re: recover PlayerEvent vector append ABI

This commit is contained in:
alex 2026-09-10 00:07:33 -04:00
parent 04d2ec8287
commit 7a780b7f22
42 changed files with 11808 additions and 8 deletions

View file

@ -41,7 +41,7 @@
"path": "/home/alex/sots-re"
}
},
"checkpoint": "campaign/runtime/checkpoints/research-live-record-bridge-44636263a545a95b40066550.json",
"checkpoint": "campaign/runtime/checkpoints/research-live-record-bridge-7b7432a9c65bd530392291c3.json",
"dependencies": [
"research-completion-abi"
],

View file

@ -121,6 +121,15 @@
"context_stdout": "verify/results/research-live-record-bridge/run-a4f6a9922bf5800747bfdfc6/player-event-dtor-context.stdout.txt",
"scope": "Read-only complete callable destructor and boundary capture; static planning evidence only, not live allocator or destruction execution."
},
"player_event_append_capture": {
"session": "run-e21ce0d2909d8647e6a99a7b",
"manifest": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/manifest.json",
"append_stdout": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-exact.stdout.txt",
"growth_stdout": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-growth-exact.stdout.txt",
"reallocator_stdout": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-exact.stdout.txt",
"eh_analysis": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-eh-analysis.json",
"scope": "Read-only callable append, reserve/growth, reallocation and MSVC unwind capture; static planning evidence only, not live allocator, copy, destruction or exception execution."
},
"operations": {
"observed_tech_default_construct": {
"va": "0x008562a0",
@ -377,6 +386,41 @@
"verify/results/research-live-record-bridge/run-36c401e90eb0ec1db4d35865/manifest.json"
]
},
"player_event_vector_append": {
"va": "0x0086c580",
"rva": "0x0046c580",
"callable_entry": true,
"prototype": "void __thiscall player_event_vector_append(PlayerEventVector *vector, const PlayerEvent *source)",
"receiver": "ECX = live three-pointer vector header: first at +0x00, last at +0x04 and end at +0x08; allocator-shaped storage begins at +0x0c",
"arguments": [{"index": 0, "location": "[entry ESP+0x04] / [EBP+0x08]", "meaning": "source fully constructed live-layout PlayerEvent to deep-copy"}],
"stack_cleanup": "callee removes the one 4-byte source argument with ret 4",
"return": "no supported return-value contract; EAX is incidental after copy construction",
"source_location_branches": [
"For an element-aligned source in [first,last), computes its 0x74-byte element index before possible growth and recomputes the source from the possibly replaced first pointer afterward.",
"For source below first or at/above last, retains the external caller pointer across possible growth. A source inside unused capacity, at last, or unaligned inside the live byte range violates the bridge precondition."
],
"no_growth": "Deep-copy-constructs at old last through 0x007693f0 and advances last by exactly 0x74 only after normal return. First, end and all prior elements remain unchanged.",
"growth": {
"reserve_va": "0x00869500",
"reserve_prototype": "void __thiscall player_event_vector_reserve_additional(PlayerEventVector *vector, uint32_t additional_count)",
"reserve_abi": "ECX=vector, one stack count, ret 4, no supported return; append passes additional_count=1 only when last==end.",
"capacity_rule": "Rejects size+additional above 0x0234f72c elements. If required exceeds capacity, chooses at least required and otherwise capacity+floor(capacity/2), subject to the same maximum, then calls 0x00865ee0.",
"reallocator_va": "0x00865ee0",
"reallocator_abi": "ECX=vector, one requested-capacity stack word, ret 4, no supported return.",
"reallocate_effects": "Allocates requested_count*0x74 through 0x0078af40 -> MSVCR100 scalar new thunk 0x00924fb6; deep-copy-constructs [old first,old last) through 0x00772430 -> 0x007693f0; destroys each old PlayerEvent by virtual slot zero with flags=0; frees old storage through 0x00924faa; then publishes end, last and first in that order. Append subsequently copies the requested source at new last and publishes last+0x74.",
"normal_postcondition": "Every prior event survives as a complete independent deep copy; each old event is destroyed exactly once, old array storage is freed once through the matching runtime family, and the appended event owns three independent strings."
},
"exceptional_ownership": "Append FuncInfo 0x00aa0428 has two branch-specific states whose actions call no-op 0x0080c5a0; partial destination cleanup remains inside 0x007693f0. Reallocator FuncInfo 0x00acb5d4 routes a failed range copy to 0x00865ff1, which frees the unpublished new block after the range helper destroys its completed prefix, then continues propagation through 0x00924fbc. Header publication and append last advancement occur only after successful relocation/copy. This is static unwind topology; no live throw was exercised, so the fixture must contain propagation and prove balanced identities before live-safety acceptance.",
"captures": [
"verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-exact.stdout.txt",
"verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-growth-exact.stdout.txt",
"verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-exact.stdout.txt",
"verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-cleanup.stdout.txt",
"verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-eh-analysis.json",
"verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/manifest.json",
"verify/results/research-completion-abi-independent/integration-lead-20260910/player-append-wide.stdout.txt"
]
},
"player_event_destruct": {
"va": "0x0061ae90",
"rva": "0x0021ae90",
@ -460,6 +504,6 @@
],
"readiness": {
"complete": false,
"reason": "The ObservedTech default-construction, copy-construction, vector-append/growth and scalar-deleting destruction, PlayerEvent default-construction, copy-construction and destruction, and shared string-assignment rows are reconciled here. PlayerEvent append, every TurnEvents operation, and remaining exposed allocation operations still require exact generated rows and bound captures before implementation."
"reason": "The ObservedTech default-construction, copy-construction, vector-append/growth and scalar-deleting destruction, PlayerEvent default-construction, copy-construction, vector-append/growth and destruction, and shared string-assignment rows are reconciled here. Every TurnEvents operation and remaining exposed allocation operations still require exact generated rows and bound captures before implementation."
}
}

View file

@ -73,6 +73,20 @@ flags and never frees enclosing PlayerEvent storage. The exact capture byte-matc
dependency and integrated independent captures. This remains static ownership evidence; no live
destruction, allocator or exception behavior was executed.
The dedicated package now also records PlayerEvent vector append `0x0086c580`
(`ECX=vector`, stack source, `ret 4`, no supported return) and reserve/growth helper
`0x00869500` in
`verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/`. An aligned source in
the live range is reduced to an element index before growth and recomputed afterward; an external
source pointer is retained. Full capacity reserves one element, selecting at least `size+1` and
normally 1.5x capacity. Reallocator `0x00865ee0` allocates through `0x0078af40`, deep-copies the
old range through `0x00772430`, destroys old elements with deleting flags zero, frees old storage,
and only then publishes end, last and first. Append deep-copies the new element through
`0x007693f0` and publishes last only after success. Bound MSVC metadata shows that partial element
cleanup remains with the copy/range helper and the reallocator frees an unpublished new block before
continuing propagation. This is static ownership evidence; no live allocation, throw, copy or
destruction was executed.
The dedicated package now also records ObservedTech vector append `0x007b7320`
(`ECX=vector`, stack source, `ret 4`, no supported return). It distinguishes source inside the live
range from source outside it, reserves one slot through `0x007b5820` only when full, deep-copies at
@ -88,8 +102,7 @@ address/opcode/mnemonic/operand rows match. Only the new 2472-byte stream is the
capture; the old 2464-byte stream remains invalidated and must not be cited as raw evidence.
The following accepted boundaries may seed the dedicated package, but each callable row still needs
its raw-window artifact and exact prototype in that package: PlayerEvent append `0x0086c580`
(`ECX=vector`, stack source, `ret 4`); destructor `0x0061ae90`
its raw-window artifact and exact prototype in that package: PlayerEvent destructor `0x0061ae90`
(`ECX=this`, plain `ret`); get/create TurnEvents `0x00885380` (`ECX=EventStorage`, stack turn,
`EAX=bucket`, `ret 4`); TurnEvents append `0x00884cb0` (`ECX=outer vector`, stack source,
`ret 4`); TurnEvents slot-zero destructor `0x0062e120`; string assignment entry `0x00425430`
@ -206,8 +219,11 @@ ABI/return and static exceptional partial-construction cleanup. PlayerEvent copy
three independent deep-copy states, ABI/return and static partial-copy unwind. PlayerEvent destruction
at `0x0061ae90` is now complete, including reverse EvImg/EvMsg/EvDsc cleanup, conditional matching-
family frees, empty-SSO resets, final base-vptr transition, ABI/no-return contract and static-only
exception qualification. The next discriminating static check is PlayerEvent vector append at
`0x0086c580`: bind its complete callable and growth windows and encode source-location branches,
capacity growth, copy/destruction order, header publication, ABI/return and partial-copy unwind.
exception qualification. PlayerEvent vector append at `0x0086c580` is now complete in the JSON,
including source-location branches, reserve capacity selection, range relocation, copy/destruction
order, header publication, ABI/no-return behavior and static-only partial-copy unwind. The next
discriminating static check is EventStorage get/create TurnEvents at `0x00885380`: bind its complete
callable and helper windows and encode last-match lookup, empty-bucket construction, append lifetime,
returned pointer stability and turn publication order.
Do not begin bridge implementation until every exposed ABI row is encoded in the dedicated
generated-address package.

View file

@ -0,0 +1,23 @@
{
"actor": "live-record bridge architect",
"artifacts": [
{
"path": "campaign/research/research-live-record-bridge.md",
"sha256": "6d06db189b6b7466a1a6d92fc97021c21cc94322757d7a1464aa78f19d4b6e1f"
},
{
"path": "campaign/research/research-live-record-addresses.json",
"sha256": "53720a926eea95a98caa7f999c8c0e84c75f2d3c9ec988ad2ec4514347e1cd14"
}
],
"basis": "6fbcc78291fc02d5e549106bbd3affe29c5f458d742017c91e8d5c9272165cd8",
"contract": "research-live-record-bridge",
"id": "1ca941df9cf17c38fa3017ac",
"model": "openai/gpt-5.6-sol",
"next_action": "Capture PlayerEvent vector append at 0x0086c580 and growth helper at 0x00869500 read-only into a new immutable run-e21ce0d2909d8647e6a99a7b directory, then analyze exact ABI, source branches, growth, unwind and publication behavior.",
"role": "architecture-review",
"schema": "sots-checkpoint/1",
"session": "run-e21ce0d2909d8647e6a99a7b",
"summary": "Pre-experiment recovery checkpoint for fresh bounded architecture quantum. OBSERVATIONS: canonical contract is needs-revision; dependency research-completion-abi is accepted; campaign validate passes; all nine campaign surprises were read and are resolved, with no open surprise for this contract. Requested model openai/gpt-5.6-sol matches campaign/models.json and is listed by opencode models. Paired worktrees are linked to the canonical repositories and remain at exact baseline HEADs: engine /tmp/opencode/sots-final-research-engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 common-dir /home/alex/sots-engine/.git digest ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; RE /tmp/opencode/sots-final-research-re HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7 common-dir /home/alex/sots-re/.git digest 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Both have expected pre-existing dirty/untracked content; no source edit has occurred this quantum. Pinned dumps/sots.exe SHA256 is 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841; /usr/bin/objdump is GNU Binutils 2.38 SHA256 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd. VM144 lease is released; no lease is held and no VM/build-host/Ghidra mutation is authorized or planned. DECISIONS: continue planning-only owned scope; perform the checkpoint-mandated read-only static capture for PlayerEvent append/growth, and treat it only as planning evidence. No implementation, delegation, staging, commit, push, or lab operation. TESTS: campaign validate; source-binding; Git HEAD/common-dir/status; binary/tool hash/version; model listing; lease show all completed successfully. BLOCKERS: implementation remains blocked on incomplete PlayerEvent append, TurnEvents/allocation rows, generated header/toolchain/fixture/checker/manifests.",
"timestamp": "2026-09-10T03:50:15.535601+00:00"
}

View file

@ -0,0 +1,39 @@
{
"actor": "live-record bridge architect",
"artifacts": [
{
"path": "campaign/research/research-live-record-bridge.md",
"sha256": "07f096d4ef2bc0104f52ab7e17727e9bd856393557084bfbd98b455930a00df6"
},
{
"path": "campaign/research/research-live-record-addresses.json",
"sha256": "1bb9364fcb8cda6c3339165ff3f35ab4a6e23ad5355358200465e5fb19c746a1"
},
{
"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/manifest.json",
"sha256": "b60b5c956968477b6c2a0422115b3bf92942c474af0254a21723e47e45020bf3"
},
{
"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-exact.stdout.txt",
"sha256": "02164c44a5398853d2ea8efba8dbcb65166fa50229b95facf6e6abaf197cc754"
},
{
"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-growth-exact.stdout.txt",
"sha256": "d4c3b9bde5faac0838071464077fa67e1423c506e23452971da6c5b13858db25"
},
{
"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-exact.stdout.txt",
"sha256": "514c78476ee03d2921ee8caea12155e6f1e1a078c3acffd22295d9a879f27160"
}
],
"basis": "6fbcc78291fc02d5e549106bbd3affe29c5f458d742017c91e8d5c9272165cd8",
"contract": "research-live-record-bridge",
"id": "7b7432a9c65bd530392291c3",
"model": "openai/gpt-5.6-sol",
"next_action": "In a fresh bounded Sol architecture quantum, checkpoint before a read-only experiment, capture EventStorage get/create TurnEvents at 0x00885380 and all directly invoked helper windows into a new immutable run directory, then encode exact last-match lookup, empty-bucket construction, append lifetime, returned-pointer stability, turn publication order, ABI/return behavior and unwind ownership in campaign/research/research-live-record-addresses.json.",
"role": "architecture-review",
"schema": "sots-checkpoint/1",
"session": "run-e21ce0d2909d8647e6a99a7b",
"summary": "Quantum-end architecture checkpoint. OBSERVATIONS: immutable run-e21ce0d2909d8647e6a99a7b binds the pinned binary and paired source identities and captures PlayerEvent vector append 0x0086c580, reserve/growth 0x00869500, and reallocator 0x00865ee0. Static evidence establishes ECX vector plus source and ret 4 for append; internal-source index recomputation after growth; external-source retention; 0x74 stride and approximately 1.5x capacity rule; deep-copy relocation before flags-zero old-element destruction; matching-family old-storage release; end/last/first header publication only after success; append last publication only after copy; and unpublished-new-block unwind cleanup. All captures returned zero with empty stderr, the append bytes match accepted integrated evidence, campaign validation passes, and 37 campaign tests pass. No live allocator, exception, game, VM, Ghidra, build-host, or bridge operation ran; no contradiction or open surprise exists. DECISIONS: encode PlayerEvent append/growth as static planning evidence only, reject unaligned or inactive-capacity source pointers, and keep implementation blocked on TurnEvents/allocation/readiness rows.",
"timestamp": "2026-09-10T04:06:57.778244+00:00"
}

View file

@ -0,0 +1,27 @@
{
"actor": "live-record bridge architect",
"artifacts": [
{
"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-exact.stdout.txt",
"sha256": "02164c44a5398853d2ea8efba8dbcb65166fa50229b95facf6e6abaf197cc754"
},
{
"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-growth-exact.stdout.txt",
"sha256": "d4c3b9bde5faac0838071464077fa67e1423c506e23452971da6c5b13858db25"
},
{
"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-exact.stdout.txt",
"sha256": "514c78476ee03d2921ee8caea12155e6f1e1a078c3acffd22295d9a879f27160"
}
],
"basis": "6fbcc78291fc02d5e549106bbd3affe29c5f458d742017c91e8d5c9272165cd8",
"contract": "research-live-record-bridge",
"id": "84978cb5ed3c94f2b3636cec",
"model": "openai/gpt-5.6-sol",
"next_action": "Decode and record the append and reallocator MSVC unwind metadata, then write the immutable run manifest and PlayerEvent append operation row.",
"role": "architecture-review",
"schema": "sots-checkpoint/1",
"session": "run-e21ce0d2909d8647e6a99a7b",
"summary": "20-call architecture checkpoint during the read-only static experiment. OBSERVATIONS: exact pinned objdump capture of PlayerEvent append 0x0086c580..0x0086c62f byte-matches the accepted integrated wide capture (3360 bytes/SHA256 02164c44a5398853d2ea8efba8dbcb65166fa50229b95facf6e6abaf197cc754). It is ECX vector plus one source pointer and ret 4; separates aligned source in [first,last) from external source, reserves one only when full, recomputes an internal source after growth, deep-copies via 0x007693f0, and increments last by 0x74 only after normal return. Exact growth helper 0x00869500..0x0086957e takes additional_count, ret 4, checks maximum 0x0234f72c, chooses max(required, approximately 1.5x capacity), and invokes 0x00865ee0 only if required exceeds capacity. New exact reallocator capture shows allocation through 0x0078af40, range deep-copy via 0x00772430, old PlayerEvent virtual destruction with flags zero, scalar-delete old storage, then publication in order end/last/first; cleanup landing path frees the unpublished new block and continues exception propagation through 0x00924fbc. Static evidence only: no live allocation, copy, destruction, throw, game, VM, Ghidra or build-host execution. Source/binary/tool identities remain those in the pre-experiment checkpoint; no contradiction or open surprise observed. DECISIONS: continue completing a provenance manifest and dedicated generated-address row; qualify unwind behavior as static-only and forbid unaligned/inactive-capacity source pointers. No implementation or lab work. TESTS: all capture commands returned zero with empty stderr; exact append hash matches accepted integrated capture. BLOCKERS: implementation remains blocked on remaining TurnEvents/allocation rows and readiness tooling/resources.",
"timestamp": "2026-09-10T03:53:45.162284+00:00"
}

View file

@ -1,5 +1,5 @@
{
"contract": "research-live-record-bridge",
"run": "run-a4f6a9922bf5800747bfdfc6",
"run": "run-e21ce0d2909d8647e6a99a7b",
"status": "complete"
}

File diff suppressed because it is too large Load diff

File diff suppressed because one or more lines are too long

View file

@ -0,0 +1,87 @@
{
"schema": "sots-live-record-static-capture/1",
"session": "run-e21ce0d2909d8647e6a99a7b",
"scope": "Read-only PlayerEvent vector append, reserve/growth, reallocation and MSVC unwind reconciliation; static planning evidence only, with no original-runtime, allocator, VM, Ghidra or build-host execution.",
"cwd": "/home/alex/sots-re",
"environment": {"mode": "empty base environment", "PATH": "/usr/bin:/bin", "LC_ALL": "C"},
"source_binding": {
"engine": {"path": "/tmp/opencode/sots-final-research-engine", "commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23", "sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd", "git_common_dir": "/home/alex/sots-engine/.git"},
"re": {"path": "/tmp/opencode/sots-final-research-re", "commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7", "sha256": "6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8", "git_common_dir": "/home/alex/sots-re/.git"}
},
"input": {"path": "dumps/sots.exe", "bytes": 7898624, "sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841"},
"tools": [{"path": "/usr/bin/objdump", "version": "GNU Binutils 2.38", "sha256": "1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd"}],
"commands": [
{"name": "player-event-append-exact", "argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x0086c580", "--stop-address=0x0086c630", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-append-context", "argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x0086c570", "--stop-address=0x0086c640", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-growth-context", "argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x00869500", "--stop-address=0x00869680", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-growth-exact", "argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x00869500", "--stop-address=0x0086957f", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-reallocate-context", "argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x00865ee0", "--stop-address=0x00866140", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-reallocate-exact", "argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x00865ee0", "--stop-address=0x00865ff1", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-reallocate-cleanup", "argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x00865ff1", "--stop-address=0x00866007", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-append-ehdata", "argv": ["/usr/bin/objdump", "-s", "--start-address=0x00aa0428", "--stop-address=0x00aa0470", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-append-eh-record", "argv": ["/usr/bin/objdump", "-s", "--start-address=0x00aa0418", "--stop-address=0x00aa044c", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-append-handler-context", "argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x00968160", "--stop-address=0x009681a0", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-reallocate-eh-record", "argv": ["/usr/bin/objdump", "-s", "--start-address=0x00acb5c8", "--stop-address=0x00acb5f8", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-reallocate-ehdata", "argv": ["/usr/bin/objdump", "-s", "--start-address=0x00acb5b0", "--stop-address=0x00acb610", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-reallocate-handler-context", "argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x009980c0", "--stop-address=0x00998110", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-reallocate-cleanup-actions", "argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x009980f0", "--stop-address=0x00998150", "dumps/sots.exe"], "returncode": 0},
{"name": "player-event-append-unwind-action-target", "argv": ["/usr/bin/objdump", "-D", "-Mintel", "--start-address=0x0080c5a0", "--stop-address=0x0080c620", "dumps/sots.exe"], "returncode": 0}
],
"checks": {
"all_commands_returned_zero": true,
"all_command_stderr_empty": true,
"append_exact_matches_integrated_dependency": true,
"append_ends_ret_4_at_0x0086c62d": true,
"internal_and_external_source_branches_captured": true,
"growth_uses_0x74_stride_and_1_5x_rule": true,
"reallocation_deep_copies_before_old_range_destruction": true,
"old_elements_use_virtual_flags_zero": true,
"header_publication_is_end_last_first": true,
"append_last_publication_follows_copy": true,
"unpublished_block_cleanup_is_captured": true
},
"observations": [
"Append uses ECX vector plus one source argument, ret 4 and no supported return value; it recomputes a live-range source after growth and retains an external source.",
"Reserve accepts additional_count and selects max(required, 1.5x capacity), capped at 0x0234f72c PlayerEvent elements.",
"Reallocator allocates through 0x0078af40, range-copies through 0x00772430, destroys old PlayerEvents with flags zero, frees old storage, and publishes end, last and first only after success.",
"Static EH metadata binds no-op append unwind actions and an unpublished-allocation cleanup path for reallocation failure."
],
"limitations": [
"Static planning evidence only; no live allocation, copy, destruction, exception, game process or bridge operation was executed.",
"Range-copy internals are inherited from the accepted dependency and were not independently recaptured in this run.",
"This package reconciles only PlayerEvent append/growth and does not make the contract ready."
],
"files": [
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-exact.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-exact.stdout.txt", "bytes": 3360, "sha256": "02164c44a5398853d2ea8efba8dbcb65166fa50229b95facf6e6abaf197cc754"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-context.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-context.stdout.txt", "bytes": 4226, "sha256": "a3c1d1d1fed51fb8dfd43fcac360df799becafac764afdc7371cb34492260f13"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-growth-context.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-growth-context.stdout.txt", "bytes": 8005, "sha256": "bd7b84616ddae2cb9acd90dd426ab140a65e062d798a238590986daf588863b8"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-growth-exact.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-growth-exact.stdout.txt", "bytes": 2652, "sha256": "d4c3b9bde5faac0838071464077fa67e1423c506e23452971da6c5b13858db25"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-context.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-context.stdout.txt", "bytes": 12702, "sha256": "47c6cacdebf13619ba8b22a5ac757c426fa4dd718dac5edfc25c173b47cce77d"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-exact.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-exact.stdout.txt", "bytes": 5148, "sha256": "514c78476ee03d2921ee8caea12155e6f1e1a078c3acffd22295d9a879f27160"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-cleanup.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-cleanup.stdout.txt", "bytes": 478, "sha256": "894f9639680a488d16093e2537e6cd9fbe3f59ad942b905ccb81f8fea3f093d0"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-ehdata.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-ehdata.stdout.txt", "bytes": 381, "sha256": "0f1fae52828f56379e030f0ef759f901e86e1c7304bbed192042ec01d0e41a81"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-eh-record.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-eh-record.stdout.txt", "bytes": 319, "sha256": "675d9ed14e0dcd0b48b91f5273bf66aec1b0790e41546761cdacbac68d7ec8c5"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-handler-context.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-handler-context.stdout.txt", "bytes": 1293, "sha256": "f923970691d71eabfb77448c2f5a474590b1957c787086126642c0019e049cc0"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-eh-record.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-eh-record.stdout.txt", "bytes": 257, "sha256": "07d3dca4d28e6cd74d4ce02af227d502241648d8b8b71edeee79f6e781d9e555"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-ehdata.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-ehdata.stdout.txt", "bytes": 443, "sha256": "3f806b385c839dddca9b18e17f70f165d6e921eee7e873388b8470bebcb03f7f"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-handler-context.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-handler-context.stdout.txt", "bytes": 1761, "sha256": "203c1d7c3665e6ded37a6f43f3ae01caca66fe61e50fae5ee3d23db87b9846fc"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-cleanup-actions.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-reallocate-cleanup-actions.stdout.txt", "bytes": 1991, "sha256": "d76d8de4bef6c361ba02b0298ba1a3088a7f788c0fb0909aa6ce6995033df375"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-unwind-action-target.stderr.txt", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-unwind-action-target.stdout.txt", "bytes": 3761, "sha256": "3c6667229b94255d3eba47d3983af89ba6bb41c0c7a95d3ab43b686c94d2d6f7"},
{"path": "verify/results/research-live-record-bridge/run-e21ce0d2909d8647e6a99a7b/player-event-append-eh-analysis.json", "bytes": 1438, "sha256": "231e7485dacba9ae827dfa7bc0a03c85cca76c9ac01009d2dff817347340d546"}
]
}

View file

@ -0,0 +1,89 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0086c570 <.text+0x46b570>:
86c570: 83 c4 18 add esp,0x18
86c573: 03 f3 add esi,ebx
86c575: 89 77 04 mov DWORD PTR [edi+0x4],esi
86c578: 5f pop edi
86c579: 5e pop esi
86c57a: 5b pop ebx
86c57b: 5d pop ebp
86c57c: c2 04 00 ret 0x4
86c57f: cc int3
86c580: 55 push ebp
86c581: 8b ec mov ebp,esp
86c583: 6a ff push 0xffffffff
86c585: 68 82 81 96 00 push 0x968182
86c58a: 64 a1 00 00 00 00 mov eax,fs:0x0
86c590: 50 push eax
86c591: 51 push ecx
86c592: 56 push esi
86c593: 57 push edi
86c594: a1 78 8b af 00 mov eax,ds:0xaf8b78
86c599: 33 c5 xor eax,ebp
86c59b: 50 push eax
86c59c: 8d 45 f4 lea eax,[ebp-0xc]
86c59f: 64 a3 00 00 00 00 mov fs:0x0,eax
86c5a5: 8b f9 mov edi,ecx
86c5a7: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
86c5aa: 8b 75 08 mov esi,DWORD PTR [ebp+0x8]
86c5ad: 3b f1 cmp esi,ecx
86c5af: 73 40 jae 0x86c5f1
86c5b1: 8b 07 mov eax,DWORD PTR [edi]
86c5b3: 3b c6 cmp eax,esi
86c5b5: 77 3a ja 0x86c5f1
86c5b7: 2b f0 sub esi,eax
86c5b9: b8 09 cb 3d 8d mov eax,0x8d3dcb09
86c5be: f7 ee imul esi
86c5c0: 03 d6 add edx,esi
86c5c2: c1 fa 06 sar edx,0x6
86c5c5: 8b f2 mov esi,edx
86c5c7: c1 ee 1f shr esi,0x1f
86c5ca: 03 f2 add esi,edx
86c5cc: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
86c5cf: 75 09 jne 0x86c5da
86c5d1: 6a 01 push 0x1
86c5d3: 8b cf mov ecx,edi
86c5d5: e8 26 cf ff ff call 0x869500
86c5da: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
86c5dd: 6b f6 74 imul esi,esi,0x74
86c5e0: 03 37 add esi,DWORD PTR [edi]
86c5e2: 89 4d 08 mov DWORD PTR [ebp+0x8],ecx
86c5e5: 89 4d f0 mov DWORD PTR [ebp-0x10],ecx
86c5e8: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
86c5ef: eb 1e jmp 0x86c60f
86c5f1: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
86c5f4: 75 09 jne 0x86c5ff
86c5f6: 6a 01 push 0x1
86c5f8: 8b cf mov ecx,edi
86c5fa: e8 01 cf ff ff call 0x869500
86c5ff: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
86c602: 89 4d 08 mov DWORD PTR [ebp+0x8],ecx
86c605: 89 4d f0 mov DWORD PTR [ebp-0x10],ecx
86c608: c7 45 fc 01 00 00 00 mov DWORD PTR [ebp-0x4],0x1
86c60f: 85 c9 test ecx,ecx
86c611: 74 06 je 0x86c619
86c613: 56 push esi
86c614: e8 d7 cd ef ff call 0x7693f0
86c619: 83 47 04 74 add DWORD PTR [edi+0x4],0x74
86c61d: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
86c620: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
86c627: 59 pop ecx
86c628: 5f pop edi
86c629: 5e pop esi
86c62a: 8b e5 mov esp,ebp
86c62c: 5d pop ebp
86c62d: c2 04 00 ret 0x4
86c630: 55 push ebp
86c631: 8b ec mov ebp,esp
86c633: 56 push esi
86c634: 8b 75 08 mov esi,DWORD PTR [ebp+0x8]
86c637: 57 push edi
86c638: 8b f9 mov edi,ecx
86c63a: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
86c63d: 8b 17 mov edx,DWORD PTR [edi]
86c63f: 8b mov eax,ecx

View file

@ -0,0 +1,33 @@
{
"schema": "sots-player-event-append-eh-analysis/1",
"binary_sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841",
"append": {
"handler_thunk_va": "0x00968182",
"func_info_va": "0x00aa0428",
"magic": "0x19930522",
"max_state": 2,
"unwind_map_va": "0x00aa0418",
"unwind_map": [
{"state": 0, "to_state": -1, "action_va": "0x00968160"},
{"state": 1, "to_state": -1, "action_va": "0x00968171"}
],
"try_blocks": 0,
"ip_map_entries": 0,
"flags": 1,
"action_effect": "Both actions pass the saved destination twice to 0x0080c5a0; that target is a plain ret and performs no cleanup write, destruction, allocation or free. Partial PlayerEvent cleanup is owned by the throwing 0x007693f0 copy constructor."
},
"reallocator": {
"handler_thunk_va": "0x009980d0",
"func_info_va": "0x00acb5d4",
"magic": "0x19930522",
"max_state": 2,
"unwind_map_va": "0x00acb5b0",
"try_blocks": 1,
"try_block_map_va": "0x00acb5c0",
"ip_map_entries": 0,
"flags": 1,
"landing_va": "0x00865ff1",
"landing_effect": "Frees the unpublished allocation saved at EBP-0x18 through 0x00924faa, then continues propagation through 0x00924fbc. The called range-copy helper owns destruction of any completed destination prefix."
},
"qualification": "Static MSVC metadata and control flow only; no allocation failure or exception was executed."
}

View file

@ -0,0 +1,8 @@
dumps/sots.exe: file format pei-i386
Contents of section .rdata:
aa0418 ffffffff 60819600 ffffffff 71819600 ....`.......q...
aa0428 22059319 02000000 1804aa00 00000000 "...............
aa0438 00000000 00000000 00000000 00000000 ................
aa0448 01000000 ....

View file

@ -0,0 +1,9 @@
dumps/sots.exe: file format pei-i386
Contents of section .rdata:
aa0428 22059319 02000000 1804aa00 00000000 "...............
aa0438 00000000 00000000 00000000 00000000 ................
aa0448 01000000 ffffffff a0819600 22059319 ............"...
aa0458 01000000 4c04aa00 00000000 00000000 ....L...........
aa0468 00000000 00000000 ........

View file

@ -0,0 +1,71 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0086c580 <.text+0x46b580>:
86c580: 55 push ebp
86c581: 8b ec mov ebp,esp
86c583: 6a ff push 0xffffffff
86c585: 68 82 81 96 00 push 0x968182
86c58a: 64 a1 00 00 00 00 mov eax,fs:0x0
86c590: 50 push eax
86c591: 51 push ecx
86c592: 56 push esi
86c593: 57 push edi
86c594: a1 78 8b af 00 mov eax,ds:0xaf8b78
86c599: 33 c5 xor eax,ebp
86c59b: 50 push eax
86c59c: 8d 45 f4 lea eax,[ebp-0xc]
86c59f: 64 a3 00 00 00 00 mov fs:0x0,eax
86c5a5: 8b f9 mov edi,ecx
86c5a7: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
86c5aa: 8b 75 08 mov esi,DWORD PTR [ebp+0x8]
86c5ad: 3b f1 cmp esi,ecx
86c5af: 73 40 jae 0x86c5f1
86c5b1: 8b 07 mov eax,DWORD PTR [edi]
86c5b3: 3b c6 cmp eax,esi
86c5b5: 77 3a ja 0x86c5f1
86c5b7: 2b f0 sub esi,eax
86c5b9: b8 09 cb 3d 8d mov eax,0x8d3dcb09
86c5be: f7 ee imul esi
86c5c0: 03 d6 add edx,esi
86c5c2: c1 fa 06 sar edx,0x6
86c5c5: 8b f2 mov esi,edx
86c5c7: c1 ee 1f shr esi,0x1f
86c5ca: 03 f2 add esi,edx
86c5cc: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
86c5cf: 75 09 jne 0x86c5da
86c5d1: 6a 01 push 0x1
86c5d3: 8b cf mov ecx,edi
86c5d5: e8 26 cf ff ff call 0x869500
86c5da: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
86c5dd: 6b f6 74 imul esi,esi,0x74
86c5e0: 03 37 add esi,DWORD PTR [edi]
86c5e2: 89 4d 08 mov DWORD PTR [ebp+0x8],ecx
86c5e5: 89 4d f0 mov DWORD PTR [ebp-0x10],ecx
86c5e8: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
86c5ef: eb 1e jmp 0x86c60f
86c5f1: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
86c5f4: 75 09 jne 0x86c5ff
86c5f6: 6a 01 push 0x1
86c5f8: 8b cf mov ecx,edi
86c5fa: e8 01 cf ff ff call 0x869500
86c5ff: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
86c602: 89 4d 08 mov DWORD PTR [ebp+0x8],ecx
86c605: 89 4d f0 mov DWORD PTR [ebp-0x10],ecx
86c608: c7 45 fc 01 00 00 00 mov DWORD PTR [ebp-0x4],0x1
86c60f: 85 c9 test ecx,ecx
86c611: 74 06 je 0x86c619
86c613: 56 push esi
86c614: e8 d7 cd ef ff call 0x7693f0
86c619: 83 47 04 74 add DWORD PTR [edi+0x4],0x74
86c61d: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
86c620: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
86c627: 59 pop ecx
86c628: 5f pop edi
86c629: 5e pop esi
86c62a: 8b e5 mov esp,ebp
86c62c: 5d pop ebp
86c62d: c2 04 00 ret 0x4

View file

@ -0,0 +1,31 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00968160 <.text+0x567160>:
968160: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
968163: 50 push eax
968164: 8b 4d f0 mov ecx,DWORD PTR [ebp-0x10]
968167: 51 push ecx
968168: e8 33 44 ea ff call 0x80c5a0
96816d: 83 c4 08 add esp,0x8
968170: c3 ret
968171: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
968174: 50 push eax
968175: 8b 4d f0 mov ecx,DWORD PTR [ebp-0x10]
968178: 51 push ecx
968179: e8 22 44 ea ff call 0x80c5a0
96817e: 83 c4 08 add esp,0x8
968181: c3 ret
968182: 8b 54 24 08 mov edx,DWORD PTR [esp+0x8]
968186: 8d 42 0c lea eax,[edx+0xc]
968189: 8b 4a f0 mov ecx,DWORD PTR [edx-0x10]
96818c: 33 c8 xor ecx,eax
96818e: e8 ef cb fb ff call 0x924d82
968193: b8 28 04 aa 00 mov eax,0xaa0428
968198: e9 2b ce fb ff jmp 0x924fc8
96819d: cc int3
96819e: cc int3
96819f: cc int3

View file

@ -0,0 +1,88 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0080c5a0 <.text+0x40b5a0>:
80c5a0: c3 ret
80c5a1: cc int3
80c5a2: cc int3
80c5a3: cc int3
80c5a4: cc int3
80c5a5: cc int3
80c5a6: cc int3
80c5a7: cc int3
80c5a8: cc int3
80c5a9: cc int3
80c5aa: cc int3
80c5ab: cc int3
80c5ac: cc int3
80c5ad: cc int3
80c5ae: cc int3
80c5af: cc int3
80c5b0: 8b c1 mov eax,ecx
80c5b2: 33 c9 xor ecx,ecx
80c5b4: c7 00 44 3d a2 00 mov DWORD PTR [eax],0xa23d44
80c5ba: 89 48 04 mov DWORD PTR [eax+0x4],ecx
80c5bd: 89 48 08 mov DWORD PTR [eax+0x8],ecx
80c5c0: 89 48 0c mov DWORD PTR [eax+0xc],ecx
80c5c3: c3 ret
80c5c4: cc int3
80c5c5: cc int3
80c5c6: cc int3
80c5c7: cc int3
80c5c8: cc int3
80c5c9: cc int3
80c5ca: cc int3
80c5cb: cc int3
80c5cc: cc int3
80c5cd: cc int3
80c5ce: cc int3
80c5cf: cc int3
80c5d0: 55 push ebp
80c5d1: 8b ec mov ebp,esp
80c5d3: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
80c5d6: 56 push esi
80c5d7: 8b f1 mov esi,ecx
80c5d9: 8b 4d 0c mov ecx,DWORD PTR [ebp+0xc]
80c5dc: 8b 06 mov eax,DWORD PTR [esi]
80c5de: 8b 40 10 mov eax,DWORD PTR [eax+0x10]
80c5e1: 51 push ecx
80c5e2: 52 push edx
80c5e3: 8b ce mov ecx,esi
80c5e5: ff d0 call eax
80c5e7: 85 c0 test eax,eax
80c5e9: 74 0d je 0x80c5f8
80c5eb: 8b 16 mov edx,DWORD PTR [esi]
80c5ed: 8b 40 04 mov eax,DWORD PTR [eax+0x4]
80c5f0: 8b 52 28 mov edx,DWORD PTR [edx+0x28]
80c5f3: 50 push eax
80c5f4: 8b ce mov ecx,esi
80c5f6: ff d2 call edx
80c5f8: 5e pop esi
80c5f9: 5d pop ebp
80c5fa: c2 08 00 ret 0x8
80c5fd: cc int3
80c5fe: cc int3
80c5ff: cc int3
80c600: 8d 41 10 lea eax,[ecx+0x10]
80c603: c3 ret
80c604: cc int3
80c605: cc int3
80c606: cc int3
80c607: cc int3
80c608: cc int3
80c609: cc int3
80c60a: cc int3
80c60b: cc int3
80c60c: cc int3
80c60d: cc int3
80c60e: cc int3
80c60f: cc int3
80c610: 55 push ebp
80c611: 8b ec mov ebp,esp
80c613: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
80c616: 83 f8 0e cmp eax,0xe
80c619: 77 70 ja 0x80c68b
80c61b: ff 24 85 94 c6 jmp DWORD PTR [eax*4+0x80c694]

View file

@ -0,0 +1,173 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00869500 <.text+0x468500>:
869500: 55 push ebp
869501: 8b ec mov ebp,esp
869503: 53 push ebx
869504: 8b 19 mov ebx,DWORD PTR [ecx]
869506: 56 push esi
869507: 8b 71 04 mov esi,DWORD PTR [ecx+0x4]
86950a: 2b f3 sub esi,ebx
86950c: b8 09 cb 3d 8d mov eax,0x8d3dcb09
869511: f7 ee imul esi
869513: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
869516: 03 d6 add edx,esi
869518: c1 fa 06 sar edx,0x6
86951b: 8b f2 mov esi,edx
86951d: c1 ee 1f shr esi,0x1f
869520: 03 f2 add esi,edx
869522: ba 2c f7 34 02 mov edx,0x234f72c
869527: 2b d0 sub edx,eax
869529: 57 push edi
86952a: 3b d6 cmp edx,esi
86952c: 73 0b jae 0x869539
86952e: 68 90 1f 9e 00 push 0x9e1f90
869533: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
869539: 8b 79 08 mov edi,DWORD PTR [ecx+0x8]
86953c: 03 f0 add esi,eax
86953e: 2b fb sub edi,ebx
869540: b8 09 cb 3d 8d mov eax,0x8d3dcb09
869545: f7 ef imul edi
869547: 03 d7 add edx,edi
869549: c1 fa 06 sar edx,0x6
86954c: 8b c2 mov eax,edx
86954e: c1 e8 1f shr eax,0x1f
869551: 03 c2 add eax,edx
869553: 3b f0 cmp esi,eax
869555: 76 21 jbe 0x869578
869557: 8b d0 mov edx,eax
869559: d1 ea shr edx,1
86955b: bf 2c f7 34 02 mov edi,0x234f72c
869560: 2b fa sub edi,edx
869562: 3b f8 cmp edi,eax
869564: 73 04 jae 0x86956a
869566: 33 c0 xor eax,eax
869568: eb 02 jmp 0x86956c
86956a: 03 c2 add eax,edx
86956c: 3b c6 cmp eax,esi
86956e: 73 02 jae 0x869572
869570: 8b c6 mov eax,esi
869572: 50 push eax
869573: e8 68 c9 ff ff call 0x865ee0
869578: 5f pop edi
869579: 5e pop esi
86957a: 5b pop ebx
86957b: 5d pop ebp
86957c: c2 04 00 ret 0x4
86957f: cc int3
869580: 55 push ebp
869581: 8b ec mov ebp,esp
869583: 8b 41 04 mov eax,DWORD PTR [ecx+0x4]
869586: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
869589: 56 push esi
86958a: 8b 31 mov esi,DWORD PTR [ecx]
86958c: 57 push edi
86958d: 2b c6 sub eax,esi
86958f: bf ff ff ff 07 mov edi,0x7ffffff
869594: c1 f8 05 sar eax,0x5
869597: 2b fa sub edi,edx
869599: 3b f8 cmp edi,eax
86959b: 73 0b jae 0x8695a8
86959d: 68 90 1f 9e 00 push 0x9e1f90
8695a2: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
8695a8: 03 c2 add eax,edx
8695aa: 8b 51 08 mov edx,DWORD PTR [ecx+0x8]
8695ad: 2b d6 sub edx,esi
8695af: c1 fa 05 sar edx,0x5
8695b2: 3b c2 cmp eax,edx
8695b4: 76 21 jbe 0x8695d7
8695b6: 8b f2 mov esi,edx
8695b8: d1 ee shr esi,1
8695ba: bf ff ff ff 07 mov edi,0x7ffffff
8695bf: 2b fe sub edi,esi
8695c1: 3b fa cmp edi,edx
8695c3: 73 04 jae 0x8695c9
8695c5: 33 d2 xor edx,edx
8695c7: eb 02 jmp 0x8695cb
8695c9: 03 d6 add edx,esi
8695cb: 3b d0 cmp edx,eax
8695cd: 73 02 jae 0x8695d1
8695cf: 8b d0 mov edx,eax
8695d1: 52 push edx
8695d2: e8 39 f9 ff ff call 0x868f10
8695d7: 5f pop edi
8695d8: 5e pop esi
8695d9: 5d pop ebp
8695da: c2 04 00 ret 0x4
8695dd: cc int3
8695de: cc int3
8695df: cc int3
8695e0: 55 push ebp
8695e1: 8b ec mov ebp,esp
8695e3: 8b 51 04 mov edx,DWORD PTR [ecx+0x4]
8695e6: 56 push esi
8695e7: 57 push edi
8695e8: 8b 39 mov edi,DWORD PTR [ecx]
8695ea: 2b d7 sub edx,edi
8695ec: b8 67 66 66 66 mov eax,0x66666667
8695f1: f7 ea imul edx
8695f3: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
8695f6: c1 fa 04 sar edx,0x4
8695f9: 8b f2 mov esi,edx
8695fb: c1 ee 1f shr esi,0x1f
8695fe: 03 f2 add esi,edx
869600: ba 66 66 66 06 mov edx,0x6666666
869605: 2b d0 sub edx,eax
869607: 3b d6 cmp edx,esi
869609: 73 0b jae 0x869616
86960b: 68 90 1f 9e 00 push 0x9e1f90
869610: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
869616: 8b 51 08 mov edx,DWORD PTR [ecx+0x8]
869619: 03 f0 add esi,eax
86961b: 2b d7 sub edx,edi
86961d: b8 67 66 66 66 mov eax,0x66666667
869622: f7 ea imul edx
869624: c1 fa 04 sar edx,0x4
869627: 8b c2 mov eax,edx
869629: c1 e8 1f shr eax,0x1f
86962c: 03 c2 add eax,edx
86962e: 3b f0 cmp esi,eax
869630: 76 21 jbe 0x869653
869632: 8b d0 mov edx,eax
869634: d1 ea shr edx,1
869636: bf 66 66 66 06 mov edi,0x6666666
86963b: 2b fa sub edi,edx
86963d: 3b f8 cmp edi,eax
86963f: 73 04 jae 0x869645
869641: 33 c0 xor eax,eax
869643: eb 02 jmp 0x869647
869645: 03 c2 add eax,edx
869647: 3b c6 cmp eax,esi
869649: 73 02 jae 0x86964d
86964b: 8b c6 mov eax,esi
86964d: 50 push eax
86964e: e8 cd fc ff ff call 0x869320
869653: 5f pop edi
869654: 5e pop esi
869655: 5d pop ebp
869656: c2 04 00 ret 0x4
869659: cc int3
86965a: cc int3
86965b: cc int3
86965c: cc int3
86965d: cc int3
86965e: cc int3
86965f: cc int3
869660: 55 push ebp
869661: 8b ec mov ebp,esp
869663: 6a ff push 0xffffffff
869665: 68 c0 85 99 00 push 0x9985c0
86966a: 64 a1 00 00 00 00 mov eax,fs:0x0
869670: 50 push eax
869671: 83 ec 08 sub esp,0x8
869674: 53 push ebx
869675: 56 push esi
869676: 57 push edi
869677: a1 78 8b af 00 mov eax,ds:0xaf8b78
86967c: 33 c5 xor eax,ebp
86967e: 50 push eax
86967f: 8d lea eax,[ebp-0xc]

View file

@ -0,0 +1,60 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00869500 <.text+0x468500>:
869500: 55 push ebp
869501: 8b ec mov ebp,esp
869503: 53 push ebx
869504: 8b 19 mov ebx,DWORD PTR [ecx]
869506: 56 push esi
869507: 8b 71 04 mov esi,DWORD PTR [ecx+0x4]
86950a: 2b f3 sub esi,ebx
86950c: b8 09 cb 3d 8d mov eax,0x8d3dcb09
869511: f7 ee imul esi
869513: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
869516: 03 d6 add edx,esi
869518: c1 fa 06 sar edx,0x6
86951b: 8b f2 mov esi,edx
86951d: c1 ee 1f shr esi,0x1f
869520: 03 f2 add esi,edx
869522: ba 2c f7 34 02 mov edx,0x234f72c
869527: 2b d0 sub edx,eax
869529: 57 push edi
86952a: 3b d6 cmp edx,esi
86952c: 73 0b jae 0x869539
86952e: 68 90 1f 9e 00 push 0x9e1f90
869533: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
869539: 8b 79 08 mov edi,DWORD PTR [ecx+0x8]
86953c: 03 f0 add esi,eax
86953e: 2b fb sub edi,ebx
869540: b8 09 cb 3d 8d mov eax,0x8d3dcb09
869545: f7 ef imul edi
869547: 03 d7 add edx,edi
869549: c1 fa 06 sar edx,0x6
86954c: 8b c2 mov eax,edx
86954e: c1 e8 1f shr eax,0x1f
869551: 03 c2 add eax,edx
869553: 3b f0 cmp esi,eax
869555: 76 21 jbe 0x869578
869557: 8b d0 mov edx,eax
869559: d1 ea shr edx,1
86955b: bf 2c f7 34 02 mov edi,0x234f72c
869560: 2b fa sub edi,edx
869562: 3b f8 cmp edi,eax
869564: 73 04 jae 0x86956a
869566: 33 c0 xor eax,eax
869568: eb 02 jmp 0x86956c
86956a: 03 c2 add eax,edx
86956c: 3b c6 cmp eax,esi
86956e: 73 02 jae 0x869572
869570: 8b c6 mov eax,esi
869572: 50 push eax
869573: e8 68 c9 ff ff call 0x865ee0
869578: 5f pop edi
869579: 5e pop esi
86957a: 5b pop ebx
86957b: 5d pop ebp
86957c: c2 04 00 ret 0x4

View file

@ -0,0 +1,47 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
009980f0 <.text+0x5970f0>:
9980f0: 8b 4d f0 mov ecx,DWORD PTR [ebp-0x10]
9980f3: e9 08 b9 dc ff jmp 0x763a00
9980f8: 8b 54 24 08 mov edx,DWORD PTR [esp+0x8]
9980fc: 8d 42 0c lea eax,[edx+0xc]
9980ff: 8b 4a e4 mov ecx,DWORD PTR [edx-0x1c]
998102: 33 c8 xor ecx,eax
998104: e8 79 cc f8 ff call 0x924d82
998109: b8 00 b6 ac 00 mov eax,0xacb600
99810e: e9 b5 ce f8 ff jmp 0x924fc8
998113: cc int3
998114: cc int3
998115: cc int3
998116: cc int3
998117: cc int3
998118: cc int3
998119: cc int3
99811a: cc int3
99811b: cc int3
99811c: cc int3
99811d: cc int3
99811e: cc int3
99811f: cc int3
998120: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
998123: 50 push eax
998124: 8b 4d 0c mov ecx,DWORD PTR [ebp+0xc]
998127: 51 push ecx
998128: e8 73 44 e7 ff call 0x80c5a0
99812d: 83 c4 08 add esp,0x8
998130: c3 ret
998131: 8b 54 24 08 mov edx,DWORD PTR [esp+0x8]
998135: 8d 42 0c lea eax,[edx+0xc]
998138: 8b 4a dc mov ecx,DWORD PTR [edx-0x24]
99813b: 33 c8 xor ecx,eax
99813d: e8 40 cc f8 ff call 0x924d82
998142: b8 60 b6 ac 00 mov eax,0xacb660
998147: e9 7c ce f8 ff jmp 0x924fc8
99814c: cc int3
99814d: cc int3
99814e: cc int3
99814f: cc int3

View file

@ -0,0 +1,15 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00865ff1 <.text+0x464ff1>:
865ff1: 8b 55 e8 mov edx,DWORD PTR [ebp-0x18]
865ff4: 52 push edx
865ff5: e8 b0 ef 0b 00 call 0x924faa
865ffa: 83 c4 04 add esp,0x4
865ffd: 6a 00 push 0x0
865fff: 6a 00 push 0x0
866001: e8 b6 ef 0b 00 call 0x924fbc
866006: cc int3

View file

@ -0,0 +1,260 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00865ee0 <.text+0x464ee0>:
865ee0: 55 push ebp
865ee1: 8b ec mov ebp,esp
865ee3: 6a ff push 0xffffffff
865ee5: 68 d0 80 99 00 push 0x9980d0
865eea: 64 a1 00 00 00 00 mov eax,fs:0x0
865ef0: 50 push eax
865ef1: 83 ec 0c sub esp,0xc
865ef4: 53 push ebx
865ef5: 56 push esi
865ef6: 57 push edi
865ef7: a1 78 8b af 00 mov eax,ds:0xaf8b78
865efc: 33 c5 xor eax,ebp
865efe: 50 push eax
865eff: 8d 45 f4 lea eax,[ebp-0xc]
865f02: 64 a3 00 00 00 00 mov fs:0x0,eax
865f08: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
865f0b: 8b f1 mov esi,ecx
865f0d: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
865f10: 81 fb 2c f7 34 02 cmp ebx,0x234f72c
865f16: 76 0b jbe 0x865f23
865f18: 68 90 1f 9e 00 push 0x9e1f90
865f1d: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
865f23: 8b 4e 08 mov ecx,DWORD PTR [esi+0x8]
865f26: 2b 0e sub ecx,DWORD PTR [esi]
865f28: b8 09 cb 3d 8d mov eax,0x8d3dcb09
865f2d: f7 e9 imul ecx
865f2f: 03 d1 add edx,ecx
865f31: c1 fa 06 sar edx,0x6
865f34: 8b c2 mov eax,edx
865f36: c1 e8 1f shr eax,0x1f
865f39: 03 c2 add eax,edx
865f3b: 3b c3 cmp eax,ebx
865f3d: 0f 83 9a 00 00 00 jae 0x865fdd
865f43: 8d 7e 0c lea edi,[esi+0xc]
865f46: 53 push ebx
865f47: 8b cf mov ecx,edi
865f49: e8 f2 4f f2 ff call 0x78af40
865f4e: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
865f51: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4]
865f54: 8b 16 mov edx,DWORD PTR [esi]
865f56: 53 push ebx
865f57: 6a 00 push 0x0
865f59: 57 push edi
865f5a: 50 push eax
865f5b: 51 push ecx
865f5c: 52 push edx
865f5d: 89 45 e8 mov DWORD PTR [ebp-0x18],eax
865f60: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
865f67: e8 c4 c4 f0 ff call 0x772430
865f6c: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4]
865f6f: 8b 1e mov ebx,DWORD PTR [esi]
865f71: 89 4d ec mov DWORD PTR [ebp-0x14],ecx
865f74: 2b cb sub ecx,ebx
865f76: b8 09 cb 3d 8d mov eax,0x8d3dcb09
865f7b: f7 e9 imul ecx
865f7d: 03 d1 add edx,ecx
865f7f: c1 fa 06 sar edx,0x6
865f82: 8b fa mov edi,edx
865f84: c1 ef 1f shr edi,0x1f
865f87: 83 c4 18 add esp,0x18
865f8a: 03 fa add edi,edx
865f8c: c7 45 fc ff ff ff ff mov DWORD PTR [ebp-0x4],0xffffffff
865f93: 85 db test ebx,ebx
865f95: 74 26 je 0x865fbd
865f97: 3b 5d ec cmp ebx,DWORD PTR [ebp-0x14]
865f9a: 74 16 je 0x865fb2
865f9c: 8d 64 24 00 lea esp,[esp+0x0]
865fa0: 8b 13 mov edx,DWORD PTR [ebx]
865fa2: 8b 02 mov eax,DWORD PTR [edx]
865fa4: 6a 00 push 0x0
865fa6: 8b cb mov ecx,ebx
865fa8: ff d0 call eax
865faa: 83 c3 74 add ebx,0x74
865fad: 3b 5d ec cmp ebx,DWORD PTR [ebp-0x14]
865fb0: 75 ee jne 0x865fa0
865fb2: 8b 0e mov ecx,DWORD PTR [esi]
865fb4: 51 push ecx
865fb5: e8 f0 ef 0b 00 call 0x924faa
865fba: 83 c4 04 add esp,0x4
865fbd: 8b ce mov ecx,esi
865fbf: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c
865fc5: 6b ff 74 imul edi,edi,0x74
865fc8: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
865fcb: 8b 4d e8 mov ecx,DWORD PTR [ebp-0x18]
865fce: 6b c0 74 imul eax,eax,0x74
865fd1: 03 c1 add eax,ecx
865fd3: 03 f9 add edi,ecx
865fd5: 89 46 08 mov DWORD PTR [esi+0x8],eax
865fd8: 89 7e 04 mov DWORD PTR [esi+0x4],edi
865fdb: 89 0e mov DWORD PTR [esi],ecx
865fdd: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
865fe0: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
865fe7: 59 pop ecx
865fe8: 5f pop edi
865fe9: 5e pop esi
865fea: 5b pop ebx
865feb: 8b e5 mov esp,ebp
865fed: 5d pop ebp
865fee: c2 04 00 ret 0x4
865ff1: 8b 55 e8 mov edx,DWORD PTR [ebp-0x18]
865ff4: 52 push edx
865ff5: e8 b0 ef 0b 00 call 0x924faa
865ffa: 83 c4 04 add esp,0x4
865ffd: 6a 00 push 0x0
865fff: 6a 00 push 0x0
866001: e8 b6 ef 0b 00 call 0x924fbc
866006: cc int3
866007: cc int3
866008: cc int3
866009: cc int3
86600a: cc int3
86600b: cc int3
86600c: cc int3
86600d: cc int3
86600e: cc int3
86600f: cc int3
866010: 55 push ebp
866011: 8b ec mov ebp,esp
866013: 6a ff push 0xffffffff
866015: 68 08 79 98 00 push 0x987908
86601a: 64 a1 00 00 00 00 mov eax,fs:0x0
866020: 50 push eax
866021: 83 ec 08 sub esp,0x8
866024: 53 push ebx
866025: 56 push esi
866026: 57 push edi
866027: a1 78 8b af 00 mov eax,ds:0xaf8b78
86602c: 33 c5 xor eax,ebp
86602e: 50 push eax
86602f: 8d 45 f4 lea eax,[ebp-0xc]
866032: 64 a3 00 00 00 00 mov fs:0x0,eax
866038: 89 4d ec mov DWORD PTR [ebp-0x14],ecx
86603b: 8b 01 mov eax,DWORD PTR [ecx]
86603d: 8b 38 mov edi,DWORD PTR [eax]
86603f: 89 00 mov DWORD PTR [eax],eax
866041: 8b 01 mov eax,DWORD PTR [ecx]
866043: 89 40 04 mov DWORD PTR [eax+0x4],eax
866046: 33 d2 xor edx,edx
866048: 89 51 04 mov DWORD PTR [ecx+0x4],edx
86604b: 3b 39 cmp edi,DWORD PTR [ecx]
86604d: 74 55 je 0x8660a4
86604f: eb 02 jmp 0x866053
866051: 33 d2 xor edx,edx
866053: 8b 1f mov ebx,DWORD PTR [edi]
866055: 8d 47 08 lea eax,[edi+0x8]
866058: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
86605b: 8d 70 08 lea esi,[eax+0x8]
86605e: 89 55 fc mov DWORD PTR [ebp-0x4],edx
866061: 39 16 cmp DWORD PTR [esi],edx
866063: 74 18 je 0x86607d
866065: 8b ce mov ecx,esi
866067: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c
86606d: 8b 06 mov eax,DWORD PTR [esi]
86606f: 50 push eax
866070: e8 35 ef 0b 00 call 0x924faa
866075: 8b 45 f0 mov eax,DWORD PTR [ebp-0x10]
866078: 83 c4 04 add esp,0x4
86607b: 33 d2 xor edx,edx
86607d: 89 16 mov DWORD PTR [esi],edx
86607f: 89 56 04 mov DWORD PTR [esi+0x4],edx
866082: 89 56 08 mov DWORD PTR [esi+0x8],edx
866085: 57 push edi
866086: c7 45 fc ff ff ff ff mov DWORD PTR [ebp-0x4],0xffffffff
86608d: c7 00 bc 22 9e 00 mov DWORD PTR [eax],0x9e22bc
866093: e8 12 ef 0b 00 call 0x924faa
866098: 8b 45 ec mov eax,DWORD PTR [ebp-0x14]
86609b: 83 c4 04 add esp,0x4
86609e: 8b fb mov edi,ebx
8660a0: 3b 18 cmp ebx,DWORD PTR [eax]
8660a2: 75 ad jne 0x866051
8660a4: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
8660a7: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
8660ae: 59 pop ecx
8660af: 5f pop edi
8660b0: 5e pop esi
8660b1: 5b pop ebx
8660b2: 8b e5 mov esp,ebp
8660b4: 5d pop ebp
8660b5: c3 ret
8660b6: cc int3
8660b7: cc int3
8660b8: cc int3
8660b9: cc int3
8660ba: cc int3
8660bb: cc int3
8660bc: cc int3
8660bd: cc int3
8660be: cc int3
8660bf: cc int3
8660c0: 55 push ebp
8660c1: 8b ec mov ebp,esp
8660c3: 51 push ecx
8660c4: 53 push ebx
8660c5: 8b d9 mov ebx,ecx
8660c7: 8b 03 mov eax,DWORD PTR [ebx]
8660c9: 57 push edi
8660ca: 8b 38 mov edi,DWORD PTR [eax]
8660cc: 89 00 mov DWORD PTR [eax],eax
8660ce: 8b 03 mov eax,DWORD PTR [ebx]
8660d0: 89 40 04 mov DWORD PTR [eax+0x4],eax
8660d3: c7 43 04 00 00 00 00 mov DWORD PTR [ebx+0x4],0x0
8660da: 3b 3b cmp edi,DWORD PTR [ebx]
8660dc: 74 3e je 0x86611c
8660de: 56 push esi
8660df: 90 nop
8660e0: 83 7f 20 00 cmp DWORD PTR [edi+0x20],0x0
8660e4: 8b 07 mov eax,DWORD PTR [edi]
8660e6: 89 45 fc mov DWORD PTR [ebp-0x4],eax
8660e9: 74 15 je 0x866100
8660eb: 8d 4f 20 lea ecx,[edi+0x20]
8660ee: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c
8660f4: 8b 4f 20 mov ecx,DWORD PTR [edi+0x20]
8660f7: 51 push ecx
8660f8: e8 ad ee 0b 00 call 0x924faa
8660fd: 83 c4 04 add esp,0x4
866100: 33 c0 xor eax,eax
866102: 57 push edi
866103: 89 47 20 mov DWORD PTR [edi+0x20],eax
866106: 89 47 24 mov DWORD PTR [edi+0x24],eax
866109: 89 47 28 mov DWORD PTR [edi+0x28],eax
86610c: e8 99 ee 0b 00 call 0x924faa
866111: 8b 7d fc mov edi,DWORD PTR [ebp-0x4]
866114: 83 c4 04 add esp,0x4
866117: 3b 3b cmp edi,DWORD PTR [ebx]
866119: 75 c5 jne 0x8660e0
86611b: 5e pop esi
86611c: 5f pop edi
86611d: 5b pop ebx
86611e: 8b e5 mov esp,ebp
866120: 5d pop ebp
866121: c3 ret
866122: cc int3
866123: cc int3
866124: cc int3
866125: cc int3
866126: cc int3
866127: cc int3
866128: cc int3
866129: cc int3
86612a: cc int3
86612b: cc int3
86612c: cc int3
86612d: cc int3
86612e: cc int3
86612f: cc int3
866130: 55 push ebp
866131: 8b ec mov ebp,esp
866133: 83 ec 0c sub esp,0xc
866136: 53 push ebx
866137: 8b 5d 0c mov ebx,DWORD PTR [ebp+0xc]
86613a: 80 7b 25 00 cmp BYTE PTR [ebx+0x25],0x0
86613e: 56 push esi
86613f: 57 push edi

View file

@ -0,0 +1,7 @@
dumps/sots.exe: file format pei-i386
Contents of section .rdata:
acb5c8 01000000 01000000 a0b5ac00 22059319 ............"...
acb5d8 02000000 b0b5ac00 01000000 c0b5ac00 ................
acb5e8 00000000 00000000 00000000 01000000 ................

View file

@ -0,0 +1,10 @@
dumps/sots.exe: file format pei-i386
Contents of section .rdata:
acb5b0 ffffffff 00000000 ffffffff 00000000 ................
acb5c0 00000000 00000000 01000000 01000000 ................
acb5d0 a0b5ac00 22059319 02000000 b0b5ac00 ...."...........
acb5e0 01000000 c0b5ac00 00000000 00000000 ................
acb5f0 00000000 01000000 ffffffff f0809900 ................
acb600 22059319 01000000 f8b5ac00 00000000 "...............

View file

@ -0,0 +1,106 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00865ee0 <.text+0x464ee0>:
865ee0: 55 push ebp
865ee1: 8b ec mov ebp,esp
865ee3: 6a ff push 0xffffffff
865ee5: 68 d0 80 99 00 push 0x9980d0
865eea: 64 a1 00 00 00 00 mov eax,fs:0x0
865ef0: 50 push eax
865ef1: 83 ec 0c sub esp,0xc
865ef4: 53 push ebx
865ef5: 56 push esi
865ef6: 57 push edi
865ef7: a1 78 8b af 00 mov eax,ds:0xaf8b78
865efc: 33 c5 xor eax,ebp
865efe: 50 push eax
865eff: 8d 45 f4 lea eax,[ebp-0xc]
865f02: 64 a3 00 00 00 00 mov fs:0x0,eax
865f08: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
865f0b: 8b f1 mov esi,ecx
865f0d: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
865f10: 81 fb 2c f7 34 02 cmp ebx,0x234f72c
865f16: 76 0b jbe 0x865f23
865f18: 68 90 1f 9e 00 push 0x9e1f90
865f1d: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
865f23: 8b 4e 08 mov ecx,DWORD PTR [esi+0x8]
865f26: 2b 0e sub ecx,DWORD PTR [esi]
865f28: b8 09 cb 3d 8d mov eax,0x8d3dcb09
865f2d: f7 e9 imul ecx
865f2f: 03 d1 add edx,ecx
865f31: c1 fa 06 sar edx,0x6
865f34: 8b c2 mov eax,edx
865f36: c1 e8 1f shr eax,0x1f
865f39: 03 c2 add eax,edx
865f3b: 3b c3 cmp eax,ebx
865f3d: 0f 83 9a 00 00 00 jae 0x865fdd
865f43: 8d 7e 0c lea edi,[esi+0xc]
865f46: 53 push ebx
865f47: 8b cf mov ecx,edi
865f49: e8 f2 4f f2 ff call 0x78af40
865f4e: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
865f51: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4]
865f54: 8b 16 mov edx,DWORD PTR [esi]
865f56: 53 push ebx
865f57: 6a 00 push 0x0
865f59: 57 push edi
865f5a: 50 push eax
865f5b: 51 push ecx
865f5c: 52 push edx
865f5d: 89 45 e8 mov DWORD PTR [ebp-0x18],eax
865f60: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
865f67: e8 c4 c4 f0 ff call 0x772430
865f6c: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4]
865f6f: 8b 1e mov ebx,DWORD PTR [esi]
865f71: 89 4d ec mov DWORD PTR [ebp-0x14],ecx
865f74: 2b cb sub ecx,ebx
865f76: b8 09 cb 3d 8d mov eax,0x8d3dcb09
865f7b: f7 e9 imul ecx
865f7d: 03 d1 add edx,ecx
865f7f: c1 fa 06 sar edx,0x6
865f82: 8b fa mov edi,edx
865f84: c1 ef 1f shr edi,0x1f
865f87: 83 c4 18 add esp,0x18
865f8a: 03 fa add edi,edx
865f8c: c7 45 fc ff ff ff ff mov DWORD PTR [ebp-0x4],0xffffffff
865f93: 85 db test ebx,ebx
865f95: 74 26 je 0x865fbd
865f97: 3b 5d ec cmp ebx,DWORD PTR [ebp-0x14]
865f9a: 74 16 je 0x865fb2
865f9c: 8d 64 24 00 lea esp,[esp+0x0]
865fa0: 8b 13 mov edx,DWORD PTR [ebx]
865fa2: 8b 02 mov eax,DWORD PTR [edx]
865fa4: 6a 00 push 0x0
865fa6: 8b cb mov ecx,ebx
865fa8: ff d0 call eax
865faa: 83 c3 74 add ebx,0x74
865fad: 3b 5d ec cmp ebx,DWORD PTR [ebp-0x14]
865fb0: 75 ee jne 0x865fa0
865fb2: 8b 0e mov ecx,DWORD PTR [esi]
865fb4: 51 push ecx
865fb5: e8 f0 ef 0b 00 call 0x924faa
865fba: 83 c4 04 add esp,0x4
865fbd: 8b ce mov ecx,esi
865fbf: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c
865fc5: 6b ff 74 imul edi,edi,0x74
865fc8: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
865fcb: 8b 4d e8 mov ecx,DWORD PTR [ebp-0x18]
865fce: 6b c0 74 imul eax,eax,0x74
865fd1: 03 c1 add eax,ecx
865fd3: 03 f9 add edi,ecx
865fd5: 89 46 08 mov DWORD PTR [esi+0x8],eax
865fd8: 89 7e 04 mov DWORD PTR [esi+0x4],edi
865fdb: 89 0e mov DWORD PTR [esi],ecx
865fdd: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
865fe0: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
865fe7: 59 pop ecx
865fe8: 5f pop edi
865fe9: 5e pop esi
865fea: 5b pop ebx
865feb: 8b e5 mov esp,ebp
865fed: 5d pop ebp
865fee: c2 04 00 ret 0x4

View file

@ -0,0 +1,43 @@
dumps/sots.exe: file format pei-i386
Disassembly of section .text:
009980c0 <.text+0x5970c0>:
9980c0: cf iret
9980c1: f8 clc
9980c2: ff cc dec esp
9980c4: cc int3
9980c5: cc int3
9980c6: cc int3
9980c7: cc int3
9980c8: cc int3
9980c9: cc int3
9980ca: cc int3
9980cb: cc int3
9980cc: cc int3
9980cd: cc int3
9980ce: cc int3
9980cf: cc int3
9980d0: 8b 54 24 08 mov edx,DWORD PTR [esp+0x8]
9980d4: 8d 42 0c lea eax,[edx+0xc]
9980d7: 8b 4a e4 mov ecx,DWORD PTR [edx-0x1c]
9980da: 33 c8 xor ecx,eax
9980dc: e8 a1 cc f8 ff call 0x924d82
9980e1: b8 d4 b5 ac 00 mov eax,0xacb5d4
9980e6: e9 dd ce f8 ff jmp 0x924fc8
9980eb: cc int3
9980ec: cc int3
9980ed: cc int3
9980ee: cc int3
9980ef: cc int3
9980f0: 8b 4d f0 mov ecx,DWORD PTR [ebp-0x10]
9980f3: e9 08 b9 dc ff jmp 0x763a00
9980f8: 8b 54 24 08 mov edx,DWORD PTR [esp+0x8]
9980fc: 8d 42 0c lea eax,[edx+0xc]
9980ff: 8b 4a e4 mov ecx,DWORD PTR [edx-0x1c]
998102: 33 c8 xor ecx,eax
998104: e8 79 cc f8 ff call 0x924d82
998109: b8 00 b6 ac 00 mov eax,0xacb600
99810e: e9 b5 jmp 0x924fc8