docs(evidence): confirm live camera global relocation

This commit is contained in:
2026-07-18 13:49:15 +04:00
parent 4ea4be8cad
commit 1bd50662b1
2 changed files with 27 additions and 5 deletions
+17 -5
View File
@@ -1261,13 +1261,13 @@ matrix convention; they must not be treated as a usable renderer ABI yet.
### Buffering-camera projection path from static Terrain analysis
A further headless-IDA review of the same GOG `Terrain.dll` identifies a
concrete `CBufferingCamera` implementation path without requiring a live game
process. Its method at RVA `0x4D740` copies exactly 64 bytes (16 dwords) into
the component at offset `+0x10`. Its frame-preparation method at RVA `0x4D9C0`
queries a viewport rectangle through a virtual method at `+0x3C`, derives its
`CBufferingCamera`-related implementation path without requiring a live game
process. The procedure at RVA `0x4D740` copies exactly 64 bytes (16 dwords)
into its receiver at offset `+0x10`. The frame-preparation procedure at RVA
`0x4D9C0` queries a viewport rectangle through a virtual method at `+0x3C`, derives its
width, height, centre and an aspect ratio from that rectangle, and obtains
projection data through the camera interface. Projection type `0` uses a
component float at offset `+0x234` as an angle passed to `tan(angle / 2)`;
receiver float at offset `+0x234` as an angle passed to `tan(angle / 2)`;
projection type `2` obtains a five-float block through a virtual method at
`+0x70`. Any other non-zero type raises `Not supported projection type`.
@@ -1279,6 +1279,18 @@ string-labelled `ICamera::SetTransformMatrix` (RVA `0x4F830`) and
`ICamera::GetTransformMatrix` (RVA `0x4F850`) are both obsolete-call stubs, so
they are not a usable method ABI.
Live read-only evidence now confirms the relocation-aware global contract. In
one elevated GOG run, `Terrain.dll` loaded at `0x02510000`; its global at
`base + 0x7355C` held non-null `0x0B37DF08`, whose first dword was
`0x025765B4` — exactly the relocated `off_100665B4` vtable from the
`LoadCamera` construction path. This proves the global is a live camera object
with that outer vtable. It also corrects an overreach: raw reads at global
offsets `+0x10` and `+0x234` did not yield a finite 4×4 matrix and a projection
angle in this sample. The static procedures' receiver and the exported global
pointer are therefore not yet proven to have the same adjustment/layout; those
offsets must remain unassigned until the selector/interface relationship is
recovered.
A fresh no-input launch of the canonical `iron_3d.exe` did create a responsive
window titled `Parkan. Железная Стратегия`. A read-only probe then requested
`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` and attempted to read the known