re: recapture ABI against rebuilt source

This commit is contained in:
alex 2026-09-10 09:30:46 -04:00
parent 41a6840162
commit dc3741539d
152 changed files with 48518 additions and 6 deletions

View file

@ -21,7 +21,7 @@
"path": "/home/alex/sots-re"
}
},
"checkpoint": "campaign/runtime/checkpoints/research-completion-abi-82fa3b0a12b0863401b9b0d1.json",
"checkpoint": "campaign/runtime/checkpoints/research-completion-abi-32c9f62a4fda2ab02b29d4c4.json",
"dependencies": [
"controls-bootstrap"
],

View file

@ -20,14 +20,21 @@ package found three additional truncated historical stops (ObservedTech append/r
string allocation/replacement); their widened streams are now the byte authority. No archive
production-history inference or live-safety claim is made.
The TurnEvents correction's current-session boundary authority is
`verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/`. It supersedes the stale-session
The TurnEvents correction's historical-session boundary authority is
`verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/`. It superseded the stale-session
attribution and truncated nested-copy stream invalidated by decisions
`d-fd5aff1eaf78a8c15d96723c` and `d-0bb927e63b915c87a58d4257`. The package binds the actual session
and a fail-if-used output directory; captures complete helper authority through `0x0077992f`; and
retains `0x00779a20` as an expected-failing boundary beside complete `0x00779a21`, `0x00779a23`, and
`0x00779a28` controls plus raw bytes. It is analyst static evidence awaiting a fresh independent
verifier, not restored acceptance.
verifier, not restored acceptance. Astra decision `d-e9d6d48cd77538556d1a1c1f` later barred reuse of
that package against changed source. The current-source remeasurement is
`verify/results/research-completion-abi/run-35e59053176da458d8b46fea-repair1/`, with preflight, plan,
recipe and interpretation in the sibling `run-35e59053176da458d8b46fea-preflight.json`,
`plan-run-35e59053176da458d8b46fea.md`, `capture_run_35e59053176da458d8b46fea.py`, and
`report-run-35e59053176da458d8b46fea.md`. The unsuffixed run directory preserves a failed recipe
predicate and is not authority. The new package is analyst static evidence awaiting fresh independent
reproduction, not restored acceptance.
## Implementable machine boundaries recovered

View file

@ -0,0 +1,27 @@
{
"actor": "research-abi-analyst",
"artifacts": [
{
"path": "verify/results/research-completion-abi/run-35e59053176da458d8b46fea/manifest.json",
"sha256": "55fcc92360c26b743389059c54bd69d5a1ac8ca02e3d2e818b9283b3630d83ae"
},
{
"path": "verify/results/research-completion-abi/capture_run_35e59053176da458d8b46fea.py",
"sha256": "4f75d389312bf4ae4c72964728c34b22c6936d716a6fe0463bbc3e035c548faa"
},
{
"path": "verify/results/research-completion-abi/plan-run-35e59053176da458d8b46fea.md",
"sha256": "57d20b2a42fe2db5c1feff7c7839532a505e60305cbfeec82c40969ae73cabcf"
}
],
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
"contract": "research-completion-abi",
"id": "039880ba52a96f1378dcf974",
"model": "openai/gpt-5.6-sol",
"next_action": "Execute repaired recipe exactly: python3 verify/results/research-completion-abi/capture_run_35e59053176da458d8b46fea.py run-35e59053176da458d8b46fea",
"role": "analyst",
"schema": "sots-checkpoint/1",
"session": "run-35e59053176da458d8b46fea",
"summary": "PRE-REPAIR-EXPERIMENT CHECKPOINT. OBSERVATION: first 27-command capture executed with all commands zero, nonempty stdout, empty stderr, stable source, aligned/direct-byte controls passing, but manifest failed two recipe comparisons. Raw bad/good streams show exactly the predeclared instrument behavior: bad 0x779913 retains a truncated c2 terminal row while good 0x779915 replaces it with c2 04 00; bad 0x779a20 retains truncated 74 while good 0x779a21 replaces it with 74 10. DECISION: this is an ordinary predicate bug, not contradictory binary/ABI evidence or a surprise. Preserve failed package and manifest. Recipe now checks equal preceding rows plus explicit truncated terminal replacement and writes a distinct fail-if-exists repair1 directory. No claim is promoted from failed package. No lab/resources/leases.",
"timestamp": "2026-09-10T13:22:44.882162+00:00"
}

View file

@ -0,0 +1,23 @@
{
"actor": "research-problem-resolver",
"artifacts": [
{
"path": "verify/results/research-completion-abi-correction-verifier/verification-plan-run-d6c4dc15e9f4d15155fee856.md",
"sha256": "78e1ee70e73cf4be34884fc2073cd650ada4a20322c1ad50cb2deeb339021fbc"
},
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/nested-copy-authority.stdout.txt",
"sha256": "973c87ccab76a8454a4e43c83b59cdeace1e4f8c124c5aa9630cb956e3156bb8"
}
],
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
"contract": "research-completion-abi",
"id": "1d04a2672a212e8b1fb37297",
"model": "openai/gpt-6-astra",
"next_action": "Inspect analyst manifest, boundary raw controls and prior Astra decision, then resolve s-81ffc3041e1f07b87928e6f2 through campaign controls with explicit invalidation and a fresh verifier probe.",
"role": "resolver",
"schema": "sots-checkpoint/1",
"session": "run-ec31ee938e1f509cd7130c03",
"summary": "OBSERVATIONS: Read canonical policy, contract, checkpoint 4555678e34291015554e7e88, sole open surprise s-81ffc3041e1f07b87928e6f2, verifier plan and analyst nested-copy authority. Plan item 5 wrongly requires stop 0x00779913 to include c2 04 00 at 0x00779912; raw authority line 79 contains all three bytes through 0x00779914. No new reproduction executed. Git confirms assigned engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23/common /home/alex/sots-engine/.git and RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7/common /home/alex/sots-re/.git; both assigned roots are dirty, not clean baseline claims. Runner record confirms resolution-only requested Astra and session. Historical verifier checkpoint reports source digests engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd, RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8; not independently rehashed by resolver. DECISION pending manifest/instrument review; affected work remains blocked. Tests: read-only Git identity/status checks only. Initial relative CLI status/help command denied by overlay; canonical absolute status succeeded. No experiments, source edits, delegation, commits, staging or lab access/mutation; no lease acquired and none assumed free.",
"timestamp": "2026-09-10T13:04:37.431119+00:00"
}

View file

@ -0,0 +1,43 @@
{
"actor": "research-abi-analyst",
"artifacts": [
{
"path": "verify/results/research-completion-abi/run-35e59053176da458d8b46fea-preflight.json",
"sha256": "7ca4dc72850cb0fbef6370bfbea8ece5cf102c886a6ef99c9940108fe44501aa"
},
{
"path": "verify/results/research-completion-abi/plan-run-35e59053176da458d8b46fea.md",
"sha256": "57d20b2a42fe2db5c1feff7c7839532a505e60305cbfeec82c40969ae73cabcf"
},
{
"path": "verify/results/research-completion-abi/capture_run_35e59053176da458d8b46fea.py",
"sha256": "4f75d389312bf4ae4c72964728c34b22c6936d716a6fe0463bbc3e035c548faa"
},
{
"path": "verify/results/research-completion-abi/run-35e59053176da458d8b46fea/manifest.json",
"sha256": "55fcc92360c26b743389059c54bd69d5a1ac8ca02e3d2e818b9283b3630d83ae"
},
{
"path": "verify/results/research-completion-abi/run-35e59053176da458d8b46fea-repair1/manifest.json",
"sha256": "082207ef0c1563c59828fc15f48c4d3b2506d6af20847be0e7efd774bfb82146"
},
{
"path": "verify/results/research-completion-abi/report-run-35e59053176da458d8b46fea.md",
"sha256": "5d30cb2edbab82e28b61bb034b2242cd271b4cc38fb1c895fad5b0a00f1b1ef8"
},
{
"path": "campaign/research/research-completion-abi.md",
"sha256": "76c35015265ab07e159edf9fc53dfbd9a7a10b6f89046536998ca8e517af229e"
}
],
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
"contract": "research-completion-abi",
"id": "32c9f62a4fda2ab02b29d4c4",
"model": "openai/gpt-5.6-sol",
"next_action": "Launch a fresh independent verifier on the current e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f RE binding to predeclare and execute verifier-owned fail-if-exists static boundary/ABI reproduction plus independent turn3 save element/RNG parsing; preserve the failed analyst run and do not promote acceptance.",
"role": "analyst",
"schema": "sots-checkpoint/1",
"session": "run-35e59053176da458d8b46fea",
"summary": "QUANTUM-END CHECKPOINT. OBSERVATIONS: canonical state validates; contract remains needs-revision with no open surprises and no evidence promotion. Assigned engine/RE HEADs remain pinned 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 / 3bfde5a70d874a723e797a695bbd847fd82c0aa7, common dirs /home/alex/sots-engine/.git /home/alex/sots-re/.git, preexisting dirty and untouched. Current campaign binding remained stable before/after capture and final check: engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd, RE e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f. Preflight archives exact campaign/runner/Python/objdump/binary/recipe/save/parser hashes. Canonical controls tests ran 37/37 pass; config tests 8/8 pass; paired verify/campaign/test_controls.py remains absent and no restoration was attempted. EXPERIMENT: authoritative repair1 package ran 27 objdump commands, all zero/nonempty/empty-stderr, 118734 stdout bytes, stable source, zero failed checks. It reproduces expected truncated 0x779913 c2 versus aligned 0x779915 c2 04 00, authority 0x779930, a20/a21/a23/a28 and direct PE bytes. Static rows expose 0x2c/0x74/0x18 strides, original allocation/free thunks, deep nested copy/destruction, get/create scan/miss/copy/cleanup/turn-store ordering and description comparison. DECISION: static current-source observations support the bounded handoff only; no independent-cross-check, live allocator safety, runtime record construction, replacement or acceptance claim. Unsuffixed first run is preserved failed measurement: two recipe predicates wrongly expected omission rather than truncated-row replacement; raw behavior matched predeclared instrument expectation, repaired in distinct fail-if-exists output. Direct entries named observed/player/turn-stride are overbroad and explicitly unused; instruction rows establish strides. RUNTIME LIMITS: no live branch, allocation, throw, constructor/destructor, event/ID/container write, save parse or RNG execution. Original helpers 0x00924fb6, 0x00924faa and 0x0046f8c0 remain dependencies when called. TESTS: campaign validate pass; manifest assertions pass; source binding stable. BLOCKERS: independent criterion remains unperformed; exact PostEvent caller inputs/defaults/write order and live capacity/string/unwind states remain unresolved. RESOURCES: no leases held; no VM, Ghidra, game, build host, or lab access; no staging/commit/push.",
"timestamp": "2026-09-10T13:25:52.516269+00:00"
}

View file

@ -0,0 +1,47 @@
{
"actor": "research-problem-resolver",
"artifacts": [
{
"path": "campaign/runtime/decisions/d-6e30d172051af0385f5979eb.json",
"sha256": "c94914d5be47b93eac301e745b53ed7b1f008744a0ac90681fefc9c4f7a11327"
},
{
"path": "campaign/runtime/surprises/s-210e489610197533e4f4cce1.json",
"sha256": "2e6b3fdf239a1dbffb887cf382e0ae80823667d6cf96afd590b4057a9438502e"
},
{
"path": "verify/results/research-completion-abi-correction-verifier/verification-plan-run-d6c4dc15e9f4d15155fee856.md",
"sha256": "78e1ee70e73cf4be34884fc2073cd650ada4a20322c1ad50cb2deeb339021fbc"
},
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/manifest.json",
"sha256": "aaada07613a2d2b10d99c4b0a5ee795501a5eba13250c5d3beece587acd8d4a4"
},
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/nested-copy-authority.stdout.txt",
"sha256": "973c87ccab76a8454a4e43c83b59cdeace1e4f8c124c5aa9630cb956e3156bb8"
},
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/nested-copy-stop-a20.stdout.txt",
"sha256": "e3988aa615066dce65ec16de0d61051ffc5deafe8c8eef4aeb0bbfbe931204a1"
},
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/nested-copy-stop-a28.stdout.txt",
"sha256": "7b02af65ab916de02fc44b2004f8acedc127bf686874bd0c75d4a277c40d9560"
},
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/nested-copy-boundary-bytes.stdout.txt",
"sha256": "b2d9b57274be71fcdd853f04758bc65d701e7b4cc169d0d5ede24c8788ef82d5"
}
],
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
"contract": "research-completion-abi",
"id": "3fc22ea3c402274179ce4d1f",
"model": "openai/gpt-6-astra",
"next_action": "Lead schedule one fresh resolution-only Astra quantum to compare prior analyst/verifier RE file manifests against run-ec31ee938e1f509cd7130c03 source_before and resolve s-210e489610197533e4f4cce1 before authorizing any verifier reproduction; no source restoration or lab mutation is authorized.",
"role": "resolver",
"schema": "sots-checkpoint/1",
"session": "run-ec31ee938e1f509cd7130c03",
"summary": "END QUANTUM. OBSERVATIONS: verified assigned Git roots/common dirs and baseline HEADs engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 (/home/alex/sots-engine/.git), RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7 (/home/alex/sots-re/.git). Both preexisting dirty; no source edits made. Resolver runner source_before engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd matches analyst, but RE e97ad0ed5708a38d40294fb6cb4ba3cb49d4938710e3c01983fa055cbf22c0b9 differs from historical 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. These are runner/archived digest observations, not a resolver content rehash. Analyst manifest records binary 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841, GNU objdump 2.38 hash 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd; twelve recorded positive static subprocess captures, no runtime execution. Read raw ret and boundary byte/decoded controls; plan and authority checkpoint hashes match historical records. DECISIONS: d-6e30d172051af0385f5979eb resolves s-81ffc3041e1f07b87928e6f2, overturns verifier item 5 complete-stop 0x00779913 and unchanged-plan next action in checkpoint 4555678e34291015554e7e88. Preserve failed prediction; new 0x00779915 normal-return control is unexecuted and unblinded, not cleanup coverage or acceptance. Full authority 0x00779930 remains required. New source-drift surprise s-210e489610197533e4f4cce1 remains OPEN; contract stays BLOCKED. No independent-cross-check, runtime allocator safety, RNG measurement or replacement acceptance restored; downstream bridge/replacement stay dependency-blocked. TESTS: Git identity/status passed; campaign validate research-completion-abi passed after decision. No disassembly/save experiment, build, game, allocator or lab execution this session. No lease held/acquired; lease inventory inspected only, no resource availability assumed; no access changes or cleanup needed. No delegation, implementation/architecture edits, staging, commit or push. Only campaign controls wrote state. Initial relative CLI command denied; no permissions bypass attempted. Integrator must link actual decision and regenerate projections after valid integration, not write a parallel board history. BLOCKER: unexplained current RE source-manifest delta; preserve old evidence, do not rebind it. Bounded stop now.",
"timestamp": "2026-09-10T13:07:03.524603+00:00"
}

View file

@ -0,0 +1,19 @@
{
"actor": "research-abi-correction-verifier",
"artifacts": [
{
"path": "verify/results/research-completion-abi-correction-verifier/verification-plan-run-d6c4dc15e9f4d15155fee856.md",
"sha256": "78e1ee70e73cf4be34884fc2073cd650ada4a20322c1ad50cb2deeb339021fbc"
}
],
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
"contract": "research-completion-abi",
"id": "4555678e34291015554e7e88",
"model": "openai/gpt-5.6-sol",
"next_action": "Create and run the independent fail-if-exists static/save reproduction for session run-d6c4dc15e9f4d15155fee856.",
"role": "verifier",
"schema": "sots-checkpoint/1",
"session": "run-d6c4dc15e9f4d15155fee856",
"summary": "OBSERVATIONS: canonical policy, contract, lead checkpoint, all 13 surprise records, relevant Astra decisions, handoff and raw manifests were read. Contract validates in verification with no open surprises. Assigned engine HEAD 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 and RE HEAD 3bfde5a70d874a723e797a695bbd847fd82c0aa7 match baselines and common dirs /home/alex/sots-engine/.git and /home/alex/sots-re/.git. Paired source binding independently remeasured as engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd and RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8, matching analyst manifest despite dirty worktrees. Binary SHA256 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841 and objdump SHA256 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd/version 2.38 match. Handoff artifacts rehash exactly. No resource lease acquired or lab mutation performed. DECISIONS: verification remains static reproduction plus archived serialized-state checking only; no live allocator safety, original-assisted compare, replacement, or integrated replay claim. Pre-experiment falsifiers and required distinct states/branches are persisted in the attached verifier-owned plan. BLOCKERS/LIMITS: contract evidence array is empty; analyst package itself states runtime capacity/string/unwind states unavailable. Canonical integrated tree is dirty at HEAD 41a6840 but is not the assigned source binding.",
"timestamp": "2026-09-10T05:26:16.270911+00:00"
}

View file

@ -0,0 +1,27 @@
{
"actor": "research-abi-analyst",
"artifacts": [
{
"path": "verify/results/research-completion-abi/run-35e59053176da458d8b46fea-preflight.json",
"sha256": "7ca4dc72850cb0fbef6370bfbea8ece5cf102c886a6ef99c9940108fe44501aa"
},
{
"path": "verify/results/research-completion-abi/plan-run-35e59053176da458d8b46fea.md",
"sha256": "57d20b2a42fe2db5c1feff7c7839532a505e60305cbfeec82c40969ae73cabcf"
},
{
"path": "verify/results/research-completion-abi/capture_run_35e59053176da458d8b46fea.py",
"sha256": "e7f6b20f28e21e539714751025873768923fd5dabdb4156d017173cd382647f8"
}
],
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
"contract": "research-completion-abi",
"id": "635032703dbd08885360c149",
"model": "openai/gpt-5.6-sol",
"next_action": "Execute exactly: python3 verify/results/research-completion-abi/capture_run_35e59053176da458d8b46fea.py run-35e59053176da458d8b46fea",
"role": "analyst",
"schema": "sots-checkpoint/1",
"session": "run-35e59053176da458d8b46fea",
"summary": "PRE-EXPERIMENT CHECKPOINT. OBSERVATIONS: current paired campaign binding remained stable through preflight at engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd and RE e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f; baseline HEAD/common-dir identities match. Binary, objdump, Python, archived save and parsers are available with identities in preflight. Canonical controls tests pass 37/37 and config tests 8/8; paired test_controls absence remains explicit. DECISION: execute only the attached current-source static plan/recipe. It refuses reused output and drift; captures 27 windows, direct PE controls, stop 0x779913 expected truncation, aligned 0x779915, authority 0x779930 and a20/a21/a23/a28. Static branch exposure is not runtime execution. Save is hashed but not parsed. No allocator/game/RNG/VM/Ghidra execution or lease. Block on any identity/stream/check failure or contradictory bytes.",
"timestamp": "2026-09-10T13:20:43.762619+00:00"
}

View file

@ -0,0 +1,27 @@
{
"actor": "campaign-lead",
"artifacts": [
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/manifest.json",
"sha256": "aaada07613a2d2b10d99c4b0a5ee795501a5eba13250c5d3beece587acd8d4a4"
},
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/report.md",
"sha256": "6e74ff0197adc6c97f5924ad3f973d5e8922f1480268d1c96dac3dd89000e38f"
},
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/capture.py",
"sha256": "66e230d79a2f9903941ff206656b7c26123adb528cbe807c2e1d3132137a20d1"
}
],
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
"contract": "research-completion-abi",
"id": "63895701b38ae7ffac31aaed",
"model": "openai/gpt-5.6-sol",
"next_action": "Launch research-abi-correction-verifier in a fresh bounded verifier session to reproduce the package independently and execute its falsifiers.",
"role": "lead",
"schema": "sots-checkpoint/1",
"session": "lead-verifier-handoff-41a6840",
"summary": "Lead inspected analyst run run-9daf5c3b75547271d5c3b4ed and its current-session fail-if-exists capture. Twelve static captures succeeded; complete instruction boundaries and raw bytes correct the invalidated provenance without claiming runtime safety. Campaign validation and all 37 control tests pass. No lease or mutable lab resource is held.",
"timestamp": "2026-09-10T05:07:46.089883+00:00"
}

View file

@ -0,0 +1,19 @@
{
"actor": "research-abi-analyst",
"artifacts": [
{
"path": "verify/results/research-completion-abi/run-35e59053176da458d8b46fea-preflight.json",
"sha256": "7ca4dc72850cb0fbef6370bfbea8ece5cf102c886a6ef99c9940108fe44501aa"
}
],
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
"contract": "research-completion-abi",
"id": "7adc6dc657a6159b06640fcc",
"model": "openai/gpt-5.6-sol",
"next_action": "Within analyst-owned results, prepare a fresh fail-if-exists static capture recipe bound to session run-35e59053176da458d8b46fea and decisions d-e9d6d48cd77538556d1a1c1f/d-6e30d172051af0385f5979eb, then checkpoint before executing it.",
"role": "analyst",
"schema": "sots-checkpoint/1",
"session": "run-35e59053176da458d8b46fea",
"summary": "MID-QUANTUM PREFLIGHT. OBSERVATIONS: canonical campaign validates; contract is needs-revision with no open surprises. Assigned engine/RE HEADs match 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 and 3bfde5a70d874a723e797a695bbd847fd82c0aa7; common dirs are /home/alex/sots-engine/.git and /home/alex/sots-re/.git. Both are preexisting dirty and untouched. Two current campaign source-bindings were stable: engine ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd, RE e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f. Current RE campaign digest differs from historical 6696fd52; it is not equated with runner-domain e97ad0ed. Fresh hashes for canonical campaign/runner/Python/objdump/binary, historical recipes, turn3 save and parsers are archived. Canonical verify/campaign tests executed 37/37 pass and verify/config 8/8 pass; paired baseline tree lacks verify/campaign/test_controls.py, so no restoration/source-identity claim. DECISION: preflight passes for lead scheduling only; future measurements must bind e5cf1c44 and cannot relabel old captures. No disassembly/save experiment was run. Runtime allocator/capacity/string/unwind/event/RNG states remain unexercised and explicit. No leases, lab access, game, Ghidra, source mutation, staging or commits.",
"timestamp": "2026-09-10T13:17:26.641161+00:00"
}

View file

@ -0,0 +1,51 @@
{
"actor": "research-problem-resolver",
"artifacts": [
{
"path": "campaign/runtime/decisions/d-e9d6d48cd77538556d1a1c1f.json",
"sha256": "c29e4ce1525f5c06efb87e7454661987026b358e5d9e0d6480df1b6956f19a42"
},
{
"path": "campaign/runtime/decisions/d-6e30d172051af0385f5979eb.json",
"sha256": "c94914d5be47b93eac301e745b53ed7b1f008744a0ac90681fefc9c4f7a11327"
},
{
"path": "campaign/runtime/surprises/s-210e489610197533e4f4cce1.json",
"sha256": "a2e6f0eaf0c2ba2d8a6a0edea74615d0f90ff9202c28811877b09961a265fb94"
},
{
"path": "campaign/runtime/runs/run-d6c4dc15e9f4d15155fee856.json",
"sha256": "510219b4269311df86f9abe068131efdf3000dbf7757ff9d2c0ef5565001b5fc"
},
{
"path": "campaign/runtime/runs/run-9daf5c3b75547271d5c3b4ed.json",
"sha256": "f0e9a8f47d7d31b873d348606800f20609f935c56b3da93f4478a39e4e10447b"
},
{
"path": "campaign/runtime/runs/run-ec31ee938e1f509cd7130c03.json",
"sha256": "a3452db76124adf1d5ad3ed4593845b589068ba2d83ce5633b9b1792b17bf1db"
},
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/manifest.json",
"sha256": "aaada07613a2d2b10d99c4b0a5ee795501a5eba13250c5d3beece587acd8d4a4"
},
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/nested-copy-authority.stdout.txt",
"sha256": "973c87ccab76a8454a4e43c83b59cdeace1e4f8c124c5aa9630cb956e3156bb8"
},
{
"path": "verify/results/research-completion-abi-correction-verifier/verification-plan-run-d6c4dc15e9f4d15155fee856.md",
"sha256": "78e1ee70e73cf4be34884fc2073cd650ada4a20322c1ad50cb2deeb339021fbc"
}
],
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
"contract": "research-completion-abi",
"id": "c80088956234568ade0a27fb",
"model": "openai/gpt-6-astra",
"next_action": "Lead perform the read-only current paired source-binding and consumed-tool/input preflight specified in d-e9d6d48cd77538556d1a1c1f, recording its result and missing-test disposition before scheduling revised independent static reproduction; do not restore source, reuse old binding or authorize lab work.",
"role": "resolver",
"schema": "sots-checkpoint/1",
"session": "run-481c9379a1efc0e527d2a28c",
"summary": "END bounded resolution-only quantum. OBSERVATIONS: assigned roots /tmp/opencode/sots-final-research-engine and /tmp/opencode/sots-final-research-re have common dirs /home/alex/sots-engine/.git and /home/alex/sots-re/.git, HEADs 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 and 3bfde5a70d874a723e797a695bbd847fd82c0aa7. Both preexisting dirty; no source changes this session. Current launch runner engine digest ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd unchanged; RE e97ad0ed5708a38d40294fb6cb4ba3cb49d4938710e3c01983fa055cbf22c0b9 versus historical analyst/verifier runner b4db6808cc2b8aca33fa27eaab330d32811ce146d829a1bb9474a03f7ccdaeb4. These runner hashes are NOT campaign-binding domain; old campaign binding 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8 must not be directly equated to them. Complete verifier-to-current git diff identifies ten included byte-changed control/config paths and removed verify/campaign/test_controls.py, plus excluded campaign/housekeeping inventory deltas, all enumerated in decision. No added or mode-only differences. Historical analyst before/after runner digests match verifier. A second whole-run diff against prior completed resolver produced redundant source_after removal and was truncated; it is not used to claim a full fieldwise comparison. Current campaign source-binding was NOT computed (resolver allowlist lacks that command). Canonical binary/tool/save files NOT freshly rehashed or executed. Archived analyst manifest records binary 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841, objdump 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd and twelve positive static commands only. Read raw authority ret bytes and verifier plan; repaired boundary remains unexecuted. DECISION d-e9d6d48cd77538556d1a1c1f resolves source surprise with new-source remeasurement, not restoration/relabeling. Qualified prior unlike-digest comparison; actual source drift survives. Historical static facts retain original scope; current-source reuse and independent-cross-check promotion invalidated. Prior d-6e30d172051af0385f5979eb boundary correction remains required. Contract now needs-revision, no acceptance restored; bridge/replacement remain dependency-blocked. TESTS: Git root/common-dir/HEAD and status checks; read-only manifest diff (exit 1 denotes differences); campaign validate research-completion-abi passed after resolution. No disassembly/save experiment, build, runtime, allocator, RNG or lab execution. No lease acquired; lease inventory inspected only, no availability/access assumed, no cleanup needed. No delegation, implementation/architecture edits, staging, commit, push or board/projection edits. BLOCKERS: current binding and consumed canonical input/tool hashes, required test availability, revised plan, lead scheduling and fresh independent/integrated evidence. Lead/integrator must link actual decision and regenerate projections after integration, not copy a history into board.",
"timestamp": "2026-09-10T13:11:37.323815+00:00"
}

View file

@ -0,0 +1,23 @@
{
"actor": "research-problem-resolver",
"artifacts": [
{
"path": "campaign/runtime/surprises/s-210e489610197533e4f4cce1.json",
"sha256": "2e6b3fdf239a1dbffb887cf382e0ae80823667d6cf96afd590b4057a9438502e"
},
{
"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/manifest.json",
"sha256": "aaada07613a2d2b10d99c4b0a5ee795501a5eba13250c5d3beece587acd8d4a4"
}
],
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
"contract": "research-completion-abi",
"id": "f15d822f91601241181df05a",
"model": "openai/gpt-6-astra",
"next_action": "Inspect runner versus campaign manifest hashing policy and relevant historical/current run digest records before deciding whether the reported mismatch compares equivalent identities.",
"role": "resolver",
"schema": "sots-checkpoint/1",
"session": "run-481c9379a1efc0e527d2a28c",
"summary": "INTERIM resolution-only. Read canonical instructions, contract, prior checkpoint, open source-drift surprise and analyst static manifest. OBSERVED Git roots/common dirs and HEADs match assigned engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 and RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7. Historical analyst binding RE 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8 versus prior resolver runner e97ad0ed5708a38d40294fb6cb4ba3cb49d4938710e3c01983fa055cbf22c0b9 not yet reconciled. Raw runner inventories include verify/results entries; must inspect binding policy before equating runner and campaign digests. No source or lab changes, no experiments or runtime execution. Shell allowlist rejected relative campaign command; will use authorized absolute control commands only. Lease directory inspected, no lease acquired or availability assumed. DECISION: keep s-210e489610197533e4f4cce1 open pending policy/inventory comparison; no stale-build diagnosis or acceptance.",
"timestamp": "2026-09-10T13:08:52.419410+00:00"
}

View file

@ -0,0 +1,14 @@
{
"actor": "research-problem-resolver",
"contract": "research-completion-abi",
"explanation": "Astra resolution-only, session run-ec31ee938e1f509cd7130c03. OBSERVATION/PROVENANCE: verifier plan verify/results/research-completion-abi-correction-verifier/verification-plan-run-d6c4dc15e9f4d15155fee856.md item 5 requires complete ret 4 at 0x00779912 with stop 0x00779913. Analyst run-9daf5c3b75547271d5c3b4ed/nested-copy-authority.stdout.txt line 79 shows c2 04 00 through 0x00779914; checkpoint 1d04a2672a212e8b1fb37297 rehashed plan to 78e1ee70e73cf4be34884fc2073cd650ada4a20322c1ad50cb2deeb339021fbc and authority to 973c87ccab76a8454a4e43c83b59cdeace1e4f8c124c5aa9630cb956e3156bb8, matching prior plan hash and analyst manifest. Analyst a20/a28 raw streams show terminal 74 versus 74 10 at 0x00779a1f; section-byte control contains 74 10 8b cf e8 28 6a ff ff. Instrument output is boundary-sensitive even when its mnemonic/target looks complete. This falsifies a verifier expectation before execution, not analyst authority or game behavior.\nIDENTITY/EXECUTION: assigned Git HEAD/common roots match engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23 and RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7. Historical analyst manifest binds binary 970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841, objdump 1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd GNU 2.38, and twelve explicit commands with zero exits, nonempty stdout and empty stderr. These are positive archived static executions, not fresh resolver executions. Binary/tool not freshly rehashed here. Current runner engine digest matches ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; RE runner digest e97ad0ed5708a38d40294fb6cb4ba3cb49d4938710e3c01983fa055cbf22c0b9 differs from historical 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8. Separate open surprise s-210e489610197533e4f4cce1 blocks source-identical reproduction. No stale-build/game-mechanism diagnosis. No runtime instrument neutrality, allocator, RNG or game execution measured.\nCLAIMS: OVERTURNED: plan item 5 complete-stop prediction for 0x00779913, and inference that failure at this verifier-chosen boundary falsifies the analyst 0x00779930 authority window. SURVIVES: archived ret encoding c2 04 00 at 0x00779912 in the hash-bound authority; the failure remains a failed predeclared prediction. QUALIFIED: minimum complete stop 0x00779915 is byte-length reasoning and an unexecuted new control, not a measurement or genuinely blinded holdout after this inspection. It covers normal return only, excludes cleanup beginning at 0x00779915, and cannot replace authority through exclusive stop 0x00779930. SURVIVES within their existing static domain only: analyst copy/allocation/cleanup instruction observations and other plan falsifiers; no new ABI semantic endorsement. QUALIFIED: independent-cross-check remains unsatisfied, ownership-recovered remains analyst static evidence awaiting reproduction. OVERTURNED for current launch: source-identical RE assumption, tracked separately. SURVIVES: runtime safety and replacement remain unaccepted; archived saves validate serialized values only, not capacity, string ownership, transient stack values or RNG draws.\nINVALIDATION: preserve the failed plan and checkpoint 4555678e34291015554e7e88 as history, but invalidate item 5 as executable acceptance requirement and its next action to run the unchanged plan. No run-d6c4dc15e9f4d15155fee856 reproduction result exists to rehabilitate. No analyst raw bytes are invalidated by this boundary mistake; prior d-fd5aff1eaf78a8c15d96723c and d-0bb927e63b915c87a58d4257 invalidations remain. CLI clears current evidence/checkpoint and invalidates any verdict; empty evidence array is not acceptance. No acceptance waiver.\nREVISED SCOPE/DEPENDENCIES: retain contract criteria and static/save-only scope; no implementation, architecture edits or lab use. After source-drift resolution and lead lifecycle authorization, independent verifier may create a fresh actual-session fail-if-exists reproduction, preserving old prediction failure and adding both new boundary controls. Required full authority/ABI windows and archived record accounting remain. research-live-record-bridge stays needs-revision with unaccepted ABI dependency; research-replacement stays proposed, its accepted-dependency narrative is not current status and cannot authorize wiring. No downstream promotion. Integrator must link this decision rather than write another board history, and regenerate projections only after valid integration.",
"id": "d-6e30d172051af0385f5979eb",
"invalidated_checkpoint": "campaign/runtime/checkpoints/research-completion-abi-1d04a2672a212e8b1fb37297.json",
"invalidated_evidence": [],
"model": "openai/gpt-6-astra",
"probe": "Cheapest boundary discriminator, NOT run here: after s-210e489610197533e4f4cce1 source reconciliation and lead authorization, checkpoint a fresh independent verifier session and new fail-if-exists directory. Rehash binary, objdump/interpreter, recipe, paired source and archived-save inputs before/after. Run /usr/bin/objdump -D -Mintel --start-address=0x00779850 against dumps/sots.exe twice, stops 0x00779913 and 0x00779915, plus full authority stop 0x00779930. Independently map PE VA 0x00779912..0x00779914 to file offsets and read bytes directly (not only a second disassembly). Predict c2-only truncated byte row at bad stop and c2 04 00 ret 4 at aligned stop, no changed preceding complete rows; preserve mnemonic/bytes separately. Normal-return stop must not be counted as unwind coverage. Keep a20 negative and aligned a21/a23/a28 controls, all other ABI/save falsifiers and explicit unexercised runtime states. Record actual commands, timestamps, exits, raw stdout/stderr hashes, positive executions and all missing/skipped states; reject drift, unexpected stderr, zero execution or contradiction. Mark original prediction failed, repaired control unblinded/new, never retroactive success. Immediate next action is lead scheduling a read-only manifest-delta review for source surprise, not this blocked reproduction.",
"role": "resolver",
"schema": "sots-decision/1",
"surprise": "s-81ffc3041e1f07b87928e6f2",
"timestamp": "2026-09-10T13:06:19.620541+00:00"
}

File diff suppressed because one or more lines are too long

View file

@ -1,5 +1,5 @@
{
"contract": "research-completion-abi",
"run": "run-9daf5c3b75547271d5c3b4ed",
"run": "run-35e59053176da458d8b46fea",
"status": "complete"
}

File diff suppressed because it is too large Load diff

File diff suppressed because one or more lines are too long

File diff suppressed because it is too large Load diff

File diff suppressed because one or more lines are too long

File diff suppressed because it is too large Load diff

File diff suppressed because one or more lines are too long

File diff suppressed because it is too large Load diff

File diff suppressed because one or more lines are too long

File diff suppressed because it is too large Load diff

File diff suppressed because one or more lines are too long

View file

@ -0,0 +1,13 @@
{
"actor": "research-problem-resolver",
"contract": "research-completion-abi",
"decision": "d-e9d6d48cd77538556d1a1c1f",
"id": "s-210e489610197533e4f4cce1",
"model": "openai/gpt-6-astra",
"probe": "Lead or authorized source-identity analyst compares the prior analyst/verifier launch RE file manifests with resolver source_before, naming every added/deleted/byte/mode-changed source path and confirming actual current paired source-binding. Preserve both manifests. Astra must decide explicit reconciliation or source-identical snapshot restoration by its owner before reproduction; no autonomous reset/copy or new source hash attached to old evidence.",
"role": "resolver",
"schema": "sots-surprise/1",
"status": "resolved",
"summary": "Resolver session run-ec31ee938e1f509cd7130c03 found source identity drift before any experiment: launch record campaign/runtime/runs/run-ec31ee938e1f509cd7130c03.json source_before RE manifest_sha256 is e97ad0ed5708a38d40294fb6cb4ba3cb49d4938710e3c01983fa055cbf22c0b9 (line 5053), not analyst run-9daf5c3b75547271d5c3b4ed manifest source_before/source_after 6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8 and verifier checkpoint 4555678e34291015554e7e88. Engine launch digest still ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd; Git HEADs/common dirs independently match pinned baselines. Same HEAD does not imply source-identical reproduction. Cause and relevance of changed RE inventory not yet measured; do not attach this binding to old measurements or infer a stale game build. No lab/source mutation or new capture executed.",
"timestamp": "2026-09-10T13:05:26.974324+00:00"
}

View file

@ -0,0 +1,13 @@
{
"actor": "research-abi-correction-verifier",
"contract": "research-completion-abi",
"decision": "d-6e30d172051af0385f5979eb",
"id": "s-81ffc3041e1f07b87928e6f2",
"model": "openai/gpt-5.6-sol",
"probe": "Astra should inspect verify/results/research-completion-abi-correction-verifier/verification-plan-run-d6c4dc15e9f4d15155fee856.md item 5 and analyst raw authority line 0x00779912 c2 04 00 in verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/nested-copy-authority.stdout.txt. Decide whether to preserve 0x00779913 as an expected-truncated negative and add fresh held-out 0x00779915 as the complete control, then authorize a fresh session-bound verifier reproduction. Require both boundaries plus direct PE bytes; do not erase the failed prediction or treat it as acceptance.",
"role": "verifier",
"schema": "sots-surprise/1",
"status": "resolved",
"summary": "Predeclared held-out boundary assumption is falsified before execution. Verification plan run-d6c4dc15e9f4d15155fee856 requires stop 0x00779913 to include the complete ret 4 at 0x00779912. The already-read analyst authority stream shows that instruction bytes are c2 04 00, spanning 0x00779912..0x00779914, so objdump stop 0x00779913 can admit only the first byte c2 under the same stop-address behavior previously established. It cannot be a complete terminal boundary; minimum complete stop is 0x00779915. This is the verifier own failed prediction, not analyst success and not game/runtime behavior. No new disassembly/save experiment, game, allocator, RNG, VM, Ghidra, or source mutation was executed. Pause the affected reproduction plan rather than silently changing its held-out boundary.",
"timestamp": "2026-09-10T05:27:48.289391+00:00"
}

View file

@ -0,0 +1,9 @@
{
"actor": "campaign-lead",
"contract": "research-completion-abi",
"from": "ready",
"model": "openai/gpt-5.6-sol",
"role": "lead",
"timestamp": "2026-09-10T05:07:46.031796+00:00",
"to": "implementing"
}

View file

@ -0,0 +1,9 @@
{
"actor": "campaign-lead",
"contract": "research-completion-abi",
"from": "implementing",
"model": "openai/gpt-5.6-sol",
"role": "lead",
"timestamp": "2026-09-10T05:07:46.150625+00:00",
"to": "verification"
}

View file

@ -0,0 +1,9 @@
{
"actor": "campaign-lead",
"contract": "research-completion-abi",
"from": "needs-revision",
"model": "openai/gpt-5.6-sol",
"role": "lead",
"timestamp": "2026-09-10T05:07:45.967164+00:00",
"to": "ready"
}

View file

@ -2,7 +2,7 @@
"actor": "research-abi-independent",
"basis": "aaddeb76f74bbd1a43671f882770ec84a7d690b4060d060ef1a68f918e8edbb0",
"contract": "research-completion-abi",
"decision": "d-0bb927e63b915c87a58d4257",
"decision": "d-e9d6d48cd77538556d1a1c1f",
"evidence_digest": "e5073be0f1187ee65c203eb9ad20adc64d18ff2d3314d554f58bd8487dafa931",
"explanation": "Scoped integrated PASS over the current two-record integrated evidence array. Fresh handoff reproduction executed 22 nonempty static windows plus strict archived save parse/checksum: 24 positive subprocesses, empty stderr, no skips; manifest matches the integrated artifact except session and state is byte-identical. Seven narrow/wide boundaries reproduce complete ret 4/ret 8 bytes. Held-out direct-PE ablation confirmed each exact return and rejected all minus-one/plus-one shifted starts; static inspection exposed distinct 0x2c/0x74 strides, deep-copy calls, three guarded long-string deletes, description inequality and three unordered-or-unequal float branches. Actual state inspection found EvNxID 4, turn-3 count 2, event ID 3 fields/defaults, exact 609080-byte rebuild, and a 2503-byte RNG leaf with digest 0978fdf34ff7962f76c2de810dc93e0a. Integrated source/input/binary/outcome hashes remain bound and campaign tests/validation pass. Scope is independent static reproduction plus one archived state only: no live allocator safety, original differential, replacement or replay acceptance; runtime branch residuals remain. Historical failed provenance/description predictions remain failures resolved by Astra.",
"model": "openai/gpt-5.6-sol",

View file

@ -0,0 +1,80 @@
# Verification report — run-d6c4dc15e9f4d15155fee856
## Result
**Paused / no verdict.** The verifier's own predeclared held-out boundary prediction was falsified
before the planned experiment. Open surprise: `s-81ffc3041e1f07b87928e6f2`. This failure is not
converted into analyst success, independent-cross-check acceptance, or a replacement claim.
## Identity reproduction
From the assigned worktrees:
```sh
git rev-parse HEAD
git rev-parse --show-toplevel
git rev-parse --git-common-dir
git status --short
```
Results: engine HEAD `7741d42fc5e4e761e6449bdaf0e4a61d00036a23`, root
`/tmp/opencode/sots-final-research-engine`, common directory `/home/alex/sots-engine/.git`; RE HEAD
`3bfde5a70d874a723e797a695bbd847fd82c0aa7`, root
`/tmp/opencode/sots-final-research-re`, common directory `/home/alex/sots-re/.git`. Both trees are
dirty as expected from the source-identical campaign snapshot; identity was not inferred from HEAD.
```sh
python3 tools/campaign.py --state-root /home/alex/sots-re validate
python3 tools/campaign.py --state-root /home/alex/sots-re status research-completion-abi
python3 tools/campaign.py --state-root /home/alex/sots-re source-binding \
research-completion-abi \
--engine-worktree /tmp/opencode/sots-final-research-engine \
--re-worktree /tmp/opencode/sots-final-research-re
```
Before the surprise, validation passed, status was `verification` with no open surprises, and the
binding matched the analyst package: engine
`ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd`, RE
`6696fd5201e144843617cbf6d78b41b5287ad5dcc9fa1e8aaa861d52b64e72e8`.
```sh
sha256sum dumps/sots.exe /usr/bin/objdump \
verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/manifest.json \
verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/report.md \
verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/capture.py
/usr/bin/objdump --version
```
Results: executable `970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841`;
objdump target bytes `1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd`,
GNU Binutils 2.38; handoff artifacts respectively
`aaada07613a2d2b10d99c4b0a5ee795501a5eba13250c5d3beece587acd8d4a4`,
`6e74ff0197adc6c97f5924ad3f973d5e8922f1480268d1c96dac3dd89000e38f`, and
`66e230d79a2f9903941ff206656b7c26123adb528cbe807c2e1d3132137a20d1`.
`/usr/bin/objdump` is a symlink whose target bytes were hashed; the manifest's 373,888-byte size is
the dereferenced executable, while `stat` on the link itself reports 24 bytes.
## Failed prediction and challenge
The pre-experiment plan required held-out stop `0x00779913` to include a complete `ret 4` beginning
at `0x00779912`. Independent inspection of the raw authority stream shows bytes `c2 04 00`; the
instruction occupies addresses `0x00779912..0x00779914`. An exclusive stop of `0x00779913` can
therefore expose only `c2`, exactly the truncation class that invalidated earlier archives. The
earliest complete stop is `0x00779915`.
This challenges the verifier instrument boundary, not game semantics. The planned objdump and save
subprocesses were **not run**, so there is no positive-execution claim, no archived-state/RNG result,
and no verifier manifest. Existing analyst captures remain measurements only. Actual runtime states
(existing/miss, spare/full, empty/nonempty, short/long, unwind) remain unexecuted; static branches do
not substitute for them. No original-assisted execution, partial/full compare, independent
replacement, or integrated replay occurred.
## Side effects and exact next action
Only verifier-owned plan/report files and canonical campaign surprise/checkpoint state were written.
No lease was acquired; no lab, VM, Ghidra, game, allocator, RNG, engine source, staging, commit, or
push operation occurred.
**Exact next action:** Astra resolves `s-81ffc3041e1f07b87928e6f2` by deciding whether
`0x00779913` becomes an expected-truncated negative and `0x00779915` the fresh complete held-out
control; then a fresh verifier quantum executes the authorized session-bound reproduction.

View file

@ -0,0 +1,56 @@
# Verification plan — run-d6c4dc15e9f4d15155fee856
Role `verifier`; actor `research-abi-correction-verifier`; requested model
`openai/gpt-5.6-sol`. This plan predates this session's disassembly and save-state experiments.
## Scope separation
The analyst package is a fresh **static capture**, not live allocator execution, original-assisted
execution, partial/full compare, independent replacement, or integrated replay. This verifier will
independently reproduce static instruction/byte facts and archived save values only. It will not
claim runtime allocator safety, event posting, replacement acceptance, or integrated-tree evidence.
## Falsifiers
1. Reject if contract/campaign validation fails, an open surprise exists, either paired worktree is
not at its pinned baseline/common repository, source binding differs from the handoff, or binary
or objdump identity differs. Dirty trees are acceptable only when their full source digests match.
2. Reject zero executions, nonzero command exits, empty required stdout, unexpected stderr/skips,
missing streams, reused output, or a manifest/session mismatch.
3. Require stop `0x00779a20` to be incomplete despite exit zero: raw bytes must show `74 10` while
decoded output at `0x00779a1f` shows only `74`. If counted as a complete stream, reject.
4. Require aligned stops `0x00779a21`, `0x00779a23`, and `0x00779a28` to add exactly complete
`74 10`, `8b cf`, and `e8 28 6a ff ff` rows. Any truncated terminal row or non-prefix change in
the shared decoded range rejects the boundary interpretation.
5. Independently hold out stop `0x00779913` for nested-copy authority. It must include complete
`ret 4` at `0x00779912` without entering the later routine; compare it with raw terminal bytes.
A bad terminal boundary or changed preceding rows falsifies the package's authority boundary.
6. Check key ABI claims directly: get/create and outer append end `ret 4`; nested destruction ends
`ret`; nested copy has normal `ret 4`, unwind cleanup, and deallocation paths; get/create has no
write to temporary `[ebp-0x20]` before append, copies source `+4`, cleans the temporary nested
vector, then stores requested turn to the stored element. Contradictory def/use evidence pauses.
7. Independently parse the archived save, not narrative counters. Require the named player/event
container elements, IDs, strings, exact `0x7f7fffff` position words, and empty player states to
match. Missing parse coverage or unexpected skips reject archived-value validation.
8. Check actual RNG evidence independently: static helper captures execute no game and therefore
expose no RNG state/draws. Any claim that unchanged/zero RNG was measured by these captures is a
failure. Archived W1 unchanged RNG remains historical and outside this static reproduction.
## Required branch exposures and distinct states
Static instruction exposure required now: existing last-match return versus miss; spare-capacity
append versus full-capacity growth edges; empty versus nonempty nested copy; null versus nonnull
nested destruction; normal return versus unwind cleanup; short/long string branch instructions;
known-bad truncated versus aligned boundary. Instruction exposure is not runtime execution.
Runtime states still unexercised and must remain explicit residuals: existing-last-match, miss with
spare/full outer capacity, empty/nonempty nested vectors owning short/long strings, deliberate
allocation failure/throw, duplicate/description-only-different events, and transient stack
sentinels. Archived save states are distinct from all of those and validate serialized values only.
## Planned reproduction
Create a fail-if-exists session directory owned by this verifier. Use an independent script, not the
analyst's hard-coded recipe, to bind source/input/tool identities, run the package windows and held-
out boundary, archive raw stdout/stderr, parse instruction rows and save values, and emit a manifest
whose failed predictions/residuals remain failures or limitations.

View file

@ -0,0 +1,188 @@
#!/usr/bin/env python3
"""Session-bound current-source static ABI capture; refuses output reuse."""
import hashlib
import json
import pathlib
import struct
import subprocess
import sys
from datetime import datetime, timezone
ROOT = pathlib.Path("/home/alex/sots-re")
SESSION = "run-35e59053176da458d8b46fea"
OUT = ROOT / "verify/results/research-completion-abi" / (SESSION + "-repair1")
ENGINE = pathlib.Path("/tmp/opencode/sots-final-research-engine")
RE = pathlib.Path("/tmp/opencode/sots-final-research-re")
CAMPAIGN = ROOT / "tools/campaign.py"
EXE = ROOT / "dumps/sots.exe"
SAVE = ROOT / "verify/results/saves/turn3-state.sav"
OBJDUMP = pathlib.Path("/usr/bin/objdump")
EXPECTED = {
"engine": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd",
"re": "e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f",
"exe": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841",
"objdump": "1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd",
"save": "978041acd168b56ed8eb3f5e42e78d5e70eae6e6517d75e659a5eb7ca3d60921",
}
# Names classify evidence only; these windows expose instructions but execute no branch.
WINDOWS = (
("observed-ctor", 0x8562A0, 0x856310),
("observed-append", 0x7B7320, 0x7B73A2),
("observed-copy", 0x79A150, 0x79A1DC),
("observed-growth", 0x7B34E0, 0x7B35F2),
("observed-alloc", 0x57E590, 0x57E5E7),
("player-ctor", 0x84EE30, 0x84EEF4),
("player-append", 0x86C580, 0x86C631),
("player-growth", 0x869500, 0x869620),
("player-copy", 0x7693F0, 0x7694C3),
("player-dtor", 0x61AE90, 0x61AEFC),
("string-assign", 0x4249A0, 0x424ADD),
("import-thunks", 0x924FAA, 0x924FBC),
("turn-get-create", 0x885380, 0x88544E),
("turn-append", 0x884CB0, 0x884D93),
("turn-growth", 0x8841A0, 0x884300),
("nested-copy-authority", 0x779850, 0x779930),
("nested-dtor", 0x629580, 0x6295CE),
("turn-virtual-dtor", 0x62E120, 0x62E170),
("dedup", 0x825D40, 0x825E67),
("string-not-equal", 0x46F8C0, 0x46F8F0),
("prune", 0x879EB0, 0x879FC0),
("nested-copy-stop-9913", 0x779850, 0x779913),
("nested-copy-stop-9915", 0x779850, 0x779915),
("nested-copy-stop-a20", 0x779850, 0x779A20),
("nested-copy-stop-a21", 0x779850, 0x779A21),
("nested-copy-stop-a23", 0x779850, 0x779A23),
("nested-copy-stop-a28", 0x779850, 0x779A28),
)
def sha(data):
return hashlib.sha256(data).hexdigest()
def ident(path):
target = path.resolve()
data = target.read_bytes()
return {"path": str(path), "resolved_path": str(target), "bytes": len(data), "sha256": sha(data)}
def binding():
argv = [sys.executable, str(CAMPAIGN), "--state-root", str(ROOT), "source-binding",
"research-completion-abi", "--engine-worktree", str(ENGINE),
"--re-worktree", str(RE)]
p = subprocess.run(argv, cwd=ROOT, capture_output=True, text=True, check=True)
return {"argv": argv, "value": json.loads(p.stdout)}
def rows(data):
return [line.rstrip() for line in data.decode("utf-8").splitlines()
if ":" in line and line.lstrip()[:1].isdigit()]
def pe_reader(data):
pe = struct.unpack_from("<I", data, 0x3C)[0]
assert data[pe:pe + 4] == b"PE\0\0"
count = struct.unpack_from("<H", data, pe + 6)[0]
opt_size = struct.unpack_from("<H", data, pe + 20)[0]
opt = pe + 24
assert struct.unpack_from("<H", data, opt)[0] == 0x10B
base = struct.unpack_from("<I", data, opt + 28)[0]
sections = []
for i in range(count):
off = opt + opt_size + 40 * i
name = data[off:off + 8].rstrip(b"\0").decode("ascii")
vsize, va, raw_size, raw = struct.unpack_from("<IIII", data, off + 8)
sections.append((name, va, max(vsize, raw_size), raw, raw_size))
def read_va(address, size):
rva = address - base
for name, va, span, raw, raw_size in sections:
if va <= rva and rva + size <= va + span:
delta = rva - va
assert delta + size <= raw_size
return data[raw + delta:raw + delta + size], name, raw + delta
raise AssertionError(("unmapped", hex(address), size))
return base, read_va
if len(sys.argv) != 2 or sys.argv[1] != SESSION:
raise SystemExit("usage: capture script with exact session argument")
if OUT.exists():
raise SystemExit("refusing existing output directory")
before = binding()
files = {"binary": ident(EXE), "objdump": ident(OBJDUMP), "python": ident(pathlib.Path(sys.executable)),
"save": ident(SAVE), "campaign": ident(CAMPAIGN),
"save_reader": ident(ROOT / "verify/save-reader/save_reader.py"),
"state_checksum": ident(ROOT / "verify/state-checksum/state_checksum.py")}
identity_failures = [key for key in ("exe", "objdump", "save")
if files[{"exe":"binary", "objdump":"objdump", "save":"save"}[key]]["sha256"] != EXPECTED[key]]
if before["value"]["engine"]["sha256"] != EXPECTED["engine"] or before["value"]["re"]["sha256"] != EXPECTED["re"]:
identity_failures.append("source")
if identity_failures:
raise SystemExit("identity drift: " + ",".join(identity_failures))
OUT.mkdir(exist_ok=False)
records, streams = [], {}
for name, start, stop in WINDOWS:
argv = [str(OBJDUMP), "-D", "-Mintel", f"--start-address=0x{start:08x}",
f"--stop-address=0x{stop:08x}", str(EXE)]
p = subprocess.run(argv, cwd=ROOT, capture_output=True)
(OUT / f"{name}.stdout.txt").write_bytes(p.stdout)
(OUT / f"{name}.stderr.txt").write_bytes(p.stderr)
streams[name] = p.stdout
records.append({"name": name, "argv": argv, "returncode": p.returncode,
"stdout": {"bytes": len(p.stdout), "sha256": sha(p.stdout)},
"stderr": {"bytes": len(p.stderr), "sha256": sha(p.stderr)},
"instruction_rows": len(rows(p.stdout))})
exe_data = EXE.read_bytes()
image_base, read_va = pe_reader(exe_data)
direct = {}
for name, address, size in (("ret4", 0x779912, 3), ("a20-family", 0x779A1F, 9),
("observed-stride", 0x7B7333, 8), ("player-stride", 0x86C593, 8),
("turn-stride", 0x884CC3, 8), ("constructor-defaults", 0xAF0DC8, 12)):
data, section, file_offset = read_va(address, size)
direct[name] = {"va": f"0x{address:08x}", "bytes": data.hex(), "section": section,
"file_offset": file_offset}
comparisons = {
"9913_is_truncated_terminal": (rows(streams["nested-copy-stop-9913"])[:-1] == rows(streams["nested-copy-stop-9915"])[:-1]
and "779912:" in rows(streams["nested-copy-stop-9913"])[-1].replace(" ", "")
and "c2" in rows(streams["nested-copy-stop-9913"])[-1].lower()
and "c2 04 00" not in rows(streams["nested-copy-stop-9913"])[-1].lower()),
"9915_terminal_ret4": "c2 04 00" in rows(streams["nested-copy-stop-9915"])[-1].lower(),
"authority_contains_ret4": any("c2 04 00" in x.lower() for x in rows(streams["nested-copy-authority"])),
"a20_is_truncated_terminal": (rows(streams["nested-copy-stop-a20"])[:-1] == rows(streams["nested-copy-stop-a21"])[:-1]
and "779a1f:" in rows(streams["nested-copy-stop-a20"])[-1].replace(" ", "")
and "74" in rows(streams["nested-copy-stop-a20"])[-1].lower()
and "74 10" not in rows(streams["nested-copy-stop-a20"])[-1].lower()),
"a21_adds_complete_je": "74 10" in rows(streams["nested-copy-stop-a21"])[-1].lower(),
"a23_adds_complete_mov": "8b cf" in rows(streams["nested-copy-stop-a23"])[-1].lower(),
"a28_adds_complete_call": "e8 28 6a ff ff" in rows(streams["nested-copy-stop-a28"])[-1].lower(),
"direct_ret4": direct["ret4"]["bytes"] == "c20400",
"direct_a20_family": direct["a20-family"]["bytes"] == "74108bcfe8286affff",
"direct_defaults": direct["constructor-defaults"]["bytes"] == "ffff7f7fffff7f7fffff7f7f",
}
after = binding()
checks = {
"all_commands_zero": all(x["returncode"] == 0 for x in records),
"all_stdout_nonempty": all(x["stdout"]["bytes"] > 0 for x in records),
"all_stderr_empty": all(x["stderr"]["bytes"] == 0 for x in records),
"source_stable": before["value"] == after["value"],
**comparisons,
}
manifest = {
"schema": "sots-abi-static-capture/2", "session": SESSION,
"actor": "research-abi-analyst", "role": "analyst", "model": "openai/gpt-5.6-sol",
"timestamp": datetime.now(timezone.utc).isoformat(),
"decisions": ["d-e9d6d48cd77538556d1a1c1f", "d-6e30d172051af0385f5979eb"],
"scope": "Static instruction/byte capture and immutable input identity; no game/runtime execution.",
"source_before": before, "source_after": after, "files": files,
"image_base": f"0x{image_base:08x}", "commands": records, "direct_pe": direct,
"checks": [{"name": k, "status": "pass" if v else "fail"} for k, v in checks.items()],
"failed": [k for k, v in checks.items() if not v],
"static_branch_exposure": ["existing-match/miss", "spare/full capacity", "empty/nonempty nested copy",
"null/nonnull destruction", "short/long string", "normal/unwind", "bad/aligned boundaries"],
"runtime_unexercised": ["all listed static branches", "allocator safety", "event construction and IDs",
"PostEvent caller defaults/write order", "exception throw", "RNG state/draws"],
"original_helpers": ["0x00924fb6 allocation thunk", "0x00924faa deallocation thunk",
"0x0046f8c0 original string comparison when called"],
}
(OUT / "manifest.json").write_text(json.dumps(manifest, indent=2) + "\n")
print(json.dumps({"output": str(OUT.relative_to(ROOT)), "commands": len(records), "failed": manifest["failed"]}, indent=2))
raise SystemExit(bool(manifest["failed"]))

View file

@ -0,0 +1,47 @@
# Current-source ABI static capture plan — run-35e59053176da458d8b46fea
This analyst-owned plan implements the new-source remeasurement selected by Astra decisions
`d-e9d6d48cd77538556d1a1c1f` and `d-6e30d172051af0385f5979eb`. It is static analysis plus input
identity only. It does not execute the game, constructors, destructors, allocation, exception paths,
event posting, or RNG, and it cannot satisfy the independent verifier criterion.
## Preconditions and falsifiers
1. Refuse an absent/wrong session, a pre-existing output directory, baseline HEAD mismatch, source
binding mismatch from preflight, binary/tool/interpreter drift, missing archived save/parser input,
nonzero subprocess return, empty required stdout, nonempty stderr, or source drift during capture.
2. Capture nested-copy stop `0x00779913` as an expected truncated negative, stop `0x00779915` as
the aligned complete `c2 04 00` control, and stop `0x00779930` as authority. Read the same bytes
through a direct PE VA-to-file-offset mapper. The old claim that `0x00779913` is complete remains
failed; it is not rewritten as a pass.
3. Retain the independent boundary family: bad `0x00779a20`, aligned `0x00779a21`, `0x00779a23`,
and `0x00779a28`, with direct bytes at `0x00779a1f`. Reject changed preceding rows.
4. Capture callable entry/return and ownership windows for ObservedTech and PlayerEvent construction,
append, growth, deep copy, destruction, string assignment, imported allocation/deallocation,
TurnEvents get/create, outer append, nested copy/destruction, duplicate comparison, and prune.
5. Preserve static branch exposure separately from runtime execution: match/miss, spare/full capacity,
empty/nonempty and null/nonnull nested vectors, short/long string branches, normal/unwind edges,
and known-bad/aligned disassembler boundaries. No static branch is reported as runtime coverage.
6. Hash but do not parse the archived save in this analyst capture. A fresh independent verifier must
parse named containers/elements, IDs, all event fields, exact FLT_MAX words, empty player states,
and the actual RNG leaf, and must use a verifier-owned recipe and fail-if-exists directory.
## Expected machine facts under test
* Distinct element strides remain `0x2c` (ObservedTech), `0x74` (PlayerEvent), and `0x18`
(TurnEvents); append/growth performs element construction rather than raw header transfer.
* Long-string ownership uses original allocator/deallocator thunks `0x00924fb6`/`0x00924faa`;
these are original-helper dependencies, not standalone allocator safety.
* Get/create checks existing buckets before miss construction, deep-copies the nested vector, cleans
the temporary nested vector, then writes the requested turn into the stored last element.
* Duplicate matching includes both description strings; mismatch returns without an event-vector
write, while no duplicate proceeds to PlayerEvent append. No RNG instruction/effect is expected
in these bounded static windows, but unchanged RNG is not measured.
## Runtime residuals
Still unavailable/unexercised: live existing-last-match and miss paths; spare/full outer capacity;
empty/nonempty nested vectors owning short/long strings; deliberate allocation failure and unwind;
equal versus description-only-different live events; transient stack sentinels; exact PostEvent
caller defaults/write order; allocator-family safety; event IDs and records created at runtime; and
all RNG state/draw effects.

View file

@ -0,0 +1,73 @@
# Current-source ABI static capture report — run-35e59053176da458d8b46fea
## Result and provenance
The authoritative package is
`verify/results/research-completion-abi/run-35e59053176da458d8b46fea-repair1/`; its manifest records
27 positive objdump executions, all return code zero with nonempty stdout and empty stderr (118,734
stdout bytes, zero stderr bytes), and no failed checks. Paired source identity remained engine
`ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd` and RE
`e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f` before/after. Binary,
objdump, Python, save and parser identities are in the manifest and preflight.
The sibling directory without `-repair1` is a preserved failed recipe run. Its streams are valid,
but two checks incorrectly required the bad boundary stream to omit its terminal row. Actual objdump
retains a one-byte terminal row (`c2` or `74`) and replaces it with the complete row when the stop is
aligned. The repaired recipe tests equal preceding rows plus that replacement. This was a local test
predicate defect, not contradictory binary behavior and not a retroactive pass.
## Measured static observations
* Stop `0x00779913` emits truncated `779912: c2`; stop `0x00779915` emits complete
`779912: c2 04 00`, and authority through `0x00779930` includes the complete return plus cleanup at
`0x00779915`. Direct PE mapping independently reads `c20400` at VA `0x00779912`.
* The second boundary family reproduces truncated `74` at stop `0x00779a20`, complete `74 10` at
`0x00779a21`, then complete `8b cf` and `e8 28 6a ff ff` at stops `0x00779a23` and
`0x00779a28`. Direct PE bytes are `74108bcfe8286affff`.
* ObservedTech append/growth instructions use `0x2c`; PlayerEvent append/nested-copy/destruction use
`0x74`; TurnEvents append/prune use `0x18`. These are distinct concrete element strides.
* ObservedTech allocation multiplies count by `0x2c` and calls `0x00924fb6`; old-element growth and
PlayerEvent/string destruction paths call `0x00924faa`. PlayerEvent append calls copy constructor
`0x007693f0`; outer TurnEvents append calls nested copy `0x00779850`.
* Nested copy zeros the destination three-pointer header, distinguishes empty count from allocation,
allocates through `0x0078af40`, multiplies by `0x74`, calls range helper `0x007725a0`, writes the
copied end pointer, returns destination in EAX, and ends `ret 4`. Its captured unwind edge calls
`0x00629580` before the allocation-failure helper; this edge was exposed, not executed.
* Get/create scans every `0x18` bucket and retains the last matching `+4` turn. On miss it establishes
vptr and zero nested-vector pointers, calls outer append, calls nested-vector cleanup, then stores
the requested stack turn into stored-last `+4`; both returns are `ret 4`.
* Outer append separates capacity-growth and spare-capacity edges, copies source `+4`, advances source
to nested vector `+8`, deep-copies it, then increments end by `0x18`; it ends `ret 4`.
* Duplicate scan advances by `0x74`; after prior field comparisons it performs description comparison
at `0x0046f8c0`, caller-cleans two arguments, and reaches match return only when AL is zero. Thus the
fresh instructions remain consistent with description equality being required.
* Direct PE mapping reads three `0x7f7fffff` words at constructor-default VA `0x00af0dc8`. This is a
binary constant observation, not a newly parsed event record.
The manifest's direct-PE entries named `observed-stride`, `player-stride`, and `turn-stride` sampled
fixed addresses but were not used to establish strides; their names are overbroad. The stride facts
above come from the archived instruction rows. This limitation does not affect the boundary-byte or
constructor-default direct controls.
## Interpretation, dependencies, and limits
The measurements support the prior static interpretation that vector elements require construction
and nested/string ownership rather than raw header copy. Calling `0x00924fb6`, `0x00924faa`, or
`0x0046f8c0` remains an original-helper dependency with the original CRT/string layout. A standalone
implementation needs one coherent allocator/copy/destruction family; this capture does not show that
original allocations can safely cross a replacement boundary.
No game branch, allocation, constructor, destructor, throw, event post, ID assignment, record write,
container mutation, or RNG draw executed. The save was hashed, not parsed. Existing/miss,
spare/full-capacity, empty/nonempty, null/nonnull, short/long-string, normal/unwind, duplicate and
description-only-different states are instruction exposures only. Exact PostEvent caller inputs,
defaulting and total write order remain outside this bounded remeasurement.
## Independent falsification package
A fresh verifier should use its own recipe and fail-if-exists directory, bind the current paired
digest, repeat the negative/aligned/authority boundaries and direct PE reads, challenge at least one
additional boundary, and parse the archived save independently for named player/event containers,
elements, IDs, strings, FLT_MAX words, empty-player states and the actual RNG leaf. It must preserve
all runtime residuals and must not count this analyst capture or archived prior verifier output as an
independent cross-check.

View file

@ -0,0 +1,70 @@
{
"schema": "sots-abi-preflight/1",
"session": "run-35e59053176da458d8b46fea",
"actor": "research-abi-analyst",
"role": "analyst",
"model": "openai/gpt-5.6-sol",
"decision": "d-e9d6d48cd77538556d1a1c1f",
"scope": "Read-only current-source and consumed-input preflight; no disassembly, save parse, game, allocator, RNG, VM, Ghidra, or source experiment.",
"source_binding_before": {
"engine": {
"path": "/tmp/opencode/sots-final-research-engine",
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
},
"re": {
"path": "/tmp/opencode/sots-final-research-re",
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
"sha256": "e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f"
}
},
"source_binding_after": {
"engine": {
"path": "/tmp/opencode/sots-final-research-engine",
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
},
"re": {
"path": "/tmp/opencode/sots-final-research-re",
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
"sha256": "e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f"
}
},
"source_stable_during_preflight": true,
"identity_classification": {
"observation": "The current campaign-domain RE digest is e5cf1c44..., distinct from historical campaign digest 6696fd52... and from resolver-recorded runner-domain digest e97ad0ed.... The hash domains are not equated.",
"decision": "Bind any future measurement to e5cf1c44...; do not attach this binding to archived measurements."
},
"consumed_files": [
{"path": "tools/campaign.py", "bytes": 35131, "sha256": "a9fafe320bf2b59200c2572bc43dff8823827b9d7b78dc7b959e4b6b983f2123"},
{"path": "tools/run_agent.py", "bytes": 20079, "sha256": "818097896b2e29dbdd2f53d37261236af302178ecd0ee083a3184a7bc33ff152"},
{"path": "campaign/models.json", "bytes": 607, "sha256": "00f959ff4ce16ba22f6befa7a9d495eb85d62d9e8001b1e1345eaae0e11b6e48"},
{"path": "campaign/contract.schema.json", "bytes": 4187, "sha256": "a2c76ec042ca097a57c3c05c1e519e392d498d387a31808c7d0f70482d43c201"},
{"path": "campaign/agents/analyst.md", "bytes": 1220, "sha256": "895c41509016038b3f72c4a68608c4101511e69c5bf410e379286da1a6202952"},
{"path": "/usr/bin/python3", "resolved_path": "/usr/bin/python3.10", "bytes": 5941864, "sha256": "a2f33a6e006989270f4340528eb61f8f97366e00a5d1b602ac8672ea44fc56ae", "version": "3.10.12"},
{"path": "/usr/bin/objdump", "resolved_path": "/usr/bin/x86_64-linux-gnu-objdump", "bytes": 373888, "sha256": "1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd"},
{"path": "dumps/sots.exe", "bytes": 7898624, "sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841"},
{"path": "verify/results/research-completion-abi/run-9daf5c3b75547271d5c3b4ed/capture.py", "bytes": 7265, "sha256": "66e230d79a2f9903941ff206656b7c26123adb528cbe807c2e1d3132137a20d1", "classification": "historical analyst recipe; not executed"},
{"path": "verify/results/research-completion-abi-independent/reproduce_run_7d85d45cb2196e07025e5096.py", "bytes": 10199, "sha256": "0681a9a4f877b7f511d382ca2b010a1b4a9eb5e4863e46b3aed372e895778bfb", "classification": "historical verifier recipe; not executed and not reusable as independent fresh recipe"},
{"path": "verify/results/saves/turn3-state.sav", "bytes": 67219, "sha256": "978041acd168b56ed8eb3f5e42e78d5e70eae6e6517d75e659a5eb7ca3d60921"},
{"path": "verify/save-reader/save_reader.py", "bytes": 74367, "sha256": "2dcac286b5382b67fe8f2dbce58c80950dd430b726ed0e98f3bcea155df0df35"},
{"path": "verify/state-checksum/state_checksum.py", "bytes": 57792, "sha256": "ed80458e84d92040aa3872464d8df315e935f379ca0da5a2df81c3049826e5b8"}
],
"test_input_disposition": {
"paired_re_verify_campaign_test_controls": "absent from assigned paired RE tree, confirming the resolver's current-inventory observation",
"canonical_verify_campaign_test_controls": {"path": "verify/campaign/test_controls.py", "bytes": 33307, "sha256": "fd46a2f7900b5a51facee63b66b1f4f1b1a3f56c00d813dadd016dae1d321925", "result": "37 tests executed, all passed"},
"canonical_verify_config": [
{"path": "verify/config/test_agent_config.py", "bytes": 2703, "sha256": "8a7a406f062c3387ec5b99b35f3befb64f676efef174047060c967074545e3e3"},
{"path": "verify/config/test_source_check.py", "bytes": 1275, "sha256": "c16731e31a54256dde4f88d33007759ff21ad8537ca6cd2be38b9e34c59525ad"}
],
"canonical_verify_config_result": "8 tests executed, all passed",
"campaign_validate_result": "pass",
"decision": "The canonical controls input required by the current campaign gate exists and passes. Its absence from the paired baseline-pinned RE inventory remains explicit and must not be described as restored source identity. No test file was copied or restored."
},
"runtime_inputs": {
"available_for_fresh_static_and_archived-value_reproduction": ["dumps/sots.exe", "/usr/bin/objdump", "/usr/bin/python3", "verify/results/saves/turn3-state.sav", "verify/save-reader/save_reader.py", "verify/state-checksum/state_checksum.py"],
"unavailable_or_unexercised": ["live existing-last-match and miss states", "spare/full outer capacity", "empty/nonempty nested vectors with short/long strings", "allocation failure/throw cleanup", "duplicate and description-only-different events", "transient stack sentinels", "live allocator safety", "runtime event construction", "live RNG draws"]
},
"resources": {"leases": [], "lab_access": false, "mutations": []},
"result": "preflight-pass-for-scheduling-only"
}

View file

@ -0,0 +1,127 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00825d40 <.text+0x424d40>:
825d40: 55 push ebp
825d41: 8b ec mov ebp,esp
825d43: 51 push ecx
825d44: 53 push ebx
825d45: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
825d48: 56 push esi
825d49: 33 f6 xor esi,esi
825d4b: 3b de cmp ebx,esi
825d4d: 75 0a jne 0x825d59
825d4f: 5e pop esi
825d50: 33 c0 xor eax,eax
825d52: 5b pop ebx
825d53: 8b e5 mov esp,ebp
825d55: 5d pop ebp
825d56: c2 08 00 ret 0x8
825d59: 8b 4b 0c mov ecx,DWORD PTR [ebx+0xc]
825d5c: 2b 4b 08 sub ecx,DWORD PTR [ebx+0x8]
825d5f: b8 09 cb 3d 8d mov eax,0x8d3dcb09
825d64: f7 e9 imul ecx
825d66: 03 d1 add edx,ecx
825d68: c1 fa 06 sar edx,0x6
825d6b: 8b c2 mov eax,edx
825d6d: c1 e8 1f shr eax,0x1f
825d70: 03 c2 add eax,edx
825d72: 57 push edi
825d73: 89 75 fc mov DWORD PTR [ebp-0x4],esi
825d76: 0f 84 d5 00 00 00 je 0x825e51
825d7c: 8b 7d 0c mov edi,DWORD PTR [ebp+0xc]
825d7f: 89 75 08 mov DWORD PTR [ebp+0x8],esi
825d82: 8b 73 08 mov esi,DWORD PTR [ebx+0x8]
825d85: 03 75 08 add esi,DWORD PTR [ebp+0x8]
825d88: 8b 4e 6c mov ecx,DWORD PTR [esi+0x6c]
825d8b: 3b 4f 6c cmp ecx,DWORD PTR [edi+0x6c]
825d8e: 0f 85 91 00 00 00 jne 0x825e25
825d94: 8b 56 40 mov edx,DWORD PTR [esi+0x40]
825d97: 3b 57 40 cmp edx,DWORD PTR [edi+0x40]
825d9a: 0f 85 85 00 00 00 jne 0x825e25
825da0: d9 46 44 fld DWORD PTR [esi+0x44]
825da3: d9 47 44 fld DWORD PTR [edi+0x44]
825da6: da e9 fucompp
825da8: df e0 fnstsw ax
825daa: f6 c4 44 test ah,0x44
825dad: 7a 76 jp 0x825e25
825daf: d9 46 48 fld DWORD PTR [esi+0x48]
825db2: d9 47 48 fld DWORD PTR [edi+0x48]
825db5: da e9 fucompp
825db7: df e0 fnstsw ax
825db9: f6 c4 44 test ah,0x44
825dbc: 7a 67 jp 0x825e25
825dbe: d9 46 4c fld DWORD PTR [esi+0x4c]
825dc1: d9 47 4c fld DWORD PTR [edi+0x4c]
825dc4: da e9 fucompp
825dc6: df e0 fnstsw ax
825dc8: f6 c4 44 test ah,0x44
825dcb: 7a 58 jp 0x825e25
825dcd: 83 7f 38 10 cmp DWORD PTR [edi+0x38],0x10
825dd1: 8b 57 34 mov edx,DWORD PTR [edi+0x34]
825dd4: 8d 47 24 lea eax,[edi+0x24]
825dd7: 8d 4e 24 lea ecx,[esi+0x24]
825dda: 72 02 jb 0x825dde
825ddc: 8b 00 mov eax,DWORD PTR [eax]
825dde: 52 push edx
825ddf: 50 push eax
825de0: 8b 41 10 mov eax,DWORD PTR [ecx+0x10]
825de3: 50 push eax
825de4: 6a 00 push 0x0
825de6: e8 b5 d8 bf ff call 0x4236a0
825deb: 85 c0 test eax,eax
825ded: 75 36 jne 0x825e25
825def: 83 7f 64 10 cmp DWORD PTR [edi+0x64],0x10
825df3: 8b 57 60 mov edx,DWORD PTR [edi+0x60]
825df6: 8d 47 50 lea eax,[edi+0x50]
825df9: 8d 4e 50 lea ecx,[esi+0x50]
825dfc: 72 02 jb 0x825e00
825dfe: 8b 00 mov eax,DWORD PTR [eax]
825e00: 52 push edx
825e01: 8b 51 10 mov edx,DWORD PTR [ecx+0x10]
825e04: 50 push eax
825e05: 52 push edx
825e06: 6a 00 push 0x0
825e08: e8 93 d8 bf ff call 0x4236a0
825e0d: 85 c0 test eax,eax
825e0f: 75 14 jne 0x825e25
825e11: 8d 47 08 lea eax,[edi+0x8]
825e14: 50 push eax
825e15: 8d 4e 08 lea ecx,[esi+0x8]
825e18: 51 push ecx
825e19: e8 a2 9a c4 ff call 0x46f8c0
825e1e: 83 c4 08 add esp,0x8
825e21: 84 c0 test al,al
825e23: 74 37 je 0x825e5c
825e25: 8b 4b 0c mov ecx,DWORD PTR [ebx+0xc]
825e28: 2b 4b 08 sub ecx,DWORD PTR [ebx+0x8]
825e2b: 8b 75 fc mov esi,DWORD PTR [ebp-0x4]
825e2e: 83 45 08 74 add DWORD PTR [ebp+0x8],0x74
825e32: b8 09 cb 3d 8d mov eax,0x8d3dcb09
825e37: f7 e9 imul ecx
825e39: 03 d1 add edx,ecx
825e3b: c1 fa 06 sar edx,0x6
825e3e: 8b c2 mov eax,edx
825e40: c1 e8 1f shr eax,0x1f
825e43: 46 inc esi
825e44: 03 c2 add eax,edx
825e46: 89 75 fc mov DWORD PTR [ebp-0x4],esi
825e49: 3b f0 cmp esi,eax
825e4b: 0f 82 31 ff ff ff jb 0x825d82
825e51: 5f pop edi
825e52: 5e pop esi
825e53: 33 c0 xor eax,eax
825e55: 5b pop ebx
825e56: 8b e5 mov esp,ebp
825e58: 5d pop ebp
825e59: c2 08 00 ret 0x8
825e5c: 5f pop edi
825e5d: 8b c6 mov eax,esi
825e5f: 5e pop esi
825e60: 5b pop ebx
825e61: 8b e5 mov esp,ebp
825e63: 5d pop ebp
825e64: c2 08 00 ret 0x8

View file

@ -0,0 +1,10 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00924faa <.text+0x523faa>:
924faa: ff 25 c8 d1 9d 00 jmp DWORD PTR ds:0x9dd1c8
924fb0: ff 25 cc d1 9d 00 jmp DWORD PTR ds:0x9dd1cc
924fb6: ff 25 d0 d1 9d 00 jmp DWORD PTR ds:0x9dd1d0

View file

@ -0,0 +1,798 @@
{
"schema": "sots-abi-static-capture/2",
"session": "run-35e59053176da458d8b46fea",
"actor": "research-abi-analyst",
"role": "analyst",
"model": "openai/gpt-5.6-sol",
"timestamp": "2026-09-10T13:22:55.662074+00:00",
"decisions": [
"d-e9d6d48cd77538556d1a1c1f",
"d-6e30d172051af0385f5979eb"
],
"scope": "Static instruction/byte capture and immutable input identity; no game/runtime execution.",
"source_before": {
"argv": [
"/usr/bin/python3",
"/home/alex/sots-re/tools/campaign.py",
"--state-root",
"/home/alex/sots-re",
"source-binding",
"research-completion-abi",
"--engine-worktree",
"/tmp/opencode/sots-final-research-engine",
"--re-worktree",
"/tmp/opencode/sots-final-research-re"
],
"value": {
"engine": {
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
"path": "/tmp/opencode/sots-final-research-engine",
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
},
"re": {
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
"path": "/tmp/opencode/sots-final-research-re",
"sha256": "e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f"
}
}
},
"source_after": {
"argv": [
"/usr/bin/python3",
"/home/alex/sots-re/tools/campaign.py",
"--state-root",
"/home/alex/sots-re",
"source-binding",
"research-completion-abi",
"--engine-worktree",
"/tmp/opencode/sots-final-research-engine",
"--re-worktree",
"/tmp/opencode/sots-final-research-re"
],
"value": {
"engine": {
"commit": "7741d42fc5e4e761e6449bdaf0e4a61d00036a23",
"path": "/tmp/opencode/sots-final-research-engine",
"sha256": "ccd8e02083e8d2e2b3e97976ace2273c8f924dfc02a39e919004eaf3544c50fd"
},
"re": {
"commit": "3bfde5a70d874a723e797a695bbd847fd82c0aa7",
"path": "/tmp/opencode/sots-final-research-re",
"sha256": "e5cf1c44761bebcada1aacb53f30722bdaf4784f21a9ec1023a1851c142c124f"
}
}
},
"files": {
"binary": {
"path": "/home/alex/sots-re/dumps/sots.exe",
"resolved_path": "/home/alex/sots-re/dumps/sots.exe",
"bytes": 7898624,
"sha256": "970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841"
},
"objdump": {
"path": "/usr/bin/objdump",
"resolved_path": "/usr/bin/x86_64-linux-gnu-objdump",
"bytes": 373888,
"sha256": "1eaaef2e7f57c4c7f69115c495e2466f5a8c8e5f3bc42221d092382f30f9d4cd"
},
"python": {
"path": "/usr/bin/python3",
"resolved_path": "/usr/bin/python3.10",
"bytes": 5941864,
"sha256": "a2f33a6e006989270f4340528eb61f8f97366e00a5d1b602ac8672ea44fc56ae"
},
"save": {
"path": "/home/alex/sots-re/verify/results/saves/turn3-state.sav",
"resolved_path": "/home/alex/sots-re/verify/results/saves/turn3-state.sav",
"bytes": 67219,
"sha256": "978041acd168b56ed8eb3f5e42e78d5e70eae6e6517d75e659a5eb7ca3d60921"
},
"campaign": {
"path": "/home/alex/sots-re/tools/campaign.py",
"resolved_path": "/home/alex/sots-re/tools/campaign.py",
"bytes": 35131,
"sha256": "a9fafe320bf2b59200c2572bc43dff8823827b9d7b78dc7b959e4b6b983f2123"
},
"save_reader": {
"path": "/home/alex/sots-re/verify/save-reader/save_reader.py",
"resolved_path": "/home/alex/sots-re/verify/save-reader/save_reader.py",
"bytes": 74367,
"sha256": "2dcac286b5382b67fe8f2dbce58c80950dd430b726ed0e98f3bcea155df0df35"
},
"state_checksum": {
"path": "/home/alex/sots-re/verify/state-checksum/state_checksum.py",
"resolved_path": "/home/alex/sots-re/verify/state-checksum/state_checksum.py",
"bytes": 57792,
"sha256": "ed80458e84d92040aa3872464d8df315e935f379ca0da5a2df81c3049826e5b8"
}
},
"image_base": "0x00400000",
"commands": [
{
"name": "observed-ctor",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x008562a0",
"--stop-address=0x00856310",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 2225,
"sha256": "e200e8f271005787df1ec1d259f7cc644a0060c300731b19ec033fe3f2e3616d"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 43
},
{
"name": "observed-append",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x007b7320",
"--stop-address=0x007b73a2",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 2853,
"sha256": "99858bf590aeed92ed7b5d39b4cb84c29dd3ce72b73b8b7d30830cc9f258f334"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 57
},
{
"name": "observed-copy",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x0079a150",
"--stop-address=0x0079a1dc",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 2772,
"sha256": "48cfde0b73307ca4b10b68d6a0d5444671a51744c9445d7c4431bb4955c4c14d"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 52
},
{
"name": "observed-growth",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x007b34e0",
"--stop-address=0x007b35f2",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 5244,
"sha256": "7fb72600e542553bbd197838a3cb0f0b6166925356b6c05a170d1eb66b65b30f"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 101
},
{
"name": "observed-alloc",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x0057e590",
"--stop-address=0x0057e5e7",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 1555,
"sha256": "27a38437141ec8f1d1975f75a7cd5b84718b20d179e7cbd3b3666453ac33c6c0"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 30
},
{
"name": "player-ctor",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x0084ee30",
"--stop-address=0x0084eef4",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 3382,
"sha256": "04a44e75771e8f3a3711bfca4a88c8fa73f1d600d264d4b5f6d4bbf3aee49490"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 62
},
{
"name": "player-append",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x0086c580",
"--stop-address=0x0086c631",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 3422,
"sha256": "b212a85480fc9bcb1b3046ebe5faab9efa45af6fb7595e4ce002ddcdb2529791"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 66
},
{
"name": "player-growth",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00869500",
"--stop-address=0x00869620",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 5928,
"sha256": "8e78b3dd17e52d947f78c93867c0977eddd16ce176b10291ba3afd8c3567428f"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 121
},
{
"name": "player-copy",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x007693f0",
"--stop-address=0x007694c3",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 4132,
"sha256": "956786989ef2866c27ee92b8c687fbc13c000a9494830b476e451a5d4e819570"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 76
},
{
"name": "player-dtor",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x0061ae90",
"--stop-address=0x0061aefc",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 2004,
"sha256": "a54b81f12580162518f780250d7dfda03b8d2e464c4ace77997208047ba11243"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 36
},
{
"name": "string-assign",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x004249a0",
"--stop-address=0x00424add",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 6102,
"sha256": "2e7a53241db15a13b74b49c2d09cb70704d5daffae1ff023364aeb64afd47815"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 117
},
{
"name": "import-thunks",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00924faa",
"--stop-address=0x00924fbc",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 304,
"sha256": "ad439944e6487e4131ac43f4ce75e61c5a362848b39ca99ca027fcee3f6162d0"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 4
},
{
"name": "turn-get-create",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00885380",
"--stop-address=0x0088544e",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 4134,
"sha256": "9cb7d2ccfcc645b3b642e520ba51c85330c57d6d4395ed3fbd4a4a1950436e80"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 81
},
{
"name": "turn-append",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00884cb0",
"--stop-address=0x00884d93",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 4309,
"sha256": "957339f40b2af8947cb883cc1d3a9d1e151bf7663305415065472ef9171dc33d"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 82
},
{
"name": "turn-growth",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x008841a0",
"--stop-address=0x00884300",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 6804,
"sha256": "9b7674abc156a82c2db00f95dd6719bfb718644536a1228baadad284b3ed8461"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 136
},
{
"name": "nested-copy-authority",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00779850",
"--stop-address=0x00779930",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 4465,
"sha256": "973c87ccab76a8454a4e43c83b59cdeace1e4f8c124c5aa9630cb956e3156bb8"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 88
},
{
"name": "nested-dtor",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00629580",
"--stop-address=0x006295ce",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 1887,
"sha256": "0aba6fc800760e3a113c07238cfb6e721623eb0bb8a933a990d3e2e82823d00f"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 37
},
{
"name": "turn-virtual-dtor",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x0062e120",
"--stop-address=0x0062e170",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 1429,
"sha256": "319e74267a88f166e05306be5cb2a2d7ffdca3e75169f7e7e6e8d379f153220c"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 27
},
{
"name": "dedup",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00825d40",
"--stop-address=0x00825e67",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 6153,
"sha256": "cb10ca40246bc57fd5431ab099008727fe5be90c22bd7f57fad1cb30301f002c"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 121
},
{
"name": "string-not-equal",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x0046f8c0",
"--stop-address=0x0046f8f0",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 1352,
"sha256": "7d1efe697a4f1d0549dd25f15758e601ef94583389aecf4a59f99cf3d825bf69"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 27
},
{
"name": "prune",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00879eb0",
"--stop-address=0x00879fc0",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 6620,
"sha256": "8536d2a47f14f5b6e0f1796de33189471687a0a0d0c2414e98e1623cb8226d99"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 134
},
{
"name": "nested-copy-stop-9913",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00779850",
"--stop-address=0x00779913",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 3815,
"sha256": "715d47e9675909adf6c2c42acae622b3c43dc9ce45dc678ffe623466e44ae219"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 73
},
{
"name": "nested-copy-stop-9915",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00779850",
"--stop-address=0x00779915",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 3819,
"sha256": "d545b88701652f65511047c65917b308b6982c23c52d6fa14ae91174feedcc31"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 73
},
{
"name": "nested-copy-stop-a20",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00779850",
"--stop-address=0x00779a20",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 8469,
"sha256": "e3988aa615066dce65ec16de0d61051ffc5deafe8c8eef4aeb0bbfbe931204a1"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 169
},
{
"name": "nested-copy-stop-a21",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00779850",
"--stop-address=0x00779a21",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 8471,
"sha256": "b6d58767d00328c37139f439db480c9bb5ce6767dabf212f9e750a31fea0d3d7"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 169
},
{
"name": "nested-copy-stop-a23",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00779850",
"--stop-address=0x00779a23",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 8518,
"sha256": "e8cc66eb74730fcf7853d66df8caa620ddb3fc8c75335f0573ac490037a7a88e"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 170
},
{
"name": "nested-copy-stop-a28",
"argv": [
"/usr/bin/objdump",
"-D",
"-Mintel",
"--start-address=0x00779850",
"--stop-address=0x00779a28",
"/home/alex/sots-re/dumps/sots.exe"
],
"returncode": 0,
"stdout": {
"bytes": 8566,
"sha256": "7b02af65ab916de02fc44b2004f8acedc127bf686874bd0c75d4a277c40d9560"
},
"stderr": {
"bytes": 0,
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
"instruction_rows": 171
}
],
"direct_pe": {
"ret4": {
"va": "0x00779912",
"bytes": "c20400",
"section": ".text",
"file_offset": 3640594
},
"a20-family": {
"va": "0x00779a1f",
"bytes": "74108bcfe8286affff",
"section": ".text",
"file_offset": 3640863
},
"observed-stride": {
"va": "0x007b7333",
"bytes": "3bc777412bf8b8e9",
"section": ".text",
"file_offset": 3893043
},
"player-stride": {
"va": "0x0086c593",
"bytes": "57a1788baf0033c5",
"section": ".text",
"file_offset": 4635027
},
"turn-stride": {
"va": "0x00884cc3",
"bytes": "57a1788baf0033c5",
"section": ".text",
"file_offset": 4735171
},
"constructor-defaults": {
"va": "0x00af0dc8",
"bytes": "ffff7f7fffff7f7fffff7f7f",
"section": ".data",
"file_offset": 7271880
}
},
"checks": [
{
"name": "all_commands_zero",
"status": "pass"
},
{
"name": "all_stdout_nonempty",
"status": "pass"
},
{
"name": "all_stderr_empty",
"status": "pass"
},
{
"name": "source_stable",
"status": "pass"
},
{
"name": "9913_is_truncated_terminal",
"status": "pass"
},
{
"name": "9915_terminal_ret4",
"status": "pass"
},
{
"name": "authority_contains_ret4",
"status": "pass"
},
{
"name": "a20_is_truncated_terminal",
"status": "pass"
},
{
"name": "a21_adds_complete_je",
"status": "pass"
},
{
"name": "a23_adds_complete_mov",
"status": "pass"
},
{
"name": "a28_adds_complete_call",
"status": "pass"
},
{
"name": "direct_ret4",
"status": "pass"
},
{
"name": "direct_a20_family",
"status": "pass"
},
{
"name": "direct_defaults",
"status": "pass"
}
],
"failed": [],
"static_branch_exposure": [
"existing-match/miss",
"spare/full capacity",
"empty/nonempty nested copy",
"null/nonnull destruction",
"short/long string",
"normal/unwind",
"bad/aligned boundaries"
],
"runtime_unexercised": [
"all listed static branches",
"allocator safety",
"event construction and IDs",
"PostEvent caller defaults/write order",
"exception throw",
"RNG state/draws"
],
"original_helpers": [
"0x00924fb6 allocation thunk",
"0x00924faa deallocation thunk",
"0x0046f8c0 original string comparison when called"
]
}

View file

@ -0,0 +1,94 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00779850 <.text+0x378850>:
779850: 55 push ebp
779851: 8b ec mov ebp,esp
779853: 6a ff push 0xffffffff
779855: 68 10 7b 98 00 push 0x987b10
77985a: 64 a1 00 00 00 00 mov eax,fs:0x0
779860: 50 push eax
779861: 83 ec 08 sub esp,0x8
779864: 53 push ebx
779865: 56 push esi
779866: 57 push edi
779867: a1 78 8b af 00 mov eax,ds:0xaf8b78
77986c: 33 c5 xor eax,ebp
77986e: 50 push eax
77986f: 8d 45 f4 lea eax,[ebp-0xc]
779872: 64 a3 00 00 00 00 mov fs:0x0,eax
779878: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
77987b: 8b f1 mov esi,ecx
77987d: 89 75 ec mov DWORD PTR [ebp-0x14],esi
779880: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
779883: 33 c0 xor eax,eax
779885: 89 06 mov DWORD PTR [esi],eax
779887: 89 46 04 mov DWORD PTR [esi+0x4],eax
77988a: 89 46 08 mov DWORD PTR [esi+0x8],eax
77988d: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
779890: 2b 0b sub ecx,DWORD PTR [ebx]
779892: b8 09 cb 3d 8d mov eax,0x8d3dcb09
779897: f7 e9 imul ecx
779899: 03 d1 add edx,ecx
77989b: c1 fa 06 sar edx,0x6
77989e: 8b fa mov edi,edx
7798a0: b8 00 00 00 00 mov eax,0x0
7798a5: c1 ef 1f shr edi,0x1f
7798a8: 03 fa add edi,edx
7798aa: 89 06 mov DWORD PTR [esi],eax
7798ac: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798af: 89 46 08 mov DWORD PTR [esi+0x8],eax
7798b2: 74 4b je 0x7798ff
7798b4: 81 ff 2c f7 34 02 cmp edi,0x234f72c
7798ba: 76 0b jbe 0x7798c7
7798bc: 68 90 1f 9e 00 push 0x9e1f90
7798c1: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
7798c7: 8d 4e 0c lea ecx,[esi+0xc]
7798ca: 57 push edi
7798cb: e8 70 16 01 00 call 0x78af40
7798d0: 6b ff 74 imul edi,edi,0x74
7798d3: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
7798d6: 52 push edx
7798d7: 8d 56 0c lea edx,[esi+0xc]
7798da: 52 push edx
7798db: 03 f8 add edi,eax
7798dd: 89 06 mov DWORD PTR [esi],eax
7798df: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798e2: 89 7e 08 mov DWORD PTR [esi+0x8],edi
7798e5: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
7798e8: 8b 1b mov ebx,DWORD PTR [ebx]
7798ea: 50 push eax
7798eb: 51 push ecx
7798ec: 53 push ebx
7798ed: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7798f4: e8 a7 8c ff ff call 0x7725a0
7798f9: 83 c4 14 add esp,0x14
7798fc: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798ff: 8b c6 mov eax,esi
779901: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
779904: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
77990b: 59 pop ecx
77990c: 5f pop edi
77990d: 5e pop esi
77990e: 5b pop ebx
77990f: 8b e5 mov esp,ebp
779911: 5d pop ebp
779912: c2 04 00 ret 0x4
779915: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14]
779918: e8 63 fc ea ff call 0x629580
77991d: 6a 00 push 0x0
77991f: 6a 00 push 0x0
779921: e8 96 b6 1a 00 call 0x924fbc
779926: cc int3
779927: cc int3
779928: cc int3
779929: cc int3
77992a: cc int3
77992b: cc int3
77992c: cc int3
77992d: cc int3
77992e: cc int3
77992f: cc int3

View file

@ -0,0 +1,79 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00779850 <.text+0x378850>:
779850: 55 push ebp
779851: 8b ec mov ebp,esp
779853: 6a ff push 0xffffffff
779855: 68 10 7b 98 00 push 0x987b10
77985a: 64 a1 00 00 00 00 mov eax,fs:0x0
779860: 50 push eax
779861: 83 ec 08 sub esp,0x8
779864: 53 push ebx
779865: 56 push esi
779866: 57 push edi
779867: a1 78 8b af 00 mov eax,ds:0xaf8b78
77986c: 33 c5 xor eax,ebp
77986e: 50 push eax
77986f: 8d 45 f4 lea eax,[ebp-0xc]
779872: 64 a3 00 00 00 00 mov fs:0x0,eax
779878: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
77987b: 8b f1 mov esi,ecx
77987d: 89 75 ec mov DWORD PTR [ebp-0x14],esi
779880: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
779883: 33 c0 xor eax,eax
779885: 89 06 mov DWORD PTR [esi],eax
779887: 89 46 04 mov DWORD PTR [esi+0x4],eax
77988a: 89 46 08 mov DWORD PTR [esi+0x8],eax
77988d: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
779890: 2b 0b sub ecx,DWORD PTR [ebx]
779892: b8 09 cb 3d 8d mov eax,0x8d3dcb09
779897: f7 e9 imul ecx
779899: 03 d1 add edx,ecx
77989b: c1 fa 06 sar edx,0x6
77989e: 8b fa mov edi,edx
7798a0: b8 00 00 00 00 mov eax,0x0
7798a5: c1 ef 1f shr edi,0x1f
7798a8: 03 fa add edi,edx
7798aa: 89 06 mov DWORD PTR [esi],eax
7798ac: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798af: 89 46 08 mov DWORD PTR [esi+0x8],eax
7798b2: 74 4b je 0x7798ff
7798b4: 81 ff 2c f7 34 02 cmp edi,0x234f72c
7798ba: 76 0b jbe 0x7798c7
7798bc: 68 90 1f 9e 00 push 0x9e1f90
7798c1: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
7798c7: 8d 4e 0c lea ecx,[esi+0xc]
7798ca: 57 push edi
7798cb: e8 70 16 01 00 call 0x78af40
7798d0: 6b ff 74 imul edi,edi,0x74
7798d3: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
7798d6: 52 push edx
7798d7: 8d 56 0c lea edx,[esi+0xc]
7798da: 52 push edx
7798db: 03 f8 add edi,eax
7798dd: 89 06 mov DWORD PTR [esi],eax
7798df: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798e2: 89 7e 08 mov DWORD PTR [esi+0x8],edi
7798e5: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
7798e8: 8b 1b mov ebx,DWORD PTR [ebx]
7798ea: 50 push eax
7798eb: 51 push ecx
7798ec: 53 push ebx
7798ed: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7798f4: e8 a7 8c ff ff call 0x7725a0
7798f9: 83 c4 14 add esp,0x14
7798fc: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798ff: 8b c6 mov eax,esi
779901: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
779904: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
77990b: 59 pop ecx
77990c: 5f pop edi
77990d: 5e pop esi
77990e: 5b pop ebx
77990f: 8b e5 mov esp,ebp
779911: 5d pop ebp
779912: c2 ret 0x4

View file

@ -0,0 +1,79 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00779850 <.text+0x378850>:
779850: 55 push ebp
779851: 8b ec mov ebp,esp
779853: 6a ff push 0xffffffff
779855: 68 10 7b 98 00 push 0x987b10
77985a: 64 a1 00 00 00 00 mov eax,fs:0x0
779860: 50 push eax
779861: 83 ec 08 sub esp,0x8
779864: 53 push ebx
779865: 56 push esi
779866: 57 push edi
779867: a1 78 8b af 00 mov eax,ds:0xaf8b78
77986c: 33 c5 xor eax,ebp
77986e: 50 push eax
77986f: 8d 45 f4 lea eax,[ebp-0xc]
779872: 64 a3 00 00 00 00 mov fs:0x0,eax
779878: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
77987b: 8b f1 mov esi,ecx
77987d: 89 75 ec mov DWORD PTR [ebp-0x14],esi
779880: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
779883: 33 c0 xor eax,eax
779885: 89 06 mov DWORD PTR [esi],eax
779887: 89 46 04 mov DWORD PTR [esi+0x4],eax
77988a: 89 46 08 mov DWORD PTR [esi+0x8],eax
77988d: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
779890: 2b 0b sub ecx,DWORD PTR [ebx]
779892: b8 09 cb 3d 8d mov eax,0x8d3dcb09
779897: f7 e9 imul ecx
779899: 03 d1 add edx,ecx
77989b: c1 fa 06 sar edx,0x6
77989e: 8b fa mov edi,edx
7798a0: b8 00 00 00 00 mov eax,0x0
7798a5: c1 ef 1f shr edi,0x1f
7798a8: 03 fa add edi,edx
7798aa: 89 06 mov DWORD PTR [esi],eax
7798ac: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798af: 89 46 08 mov DWORD PTR [esi+0x8],eax
7798b2: 74 4b je 0x7798ff
7798b4: 81 ff 2c f7 34 02 cmp edi,0x234f72c
7798ba: 76 0b jbe 0x7798c7
7798bc: 68 90 1f 9e 00 push 0x9e1f90
7798c1: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
7798c7: 8d 4e 0c lea ecx,[esi+0xc]
7798ca: 57 push edi
7798cb: e8 70 16 01 00 call 0x78af40
7798d0: 6b ff 74 imul edi,edi,0x74
7798d3: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
7798d6: 52 push edx
7798d7: 8d 56 0c lea edx,[esi+0xc]
7798da: 52 push edx
7798db: 03 f8 add edi,eax
7798dd: 89 06 mov DWORD PTR [esi],eax
7798df: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798e2: 89 7e 08 mov DWORD PTR [esi+0x8],edi
7798e5: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
7798e8: 8b 1b mov ebx,DWORD PTR [ebx]
7798ea: 50 push eax
7798eb: 51 push ecx
7798ec: 53 push ebx
7798ed: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7798f4: e8 a7 8c ff ff call 0x7725a0
7798f9: 83 c4 14 add esp,0x14
7798fc: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798ff: 8b c6 mov eax,esi
779901: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
779904: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
77990b: 59 pop ecx
77990c: 5f pop edi
77990d: 5e pop esi
77990e: 5b pop ebx
77990f: 8b e5 mov esp,ebp
779911: 5d pop ebp
779912: c2 04 00 ret 0x4

View file

@ -0,0 +1,175 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00779850 <.text+0x378850>:
779850: 55 push ebp
779851: 8b ec mov ebp,esp
779853: 6a ff push 0xffffffff
779855: 68 10 7b 98 00 push 0x987b10
77985a: 64 a1 00 00 00 00 mov eax,fs:0x0
779860: 50 push eax
779861: 83 ec 08 sub esp,0x8
779864: 53 push ebx
779865: 56 push esi
779866: 57 push edi
779867: a1 78 8b af 00 mov eax,ds:0xaf8b78
77986c: 33 c5 xor eax,ebp
77986e: 50 push eax
77986f: 8d 45 f4 lea eax,[ebp-0xc]
779872: 64 a3 00 00 00 00 mov fs:0x0,eax
779878: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
77987b: 8b f1 mov esi,ecx
77987d: 89 75 ec mov DWORD PTR [ebp-0x14],esi
779880: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
779883: 33 c0 xor eax,eax
779885: 89 06 mov DWORD PTR [esi],eax
779887: 89 46 04 mov DWORD PTR [esi+0x4],eax
77988a: 89 46 08 mov DWORD PTR [esi+0x8],eax
77988d: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
779890: 2b 0b sub ecx,DWORD PTR [ebx]
779892: b8 09 cb 3d 8d mov eax,0x8d3dcb09
779897: f7 e9 imul ecx
779899: 03 d1 add edx,ecx
77989b: c1 fa 06 sar edx,0x6
77989e: 8b fa mov edi,edx
7798a0: b8 00 00 00 00 mov eax,0x0
7798a5: c1 ef 1f shr edi,0x1f
7798a8: 03 fa add edi,edx
7798aa: 89 06 mov DWORD PTR [esi],eax
7798ac: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798af: 89 46 08 mov DWORD PTR [esi+0x8],eax
7798b2: 74 4b je 0x7798ff
7798b4: 81 ff 2c f7 34 02 cmp edi,0x234f72c
7798ba: 76 0b jbe 0x7798c7
7798bc: 68 90 1f 9e 00 push 0x9e1f90
7798c1: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
7798c7: 8d 4e 0c lea ecx,[esi+0xc]
7798ca: 57 push edi
7798cb: e8 70 16 01 00 call 0x78af40
7798d0: 6b ff 74 imul edi,edi,0x74
7798d3: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
7798d6: 52 push edx
7798d7: 8d 56 0c lea edx,[esi+0xc]
7798da: 52 push edx
7798db: 03 f8 add edi,eax
7798dd: 89 06 mov DWORD PTR [esi],eax
7798df: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798e2: 89 7e 08 mov DWORD PTR [esi+0x8],edi
7798e5: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
7798e8: 8b 1b mov ebx,DWORD PTR [ebx]
7798ea: 50 push eax
7798eb: 51 push ecx
7798ec: 53 push ebx
7798ed: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7798f4: e8 a7 8c ff ff call 0x7725a0
7798f9: 83 c4 14 add esp,0x14
7798fc: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798ff: 8b c6 mov eax,esi
779901: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
779904: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
77990b: 59 pop ecx
77990c: 5f pop edi
77990d: 5e pop esi
77990e: 5b pop ebx
77990f: 8b e5 mov esp,ebp
779911: 5d pop ebp
779912: c2 04 00 ret 0x4
779915: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14]
779918: e8 63 fc ea ff call 0x629580
77991d: 6a 00 push 0x0
77991f: 6a 00 push 0x0
779921: e8 96 b6 1a 00 call 0x924fbc
779926: cc int3
779927: cc int3
779928: cc int3
779929: cc int3
77992a: cc int3
77992b: cc int3
77992c: cc int3
77992d: cc int3
77992e: cc int3
77992f: cc int3
779930: 55 push ebp
779931: 8b ec mov ebp,esp
779933: 6a ff push 0xffffffff
779935: 68 38 06 97 00 push 0x970638
77993a: 64 a1 00 00 00 00 mov eax,fs:0x0
779940: 50 push eax
779941: 83 ec 20 sub esp,0x20
779944: a1 78 8b af 00 mov eax,ds:0xaf8b78
779949: 33 c5 xor eax,ebp
77994b: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
77994e: 56 push esi
77994f: 50 push eax
779950: 8d 45 f4 lea eax,[ebp-0xc]
779953: 64 a3 00 00 00 00 mov fs:0x0,eax
779959: 8b f1 mov esi,ecx
77995b: 8b 86 8c 00 00 00 mov eax,DWORD PTR [esi+0x8c]
779961: 85 c0 test eax,eax
779963: 75 0c jne 0x779971
779965: 68 34 24 a2 00 push 0xa22434
77996a: e8 e1 05 14 00 call 0x8b9f50
77996f: eb 7e jmp 0x7799ef
779971: 50 push eax
779972: e8 09 cc c9 ff call 0x416580
779977: 83 c4 04 add esp,0x4
77997a: 85 c0 test eax,eax
77997c: 74 0c je 0x77998a
77997e: 68 f8 23 a2 00 push 0xa223f8
779983: e8 58 08 14 00 call 0x8ba1e0
779988: eb 65 jmp 0x7799ef
77998a: e8 d1 58 dc ff call 0x53f260
77998f: c7 45 e8 0f 00 00 00 mov DWORD PTR [ebp-0x18],0xf
779996: c7 45 e4 00 00 00 00 mov DWORD PTR [ebp-0x1c],0x0
77999d: c6 45 d4 00 mov BYTE PTR [ebp-0x2c],0x0
7799a1: 8d 4d d4 lea ecx,[ebp-0x2c]
7799a4: 51 push ecx
7799a5: 50 push eax
7799a6: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7799ad: e8 fe 52 dc ff call 0x53ecb0
7799b2: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
7799b5: 83 c4 08 add esp,0x8
7799b8: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
7799bc: 73 03 jae 0x7799c1
7799be: 8d 45 d4 lea eax,[ebp-0x2c]
7799c1: 8b 96 8c 00 00 00 mov edx,DWORD PTR [esi+0x8c]
7799c7: 6a 00 push 0x0
7799c9: 56 push esi
7799ca: 68 a0 8d 77 00 push 0x778da0
7799cf: 68 e0 ea 76 00 push 0x76eae0
7799d4: 6a 00 push 0x0
7799d6: 50 push eax
7799d7: 52 push edx
7799d8: e8 f3 d7 c9 ff call 0x4171d0
7799dd: 83 c4 1c add esp,0x1c
7799e0: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
7799e4: 72 0c jb 0x7799f2
7799e6: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
7799e9: 50 push eax
7799ea: e8 bb b5 1a 00 call 0x924faa
7799ef: 83 c4 04 add esp,0x4
7799f2: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
7799f5: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
7799fc: 59 pop ecx
7799fd: 5e pop esi
7799fe: 8b 4d f0 mov ecx,DWORD PTR [ebp-0x10]
779a01: 33 cd xor ecx,ebp
779a03: e8 7a b3 1a 00 call 0x924d82
779a08: 8b e5 mov esp,ebp
779a0a: 5d pop ebp
779a0b: c3 ret
779a0c: cc int3
779a0d: cc int3
779a0e: cc int3
779a0f: cc int3
779a10: 53 push ebx
779a11: 56 push esi
779a12: 8b f1 mov esi,ecx
779a14: 57 push edi
779a15: 8b be 24 01 00 00 mov edi,DWORD PTR [esi+0x124]
779a1b: 33 db xor ebx,ebx
779a1d: 3b fb cmp edi,ebx
779a1f: 74 je 0x779a31

View file

@ -0,0 +1,175 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00779850 <.text+0x378850>:
779850: 55 push ebp
779851: 8b ec mov ebp,esp
779853: 6a ff push 0xffffffff
779855: 68 10 7b 98 00 push 0x987b10
77985a: 64 a1 00 00 00 00 mov eax,fs:0x0
779860: 50 push eax
779861: 83 ec 08 sub esp,0x8
779864: 53 push ebx
779865: 56 push esi
779866: 57 push edi
779867: a1 78 8b af 00 mov eax,ds:0xaf8b78
77986c: 33 c5 xor eax,ebp
77986e: 50 push eax
77986f: 8d 45 f4 lea eax,[ebp-0xc]
779872: 64 a3 00 00 00 00 mov fs:0x0,eax
779878: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
77987b: 8b f1 mov esi,ecx
77987d: 89 75 ec mov DWORD PTR [ebp-0x14],esi
779880: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
779883: 33 c0 xor eax,eax
779885: 89 06 mov DWORD PTR [esi],eax
779887: 89 46 04 mov DWORD PTR [esi+0x4],eax
77988a: 89 46 08 mov DWORD PTR [esi+0x8],eax
77988d: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
779890: 2b 0b sub ecx,DWORD PTR [ebx]
779892: b8 09 cb 3d 8d mov eax,0x8d3dcb09
779897: f7 e9 imul ecx
779899: 03 d1 add edx,ecx
77989b: c1 fa 06 sar edx,0x6
77989e: 8b fa mov edi,edx
7798a0: b8 00 00 00 00 mov eax,0x0
7798a5: c1 ef 1f shr edi,0x1f
7798a8: 03 fa add edi,edx
7798aa: 89 06 mov DWORD PTR [esi],eax
7798ac: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798af: 89 46 08 mov DWORD PTR [esi+0x8],eax
7798b2: 74 4b je 0x7798ff
7798b4: 81 ff 2c f7 34 02 cmp edi,0x234f72c
7798ba: 76 0b jbe 0x7798c7
7798bc: 68 90 1f 9e 00 push 0x9e1f90
7798c1: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
7798c7: 8d 4e 0c lea ecx,[esi+0xc]
7798ca: 57 push edi
7798cb: e8 70 16 01 00 call 0x78af40
7798d0: 6b ff 74 imul edi,edi,0x74
7798d3: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
7798d6: 52 push edx
7798d7: 8d 56 0c lea edx,[esi+0xc]
7798da: 52 push edx
7798db: 03 f8 add edi,eax
7798dd: 89 06 mov DWORD PTR [esi],eax
7798df: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798e2: 89 7e 08 mov DWORD PTR [esi+0x8],edi
7798e5: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
7798e8: 8b 1b mov ebx,DWORD PTR [ebx]
7798ea: 50 push eax
7798eb: 51 push ecx
7798ec: 53 push ebx
7798ed: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7798f4: e8 a7 8c ff ff call 0x7725a0
7798f9: 83 c4 14 add esp,0x14
7798fc: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798ff: 8b c6 mov eax,esi
779901: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
779904: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
77990b: 59 pop ecx
77990c: 5f pop edi
77990d: 5e pop esi
77990e: 5b pop ebx
77990f: 8b e5 mov esp,ebp
779911: 5d pop ebp
779912: c2 04 00 ret 0x4
779915: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14]
779918: e8 63 fc ea ff call 0x629580
77991d: 6a 00 push 0x0
77991f: 6a 00 push 0x0
779921: e8 96 b6 1a 00 call 0x924fbc
779926: cc int3
779927: cc int3
779928: cc int3
779929: cc int3
77992a: cc int3
77992b: cc int3
77992c: cc int3
77992d: cc int3
77992e: cc int3
77992f: cc int3
779930: 55 push ebp
779931: 8b ec mov ebp,esp
779933: 6a ff push 0xffffffff
779935: 68 38 06 97 00 push 0x970638
77993a: 64 a1 00 00 00 00 mov eax,fs:0x0
779940: 50 push eax
779941: 83 ec 20 sub esp,0x20
779944: a1 78 8b af 00 mov eax,ds:0xaf8b78
779949: 33 c5 xor eax,ebp
77994b: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
77994e: 56 push esi
77994f: 50 push eax
779950: 8d 45 f4 lea eax,[ebp-0xc]
779953: 64 a3 00 00 00 00 mov fs:0x0,eax
779959: 8b f1 mov esi,ecx
77995b: 8b 86 8c 00 00 00 mov eax,DWORD PTR [esi+0x8c]
779961: 85 c0 test eax,eax
779963: 75 0c jne 0x779971
779965: 68 34 24 a2 00 push 0xa22434
77996a: e8 e1 05 14 00 call 0x8b9f50
77996f: eb 7e jmp 0x7799ef
779971: 50 push eax
779972: e8 09 cc c9 ff call 0x416580
779977: 83 c4 04 add esp,0x4
77997a: 85 c0 test eax,eax
77997c: 74 0c je 0x77998a
77997e: 68 f8 23 a2 00 push 0xa223f8
779983: e8 58 08 14 00 call 0x8ba1e0
779988: eb 65 jmp 0x7799ef
77998a: e8 d1 58 dc ff call 0x53f260
77998f: c7 45 e8 0f 00 00 00 mov DWORD PTR [ebp-0x18],0xf
779996: c7 45 e4 00 00 00 00 mov DWORD PTR [ebp-0x1c],0x0
77999d: c6 45 d4 00 mov BYTE PTR [ebp-0x2c],0x0
7799a1: 8d 4d d4 lea ecx,[ebp-0x2c]
7799a4: 51 push ecx
7799a5: 50 push eax
7799a6: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7799ad: e8 fe 52 dc ff call 0x53ecb0
7799b2: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
7799b5: 83 c4 08 add esp,0x8
7799b8: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
7799bc: 73 03 jae 0x7799c1
7799be: 8d 45 d4 lea eax,[ebp-0x2c]
7799c1: 8b 96 8c 00 00 00 mov edx,DWORD PTR [esi+0x8c]
7799c7: 6a 00 push 0x0
7799c9: 56 push esi
7799ca: 68 a0 8d 77 00 push 0x778da0
7799cf: 68 e0 ea 76 00 push 0x76eae0
7799d4: 6a 00 push 0x0
7799d6: 50 push eax
7799d7: 52 push edx
7799d8: e8 f3 d7 c9 ff call 0x4171d0
7799dd: 83 c4 1c add esp,0x1c
7799e0: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
7799e4: 72 0c jb 0x7799f2
7799e6: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
7799e9: 50 push eax
7799ea: e8 bb b5 1a 00 call 0x924faa
7799ef: 83 c4 04 add esp,0x4
7799f2: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
7799f5: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
7799fc: 59 pop ecx
7799fd: 5e pop esi
7799fe: 8b 4d f0 mov ecx,DWORD PTR [ebp-0x10]
779a01: 33 cd xor ecx,ebp
779a03: e8 7a b3 1a 00 call 0x924d82
779a08: 8b e5 mov esp,ebp
779a0a: 5d pop ebp
779a0b: c3 ret
779a0c: cc int3
779a0d: cc int3
779a0e: cc int3
779a0f: cc int3
779a10: 53 push ebx
779a11: 56 push esi
779a12: 8b f1 mov esi,ecx
779a14: 57 push edi
779a15: 8b be 24 01 00 00 mov edi,DWORD PTR [esi+0x124]
779a1b: 33 db xor ebx,ebx
779a1d: 3b fb cmp edi,ebx
779a1f: 74 10 je 0x779a31

View file

@ -0,0 +1,176 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00779850 <.text+0x378850>:
779850: 55 push ebp
779851: 8b ec mov ebp,esp
779853: 6a ff push 0xffffffff
779855: 68 10 7b 98 00 push 0x987b10
77985a: 64 a1 00 00 00 00 mov eax,fs:0x0
779860: 50 push eax
779861: 83 ec 08 sub esp,0x8
779864: 53 push ebx
779865: 56 push esi
779866: 57 push edi
779867: a1 78 8b af 00 mov eax,ds:0xaf8b78
77986c: 33 c5 xor eax,ebp
77986e: 50 push eax
77986f: 8d 45 f4 lea eax,[ebp-0xc]
779872: 64 a3 00 00 00 00 mov fs:0x0,eax
779878: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
77987b: 8b f1 mov esi,ecx
77987d: 89 75 ec mov DWORD PTR [ebp-0x14],esi
779880: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
779883: 33 c0 xor eax,eax
779885: 89 06 mov DWORD PTR [esi],eax
779887: 89 46 04 mov DWORD PTR [esi+0x4],eax
77988a: 89 46 08 mov DWORD PTR [esi+0x8],eax
77988d: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
779890: 2b 0b sub ecx,DWORD PTR [ebx]
779892: b8 09 cb 3d 8d mov eax,0x8d3dcb09
779897: f7 e9 imul ecx
779899: 03 d1 add edx,ecx
77989b: c1 fa 06 sar edx,0x6
77989e: 8b fa mov edi,edx
7798a0: b8 00 00 00 00 mov eax,0x0
7798a5: c1 ef 1f shr edi,0x1f
7798a8: 03 fa add edi,edx
7798aa: 89 06 mov DWORD PTR [esi],eax
7798ac: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798af: 89 46 08 mov DWORD PTR [esi+0x8],eax
7798b2: 74 4b je 0x7798ff
7798b4: 81 ff 2c f7 34 02 cmp edi,0x234f72c
7798ba: 76 0b jbe 0x7798c7
7798bc: 68 90 1f 9e 00 push 0x9e1f90
7798c1: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
7798c7: 8d 4e 0c lea ecx,[esi+0xc]
7798ca: 57 push edi
7798cb: e8 70 16 01 00 call 0x78af40
7798d0: 6b ff 74 imul edi,edi,0x74
7798d3: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
7798d6: 52 push edx
7798d7: 8d 56 0c lea edx,[esi+0xc]
7798da: 52 push edx
7798db: 03 f8 add edi,eax
7798dd: 89 06 mov DWORD PTR [esi],eax
7798df: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798e2: 89 7e 08 mov DWORD PTR [esi+0x8],edi
7798e5: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
7798e8: 8b 1b mov ebx,DWORD PTR [ebx]
7798ea: 50 push eax
7798eb: 51 push ecx
7798ec: 53 push ebx
7798ed: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7798f4: e8 a7 8c ff ff call 0x7725a0
7798f9: 83 c4 14 add esp,0x14
7798fc: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798ff: 8b c6 mov eax,esi
779901: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
779904: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
77990b: 59 pop ecx
77990c: 5f pop edi
77990d: 5e pop esi
77990e: 5b pop ebx
77990f: 8b e5 mov esp,ebp
779911: 5d pop ebp
779912: c2 04 00 ret 0x4
779915: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14]
779918: e8 63 fc ea ff call 0x629580
77991d: 6a 00 push 0x0
77991f: 6a 00 push 0x0
779921: e8 96 b6 1a 00 call 0x924fbc
779926: cc int3
779927: cc int3
779928: cc int3
779929: cc int3
77992a: cc int3
77992b: cc int3
77992c: cc int3
77992d: cc int3
77992e: cc int3
77992f: cc int3
779930: 55 push ebp
779931: 8b ec mov ebp,esp
779933: 6a ff push 0xffffffff
779935: 68 38 06 97 00 push 0x970638
77993a: 64 a1 00 00 00 00 mov eax,fs:0x0
779940: 50 push eax
779941: 83 ec 20 sub esp,0x20
779944: a1 78 8b af 00 mov eax,ds:0xaf8b78
779949: 33 c5 xor eax,ebp
77994b: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
77994e: 56 push esi
77994f: 50 push eax
779950: 8d 45 f4 lea eax,[ebp-0xc]
779953: 64 a3 00 00 00 00 mov fs:0x0,eax
779959: 8b f1 mov esi,ecx
77995b: 8b 86 8c 00 00 00 mov eax,DWORD PTR [esi+0x8c]
779961: 85 c0 test eax,eax
779963: 75 0c jne 0x779971
779965: 68 34 24 a2 00 push 0xa22434
77996a: e8 e1 05 14 00 call 0x8b9f50
77996f: eb 7e jmp 0x7799ef
779971: 50 push eax
779972: e8 09 cc c9 ff call 0x416580
779977: 83 c4 04 add esp,0x4
77997a: 85 c0 test eax,eax
77997c: 74 0c je 0x77998a
77997e: 68 f8 23 a2 00 push 0xa223f8
779983: e8 58 08 14 00 call 0x8ba1e0
779988: eb 65 jmp 0x7799ef
77998a: e8 d1 58 dc ff call 0x53f260
77998f: c7 45 e8 0f 00 00 00 mov DWORD PTR [ebp-0x18],0xf
779996: c7 45 e4 00 00 00 00 mov DWORD PTR [ebp-0x1c],0x0
77999d: c6 45 d4 00 mov BYTE PTR [ebp-0x2c],0x0
7799a1: 8d 4d d4 lea ecx,[ebp-0x2c]
7799a4: 51 push ecx
7799a5: 50 push eax
7799a6: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7799ad: e8 fe 52 dc ff call 0x53ecb0
7799b2: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
7799b5: 83 c4 08 add esp,0x8
7799b8: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
7799bc: 73 03 jae 0x7799c1
7799be: 8d 45 d4 lea eax,[ebp-0x2c]
7799c1: 8b 96 8c 00 00 00 mov edx,DWORD PTR [esi+0x8c]
7799c7: 6a 00 push 0x0
7799c9: 56 push esi
7799ca: 68 a0 8d 77 00 push 0x778da0
7799cf: 68 e0 ea 76 00 push 0x76eae0
7799d4: 6a 00 push 0x0
7799d6: 50 push eax
7799d7: 52 push edx
7799d8: e8 f3 d7 c9 ff call 0x4171d0
7799dd: 83 c4 1c add esp,0x1c
7799e0: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
7799e4: 72 0c jb 0x7799f2
7799e6: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
7799e9: 50 push eax
7799ea: e8 bb b5 1a 00 call 0x924faa
7799ef: 83 c4 04 add esp,0x4
7799f2: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
7799f5: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
7799fc: 59 pop ecx
7799fd: 5e pop esi
7799fe: 8b 4d f0 mov ecx,DWORD PTR [ebp-0x10]
779a01: 33 cd xor ecx,ebp
779a03: e8 7a b3 1a 00 call 0x924d82
779a08: 8b e5 mov esp,ebp
779a0a: 5d pop ebp
779a0b: c3 ret
779a0c: cc int3
779a0d: cc int3
779a0e: cc int3
779a0f: cc int3
779a10: 53 push ebx
779a11: 56 push esi
779a12: 8b f1 mov esi,ecx
779a14: 57 push edi
779a15: 8b be 24 01 00 00 mov edi,DWORD PTR [esi+0x124]
779a1b: 33 db xor ebx,ebx
779a1d: 3b fb cmp edi,ebx
779a1f: 74 10 je 0x779a31
779a21: 8b cf mov ecx,edi

View file

@ -0,0 +1,177 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00779850 <.text+0x378850>:
779850: 55 push ebp
779851: 8b ec mov ebp,esp
779853: 6a ff push 0xffffffff
779855: 68 10 7b 98 00 push 0x987b10
77985a: 64 a1 00 00 00 00 mov eax,fs:0x0
779860: 50 push eax
779861: 83 ec 08 sub esp,0x8
779864: 53 push ebx
779865: 56 push esi
779866: 57 push edi
779867: a1 78 8b af 00 mov eax,ds:0xaf8b78
77986c: 33 c5 xor eax,ebp
77986e: 50 push eax
77986f: 8d 45 f4 lea eax,[ebp-0xc]
779872: 64 a3 00 00 00 00 mov fs:0x0,eax
779878: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
77987b: 8b f1 mov esi,ecx
77987d: 89 75 ec mov DWORD PTR [ebp-0x14],esi
779880: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
779883: 33 c0 xor eax,eax
779885: 89 06 mov DWORD PTR [esi],eax
779887: 89 46 04 mov DWORD PTR [esi+0x4],eax
77988a: 89 46 08 mov DWORD PTR [esi+0x8],eax
77988d: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
779890: 2b 0b sub ecx,DWORD PTR [ebx]
779892: b8 09 cb 3d 8d mov eax,0x8d3dcb09
779897: f7 e9 imul ecx
779899: 03 d1 add edx,ecx
77989b: c1 fa 06 sar edx,0x6
77989e: 8b fa mov edi,edx
7798a0: b8 00 00 00 00 mov eax,0x0
7798a5: c1 ef 1f shr edi,0x1f
7798a8: 03 fa add edi,edx
7798aa: 89 06 mov DWORD PTR [esi],eax
7798ac: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798af: 89 46 08 mov DWORD PTR [esi+0x8],eax
7798b2: 74 4b je 0x7798ff
7798b4: 81 ff 2c f7 34 02 cmp edi,0x234f72c
7798ba: 76 0b jbe 0x7798c7
7798bc: 68 90 1f 9e 00 push 0x9e1f90
7798c1: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
7798c7: 8d 4e 0c lea ecx,[esi+0xc]
7798ca: 57 push edi
7798cb: e8 70 16 01 00 call 0x78af40
7798d0: 6b ff 74 imul edi,edi,0x74
7798d3: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
7798d6: 52 push edx
7798d7: 8d 56 0c lea edx,[esi+0xc]
7798da: 52 push edx
7798db: 03 f8 add edi,eax
7798dd: 89 06 mov DWORD PTR [esi],eax
7798df: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798e2: 89 7e 08 mov DWORD PTR [esi+0x8],edi
7798e5: 8b 4b 04 mov ecx,DWORD PTR [ebx+0x4]
7798e8: 8b 1b mov ebx,DWORD PTR [ebx]
7798ea: 50 push eax
7798eb: 51 push ecx
7798ec: 53 push ebx
7798ed: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7798f4: e8 a7 8c ff ff call 0x7725a0
7798f9: 83 c4 14 add esp,0x14
7798fc: 89 46 04 mov DWORD PTR [esi+0x4],eax
7798ff: 8b c6 mov eax,esi
779901: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
779904: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
77990b: 59 pop ecx
77990c: 5f pop edi
77990d: 5e pop esi
77990e: 5b pop ebx
77990f: 8b e5 mov esp,ebp
779911: 5d pop ebp
779912: c2 04 00 ret 0x4
779915: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14]
779918: e8 63 fc ea ff call 0x629580
77991d: 6a 00 push 0x0
77991f: 6a 00 push 0x0
779921: e8 96 b6 1a 00 call 0x924fbc
779926: cc int3
779927: cc int3
779928: cc int3
779929: cc int3
77992a: cc int3
77992b: cc int3
77992c: cc int3
77992d: cc int3
77992e: cc int3
77992f: cc int3
779930: 55 push ebp
779931: 8b ec mov ebp,esp
779933: 6a ff push 0xffffffff
779935: 68 38 06 97 00 push 0x970638
77993a: 64 a1 00 00 00 00 mov eax,fs:0x0
779940: 50 push eax
779941: 83 ec 20 sub esp,0x20
779944: a1 78 8b af 00 mov eax,ds:0xaf8b78
779949: 33 c5 xor eax,ebp
77994b: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
77994e: 56 push esi
77994f: 50 push eax
779950: 8d 45 f4 lea eax,[ebp-0xc]
779953: 64 a3 00 00 00 00 mov fs:0x0,eax
779959: 8b f1 mov esi,ecx
77995b: 8b 86 8c 00 00 00 mov eax,DWORD PTR [esi+0x8c]
779961: 85 c0 test eax,eax
779963: 75 0c jne 0x779971
779965: 68 34 24 a2 00 push 0xa22434
77996a: e8 e1 05 14 00 call 0x8b9f50
77996f: eb 7e jmp 0x7799ef
779971: 50 push eax
779972: e8 09 cc c9 ff call 0x416580
779977: 83 c4 04 add esp,0x4
77997a: 85 c0 test eax,eax
77997c: 74 0c je 0x77998a
77997e: 68 f8 23 a2 00 push 0xa223f8
779983: e8 58 08 14 00 call 0x8ba1e0
779988: eb 65 jmp 0x7799ef
77998a: e8 d1 58 dc ff call 0x53f260
77998f: c7 45 e8 0f 00 00 00 mov DWORD PTR [ebp-0x18],0xf
779996: c7 45 e4 00 00 00 00 mov DWORD PTR [ebp-0x1c],0x0
77999d: c6 45 d4 00 mov BYTE PTR [ebp-0x2c],0x0
7799a1: 8d 4d d4 lea ecx,[ebp-0x2c]
7799a4: 51 push ecx
7799a5: 50 push eax
7799a6: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7799ad: e8 fe 52 dc ff call 0x53ecb0
7799b2: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
7799b5: 83 c4 08 add esp,0x8
7799b8: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
7799bc: 73 03 jae 0x7799c1
7799be: 8d 45 d4 lea eax,[ebp-0x2c]
7799c1: 8b 96 8c 00 00 00 mov edx,DWORD PTR [esi+0x8c]
7799c7: 6a 00 push 0x0
7799c9: 56 push esi
7799ca: 68 a0 8d 77 00 push 0x778da0
7799cf: 68 e0 ea 76 00 push 0x76eae0
7799d4: 6a 00 push 0x0
7799d6: 50 push eax
7799d7: 52 push edx
7799d8: e8 f3 d7 c9 ff call 0x4171d0
7799dd: 83 c4 1c add esp,0x1c
7799e0: 83 7d e8 10 cmp DWORD PTR [ebp-0x18],0x10
7799e4: 72 0c jb 0x7799f2
7799e6: 8b 45 d4 mov eax,DWORD PTR [ebp-0x2c]
7799e9: 50 push eax
7799ea: e8 bb b5 1a 00 call 0x924faa
7799ef: 83 c4 04 add esp,0x4
7799f2: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
7799f5: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
7799fc: 59 pop ecx
7799fd: 5e pop esi
7799fe: 8b 4d f0 mov ecx,DWORD PTR [ebp-0x10]
779a01: 33 cd xor ecx,ebp
779a03: e8 7a b3 1a 00 call 0x924d82
779a08: 8b e5 mov esp,ebp
779a0a: 5d pop ebp
779a0b: c3 ret
779a0c: cc int3
779a0d: cc int3
779a0e: cc int3
779a0f: cc int3
779a10: 53 push ebx
779a11: 56 push esi
779a12: 8b f1 mov esi,ecx
779a14: 57 push edi
779a15: 8b be 24 01 00 00 mov edi,DWORD PTR [esi+0x124]
779a1b: 33 db xor ebx,ebx
779a1d: 3b fb cmp edi,ebx
779a1f: 74 10 je 0x779a31
779a21: 8b cf mov ecx,edi
779a23: e8 28 6a ff ff call 0x770450

View file

@ -0,0 +1,43 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00629580 <.text+0x228580>:
629580: 57 push edi
629581: 8b f9 mov edi,ecx
629583: 83 3f 00 cmp DWORD PTR [edi],0x0
629586: 74 36 je 0x6295be
629588: 53 push ebx
629589: 56 push esi
62958a: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c
629590: 8b 5f 04 mov ebx,DWORD PTR [edi+0x4]
629593: 8b 37 mov esi,DWORD PTR [edi]
629595: 3b f3 cmp esi,ebx
629597: 74 18 je 0x6295b1
629599: 8d a4 24 00 00 00 00 lea esp,[esp+0x0]
6295a0: 8b 06 mov eax,DWORD PTR [esi]
6295a2: 8b 10 mov edx,DWORD PTR [eax]
6295a4: 6a 00 push 0x0
6295a6: 8b ce mov ecx,esi
6295a8: ff d2 call edx
6295aa: 83 c6 74 add esi,0x74
6295ad: 3b f3 cmp esi,ebx
6295af: 75 ef jne 0x6295a0
6295b1: 8b 07 mov eax,DWORD PTR [edi]
6295b3: 50 push eax
6295b4: e8 f1 b9 2f 00 call 0x924faa
6295b9: 83 c4 04 add esp,0x4
6295bc: 5e pop esi
6295bd: 5b pop ebx
6295be: 33 c0 xor eax,eax
6295c0: 89 07 mov DWORD PTR [edi],eax
6295c2: 89 47 04 mov DWORD PTR [edi+0x4],eax
6295c5: 89 47 08 mov DWORD PTR [edi+0x8],eax
6295c8: 5f pop edi
6295c9: c3 ret
6295ca: cc int3
6295cb: cc int3
6295cc: cc int3
6295cd: cc int3

View file

@ -0,0 +1,36 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0057e590 <.text+0x17d590>:
57e590: 55 push ebp
57e591: 8b ec mov ebp,esp
57e593: 8b 4d 08 mov ecx,DWORD PTR [ebp+0x8]
57e596: 83 ec 0c sub esp,0xc
57e599: 33 c0 xor eax,eax
57e59b: 85 c9 test ecx,ecx
57e59d: 74 41 je 0x57e5e0
57e59f: 81 f9 5d 74 d1 05 cmp ecx,0x5d1745d
57e5a5: 77 10 ja 0x57e5b7
57e5a7: 6b c9 2c imul ecx,ecx,0x2c
57e5aa: 51 push ecx
57e5ab: e8 06 6a 3a 00 call 0x924fb6
57e5b0: 83 c4 04 add esp,0x4
57e5b3: 85 c0 test eax,eax
57e5b5: 75 29 jne 0x57e5e0
57e5b7: 8d 45 08 lea eax,[ebp+0x8]
57e5ba: 50 push eax
57e5bb: 8d 4d f4 lea ecx,[ebp-0xc]
57e5be: c7 45 08 00 00 00 00 mov DWORD PTR [ebp+0x8],0x0
57e5c5: ff 15 bc d1 9d 00 call DWORD PTR ds:0x9dd1bc
57e5cb: 68 90 d1 a8 00 push 0xa8d190
57e5d0: 8d 4d f4 lea ecx,[ebp-0xc]
57e5d3: 51 push ecx
57e5d4: c7 45 f4 00 1f 9e 00 mov DWORD PTR [ebp-0xc],0x9e1f00
57e5db: e8 dc 69 3a 00 call 0x924fbc
57e5e0: 8b e5 mov esp,ebp
57e5e2: 5d pop ebp
57e5e3: c2 04 00 ret 0x4
57e5e6: cc int3

View file

@ -0,0 +1,63 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
007b7320 <.text+0x3b6320>:
7b7320: 55 push ebp
7b7321: 8b ec mov ebp,esp
7b7323: 56 push esi
7b7324: 8b f1 mov esi,ecx
7b7326: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4]
7b7329: 57 push edi
7b732a: 8b 7d 08 mov edi,DWORD PTR [ebp+0x8]
7b732d: 3b f9 cmp edi,ecx
7b732f: 73 47 jae 0x7b7378
7b7331: 8b 06 mov eax,DWORD PTR [esi]
7b7333: 3b c7 cmp eax,edi
7b7335: 77 41 ja 0x7b7378
7b7337: 2b f8 sub edi,eax
7b7339: b8 e9 a2 8b 2e mov eax,0x2e8ba2e9
7b733e: f7 ef imul edi
7b7340: c1 fa 03 sar edx,0x3
7b7343: 8b fa mov edi,edx
7b7345: c1 ef 1f shr edi,0x1f
7b7348: 03 fa add edi,edx
7b734a: 3b 4e 08 cmp ecx,DWORD PTR [esi+0x8]
7b734d: 75 09 jne 0x7b7358
7b734f: 6a 01 push 0x1
7b7351: 8b ce mov ecx,esi
7b7353: e8 c8 e4 ff ff call 0x7b5820
7b7358: 8b 46 04 mov eax,DWORD PTR [esi+0x4]
7b735b: 6b ff 2c imul edi,edi,0x2c
7b735e: 03 3e add edi,DWORD PTR [esi]
7b7360: 8d 4e 0c lea ecx,[esi+0xc]
7b7363: 57 push edi
7b7364: 50 push eax
7b7365: 51 push ecx
7b7366: e8 e5 2d fe ff call 0x79a150
7b736b: 83 c4 0c add esp,0xc
7b736e: 83 46 04 2c add DWORD PTR [esi+0x4],0x2c
7b7372: 5f pop edi
7b7373: 5e pop esi
7b7374: 5d pop ebp
7b7375: c2 04 00 ret 0x4
7b7378: 3b 4e 08 cmp ecx,DWORD PTR [esi+0x8]
7b737b: 75 09 jne 0x7b7386
7b737d: 6a 01 push 0x1
7b737f: 8b ce mov ecx,esi
7b7381: e8 9a e4 ff ff call 0x7b5820
7b7386: 8b 56 04 mov edx,DWORD PTR [esi+0x4]
7b7389: 57 push edi
7b738a: 52 push edx
7b738b: 8d 46 0c lea eax,[esi+0xc]
7b738e: 50 push eax
7b738f: e8 bc 2d fe ff call 0x79a150
7b7394: 83 c4 0c add esp,0xc
7b7397: 83 46 04 2c add DWORD PTR [esi+0x4],0x2c
7b739b: 5f pop edi
7b739c: 5e pop esi
7b739d: 5d pop ebp
7b739e: c2 04 00 ret 0x4
7b73a1: cc int3

View file

@ -0,0 +1,58 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0079a150 <.text+0x399150>:
79a150: 55 push ebp
79a151: 8b ec mov ebp,esp
79a153: 6a ff push 0xffffffff
79a155: 68 39 9f 98 00 push 0x989f39
79a15a: 64 a1 00 00 00 00 mov eax,fs:0x0
79a160: 50 push eax
79a161: 51 push ecx
79a162: 56 push esi
79a163: 57 push edi
79a164: a1 78 8b af 00 mov eax,ds:0xaf8b78
79a169: 33 c5 xor eax,ebp
79a16b: 50 push eax
79a16c: 8d 45 f4 lea eax,[ebp-0xc]
79a16f: 64 a3 00 00 00 00 mov fs:0x0,eax
79a175: 8b 75 0c mov esi,DWORD PTR [ebp+0xc]
79a178: 89 75 f0 mov DWORD PTR [ebp-0x10],esi
79a17b: 33 c0 xor eax,eax
79a17d: 89 45 fc mov DWORD PTR [ebp-0x4],eax
79a180: 3b f0 cmp esi,eax
79a182: 74 44 je 0x79a1c8
79a184: 8b 7d 10 mov edi,DWORD PTR [ebp+0x10]
79a187: c7 06 9c 43 a2 00 mov DWORD PTR [esi],0xa2439c
79a18d: 66 8b 4f 04 mov cx,WORD PTR [edi+0x4]
79a191: 66 89 4e 04 mov WORD PTR [esi+0x4],cx
79a195: 66 8b 57 06 mov dx,WORD PTR [edi+0x6]
79a199: 66 89 56 06 mov WORD PTR [esi+0x6],dx
79a19d: 8a 4f 08 mov cl,BYTE PTR [edi+0x8]
79a1a0: 88 4e 08 mov BYTE PTR [esi+0x8],cl
79a1a3: 6a ff push 0xffffffff
79a1a5: 8d 4e 0c lea ecx,[esi+0xc]
79a1a8: 50 push eax
79a1a9: 8d 57 0c lea edx,[edi+0xc]
79a1ac: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
79a1b3: 89 41 10 mov DWORD PTR [ecx+0x10],eax
79a1b6: 52 push edx
79a1b7: c6 45 fc 01 mov BYTE PTR [ebp-0x4],0x1
79a1bb: 88 01 mov BYTE PTR [ecx],al
79a1bd: e8 6e b2 c8 ff call 0x425430
79a1c2: 8b 47 28 mov eax,DWORD PTR [edi+0x28]
79a1c5: 89 46 28 mov DWORD PTR [esi+0x28],eax
79a1c8: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
79a1cb: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
79a1d2: 59 pop ecx
79a1d3: 5f pop edi
79a1d4: 5e pop esi
79a1d5: 8b e5 mov esp,ebp
79a1d7: 5d pop ebp
79a1d8: c3 ret
79a1d9: cc int3
79a1da: cc int3
79a1db: cc int3

View file

@ -0,0 +1,49 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
008562a0 <.text+0x4552a0>:
8562a0: 55 push ebp
8562a1: 8b ec mov ebp,esp
8562a3: 6a ff push 0xffffffff
8562a5: 68 48 6c 99 00 push 0x996c48
8562aa: 64 a1 00 00 00 00 mov eax,fs:0x0
8562b0: 50 push eax
8562b1: 51 push ecx
8562b2: 53 push ebx
8562b3: 56 push esi
8562b4: a1 78 8b af 00 mov eax,ds:0xaf8b78
8562b9: 33 c5 xor eax,ebp
8562bb: 50 push eax
8562bc: 8d 45 f4 lea eax,[ebp-0xc]
8562bf: 64 a3 00 00 00 00 mov fs:0x0,eax
8562c5: 8b f1 mov esi,ecx
8562c7: 89 75 f0 mov DWORD PTR [ebp-0x10],esi
8562ca: 33 db xor ebx,ebx
8562cc: 8d 4e 0c lea ecx,[esi+0xc]
8562cf: c7 06 9c 43 a2 00 mov DWORD PTR [esi],0xa2439c
8562d5: 53 push ebx
8562d6: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
8562dd: 89 59 10 mov DWORD PTR [ecx+0x10],ebx
8562e0: 68 0c 10 9e 00 push 0x9e100c
8562e5: 89 5d fc mov DWORD PTR [ebp-0x4],ebx
8562e8: 88 19 mov BYTE PTR [ecx],bl
8562ea: e8 61 f2 bc ff call 0x425550
8562ef: 33 c0 xor eax,eax
8562f1: 89 46 04 mov DWORD PTR [esi+0x4],eax
8562f4: 88 5e 08 mov BYTE PTR [esi+0x8],bl
8562f7: 89 5e 28 mov DWORD PTR [esi+0x28],ebx
8562fa: 8b c6 mov eax,esi
8562fc: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
8562ff: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
856306: 59 pop ecx
856307: 5e pop esi
856308: 5b pop ebx
856309: 8b e5 mov esp,ebp
85630b: 5d pop ebp
85630c: c3 ret
85630d: cc int3
85630e: cc int3
85630f: cc int3

View file

@ -0,0 +1,107 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
007b34e0 <.text+0x3b24e0>:
7b34e0: 55 push ebp
7b34e1: 8b ec mov ebp,esp
7b34e3: 6a ff push 0xffffffff
7b34e5: 68 00 c3 98 00 push 0x98c300
7b34ea: 64 a1 00 00 00 00 mov eax,fs:0x0
7b34f0: 50 push eax
7b34f1: 83 ec 0c sub esp,0xc
7b34f4: 53 push ebx
7b34f5: 56 push esi
7b34f6: 57 push edi
7b34f7: a1 78 8b af 00 mov eax,ds:0xaf8b78
7b34fc: 33 c5 xor eax,ebp
7b34fe: 50 push eax
7b34ff: 8d 45 f4 lea eax,[ebp-0xc]
7b3502: 64 a3 00 00 00 00 mov fs:0x0,eax
7b3508: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
7b350b: 8b f1 mov esi,ecx
7b350d: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
7b3510: 81 fb 5d 74 d1 05 cmp ebx,0x5d1745d
7b3516: 76 0b jbe 0x7b3523
7b3518: 68 90 1f 9e 00 push 0x9e1f90
7b351d: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
7b3523: 8b 4e 08 mov ecx,DWORD PTR [esi+0x8]
7b3526: 2b 0e sub ecx,DWORD PTR [esi]
7b3528: b8 e9 a2 8b 2e mov eax,0x2e8ba2e9
7b352d: f7 e9 imul ecx
7b352f: c1 fa 03 sar edx,0x3
7b3532: 8b c2 mov eax,edx
7b3534: c1 e8 1f shr eax,0x1f
7b3537: 03 c2 add eax,edx
7b3539: 3b c3 cmp eax,ebx
7b353b: 0f 83 9c 00 00 00 jae 0x7b35dd
7b3541: 8d 7e 0c lea edi,[esi+0xc]
7b3544: 53 push ebx
7b3545: 8b cf mov ecx,edi
7b3547: e8 44 b0 dc ff call 0x57e590
7b354c: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4]
7b354f: 8b 16 mov edx,DWORD PTR [esi]
7b3551: 89 45 ec mov DWORD PTR [ebp-0x14],eax
7b3554: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
7b3557: 50 push eax
7b3558: 8b 45 ec mov eax,DWORD PTR [ebp-0x14]
7b355b: 6a 00 push 0x0
7b355d: 57 push edi
7b355e: 50 push eax
7b355f: 51 push ecx
7b3560: 52 push edx
7b3561: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
7b3568: e8 e3 b0 0a 00 call 0x85e650
7b356d: 8b 56 04 mov edx,DWORD PTR [esi+0x4]
7b3570: 8b 0e mov ecx,DWORD PTR [esi]
7b3572: 89 55 e8 mov DWORD PTR [ebp-0x18],edx
7b3575: 2b d1 sub edx,ecx
7b3577: b8 e9 a2 8b 2e mov eax,0x2e8ba2e9
7b357c: f7 ea imul edx
7b357e: c1 fa 03 sar edx,0x3
7b3581: 8b fa mov edi,edx
7b3583: c1 ef 1f shr edi,0x1f
7b3586: 83 c4 18 add esp,0x18
7b3589: 03 fa add edi,edx
7b358b: c7 45 fc ff ff ff ff mov DWORD PTR [ebp-0x4],0xffffffff
7b3592: 85 c9 test ecx,ecx
7b3594: 74 2a je 0x7b35c0
7b3596: 8b d9 mov ebx,ecx
7b3598: 3b 5d e8 cmp ebx,DWORD PTR [ebp-0x18]
7b359b: 74 15 je 0x7b35b2
7b359d: 8d 49 00 lea ecx,[ecx+0x0]
7b35a0: 8b 13 mov edx,DWORD PTR [ebx]
7b35a2: 8b 02 mov eax,DWORD PTR [edx]
7b35a4: 6a 00 push 0x0
7b35a6: 8b cb mov ecx,ebx
7b35a8: ff d0 call eax
7b35aa: 83 c3 2c add ebx,0x2c
7b35ad: 3b 5d e8 cmp ebx,DWORD PTR [ebp-0x18]
7b35b0: 75 ee jne 0x7b35a0
7b35b2: 8b 0e mov ecx,DWORD PTR [esi]
7b35b4: 51 push ecx
7b35b5: e8 f0 19 17 00 call 0x924faa
7b35ba: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
7b35bd: 83 c4 04 add esp,0x4
7b35c0: 8b ce mov ecx,esi
7b35c2: ff 15 2c d1 9d 00 call DWORD PTR ds:0x9dd12c
7b35c8: 6b db 2c imul ebx,ebx,0x2c
7b35cb: 6b ff 2c imul edi,edi,0x2c
7b35ce: 8b 45 ec mov eax,DWORD PTR [ebp-0x14]
7b35d1: 03 d8 add ebx,eax
7b35d3: 03 f8 add edi,eax
7b35d5: 89 5e 08 mov DWORD PTR [esi+0x8],ebx
7b35d8: 89 7e 04 mov DWORD PTR [esi+0x4],edi
7b35db: 89 06 mov DWORD PTR [esi],eax
7b35dd: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
7b35e0: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
7b35e7: 59 pop ecx
7b35e8: 5f pop edi
7b35e9: 5e pop esi
7b35ea: 5b pop ebx
7b35eb: 8b e5 mov esp,ebp
7b35ed: 5d pop ebp
7b35ee: c2 04 00 ret 0x4
7b35f1: 8b mov edx,DWORD PTR [ebp-0x14]

View file

@ -0,0 +1,72 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0086c580 <.text+0x46b580>:
86c580: 55 push ebp
86c581: 8b ec mov ebp,esp
86c583: 6a ff push 0xffffffff
86c585: 68 82 81 96 00 push 0x968182
86c58a: 64 a1 00 00 00 00 mov eax,fs:0x0
86c590: 50 push eax
86c591: 51 push ecx
86c592: 56 push esi
86c593: 57 push edi
86c594: a1 78 8b af 00 mov eax,ds:0xaf8b78
86c599: 33 c5 xor eax,ebp
86c59b: 50 push eax
86c59c: 8d 45 f4 lea eax,[ebp-0xc]
86c59f: 64 a3 00 00 00 00 mov fs:0x0,eax
86c5a5: 8b f9 mov edi,ecx
86c5a7: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
86c5aa: 8b 75 08 mov esi,DWORD PTR [ebp+0x8]
86c5ad: 3b f1 cmp esi,ecx
86c5af: 73 40 jae 0x86c5f1
86c5b1: 8b 07 mov eax,DWORD PTR [edi]
86c5b3: 3b c6 cmp eax,esi
86c5b5: 77 3a ja 0x86c5f1
86c5b7: 2b f0 sub esi,eax
86c5b9: b8 09 cb 3d 8d mov eax,0x8d3dcb09
86c5be: f7 ee imul esi
86c5c0: 03 d6 add edx,esi
86c5c2: c1 fa 06 sar edx,0x6
86c5c5: 8b f2 mov esi,edx
86c5c7: c1 ee 1f shr esi,0x1f
86c5ca: 03 f2 add esi,edx
86c5cc: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
86c5cf: 75 09 jne 0x86c5da
86c5d1: 6a 01 push 0x1
86c5d3: 8b cf mov ecx,edi
86c5d5: e8 26 cf ff ff call 0x869500
86c5da: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
86c5dd: 6b f6 74 imul esi,esi,0x74
86c5e0: 03 37 add esi,DWORD PTR [edi]
86c5e2: 89 4d 08 mov DWORD PTR [ebp+0x8],ecx
86c5e5: 89 4d f0 mov DWORD PTR [ebp-0x10],ecx
86c5e8: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
86c5ef: eb 1e jmp 0x86c60f
86c5f1: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
86c5f4: 75 09 jne 0x86c5ff
86c5f6: 6a 01 push 0x1
86c5f8: 8b cf mov ecx,edi
86c5fa: e8 01 cf ff ff call 0x869500
86c5ff: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
86c602: 89 4d 08 mov DWORD PTR [ebp+0x8],ecx
86c605: 89 4d f0 mov DWORD PTR [ebp-0x10],ecx
86c608: c7 45 fc 01 00 00 00 mov DWORD PTR [ebp-0x4],0x1
86c60f: 85 c9 test ecx,ecx
86c611: 74 06 je 0x86c619
86c613: 56 push esi
86c614: e8 d7 cd ef ff call 0x7693f0
86c619: 83 47 04 74 add DWORD PTR [edi+0x4],0x74
86c61d: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
86c620: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
86c627: 59 pop ecx
86c628: 5f pop edi
86c629: 5e pop esi
86c62a: 8b e5 mov esp,ebp
86c62c: 5d pop ebp
86c62d: c2 04 00 ret 0x4
86c630: 55 push ebp

View file

@ -0,0 +1,82 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
007693f0 <.text+0x3683f0>:
7693f0: 55 push ebp
7693f1: 8b ec mov ebp,esp
7693f3: 6a ff push 0xffffffff
7693f5: 68 de 62 98 00 push 0x9862de
7693fa: 64 a1 00 00 00 00 mov eax,fs:0x0
769400: 50 push eax
769401: 51 push ecx
769402: 53 push ebx
769403: 56 push esi
769404: 57 push edi
769405: a1 78 8b af 00 mov eax,ds:0xaf8b78
76940a: 33 c5 xor eax,ebp
76940c: 50 push eax
76940d: 8d 45 f4 lea eax,[ebp-0xc]
769410: 64 a3 00 00 00 00 mov fs:0x0,eax
769416: 8b f1 mov esi,ecx
769418: 89 75 f0 mov DWORD PTR [ebp-0x10],esi
76941b: 8b 7d 08 mov edi,DWORD PTR [ebp+0x8]
76941e: c7 06 58 19 a2 00 mov DWORD PTR [esi],0xa21958
769424: 8b 47 04 mov eax,DWORD PTR [edi+0x4]
769427: 33 db xor ebx,ebx
769429: 6a ff push 0xffffffff
76942b: 8d 4e 08 lea ecx,[esi+0x8]
76942e: 89 46 04 mov DWORD PTR [esi+0x4],eax
769431: 53 push ebx
769432: 8d 57 08 lea edx,[edi+0x8]
769435: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
76943c: 89 59 10 mov DWORD PTR [ecx+0x10],ebx
76943f: 52 push edx
769440: 89 5d fc mov DWORD PTR [ebp-0x4],ebx
769443: 88 19 mov BYTE PTR [ecx],bl
769445: e8 e6 bf cb ff call 0x425430
76944a: 6a ff push 0xffffffff
76944c: 8d 4e 24 lea ecx,[esi+0x24]
76944f: 53 push ebx
769450: 8d 47 24 lea eax,[edi+0x24]
769453: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
76945a: 89 59 10 mov DWORD PTR [ecx+0x10],ebx
76945d: 50 push eax
76945e: c6 45 fc 01 mov BYTE PTR [ebp-0x4],0x1
769462: 88 19 mov BYTE PTR [ecx],bl
769464: e8 c7 bf cb ff call 0x425430
769469: 8b 4f 40 mov ecx,DWORD PTR [edi+0x40]
76946c: 89 4e 40 mov DWORD PTR [esi+0x40],ecx
76946f: 8b 57 44 mov edx,DWORD PTR [edi+0x44]
769472: 89 56 44 mov DWORD PTR [esi+0x44],edx
769475: 8b 47 48 mov eax,DWORD PTR [edi+0x48]
769478: 89 46 48 mov DWORD PTR [esi+0x48],eax
76947b: 8b 4f 4c mov ecx,DWORD PTR [edi+0x4c]
76947e: 89 4e 4c mov DWORD PTR [esi+0x4c],ecx
769481: 6a ff push 0xffffffff
769483: 8d 4e 50 lea ecx,[esi+0x50]
769486: 53 push ebx
769487: 8d 57 50 lea edx,[edi+0x50]
76948a: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
769491: 89 59 10 mov DWORD PTR [ecx+0x10],ebx
769494: 52 push edx
769495: c6 45 fc 02 mov BYTE PTR [ebp-0x4],0x2
769499: 88 19 mov BYTE PTR [ecx],bl
76949b: e8 90 bf cb ff call 0x425430
7694a0: 8b 47 6c mov eax,DWORD PTR [edi+0x6c]
7694a3: 89 46 6c mov DWORD PTR [esi+0x6c],eax
7694a6: 8b 4f 70 mov ecx,DWORD PTR [edi+0x70]
7694a9: 89 4e 70 mov DWORD PTR [esi+0x70],ecx
7694ac: 8b c6 mov eax,esi
7694ae: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
7694b1: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
7694b8: 59 pop ecx
7694b9: 5f pop edi
7694ba: 5e pop esi
7694bb: 5b pop ebx
7694bc: 8b e5 mov esp,ebp
7694be: 5d pop ebp
7694bf: c2 04 00 ret 0x4
7694c2: cc int3

View file

@ -0,0 +1,68 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0084ee30 <.text+0x44de30>:
84ee30: 55 push ebp
84ee31: 8b ec mov ebp,esp
84ee33: 6a ff push 0xffffffff
84ee35: 68 3e 61 99 00 push 0x99613e
84ee3a: 64 a1 00 00 00 00 mov eax,fs:0x0
84ee40: 50 push eax
84ee41: 51 push ecx
84ee42: 53 push ebx
84ee43: 56 push esi
84ee44: a1 78 8b af 00 mov eax,ds:0xaf8b78
84ee49: 33 c5 xor eax,ebp
84ee4b: 50 push eax
84ee4c: 8d 45 f4 lea eax,[ebp-0xc]
84ee4f: 64 a3 00 00 00 00 mov fs:0x0,eax
84ee55: 8b f1 mov esi,ecx
84ee57: 89 75 f0 mov DWORD PTR [ebp-0x10],esi
84ee5a: 33 db xor ebx,ebx
84ee5c: 8d 4e 08 lea ecx,[esi+0x8]
84ee5f: c7 06 58 19 a2 00 mov DWORD PTR [esi],0xa21958
84ee65: 53 push ebx
84ee66: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
84ee6d: 89 59 10 mov DWORD PTR [ecx+0x10],ebx
84ee70: 68 0c 10 9e 00 push 0x9e100c
84ee75: 89 5d fc mov DWORD PTR [ebp-0x4],ebx
84ee78: 88 19 mov BYTE PTR [ecx],bl
84ee7a: e8 d1 66 bd ff call 0x425550
84ee7f: 8d 4e 24 lea ecx,[esi+0x24]
84ee82: 53 push ebx
84ee83: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
84ee8a: 89 59 10 mov DWORD PTR [ecx+0x10],ebx
84ee8d: 68 0c 10 9e 00 push 0x9e100c
84ee92: c6 45 fc 01 mov BYTE PTR [ebp-0x4],0x1
84ee96: 88 19 mov BYTE PTR [ecx],bl
84ee98: e8 b3 66 bd ff call 0x425550
84ee9d: 8d 4e 50 lea ecx,[esi+0x50]
84eea0: 53 push ebx
84eea1: c7 41 14 0f 00 00 00 mov DWORD PTR [ecx+0x14],0xf
84eea8: 89 59 10 mov DWORD PTR [ecx+0x10],ebx
84eeab: 68 0c 10 9e 00 push 0x9e100c
84eeb0: c6 45 fc 02 mov BYTE PTR [ebp-0x4],0x2
84eeb4: 88 19 mov BYTE PTR [ecx],bl
84eeb6: e8 95 66 bd ff call 0x425550
84eebb: 89 5e 04 mov DWORD PTR [esi+0x4],ebx
84eebe: 89 5e 40 mov DWORD PTR [esi+0x40],ebx
84eec1: a1 c8 0d af 00 mov eax,ds:0xaf0dc8
84eec6: 89 46 44 mov DWORD PTR [esi+0x44],eax
84eec9: 8b 0d cc 0d af 00 mov ecx,DWORD PTR ds:0xaf0dcc
84eecf: 89 4e 48 mov DWORD PTR [esi+0x48],ecx
84eed2: 8b 15 d0 0d af 00 mov edx,DWORD PTR ds:0xaf0dd0
84eed8: 89 56 4c mov DWORD PTR [esi+0x4c],edx
84eedb: 89 5e 6c mov DWORD PTR [esi+0x6c],ebx
84eede: 89 5e 70 mov DWORD PTR [esi+0x70],ebx
84eee1: 8b c6 mov eax,esi
84eee3: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
84eee6: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
84eeed: 59 pop ecx
84eeee: 5e pop esi
84eeef: 5b pop ebx
84eef0: 8b e5 mov esp,ebp
84eef2: 5d pop ebp
84eef3: c3 ret

View file

@ -0,0 +1,42 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0061ae90 <.text+0x219e90>:
61ae90: 53 push ebx
61ae91: 56 push esi
61ae92: 8b f1 mov esi,ecx
61ae94: 83 7e 64 10 cmp DWORD PTR [esi+0x64],0x10
61ae98: 72 0c jb 0x61aea6
61ae9a: 8b 46 50 mov eax,DWORD PTR [esi+0x50]
61ae9d: 50 push eax
61ae9e: e8 07 a1 30 00 call 0x924faa
61aea3: 83 c4 04 add esp,0x4
61aea6: 33 db xor ebx,ebx
61aea8: c7 46 64 0f 00 00 00 mov DWORD PTR [esi+0x64],0xf
61aeaf: 89 5e 60 mov DWORD PTR [esi+0x60],ebx
61aeb2: 88 5e 50 mov BYTE PTR [esi+0x50],bl
61aeb5: 83 7e 38 10 cmp DWORD PTR [esi+0x38],0x10
61aeb9: 72 0c jb 0x61aec7
61aebb: 8b 4e 24 mov ecx,DWORD PTR [esi+0x24]
61aebe: 51 push ecx
61aebf: e8 e6 a0 30 00 call 0x924faa
61aec4: 83 c4 04 add esp,0x4
61aec7: c7 46 38 0f 00 00 00 mov DWORD PTR [esi+0x38],0xf
61aece: 89 5e 34 mov DWORD PTR [esi+0x34],ebx
61aed1: 88 5e 24 mov BYTE PTR [esi+0x24],bl
61aed4: 83 7e 1c 10 cmp DWORD PTR [esi+0x1c],0x10
61aed8: 72 0c jb 0x61aee6
61aeda: 8b 56 08 mov edx,DWORD PTR [esi+0x8]
61aedd: 52 push edx
61aede: e8 c7 a0 30 00 call 0x924faa
61aee3: 83 c4 04 add esp,0x4
61aee6: 89 5e 18 mov DWORD PTR [esi+0x18],ebx
61aee9: c7 46 1c 0f 00 00 00 mov DWORD PTR [esi+0x1c],0xf
61aef0: 88 5e 08 mov BYTE PTR [esi+0x8],bl
61aef3: c7 06 bc 22 9e 00 mov DWORD PTR [esi],0x9e22bc
61aef9: 5e pop esi
61aefa: 5b pop ebx
61aefb: c3 ret

View file

@ -0,0 +1,127 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00869500 <.text+0x468500>:
869500: 55 push ebp
869501: 8b ec mov ebp,esp
869503: 53 push ebx
869504: 8b 19 mov ebx,DWORD PTR [ecx]
869506: 56 push esi
869507: 8b 71 04 mov esi,DWORD PTR [ecx+0x4]
86950a: 2b f3 sub esi,ebx
86950c: b8 09 cb 3d 8d mov eax,0x8d3dcb09
869511: f7 ee imul esi
869513: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
869516: 03 d6 add edx,esi
869518: c1 fa 06 sar edx,0x6
86951b: 8b f2 mov esi,edx
86951d: c1 ee 1f shr esi,0x1f
869520: 03 f2 add esi,edx
869522: ba 2c f7 34 02 mov edx,0x234f72c
869527: 2b d0 sub edx,eax
869529: 57 push edi
86952a: 3b d6 cmp edx,esi
86952c: 73 0b jae 0x869539
86952e: 68 90 1f 9e 00 push 0x9e1f90
869533: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
869539: 8b 79 08 mov edi,DWORD PTR [ecx+0x8]
86953c: 03 f0 add esi,eax
86953e: 2b fb sub edi,ebx
869540: b8 09 cb 3d 8d mov eax,0x8d3dcb09
869545: f7 ef imul edi
869547: 03 d7 add edx,edi
869549: c1 fa 06 sar edx,0x6
86954c: 8b c2 mov eax,edx
86954e: c1 e8 1f shr eax,0x1f
869551: 03 c2 add eax,edx
869553: 3b f0 cmp esi,eax
869555: 76 21 jbe 0x869578
869557: 8b d0 mov edx,eax
869559: d1 ea shr edx,1
86955b: bf 2c f7 34 02 mov edi,0x234f72c
869560: 2b fa sub edi,edx
869562: 3b f8 cmp edi,eax
869564: 73 04 jae 0x86956a
869566: 33 c0 xor eax,eax
869568: eb 02 jmp 0x86956c
86956a: 03 c2 add eax,edx
86956c: 3b c6 cmp eax,esi
86956e: 73 02 jae 0x869572
869570: 8b c6 mov eax,esi
869572: 50 push eax
869573: e8 68 c9 ff ff call 0x865ee0
869578: 5f pop edi
869579: 5e pop esi
86957a: 5b pop ebx
86957b: 5d pop ebp
86957c: c2 04 00 ret 0x4
86957f: cc int3
869580: 55 push ebp
869581: 8b ec mov ebp,esp
869583: 8b 41 04 mov eax,DWORD PTR [ecx+0x4]
869586: 8b 55 08 mov edx,DWORD PTR [ebp+0x8]
869589: 56 push esi
86958a: 8b 31 mov esi,DWORD PTR [ecx]
86958c: 57 push edi
86958d: 2b c6 sub eax,esi
86958f: bf ff ff ff 07 mov edi,0x7ffffff
869594: c1 f8 05 sar eax,0x5
869597: 2b fa sub edi,edx
869599: 3b f8 cmp edi,eax
86959b: 73 0b jae 0x8695a8
86959d: 68 90 1f 9e 00 push 0x9e1f90
8695a2: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
8695a8: 03 c2 add eax,edx
8695aa: 8b 51 08 mov edx,DWORD PTR [ecx+0x8]
8695ad: 2b d6 sub edx,esi
8695af: c1 fa 05 sar edx,0x5
8695b2: 3b c2 cmp eax,edx
8695b4: 76 21 jbe 0x8695d7
8695b6: 8b f2 mov esi,edx
8695b8: d1 ee shr esi,1
8695ba: bf ff ff ff 07 mov edi,0x7ffffff
8695bf: 2b fe sub edi,esi
8695c1: 3b fa cmp edi,edx
8695c3: 73 04 jae 0x8695c9
8695c5: 33 d2 xor edx,edx
8695c7: eb 02 jmp 0x8695cb
8695c9: 03 d6 add edx,esi
8695cb: 3b d0 cmp edx,eax
8695cd: 73 02 jae 0x8695d1
8695cf: 8b d0 mov edx,eax
8695d1: 52 push edx
8695d2: e8 39 f9 ff ff call 0x868f10
8695d7: 5f pop edi
8695d8: 5e pop esi
8695d9: 5d pop ebp
8695da: c2 04 00 ret 0x4
8695dd: cc int3
8695de: cc int3
8695df: cc int3
8695e0: 55 push ebp
8695e1: 8b ec mov ebp,esp
8695e3: 8b 51 04 mov edx,DWORD PTR [ecx+0x4]
8695e6: 56 push esi
8695e7: 57 push edi
8695e8: 8b 39 mov edi,DWORD PTR [ecx]
8695ea: 2b d7 sub edx,edi
8695ec: b8 67 66 66 66 mov eax,0x66666667
8695f1: f7 ea imul edx
8695f3: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
8695f6: c1 fa 04 sar edx,0x4
8695f9: 8b f2 mov esi,edx
8695fb: c1 ee 1f shr esi,0x1f
8695fe: 03 f2 add esi,edx
869600: ba 66 66 66 06 mov edx,0x6666666
869605: 2b d0 sub edx,eax
869607: 3b d6 cmp edx,esi
869609: 73 0b jae 0x869616
86960b: 68 90 1f 9e 00 push 0x9e1f90
869610: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
869616: 8b 51 08 mov edx,DWORD PTR [ecx+0x8]
869619: 03 f0 add esi,eax
86961b: 2b d7 sub edx,edi
86961d: b8 67 66 mov eax,0x66666667

View file

@ -0,0 +1,140 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00879eb0 <.text+0x478eb0>:
879eb0: 55 push ebp
879eb1: 8b ec mov ebp,esp
879eb3: 51 push ecx
879eb4: 53 push ebx
879eb5: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
879eb8: 8b d1 mov edx,ecx
879eba: 8b 4a 08 mov ecx,DWORD PTR [edx+0x8]
879ebd: 56 push esi
879ebe: 8b 72 04 mov esi,DWORD PTR [edx+0x4]
879ec1: 8b c6 mov eax,esi
879ec3: 83 c3 ce add ebx,0xffffffce
879ec6: 57 push edi
879ec7: 89 55 fc mov DWORD PTR [ebp-0x4],edx
879eca: 8b f9 mov edi,ecx
879ecc: 3b c1 cmp eax,ecx
879ece: 74 0e je 0x879ede
879ed0: 39 58 04 cmp DWORD PTR [eax+0x4],ebx
879ed3: 7d 09 jge 0x879ede
879ed5: 8b f8 mov edi,eax
879ed7: 83 c0 18 add eax,0x18
879eda: 3b c1 cmp eax,ecx
879edc: 75 f2 jne 0x879ed0
879ede: 3b f9 cmp edi,ecx
879ee0: 74 56 je 0x879f38
879ee2: 3b f7 cmp esi,edi
879ee4: 74 52 je 0x879f38
879ee6: 8b d9 mov ebx,ecx
879ee8: 3b fb cmp edi,ebx
879eea: 74 2c je 0x879f18
879eec: 8b c7 mov eax,edi
879eee: 2b c6 sub eax,esi
879ef0: 89 45 08 mov DWORD PTR [ebp+0x8],eax
879ef3: eb 03 jmp 0x879ef8
879ef5: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
879ef8: 8b 44 30 04 mov eax,DWORD PTR [eax+esi*1+0x4]
879efc: 8d 4f 08 lea ecx,[edi+0x8]
879eff: 51 push ecx
879f00: 8d 4e 08 lea ecx,[esi+0x8]
879f03: 89 46 04 mov DWORD PTR [esi+0x4],eax
879f06: e8 a5 07 f0 ff call 0x77a6b0
879f0b: 83 c7 18 add edi,0x18
879f0e: 83 c6 18 add esi,0x18
879f11: 3b fb cmp edi,ebx
879f13: 75 e0 jne 0x879ef5
879f15: 8b 55 fc mov edx,DWORD PTR [ebp-0x4]
879f18: 8b 5a 08 mov ebx,DWORD PTR [edx+0x8]
879f1b: 8b fe mov edi,esi
879f1d: 3b f3 cmp esi,ebx
879f1f: 74 14 je 0x879f35
879f21: 8b 17 mov edx,DWORD PTR [edi]
879f23: 8b 02 mov eax,DWORD PTR [edx]
879f25: 6a 00 push 0x0
879f27: 8b cf mov ecx,edi
879f29: ff d0 call eax
879f2b: 83 c7 18 add edi,0x18
879f2e: 3b fb cmp edi,ebx
879f30: 75 ef jne 0x879f21
879f32: 8b 55 fc mov edx,DWORD PTR [ebp-0x4]
879f35: 89 72 08 mov DWORD PTR [edx+0x8],esi
879f38: 5f pop edi
879f39: 5e pop esi
879f3a: 5b pop ebx
879f3b: 8b e5 mov esp,ebp
879f3d: 5d pop ebp
879f3e: c2 04 00 ret 0x4
879f41: cc int3
879f42: cc int3
879f43: cc int3
879f44: cc int3
879f45: cc int3
879f46: cc int3
879f47: cc int3
879f48: cc int3
879f49: cc int3
879f4a: cc int3
879f4b: cc int3
879f4c: cc int3
879f4d: cc int3
879f4e: cc int3
879f4f: cc int3
879f50: 55 push ebp
879f51: 8b ec mov ebp,esp
879f53: 56 push esi
879f54: 8b f1 mov esi,ecx
879f56: e8 a5 ae ff ff call 0x874e00
879f5b: f6 45 08 01 test BYTE PTR [ebp+0x8],0x1
879f5f: 74 09 je 0x879f6a
879f61: 56 push esi
879f62: e8 43 b0 0a 00 call 0x924faa
879f67: 83 c4 04 add esp,0x4
879f6a: 8b c6 mov eax,esi
879f6c: 5e pop esi
879f6d: 5d pop ebp
879f6e: c2 04 00 ret 0x4
879f71: cc int3
879f72: cc int3
879f73: cc int3
879f74: cc int3
879f75: cc int3
879f76: cc int3
879f77: cc int3
879f78: cc int3
879f79: cc int3
879f7a: cc int3
879f7b: cc int3
879f7c: cc int3
879f7d: cc int3
879f7e: cc int3
879f7f: cc int3
879f80: 55 push ebp
879f81: 8b ec mov ebp,esp
879f83: 8b 55 18 mov edx,DWORD PTR [ebp+0x18]
879f86: 8a 45 08 mov al,BYTE PTR [ebp+0x8]
879f89: 53 push ebx
879f8a: 56 push esi
879f8b: 8b f1 mov esi,ecx
879f8d: 8b 4d 14 mov ecx,DWORD PTR [ebp+0x14]
879f90: 89 4e 08 mov DWORD PTR [esi+0x8],ecx
879f93: 52 push edx
879f94: 8d 4e 20 lea ecx,[esi+0x20]
879f97: 88 46 04 mov BYTE PTR [esi+0x4],al
879f9a: e8 51 50 f4 ff call 0x7beff0
879f9f: 8b 45 1c mov eax,DWORD PTR [ebp+0x1c]
879fa2: 8a 4d 20 mov cl,BYTE PTR [ebp+0x20]
879fa5: 8a 55 0c mov dl,BYTE PTR [ebp+0xc]
879fa8: 89 46 14 mov DWORD PTR [esi+0x14],eax
879fab: 8a 45 10 mov al,BYTE PTR [ebp+0x10]
879fae: 88 4e 18 mov BYTE PTR [esi+0x18],cl
879fb1: 8b 4d 24 mov ecx,DWORD PTR [ebp+0x24]
879fb4: 88 56 10 mov BYTE PTR [esi+0x10],dl
879fb7: 8b 55 28 mov edx,DWORD PTR [ebp+0x28]
879fba: 88 46 11 mov BYTE PTR [esi+0x11],al
879fbd: 8b 45 2c mov eax,DWORD PTR [ebp+0x2c]

View file

@ -0,0 +1,123 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
004249a0 <.text+0x239a0>:
4249a0: 55 push ebp
4249a1: 8b ec mov ebp,esp
4249a3: 6a ff push 0xffffffff
4249a5: 68 80 47 95 00 push 0x954780
4249aa: 64 a1 00 00 00 00 mov eax,fs:0x0
4249b0: 50 push eax
4249b1: 83 ec 1c sub esp,0x1c
4249b4: 53 push ebx
4249b5: 56 push esi
4249b6: 57 push edi
4249b7: a1 78 8b af 00 mov eax,ds:0xaf8b78
4249bc: 33 c5 xor eax,ebp
4249be: 50 push eax
4249bf: 8d 45 f4 lea eax,[ebp-0xc]
4249c2: 64 a3 00 00 00 00 mov fs:0x0,eax
4249c8: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
4249cb: 8b f9 mov edi,ecx
4249cd: 89 7d ec mov DWORD PTR [ebp-0x14],edi
4249d0: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
4249d3: 8b f0 mov esi,eax
4249d5: 83 ce 0f or esi,0xf
4249d8: 83 fe fe cmp esi,0xfffffffe
4249db: 76 04 jbe 0x4249e1
4249dd: 8b f0 mov esi,eax
4249df: eb 27 jmp 0x424a08
4249e1: 8b 5f 14 mov ebx,DWORD PTR [edi+0x14]
4249e4: b8 ab aa aa aa mov eax,0xaaaaaaab
4249e9: f7 e6 mul esi
4249eb: 8b cb mov ecx,ebx
4249ed: d1 e9 shr ecx,1
4249ef: d1 ea shr edx,1
4249f1: 3b ca cmp ecx,edx
4249f3: 76 13 jbe 0x424a08
4249f5: b8 fe ff ff ff mov eax,0xfffffffe
4249fa: 2b c1 sub eax,ecx
4249fc: 8d 34 19 lea esi,[ecx+ebx*1]
4249ff: 3b d8 cmp ebx,eax
424a01: 76 05 jbe 0x424a08
424a03: be fe ff ff ff mov esi,0xfffffffe
424a08: 33 c0 xor eax,eax
424a0a: 8d 4e 01 lea ecx,[esi+0x1]
424a0d: 89 45 fc mov DWORD PTR [ebp-0x4],eax
424a10: 3b c8 cmp ecx,eax
424a12: 76 12 jbe 0x424a26
424a14: 83 f9 ff cmp ecx,0xffffffff
424a17: 77 12 ja 0x424a2b
424a19: 51 push ecx
424a1a: e8 97 05 50 00 call 0x924fb6
424a1f: 83 c4 04 add esp,0x4
424a22: 85 c0 test eax,eax
424a24: 74 05 je 0x424a2b
424a26: 89 45 08 mov DWORD PTR [ebp+0x8],eax
424a29: eb 52 jmp 0x424a7d
424a2b: 8d 4d e8 lea ecx,[ebp-0x18]
424a2e: 51 push ecx
424a2f: 8d 4d d8 lea ecx,[ebp-0x28]
424a32: c7 45 e8 00 00 00 00 mov DWORD PTR [ebp-0x18],0x0
424a39: ff 15 bc d1 9d 00 call DWORD PTR ds:0x9dd1bc
424a3f: 68 90 d1 a8 00 push 0xa8d190
424a44: 8d 55 d8 lea edx,[ebp-0x28]
424a47: 52 push edx
424a48: c7 45 d8 00 1f 9e 00 mov DWORD PTR [ebp-0x28],0x9e1f00
424a4f: e8 68 05 50 00 call 0x924fbc
424a54: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
424a57: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14]
424a5a: 89 45 e4 mov DWORD PTR [ebp-0x1c],eax
424a5d: 40 inc eax
424a5e: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
424a61: 50 push eax
424a62: 83 c1 18 add ecx,0x18
424a65: c6 45 fc 02 mov BYTE PTR [ebp-0x4],0x2
424a69: e8 e2 ed 2f 00 call 0x723850
424a6e: 89 45 08 mov DWORD PTR [ebp+0x8],eax
424a71: b8 77 4a 42 00 mov eax,0x424a77
424a76: c3 ret
424a77: 8b 7d ec mov edi,DWORD PTR [ebp-0x14]
424a7a: 8b 75 e4 mov esi,DWORD PTR [ebp-0x1c]
424a7d: 8b 5d 0c mov ebx,DWORD PTR [ebp+0xc]
424a80: 85 db test ebx,ebx
424a82: 74 1a je 0x424a9e
424a84: 83 7f 14 10 cmp DWORD PTR [edi+0x14],0x10
424a88: 72 04 jb 0x424a8e
424a8a: 8b 07 mov eax,DWORD PTR [edi]
424a8c: eb 02 jmp 0x424a90
424a8e: 8b c7 mov eax,edi
424a90: 53 push ebx
424a91: 50 push eax
424a92: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
424a95: 50 push eax
424a96: e8 e1 02 50 00 call 0x924d7c
424a9b: 83 c4 0c add esp,0xc
424a9e: 83 7f 14 10 cmp DWORD PTR [edi+0x14],0x10
424aa2: 72 0b jb 0x424aaf
424aa4: 8b 0f mov ecx,DWORD PTR [edi]
424aa6: 51 push ecx
424aa7: e8 fe 04 50 00 call 0x924faa
424aac: 83 c4 04 add esp,0x4
424aaf: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
424ab2: c6 07 00 mov BYTE PTR [edi],0x0
424ab5: 89 07 mov DWORD PTR [edi],eax
424ab7: 89 77 14 mov DWORD PTR [edi+0x14],esi
424aba: 89 5f 10 mov DWORD PTR [edi+0x10],ebx
424abd: 83 fe 10 cmp esi,0x10
424ac0: 72 02 jb 0x424ac4
424ac2: 8b f8 mov edi,eax
424ac4: c6 04 1f 00 mov BYTE PTR [edi+ebx*1],0x0
424ac8: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
424acb: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
424ad2: 59 pop ecx
424ad3: 5f pop edi
424ad4: 5e pop esi
424ad5: 5b pop ebx
424ad6: 8b e5 mov esp,ebp
424ad8: 5d pop ebp
424ad9: c2 08 00 ret 0x8
424adc: 8b mov esi,DWORD PTR [ebp-0x14]

View file

@ -0,0 +1,33 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0046f8c0 <.text+0x6e8c0>:
46f8c0: 55 push ebp
46f8c1: 8b ec mov ebp,esp
46f8c3: 8b 45 0c mov eax,DWORD PTR [ebp+0xc]
46f8c6: 83 78 14 10 cmp DWORD PTR [eax+0x14],0x10
46f8ca: 8b 48 10 mov ecx,DWORD PTR [eax+0x10]
46f8cd: 72 02 jb 0x46f8d1
46f8cf: 8b 00 mov eax,DWORD PTR [eax]
46f8d1: 51 push ecx
46f8d2: 8b 4d 08 mov ecx,DWORD PTR [ebp+0x8]
46f8d5: 50 push eax
46f8d6: 8b 41 10 mov eax,DWORD PTR [ecx+0x10]
46f8d9: 50 push eax
46f8da: 6a 00 push 0x0
46f8dc: e8 bf 3d fb ff call 0x4236a0
46f8e1: f7 d8 neg eax
46f8e3: 1b c0 sbb eax,eax
46f8e5: f7 d8 neg eax
46f8e7: 5d pop ebp
46f8e8: c3 ret
46f8e9: cc int3
46f8ea: cc int3
46f8eb: cc int3
46f8ec: cc int3
46f8ed: cc int3
46f8ee: cc int3
46f8ef: cc int3

View file

@ -0,0 +1,88 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00884cb0 <.text+0x483cb0>:
884cb0: 55 push ebp
884cb1: 8b ec mov ebp,esp
884cb3: 6a ff push 0xffffffff
884cb5: 68 72 0b 98 00 push 0x980b72
884cba: 64 a1 00 00 00 00 mov eax,fs:0x0
884cc0: 50 push eax
884cc1: 51 push ecx
884cc2: 56 push esi
884cc3: 57 push edi
884cc4: a1 78 8b af 00 mov eax,ds:0xaf8b78
884cc9: 33 c5 xor eax,ebp
884ccb: 50 push eax
884ccc: 8d 45 f4 lea eax,[ebp-0xc]
884ccf: 64 a3 00 00 00 00 mov fs:0x0,eax
884cd5: 8b f9 mov edi,ecx
884cd7: 8b 4f 04 mov ecx,DWORD PTR [edi+0x4]
884cda: 8b 75 08 mov esi,DWORD PTR [ebp+0x8]
884cdd: 3b f1 cmp esi,ecx
884cdf: 73 59 jae 0x884d3a
884ce1: 8b 07 mov eax,DWORD PTR [edi]
884ce3: 3b c6 cmp eax,esi
884ce5: 77 53 ja 0x884d3a
884ce7: 2b f0 sub esi,eax
884ce9: b8 ab aa aa 2a mov eax,0x2aaaaaab
884cee: f7 ee imul esi
884cf0: c1 fa 02 sar edx,0x2
884cf3: 8b f2 mov esi,edx
884cf5: c1 ee 1f shr esi,0x1f
884cf8: 03 f2 add esi,edx
884cfa: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
884cfd: 75 09 jne 0x884d08
884cff: 6a 01 push 0x1
884d01: 8b cf mov ecx,edi
884d03: e8 98 f4 ff ff call 0x8841a0
884d08: 8b 0f mov ecx,DWORD PTR [edi]
884d0a: 8d 04 76 lea eax,[esi+esi*2]
884d0d: 8d 0c c1 lea ecx,[ecx+eax*8]
884d10: 8b 47 04 mov eax,DWORD PTR [edi+0x4]
884d13: 89 45 08 mov DWORD PTR [ebp+0x8],eax
884d16: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
884d19: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
884d20: 85 c0 test eax,eax
884d22: 74 54 je 0x884d78
884d24: c7 00 7c f0 a0 00 mov DWORD PTR [eax],0xa0f07c
884d2a: 8b 51 04 mov edx,DWORD PTR [ecx+0x4]
884d2d: 83 c1 08 add ecx,0x8
884d30: c6 45 fc 01 mov BYTE PTR [ebp-0x4],0x1
884d34: 89 50 04 mov DWORD PTR [eax+0x4],edx
884d37: 51 push ecx
884d38: eb 36 jmp 0x884d70
884d3a: 3b 4f 08 cmp ecx,DWORD PTR [edi+0x8]
884d3d: 75 09 jne 0x884d48
884d3f: 6a 01 push 0x1
884d41: 8b cf mov ecx,edi
884d43: e8 58 f4 ff ff call 0x8841a0
884d48: 8b 47 04 mov eax,DWORD PTR [edi+0x4]
884d4b: 89 45 08 mov DWORD PTR [ebp+0x8],eax
884d4e: 89 45 f0 mov DWORD PTR [ebp-0x10],eax
884d51: c7 45 fc 02 00 00 00 mov DWORD PTR [ebp-0x4],0x2
884d58: 85 c0 test eax,eax
884d5a: 74 1c je 0x884d78
884d5c: c7 00 7c f0 a0 00 mov DWORD PTR [eax],0xa0f07c
884d62: 8b 4e 04 mov ecx,DWORD PTR [esi+0x4]
884d65: 83 c6 08 add esi,0x8
884d68: c6 45 fc 03 mov BYTE PTR [ebp-0x4],0x3
884d6c: 89 48 04 mov DWORD PTR [eax+0x4],ecx
884d6f: 56 push esi
884d70: 8d 48 08 lea ecx,[eax+0x8]
884d73: e8 d8 4a ef ff call 0x779850
884d78: 83 47 04 18 add DWORD PTR [edi+0x4],0x18
884d7c: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
884d7f: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
884d86: 59 pop ecx
884d87: 5f pop edi
884d88: 5e pop esi
884d89: 8b e5 mov esp,ebp
884d8b: 5d pop ebp
884d8c: c2 04 00 ret 0x4
884d8f: cc int3
884d90: 55 push ebp
884d91: 8b ec mov ebp,esp

View file

@ -0,0 +1,87 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00885380 <.text+0x484380>:
885380: 55 push ebp
885381: 8b ec mov ebp,esp
885383: 6a ff push 0xffffffff
885385: 68 30 af 99 00 push 0x99af30
88538a: 64 a1 00 00 00 00 mov eax,fs:0x0
885390: 50 push eax
885391: 83 ec 18 sub esp,0x18
885394: 53 push ebx
885395: 56 push esi
885396: 57 push edi
885397: a1 78 8b af 00 mov eax,ds:0xaf8b78
88539c: 33 c5 xor eax,ebp
88539e: 50 push eax
88539f: 8d 45 f4 lea eax,[ebp-0xc]
8853a2: 64 a3 00 00 00 00 mov fs:0x0,eax
8853a8: 8b f1 mov esi,ecx
8853aa: 8b 56 08 mov edx,DWORD PTR [esi+0x8]
8853ad: 2b 56 04 sub edx,DWORD PTR [esi+0x4]
8853b0: 8d 4e 04 lea ecx,[esi+0x4]
8853b3: b8 ab aa aa 2a mov eax,0x2aaaaaab
8853b8: f7 ea imul edx
8853ba: c1 fa 02 sar edx,0x2
8853bd: 8b c2 mov eax,edx
8853bf: c1 e8 1f shr eax,0x1f
8853c2: 33 db xor ebx,ebx
8853c4: 03 c2 add eax,edx
8853c6: 33 ff xor edi,edi
8853c8: 3b c3 cmp eax,ebx
8853ca: 7e 30 jle 0x8853fc
8853cc: 8b 11 mov edx,DWORD PTR [ecx]
8853ce: 8b ff mov edi,edi
8853d0: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
8853d3: 39 5a 04 cmp DWORD PTR [edx+0x4],ebx
8853d6: 75 02 jne 0x8853da
8853d8: 8b fa mov edi,edx
8853da: 83 c2 18 add edx,0x18
8853dd: 48 dec eax
8853de: 75 f0 jne 0x8853d0
8853e0: 33 db xor ebx,ebx
8853e2: 3b fb cmp edi,ebx
8853e4: 74 16 je 0x8853fc
8853e6: 8b c7 mov eax,edi
8853e8: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
8853eb: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
8853f2: 59 pop ecx
8853f3: 5f pop edi
8853f4: 5e pop esi
8853f5: 5b pop ebx
8853f6: 8b e5 mov esp,ebp
8853f8: 5d pop ebp
8853f9: c2 04 00 ret 0x4
8853fc: c7 45 dc 7c f0 a0 00 mov DWORD PTR [ebp-0x24],0xa0f07c
885403: 89 5d e4 mov DWORD PTR [ebp-0x1c],ebx
885406: 89 5d e8 mov DWORD PTR [ebp-0x18],ebx
885409: 89 5d ec mov DWORD PTR [ebp-0x14],ebx
88540c: 8d 45 dc lea eax,[ebp-0x24]
88540f: 50 push eax
885410: 89 5d fc mov DWORD PTR [ebp-0x4],ebx
885413: e8 98 f8 ff ff call 0x884cb0
885418: 8d 4d e4 lea ecx,[ebp-0x1c]
88541b: c7 45 fc 01 00 00 00 mov DWORD PTR [ebp-0x4],0x1
885422: e8 59 41 da ff call 0x629580
885427: 8b 46 08 mov eax,DWORD PTR [esi+0x8]
88542a: 8b 4d 08 mov ecx,DWORD PTR [ebp+0x8]
88542d: 89 48 ec mov DWORD PTR [eax-0x14],ecx
885430: 8b 46 08 mov eax,DWORD PTR [esi+0x8]
885433: 83 e8 18 sub eax,0x18
885436: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
885439: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
885440: 59 pop ecx
885441: 5f pop edi
885442: 5e pop esi
885443: 5b pop ebx
885444: 8b e5 mov esp,ebp
885446: 5d pop ebp
885447: c2 04 00 ret 0x4
88544a: cc int3
88544b: cc int3
88544c: cc int3
88544d: cc int3

View file

@ -0,0 +1,142 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
008841a0 <.text+0x4831a0>:
8841a0: 55 push ebp
8841a1: 8b ec mov ebp,esp
8841a3: 8b 51 04 mov edx,DWORD PTR [ecx+0x4]
8841a6: 56 push esi
8841a7: 57 push edi
8841a8: 8b 39 mov edi,DWORD PTR [ecx]
8841aa: 2b d7 sub edx,edi
8841ac: b8 ab aa aa 2a mov eax,0x2aaaaaab
8841b1: f7 ea imul edx
8841b3: 8b 45 08 mov eax,DWORD PTR [ebp+0x8]
8841b6: c1 fa 02 sar edx,0x2
8841b9: 8b f2 mov esi,edx
8841bb: c1 ee 1f shr esi,0x1f
8841be: 03 f2 add esi,edx
8841c0: ba aa aa aa 0a mov edx,0xaaaaaaa
8841c5: 2b d0 sub edx,eax
8841c7: 3b d6 cmp edx,esi
8841c9: 73 0b jae 0x8841d6
8841cb: 68 90 1f 9e 00 push 0x9e1f90
8841d0: ff 15 50 d1 9d 00 call DWORD PTR ds:0x9dd150
8841d6: 8b 51 08 mov edx,DWORD PTR [ecx+0x8]
8841d9: 03 f0 add esi,eax
8841db: 2b d7 sub edx,edi
8841dd: b8 ab aa aa 2a mov eax,0x2aaaaaab
8841e2: f7 ea imul edx
8841e4: c1 fa 02 sar edx,0x2
8841e7: 8b c2 mov eax,edx
8841e9: c1 e8 1f shr eax,0x1f
8841ec: 03 c2 add eax,edx
8841ee: 3b f0 cmp esi,eax
8841f0: 76 21 jbe 0x884213
8841f2: 8b d0 mov edx,eax
8841f4: d1 ea shr edx,1
8841f6: bf aa aa aa 0a mov edi,0xaaaaaaa
8841fb: 2b fa sub edi,edx
8841fd: 3b f8 cmp edi,eax
8841ff: 73 04 jae 0x884205
884201: 33 c0 xor eax,eax
884203: eb 02 jmp 0x884207
884205: 03 c2 add eax,edx
884207: 3b c6 cmp eax,esi
884209: 73 02 jae 0x88420d
88420b: 8b c6 mov eax,esi
88420d: 50 push eax
88420e: e8 4d f8 ff ff call 0x883a60
884213: 5f pop edi
884214: 5e pop esi
884215: 5d pop ebp
884216: c2 04 00 ret 0x4
884219: cc int3
88421a: cc int3
88421b: cc int3
88421c: cc int3
88421d: cc int3
88421e: cc int3
88421f: cc int3
884220: 55 push ebp
884221: 8b ec mov ebp,esp
884223: 6a ff push 0xffffffff
884225: 68 10 ad 99 00 push 0x99ad10
88422a: 64 a1 00 00 00 00 mov eax,fs:0x0
884230: 50 push eax
884231: 83 ec 0c sub esp,0xc
884234: 53 push ebx
884235: 56 push esi
884236: 57 push edi
884237: a1 78 8b af 00 mov eax,ds:0xaf8b78
88423c: 33 c5 xor eax,ebp
88423e: 50 push eax
88423f: 8d 45 f4 lea eax,[ebp-0xc]
884242: 64 a3 00 00 00 00 mov fs:0x0,eax
884248: 89 65 f0 mov DWORD PTR [ebp-0x10],esp
88424b: 8b d9 mov ebx,ecx
88424d: 89 5d e8 mov DWORD PTR [ebp-0x18],ebx
884250: 8b 7d 08 mov edi,DWORD PTR [ebp+0x8]
884253: 80 bf 89 00 00 00 00 cmp BYTE PTR [edi+0x89],0x0
88425a: 8b 43 04 mov eax,DWORD PTR [ebx+0x4]
88425d: 89 45 ec mov DWORD PTR [ebp-0x14],eax
884260: 75 51 jne 0x8842b3
884262: 8d 4f 10 lea ecx,[edi+0x10]
884265: 51 push ecx
884266: 8b cb mov ecx,ebx
884268: e8 23 f9 ff ff call 0x883b90
88426d: 8b 55 0c mov edx,DWORD PTR [ebp+0xc]
884270: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14]
884273: 8b f0 mov esi,eax
884275: 89 56 04 mov DWORD PTR [esi+0x4],edx
884278: 8a 87 88 00 00 00 mov al,BYTE PTR [edi+0x88]
88427e: 88 86 88 00 00 00 mov BYTE PTR [esi+0x88],al
884284: 80 b9 89 00 00 00 00 cmp BYTE PTR [ecx+0x89],0x0
88428b: 74 03 je 0x884290
88428d: 89 75 ec mov DWORD PTR [ebp-0x14],esi
884290: 8b 17 mov edx,DWORD PTR [edi]
884292: 56 push esi
884293: 52 push edx
884294: 8b cb mov ecx,ebx
884296: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
88429d: e8 7e ff ff ff call 0x884220
8842a2: 89 06 mov DWORD PTR [esi],eax
8842a4: 8b 47 08 mov eax,DWORD PTR [edi+0x8]
8842a7: 56 push esi
8842a8: 50 push eax
8842a9: 8b cb mov ecx,ebx
8842ab: e8 70 ff ff ff call 0x884220
8842b0: 89 46 08 mov DWORD PTR [esi+0x8],eax
8842b3: 8b 45 ec mov eax,DWORD PTR [ebp-0x14]
8842b6: 8b 4d f4 mov ecx,DWORD PTR [ebp-0xc]
8842b9: 64 89 0d 00 00 00 00 mov DWORD PTR fs:0x0,ecx
8842c0: 59 pop ecx
8842c1: 5f pop edi
8842c2: 5e pop esi
8842c3: 5b pop ebx
8842c4: 8b e5 mov esp,ebp
8842c6: 5d pop ebp
8842c7: c2 08 00 ret 0x8
8842ca: 8b 4d ec mov ecx,DWORD PTR [ebp-0x14]
8842cd: 51 push ecx
8842ce: 8b 4d e8 mov ecx,DWORD PTR [ebp-0x18]
8842d1: e8 5a f5 fe ff call 0x873830
8842d6: 6a 00 push 0x0
8842d8: 6a 00 push 0x0
8842da: e8 dd 0c 0a 00 call 0x924fbc
8842df: cc int3
8842e0: 55 push ebp
8842e1: 8b ec mov ebp,esp
8842e3: 6a ff push 0xffffffff
8842e5: 68 6c ad 99 00 push 0x99ad6c
8842ea: 64 a1 00 00 00 00 mov eax,fs:0x0
8842f0: 50 push eax
8842f1: 83 ec 78 sub esp,0x78
8842f4: 56 push esi
8842f5: a1 78 8b af 00 mov eax,ds:0xaf8b78
8842fa: 33 c5 xor eax,ebp
8842fc: 50 push eax
8842fd: 8d 45 f4 lea eax,[ebp-0xc]

View file

@ -0,0 +1,33 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
0062e120 <.text+0x22d120>:
62e120: 55 push ebp
62e121: 8b ec mov ebp,esp
62e123: 6a ff push 0xffffffff
62e125: 68 08 92 98 00 push 0x989208
62e12a: 64 a1 00 00 00 00 mov eax,fs:0x0
62e130: 50 push eax
62e131: 51 push ecx
62e132: 56 push esi
62e133: a1 78 8b af 00 mov eax,ds:0xaf8b78
62e138: 33 c5 xor eax,ebp
62e13a: 50 push eax
62e13b: 8d 45 f4 lea eax,[ebp-0xc]
62e13e: 64 a3 00 00 00 00 mov fs:0x0,eax
62e144: 8b f1 mov esi,ecx
62e146: 89 75 f0 mov DWORD PTR [ebp-0x10],esi
62e149: 8d 4e 08 lea ecx,[esi+0x8]
62e14c: c7 45 fc 00 00 00 00 mov DWORD PTR [ebp-0x4],0x0
62e153: e8 28 b4 ff ff call 0x629580
62e158: f6 45 08 01 test BYTE PTR [ebp+0x8],0x1
62e15c: c7 06 bc 22 9e 00 mov DWORD PTR [esi],0x9e22bc
62e162: 74 09 je 0x62e16d
62e164: 56 push esi
62e165: e8 40 6e 2f 00 call 0x924faa
62e16a: 83 c4 04 add esp,0x4
62e16d: 8b c6 mov eax,esi
62e16f: 8b mov ecx,DWORD PTR [ebp-0xc]

View file

@ -0,0 +1,127 @@
/home/alex/sots-re/dumps/sots.exe: file format pei-i386
Disassembly of section .text:
00825d40 <.text+0x424d40>:
825d40: 55 push ebp
825d41: 8b ec mov ebp,esp
825d43: 51 push ecx
825d44: 53 push ebx
825d45: 8b 5d 08 mov ebx,DWORD PTR [ebp+0x8]
825d48: 56 push esi
825d49: 33 f6 xor esi,esi
825d4b: 3b de cmp ebx,esi
825d4d: 75 0a jne 0x825d59
825d4f: 5e pop esi
825d50: 33 c0 xor eax,eax
825d52: 5b pop ebx
825d53: 8b e5 mov esp,ebp
825d55: 5d pop ebp
825d56: c2 08 00 ret 0x8
825d59: 8b 4b 0c mov ecx,DWORD PTR [ebx+0xc]
825d5c: 2b 4b 08 sub ecx,DWORD PTR [ebx+0x8]
825d5f: b8 09 cb 3d 8d mov eax,0x8d3dcb09
825d64: f7 e9 imul ecx
825d66: 03 d1 add edx,ecx
825d68: c1 fa 06 sar edx,0x6
825d6b: 8b c2 mov eax,edx
825d6d: c1 e8 1f shr eax,0x1f
825d70: 03 c2 add eax,edx
825d72: 57 push edi
825d73: 89 75 fc mov DWORD PTR [ebp-0x4],esi
825d76: 0f 84 d5 00 00 00 je 0x825e51
825d7c: 8b 7d 0c mov edi,DWORD PTR [ebp+0xc]
825d7f: 89 75 08 mov DWORD PTR [ebp+0x8],esi
825d82: 8b 73 08 mov esi,DWORD PTR [ebx+0x8]
825d85: 03 75 08 add esi,DWORD PTR [ebp+0x8]
825d88: 8b 4e 6c mov ecx,DWORD PTR [esi+0x6c]
825d8b: 3b 4f 6c cmp ecx,DWORD PTR [edi+0x6c]
825d8e: 0f 85 91 00 00 00 jne 0x825e25
825d94: 8b 56 40 mov edx,DWORD PTR [esi+0x40]
825d97: 3b 57 40 cmp edx,DWORD PTR [edi+0x40]
825d9a: 0f 85 85 00 00 00 jne 0x825e25
825da0: d9 46 44 fld DWORD PTR [esi+0x44]
825da3: d9 47 44 fld DWORD PTR [edi+0x44]
825da6: da e9 fucompp
825da8: df e0 fnstsw ax
825daa: f6 c4 44 test ah,0x44
825dad: 7a 76 jp 0x825e25
825daf: d9 46 48 fld DWORD PTR [esi+0x48]
825db2: d9 47 48 fld DWORD PTR [edi+0x48]
825db5: da e9 fucompp
825db7: df e0 fnstsw ax
825db9: f6 c4 44 test ah,0x44
825dbc: 7a 67 jp 0x825e25
825dbe: d9 46 4c fld DWORD PTR [esi+0x4c]
825dc1: d9 47 4c fld DWORD PTR [edi+0x4c]
825dc4: da e9 fucompp
825dc6: df e0 fnstsw ax
825dc8: f6 c4 44 test ah,0x44
825dcb: 7a 58 jp 0x825e25
825dcd: 83 7f 38 10 cmp DWORD PTR [edi+0x38],0x10
825dd1: 8b 57 34 mov edx,DWORD PTR [edi+0x34]
825dd4: 8d 47 24 lea eax,[edi+0x24]
825dd7: 8d 4e 24 lea ecx,[esi+0x24]
825dda: 72 02 jb 0x825dde
825ddc: 8b 00 mov eax,DWORD PTR [eax]
825dde: 52 push edx
825ddf: 50 push eax
825de0: 8b 41 10 mov eax,DWORD PTR [ecx+0x10]
825de3: 50 push eax
825de4: 6a 00 push 0x0
825de6: e8 b5 d8 bf ff call 0x4236a0
825deb: 85 c0 test eax,eax
825ded: 75 36 jne 0x825e25
825def: 83 7f 64 10 cmp DWORD PTR [edi+0x64],0x10
825df3: 8b 57 60 mov edx,DWORD PTR [edi+0x60]
825df6: 8d 47 50 lea eax,[edi+0x50]
825df9: 8d 4e 50 lea ecx,[esi+0x50]
825dfc: 72 02 jb 0x825e00
825dfe: 8b 00 mov eax,DWORD PTR [eax]
825e00: 52 push edx
825e01: 8b 51 10 mov edx,DWORD PTR [ecx+0x10]
825e04: 50 push eax
825e05: 52 push edx
825e06: 6a 00 push 0x0
825e08: e8 93 d8 bf ff call 0x4236a0
825e0d: 85 c0 test eax,eax
825e0f: 75 14 jne 0x825e25
825e11: 8d 47 08 lea eax,[edi+0x8]
825e14: 50 push eax
825e15: 8d 4e 08 lea ecx,[esi+0x8]
825e18: 51 push ecx
825e19: e8 a2 9a c4 ff call 0x46f8c0
825e1e: 83 c4 08 add esp,0x8
825e21: 84 c0 test al,al
825e23: 74 37 je 0x825e5c
825e25: 8b 4b 0c mov ecx,DWORD PTR [ebx+0xc]
825e28: 2b 4b 08 sub ecx,DWORD PTR [ebx+0x8]
825e2b: 8b 75 fc mov esi,DWORD PTR [ebp-0x4]
825e2e: 83 45 08 74 add DWORD PTR [ebp+0x8],0x74
825e32: b8 09 cb 3d 8d mov eax,0x8d3dcb09
825e37: f7 e9 imul ecx
825e39: 03 d1 add edx,ecx
825e3b: c1 fa 06 sar edx,0x6
825e3e: 8b c2 mov eax,edx
825e40: c1 e8 1f shr eax,0x1f
825e43: 46 inc esi
825e44: 03 c2 add eax,edx
825e46: 89 75 fc mov DWORD PTR [ebp-0x4],esi
825e49: 3b f0 cmp esi,eax
825e4b: 0f 82 31 ff ff ff jb 0x825d82
825e51: 5f pop edi
825e52: 5e pop esi
825e53: 33 c0 xor eax,eax
825e55: 5b pop ebx
825e56: 8b e5 mov esp,ebp
825e58: 5d pop ebp
825e59: c2 08 00 ret 0x8
825e5c: 5f pop edi
825e5d: 8b c6 mov eax,esi
825e5f: 5e pop esi
825e60: 5b pop ebx
825e61: 8b e5 mov esp,ebp
825e63: 5d pop ebp
825e64: c2 08 00 ret 0x8

Some files were not shown because too many files have changed in this diff Show more