MP: authentic update-record deadbands streamed from the model record (task #3)
Binary ctor @0x4a26a7-0x4a26ef: mech+0x768/76c/770 <- raw record words 0x26/0x27/0x28 (UpdatePositionDiffrence / UpdateTurnVelocityDiffrence / UpdateTurnDegreeDiffrence x pi/180 [const @0x4a2d44]). Read at RAW record offsets -- the Mech__ModelResource struct is layout-skewed (field98 gave -1.5 where the record holds 0.3; audit filed as task #4, also explains the old forwardCycleRate "floor 25" hack). Sender triggers now use the authored constants: pos-deadband type 0, quat-Y delta + yaw-rate delta + stopped-turn edge type 4 (binary @0x4aad35/@0x4aac2b/@0x4aac6c). Verified 2-node: madcat streams 0.3/0.045/3deg, type-4 spam gone, walking replicant clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
co-authored by
Claude Fable 5
parent
e8b9f71025
commit
a652ddcdbc
@@ -0,0 +1,39 @@
|
||||
import capstone, struct, sys
|
||||
sys.stdout.reconfigure(encoding="utf-8", errors="replace")
|
||||
data = open("../content/BTL4OPT.EXE","rb").read()
|
||||
# established mapping (from dis_4b2980.py usage): file offset = VA - 0x400000 - 0xc00 adjustments;
|
||||
# use the section table: .text typically RVA 0x1000, raw 0x400/0x600. Recover from PE header.
|
||||
pe = struct.unpack_from("<I", data, 0x3c)[0]
|
||||
nsec = struct.unpack_from("<H", data, pe+6)[0]
|
||||
opt = pe+24; szopt = struct.unpack_from("<H", data, pe+20)[0]
|
||||
sec0 = opt+szopt
|
||||
imgbase = struct.unpack_from("<I", data, opt+28)[0]
|
||||
secs=[]
|
||||
for i in range(nsec):
|
||||
off=sec0+i*40
|
||||
name=data[off:off+8].rstrip(b"\0").decode()
|
||||
vsz,va,rsz,ra=struct.unpack_from("<IIII",data,off+8)
|
||||
secs.append((name,va,rsz,ra))
|
||||
text=[s for s in secs if s[0]=="CODE"][0]
|
||||
va0=imgbase+text[1]; ra0=text[3]; n=text[2]
|
||||
md=capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32)
|
||||
md.detail=True
|
||||
code=data[ra0:ra0+n]
|
||||
hits=[]
|
||||
# quick byte-pattern prescan for disp32 0x768/0x76c/0x770 little-endian
|
||||
import re
|
||||
for target,label in [(0x768,"0x768"),(0x76c,"0x76c"),(0x770,"0x770")]:
|
||||
pat=struct.pack("<I",target)
|
||||
for m in re.finditer(re.escape(pat),code):
|
||||
start=max(0,m.start()-8)
|
||||
for ins in md.disasm(code[start:m.start()+12], va0+start):
|
||||
if ins.op_str and label in ins.op_str and ("ptr [" in ins.op_str):
|
||||
# writes: mov [reg+disp], src OR fstp
|
||||
if ins.mnemonic in ("mov","fstp","fst") and ins.op_str.index("[")<ins.op_str.index(","):
|
||||
hits.append((ins.address,f"{ins.mnemonic} {ins.op_str}"))
|
||||
elif ins.mnemonic in ("fld","fcomp","fcom","mov") :
|
||||
pass
|
||||
seen=set()
|
||||
for a,t in sorted(hits):
|
||||
if (a,t) not in seen:
|
||||
seen.add((a,t)); print(f"0x{a:x}: {t}")
|
||||
Reference in New Issue
Block a user