diff --git a/findings/01-fingerprint.md b/findings/01-fingerprint.md
new file mode 100644
index 0000000..4f97aed
--- /dev/null
+++ b/findings/01-fingerprint.md
@@ -0,0 +1,35 @@
+# P0 — binary fingerprint
+
+Target: `Sword of the Stars.exe` (GOG Complete Collection v1.8.1, build 19833), 7.5 MB,
+extracted via innoextract to `/srv/re-lab/sots-game/`.
+
+## PE / toolchain
+- **PE32, i386 (32-bit)**, subsystem Windows GUI 5.01, 5 sections, ImageBase `0x00400000`,
+  SizeOfImage `0x007b3000`, entry `0x00925794`.
+- **Compiler: MSVC 2010 (VC++ 10.0)** — MajorLinkerVersion 10; imports `MSVCR100.dll` +
+  `MSVCP100.dll`. Resolves the earlier VS2003/2005/2008 uncertainty. Implications: **RTTI
+  present** (C++ class hierarchy recoverable), MSVC-2010 name mangling (Ghidra demangles),
+  VS2010 Dinkumware STL — expect heavily inlined `std::vector/map/string`.
+- COFF characteristics `0x12F` → includes `IMAGE_FILE_LARGE_ADDRESS_AWARE (0x20)`:
+  **LAA is already enabled in this build.** The 2 GB→4 GB mitigation is baked in; the memory
+  ceiling only needs allocator work if large-battle crashes still occur. `RELOCS_STRIPPED`
+  set (so the ASLR flag in DllCharacteristics `0x8140` is effectively inert).
+
+## Imported subsystems (from the import table)
+- **Graphics: DirectX 9** — `d3d9.dll` + `d3dx9_42.dll` (D3DX June 2010). Anchor for the
+  renderer: `Direct3DCreate9` → `CreateDevice` → present loop.
+- **Audio:** `DSOUND.dll` (DirectSound). **Video:** `binkw32.dll` (RAD Bink).
+- **Net:** `WSOCK32.dll` + `IPHLPAPI.DLL` (multiplayer).
+- Std Win32: KERNEL32, USER32, GDI32, ADVAPI32, SHELL32, SHLWAPI, WINMM, ole32.
+
+## Data
+- `sots.gob` (1.45 GB) + `sots_local_en.gob` (599 MB) — renamed uncompressed ZIPs (per
+  community docs); openable directly. Modding is `./Mods/` override.
+
+## Consequences for the plan
+- **Battle-load** becomes the primary bug target (LAA already done).
+- The RTTI analyzer should hand us the class hierarchy — the fastest path into the object
+  model (goal #1), to be cross-referenced with the community save-editor structs.
+- D3D9 device init is a clean, well-anchored first renderer target.
+
+_Fingerprint captured 2026-09-07 via objdump on CT111._