106 lines
7.4 KiB
Markdown
106 lines
7.4 KiB
Markdown
# Read-only capture / provenance index
|
|
|
|
Initial ReVa session: `run-1b88df9d169e9517a5e1b0f0`.
|
|
|
|
ReVa selected program: `/Sword of the Stars.exe`; reported MD5:
|
|
`9969481c39f4b33a8a21c48b62abee4c`. The initial ReVa service did not expose a local path or
|
|
SHA-256. This limitation is now resolved for the static analysis input only: local
|
|
`dumps/sots.exe` has the same MD5 and SHA-256
|
|
`970b7de729956a53094c7eb98aba4270aee98e2fed5daf0d39e290013c90c841`, as independently recorded
|
|
in `campaign/research/record-observation-crosscheck.md`. This binds the local objdump captures to
|
|
the ReVa-selected binary fingerprint; it does not bind any live runtime, allocator, asset, or shim.
|
|
|
|
| Anchor | Fresh static observation |
|
|
|---|---|
|
|
| `0x007ba1a0` | `read-memory` returned 256 bytes; decompilation reports 395 bytes, four callers including `OnTechResearched` at `0x008917dc`. |
|
|
| `0x008862b0` | `read-memory` returned 435 bytes; decompilation reports 435 bytes and 161 incoming references. |
|
|
| `0x0084ee30` | `read-memory` returned 196 bytes; decompilation reports a 196-byte `__fastcall` constructor and six incoming references. |
|
|
|
|
Requests used the live schema: `programPath=/Sword of the Stars.exe`,
|
|
`addressOrSymbol` for memory, and `functionNameOrAddress` for decompilation. All calls were
|
|
read-only; no Ghidra, VM, or source mutation occurred.
|
|
|
|
## Local instruction capture added in this quantum
|
|
|
|
`objdump-2026-09-09-ownership.txt` contains selected raw instruction windows plus exact GNU
|
|
objdump 2.38 commands. It covers the ObservedTech constructor, append/copy/reallocation/allocation
|
|
and destruction path, plus PlayerEvent vector copy and three-string destruction path. The
|
|
interpretation is in `recovered-static.md`; raw instructions are the authority where the old
|
|
decompiler's false non-return annotation could truncate cleanup.
|
|
|
|
`objdump-2026-09-09-turnevents.txt` adds exact local commands and selected raw instructions for
|
|
`0x00885380`, `0x00825d40`, `0x00879eb0`, outer TurnEvents append/growth/copy/destruction, nested
|
|
PlayerEvent vector construction/copy/destruction, both allocation strides, and static unwind edges.
|
|
Its selected excerpt omitted the test/branch at `0x00825e1e`--`0x00825e2d`, so Astra decision
|
|
`d-2ff30c9f5355116bea822924` overturned that excerpt's sufficiency for branch polarity.
|
|
|
|
`objdump-2026-09-09-dedup-helper.txt` was intended to repair that gap with exit-zero GNU objdump 2.38
|
|
output for `0x00825d40`--`0x00825e64`, helper `0x0046f8c0` through its return, and direct
|
|
comparison callees `0x004236a0` and `0x00422720` through every return. After `EvImg`, FindDuplicate
|
|
passes both `EvDsc` strings to `0x0046f8c0`; that helper returns one for unequal strings and zero for
|
|
equal strings. `0x00825e23` jumps to the matched-element return only on zero. Therefore description
|
|
equality is required for dedup. Candidate and stored strings each independently select inline versus
|
|
heap bytes at capacity `0x10`; byte equality plus length equality is required, including empty and
|
|
mixed short/long cases. This is static instruction evidence, not a live same-bucket fixture.
|
|
The historical archive SHA-256 is `3bc3c368f30f2ef2b0d291acad9c0f898b74f4436393d47bf8c942571793dd06`;
|
|
its first-window unfiltered provenance claim is superseded below.
|
|
|
|
### 2026-09-10 stop-boundary provenance repair
|
|
|
|
Independent review found that the archive above could not be literal unfiltered stdout of its
|
|
declared first command: stop `0x00825e65` truncates the terminal three-byte instruction after `c2`,
|
|
but the archive displayed `c2 08 00`. Astra decision `d-d2a9b8be6399a6abaa0e05a5` overturned that
|
|
provenance claim and required paired captures. The repaired raw streams are:
|
|
|
|
* `objdump-2026-09-10-dedup-narrow.stdout.txt` / `.stderr.txt`, exact stop `0x00825e65`, exit zero,
|
|
stdout SHA-256 `1c2408cd49cc10383bad9fe06d3287476b103205f4155adf64c8a50ccd5205e8`;
|
|
* `objdump-2026-09-10-dedup-wide.stdout.txt` / `.stderr.txt`, exact stop `0x00825e67`, exit zero,
|
|
stdout SHA-256 `3c9f83d3a98d95ffa68e0595e47f6c3beab3016aa97cd44bf39ac72ed3ec0a84`.
|
|
|
|
`objdump-2026-09-10-boundary-repair.md` records executable/tool/source identities, stream sizes and
|
|
the bounded comparison. Both contain 120 decoded instructions and identical preceding instruction
|
|
lines; narrow prints terminal `c2`, wide prints `c2 08 00`. The wide content matches the old first
|
|
window after line-end normalization apart from one final blank line. This supersedes only the old
|
|
first-window production claim; independent semantic review is still required.
|
|
|
|
### 2026-09-10 ownership-window provenance repair
|
|
|
|
Astra decision `d-d4c494ba02ada278030ef473` required the same narrow/wide check for the three
|
|
ownership rows independently found to have truncated stops, followed by an audit of every remaining
|
|
terminal boundary in `objdump-2026-09-09-ownership.txt`. The complete fresh package is
|
|
`run-79357a65226f61d6a86c042d/manifest.json`; measured comparison and bounded interpretation are in
|
|
`comparison.json` and `report.md`.
|
|
|
|
The decision's three predictions held exactly: the allocator, PlayerEvent append and PlayerEvent copy
|
|
narrow streams end in `c2`, while widened streams and independent section-byte dumps contain
|
|
`c2 04 00`; all preceding lines agree. The audit found three additional historical stops with the
|
|
same boundary effect: ObservedTech append and reallocator widen from `c2` to `c2 04 00`, and the
|
|
string allocation/replacement helper widens from `c2` to `c2 08 00`. The constructor, ObservedTech
|
|
copy helper, PlayerEvent destructor and import-thunk windows were already complete at their declared
|
|
stops. All 22 commands exited zero with empty stderr. This supersedes command-to-terminal-byte
|
|
provenance only; it does not establish archive production history, live execution, allocator safety,
|
|
field semantics or acceptance. Fresh independent reproduction remains required.
|
|
|
|
## Independent-review falsifiers
|
|
|
|
The independent verifier should reproduce the local commands against the recorded SHA-256 input
|
|
and challenge these distinct-state claims:
|
|
|
|
1. Empty ObservedTech vector and full vector: verify that `0x007b7320` reaches growth only on
|
|
`_Mylast == _Myend`, and that its `0x0079a150` path copy-constructs rather than header-copies.
|
|
2. Long versus short strings: verify `>= 0x10` cleanup and that the temporary cleanup after
|
|
`RecordObservedTech` cannot be interpreted as ownership transfer.
|
|
3. New versus existing observed-tech name and duplicate versus no-duplicate event: verify branch
|
|
ordering before inferring any allocation or ID effect.
|
|
4. Event vector full capacity: verify the `0x74` copy/growth path independently from the `0x2c`
|
|
ObservedTech path; a matching vector header alone is not a falsifier-resistant semantic test.
|
|
5. Duplicate comparator: hold action/location/finite position/message/image fixed; compare equal
|
|
versus description-only-different EvDsc for empty/short and long strings. Raw instructions predict
|
|
dedup only for equal descriptions. Require positive comparator entry/return evidence and full
|
|
pre/post records/IDs in any later live test; static parsing alone does not prove runtime safety.
|
|
6. Prune boundaries: distinguish zero, one, and two leading stale buckets, plus stale-after-fresh;
|
|
only the two-leading-stale case should shorten the outer vector, by one bucket.
|
|
7. Turn buckets: with duplicate `EvTurn` buckets, get-or-create should return the last match; on a
|
|
miss compare spare versus full outer capacity and empty versus nonempty nested vectors.
|
|
|
|
No live allocator-safety or replacement claim is offered for independent approval.
|