Files

T

Joe DiPrimaandClaude Fable 5 e69c0d7aa8 #60 GAP CENSUS: the export dark-region inventory (tool + report + KB)

tools/gapcensus.py (deterministic): index-vs-.text interval math, export
cross-check, function-start discovery inside dark regions (E8 call targets +
data-section code pointers), pad exclusion, TU attribution, repo-citation
flags. Output: reference/decomp/GAP_CENSUS.md + gap_census.tsv.

Headline: .text 892KB, index covers 87.3%; 428 dark regions = 90KB REAL code
(indexed-but-unexported = 0 -- the gap class is purely 'never indexed').
Game-side dark ~54KB: 66 regions visited by past digs, 159 NEVER TOUCHED.
Validation: all six historically-bitten dark addresses (VehicleDead,
ToggleLamp, death tail, master-perf, myomer integrator, duck consumer) land
inside census regions; the two most-cited regions are the two that produced
the most reconstructions.

Top uncharted leads (spot-checked real code): the ~9KB l4splr|btmssn cluster
(dispatch-table state machine -- likely BTMission's unexported heart); the
613B btplayer hole before the ctor (mission-review id-0x18 sender suspect);
btl4app tails; heat|mechmppr + mechweap|btplayer boundaries. Full log:
phases/phase-04-gap-census.md. Re-export half deferred (no local Ghidra;
scripts ready). KB: source-completeness census section + CLAUDE.md lookup
row + decomp-reference tools entry; consult the census BEFORE any 'absent
from the export' claim (gotcha #20).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-06 10:34:02 -05:00

5.4 KiB

Raw Blame History

GAP CENSUS -- the export dark-region inventory (#60)

Generated by tools/gapcensus.py (deterministic; re-run after any re-export). Machine-readable twin: gap_census.tsv.

Headline

Metric	Value
Code section (.text)	`0x401000`-`0x4e0000` (892 KB)
Indexed functions (functions_index.tsv)	6267, covering 778 KB (87.3%)
RAW DARK (no indexed function at all)	428 regions >= 16B, 105 KB (11.9%) -- 90 KB REAL CODE after padding
Exported pseudocode functions (part_*.c)	6267
Indexed but NOT exported (Ghidra knew it; no pseudocode)	0 functions, 0 KB
Function starts discovered inside dark regions	332 (call-graph + data-pointer evidence)

Reading the tables: visited = the address is already cited somewhere in game/ context/ docs/ (a prior dig reached it); everything else is UNCHARTED. tu = nearest file-tagged export neighbors (before|after when they disagree).

Dark code by suspected TU family

Family	Regions	Real code bytes
munga/ (engine core -- source in repo)	150	28540
bt/ (GAME -- reconstruction target)	87	23954
BOUNDARY/mixed	59	15581
bt_l4/ (GAME video/glue -- reconstruction target)	80	14916
munga_l4/ (engine L4 -- source in repo)	52	9529

Top 40 dark regions by REAL CODE bytes (padding excluded)

#	Range	Code bytes	Fn starts	Call-ins	Visited	Suspected TU
1	`0x412e41`-`0x4146dc`	5936	6	0	-	munga/boxsolid.cpp
2	`0x4a9b5a`-`0x4ab188`	4957	1	0	69: `4a9b5a` `4a9b5c` `4a9b6c` `4a9bff`...	bt/mech2.cpp
3	`0x486467`-`0x487788`	4265	0	0	-	munga_l4/l4splr.cpp
4	`0x49ffc8`-`0x4a1232`	4116	5	2	89: `49ffc8` `49ffcc` `49ffde` `49ffff`...	bt/btmssn.cpp
5	`0x4cdce5`-`0x4ceecc`	3831	1	0	18: `4cdcf0` `4cdd75` `4cdd9d` `4cddc1`...	bt_l4/btl4vid.cpp
6	`0x4a68ce`-`0x4a71f4`	1822	2	0	44: `4a6928` `4a6989` `4a69aa` `4a69d6`...	bt/mech2.cpp
7	`0x4596ab`-`0x459eb8`	1795	0	0	1: `4599ae`	munga_l4/l4vidrnd.cpp
8	`0x480a2a`-`0x48116d`	1521	0	0	-	munga_l4/l4splr.cpp
9	`0x42f3fe`-`0x42f9bc`	1341	1	0	-	munga/player.cpp
10	`0x40c82a`-`0x40cdb4`	1322	0	0	-	munga/scalar.cpp
11	`0x464bf6`-`0x4651ac`	1312	2	0	-	munga_l4/l4audio.cpp
12	`0x40b68c`-`0x40bbe8`	1293	0	0	-	munga/scalar.cpp
13	`0x481f77`-`0x48255c`	1267	0	0	-	munga_l4/l4splr.cpp
14	`0x47ae1b`-`0x47b2ec`	1060	0	0	-	munga_l4/l4ctrl.cpp
15	`0x4dd80a`-`0x4ddc7c`	1030	0	0	-	bt_l4/btl4app.cpp
16	`0x405b1e`-`0x405f44`	972	0	0	-	munga/filestrm.hpp
17	`0x427fd0`-`0x4283b8`	931	0	0	-	munga/network.cpp
18	`0x4cba73`-`0x4cbea0`	904	1	0	1: `4cbaf0`	bt_l4/btl4gaug.cpp
19	`0x4be3cf`-`0x4be7c4`	897	1	0	1: `4be474`	bt/mechweap.hpp
20	`0x4b297b`-`0x4b2d8c`	894	1	1	30: `4b2980` `4b298c` `4b299e` `4b29bd`...	bt/powersub.cpp
21	`0x4da08f`-`0x4da44c`	866	4	0	-	bt_l4/btl4app.cpp
22	`0x4147f9`-`0x414b60`	789	4	0	-	munga/boxsolid.cpp
23	`0x4d41ae`-`0x4d45b0`	765	0	0	-	bt_l4/btl4app.cpp
24	`0x412940`-`0x412c78`	760	4	0	-	munga/boxsolid.cpp
25	`0x4af691`-`0x4af9cf`	707	0	0	-	bt/heat.cpp
26	`0x4bc0fd`-`0x4bc3fc`	693	1	0	6: `4bc100` `4bc104` `4bc136` `4bc194`...	bt/mechweap.hpp
27	`0x4829ab`-`0x482c9f`	687	0	0	-	munga_l4/l4splr.cpp
28	`0x4bdd7b`-`0x4be078`	673	4	0	-	bt/mechweap.hpp
29	`0x4105ff`-`0x4108b4`	635	4	0	-	munga/boxsolid.cpp
30	`0x487a27`-`0x487ca0`	632	0	0	-	munga_l4/l4splr.cpp
31	`0x4221b9`-`0x42249c`	631	2	0	-	munga/network.cpp
32	`0x4c08fc`-`0x4c0bc8`	613	1	0	-	bt/btplayer.cpp
33	`0x4bbcfd`-`0x4bbfcc`	607	2	0	41: `4bbd04` `4bbd12` `4bbd1b` `4bbd28`...	bt/mechweap.hpp
34	`0x4c05be`-`0x4c083c`	552	1	0	22: `4c05c0` `4c05c4` `4c05df` `4c0611`...	bt/btplayer.cpp
35	`0x4bfca1`-`0x4bfee0`	535	1	0	1: `4bfcac`	bt/mechweap.hpp
36	`0x483b9b`-`0x483df0`	520	0	0	-	munga_l4/l4splr.cpp
37	`0x4b8837`-`0x4b8a8c`	509	3	0	6: `4b8837` `4b8a48` `4b8a50` `4b8a5b`...	bt/powersub.cpp
38	`0x4c11b3`-`0x4c1408`	499	4	0	3: `4c11b3` `4c1230` `4c13d4`	bt/btplayer.cpp
39	`0x47b8e2`-`0x47bb20`	488	1	0	-	munga_l4/l4app.cpp
40	`0x4d95b6`-`0x4d9800`	487	0	0	-	bt_l4/btl4app.cpp

Indexed-but-unexported functions (first 60 by address)

These have index rows (address + size) but no pseudocode in all/part_*.c -- decompile them individually (raw disasm or a targeted re-export) when a dig arrives.

Addr	Size	Index name	Cited in repo

5.4 KiB Raw Blame History