docs(evidence): recover camera transform adjustment
This commit is contained in:
@@ -1304,6 +1304,20 @@ not prove first- versus third-person identity. It does prove that the static
|
|||||||
direct-xref initializer is not the sole runtime writer of the global; indirect
|
direct-xref initializer is not the sole runtime writer of the global; indirect
|
||||||
or unanalyzed write paths remain to be recovered.
|
or unanalyzed write paths remain to be recovered.
|
||||||
|
|
||||||
|
The shared outer vtable now recovers the exact transform adjustment for the
|
||||||
|
world-like samples. Its slot `+0x54` asks the subobject at `outer + 4` for
|
||||||
|
selector `0` through that subobject's slot `+0x20`, then copies three dwords
|
||||||
|
from returned offsets `+0x0C`, `+0x1C`, and `+0x2C`. In the live world-like
|
||||||
|
object, the selector field at `outer + 0x10` was `0xFFFFFFFF`; the recovered
|
||||||
|
selector implementation therefore returns `outer + 0x20`. The copied triple is
|
||||||
|
exactly `outer + 0x2C/+0x3C/+0x4C`, proving its association with the active
|
||||||
|
affine transform rather than merely a sampled correlation. The paired block
|
||||||
|
starts at `outer + 0x60` under selector `2`. Another outer slot at `+0x70`
|
||||||
|
obtains that selector-2 transform and applies `atan2` to its axis values, so it
|
||||||
|
is a proven orientation-angle path. Field names, angle order and matrix
|
||||||
|
handedness remain unassigned, but a backend-neutral camera pose may now retain
|
||||||
|
the raw affine transform and the exact translation triple without guessing them.
|
||||||
|
|
||||||
A fresh no-input launch of the canonical `iron_3d.exe` did create a responsive
|
A fresh no-input launch of the canonical `iron_3d.exe` did create a responsive
|
||||||
window titled `Parkan. Железная Стратегия`. A read-only probe then requested
|
window titled `Parkan. Железная Стратегия`. A read-only probe then requested
|
||||||
`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` and attempted to read the known
|
`PROCESS_QUERY_INFORMATION | PROCESS_VM_READ` and attempted to read the known
|
||||||
|
|||||||
@@ -296,6 +296,18 @@ normalized-looking `(0.098, 0.018, 0.856)` и не совпадал с paired bl
|
|||||||
оно запрещает называть `0x4D4D0` единственным runtime writer и требует recovery
|
оно запрещает называть `0x4D4D0` единственным runtime writer и требует recovery
|
||||||
indirect/unanalyzed write path.
|
indirect/unanalyzed write path.
|
||||||
|
|
||||||
|
Outer vtable `off_100665B4` теперь даёт exact transform adjustment для
|
||||||
|
world-like sample. Slot `+0x54` вызывает у subobject `outer + 4` slot `+0x20`
|
||||||
|
с selector `0`, затем копирует returned `+0x0C/+0x1C/+0x2C`. В live объекте
|
||||||
|
selector field `outer + 0x10` был `0xFFFFFFFF`; реализация selector `0` при
|
||||||
|
этом возвращает `outer + 0x20`. Значит observed triple
|
||||||
|
`outer + 0x2C/+0x3C/+0x4C` — доказанная translation часть active affine
|
||||||
|
transform, а не корреляция. Selector `2` возвращает paired block `outer + 0x60`;
|
||||||
|
outer slot `+0x70` применяет `atan2` к его axis values, что доказывает
|
||||||
|
orientation-angle path. Названия полей, angle order и handedness пока не
|
||||||
|
установлены, но raw affine transform и translation можно сохранять как
|
||||||
|
backend-neutral camera pose без догадок.
|
||||||
|
|
||||||
### Vtable и interface negotiation
|
### Vtable и interface negotiation
|
||||||
|
|
||||||
Вызовы вида `object->vfunc(offset)` доказывают порядок slots, даже когда имя
|
Вызовы вида `object->vfunc(offset)` доказывают порядок slots, даже когда имя
|
||||||
|
|||||||
Reference in New Issue
Block a user