arcattackandClaude Opus 5
f3bdb3b85a
Both classes' Receiver::MessageHandlerSet were default-constructed blackholes (input-path audit systemic cause #1): entryCount 0, no parent chain, Find() returns NullHandler for every id, Receive drops silently. The new unhandled- message trace printed it on the first press: [btntest] PRESS 0x14 at poll 400 [msg] UNHANDLED: Searchlight has no handler for message id 3 Each class now has a GetMessageHandlers() function-local static chained to PowerWatcher's (which name-resolves through HeatWatcher/MechSubsystem to Receiver's empty ROOT set, so id 3 does NOT collide with HeatSink's ToggleCooling), plus a correctly-typed forwarder -- Receiver::Handler is void(const Message*) while the decomp shape is Logical(Message&), so a cast would be UB that merely happens to work on x86 __thiscall. DefaultData re-pointed off the dead empty sets. MessageArg now reads the NAMED ReceiverDataMessageOf<int>::dataContents with a static_assert locking it to the binary's message+0xC (was a raw offset read -- databinding rule). ROOT CAUSE of a long-standing misattribution: @004b860c is **ThermalSight's** ToggleLamp (table @0x51120C), NOT Searchlight's. The two TUs emit parallel shared-data blocks with identical stride (msg entry, +0x5C attrs, +0x84 Performance triple); what pins each entry to its TU is that "ToggleLamp" is NOT pooled across them -- two copies exist, each emitted immediately before its own class-name string ("Searchlight"@0x51144B, "ThermalSight"@0x511475). [T1: reference/decomp/section_dump.txt:69661-69711] Searchlight's own handler is @004b838c, which sits in a Ghidra EXPORT GAP (#60). RECOVERED by raw disassembly of content/BTL4OPT.EXE (scratchpad/dis838c.py, the EjectAmmo technique) -- and it corrected two things I had inferred wrong: * NO ControlsAllowLights/+0x25C novice gate. Searchlight tests the press alone; that lock is ThermalSight-only. A NOVICE pilot CAN work the lamp. * `or word ptr [this+0x18],1` sits AT the jle target -> the graphics-dirty bit (updateModel == ForceUpdate(), per #59) is raised UNCONDITIONALLY. Consequence: the "ORIGINAL 1995 LATENT BUG -- the searchlight can never light" claim is RETRACTED. It compared Searchlight's Performance (@004b841c, reads requestedOn@0x1E0) against ThermalSight's toggle (0x1DC) -- two different classes -- and so invented a missing 0x1DC->0x1E0 bridge. Every sibling toggles the field its own Performance reads. The searchlight DID light in the arcade, the searchlight->fog swap was NOT inert there, and building PullFogRenderable is FAITHFUL rather than a designer-intent deviation (the 2026-07-13 "left as-is" decision is void; the sim needs no repair). Verified live, real click seam (BT_BTNTEST): 0x14 -> [light] requested ON -> reported lightState 0 -> 1 (lamp lights) 0x12 -> [light] thermal sight requested ON -> thermalActive 0 -> 1 UNHANDLED lines for both classes gone; 40 LNK2019 unchanged (the pre-existing CreateStreamedSubsystem + Entity__SharedData::DefaultData families only). Swept the misattribution out of searchlight.cpp/.hpp, thermalsight.cpp/.hpp, hud.cpp:282 (it had claimed @00511180/@004b838c as HUD's), btplayer.cpp's +0x25C consumer list, context/{decomp-reference,subsystems,rendering,open-questions, pod-hardware,experience-levels}.md, docs/{GLASS_COCKPIT,INPUT_PATH_AUDIT}.md. checkctx.py CLEAN. Still open (documented, not fixed): ThermalSight has no visible IR effect (ToggleGlobalThermalVision is a marked no-op, pvision unported, IsLocallyViewed returns False); ThermalSight publishes "LightState"->0x1D8 where the binary has "LightOn"->0x1D8 and "LightState"->0x1E0; Searchlight's commandedOn@0x1DC has no identified role and measured 21 live, hinting our SubsystemResource +0x28 differs from the binary's. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
51 lines
1.7 KiB
Python
51 lines
1.7 KiB
Python
"""Raw-disassemble Searchlight::ToggleLamp @004b838c -- a Ghidra export gap (#60).
|
|
|
|
The exported functions_index.tsv jumps straight to 4b83b8, so this body was never
|
|
in the pseudocode. It is the handler bound by Searchlight's message table
|
|
@0051117c {3, "ToggleLamp"@00511440, @004b838c}. Same technique that recovered
|
|
EjectAmmo @004bb9b8 (see context/decomp-reference.md).
|
|
|
|
Also dumps ThermalSight's @004b860c for a side-by-side, since that one IS exported
|
|
and is the structural sibling the reconstruction was inferred from.
|
|
"""
|
|
import struct
|
|
from capstone import *
|
|
|
|
PATH = r"C:\git\bt411\content\BTL4OPT.EXE"
|
|
data = open(PATH, "rb").read()
|
|
e_lfanew = struct.unpack_from("<I", data, 0x3C)[0]
|
|
coff = e_lfanew + 4
|
|
num_sec = struct.unpack_from("<H", data, coff + 2)[0]
|
|
opt_size = struct.unpack_from("<H", data, coff + 16)[0]
|
|
opt = coff + 20
|
|
image_base = struct.unpack_from("<I", data, opt + 28)[0]
|
|
sec_tbl = opt + opt_size
|
|
secs = []
|
|
for i in range(num_sec):
|
|
off = sec_tbl + i * 40
|
|
vsize, va, rawsize, rawptr = struct.unpack_from("<IIII", data, off + 8)
|
|
secs.append((va, vsize, rawptr, rawsize))
|
|
|
|
|
|
def va_to_off(va):
|
|
rva = va - image_base
|
|
for sva, vsize, rawptr, rawsize in secs:
|
|
if sva <= rva < sva + max(vsize, rawsize):
|
|
return rawptr + (rva - sva)
|
|
return None
|
|
|
|
|
|
md = Cs(CS_ARCH_X86, CS_MODE_32)
|
|
|
|
for name, va, length in (
|
|
("Searchlight::ToggleLamp @004b838c (EXPORT GAP -- ground truth)", 0x004b838c, 0x2c),
|
|
("ThermalSight::ToggleLamp @004b860c (exported sibling)", 0x004b860c, 0x3c),
|
|
):
|
|
off = va_to_off(va)
|
|
print("=" * 78)
|
|
print(name)
|
|
print("=" * 78)
|
|
for ins in md.disasm(data[off:off + length], va):
|
|
print(" %08x %-22s %s %s" % (ins.address, ins.bytes.hex(), ins.mnemonic, ins.op_str))
|
|
print()
|