Files

T

Joe DiPrimaandClaude Fable 5 f44be87ab2 #60 PART 2: the RE-EXPORT -- dark code 90KB -> 41KB, coverage 87.3% -> 93.5%

Installed JDK 21 + Ghidra 12.1.2 (no admin, %LOCALAPPDATA%\bt411-tools beside
DXSDK/cmake; runner uses 8.3 SHORT paths because Ghidra's .bat expands
%JAVA_HOME% unquoted and the profile has a space).

New tooling: reference/ghidra_scripts/ExportGaps.java -- ExportAll's exact
output contract PLUS a gap-fill pass (force disassembly + createFunction at
E8 call targets outside functions, data->code pointers at a plausible
prologue, and the census's discovered starts; iterated to a fixpoint,
logged to gapfill_report.tsv).  tools/ghidra_reexport.sh (headless runner,
'reprocess' mode) and tools/gapdiff.py (score two censused exports);
gapcensus.py now censuses any export dir.

Results: 6267 -> 6472 functions (+205 created in 2 rounds: 195 census
starts, 6 call targets, 4 data pointers; 56.1KB newly covered), ZERO
decompile failures.  Dark real code 90.4 -> 40.8 KB (54.8% recovered);
game-side dark 53.1 -> 21.1 KB; regions 428 -> 321.  EVERY historically
dark function now has pseudocode -- including @0x4c05c4 VehicleDead, the
absence that opened this issue.

VALIDATION: the new pseudocode confirms this week's hand reconstruction of
the crouch field-for-field (mapPosture/duckState/squatCapable/myomerEff/
novice gate/SetLegAnimation/ForceUpdate/stability alarm) -- and exposed one
branch the raw pass missed: AIRBORNE AUTO-RISE (mode 3|4 && legState 1 ->
forced squ), now implemented in mech4.cpp and re-benched un-regressed.

PROMOTION: the re-export is canonical reference/decomp/; the previous export
is preserved at reference/decomp/archive_2025export/ so old
`part_0NN.c:LINE` citations still resolve (addresses are stable across both;
line/shard membership is NOT -- cite @ADDR).

New lead recorded: @0x4c0904 is the MASTER BTPlayer Performance (team
resolution, EndMission console post, score heartbeat) -- our @0x4c083c
PlayerSimulation attribution needs a re-check.  KB: source-completeness,
gotcha #20 (the rule is cheap now -- look it up), CLAUDE.md router/layout.
Log: phases/phase-04-gap-census.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-06 11:11:26 -05:00

5.4 KiB

Raw Blame History

GAP CENSUS -- the export dark-region inventory (#60)

Generated by tools/gapcensus.py (deterministic; re-run after any re-export). Machine-readable twin: gap_census.tsv.

Headline

Metric	Value
Code section (.text)	`0x401000`-`0x4e0000` (892 KB)
Indexed functions (functions_index.tsv)	6267, covering 778 KB (87.3%)
RAW DARK (no indexed function at all)	428 regions >= 16B, 105 KB (11.9%) -- 90 KB REAL CODE after padding
Exported pseudocode functions (part_*.c)	6267
Indexed but NOT exported (Ghidra knew it; no pseudocode)	0 functions, 0 KB
Function starts discovered inside dark regions	332 (call-graph + data-pointer evidence)

Reading the tables: visited = the address is already cited somewhere in game/ context/ docs/ (a prior dig reached it); everything else is UNCHARTED. tu = nearest file-tagged export neighbors (before|after when they disagree).

Dark code by suspected TU family

Family	Regions	Real code bytes
munga/ (engine core -- source in repo)	150	28540
bt/ (GAME -- reconstruction target)	87	23954
BOUNDARY/mixed	59	15581
bt_l4/ (GAME video/glue -- reconstruction target)	80	14916
munga_l4/ (engine L4 -- source in repo)	52	9529

Top 40 dark regions by REAL CODE bytes (padding excluded)

#	Range	Code bytes	Fn starts	Call-ins	Visited	Suspected TU
1	`0x412e41`-`0x4146dc`	5936	6	0	-	munga/boxsolid.cpp
2	`0x4a9b5a`-`0x4ab188`	4957	1	0	69: `4a9b5a` `4a9b5c` `4a9b6c` `4a9bff`...	bt/mech2.cpp
3	`0x486467`-`0x487788`	4265	0	0	-	munga_l4/l4splr.cpp
4	`0x49ffc8`-`0x4a1232`	4116	5	2	89: `49ffc8` `49ffcc` `49ffde` `49ffff`...	bt/btmssn.cpp
5	`0x4cdce5`-`0x4ceecc`	3831	1	0	18: `4cdcf0` `4cdd75` `4cdd9d` `4cddc1`...	bt_l4/btl4vid.cpp
6	`0x4a68ce`-`0x4a71f4`	1822	2	0	44: `4a6928` `4a6989` `4a69aa` `4a69d6`...	bt/mech2.cpp
7	`0x4596ab`-`0x459eb8`	1795	0	0	1: `4599ae`	munga_l4/l4vidrnd.cpp
8	`0x480a2a`-`0x48116d`	1521	0	0	-	munga_l4/l4splr.cpp
9	`0x42f3fe`-`0x42f9bc`	1341	1	0	-	munga/player.cpp
10	`0x40c82a`-`0x40cdb4`	1322	0	0	-	munga/scalar.cpp
11	`0x464bf6`-`0x4651ac`	1312	2	0	-	munga_l4/l4audio.cpp
12	`0x40b68c`-`0x40bbe8`	1293	0	0	-	munga/scalar.cpp
13	`0x481f77`-`0x48255c`	1267	0	0	-	munga_l4/l4splr.cpp
14	`0x47ae1b`-`0x47b2ec`	1060	0	0	-	munga_l4/l4ctrl.cpp
15	`0x4dd80a`-`0x4ddc7c`	1030	0	0	-	bt_l4/btl4app.cpp
16	`0x405b1e`-`0x405f44`	972	0	0	-	munga/filestrm.hpp
17	`0x427fd0`-`0x4283b8`	931	0	0	-	munga/network.cpp
18	`0x4cba73`-`0x4cbea0`	904	1	0	1: `4cbaf0`	bt_l4/btl4gaug.cpp
19	`0x4be3cf`-`0x4be7c4`	897	1	0	1: `4be474`	bt/mechweap.hpp
20	`0x4b297b`-`0x4b2d8c`	894	1	1	30: `4b2980` `4b298c` `4b299e` `4b29bd`...	bt/powersub.cpp
21	`0x4da08f`-`0x4da44c`	866	4	0	-	bt_l4/btl4app.cpp
22	`0x4147f9`-`0x414b60`	789	4	0	-	munga/boxsolid.cpp
23	`0x4d41ae`-`0x4d45b0`	765	0	0	-	bt_l4/btl4app.cpp
24	`0x412940`-`0x412c78`	760	4	0	-	munga/boxsolid.cpp
25	`0x4af691`-`0x4af9cf`	707	0	0	-	bt/heat.cpp
26	`0x4bc0fd`-`0x4bc3fc`	693	1	0	6: `4bc100` `4bc104` `4bc136` `4bc194`...	bt/mechweap.hpp
27	`0x4829ab`-`0x482c9f`	687	0	0	-	munga_l4/l4splr.cpp
28	`0x4bdd7b`-`0x4be078`	673	4	0	-	bt/mechweap.hpp
29	`0x4105ff`-`0x4108b4`	635	4	0	-	munga/boxsolid.cpp
30	`0x487a27`-`0x487ca0`	632	0	0	-	munga_l4/l4splr.cpp
31	`0x4221b9`-`0x42249c`	631	2	0	-	munga/network.cpp
32	`0x4c08fc`-`0x4c0bc8`	613	1	0	-	bt/btplayer.cpp
33	`0x4bbcfd`-`0x4bbfcc`	607	2	0	41: `4bbd04` `4bbd12` `4bbd1b` `4bbd28`...	bt/mechweap.hpp
34	`0x4c05be`-`0x4c083c`	552	1	0	22: `4c05c0` `4c05c4` `4c05df` `4c0611`...	bt/btplayer.cpp
35	`0x4bfca1`-`0x4bfee0`	535	1	0	1: `4bfcac`	bt/mechweap.hpp
36	`0x483b9b`-`0x483df0`	520	0	0	-	munga_l4/l4splr.cpp
37	`0x4b8837`-`0x4b8a8c`	509	3	0	6: `4b8837` `4b8a48` `4b8a50` `4b8a5b`...	bt/powersub.cpp
38	`0x4c11b3`-`0x4c1408`	499	4	0	3: `4c11b3` `4c1230` `4c13d4`	bt/btplayer.cpp
39	`0x47b8e2`-`0x47bb20`	488	1	0	-	munga_l4/l4app.cpp
40	`0x4d95b6`-`0x4d9800`	487	0	0	-	bt_l4/btl4app.cpp

Indexed-but-unexported functions (first 60 by address)

These have index rows (address + size) but no pseudocode in all/part_*.c -- decompile them individually (raw disasm or a targeted re-export) when a dig arrives.

Addr	Size	Index name	Cited in repo

5.4 KiB Raw Blame History