From 90c665a3bec0476d35f5fbbbcc1bd4e064b0cb52 Mon Sep 17 00:00:00 2001 From: alex Date: Tue, 8 Sep 2026 14:53:40 -0400 Subject: [PATCH] lane T2: record the rule-17 hit -- the caller's real body runs 0x48 bytes past Ghidra's reported end, and a clipped sweep would have found no caller at all --- findings/subsystems/treaty-turn-stamp.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/findings/subsystems/treaty-turn-stamp.md b/findings/subsystems/treaty-turn-stamp.md index adcd039..4e0f6eb 100644 --- a/findings/subsystems/treaty-turn-stamp.md +++ b/findings/subsystems/treaty-turn-stamp.md @@ -88,6 +88,16 @@ exist. **before** either turn driver, in the host's command-application step โ€” the same bracket `phase_catalog.h` already calls `Driver::Host`. +**Rule 17, a fifth time: that call site is 0x1c bytes past Ghidra's reported end of its own caller.** +Ghidra sizes `ApplyTurnCommands` at 2965 bytes, ending 0x007b2445; the real body runs to `ret 0x10` at +**0x007b248d**, 0x48 bytes further, and the call to 0x007898c0 sits inside that tail. A sweep clipped at +`fva + size` would have found **no caller at all** for this function and concluded it was dead. The +surrounding instructions corroborate the identification independently: the call is the last real statement +of `ApplyTurnCommands`, its three stack arguments are three locals at `[ebp-0x344]`, `[ebp-0x34c]`, +`[ebp-0x348]`, and it is immediately followed by `FUN_007acb50(S, <0x00a24f9c>)` โ€” the function +`strategic-turn-internals.md` ยง5.2 already names as the one that "dumps the Alliances / Non Aggression / +Cease fires tables to the log". + `void __thiscall (StrategyServer* S, vector* allianceBroken, vector* napBroken, vector* cfBroken)`, `ret 0xc`, 700 B. `this` is the **`S` frame** โ€” `[edi+0x54]`/`[edi+0x58]` is the `vector Players` and `[edi+0xc]` is `Frame`, both `S`-frame offsets lane T and lane Z