"""DIMENSION 4, pass 13: the authority question. Enumerate EVERY qword write to an offset +0x10 anywhere in CardsDLL, so the claim "the duplicate field is only ever filled from the wire" is not an absence claim from a narrow search. Matcher: any line assigning through a longlong/undefined8 pointer at +0x10, in any of the syntactic forms the decompiler emits: *(longlong *)(X + 0x10) = ... *(undefined8 *)(X + 0x10) = ... *(ulonglong *)(X + 0x10) = ... and the indexed forms (X + 0x10 + i*0x18). CONTROL: the four known writers MUST appear: 0x180162880, 0x18013bd40, 0x1801293d0, 0x18013e7f0. """ import re, traceback, time OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/store/dup13_out.txt" W = re.compile(r"\*\((?:longlong|undefined8|ulonglong|code \*)\s*\*\)\([^;\n]{0,90}\+ 0x10\)\s*=") CONTROLS = [0x180162880, 0x18013BD40, 0x1801293D0, 0x18013E7F0] try: fh = open(OUT, "w") t0 = time.time() funcs = [] it = fm.getFunctions(True) while it.hasNext(): funcs.append(it.next()) fh.write("functions: %d\n" % len(funcs)) hits = {} for f in funcs: ent = int(f.getEntryPoint().getOffset()) try: s = dec(ent, timeout=25) except Exception: continue if s.startswith("// decompile"): continue lines = [l.strip() for l in s.split("\n") if W.search(l)] if lines: hits[ent] = (f.getName(), lines) fh.write("swept in %.0fs, %d functions contain a qword write at +0x10\n" % (time.time() - t0, len(hits))) fh.write("\n=== CONTROL ===\n") for c in CONTROLS: fh.write(" %#x present=%s\n" % (c, c in hits)) fh.write("\n=== all writers ===\n") for ent in sorted(hits): nm, lines = hits[ent] fh.write(" %#x %s\n" % (ent, nm)) for l in lines[:6]: fh.write(" %s\n" % l[:150]) fh.close() print("WROTE", OUT) except Exception: traceback.print_exc()