maddo/Crusader_Decomp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Crusader_Decomp/USECODE/EUSECODE_extracted/readable_script_ir.md
MaddoScientisto de42fd1ea1 Add Crusader-specific USECODE data and documentation 
- Introduced new file `vm_mask_ladder.tsv` containing detailed mappings for Crusader USECODE VM masks and their associated descriptors.
- Added comprehensive documentation in `scummvm-crusader-reference.md` outlining the structure, findings, and implications for reverse-engineering the Crusader engine within ScummVM.
- Created `usecode-roundtrip-ir.md` to document the plan for converting Crusader USECODE bytes into a human-readable format, detailing the container layout, event names, and intrinsic tables.
- Implemented a PowerShell script `temp_usecode_sample.ps1` for extracting and analyzing USECODE data from the Crusader FLX files, providing insights into class and event structures.
2026-03-22 17:26:39 +01:00

26 KiB
Raw Permalink Blame History

Readable Script IR

This report joins descriptor neighborhoods to the verified 000d VM/runtime lane. It stays conservative: opcode-family and mask-family evidence is carried forward only where the binary proves it.

Verified Runtime Lane

  • Owner path: entity_vm_runtime_init_from_path_if_configured -> entity_vm_runtime_create -> entity_vm_runtime_owner_resource_create
  • Slot source: (+0x10/+0x12) + 0x0d*slot + 4 inside the runtime owner/resource object
  • Context seed: entity_vm_context_create_from_slot_index copies that source into +0xd6/+0xd8 and mirrors it to 0x39ca[slot]
  • Selector status: 0x19/0x1a/0x1b are proven inside 000d:0988; 0x18 is still implied, and the upstream seed into [BP-0x32] remains unresolved

Verified VM IR Operators

Stage IR Opcode / Lane Payload Shape
000d:0988 APPEND_UNIQUE_INLINE opcode 0x18 (implied sibling) inline referent-chain payload
000d:0988 APPEND_UNIQUE_INDIRECT opcode 0x19 indirect/string-like referent-chain payload
000d:0988 REMOVE_MATCHING_INDIRECT opcode 0x1a indirect/string-like referent-chain payload
000d:0988 REMOVE_MATCHING_INLINE opcode 0x1b inline referent-chain payload
000d:177c PUSH_FRAME_WORD_LITERAL same FUN_000d_ebe3 sequencer family word scalar pushed to stream stack
000d:1acb COMPARE_STREAM_DWORD_AND_PUSH_BOOL same FUN_000d_ebe3 sequencer family stream dword pair consumed, predicate word emitted
000d:208b MATERIALIZE_OR_FORWARD_VALUE slot-backed context consumer materialized slot value or forwarded object result
000d:21ed PREPEND_INLINE_PAYLOAD inline payload substage caller-owned blob copied into context +0x102 buffer
000d:22bc BUILD_ENTITY_LINK_MATRIX inline payload follow-on stage two signed metadata bytes plus streamed entity/link ids
000d:22bc EMIT_OR_PUSHBACK_RESULT inline payload follow-on stage stream writeback filter
000d:2104 FINALIZE_MIXED_VALUE_TO_OUTPTR same FUN_000d_ebe3 sequencer family mixed immediate/object scalar return

Verified Mask Ladder

Wrapper Mask Caller Anchor Descriptor Bias
0005:27a4 0x0001:0000 000c:a09e entity +0x5b bit 0x0004 branch generic active-event-biased lane; no direct class-id bridge
0005:2867 0x0002:0001 stores result into entity field +0x39 active-event ecosystem bias stronger than referent-anchor bias
0005:2ae2 0x0004:0002 same verified local mask ladder around entity_vm_context_try_create_masked_for_entity active-event ecosystem bias stronger than referent-anchor bias
0005:2c9b 0x0010:0004 direct callers at 0005:5946 and 0005:59e9 active-event ecosystem bias stronger than referent-anchor bias
0005:2918 0x0020:0005 +0x3c == 0x20b object lane, carries caller fields +0x36/+0x38 candidate active-event field bridge; still not descriptor-specific
0005:2c06 0x0200:0009 direct caller anchor at 0005:0292 active-event ecosystem bias stronger than referent-anchor bias
0005:2c35 0x0400:000a xref-dark signed slot-offset wrapper forwarding context +0x34 offset-specialized masked context creation; descriptor family unresolved
0005:2c68 0x0800:000b xref-dark signed slot-offset wrapper forwarding context +0x34 offset-specialized masked context creation; descriptor family unresolved
0005:2cd2 0x1000:000c direct caller anchor at 0005:0fee active-event ecosystem bias stronger than referent-anchor bias
0004:f05c 0x2000:0015 0004:f2b3 overlap/proximity branch with entity byte +0x32 state checks gameplay-state lane feeding runtime materialization, not direct descriptor switch
0005:2d01 0x4000:000e direct callers at 0007:814e and 0007:822e active-event ecosystem bias stronger than referent-anchor bias
0004:f033 0x8000:0007 local wrapper seed recovered from direct instruction evidence gameplay-side materialization lane; still descriptor-agnostic
0005:2d30 0x8000:000f entity id/class flag gate plus 0x0f16 / 0x20f dispatch-entry emission path strongest current active-event ecosystem candidate in the ladder

JELYHACK anchor lane

277: JELYHACK

Descriptor focus: anchor JELYHACK(referent)

Descriptor-side attachments:

  • Active event neighbors: REE_BOOT, SFXTRIG
  • Callback neighbors: SURCAMNS, SURCAMEW
  • Referent-side neighbors: BASEGUN, TIMER, SPECIAL, TRIGPAD, MONSTER, ELITE, D_ESTORM, DATALINK, SLIDEFLR, JELYH2, HOFFMAN, D_HOFFMA
  • Event families present: callback-eventtrigger, boot-event-core, minimal-event-core

Runtime bridge:

  • Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
  • Mask pairs: indirect-only active-event-biased ladder; no direct anchor-specific mask proven
  • Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
  • Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
  • Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
  • Interpretation: Referent-only anchors are now readable as payload owners, but the current mask ladder still correlates more strongly with active-event descriptors than with anchor-only rows.
anchor JELYHACK(referent)
attach REE_BOOT(...)  # active event-bearing neighbor
attach SFXTRIG(...)  # active event-bearing neighbor
callback SURCAMNS(...)  # eventTrigger-bearing neighbor
callback SURCAMEW(...)  # eventTrigger-bearing neighbor
near BASEGUN(...)  # referent-side local context
near TIMER(...)  # referent-side local context
near SPECIAL(...)  # referent-side local context
near TRIGPAD(...)  # referent-side local context
near MONSTER(...)  # referent-side local context
near ELITE(...)  # referent-side local context
near D_ESTORM(...)  # referent-side local context
near DATALINK(...)  # referent-side local context
near SLIDEFLR(...)  # referent-side local context
near JELYH2(...)  # referent-side local context
near HOFFMAN(...)  # referent-side local context
near D_HOFFMA(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)

280: JELYH2

Descriptor focus: anchor JELYH2(referent)

Descriptor-side attachments:

  • Active event neighbors: REE_BOOT, SFXTRIG
  • Callback neighbors: SURCAMEW
  • Referent-side neighbors: SPECIAL, TRIGPAD, MONSTER, ELITE, D_ESTORM, JELYHACK, DATALINK, SLIDEFLR, HOFFMAN, D_HOFFMA, SKILLBOX, D_GURDSQ, VETRON
  • Event families present: boot-event-core, callback-eventtrigger, minimal-event-core

Runtime bridge:

  • Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
  • Mask pairs: indirect-only active-event-biased ladder; no direct anchor-specific mask proven
  • Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
  • Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
  • Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
  • Interpretation: Referent-only anchors are now readable as payload owners, but the current mask ladder still correlates more strongly with active-event descriptors than with anchor-only rows.
anchor JELYH2(referent)
attach REE_BOOT(...)  # active event-bearing neighbor
attach SFXTRIG(...)  # active event-bearing neighbor
callback SURCAMEW(...)  # eventTrigger-bearing neighbor
near SPECIAL(...)  # referent-side local context
near TRIGPAD(...)  # referent-side local context
near MONSTER(...)  # referent-side local context
near ELITE(...)  # referent-side local context
near D_ESTORM(...)  # referent-side local context
near JELYHACK(...)  # referent-side local context
near DATALINK(...)  # referent-side local context
near SLIDEFLR(...)  # referent-side local context
near HOFFMAN(...)  # referent-side local context
near D_HOFFMA(...)  # referent-side local context
near SKILLBOX(...)  # referent-side local context
near D_GURDSQ(...)  # referent-side local context
near VETRON(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)

EVENT hub lane

189: COR_BOOT

Descriptor focus: attach COR_BOOT(referent,event,counter,item)

Descriptor-side attachments:

  • Active event neighbors: EVENT, NPCTRIG
  • Callback neighbors: none proven in window
  • Referent-side neighbors: GRENADE, SCIENTIS, ROLL_NS, REB_COUP, MEDIKIT, K, CRUZTRIG, NPC_ONLY
  • Event families present: event-hub, npc-trigger

Runtime bridge:

  • Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
  • Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
  • Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
  • Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
  • Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
  • Interpretation: This is the strongest current descriptor-side bridge into the active event runtime lane: the neighborhood contains explicit event cores and matches the proven payload-chain plus link-matrix VM behavior.
attach COR_BOOT(referent,event,counter,item)
attach EVENT(...)  # active event-bearing neighbor
attach NPCTRIG(...)  # active event-bearing neighbor
near GRENADE(...)  # referent-side local context
near SCIENTIS(...)  # referent-side local context
near ROLL_NS(...)  # referent-side local context
near REB_COUP(...)  # referent-side local context
near MEDIKIT(...)  # referent-side local context
near K(...)  # referent-side local context
near CRUZTRIG(...)  # referent-side local context
near NPC_ONLY(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)

190: EVENT

Descriptor focus: hub EVENT(mva3b,referent,event,item,source,dest,door,counter,counter2,link,time,post1,post2,floor,flicMan)

Descriptor-side attachments:

  • Active event neighbors: COR_BOOT, NPCTRIG
  • Callback neighbors: none proven in window
  • Referent-side neighbors: SCIENTIS, ROLL_NS, REB_COUP, MEDIKIT, K, CRUZTRIG, NPC_ONLY, VMAIL
  • Event families present: boot-event-core, npc-trigger

Runtime bridge:

  • Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
  • Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
  • Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
  • Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
  • Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
  • Interpretation: This is the strongest current descriptor-side bridge into the active event runtime lane: the neighborhood contains explicit event cores and matches the proven payload-chain plus link-matrix VM behavior.
hub EVENT(mva3b,referent,event,item,source,dest,door,counter,counter2,link,time,post1,post2,floor,flicMan)
attach COR_BOOT(...)  # active event-bearing neighbor
attach NPCTRIG(...)  # active event-bearing neighbor
near SCIENTIS(...)  # referent-side local context
near ROLL_NS(...)  # referent-side local context
near REB_COUP(...)  # referent-side local context
near MEDIKIT(...)  # referent-side local context
near K(...)  # referent-side local context
near CRUZTRIG(...)  # referent-side local context
near NPC_ONLY(...)  # referent-side local context
near VMAIL(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)

191: NPCTRIG

Descriptor focus: attach NPCTRIG(referent,event,item,item2,typeNpc)

Descriptor-side attachments:

  • Active event neighbors: COR_BOOT, EVENT
  • Callback neighbors: none proven in window
  • Referent-side neighbors: ROLL_NS, REB_COUP, MEDIKIT, K, CRUZTRIG, NPC_ONLY, VMAIL, STORMTRO
  • Event families present: boot-event-core, event-hub

Runtime bridge:

  • Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
  • Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
  • Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
  • Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
  • Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
  • Interpretation: This is the strongest current descriptor-side bridge into the active event runtime lane: the neighborhood contains explicit event cores and matches the proven payload-chain plus link-matrix VM behavior.
attach NPCTRIG(referent,event,item,item2,typeNpc)
attach COR_BOOT(...)  # active event-bearing neighbor
attach EVENT(...)  # active event-bearing neighbor
near ROLL_NS(...)  # referent-side local context
near REB_COUP(...)  # referent-side local context
near MEDIKIT(...)  # referent-side local context
near K(...)  # referent-side local context
near CRUZTRIG(...)  # referent-side local context
near NPC_ONLY(...)  # referent-side local context
near VMAIL(...)  # referent-side local context
near STORMTRO(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)

Environmental event lane

229: FLAMEBOX

Descriptor focus: attach FLAMEBOX(referent,event,flame,flame2,direction,count,newType)

Descriptor-side attachments:

  • Active event neighbors: none proven in window
  • Callback neighbors: none proven in window
  • Referent-side neighbors: WVENTNS, WVENTEW, REBEL_TV, SDOOR_N, SDOOR_E, EBRIDGE2, MCRATE, COPY_EW, COPY_NS
  • Event families present: none

Runtime bridge:

  • Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
  • Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
  • Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
  • Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
  • Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
  • Interpretation: Environmental descriptors share the same active event field grammar, so they likely ride the same generic VM event lane even though no hazard-specific opcode split is proven yet.
attach FLAMEBOX(referent,event,flame,flame2,direction,count,newType)
near WVENTNS(...)  # referent-side local context
near WVENTEW(...)  # referent-side local context
near REBEL_TV(...)  # referent-side local context
near SDOOR_N(...)  # referent-side local context
near SDOOR_E(...)  # referent-side local context
near EBRIDGE2(...)  # referent-side local context
near MCRATE(...)  # referent-side local context
near COPY_EW(...)  # referent-side local context
near COPY_NS(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)

237: NOSTRIL

Descriptor focus: attach NOSTRIL(referent,event,fire,count,fire2)

Descriptor-side attachments:

  • Active event neighbors: none proven in window
  • Callback neighbors: none proven in window
  • Referent-side neighbors: COPY_EW, COPY_NS, FLAME1, REB_PAD, VARDESK, BLASER1, REB_BOOT, UPPLATE, KEYPADNS
  • Event families present: none

Runtime bridge:

  • Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
  • Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
  • Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
  • Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
  • Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
  • Interpretation: Environmental descriptors share the same active event field grammar, so they likely ride the same generic VM event lane even though no hazard-specific opcode split is proven yet.
attach NOSTRIL(referent,event,fire,count,fire2)
near COPY_EW(...)  # referent-side local context
near COPY_NS(...)  # referent-side local context
near FLAME1(...)  # referent-side local context
near REB_PAD(...)  # referent-side local context
near VARDESK(...)  # referent-side local context
near BLASER1(...)  # referent-side local context
near REB_BOOT(...)  # referent-side local context
near UPPLATE(...)  # referent-side local context
near KEYPADNS(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)

296: STEAMBOX

Descriptor focus: attach STEAMBOX(referent,event,steam,steam2,direction,count)

Descriptor-side attachments:

  • Active event neighbors: none proven in window
  • Callback neighbors: none proven in window
  • Referent-side neighbors: BOUNCBOX, HOVER1, STEAM1, FADE, PHIR, FLAME2, STEAM2, FLAMELP, BBOX, GBOX_NS
  • Event families present: none

Runtime bridge:

  • Runtime ops: APPEND_UNIQUE_INLINE, APPEND_UNIQUE_INDIRECT, REMOVE_MATCHING_INDIRECT, REMOVE_MATCHING_INLINE, MATERIALIZE_OR_FORWARD_VALUE, PREPEND_INLINE_PAYLOAD, BUILD_ENTITY_LINK_MATRIX, EMIT_OR_PUSHBACK_RESULT, FINALIZE_MIXED_VALUE_TO_OUTPTR
  • Mask pairs: 0x0001:0000, 0x0002:0001, 0x0004:0002, 0x0010:0004, 0x0020:0005, 0x0200:0009, 0x0400:000a, 0x0800:000b, 0x1000:000c, 0x2000:0015, 0x4000:000e, 0x8000:0007, 0x8000:000f
  • Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
  • Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
  • Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
  • Interpretation: Environmental descriptors share the same active event field grammar, so they likely ride the same generic VM event lane even though no hazard-specific opcode split is proven yet.
attach STEAMBOX(referent,event,steam,steam2,direction,count)
near BOUNCBOX(...)  # referent-side local context
near HOVER1(...)  # referent-side local context
near STEAM1(...)  # referent-side local context
near FADE(...)  # referent-side local context
near PHIR(...)  # referent-side local context
near FLAME2(...)  # referent-side local context
near STEAM2(...)  # referent-side local context
near FLAMELP(...)  # referent-side local context
near BBOX(...)  # referent-side local context
near GBOX_NS(...)  # referent-side local context

vm_effect:
    APPEND_UNIQUE_INLINE(...)
    APPEND_UNIQUE_INDIRECT(...)
    REMOVE_MATCHING_INDIRECT(...)
    REMOVE_MATCHING_INLINE(...)
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PREPEND_INLINE_PAYLOAD(...)
    BUILD_ENTITY_LINK_MATRIX(...)
    EMIT_OR_PUSHBACK_RESULT(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)

Callback trigger lane

269: SURCAMNS

Descriptor focus: callback SURCAMNS(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)

Descriptor-side attachments:

  • Active event neighbors: none proven in window
  • Callback neighbors: none proven in window
  • Referent-side neighbors: D_SOLD, D_VARG, D_COUR, D_SUSAN, D_THERM, BASEGUN, TIMER, SPECIAL, TRIGPAD, MONSTER
  • Event families present: none

Runtime bridge:

  • Runtime ops: MATERIALIZE_OR_FORWARD_VALUE, PUSH_FRAME_WORD_LITERAL, COMPARE_STREAM_DWORD_AND_PUSH_BOOL, FINALIZE_MIXED_VALUE_TO_OUTPTR
  • Mask pairs: no callback-specific mask pair proven; current ladder favors active event carriers
  • Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
  • Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
  • Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
  • Interpretation: Callback/eventTrigger descriptors are structurally distinct from the active event lane, so the runtime bridge is still generic slot-backed context flow rather than a callback-specific opcode family.
callback SURCAMNS(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)
near D_SOLD(...)  # referent-side local context
near D_VARG(...)  # referent-side local context
near D_COUR(...)  # referent-side local context
near D_SUSAN(...)  # referent-side local context
near D_THERM(...)  # referent-side local context
near BASEGUN(...)  # referent-side local context
near TIMER(...)  # referent-side local context
near SPECIAL(...)  # referent-side local context
near TRIGPAD(...)  # referent-side local context
near MONSTER(...)  # referent-side local context

vm_effect:
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PUSH_FRAME_WORD_LITERAL(...)
    COMPARE_STREAM_DWORD_AND_PUSH_BOOL(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)

284: SURCAMEW

Descriptor focus: callback SURCAMEW(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)

Descriptor-side attachments:

  • Active event neighbors: REE_BOOT, SFXTRIG
  • Callback neighbors: none proven in window
  • Referent-side neighbors: SLIDEFLR, JELYH2, HOFFMAN, D_HOFFMA, SKILLBOX, D_GURDSQ, VETRON, DEATHBOX
  • Event families present: boot-event-core, minimal-event-core

Runtime bridge:

  • Runtime ops: MATERIALIZE_OR_FORWARD_VALUE, PUSH_FRAME_WORD_LITERAL, COMPARE_STREAM_DWORD_AND_PUSH_BOOL, FINALIZE_MIXED_VALUE_TO_OUTPTR
  • Mask pairs: no callback-specific mask pair proven; current ladder favors active event carriers
  • Owner source: 000d:44df -> 000d:4c99 -> 000d:7000 -> (+0x10/+0x12) + 0x0d*slot + 4
  • Mirror write: entity_vm_context_create_from_slot_index writes the same source pair to 0x39ca[context_slot]
  • Selector status: 0x19/0x1a/0x1b proven in 000d:0988; 0x18 implied; upstream [BP-0x32] seed unresolved
  • Interpretation: Callback/eventTrigger descriptors are structurally distinct from the active event lane, so the runtime bridge is still generic slot-backed context flow rather than a callback-specific opcode family.
callback SURCAMEW(referent,textFile,monit,valueBox,passcode,link,code,screen,cameraEgg,trueRef,therma,eventTrigger,foundGun)
attach REE_BOOT(...)  # active event-bearing neighbor
attach SFXTRIG(...)  # active event-bearing neighbor
near SLIDEFLR(...)  # referent-side local context
near JELYH2(...)  # referent-side local context
near HOFFMAN(...)  # referent-side local context
near D_HOFFMA(...)  # referent-side local context
near SKILLBOX(...)  # referent-side local context
near D_GURDSQ(...)  # referent-side local context
near VETRON(...)  # referent-side local context
near DEATHBOX(...)  # referent-side local context

vm_effect:
    MATERIALIZE_OR_FORWARD_VALUE(...)
    PUSH_FRAME_WORD_LITERAL(...)
    COMPARE_STREAM_DWORD_AND_PUSH_BOOL(...)
    FINALIZE_MIXED_VALUE_TO_OUTPTR(...)