alex/sots-re
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

lane T2: record the rule-17 hit -- the caller's real body runs 0x48 bytes past Ghidra's reported end, and a clipped sweep would have found no caller at all

Browse source
This commit is contained in:
alex 2026-09-08 14:53:40 -04:00
parent 214e00186d
commit 90c665a3be
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
findings/subsystems/treaty-turn-stamp.md
View file

@ -88,6 +88,16 @@ exist.
**before** either turn driver, in the host's command-application step — the same bracket
`phase_catalog.h` already calls `Driver::Host`.
**Rule 17, a fifth time: that call site is 0x1c bytes past Ghidra's reported end of its own caller.**
Ghidra sizes `ApplyTurnCommands` at 2965 bytes, ending 0x007b2445; the real body runs to `ret 0x10` at
**0x007b248d**, 0x48 bytes further, and the call to 0x007898c0 sits inside that tail. A sweep clipped at
`fva + size` would have found **no caller at all** for this function and concluded it was dead. The
surrounding instructions corroborate the identification independently: the call is the last real statement
of `ApplyTurnCommands`, its three stack arguments are three locals at `[ebp-0x344]`, `[ebp-0x34c]`,
`[ebp-0x348]`, and it is immediately followed by `FUN_007acb50(S, <0x00a24f9c>)` — the function
`strategic-turn-internals.md` §5.2 already names as the one that "dumps the Alliances / Non Aggression /
Cease fires tables to the log".
`void __thiscall (StrategyServer* S, vector<uint>* allianceBroken, vector<uint>* napBroken,
vector<uint>* cfBroken)`, `ret 0xc`, 700 B. `this` is the **`S` frame** — `[edi+0x54]`/`[edi+0x58]` is the
`vector<ServerPlayer*> Players` and `[edi+0xc]` is `Frame`, both `S`-frame offsets lane T and lane Z