From 59957a02a247ebaebeb6f49ec0705ffd233c198d Mon Sep 17 00:00:00 2001 From: ReaperOfVeriod Date: Wed, 14 Oct 2026 05:23:14 +0200 Subject: [PATCH] Attribute the 0xc0 immediate sites to functions: 410 candidates The decomp's functions.tsv makes this cheap -- 3,835 level-0 functions with start and size, so each immediate-bearing instruction is attributable to its container. 410 of 3,835 functions (10.7%) contain one; sizes 20 to 34,316, median 808. Ten per cent is what a common small immediate buys, so this confirms 56b00fb rather than narrowing anything. 410 is not a shortlist. What it does establish is that the attribution works and the decomp's extents are usable for it. The loader hunt now has a concrete next step: of those 410, the ones that also touch a class span. That is dataflow, not counting, and it is where this resumes. Caveat recorded: a 20-byte 'function' holding the immediate is a mis-bound extent whose tail happens to include another function's instruction. Sizes need a floor before the set is used. No test -- an attribution count with no assertion behind it would only make the 410 look like a finding. --- docs/plan/level-assets.md | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/docs/plan/level-assets.md b/docs/plan/level-assets.md index 28d7792..a6a19a8 100644 --- a/docs/plan/level-assets.md +++ b/docs/plan/level-assets.md @@ -1979,6 +1979,27 @@ filtering on opcode, which costs nothing and needs no capstone. **Result: still no signal.** Nothing in the immediate stream points at `moby_classes` more than at the other small offsets the program uses. The loader -is not findable this way, and the remaining route is structural -- finding -functions that touch both the chunk offset and a class span, which means real -dataflow rather than a frequency count. +is not findable by frequency. + +### Mapping the sites to functions: 410 candidates, which is not a narrowing + +The next step the decomp makes cheap. `functions.tsv` gives 3,835 level-0 +functions with start and size, so each `0xc0` immediate-bearing instruction can be +attributed to its containing function. + +**410 of 3,835 functions (10.7%) contain one.** Sizes run 20 bytes (extent +tail, effectively a mis-bound) to 34,316, median 808. + +Ten per cent is what a common small immediate buys, so this confirms the previous +commit rather than narrowing anything -- 410 candidates is not a shortlist. What +it does establish is that the attribution machinery works and that function +extents from the decomp are usable for exactly this. + +The loader hunt now has a concrete next step rather than a vague one: of those +410, find the ones that *also* touch a class span -- a tie or moby class base -- +and those are the constructors. That is dataflow rather than counting, and it is +where this should resume. + +Note the one caution this measurement earns: a 20-byte "function" containing the +immediate is not a real candidate, it is a function whose extent ends just after +some other function's instruction. Sizes need a floor before the set is used.