diff options
Diffstat (limited to 'docs/tomes/05-render.md')
| -rw-r--r-- | docs/tomes/05-render.md | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/docs/tomes/05-render.md b/docs/tomes/05-render.md index 7019c24..f4364f4 100644 --- a/docs/tomes/05-render.md +++ b/docs/tomes/05-render.md @@ -1291,6 +1291,19 @@ pointer are therefore not yet proven to have the same adjustment/layout; those offsets must remain unassigned until the selector/interface relationship is recovered. +The unattended demo also proves that this global is dynamic. Across 25 seconds +of read-only sampling it held three distinct heap pointers; all began with the +same relocated outer vtables `0x025765B4` and `0x02576558`. Two selected +objects exposed synchronized translation triples in the paired raw blocks at +offsets `+0x2C/+0x3C/+0x4C` and `+0x6C/+0x7C/+0x8C`, with world-like values +such as `(491.562, 761.551, 7.361)`. A third object used the same vtable but +reported normalized-looking values near `(0.098, 0.018, 0.856)` and did not +match the paired block. The observed pointer transitions are consistent with +the unattended camera changes, but the sample carries no mode label and does +not prove first- versus third-person identity. It does prove that the static +direct-xref initializer is not the sole runtime writer of the global; indirect +or unanalyzed write paths remain to be recovered. + A fresh no-input launch of the canonical `iron_3d.exe` did create a responsive window titled `Parkan. Железная Стратегия`. A read-only probe then requested `PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` and attempted to read the known |