO vftable and",
|
||||
"are not constructors, so tools/vtable_map.py's automatic seeds cannot reach",
|
||||
"them. Every entry must carry evidence a reader can re-derive. These are",
|
||||
"seeds for the `this`-propagation fixpoint, so one entry types a whole",
|
||||
"subtree -- which is also why a wrong entry is expensive. Keep it short."
|
||||
],
|
||||
"owners": [
|
||||
{
|
||||
"func": "0x007dc6c0",
|
||||
"name": "StrategyServer::ProcessTurn",
|
||||
"class": "Game::StrategyServer",
|
||||
"offset": 0,
|
||||
"evidence": [
|
||||
"first member op is `inc [esi+0x8]` = ModCount; lane Z read S+0x8 as",
|
||||
"ModCount from StrategyServer::Write's wire tag at 0x0079fb2f",
|
||||
"hands its own `this` to 0x007d7f70, which dispatches on [this+0x158]",
|
||||
"and [this+0x15c]; the StrategyServer ctor 0x007d78d0 constructs a",
|
||||
"ServerTradeManagerImpl into +0x158 and a ServerSpyManager into +0x15c",
|
||||
"(vtable_map field 0x158 / field 0x15c)"
|
||||
]
|
||||
},
|
||||
{
|
||||
"func": "0x007d92a0",
|
||||
"name": "StrategyServer::OnAllCombatDone_Tail",
|
||||
"class": "Game::StrategyServer",
|
||||
"offset": 0,
|
||||
"evidence": [
|
||||
"lane K read [ebx+0x54]/[ebx+0x58] as vector<ServerPlayer*> Players",
|
||||
"dispatches on [ebx+0x158] and [ebx+0x15c] in one straight-line block,",
|
||||
"matching the two managers the StrategyServer ctor 0x007d78d0 builds",
|
||||
"there; slot 15 needs >=16 slots and slot 13 needs >=14, which the two",
|
||||
"concrete vtables 0x00a31b74 (22) and 0x00a3073c (18) supply"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
184
scripts/lane_v2_writeback.py
Normal file
184
scripts/lane_v2_writeback.py
Normal file
|
|
@ -0,0 +1,184 @@
|
|||
#!/usr/bin/env python3
|
||||
"""Lane V2 -- write the resolved indirect edges back into Ghidra.
|
||||
|
||||
Everything here comes from tools/vtable_map.py (RTTI vftable map + slot recovery
|
||||
+ constructor-derived member typing). Nothing is decompiler-derived.
|
||||
|
||||
uv run python3 scripts/lane_v2_writeback.py [--dry]
|
||||
"""
|
||||
import json
|
||||
import os
|
||||
import subprocess
|
||||
import sys
|
||||
|
||||
HERE = os.path.dirname(os.path.abspath(__file__))
|
||||
REPO = os.path.dirname(HERE)
|
||||
PROG = "/Sword of the Stars.exe"
|
||||
DRY = "--dry" in sys.argv
|
||||
|
||||
|
||||
def call(tool, args):
|
||||
if DRY:
|
||||
print(f" [dry] {tool} {json.dumps(args)[:150]}")
|
||||
return
|
||||
p = subprocess.run(
|
||||
["uv", "run", "python3", os.path.join(REPO, "tools", "reva_call.py"),
|
||||
tool, json.dumps(args)],
|
||||
cwd=REPO, capture_output=True, text=True, timeout=300)
|
||||
ok = '"success":true' in p.stdout or '"success": true' in p.stdout
|
||||
print(f" {'ok ' if ok else 'ERR'} {tool} {args.get('addressOrSymbol', args.get('address', ''))}"
|
||||
f" {'' if ok else p.stdout.strip()[:200] + p.stderr.strip()[:200]}")
|
||||
|
||||
|
||||
def comment(addr, text):
|
||||
call("set-comment", {"programPath": PROG, "addressOrSymbol": addr,
|
||||
"comment": text, "commentType": "pre"})
|
||||
|
||||
|
||||
def plate(addr, text):
|
||||
call("set-comment", {"programPath": PROG, "addressOrSymbol": addr,
|
||||
"comment": text, "commentType": "plate"})
|
||||
|
||||
|
||||
def label(addr, name):
|
||||
call("create-label", {"programPath": PROG, "addressOrSymbol": addr,
|
||||
"labelName": name})
|
||||
|
||||
|
||||
TRADE_VT = "0x00a31b74"
|
||||
SPY_VT = "0x00a3073c"
|
||||
|
||||
# --------------------------------------------------------------- the targets
|
||||
# vtable, class, slot, target, phase note, RNG note
|
||||
TARGETS = [
|
||||
(TRADE_VT, "ServerTradeManagerImpl", 10, "0x00893290",
|
||||
"dispatched at 0x007d8469 (StrategyServer::DetectEncounters)",
|
||||
"DRAWS: Chance x3 at 0x00893426 / 0x00893513 / 0x008935ce on the "
|
||||
"strategic generator; 16 of ~20 words of a strategic turn (lane Z)"),
|
||||
(TRADE_VT, "ServerTradeManagerImpl", 14, "0x008590d0",
|
||||
"OnAllCombatDone_Tail phase 23, call 1 of 8, at 0x007d97a7", ""),
|
||||
(TRADE_VT, "ServerTradeManagerImpl", 8, "0x0088e8d0",
|
||||
"OnAllCombatDone_Tail phase 23, call 2 of 8, at 0x007d97b6 (arg 1)", ""),
|
||||
(TRADE_VT, "ServerTradeManagerImpl", 12, "0x0088e920",
|
||||
"OnAllCombatDone_Tail phase 23, call 3 of 8, at 0x007d97c3", ""),
|
||||
(TRADE_VT, "ServerTradeManagerImpl", 11, "0x00848570",
|
||||
"OnAllCombatDone_Tail phase 23, call 4 of 8, at 0x007d97d0", ""),
|
||||
(TRADE_VT, "ServerTradeManagerImpl", 9, "0x00868060",
|
||||
"OnAllCombatDone_Tail phase 23, call 5 of 8, at 0x007d97dd", ""),
|
||||
(TRADE_VT, "ServerTradeManagerImpl", 7, "0x0088ad60",
|
||||
"OnAllCombatDone_Tail phase 23, call 6 of 8, at 0x007d97ea", ""),
|
||||
(TRADE_VT, "ServerTradeManagerImpl", 13, "0x0088ef80",
|
||||
"OnAllCombatDone_Tail phase 23, call 7 of 8, at 0x007d97f7",
|
||||
"REACHES A DRAW: -> 0x00820ca0 NextFloat at 0x00820e18 and "
|
||||
"-> 0x0088b440 NextInt at 0x0088b613, both on [obj+0x16c] = the "
|
||||
"StrategyServer strategic generator. Never observed firing (lane Z "
|
||||
"measured 0 tail words on 8 turns)"),
|
||||
(TRADE_VT, "ServerTradeManagerImpl", 15, "0x0082cca0",
|
||||
"OnAllCombatDone_Tail phase 23, call 8 of 8, at 0x007d9804",
|
||||
"REACHES A DRAW: Chance at 0x0082cdb8, generator loaded at 0x0082cda4 "
|
||||
"as [eax+0x16c] = the strategic generator. Never observed firing"),
|
||||
(SPY_VT, "ServerSpyManager", 13, "0x008877b0",
|
||||
"OnAllCombatDone_Tail phase 23, the ninth call, at 0x007d9811 "
|
||||
"(receiver is StrategyServer+0x15c, not +0x158)",
|
||||
"REACHES A DRAW: Chance at 0x00887c8a on [ecx+0x16c]; and via "
|
||||
"0x008408e0 Chance at 0x00840929 / 0x00840a3c and NextInt at "
|
||||
"0x008409c7, all on [reg+0x16c] = the strategic generator. "
|
||||
"Never observed firing"),
|
||||
(SPY_VT, "ServerSpyManager", 14, "0x0088db80",
|
||||
"OnAllCombatDone_Tail phase 33, call 1 of 2, at 0x007d989b",
|
||||
"REACHES A DRAW: Chance at 0x0088dc43 on [eax+0x16c] = the strategic "
|
||||
"generator. Never observed firing"),
|
||||
(SPY_VT, "ServerSpyManager", 15, "0x00887f30",
|
||||
"OnAllCombatDone_Tail phase 33, call 2 of 2, at 0x007d98a8", ""),
|
||||
]
|
||||
|
||||
# dispatch site -> (class, slot, target)
|
||||
SITES = [
|
||||
("0x007d8469", "ServerTradeManagerImpl", 10, "0x00893290", TRADE_VT),
|
||||
("0x007d97a7", "ServerTradeManagerImpl", 14, "0x008590d0", TRADE_VT),
|
||||
("0x007d97b6", "ServerTradeManagerImpl", 8, "0x0088e8d0", TRADE_VT),
|
||||
("0x007d97c3", "ServerTradeManagerImpl", 12, "0x0088e920", TRADE_VT),
|
||||
("0x007d97d0", "ServerTradeManagerImpl", 11, "0x00848570", TRADE_VT),
|
||||
("0x007d97dd", "ServerTradeManagerImpl", 9, "0x00868060", TRADE_VT),
|
||||
("0x007d97ea", "ServerTradeManagerImpl", 7, "0x0088ad60", TRADE_VT),
|
||||
("0x007d97f7", "ServerTradeManagerImpl", 13, "0x0088ef80", TRADE_VT),
|
||||
("0x007d9804", "ServerTradeManagerImpl", 15, "0x0082cca0", TRADE_VT),
|
||||
("0x007d9811", "ServerSpyManager", 13, "0x008877b0", SPY_VT),
|
||||
("0x007d989b", "ServerSpyManager", 14, "0x0088db80", SPY_VT),
|
||||
("0x007d98a8", "ServerSpyManager", 15, "0x00887f30", SPY_VT),
|
||||
]
|
||||
|
||||
# the SVScriptObject hook block on StrategyServer+0x1b4
|
||||
SVSO = [
|
||||
("0x007dcb8e", 4, "ProcessTurn, hook id 6 pushed at 0x007dcb8c"),
|
||||
("0x007dcb97", 11, "ProcessTurn, the hook body paired with the id-6 gate"),
|
||||
("0x007dcbb6", 4, "ProcessTurn, second gate"),
|
||||
("0x007dcbbf", 30, "ProcessTurn, the hook body paired with it"),
|
||||
("0x007d9767", 4, "OnAllCombatDone_Tail, gate"),
|
||||
("0x007d9770", 25, "OnAllCombatDone_Tail, hook body"),
|
||||
("0x007d9783", 4, "OnAllCombatDone_Tail, gate"),
|
||||
("0x007d978c", 27, "OnAllCombatDone_Tail, hook body"),
|
||||
("0x007d9838", 4, "OnAllCombatDone_Tail, gate"),
|
||||
("0x007d9841", 30, "OnAllCombatDone_Tail, hook body"),
|
||||
]
|
||||
|
||||
SVSO_NOTE = (
|
||||
"SVScriptObject hook: receiver is StrategyServer+0x1b4, null-checked "
|
||||
"before the block (`cmp reg,ebx; je`). 30 classes derive from "
|
||||
"Game::SVScriptObject; the base's empty override is 0x0080c5a0. "
|
||||
"Lane V2: slot 4 has 14 non-stub overrides, slot 11 has 7, slot 25 has 8, "
|
||||
"slot 30 has 1, slot 27 has 0. Thirteen of those overrides reach an RNG "
|
||||
"draw at depth 2-4 (e.g. SVSOCrowRuins slot 11 = 0x00518340 -> "
|
||||
"0x004f4210 -> IntRangeBell 0x008e6d80). Which generator object those "
|
||||
"draws use is NOT established -- it arrives as an argument. "
|
||||
"Scripted-scenario only; presumed inactive in a normal game and still "
|
||||
"not proven so."
|
||||
)
|
||||
|
||||
|
||||
def main():
|
||||
print("== vtable-slot plate comments and labels ==")
|
||||
for vt, cls, slot, tgt, where, rng in TARGETS:
|
||||
txt = (f"Game::{cls} vftable {vt} slot {slot} (+0x{4 * slot:x}).\n"
|
||||
f"Reached ONLY through a virtual dispatch: {where}.\n"
|
||||
f"Receiver typed from the constructor: StrategyServer ctor "
|
||||
f"0x007d78d0 stores the {cls} constructor's result into "
|
||||
f"StrategyServer+0x{'158' if cls.startswith('ServerTrade') else '15c'}"
|
||||
f"; corroborated by 0x007dcf90 (a StrategyServer method entered "
|
||||
f"on the +4 sub-object) storing the same two constructors 4 "
|
||||
f"bytes lower. [lane V2]")
|
||||
if rng:
|
||||
txt += "\n" + rng
|
||||
plate(tgt, txt)
|
||||
label(tgt, f"{cls}_vslot{slot}")
|
||||
|
||||
print("== dispatch-site comments ==")
|
||||
for site, cls, slot, tgt, vt in SITES:
|
||||
comment(site, f"-> Game::{cls}::vslot{slot} = {tgt} "
|
||||
f"(vftable {vt} + 0x{4 * slot:x}) [lane V2]")
|
||||
|
||||
print("== SVScriptObject hook block ==")
|
||||
for site, slot, where in SVSO:
|
||||
comment(site, f"SVScriptObject slot {slot} (+0x{4 * slot:x}) -- {where}."
|
||||
f"\n{SVSO_NOTE} [lane V2]")
|
||||
|
||||
print("== the two managers ==")
|
||||
plate("0x007d78d0",
|
||||
"Game::StrategyServer constructor (vptr installs: 0x00a26084 at +0, "
|
||||
"0x00a26034 at +4, Mars::IStreamable 0x009e22bc at +0).\n"
|
||||
"Lane V2 member typings taken from here:\n"
|
||||
" +0x158 = Game::ServerTradeManagerImpl* (ctor 0x00858f70, "
|
||||
"stored 0x007d7d81)\n"
|
||||
" +0x15c = Game::ServerSpyManager* (ctor 0x00832a30, "
|
||||
"stored 0x007d7d8e)\n"
|
||||
"Game::ServerTradeManager (vftable 0x00a311a4) is abstract -- 21 of "
|
||||
"its 22 slots are purecall -- and ServerTradeManagerImpl is its "
|
||||
"ONLY derived class, so slot N of that interface resolves uniquely. "
|
||||
"Game::ServerSpyManager has no *Impl: it is itself the concrete "
|
||||
"class (18 slots, none purecall) over IServerSpyManager / "
|
||||
"ISpyManager / IStreamable. [lane V2]")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
1257
tools/vtable_map.py
Normal file
1257
tools/vtable_map.py
Normal file
File diff suppressed because it is too large
Load diff
Loading…
Add table
Reference in a new issue