From db4fda269f0d2d4c26a3e73b8116e590c3fca3d2 Mon Sep 17 00:00:00 2001 From: alex Date: Wed, 9 Sep 2026 00:37:25 -0400 Subject: [PATCH] AR: header dates and status line --- findings/control-flow/raid-target-pick-verdict.md | 6 ++++-- ghidra/addresses.d/ar.json | 10 +++++----- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/findings/control-flow/raid-target-pick-verdict.md b/findings/control-flow/raid-target-pick-verdict.md index efb2ab8..69987f2 100644 --- a/findings/control-flow/raid-target-pick-verdict.md +++ b/findings/control-flow/raid-target-pick-verdict.md @@ -1,8 +1,10 @@ # The raid target pick — a verdict on `TradeManager+0x0c` - **Type:** control-flow (static decode of the writer + live measurement) -- **Owner / date:** lane AR · 2026-09-08 · guest **VM141** (`sots-re-win10-b`, 192.168.10.143) — - **held from the time this file was committed** +- **Owner / date:** lane AR · 2026-09-08 → 2026-09-09 · guest **VM141** (`sots-re-win10-b`, + 192.168.10.143) — held from the time the predictions were committed, **released** (§10) +- **Status:** **verified** for the verdict, for `A`'s per-fleet cost and for the oracle pair; + **one observation** of the pick itself, and the coverage limits are listed in §7 - **Decides:** lane AG's `gate-indexed-rng-audit.md` §3.3 final paragraph — *per-system containing-sector table* versus *sector-indexed vector of six* — which lane AD (`raid-gate-multiplicity.md` §4) measured and correctly reported it could not separate on sector `TradeID 832` diff --git a/ghidra/addresses.d/ar.json b/ghidra/addresses.d/ar.json index 7ab7ca4..d1c5a6c 100644 --- a/ghidra/addresses.d/ar.json +++ b/ghidra/addresses.d/ar.json @@ -6,7 +6,7 @@ "convention": "thiscall", "prototype": "void __thiscall (TradeManager* this) // 214 B, 0x00841700-0x008417d5, decoded to the next function start. THE WRITER OF TradeManager+0x0c that lane AG's gate-indexed audit section 7 lists as NOT FOUND, and it settles AG section 3.3: (1) `lea ecx,[this+0x0c]; push 0; call 0x00459f70` clears the vector; (2) resizes it to `count(([this+4])+0x40 .. +0x44)` -- the SYSTEMS vector, the very container FUN_00841cd0 indexes with rt->trfr at 0x00841d36 -- growing with vector::_Insert_n 0x0050e6a0 (fill value NULL) or shrinking with erase 0x004ddfc0; (3) walks this->+0x1c (the SECTOR vector) x sector->+0x78 (that sector's MEMBER SYSTEM vector) and executes `mov [this->+0x0c + m->+0x5c * 4], sector` at 0x008417a8. ServerSystem+0x5c is the serialised `Idx` field (objects/layouts.md, grade verified), so this is literally `containingSector[system.Idx] = sector`. CONSEQUENCE: TradeManager+0x0c is a PER-SYSTEM table whose length is BY CONSTRUCTION the length of the container trfr indexes, so Slot13RngCalleeB's bounds check G_B1a can never reject a valid trfr and 0x0088b613 is reachable. Five callers; FUN_00858a10 is the DESERIALISER (ReadInt/ReadFloat throughout, calls this at 0x00858f07), so the table is rebuilt on load", "status": "verified", - "source": "findings/control-flow/raid-target-pick-verdict.md (lane AR 2026-09-08); disassembled from dumps/sots.exe to the next function start" + "source": "findings/control-flow/raid-target-pick-verdict.md (lane AR 2026-09-09); disassembled from dumps/sots.exe to the next function start" }, { "name": "TradeManager_GetSectorForSystem", @@ -14,7 +14,7 @@ "convention": "thiscall", "prototype": "void __thiscall (TradeManager* this, ServerSystem* sys) // 83 B, RET 4. Reads TradeManager+0x0c back the same way the writer fills it: bounds-checks `sys->+0x5c` (= the `Idx` tag) against `(this->+0x10 - this->+0x0c)/4` and indexes `((TradeSector**)this->+0x0c)[sys->Idx]`, then passes `sector + 0x78` -- the sector's MEMBER SYSTEM vector, the same vector the writer iterates -- to FUN_0059ec00 with the system. Independent confirmation that +0x5c on the indexing object and +0x78 on the table element are the two halves of one relation. Tail-calls TradeManager_RebuildSystemToSectorTable 0x00841700", "status": "verified", - "source": "findings/control-flow/raid-target-pick-verdict.md (lane AR 2026-09-08)" + "source": "findings/control-flow/raid-target-pick-verdict.md (lane AR 2026-09-09)" }, { "name": "Vector_ResizePtr", @@ -22,7 +22,7 @@ "convention": "thiscall", "prototype": "void __thiscall (std::vector* this, size_t n) // RET 4. resize(n): when size > n it moves _Mylast down to _Myfirst + n (the shrink arm the trade manager uses with n = 0, i.e. clear); when size < n it calls 0x00538180 to grow", "status": "verified", - "source": "findings/control-flow/raid-target-pick-verdict.md (lane AR 2026-09-08)" + "source": "findings/control-flow/raid-target-pick-verdict.md (lane AR 2026-09-09)" }, { "name": "SpeciesDef_InterceptFlagWord", @@ -38,7 +38,7 @@ "convention": "thiscall", "prototype": "bool __thiscall (SpeciesDef* this) // 12 B: `xor eax,eax; cmp [ecx+0x144],eax; setne al; ret`. TRUE for HUMAN (species 0) and ZUUL (species 5) only. This is the third disjunct of FUN_00820af0's short-circuit, so a HUMAN raider intercepts at frac = 1.0 and the NextFloat at 0x00820c1b IS NOT DRAWN -- correcting lane AG section 3.3's committed `3 words on a success` and section 5.2's `B costs 2 on a success`, both of which hold only for a raider whose species does not set this flag", "status": "verified", - "source": "findings/control-flow/raid-target-pick-verdict.md (lane AR 2026-09-08)" + "source": "findings/control-flow/raid-target-pick-verdict.md (lane AR 2026-09-09)" }, { "name": "StarFleet_GetCrewSpeciesForIntercept", @@ -46,7 +46,7 @@ "convention": "cdecl", "prototype": "int __cdecl (StarFleet* fleet) // returns the fleet owner's species (FUN_0071e280(fleet)->+0x5c) on the default path; only when that species is 4 does it scan the fleet's ship vector (+0xa4..+0xa8) for a ship whose design->+0x14->+0xac..+0xb4 slot is non-null and return THAT record's +0x4 instead. Called TWICE from FUN_00820af0 (0x00820bcf, 0x00820bdd) -- once compared against 1, once used as the index into SpeciesDef_Table", "status": "verified", - "source": "findings/control-flow/raid-target-pick-verdict.md (lane AR 2026-09-08)" + "source": "findings/control-flow/raid-target-pick-verdict.md (lane AR 2026-09-09)" } ] }