486 lines
26 KiB
Markdown
486 lines
26 KiB
Markdown
|
# Readable Script IR
|
||
|
|
|
||
|
|
This report joins descriptor neighborhoods to the verified 000d VM/runtime lane.
|
||
|
|
It stays conservative: opcode-family and mask-family evidence is carried forward only where the binary proves it.
|
||
|
|
|
||
|
|
## Verified Runtime Lane
|
||
|
|
|
||
|
|
- Owner path: `entity_vm_runtime_init_from_path_if_configured -> entity_vm_runtime_create -> entity_vm_runtime_owner_resource_create`
|
||
|
|
- Slot source: `(+0x10/+0x12) + 0x0d*slot + 4` inside the runtime owner/resource object
|
||
|
|
- Context seed: `entity_vm_context_create_from_slot_index` copies that source into `+0xd6/+0xd8` and mirrors it to `0x39ca[slot]`
|
||
|
|
- Selector status: `0x19/0x1a/0x1b` are proven inside `000d:0988`; `0x18` is still implied, and the upstream seed into `[BP-0x32]` remains unresolved
|
||
|
|
|
||
|
|
## Verified VM IR Operators
|
||
|
|
|
||
|
|
| Stage | IR | Opcode / Lane | Payload Shape |
|
||
|
|
|---|---|---|---|
|
||
|
|
| 000d:0988 | APPEND_UNIQUE_INLINE | opcode 0x18 (implied sibling) | inline referent-chain payload |
|
||
|
|
| 000d:0988 | APPEND_UNIQUE_INDIRECT | opcode 0x19 | indirect/string-like referent-chain payload |
|
||
|
|
| 000d:0988 | REMOVE_MATCHING_INDIRECT | opcode 0x1a | indirect/string-like referent-chain payload |
|
||
|
|
| 000d:0988 | REMOVE_MATCHING_INLINE | opcode 0x1b | inline referent-chain payload |
|
||
|
|
| 000d:177c | PUSH_FRAME_WORD_LITERAL | same FUN_000d_ebe3 sequencer family | word scalar pushed to stream stack |
|
||
|
|
| 000d:1acb | COMPARE_STREAM_DWORD_AND_PUSH_BOOL | same FUN_000d_ebe3 sequencer family | stream dword pair consumed, predicate word emitted |
|
||
|
|
| 000d:208b | MATERIALIZE_OR_FORWARD_VALUE | slot-backed context consumer | materialized slot value or forwarded object result |
|
||
|
|
| 000d:21ed | PREPEND_INLINE_PAYLOAD | inline payload substage | caller-owned blob copied into context +0x102 buffer |
|
||
|
|
| 000d:22bc | BUILD_ENTITY_LINK_MATRIX | inline payload follow-on stage | two signed metadata bytes plus streamed entity/link ids |
|
||
|
|
| 000d:22bc | EMIT_OR_PUSHBACK_RESULT | inline payload follow-on stage | stream writeback filter |
|
||
|
|
| 000d:2104 | FINALIZE_MIXED_VALUE_TO_OUTPTR | same FUN_000d_ebe3 sequencer family | mixed immediate/object scalar return |
|
||
|
|
|
||
|
|
## Verified Mask Ladder
|
||
|
|
|
||
|
|
| Wrapper | Mask | Caller Anchor | Descriptor Bias |
|
||
|
|
|---|---|---|---|
|
||
|
|
| 0005:27a4 | 0x0001:0000 | 000c:a09e entity +0x5b bit 0x0004 branch | generic active-event-biased lane; no direct class-id bridge |
|
||
|
|
| 0005:2867 | 0x0002:0001 | stores result into entity field +0x39 | active-event ecosystem bias stronger than referent-anchor bias |
|
||
|
|
| 0005:2ae2 | 0x0004:0002 | same verified local mask ladder around entity_vm_context_try_create_masked_for_entity | active-event ecosystem bias stronger than referent-anchor bias |
|
||
|
|
| 0005:2c9b | 0x0010:0004 | direct callers at 0005:5946 and 0005:59e9 | active-event ecosystem bias stronger than referent-anchor bias |
|
||
|
|
| 0005:2918 | 0x0020:0005 | +0x3c == 0x20b object lane, carries caller fields +0x36/+0x38 | candidate active-event field bridge; still not descriptor-specific |
|
||
|
|
| 0005:2c06 | 0x0200:0009 | direct caller anchor at 0005:0292 | active-event ecosystem bias stronger than referent-anchor bias |
|
||
|
|
| 0005:2c35 | 0x0400:000a | xref-dark signed slot-offset wrapper forwarding context +0x34 | offset-specialized masked context creation; descriptor family unresolved |
|
||
|
|
| 0005:2c68 | 0x0800:000b | xref-dark signed slot-offset wrapper forwarding context +0x34 | offset-specialized masked context creation; descriptor family unresolved |
|
||
|
|
| 0005:2cd2 | 0x1000:000c | direct caller anchor at 0005:0fee | active-event ecosystem bias stronger than referent-anchor bias |
|
||
|
|
| 0004:f05c | 0x2000:0015 | 0004:f2b3 overlap/proximity branch with entity byte +0x32 state checks | gameplay-state lane feeding runtime materialization, not direct descriptor switch |
|
||
|
|
| 0005:2d01 | 0x4000:000e | direct callers at 0007:814e and 0007:822e | active-event ecosystem bias stronger than referent-anchor bias |
|
||
|
|
| 0004:f033 | 0x8000:0007 | local wrapper seed recovered from direct instruction evidence | gameplay-side materialization lane; still descriptor-agnostic |
|
||
|
|
| 0005:2d30 | 0x8000:000f | entity id/class flag gate plus 0x0f16 / 0x20f dispatch-entry emission path | strongest current active-event ecosystem candidate in the ladder |
|
||
|
|
|
||
|
|
## JELYHACK anchor lane
|
||
|
|
|
||
|
|
### 277: JELYHACK
|
||
|
|
|
||
|
|
Descriptor focus: `anchor JELYHACK(referent)`
|
||
|
|
|
||
|
|
Descriptor-side attachments:
|
||
|
|
- Active event neighbors: REE_BOOT, SFXTRIG
|
||
|
|
- Callback neighbors: SURCAMNS, SURCAMEW
|
||
|
|
- Referent-side neighbors: BASEGUN, TIMER, SPECIAL, TRIGPAD, MONSTER, ELITE, D_ESTORM, DATALINK, SLIDEFLR, JELYH2, HOFFMAN, D_HOFFMA
|
||
|
|
- Event families present: callback-eventtrigger, boot-event-core, minimal-event-core
|
||
|
|
|
||
|
|
Runtime bridge:
|
||
|
|
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
|
||
|
|
- Mask pairs: indirect-only active-event-biased ladder; no direct anchor-specific mask proven
|
||
|
|
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
|
||
|
|
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
|
||
|
|
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
|
||
|
|
- Interpretation: Referent-only anchors are now readable as payload owners, but the current mask ladder still correlates more strongly with active-event descriptors than with anchor-only rows.
|
||
|
|
|
||
|
|
```text
|
||
|
|
anchor JELYHACK(referent)
|
||
|
|
attach REE_BOOT(...) # active event-bearing neighbor
|
||
|
|
attach SFXTRIG(...) # active event-bearing neighbor
|
||
|
|
callback SURCAMNS(...) # eventTrigger-bearing neighbor
|
||
|
|
callback SURCAMEW(...) # eventTrigger-bearing neighbor
|
||
|
|
near BASEGUN(...) # referent-side local context
|
||
|
|
near TIMER(...) # referent-side local context
|
||
|
|
near SPECIAL(...) # referent-side local context
|
||
|
|
near TRIGPAD(...) # referent-side local context
|
||
|
|
near MONSTER(...) # referent-side local context
|
||
|
|
near ELITE(...) # referent-side local context
|
||
|
|
near D_ESTORM(...) # referent-side local context
|
||
|
|
near DATALINK(...) # referent-side local context
|
||
|
|
near SLIDEFLR(...) # referent-side local context
|
||
|
|
near JELYH2(...) # referent-side local context
|
||
|
|
near HOFFMAN(...) # referent-side local context
|
||
|
|
near D_HOFFMA(...) # referent-side local context
|
||
|
|
|
||
|
|
vm_effect:
|
||
|
|
APPEND_UNIQUE_INLINE(...)
|
||
|
|
APPEND_UNIQUE_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INLINE(...)
|
||
|
|
MATERIALIZE_OR_FORWARD_VALUE(...)
|
||
|
|
PREPEND_INLINE_PAYLOAD(...)
|
||
|
|
BUILD_ENTITY_LINK_MATRIX(...)
|
||
|
|
EMIT_OR_PUSHBACK_RESULT(...)
|
||
|
|
FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
|
||
|
|
```
|
||
|
|
|
||
|
|
### 280: JELYH2
|
||
|
|
|
||
|
|
Descriptor focus: `anchor JELYH2(referent)`
|
||
|
|
|
||
|
|
Descriptor-side attachments:
|
||
|
|
- Active event neighbors: REE_BOOT, SFXTRIG
|
||
|
|
- Callback neighbors: SURCAMEW
|
||
|
|
- Referent-side neighbors: SPECIAL, TRIGPAD, MONSTER, ELITE, D_ESTORM, JELYHACK, DATALINK, SLIDEFLR, HOFFMAN, D_HOFFMA, SKILLBOX, D_GURDSQ, VETRON
|
||
|
|
- Event families present: boot-event-core, callback-eventtrigger, minimal-event-core
|
||
|
|
|
||
|
|
Runtime bridge:
|
||
|
|
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
|
||
|
|
- Mask pairs: indirect-only active-event-biased ladder; no direct anchor-specific mask proven
|
||
|
|
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
|
||
|
|
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
|
||
|
|
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
|
||
|
|
- Interpretation: Referent-only anchors are now readable as payload owners, but the current mask ladder still correlates more strongly with active-event descriptors than with anchor-only rows.
|
||
|
|
|
||
|
|
```text
|
||
|
|
anchor JELYH2(referent)
|
||
|
|
attach REE_BOOT(...) # active event-bearing neighbor
|
||
|
|
attach SFXTRIG(...) # active event-bearing neighbor
|
||
|
|
callback SURCAMEW(...) # eventTrigger-bearing neighbor
|
||
|
|
near SPECIAL(...) # referent-side local context
|
||
|
|
near TRIGPAD(...) # referent-side local context
|
||
|
|
near MONSTER(...) # referent-side local context
|
||
|
|
near ELITE(...) # referent-side local context
|
||
|
|
near D_ESTORM(...) # referent-side local context
|
||
|
|
near JELYHACK(...) # referent-side local context
|
||
|
|
near DATALINK(...) # referent-side local context
|
||
|
|
near SLIDEFLR(...) # referent-side local context
|
||
|
|
near HOFFMAN(...) # referent-side local context
|
||
|
|
near D_HOFFMA(...) # referent-side local context
|
||
|
|
near SKILLBOX(...) # referent-side local context
|
||
|
|
near D_GURDSQ(...) # referent-side local context
|
||
|
|
near VETRON(...) # referent-side local context
|
||
|
|
|
||
|
|
vm_effect:
|
||
|
|
APPEND_UNIQUE_INLINE(...)
|
||
|
|
APPEND_UNIQUE_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INLINE(...)
|
||
|
|
MATERIALIZE_OR_FORWARD_VALUE(...)
|
||
|
|
PREPEND_INLINE_PAYLOAD(...)
|
||
|
|
BUILD_ENTITY_LINK_MATRIX(...)
|
||
|
|
EMIT_OR_PUSHBACK_RESULT(...)
|
||
|
|
FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
## EVENT hub lane
|
||
|
|
|
||
|
|
### 189: COR_BOOT
|
||
|
|
|
||
|
|
Descriptor focus: `attach COR_BOOT(referent,event,counter,item)`
|
||
|
|
|
||
|
|
Descriptor-side attachments:
|
||
|
|
- Active event neighbors: EVENT, NPCTRIG
|
||
|
|
- Callback neighbors: none proven in window
|
||
|
|
- Referent-side neighbors: GRENADE, SCIENTIS, ROLL_NS, REB_COUP, MEDIKIT, K, CRUZTRIG, NPC_ONLY
|
||
|
|
- Event families present: event-hub, npc-trigger
|
||
|
|
|
||
|
|
Runtime bridge:
|
||
|
|
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
|
||
|
|
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
|
||
|
|
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
|
||
|
|
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
|
||
|
|
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
|
||
|
|
- Interpretation: This is the strongest current descriptor-side bridge into the active event runtime lane: the neighborhood contains explicit event cores and matches the proven payload-chain plus link-matrix VM behavior.
|
||
|
|
|
||
|
|
```text
|
||
|
|
attach COR_BOOT(referent,event,counter,item)
|
||
|
|
attach EVENT(...) # active event-bearing neighbor
|
||
|
|
attach NPCTRIG(...) # active event-bearing neighbor
|
||
|
|
near GRENADE(...) # referent-side local context
|
||
|
|
near SCIENTIS(...) # referent-side local context
|
||
|
|
near ROLL_NS(...) # referent-side local context
|
||
|
|
near REB_COUP(...) # referent-side local context
|
||
|
|
near MEDIKIT(...) # referent-side local context
|
||
|
|
near K(...) # referent-side local context
|
||
|
|
near CRUZTRIG(...) # referent-side local context
|
||
|
|
near NPC_ONLY(...) # referent-side local context
|
||
|
|
|
||
|
|
vm_effect:
|
||
|
|
APPEND_UNIQUE_INLINE(...)
|
||
|
|
APPEND_UNIQUE_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INLINE(...)
|
||
|
|
MATERIALIZE_OR_FORWARD_VALUE(...)
|
||
|
|
PREPEND_INLINE_PAYLOAD(...)
|
||
|
|
BUILD_ENTITY_LINK_MATRIX(...)
|
||
|
|
EMIT_OR_PUSHBACK_RESULT(...)
|
||
|
|
FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
|
||
|
|
```
|
||
|
|
|
||
|
|
### 190: EVENT
|
||
|
|
|
||
|
|
Descriptor focus: `hub EVENT(mva3b,referent,event,item,source,dest,door,counter,counter2,link,time,post1,post2,floor,flicMan)`
|
||
|
|
|
||
|
|
Descriptor-side attachments:
|
||
|
|
- Active event neighbors: COR_BOOT, NPCTRIG
|
||
|
|
- Callback neighbors: none proven in window
|
||
|
|
- Referent-side neighbors: SCIENTIS, ROLL_NS, REB_COUP, MEDIKIT, K, CRUZTRIG, NPC_ONLY, VMAIL
|
||
|
|
- Event families present: boot-event-core, npc-trigger
|
||
|
|
|
||
|
|
Runtime bridge:
|
||
|
|
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
|
||
|
|
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
|
||
|
|
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
|
||
|
|
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
|
||
|
|
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
|
||
|
|
- Interpretation: This is the strongest current descriptor-side bridge into the active event runtime lane: the neighborhood contains explicit event cores and matches the proven payload-chain plus link-matrix VM behavior.
|
||
|
|
|
||
|
|
```text
|
||
|
|
hub EVENT(mva3b,referent,event,item,source,dest,door,counter,counter2,link,time,post1,post2,floor,flicMan)
|
||
|
|
attach COR_BOOT(...) # active event-bearing neighbor
|
||
|
|
attach NPCTRIG(...) # active event-bearing neighbor
|
||
|
|
near SCIENTIS(...) # referent-side local context
|
||
|
|
near ROLL_NS(...) # referent-side local context
|
||
|
|
near REB_COUP(...) # referent-side local context
|
||
|
|
near MEDIKIT(...) # referent-side local context
|
||
|
|
near K(...) # referent-side local context
|
||
|
|
near CRUZTRIG(...) # referent-side local context
|
||
|
|
near NPC_ONLY(...) # referent-side local context
|
||
|
|
near VMAIL(...) # referent-side local context
|
||
|
|
|
||
|
|
vm_effect:
|
||
|
|
APPEND_UNIQUE_INLINE(...)
|
||
|
|
APPEND_UNIQUE_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INLINE(...)
|
||
|
|
MATERIALIZE_OR_FORWARD_VALUE(...)
|
||
|
|
PREPEND_INLINE_PAYLOAD(...)
|
||
|
|
BUILD_ENTITY_LINK_MATRIX(...)
|
||
|
|
EMIT_OR_PUSHBACK_RESULT(...)
|
||
|
|
FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
|
||
|
|
```
|
||
|
|
|
||
|
|
### 191: NPCTRIG
|
||
|
|
|
||
|
|
Descriptor focus: `attach NPCTRIG(referent,event,item,item2,typeNpc)`
|
||
|
|
|
||
|
|
Descriptor-side attachments:
|
||
|
|
- Active event neighbors: COR_BOOT, EVENT
|
||
|
|
- Callback neighbors: none proven in window
|
||
|
|
- Referent-side neighbors: ROLL_NS, REB_COUP, MEDIKIT, K, CRUZTRIG, NPC_ONLY, VMAIL, STORMTRO
|
||
|
|
- Event families present: boot-event-core, event-hub
|
||
|
|
|
||
|
|
Runtime bridge:
|
||
|
|
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
|
||
|
|
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
|
||
|
|
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
|
||
|
|
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
|
||
|
|
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
|
||
|
|
- Interpretation: This is the strongest current descriptor-side bridge into the active event runtime lane: the neighborhood contains explicit event cores and matches the proven payload-chain plus link-matrix VM behavior.
|
||
|
|
|
||
|
|
```text
|
||
|
|
attach NPCTRIG(referent,event,item,item2,typeNpc)
|
||
|
|
attach COR_BOOT(...) # active event-bearing neighbor
|
||
|
|
attach EVENT(...) # active event-bearing neighbor
|
||
|
|
near ROLL_NS(...) # referent-side local context
|
||
|
|
near REB_COUP(...) # referent-side local context
|
||
|
|
near MEDIKIT(...) # referent-side local context
|
||
|
|
near K(...) # referent-side local context
|
||
|
|
near CRUZTRIG(...) # referent-side local context
|
||
|
|
near NPC_ONLY(...) # referent-side local context
|
||
|
|
near VMAIL(...) # referent-side local context
|
||
|
|
near STORMTRO(...) # referent-side local context
|
||
|
|
|
||
|
|
vm_effect:
|
||
|
|
APPEND_UNIQUE_INLINE(...)
|
||
|
|
APPEND_UNIQUE_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INLINE(...)
|
||
|
|
MATERIALIZE_OR_FORWARD_VALUE(...)
|
||
|
|
PREPEND_INLINE_PAYLOAD(...)
|
||
|
|
BUILD_ENTITY_LINK_MATRIX(...)
|
||
|
|
EMIT_OR_PUSHBACK_RESULT(...)
|
||
|
|
FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
## Environmental event lane
|
||
|
|
|
||
|
|
### 229: FLAMEBOX
|
||
|
|
|
||
|
|
Descriptor focus: `attach FLAMEBOX(referent,event,flame,flame2,direction,count,newType)`
|
||
|
|
|
||
|
|
Descriptor-side attachments:
|
||
|
|
- Active event neighbors: none proven in window
|
||
|
|
- Callback neighbors: none proven in window
|
||
|
|
- Referent-side neighbors: WVENTNS, WVENTEW, REBEL_TV, SDOOR_N, SDOOR_E, EBRIDGE2, MCRATE, COPY_EW, COPY_NS
|
||
|
|
- Event families present: none
|
||
|
|
|
||
|
|
Runtime bridge:
|
||
|
|
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
|
||
|
|
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
|
||
|
|
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
|
||
|
|
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
|
||
|
|
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
|
||
|
|
- Interpretation: Environmental descriptors share the same active event field grammar, so they likely ride the same generic VM event lane even though no hazard-specific opcode split is proven yet.
|
||
|
|
|
||
|
|
```text
|
||
|
|
attach FLAMEBOX(referent,event,flame,flame2,direction,count,newType)
|
||
|
|
near WVENTNS(...) # referent-side local context
|
||
|
|
near WVENTEW(...) # referent-side local context
|
||
|
|
near REBEL_TV(...) # referent-side local context
|
||
|
|
near SDOOR_N(...) # referent-side local context
|
||
|
|
near SDOOR_E(...) # referent-side local context
|
||
|
|
near EBRIDGE2(...) # referent-side local context
|
||
|
|
near MCRATE(...) # referent-side local context
|
||
|
|
near COPY_EW(...) # referent-side local context
|
||
|
|
near COPY_NS(...) # referent-side local context
|
||
|
|
|
||
|
|
vm_effect:
|
||
|
|
APPEND_UNIQUE_INLINE(...)
|
||
|
|
APPEND_UNIQUE_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INLINE(...)
|
||
|
|
MATERIALIZE_OR_FORWARD_VALUE(...)
|
||
|
|
PREPEND_INLINE_PAYLOAD(...)
|
||
|
|
BUILD_ENTITY_LINK_MATRIX(...)
|
||
|
|
EMIT_OR_PUSHBACK_RESULT(...)
|
||
|
|
FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
|
||
|
|
```
|
||
|
|
|
||
|
|
### 237: NOSTRIL
|
||
|
|
|
||
|
|
Descriptor focus: `attach NOSTRIL(referent,event,fire,count,fire2)`
|
||
|
|
|
||
|
|
Descriptor-side attachments:
|
||
|
|
- Active event neighbors: none proven in window
|
||
|
|
- Callback neighbors: none proven in window
|
||
|
|
- Referent-side neighbors: COPY_EW, COPY_NS, FLAME1, REB_PAD, VARDESK, BLASER1, REB_BOOT, UPPLATE, KEYPADNS
|
||
|
|
- Event families present: none
|
||
|
|
|
||
|
|
Runtime bridge:
|
||
|
|
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
|
||
|
|
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
|
||
|
|
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
|
||
|
|
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
|
||
|
|
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
|
||
|
|
- Interpretation: Environmental descriptors share the same active event field grammar, so they likely ride the same generic VM event lane even though no hazard-specific opcode split is proven yet.
|
||
|
|
|
||
|
|
```text
|
||
|
|
attach NOSTRIL(referent,event,fire,count,fire2)
|
||
|
|
near COPY_EW(...) # referent-side local context
|
||
|
|
near COPY_NS(...) # referent-side local context
|
||
|
|
near FLAME1(...) # referent-side local context
|
||
|
|
near REB_PAD(...) # referent-side local context
|
||
|
|
near VARDESK(...) # referent-side local context
|
||
|
|
near BLASER1(...) # referent-side local context
|
||
|
|
near REB_BOOT(...) # referent-side local context
|
||
|
|
near UPPLATE(...) # referent-side local context
|
||
|
|
near KEYPADNS(...) # referent-side local context
|
||
|
|
|
||
|
|
vm_effect:
|
||
|
|
APPEND_UNIQUE_INLINE(...)
|
||
|
|
APPEND_UNIQUE_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INLINE(...)
|
||
|
|
MATERIALIZE_OR_FORWARD_VALUE(...)
|
||
|
|
PREPEND_INLINE_PAYLOAD(...)
|
||
|
|
BUILD_ENTITY_LINK_MATRIX(...)
|
||
|
|
EMIT_OR_PUSHBACK_RESULT(...)
|
||
|
|
FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
|
||
|
|
```
|
||
|
|
|
||
|
|
### 296: STEAMBOX
|
||
|
|
|
||
|
|
Descriptor focus: `attach STEAMBOX(referent,event,steam,steam2,direction,count)`
|
||
|
|
|
||
|
|
Descriptor-side attachments:
|
||
|
|
- Active event neighbors: none proven in window
|
||
|
|
- Callback neighbors: none proven in window
|
||
|
|
- Referent-side neighbors: BOUNCBOX, HOVER1, STEAM1, FADE, PHIR, FLAME2, STEAM2, FLAMELP, BBOX, GBOX_NS
|
||
|
|
- Event families present: none
|
||
|
|
|
||
|
|
Runtime bridge:
|
||
|
|
- Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
|
||
|
|
- Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
|
||
|
|
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
|
||
|
|
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
|
||
|
|
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
|
||
|
|
- Interpretation: Environmental descriptors share the same active event field grammar, so they likely ride the same generic VM event lane even though no hazard-specific opcode split is proven yet.
|
||
|
|
|
||
|
|
```text
|
||
|
|
attach STEAMBOX(referent,event,steam,steam2,direction,count)
|
||
|
|
near BOUNCBOX(...) # referent-side local context
|
||
|
|
near HOVER1(...) # referent-side local context
|
||
|
|
near STEAM1(...) # referent-side local context
|
||
|
|
near FADE(...) # referent-side local context
|
||
|
|
near PHIR(...) # referent-side local context
|
||
|
|
near FLAME2(...) # referent-side local context
|
||
|
|
near STEAM2(...) # referent-side local context
|
||
|
|
near FLAMELP(...) # referent-side local context
|
||
|
|
near BBOX(...) # referent-side local context
|
||
|
|
near GBOX_NS(...) # referent-side local context
|
||
|
|
|
||
|
|
vm_effect:
|
||
|
|
APPEND_UNIQUE_INLINE(...)
|
||
|
|
APPEND_UNIQUE_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INDIRECT(...)
|
||
|
|
REMOVE_MATCHING_INLINE(...)
|
||
|
|
MATERIALIZE_OR_FORWARD_VALUE(...)
|
||
|
|
PREPEND_INLINE_PAYLOAD(...)
|
||
|
|
BUILD_ENTITY_LINK_MATRIX(...)
|
||
|
|
EMIT_OR_PUSHBACK_RESULT(...)
|
||
|
|
FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
## Callback trigger lane
|
||
|
|
|
||
|
|
### 269: SURCAMNS
|
||
|
|
|
||
|
|
Descriptor focus: `callback SURCAMNS(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)`
|
||
|
|
|
||
|
|
Descriptor-side attachments:
|
||
|
|
- Active event neighbors: none proven in window
|
||
|
|
- Callback neighbors: none proven in window
|
||
|
|
- Referent-side neighbors: D_SOLD, D_VARG, D_COUR, D_SUSAN, D_THERM, BASEGUN, TIMER, SPECIAL, TRIGPAD, MONSTER
|
||
|
|
- Event families present: none
|
||
|
|
|
||
|
|
Runtime bridge:
|
||
|
|
- Runtime ops: MATERIALIZE_OR_FORWARD_VALUE, PUSH_FRAME_WORD_LITERAL, COMPARE_STREAM_DWORD_AND_PUSH_BOOL, FINALIZE_MIXED_VALUE_TO_OUTPTR
|
||
|
|
- Mask pairs: no callback-specific mask pair proven; current ladder favors active event carriers
|
||
|
|
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
|
||
|
|
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
|
||
|
|
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
|
||
|
|
- Interpretation: Callback/eventTrigger descriptors are structurally distinct from the active event lane, so the runtime bridge is still generic slot-backed context flow rather than a callback-specific opcode family.
|
||
|
|
|
||
|
|
```text
|
||
|
|
callback SURCAMNS(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)
|
||
|
|
near D_SOLD(...) # referent-side local context
|
||
|
|
near D_VARG(...) # referent-side local context
|
||
|
|
near D_COUR(...) # referent-side local context
|
||
|
|
near D_SUSAN(...) # referent-side local context
|
||
|
|
near D_THERM(...) # referent-side local context
|
||
|
|
near BASEGUN(...) # referent-side local context
|
||
|
|
near TIMER(...) # referent-side local context
|
||
|
|
near SPECIAL(...) # referent-side local context
|
||
|
|
near TRIGPAD(...) # referent-side local context
|
||
|
|
near MONSTER(...) # referent-side local context
|
||
|
|
|
||
|
|
vm_effect:
|
||
|
|
MATERIALIZE_OR_FORWARD_VALUE(...)
|
||
|
|
PUSH_FRAME_WORD_LITERAL(...)
|
||
|
|
COMPARE_STREAM_DWORD_AND_PUSH_BOOL(...)
|
||
|
|
FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
|
||
|
|
```
|
||
|
|
|
||
|
|
### 284: SURCAMEW
|
||
|
|
|
||
|
|
Descriptor focus: `callback SURCAMEW(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)`
|
||
|
|
|
||
|
|
Descriptor-side attachments:
|
||
|
|
- Active event neighbors: REE_BOOT, SFXTRIG
|
||
|
|
- Callback neighbors: none proven in window
|
||
|
|
- Referent-side neighbors: SLIDEFLR, JELYH2, HOFFMAN, D_HOFFMA, SKILLBOX, D_GURDSQ, VETRON, DEATHBOX
|
||
|
|
- Event families present: boot-event-core, minimal-event-core
|
||
|
|
|
||
|
|
Runtime bridge:
|
||
|
|
- Runtime ops: MATERIALIZE_OR_FORWARD_VALUE, PUSH_FRAME_WORD_LITERAL, COMPARE_STREAM_DWORD_AND_PUSH_BOOL, FINALIZE_MIXED_VALUE_TO_OUTPTR
|
||
|
|
- Mask pairs: no callback-specific mask pair proven; current ladder favors active event carriers
|
||
|
|
- Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
|
||
|
|
- Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
|
||
|
|
- Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
|
||
|
|
- Interpretation: Callback/eventTrigger descriptors are structurally distinct from the active event lane, so the runtime bridge is still generic slot-backed context flow rather than a callback-specific opcode family.
|
||
|
|
|
||
|
|
```text
|
||
|
|
callback SURCAMEW(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)
|
||
|
|
attach REE_BOOT(...) # active event-bearing neighbor
|
||
|
|
attach SFXTRIG(...) # active event-bearing neighbor
|
||
|
|
near SLIDEFLR(...) # referent-side local context
|
||
|
|
near JELYH2(...) # referent-side local context
|
||
|
|
near HOFFMAN(...) # referent-side local context
|
||
|
|
near D_HOFFMA(...) # referent-side local context
|
||
|
|
near SKILLBOX(...) # referent-side local context
|
||
|
|
near D_GURDSQ(...) # referent-side local context
|
||
|
|
near VETRON(...) # referent-side local context
|
||
|
|
near DEATHBOX(...) # referent-side local context
|
||
|
|
|
||
|
|
vm_effect:
|
||
|
|
MATERIALIZE_OR_FORWARD_VALUE(...)
|
||
|
|
PUSH_FRAME_WORD_LITERAL(...)
|
||
|
|
COMPARE_STREAM_DWORD_AND_PUSH_BOOL(...)
|
||
|
|
FINALIZE_MIXED_VALUE_TO_OUTPTR(...)
|
||
|
|
```
|