jan/rrt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Probe infrastructure payload 0x55f1 triplets

Browse source
This commit is contained in:
Jan Petykiewicz 2026-04-18 13:50:07 -07:00
commit ae67719ac6
3 changed files with 104 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/rehost-queue.md
View file

@ -65,7 +65,13 @@ Working rule:
`(payload pointer, previous live id, next live id)`, so the next infrastructure question is only
how those payload streams align with the embedded `0x55f1` name-pair groups and compact-prefix
regimes, and which tagged values inside each payload stream become the child count, optional
primary-child ordinal, and per-child callback sequence that `0x0048dcf0` consumes.
primary-child ordinal, and per-child callback sequence that `0x0048dcf0` consumes. Direct
disassembly now also shows the shared child payload callback `0x00455fc0` opening
`0x55f1 -> 0x55f2 -> 0x55f3`, parsing three `0x55f1` strings through `0x00531380`, seeding the
child through `0x00455b70`, and then dispatching slot `+0x48`; the widened save-side probe
currently sees `0` third `0x55f1` strings on grounded `q.gms`, so the next pass should ask
whether that third string is genuinely absent on ordinary saves or stored under different
framing than the current embedded-row scan.
- The child loader identity is closed now too: local `.rdata` at `0x005cfd00` proves the
`Infrastructure` child vtable uses the shared tagged callback strip directly, with
`+0x40 = 0x00455fc0`, `+0x48 = 0x00455870`, and `+0x4c = 0x00455930`. So the remaining