re: correct TurnEvents miss-path recovery
This commit is contained in:
alex
parent
be66fdde2c
commit
93e2166217
20 changed files with 11204 additions and 8 deletions
|
|
@ -21,7 +21,7 @@
|
||||||
"path": "/home/alex/sots-re"
|
"path": "/home/alex/sots-re"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"checkpoint": "campaign/runtime/checkpoints/research-completion-abi-34e545ce9e774117dec97cf0.json",
|
"checkpoint": "campaign/runtime/checkpoints/research-completion-abi-1340cf6a2a12b704e5cd048e.json",
|
||||||
"dependencies": [
|
"dependencies": [
|
||||||
"controls-bootstrap"
|
"controls-bootstrap"
|
||||||
],
|
],
|
||||||
|
|
|
||||||
|
|
@ -37,8 +37,13 @@ production-history inference or live-safety claim is made.
|
||||||
prior long destination buffer through `0x00924faa`. A temporary long string is therefore not
|
prior long destination buffer through `0x00924faa`. A temporary long string is therefore not
|
||||||
transferable by raw header copy.
|
transferable by raw header copy.
|
||||||
* `0x00885380`: get-or-create TurnEvents bucket, ECX EventStorage receiver plus stack turn, EAX
|
* `0x00885380`: get-or-create TurnEvents bucket, ECX EventStorage receiver plus stack turn, EAX
|
||||||
bucket return, `ret 4`. It returns the last existing matching turn. On absence it appends a deep
|
bucket return, `ret 4`. It returns the last existing matching turn. On absence it initializes the
|
||||||
copy of a zero/empty stack bucket through `0x00884cb0`, then writes the stored turn.
|
stack bucket's vptr and empty nested-vector header but **not** its `EvTurn`; `0x00884cb0` copies
|
||||||
|
that incoming stack word and deep-copies the nested vector. After temporary nested-vector cleanup,
|
||||||
|
get/create writes the requested turn into the stored last element and returns it. The transient
|
||||||
|
word is not measured randomness or a zero default. Fresh correction capture:
|
||||||
|
`verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09/`, governed by
|
||||||
|
`d-b51f3f76803e852ed250846a`.
|
||||||
* `0x00884cb0`: outer TurnEvents vector append, ECX vector receiver plus stack source, `ret 4`,
|
* `0x00884cb0`: outer TurnEvents vector append, ECX vector receiver plus stack source, `ret 4`,
|
||||||
stride `0x18`. Full-capacity growth is `0x008841a0` -> `0x00883a60`; allocation is
|
stride `0x18`. Full-capacity growth is `0x008841a0` -> `0x00883a60`; allocation is
|
||||||
`0x006e8f50` -> `0x00924fb6` with `count * 0x18`. Existing buckets are copy-constructed by
|
`0x006e8f50` -> `0x00924fb6` with `count * 0x18`. Existing buckets are copy-constructed by
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,35 @@
|
||||||
|
{
|
||||||
|
"actor": "research-abi-analyst",
|
||||||
|
"artifacts": [
|
||||||
|
{
|
||||||
|
"path": "verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09/manifest.json",
|
||||||
|
"sha256": "4f3b4b28002a22521d2e7b87c8f82d63b21bf9f48918cc4ab6a7f629155cd101"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09/report.md",
|
||||||
|
"sha256": "f37e3c4bbf4c0dd249bb152422a786172d14d77fc912c7d8a4cb0d7240c0a3c7"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "verify/results/research-completion-abi/recovered-static.md",
|
||||||
|
"sha256": "b6bfe302ebc96ab65eab31a86ff286a4bd3c43f3bba16610d9e87b04e5d40c35"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "campaign/research/research-completion-abi.md",
|
||||||
|
"sha256": "23912a90a275f36679e1ed03d9d8830359299a2ecc269ec075f07d6f7425f4f6"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "campaign/runtime/decisions/d-b51f3f76803e852ed250846a.json",
|
||||||
|
"sha256": "d01550dd8874160d05378f6183d780c444a5285a4ebc5d3c6049fbda8e342957"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||||
|
"contract": "research-completion-abi",
|
||||||
|
"id": "1340cf6a2a12b704e5cd048e",
|
||||||
|
"model": "openai/gpt-5.6-sol",
|
||||||
|
"next_action": "Lead assigns a distinct research-completion-abi verifier to freshly reproduce the four run-16f8e9b6376b278c4870be09 windows and challenge the report\u2019s last-match, spare/full, empty/nonempty and cleanup-before-store falsifiers.",
|
||||||
|
"role": "analyst",
|
||||||
|
"schema": "sots-checkpoint/1",
|
||||||
|
"session": "run-16f8e9b6376b278c4870be09",
|
||||||
|
"summary": "QUANTUM HANDOFF. OBSERVATIONS: no open surprises; contract remains needs-revision. Assigned source identities were freshly verified before capture: engine worktree /tmp/opencode/sots-final-research-engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23, common /home/alex/sots-engine/.git, digest ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; RE worktree /tmp/opencode/sots-final-research-re HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7, common /home/alex/sots-re/.git, digest 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Both assigned trees retained pre-existing dirty/untracked files; this quantum edited only contract-owned canonical campaign/research/research-completion-abi.md, verify/results/research-completion-abi/recovered-static.md and new run-16f8e9b6376b278c4870be09/. Canonical RE HEAD at stop is be66fdde2c35e3feae55820c26bfc06a11feef63; it is not substituted for the pinned assigned-worktree source identity. Fresh input/tool: dumps/sots.exe SHA256 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841, 7,898,624 bytes; /usr/bin/objdump SHA256 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd, GNU Binutils 2.38. Four read-only local windows required by d-b51f3f76803e852ed250846a ran exit zero with nonempty stdout/empty stderr; manifest hashes revalidated and all four stdout hashes exactly reproduce archived bridge captures. RECORDED FACTS: get/create never writes temporary [EBP-0x20] EvTurn before append; append copies source+4 to destination+4, invokes nested deep-copy, then advances last; empty nested copy initializes three zero pointers and allocates nothing; temporary nested cleanup at 0x885422 precedes requested-turn publication at 0x88542d and EAX return of last-0x18; cleanup destroys 0x74-stride elements/frees through 0x00924faa only for nonnull storage, then zeros all pointers. DECISION: corrected both owned handoffs to describe the transient scalar as an incoming stack word not initialized by this routine, neither measured randomness nor necessarily nonzero; do not encode zero or reproduce an uninitialized read. Static usable postcondition is final requested turn after normally returning helpers on valid containers. HYPOTHESES/UNEXERCISED: full outer growth, nonempty nested copy, failure/unwind, transient observation/reentrancy, padding and live CRT compatibility were not executed. No game, VM, Ghidra or build host used; no RNG draw, event ID/record or unrelated game state observed; no lease acquired/held, cleanup obligation or access change. No delegation, stage, commit or push. TESTS: custom manifest verifier PASS 4/4 outputs hash-valid/exit-zero/nonempty and equal archived hashes; campaign validate passed listing five contracts; git diff --check passed; search found no remaining zero-temporary wording in owned Markdown. Report supplies independent falsifiers for last-match/no-write hit, spare/full miss, empty/nonempty nested copy and cleanup-before-store order. BLOCKER: ownership-recovered and independent-cross-check remain unaccepted until a distinct verifier reproduces/challenges the corrected package; static evidence does not establish live allocator safety or replacement acceptance.",
|
||||||
|
"timestamp": "2026-09-10T04:29:20.452182+00:00"
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
{
|
||||||
|
"actor": "research-abi-analyst",
|
||||||
|
"artifacts": [
|
||||||
|
{
|
||||||
|
"path": "campaign/runtime/decisions/d-b51f3f76803e852ed250846a.json",
|
||||||
|
"sha256": "d01550dd8874160d05378f6183d780c444a5285a4ebc5d3c6049fbda8e342957"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"path": "verify/results/research-live-record-bridge/run-472955e277202c411388c66b/manifest.json",
|
||||||
|
"sha256": "ae16b4b500db5b84bea27c659e254842ab0c67c040ca782c016381384338773b"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
|
||||||
|
"contract": "research-completion-abi",
|
||||||
|
"id": "1897e2d634227fce344878e2",
|
||||||
|
"model": "openai/gpt-5.6-sol",
|
||||||
|
"next_action": "Create a fresh owned capture directory and rerun hash-bound objdump windows 0x00885380..0x0088544a, 0x00884cb0..0x00884d8f, 0x00779850..0x00779a20 and 0x00629580..0x006295ca.",
|
||||||
|
"role": "analyst",
|
||||||
|
"schema": "sots-checkpoint/1",
|
||||||
|
"session": "run-16f8e9b6376b278c4870be09",
|
||||||
|
"summary": "RECOVERY/PRE-EXPERIMENT. Static authority read: campaign README, current workflow, contract, resolver checkpoint, all surprise statuses, decision d-b51f3f76803e852ed250846a, prior handoff and raw manifests. Observation: no open surprises; contract is needs-revision and assigns only campaign/research/research-completion-abi.md plus verify/results/research-completion-abi/. Resolver overturned only the claim that miss-path temporary EvTurn starts/copies zero; it preserved, for valid containers and normally returning helpers, the get/create ABI, full last-match scan, vptr/empty nested header, scalar copy plus nested deep-copy, cleanup-before-final requested-turn store and final EAX bucket. Observation: assigned engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23/common /home/alex/sots-engine/.git and RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7/common /home/alex/sots-re/.git match baselines. Both worktrees contain pre-existing dirty/untracked files; no changes attributed to this quantum. Fresh source binding exactly matches prior engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd and RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Fresh hashes: owner binary 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841; /usr/bin/objdump 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd, GNU Binutils 2.38. Decision: run one read-only local static experiment reproducing four corrected-domain windows: complete get/create, append, nested empty-copy path, and temporary cleanup. No VM/Ghidra/build-host lease held or needed; no game execution, mutation, delegation, staging or commit. Blockers remain live allocator safety/failure/unwind execution and independent reproduction; this analyst will not promote its own claim.",
|
||||||
|
"timestamp": "2026-09-10T04:24:41.792903+00:00"
|
||||||
|
}
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
{
|
{
|
||||||
"contract": "research-completion-abi",
|
"contract": "research-completion-abi",
|
||||||
"run": "run-d94d4516b9d898793318805e",
|
"run": "run-16f8e9b6376b278c4870be09",
|
||||||
"status": "complete"
|
"status": "complete"
|
||||||
}
|
}
|
||||||
|
|
|
||||||
10361
campaign/runtime/runs/run-16f8e9b6376b278c4870be09.json
Normal file
10361
campaign/runtime/runs/run-16f8e9b6376b278c4870be09.json
Normal file
File diff suppressed because it is too large
Load diff
91
campaign/runtime/runs/run-16f8e9b6376b278c4870be09.jsonl
Normal file
91
campaign/runtime/runs/run-16f8e9b6376b278c4870be09.jsonl
Normal file
File diff suppressed because one or more lines are too long
|
|
@ -63,10 +63,14 @@ convert the static interpretations below into live allocator-safety or accepted
|
||||||
hit returns the **last** matching bucket and performs no construction, allocation, ID update, or
|
hit returns the **last** matching bucket and performs no construction, allocation, ID update, or
|
||||||
RNG draw.
|
RNG draw.
|
||||||
* On a miss it initializes a stack `TurnEvents` with vptr `0x00a0f07c` and zero nested-vector
|
* On a miss it initializes a stack `TurnEvents` with vptr `0x00a0f07c` and zero nested-vector
|
||||||
pointers, then calls outer `vector<TurnEvents>::push_back` at `0x00884cb0`. Only after append does
|
pointers, but does **not** initialize the temporary `EvTurn` at `+4` (`[EBP-0x20]`). It then calls
|
||||||
it write the requested turn to the stored element at `_Mylast[-1]+4`. It destroys the temporary's
|
outer `vector<TurnEvents>::push_back` at `0x00884cb0`; append copies that incoming stack word as its
|
||||||
nested vector through `0x00629580` and returns the new element. The temporary itself starts with
|
scalar `EvTurn` before deep-copying the nested vector. Get/create destroys the temporary's nested
|
||||||
turn zero; append deep-copies that zero before the stored turn is patched.
|
vector through `0x00629580`, only then writes the requested turn to the stored element at
|
||||||
|
`_Mylast[-1]+4`, and returns the new element. The transient word is not measured randomness or
|
||||||
|
necessarily nonzero; do not infer a zero default. This correction and its fresh four-window
|
||||||
|
reproduction are in `run-16f8e9b6376b278c4870be09/` under decision
|
||||||
|
`d-b51f3f76803e852ed250846a`.
|
||||||
* `0x00884cb0` is ECX receiver plus one source pointer and `ret 4`; stride is `0x18`. It handles a
|
* `0x00884cb0` is ECX receiver plus one source pointer and `ret 4`; stride is `0x18`. It handles a
|
||||||
source pointer inside its own vector separately so growth cannot invalidate the source. Both
|
source pointer inside its own vector separately so growth cannot invalidate the source. Both
|
||||||
branches install the TurnEvents vptr, copy `EvTurn`, and copy-construct the nested PlayerEvent
|
branches install the TurnEvents vptr, copy `EvTurn`, and copy-construct the nested PlayerEvent
|
||||||
|
|
@ -151,6 +155,9 @@ remain part of the caller-level behavior documented in `findings/subsystems/even
|
||||||
4. `EvDsc` equality participation is now statically pinned, but has not been exercised in a live
|
4. `EvDsc` equality participation is now statically pinned, but has not been exercised in a live
|
||||||
same-bucket description-only fixture. Independent review must reproduce the complete helper and
|
same-bucket description-only fixture. Independent review must reproduce the complete helper and
|
||||||
branch windows before this becomes accepted ABI evidence.
|
branch windows before this becomes accepted ABI evidence.
|
||||||
|
5. The corrected TurnEvents miss path has a fresh analyst reproduction, not independent
|
||||||
|
reproduction. Full/spare outer capacity, nonempty nested copy, transient observation and
|
||||||
|
failure/unwind remain unexecuted; final requested-turn publication does not certify those paths.
|
||||||
|
|
||||||
Independent cross-check captures: `verify/results/research-callback/observed-copy-helper-objdump.txt`
|
Independent cross-check captures: `verify/results/research-callback/observed-copy-helper-objdump.txt`
|
||||||
and `event-copy-helper-objdump.txt`. The PlayerEvent copy operation is different: ECX is the
|
and `event-copy-helper-objdump.txt`. The PlayerEvent copy operation is different: ECX is the
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,94 @@
|
||||||
|
#!/usr/bin/env python3
|
||||||
|
"""Capture the four read-only windows required by decision d-b51f3f76803e852ed250846a."""
|
||||||
|
|
||||||
|
import hashlib
|
||||||
|
import json
|
||||||
|
import subprocess
|
||||||
|
from datetime import datetime, timezone
|
||||||
|
from pathlib import Path
|
||||||
|
|
||||||
|
ROOT = Path("/home/alex/sots-re")
|
||||||
|
OUT = ROOT / "verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09"
|
||||||
|
BINARY = ROOT / "dumps/sots.exe"
|
||||||
|
TOOL = Path("/usr/bin/objdump")
|
||||||
|
|
||||||
|
WINDOWS = (
|
||||||
|
("turn-get-create", "0x00885380", "0x0088544a"),
|
||||||
|
("turn-append", "0x00884cb0", "0x00884d8f"),
|
||||||
|
("nested-copy", "0x00779850", "0x00779a20"),
|
||||||
|
("nested-dtor", "0x00629580", "0x006295ca"),
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
def digest(data: bytes) -> str:
|
||||||
|
return hashlib.sha256(data).hexdigest()
|
||||||
|
|
||||||
|
|
||||||
|
def file_digest(path: Path) -> str:
|
||||||
|
return digest(path.read_bytes())
|
||||||
|
|
||||||
|
|
||||||
|
records = []
|
||||||
|
for name, start, stop in WINDOWS:
|
||||||
|
argv = [str(TOOL), "-D", "-Mintel", f"--start-address={start}",
|
||||||
|
f"--stop-address={stop}", str(BINARY)]
|
||||||
|
proc = subprocess.run(argv, cwd=ROOT, check=False, capture_output=True)
|
||||||
|
stdout_path = OUT / f"{name}.stdout.txt"
|
||||||
|
stderr_path = OUT / f"{name}.stderr.txt"
|
||||||
|
stdout_path.write_bytes(proc.stdout)
|
||||||
|
stderr_path.write_bytes(proc.stderr)
|
||||||
|
records.append({
|
||||||
|
"name": name,
|
||||||
|
"argv": argv,
|
||||||
|
"cwd": str(ROOT),
|
||||||
|
"start": start,
|
||||||
|
"stop": stop,
|
||||||
|
"returncode": proc.returncode,
|
||||||
|
"stdout": {
|
||||||
|
"path": str(stdout_path.relative_to(ROOT)),
|
||||||
|
"bytes": len(proc.stdout),
|
||||||
|
"sha256": digest(proc.stdout),
|
||||||
|
},
|
||||||
|
"stderr": {
|
||||||
|
"path": str(stderr_path.relative_to(ROOT)),
|
||||||
|
"bytes": len(proc.stderr),
|
||||||
|
"sha256": digest(proc.stderr),
|
||||||
|
},
|
||||||
|
})
|
||||||
|
|
||||||
|
version = subprocess.run([str(TOOL), "--version"], check=True,
|
||||||
|
capture_output=True, text=True).stdout.splitlines()[0]
|
||||||
|
manifest = {
|
||||||
|
"schema": "sots-abi-static-capture/1",
|
||||||
|
"session": "run-16f8e9b6376b278c4870be09",
|
||||||
|
"actor": "research-abi-analyst",
|
||||||
|
"role": "analyst",
|
||||||
|
"model": "openai/gpt-5.6-sol",
|
||||||
|
"timestamp": datetime.now(timezone.utc).isoformat(),
|
||||||
|
"scope": "Fresh read-only correction capture required by d-b51f3f76803e852ed250846a; no game execution or live allocator claim.",
|
||||||
|
"source_binding": {
|
||||||
|
"engine": {
|
||||||
|
"path": "/tmp/opencode/sots-final-research-engine",
|
||||||
|
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||||
|
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd",
|
||||||
|
},
|
||||||
|
"re": {
|
||||||
|
"path": "/tmp/opencode/sots-final-research-re",
|
||||||
|
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||||
|
"sha256": "6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
"input": {
|
||||||
|
"path": "dumps/sots.exe",
|
||||||
|
"bytes": BINARY.stat().st_size,
|
||||||
|
"sha256": file_digest(BINARY),
|
||||||
|
},
|
||||||
|
"tool": {
|
||||||
|
"path": str(TOOL),
|
||||||
|
"bytes": TOOL.stat().st_size,
|
||||||
|
"sha256": file_digest(TOOL),
|
||||||
|
"version": version,
|
||||||
|
},
|
||||||
|
"windows": records,
|
||||||
|
}
|
||||||
|
(OUT / "manifest.json").write_text(json.dumps(manifest, indent=2) + "\n")
|
||||||
|
|
@ -0,0 +1,134 @@
|
||||||
|
{
|
||||||
|
"schema": "sots-abi-static-capture/1",
|
||||||
|
"session": "run-16f8e9b6376b278c4870be09",
|
||||||
|
"actor": "research-abi-analyst",
|
||||||
|
"role": "analyst",
|
||||||
|
"model": "openai/gpt-5.6-sol",
|
||||||
|
"timestamp": "2026-09-10T04:25:48.076637+00:00",
|
||||||
|
"scope": "Fresh read-only correction capture required by d-b51f3f76803e852ed250846a; no game execution or live allocator claim.",
|
||||||
|
"source_binding": {
|
||||||
|
"engine": {
|
||||||
|
"path": "/tmp/opencode/sots-final-research-engine",
|
||||||
|
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
|
||||||
|
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
|
||||||
|
},
|
||||||
|
"re": {
|
||||||
|
"path": "/tmp/opencode/sots-final-research-re",
|
||||||
|
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
|
||||||
|
"sha256": "6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"input": {
|
||||||
|
"path": "dumps/sots.exe",
|
||||||
|
"bytes": 7898624,
|
||||||
|
"sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841"
|
||||||
|
},
|
||||||
|
"tool": {
|
||||||
|
"path": "/usr/bin/objdump",
|
||||||
|
"bytes": 373888,
|
||||||
|
"sha256": "1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd",
|
||||||
|
"version": "GNU objdump (GNU Binutils for Ubuntu) 2.38"
|
||||||
|
},
|
||||||
|
"windows": [
|
||||||
|
{
|
||||||
|
"name": "turn-get-create",
|
||||||
|
"argv": [
|
||||||
|
"/usr/bin/objdump",
|
||||||
|
"-D",
|
||||||
|
"-Mintel",
|
||||||
|
"--start-address=0x00885380",
|
||||||
|
"--stop-address=0x0088544a",
|
||||||
|
"/home/alex/sots-re/dumps/sots.exe"
|
||||||
|
],
|
||||||
|
"cwd": "/home/alex/sots-re",
|
||||||
|
"start": "0x00885380",
|
||||||
|
"stop": "0x0088544a",
|
||||||
|
"returncode": 0,
|
||||||
|
"stdout": {
|
||||||
|
"path": "verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09/turn-get-create.stdout.txt",
|
||||||
|
"bytes": 3974,
|
||||||
|
"sha256": "f6e72ba9b08fdf48d70f39379b2fb30a5adbe796072485f70c5795c10ab45ca3"
|
||||||
|
},
|
||||||
|
"stderr": {
|
||||||
|
"path": "verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09/turn-get-create.stderr.txt",
|
||||||
|
"bytes": 0,
|
||||||
|
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "turn-append",
|
||||||
|
"argv": [
|
||||||
|
"/usr/bin/objdump",
|
||||||
|
"-D",
|
||||||
|
"-Mintel",
|
||||||
|
"--start-address=0x00884cb0",
|
||||||
|
"--stop-address=0x00884d8f",
|
||||||
|
"/home/alex/sots-re/dumps/sots.exe"
|
||||||
|
],
|
||||||
|
"cwd": "/home/alex/sots-re",
|
||||||
|
"start": "0x00884cb0",
|
||||||
|
"stop": "0x00884d8f",
|
||||||
|
"returncode": 0,
|
||||||
|
"stdout": {
|
||||||
|
"path": "verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09/turn-append.stdout.txt",
|
||||||
|
"bytes": 4179,
|
||||||
|
"sha256": "57d6655feed0fc137bb2b7eee4bfcb09536b5a715603c917ee142770f1d52a15"
|
||||||
|
},
|
||||||
|
"stderr": {
|
||||||
|
"path": "verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09/turn-append.stderr.txt",
|
||||||
|
"bytes": 0,
|
||||||
|
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "nested-copy",
|
||||||
|
"argv": [
|
||||||
|
"/usr/bin/objdump",
|
||||||
|
"-D",
|
||||||
|
"-Mintel",
|
||||||
|
"--start-address=0x00779850",
|
||||||
|
"--stop-address=0x00779a20",
|
||||||
|
"/home/alex/sots-re/dumps/sots.exe"
|
||||||
|
],
|
||||||
|
"cwd": "/home/alex/sots-re",
|
||||||
|
"start": "0x00779850",
|
||||||
|
"stop": "0x00779a20",
|
||||||
|
"returncode": 0,
|
||||||
|
"stdout": {
|
||||||
|
"path": "verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09/nested-copy.stdout.txt",
|
||||||
|
"bytes": 8469,
|
||||||
|
"sha256": "e3988aa615066dce65ec16de0d61051ffc5deafe8c8eef4aeb0bbfbe931204a1"
|
||||||
|
},
|
||||||
|
"stderr": {
|
||||||
|
"path": "verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09/nested-copy.stderr.txt",
|
||||||
|
"bytes": 0,
|
||||||
|
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"name": "nested-dtor",
|
||||||
|
"argv": [
|
||||||
|
"/usr/bin/objdump",
|
||||||
|
"-D",
|
||||||
|
"-Mintel",
|
||||||
|
"--start-address=0x00629580",
|
||||||
|
"--stop-address=0x006295ca",
|
||||||
|
"/home/alex/sots-re/dumps/sots.exe"
|
||||||
|
],
|
||||||
|
"cwd": "/home/alex/sots-re",
|
||||||
|
"start": "0x00629580",
|
||||||
|
"stop": "0x006295ca",
|
||||||
|
"returncode": 0,
|
||||||
|
"stdout": {
|
||||||
|
"path": "verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09/nested-dtor.stdout.txt",
|
||||||
|
"bytes": 1727,
|
||||||
|
"sha256": "3c38887e60d009ab904772b13be93ac1eedd9bee85024e37110160a625db3a83"
|
||||||
|
},
|
||||||
|
"stderr": {
|
||||||
|
"path": "verify/results/research-completion-abi/run-16f8e9b6376b278c4870be09/nested-dtor.stderr.txt",
|
||||||
|
"bytes": 0,
|
||||||
|
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,175 @@
|
||||||
|
|
||||||
|
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
|
||||||
|
|
||||||
|
|
||||||
|
Disassembly of section .text:
|
||||||
|
|
||||||
|
00779850 <.text+0x378850>:
|
||||||
|
779850: 55 push ebp
|
||||||
|
779851: 8b ec mov ebp,esp
|
||||||
|
779853: 6a ff push 0xffffffff
|
||||||
|
779855: 68 10 7b 98 00 push 0x987b10
|
||||||
|
77985a: 64 a1 00 00 00 00 mov eax,fs:0x0
|
||||||
|
779860: 50 push eax
|
||||||
|
779861: 83 ec 08 sub esp,0x8
|
||||||
|
779864: 53 push ebx
|
||||||
|
779865: 56 push esi
|
||||||
|
779866: 57 push edi
|
||||||
|
779867: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
||||||
|
77986c: 33 c5 xor eax,ebp
|
||||||
|
77986e: 50 push eax
|
||||||
|
77986f: 8d 45 f4 lea eax,[ebp-0xc]
|
||||||
|
779872: 64 a3 00 00 00 00 mov fs:0x0,eax
|
||||||
|
779878: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
|
||||||
|
77987b: 8b f1 mov esi,ecx
|
||||||
|
77987d: 89 75 ec mov DWORD PTR [ebp-0x14],esi
|
||||||
|
779880: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
|
||||||
|
779883: 33 c0 xor eax,eax
|
||||||
|
779885: 89 06 mov DWORD PTR [esi],eax
|
||||||
|
779887: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
||||||
|
77988a: 89 46 08 mov DWORD PTR [esi+0x8],eax
|
||||||
|
77988d: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
|
||||||
|
779890: 2b 0b sub ecx,DWORD PTR [ebx]
|
||||||
|
779892: b8 09 cb 3d 8d mov eax,0x8d3dcb09
|
||||||
|
779897: f7 e9 imul ecx
|
||||||
|
779899: 03 d1 add edx,ecx
|
||||||
|
77989b: c1 fa 06 sar edx,0x6
|
||||||
|
77989e: 8b fa mov edi,edx
|
||||||
|
7798a0: b8 00 00 00 00 mov eax,0x0
|
||||||
|
7798a5: c1 ef 1f shr edi,0x1f
|
||||||
|
7798a8: 03 fa add edi,edx
|
||||||
|
7798aa: 89 06 mov DWORD PTR [esi],eax
|
||||||
|
7798ac: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
||||||
|
7798af: 89 46 08 mov DWORD PTR [esi+0x8],eax
|
||||||
|
7798b2: 74 4b je 0x7798ff
|
||||||
|
7798b4: 81 ff 2c f7 34 02 cmp edi,0x234f72c
|
||||||
|
7798ba: 76 0b jbe 0x7798c7
|
||||||
|
7798bc: 68 90 1f 9e 00 push 0x9e1f90
|
||||||
|
7798c1: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
|
||||||
|
7798c7: 8d 4e 0c lea ecx,[esi+0xc]
|
||||||
|
7798ca: 57 push edi
|
||||||
|
7798cb: e8 70 16 01 00 call 0x78af40
|
||||||
|
7798d0: 6b ff 74 imul edi,edi,0x74
|
||||||
|
7798d3: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
|
||||||
|
7798d6: 52 push edx
|
||||||
|
7798d7: 8d 56 0c lea edx,[esi+0xc]
|
||||||
|
7798da: 52 push edx
|
||||||
|
7798db: 03 f8 add edi,eax
|
||||||
|
7798dd: 89 06 mov DWORD PTR [esi],eax
|
||||||
|
7798df: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
||||||
|
7798e2: 89 7e 08 mov DWORD PTR [esi+0x8],edi
|
||||||
|
7798e5: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
|
||||||
|
7798e8: 8b 1b mov ebx,DWORD PTR [ebx]
|
||||||
|
7798ea: 50 push eax
|
||||||
|
7798eb: 51 push ecx
|
||||||
|
7798ec: 53 push ebx
|
||||||
|
7798ed: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
|
||||||
|
7798f4: e8 a7 8c ff ff call 0x7725a0
|
||||||
|
7798f9: 83 c4 14 add esp,0x14
|
||||||
|
7798fc: 89 46 04 mov DWORD PTR [esi+0x4],eax
|
||||||
|
7798ff: 8b c6 mov eax,esi
|
||||||
|
779901: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
||||||
|
779904: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
||||||
|
77990b: 59 pop ecx
|
||||||
|
77990c: 5f pop edi
|
||||||
|
77990d: 5e pop esi
|
||||||
|
77990e: 5b pop ebx
|
||||||
|
77990f: 8b e5 mov esp,ebp
|
||||||
|
779911: 5d pop ebp
|
||||||
|
779912: c2 04 00 ret 0x4
|
||||||
|
779915: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14]
|
||||||
|
779918: e8 63 fc ea ff call 0x629580
|
||||||
|
77991d: 6a 00 push 0x0
|
||||||
|
77991f: 6a 00 push 0x0
|
||||||
|
779921: e8 96 b6 1a 00 call 0x924fbc
|
||||||
|
779926: cc int3
|
||||||
|
779927: cc int3
|
||||||
|
779928: cc int3
|
||||||
|
779929: cc int3
|
||||||
|
77992a: cc int3
|
||||||
|
77992b: cc int3
|
||||||
|
77992c: cc int3
|
||||||
|
77992d: cc int3
|
||||||
|
77992e: cc int3
|
||||||
|
77992f: cc int3
|
||||||
|
779930: 55 push ebp
|
||||||
|
779931: 8b ec mov ebp,esp
|
||||||
|
779933: 6a ff push 0xffffffff
|
||||||
|
779935: 68 38 06 97 00 push 0x970638
|
||||||
|
77993a: 64 a1 00 00 00 00 mov eax,fs:0x0
|
||||||
|
779940: 50 push eax
|
||||||
|
779941: 83 ec 20 sub esp,0x20
|
||||||
|
779944: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
||||||
|
779949: 33 c5 xor eax,ebp
|
||||||
|
77994b: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
|
||||||
|
77994e: 56 push esi
|
||||||
|
77994f: 50 push eax
|
||||||
|
779950: 8d 45 f4 lea eax,[ebp-0xc]
|
||||||
|
779953: 64 a3 00 00 00 00 mov fs:0x0,eax
|
||||||
|
779959: 8b f1 mov esi,ecx
|
||||||
|
77995b: 8b 86 8c 00 00 00 mov eax,DWORD PTR [esi+0x8c]
|
||||||
|
779961: 85 c0 test eax,eax
|
||||||
|
779963: 75 0c jne 0x779971
|
||||||
|
779965: 68 34 24 a2 00 push 0xa22434
|
||||||
|
77996a: e8 e1 05 14 00 call 0x8b9f50
|
||||||
|
77996f: eb 7e jmp 0x7799ef
|
||||||
|
779971: 50 push eax
|
||||||
|
779972: e8 09 cc c9 ff call 0x416580
|
||||||
|
779977: 83 c4 04 add esp,0x4
|
||||||
|
77997a: 85 c0 test eax,eax
|
||||||
|
77997c: 74 0c je 0x77998a
|
||||||
|
77997e: 68 f8 23 a2 00 push 0xa223f8
|
||||||
|
779983: e8 58 08 14 00 call 0x8ba1e0
|
||||||
|
779988: eb 65 jmp 0x7799ef
|
||||||
|
77998a: e8 d1 58 dc ff call 0x53f260
|
||||||
|
77998f: c7 45 e8 0f 00 00 00 mov DWORD PTR [ebp-0x18],0xf
|
||||||
|
779996: c7 45 e4 00 00 00 00 mov DWORD PTR [ebp-0x1c],0x0
|
||||||
|
77999d: c6 45 d4 00 mov BYTE PTR [ebp-0x2c],0x0
|
||||||
|
7799a1: 8d 4d d4 lea ecx,[ebp-0x2c]
|
||||||
|
7799a4: 51 push ecx
|
||||||
|
7799a5: 50 push eax
|
||||||
|
7799a6: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
|
||||||
|
7799ad: e8 fe 52 dc ff call 0x53ecb0
|
||||||
|
7799b2: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
|
||||||
|
7799b5: 83 c4 08 add esp,0x8
|
||||||
|
7799b8: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
|
||||||
|
7799bc: 73 03 jae 0x7799c1
|
||||||
|
7799be: 8d 45 d4 lea eax,[ebp-0x2c]
|
||||||
|
7799c1: 8b 96 8c 00 00 00 mov edx,DWORD PTR [esi+0x8c]
|
||||||
|
7799c7: 6a 00 push 0x0
|
||||||
|
7799c9: 56 push esi
|
||||||
|
7799ca: 68 a0 8d 77 00 push 0x778da0
|
||||||
|
7799cf: 68 e0 ea 76 00 push 0x76eae0
|
||||||
|
7799d4: 6a 00 push 0x0
|
||||||
|
7799d6: 50 push eax
|
||||||
|
7799d7: 52 push edx
|
||||||
|
7799d8: e8 f3 d7 c9 ff call 0x4171d0
|
||||||
|
7799dd: 83 c4 1c add esp,0x1c
|
||||||
|
7799e0: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
|
||||||
|
7799e4: 72 0c jb 0x7799f2
|
||||||
|
7799e6: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
|
||||||
|
7799e9: 50 push eax
|
||||||
|
7799ea: e8 bb b5 1a 00 call 0x924faa
|
||||||
|
7799ef: 83 c4 04 add esp,0x4
|
||||||
|
7799f2: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
||||||
|
7799f5: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
||||||
|
7799fc: 59 pop ecx
|
||||||
|
7799fd: 5e pop esi
|
||||||
|
7799fe: 8b 4d f0 mov ecx,DWORD PTR [ebp-0x10]
|
||||||
|
779a01: 33 cd xor ecx,ebp
|
||||||
|
779a03: e8 7a b3 1a 00 call 0x924d82
|
||||||
|
779a08: 8b e5 mov esp,ebp
|
||||||
|
779a0a: 5d pop ebp
|
||||||
|
779a0b: c3 ret
|
||||||
|
779a0c: cc int3
|
||||||
|
779a0d: cc int3
|
||||||
|
779a0e: cc int3
|
||||||
|
779a0f: cc int3
|
||||||
|
779a10: 53 push ebx
|
||||||
|
779a11: 56 push esi
|
||||||
|
779a12: 8b f1 mov esi,ecx
|
||||||
|
779a14: 57 push edi
|
||||||
|
779a15: 8b be 24 01 00 00 mov edi,DWORD PTR [esi+0x124]
|
||||||
|
779a1b: 33 db xor ebx,ebx
|
||||||
|
779a1d: 3b fb cmp edi,ebx
|
||||||
|
779a1f: 74 je 0x779a31
|
||||||
|
|
@ -0,0 +1,39 @@
|
||||||
|
|
||||||
|
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
|
||||||
|
|
||||||
|
|
||||||
|
Disassembly of section .text:
|
||||||
|
|
||||||
|
00629580 <.text+0x228580>:
|
||||||
|
629580: 57 push edi
|
||||||
|
629581: 8b f9 mov edi,ecx
|
||||||
|
629583: 83 3f 00 cmp DWORD PTR [edi],0x0
|
||||||
|
629586: 74 36 je 0x6295be
|
||||||
|
629588: 53 push ebx
|
||||||
|
629589: 56 push esi
|
||||||
|
62958a: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c
|
||||||
|
629590: 8b 5f 04 mov ebx,DWORD PTR [edi+0x4]
|
||||||
|
629593: 8b 37 mov esi,DWORD PTR [edi]
|
||||||
|
629595: 3b f3 cmp esi,ebx
|
||||||
|
629597: 74 18 je 0x6295b1
|
||||||
|
629599: 8d a4 24 00 00 00 00 lea esp,[esp+0x0]
|
||||||
|
6295a0: 8b 06 mov eax,DWORD PTR [esi]
|
||||||
|
6295a2: 8b 10 mov edx,DWORD PTR [eax]
|
||||||
|
6295a4: 6a 00 push 0x0
|
||||||
|
6295a6: 8b ce mov ecx,esi
|
||||||
|
6295a8: ff d2 call edx
|
||||||
|
6295aa: 83 c6 74 add esi,0x74
|
||||||
|
6295ad: 3b f3 cmp esi,ebx
|
||||||
|
6295af: 75 ef jne 0x6295a0
|
||||||
|
6295b1: 8b 07 mov eax,DWORD PTR [edi]
|
||||||
|
6295b3: 50 push eax
|
||||||
|
6295b4: e8 f1 b9 2f 00 call 0x924faa
|
||||||
|
6295b9: 83 c4 04 add esp,0x4
|
||||||
|
6295bc: 5e pop esi
|
||||||
|
6295bd: 5b pop ebx
|
||||||
|
6295be: 33 c0 xor eax,eax
|
||||||
|
6295c0: 89 07 mov DWORD PTR [edi],eax
|
||||||
|
6295c2: 89 47 04 mov DWORD PTR [edi+0x4],eax
|
||||||
|
6295c5: 89 47 08 mov DWORD PTR [edi+0x8],eax
|
||||||
|
6295c8: 5f pop edi
|
||||||
|
6295c9: c3 ret
|
||||||
|
|
@ -0,0 +1,64 @@
|
||||||
|
# TurnEvents miss-path correction capture
|
||||||
|
|
||||||
|
This is a **fresh static measurement**, not live execution, allocator-safety evidence, independent
|
||||||
|
verification, or replacement acceptance. It implements the read-only analyst repair required by
|
||||||
|
Astra decision `d-b51f3f76803e852ed250846a`.
|
||||||
|
|
||||||
|
## Provenance and positive execution
|
||||||
|
|
||||||
|
`manifest.json` records four GNU objdump 2.38 invocations. Each returned zero, emitted nonempty
|
||||||
|
stdout and empty stderr. The freshly hashed inputs are:
|
||||||
|
|
||||||
|
* owner-supplied `dumps/sots.exe`: SHA-256
|
||||||
|
`970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841`;
|
||||||
|
* `/usr/bin/objdump`: SHA-256
|
||||||
|
`1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd`;
|
||||||
|
* assigned engine source binding:
|
||||||
|
`ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd`;
|
||||||
|
* assigned RE source binding:
|
||||||
|
`6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8`.
|
||||||
|
|
||||||
|
All four stdout hashes equal the corresponding records in the historical bridge manifest
|
||||||
|
`run-472955e277202c411388c66b/manifest.json`. This is same-tool/same-binary reproduction by the ABI
|
||||||
|
analyst, not the required independent-verifier reproduction.
|
||||||
|
|
||||||
|
## Recorded instruction facts
|
||||||
|
|
||||||
|
For valid containers and normally returning callees:
|
||||||
|
|
||||||
|
1. Complete get/create entry `0x00885380..0x0088544a` reserves stack space but does not initialize
|
||||||
|
`[EBP-0x20]`, the temporary `TurnEvents+4` / `EvTurn` word. The miss path writes the vptr at
|
||||||
|
`[EBP-0x24]`, nested-vector pointers at `-0x1c/-0x18/-0x14`, and EH state at `-4`.
|
||||||
|
2. Append's external-source branch at `0x00884d62..0x00884d73` loads source `+4`, stores it to
|
||||||
|
destination `+4`, then invokes nested-vector copy. It advances `_Mylast` at `0x00884d78`.
|
||||||
|
3. Nested copy `0x00779850` first zeros all three destination pointers. Its empty-source branch at
|
||||||
|
`0x007798b2` reaches the return without allocation; a nonempty source instead allocates and
|
||||||
|
range-copy-constructs `0x74`-byte `PlayerEvent` elements. The captured unwind edge calls
|
||||||
|
`0x00629580`; no throw was executed.
|
||||||
|
4. Get/create calls temporary nested-vector cleanup at `0x00885422`, then writes the requested turn
|
||||||
|
into the stored last element at `0x0088542d`, then returns `_Mylast-0x18` in EAX.
|
||||||
|
5. Cleanup `0x00629580` skips destruction/free for a null first pointer; otherwise it invokes each
|
||||||
|
`0x74`-stride element's virtual destructor, calls `0x00924faa` on the nested allocation, and in
|
||||||
|
either case zeros all three vector pointers.
|
||||||
|
|
||||||
|
## Corrected interpretation
|
||||||
|
|
||||||
|
**Decision:** describe the pre-append scalar only as an incoming stack word not initialized by this
|
||||||
|
routine. It is neither measured randomness nor necessarily nonzero. Do not encode a zero default or
|
||||||
|
attempt to reproduce an uninitialized read in clean-room code. The usable static postcondition is
|
||||||
|
that, after successful append and temporary cleanup, the stored new bucket contains the requested
|
||||||
|
turn and EAX identifies that bucket.
|
||||||
|
|
||||||
|
**Unexercised / unresolved:** full-capacity allocation at this call site, nonempty nested copy,
|
||||||
|
failure/unwind outcomes, transient observers/reentrancy, padding bytes and live CRT compatibility.
|
||||||
|
No event ID, event record, RNG, or other game state is written by get/create itself in the captured
|
||||||
|
normal path beyond outer container construction/pointers and the new bucket's fields.
|
||||||
|
|
||||||
|
## Independent falsifiers still required
|
||||||
|
|
||||||
|
The independent verifier should freshly hash the tool/binary and reproduce all four windows, then
|
||||||
|
check these distinct branches/states: existing duplicate turn buckets select the last match and do
|
||||||
|
not write; miss with spare versus full outer capacity; empty versus nonempty nested vector; and
|
||||||
|
cleanup-before-final-turn-store ordering. A future leased runtime fixture, if separately authorized,
|
||||||
|
can use distinct stack sentinels and spare/full capacity with neutral controls. Coherent parsing or
|
||||||
|
a final correct `EvTurn` alone cannot prove transient field semantics or allocator safety.
|
||||||
|
|
@ -0,0 +1,85 @@
|
||||||
|
|
||||||
|
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
|
||||||
|
|
||||||
|
|
||||||
|
Disassembly of section .text:
|
||||||
|
|
||||||
|
00884cb0 <.text+0x483cb0>:
|
||||||
|
884cb0: 55 push ebp
|
||||||
|
884cb1: 8b ec mov ebp,esp
|
||||||
|
884cb3: 6a ff push 0xffffffff
|
||||||
|
884cb5: 68 72 0b 98 00 push 0x980b72
|
||||||
|
884cba: 64 a1 00 00 00 00 mov eax,fs:0x0
|
||||||
|
884cc0: 50 push eax
|
||||||
|
884cc1: 51 push ecx
|
||||||
|
884cc2: 56 push esi
|
||||||
|
884cc3: 57 push edi
|
||||||
|
884cc4: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
||||||
|
884cc9: 33 c5 xor eax,ebp
|
||||||
|
884ccb: 50 push eax
|
||||||
|
884ccc: 8d 45 f4 lea eax,[ebp-0xc]
|
||||||
|
884ccf: 64 a3 00 00 00 00 mov fs:0x0,eax
|
||||||
|
884cd5: 8b f9 mov edi,ecx
|
||||||
|
884cd7: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
|
||||||
|
884cda: 8b 75 08 mov esi,DWORD PTR [ebp+0x8]
|
||||||
|
884cdd: 3b f1 cmp esi,ecx
|
||||||
|
884cdf: 73 59 jae 0x884d3a
|
||||||
|
884ce1: 8b 07 mov eax,DWORD PTR [edi]
|
||||||
|
884ce3: 3b c6 cmp eax,esi
|
||||||
|
884ce5: 77 53 ja 0x884d3a
|
||||||
|
884ce7: 2b f0 sub esi,eax
|
||||||
|
884ce9: b8 ab aa aa 2a mov eax,0x2aaaaaab
|
||||||
|
884cee: f7 ee imul esi
|
||||||
|
884cf0: c1 fa 02 sar edx,0x2
|
||||||
|
884cf3: 8b f2 mov esi,edx
|
||||||
|
884cf5: c1 ee 1f shr esi,0x1f
|
||||||
|
884cf8: 03 f2 add esi,edx
|
||||||
|
884cfa: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
|
||||||
|
884cfd: 75 09 jne 0x884d08
|
||||||
|
884cff: 6a 01 push 0x1
|
||||||
|
884d01: 8b cf mov ecx,edi
|
||||||
|
884d03: e8 98 f4 ff ff call 0x8841a0
|
||||||
|
884d08: 8b 0f mov ecx,DWORD PTR [edi]
|
||||||
|
884d0a: 8d 04 76 lea eax,[esi+esi*2]
|
||||||
|
884d0d: 8d 0c c1 lea ecx,[ecx+eax*8]
|
||||||
|
884d10: 8b 47 04 mov eax,DWORD PTR [edi+0x4]
|
||||||
|
884d13: 89 45 08 mov DWORD PTR [ebp+0x8],eax
|
||||||
|
884d16: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
|
||||||
|
884d19: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
|
||||||
|
884d20: 85 c0 test eax,eax
|
||||||
|
884d22: 74 54 je 0x884d78
|
||||||
|
884d24: c7 00 7c f0 a0 00 mov DWORD PTR [eax],0xa0f07c
|
||||||
|
884d2a: 8b 51 04 mov edx,DWORD PTR [ecx+0x4]
|
||||||
|
884d2d: 83 c1 08 add ecx,0x8
|
||||||
|
884d30: c6 45 fc 01 mov BYTE PTR [ebp-0x4],0x1
|
||||||
|
884d34: 89 50 04 mov DWORD PTR [eax+0x4],edx
|
||||||
|
884d37: 51 push ecx
|
||||||
|
884d38: eb 36 jmp 0x884d70
|
||||||
|
884d3a: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
|
||||||
|
884d3d: 75 09 jne 0x884d48
|
||||||
|
884d3f: 6a 01 push 0x1
|
||||||
|
884d41: 8b cf mov ecx,edi
|
||||||
|
884d43: e8 58 f4 ff ff call 0x8841a0
|
||||||
|
884d48: 8b 47 04 mov eax,DWORD PTR [edi+0x4]
|
||||||
|
884d4b: 89 45 08 mov DWORD PTR [ebp+0x8],eax
|
||||||
|
884d4e: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
|
||||||
|
884d51: c7 45 fc 02 00 00 00 mov DWORD PTR [ebp-0x4],0x2
|
||||||
|
884d58: 85 c0 test eax,eax
|
||||||
|
884d5a: 74 1c je 0x884d78
|
||||||
|
884d5c: c7 00 7c f0 a0 00 mov DWORD PTR [eax],0xa0f07c
|
||||||
|
884d62: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4]
|
||||||
|
884d65: 83 c6 08 add esi,0x8
|
||||||
|
884d68: c6 45 fc 03 mov BYTE PTR [ebp-0x4],0x3
|
||||||
|
884d6c: 89 48 04 mov DWORD PTR [eax+0x4],ecx
|
||||||
|
884d6f: 56 push esi
|
||||||
|
884d70: 8d 48 08 lea ecx,[eax+0x8]
|
||||||
|
884d73: e8 d8 4a ef ff call 0x779850
|
||||||
|
884d78: 83 47 04 18 add DWORD PTR [edi+0x4],0x18
|
||||||
|
884d7c: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
||||||
|
884d7f: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
||||||
|
884d86: 59 pop ecx
|
||||||
|
884d87: 5f pop edi
|
||||||
|
884d88: 5e pop esi
|
||||||
|
884d89: 8b e5 mov esp,ebp
|
||||||
|
884d8b: 5d pop ebp
|
||||||
|
884d8c: c2 04 00 ret 0x4
|
||||||
|
|
@ -0,0 +1,83 @@
|
||||||
|
|
||||||
|
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
|
||||||
|
|
||||||
|
|
||||||
|
Disassembly of section .text:
|
||||||
|
|
||||||
|
00885380 <.text+0x484380>:
|
||||||
|
885380: 55 push ebp
|
||||||
|
885381: 8b ec mov ebp,esp
|
||||||
|
885383: 6a ff push 0xffffffff
|
||||||
|
885385: 68 30 af 99 00 push 0x99af30
|
||||||
|
88538a: 64 a1 00 00 00 00 mov eax,fs:0x0
|
||||||
|
885390: 50 push eax
|
||||||
|
885391: 83 ec 18 sub esp,0x18
|
||||||
|
885394: 53 push ebx
|
||||||
|
885395: 56 push esi
|
||||||
|
885396: 57 push edi
|
||||||
|
885397: a1 78 8b af 00 mov eax,ds:0xaf8b78
|
||||||
|
88539c: 33 c5 xor eax,ebp
|
||||||
|
88539e: 50 push eax
|
||||||
|
88539f: 8d 45 f4 lea eax,[ebp-0xc]
|
||||||
|
8853a2: 64 a3 00 00 00 00 mov fs:0x0,eax
|
||||||
|
8853a8: 8b f1 mov esi,ecx
|
||||||
|
8853aa: 8b 56 08 mov edx,DWORD PTR [esi+0x8]
|
||||||
|
8853ad: 2b 56 04 sub edx,DWORD PTR [esi+0x4]
|
||||||
|
8853b0: 8d 4e 04 lea ecx,[esi+0x4]
|
||||||
|
8853b3: b8 ab aa aa 2a mov eax,0x2aaaaaab
|
||||||
|
8853b8: f7 ea imul edx
|
||||||
|
8853ba: c1 fa 02 sar edx,0x2
|
||||||
|
8853bd: 8b c2 mov eax,edx
|
||||||
|
8853bf: c1 e8 1f shr eax,0x1f
|
||||||
|
8853c2: 33 db xor ebx,ebx
|
||||||
|
8853c4: 03 c2 add eax,edx
|
||||||
|
8853c6: 33 ff xor edi,edi
|
||||||
|
8853c8: 3b c3 cmp eax,ebx
|
||||||
|
8853ca: 7e 30 jle 0x8853fc
|
||||||
|
8853cc: 8b 11 mov edx,DWORD PTR [ecx]
|
||||||
|
8853ce: 8b ff mov edi,edi
|
||||||
|
8853d0: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
|
||||||
|
8853d3: 39 5a 04 cmp DWORD PTR [edx+0x4],ebx
|
||||||
|
8853d6: 75 02 jne 0x8853da
|
||||||
|
8853d8: 8b fa mov edi,edx
|
||||||
|
8853da: 83 c2 18 add edx,0x18
|
||||||
|
8853dd: 48 dec eax
|
||||||
|
8853de: 75 f0 jne 0x8853d0
|
||||||
|
8853e0: 33 db xor ebx,ebx
|
||||||
|
8853e2: 3b fb cmp edi,ebx
|
||||||
|
8853e4: 74 16 je 0x8853fc
|
||||||
|
8853e6: 8b c7 mov eax,edi
|
||||||
|
8853e8: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
||||||
|
8853eb: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
||||||
|
8853f2: 59 pop ecx
|
||||||
|
8853f3: 5f pop edi
|
||||||
|
8853f4: 5e pop esi
|
||||||
|
8853f5: 5b pop ebx
|
||||||
|
8853f6: 8b e5 mov esp,ebp
|
||||||
|
8853f8: 5d pop ebp
|
||||||
|
8853f9: c2 04 00 ret 0x4
|
||||||
|
8853fc: c7 45 dc 7c f0 a0 00 mov DWORD PTR [ebp-0x24],0xa0f07c
|
||||||
|
885403: 89 5d e4 mov DWORD PTR [ebp-0x1c],ebx
|
||||||
|
885406: 89 5d e8 mov DWORD PTR [ebp-0x18],ebx
|
||||||
|
885409: 89 5d ec mov DWORD PTR [ebp-0x14],ebx
|
||||||
|
88540c: 8d 45 dc lea eax,[ebp-0x24]
|
||||||
|
88540f: 50 push eax
|
||||||
|
885410: 89 5d fc mov DWORD PTR [ebp-0x4],ebx
|
||||||
|
885413: e8 98 f8 ff ff call 0x884cb0
|
||||||
|
885418: 8d 4d e4 lea ecx,[ebp-0x1c]
|
||||||
|
88541b: c7 45 fc 01 00 00 00 mov DWORD PTR [ebp-0x4],0x1
|
||||||
|
885422: e8 59 41 da ff call 0x629580
|
||||||
|
885427: 8b 46 08 mov eax,DWORD PTR [esi+0x8]
|
||||||
|
88542a: 8b 4d 08 mov ecx,DWORD PTR [ebp+0x8]
|
||||||
|
88542d: 89 48 ec mov DWORD PTR [eax-0x14],ecx
|
||||||
|
885430: 8b 46 08 mov eax,DWORD PTR [esi+0x8]
|
||||||
|
885433: 83 e8 18 sub eax,0x18
|
||||||
|
885436: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
|
||||||
|
885439: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
|
||||||
|
885440: 59 pop ecx
|
||||||
|
885441: 5f pop edi
|
||||||
|
885442: 5e pop esi
|
||||||
|
885443: 5b pop ebx
|
||||||
|
885444: 8b e5 mov esp,ebp
|
||||||
|
885446: 5d pop ebp
|
||||||
|
885447: c2 04 00 ret 0x4
|
||||||
Loading…
Add table
Reference in a new issue