"""Bounded, read-only proof of original manual-exposure input publication.
This records the pinned image's initial stores, not another game camera's live
histogram. It never changes production, accesses a process, or guesses that an
initial store is still the current value after settings/debug overrides.
"""
from pathlib import Path
import hashlib
import importlib.util
import json
import struct
import zlib
spec = importlib.util.spec_from_file_location("audit", "research/Audit-GalaxyClientCompatibility.py")
audit = importlib.util.module_from_spec(spec)
spec.loader.exec_module(audit)
image_path = Path("artifacts/ship-model-reference/client-copy/EliteDangerous64.exe")
image = audit.Image(image_path)
image_sha = hashlib.sha256(image.raw).hexdigest()
if image_sha != "6891f70a021fa9f3a0e00458c284f48d1226e68ae7fc02ad48081aed47857e93":
raise ValueError("Pinned exposure image changed")
functions = {}
instructions = {}
for rva in (0x351F8E0, 0x351F450, 0x3526320, 0x3523480):
bounds = image.function(rva)
if bounds is None or bounds[0] != rva:
raise ValueError("Original exposure function boundary changed")
raw = image.data(rva, bounds[1] - rva)
instructions[rva] = image.instructions(rva, len(raw))
functions[hex(rva)] = dict(length=len(raw), sha256=hashlib.sha256(raw).hexdigest())
def block(function, first, last):
rows = [dict(rva=hex(x.address - image.base), raw=x.bytes.hex(),
instruction=x.mnemonic + " " + x.op_str)
for x in instructions[function]
if first <= x.address - image.base <= last]
if not rows or int(rows[0]["rva"], 16) != first:
raise ValueError("Misaligned exposure instruction anchor")
return rows
def exact(rva, expected):
raw = image.data(rva, len(bytes.fromhex(expected)))
if raw.hex() != expected:
raise ValueError("Original exposure store/selection changed")
return dict(rva=hex(rva), raw=raw.hex())
# Each 64-bit store sets two adjacent 32-bit fields. The upper half is zero.
# Owner+100 is EV; owner+120 is exposure mode. Neither is the neighboring low
# half (.5 at +FC, 1 at +11C), and the shadow constructor's provisional mode2
# is overwritten by the owner's per-render copy.
constructor = [
exact(0x351FA75, "48c786fc0000000000003f"),
exact(0x351FA95, "48c7861c0100000000803f"),
]
copy_ev = block(0x3526320, 0x35263B4, 0x35263C2)
copy_mode = block(0x3526320, 0x3526436, 0x3526444)
if [r["instruction"] for r in copy_ev] != [
"mov eax, dword ptr [r14 + 0x100]", "mov rcx, qword ptr [r14 + 0xd8]",
"mov dword ptr [rcx + 0x6fc], eax"]:
raise ValueError("Owner EV to shadow binding changed")
if [r["instruction"] for r in copy_mode] != [
"mov eax, dword ptr [r14 + 0x120]", "mov rcx, qword ptr [r14 + 0xd8]",
"mov dword ptr [rcx + 0x6c8], eax"]:
raise ValueError("Owner mode to shadow binding changed")
one = image.data(0x4DE165C, 4)
if one != struct.pack("<f", 1) or image.section(0x4DE165C) != ".rdata":
raise ValueError("Original override-disabled constant changed")
stores = {}
for name, rva, expected in [
("ToeModifier", 0x5E8B918, "d7a3803f"),
("ShoulderModifier", 0x5E8B910, "33331340"),
("Offset", 0x5E8B908, "0000a040"),
("Slope", 0x5E8B914, "0000803f"),
]:
raw = image.data(rva, 4)
if raw.hex() != expected or image.section(rva) != ".data":
raise ValueError("Original curve initial store changed")
stores[name] = dict(rva=hex(rva), raw=raw.hex(), initialValue=struct.unpack("<f", raw)[0])
if image.data(0x5E8B997, 1) != b"\x01" or image.data(0x5E8B994, 1) != b"\x01":
raise ValueError("Original exposure flag initial store changed")
compressed = image.data(0x54C4568 + 16, 7370)
program = zlib.decompress(compressed, -15)
program_sha = hashlib.sha256(program).hexdigest()
if program_sha != "62ef0e8e73e653df972031438fdf5a44e5c152e3c7aa0c9af8fd42e14df7cea7":
raise ValueError("Original exposure program changed")
effect = program.index(b"\x08\x02xfxd3f")
cursor = effect + 8
objects = []
for _ in range(2):
marker = program.index(b"\0\1voMrtP", cursor)
length, count = struct.unpack_from("<2I", program, marker + 8)
objects.append(program[marker + 16:marker + 16 + length])
cursor = marker + 16 + length + count * 4
first, second = objects
pass_pointer, pass_count = struct.unpack_from("<2Q", first, 8)
passes = []
for n in range(pass_count):
ptr = struct.unpack_from("<Q", first, pass_pointer + n * 0x70)[0]
passes.append(first[ptr:first.index(b"\0", ptr)].decode("ascii"))
if passes != ["AnalyseLuminance_AutoExposure", "AnalyseLuminance_ManualExposure"]:
raise ValueError("Original exposure pass selection changed")
variables_pointer, variable_count = struct.unpack_from("<2Q", second, 0x48)
names = {"c_manualExposure": "cb0[6].x", "c_exposureCompensationCurveToeModifier": "cb0[6].y",
"c_exposureCompensationCurveShoulderModifier": "cb0[6].z",
"c_exposureCompensationCurveOffset": "cb0[6].w", "c_exposureCompensationCurveSlope": "cb0[7].x"}
reflection = []
for n in range(variable_count):
at = variables_pointer + n * 32
ptr = struct.unpack_from("<Q", second, at)[0]
name = second[ptr:second.index(b"\0", ptr)].decode("ascii")
if name not in names:
continue
packed = struct.unpack_from("<H", second, at + 10)[0]
offset = (packed >> 1) & 0x7FFC
reflection.append(dict(name=name, dataOffset=offset, storageBank=packed & 3,
shaderRegister=names[name], raw=second[at:at + 32].hex()))
if {r["dataOffset"] for r in reflection} != {112, 116, 120, 124, 128}:
raise ValueError("Original exposure uniform offsets changed")
publisher = Path("artifacts/galaxy-query-research/power-outer-sources/focus-ring/decompiled/3523480.c")
source = publisher.read_text(encoding="utf-8")
for token in ["+ 0x6fc", "cRam0000000145e8b997", "fRam0000000145e8b918",
"fRam0000000145e8b910", "uRam0000000145e8b908", "fRam0000000145e8b914",
"lVar20 + 2,0", "iVar2 == 0,0"]:
if token not in source:
raise ValueError("Original exposure publication source changed")
selection = block(0x3523480, 0x3525DC4, 0x3525DDB)
if [r["instruction"] for r in selection][-5:] != [
"mov rdx, r12", "sete sil", "xor r9d, r9d", "mov r8d, esi", "call 0x1404f8d70"]:
raise ValueError("Original mode-zero/manual-pass binding changed")
out = Path("artifacts/galaxy-query-research/power-outer-sources/focus-ring/exposure-controls.json")
result = dict(
image=str(image_path), imageSha256=image_sha, gameProcessAccess=False, gameCalls=0,
productionSourcesModified=False, originalComputeExecuted=False,
functions=functions, publisherDecompilation=dict(path=str(publisher), sha256=hashlib.sha256(publisher.read_bytes()).hexdigest()),
ownerDefaults=dict(exposureEv=0, exposureMode=0, stores=constructor),
perRenderCopy=dict(exposureEv=copy_ev, exposureMode=copy_mode),
curveOverride=dict(flagRva="0x5E8B997", initialFlag=True, initialStores=stores,
disabledValues=dict(ToeModifier=1, ShoulderModifier=1, Offset=0, Slope=1),
disabledConstant=dict(rva="0x4DE165C", raw=one.hex()),
liveValuesCopied=False, staticInitialValuesAreNotRuntimeReadiness=True),
compiledProgram=dict(sha256=program_sha, passes=passes, reflection=reflection, gpuConstantDataStart=16),
modeSelection=dict(modeField="shadow+6C8", modeSource="owner+120", manualWhenModeZero=True,
passArgument="mode==0", assembly=selection),
dispatchGate=dict(source="3526320", required=[
"(global5E8B994 && owner+D0<2) || owner+120!=0", "owner+E0 != 0",
"renderContext+1DA8 != 0", "per-view bVar24 allows work",
"global5FC8392==0 inside 3523480"], initialGlobal5E8B994=True,
initialDefaultStoreDoesNotProveDispatch=True),
sourceContract=dict(
manualInputs="EV belongs to the tool's current rendered view; use the documented original curve branch only when explicitly selected/bound",
histogram="Automatic exposure must analyze the tool view's own HDR scene, never another game camera",
defaultResource="A successfully created/bound 6x1 zero histogram remains a distinct known-default source; it is not a completed manual/auto computation",
unresolved=["runtime overrides/current producer-ready state", "full automatic histogram control source and dispatch", "tool common-HDR exposure integration"]),
)
out.parent.mkdir(parents=True, exist_ok=True)
out.write_text(json.dumps(result, indent=2) + "\n", encoding="utf-8")
print(json.dumps(dict(path=str(out), controls=stores, initialMode=0, passes=passes, runtimeReadinessClaimed=False)))
"""Bounded, read-only proof of original manual-exposure input publication.
This records the pinned image's initial stores, not another game camera's live
histogram. It never changes production, accesses a process, or guesses that an
initial store is still the current value after settings/debug overrides.
"""
from pathlib import Path
import hashlib
import importlib.util
import json
import struct
import zlib
spec = importlib.util.spec_from_file_location("audit", "research/Audit-GalaxyClientCompatibility.py")
audit = importlib.util.module_from_spec(spec)
spec.loader.exec_module(audit)
image_path = Path("artifacts/ship-model-reference/client-copy/EliteDangerous64.exe")
image = audit.Image(image_path)
image_sha = hashlib.sha256(image.raw).hexdigest()
if image_sha != "6891f70a021fa9f3a0e00458c284f48d1226e68ae7fc02ad48081aed47857e93":
raise ValueError("Pinned exposure image changed")
functions = {}
instructions = {}
for rva in (0x351F8E0, 0x351F450, 0x3526320, 0x3523480):
bounds = image.function(rva)
if bounds is None or bounds[0] != rva:
raise ValueError("Original exposure function boundary changed")
raw = image.data(rva, bounds[1] - rva)
instructions[rva] = image.instructions(rva, len(raw))
functions[hex(rva)] = dict(length=len(raw), sha256=hashlib.sha256(raw).hexdigest())
def block(function, first, last):
rows = [dict(rva=hex(x.address - image.base), raw=x.bytes.hex(),
instruction=x.mnemonic + " " + x.op_str)
for x in instructions[function]
if first <= x.address - image.base <= last]
if not rows or int(rows[0]["rva"], 16) != first:
raise ValueError("Misaligned exposure instruction anchor")
return rows
def exact(rva, expected):
raw = image.data(rva, len(bytes.fromhex(expected)))
if raw.hex() != expected:
raise ValueError("Original exposure store/selection changed")
return dict(rva=hex(rva), raw=raw.hex())
# Each 64-bit store sets two adjacent 32-bit fields. The upper half is zero.
# Owner+100 is EV; owner+120 is exposure mode. Neither is the neighboring low
# half (.5 at +FC, 1 at +11C), and the shadow constructor's provisional mode2
# is overwritten by the owner's per-render copy.
constructor = [
exact(0x351FA75, "48c786fc0000000000003f"),
exact(0x351FA95, "48c7861c0100000000803f"),
]
copy_ev = block(0x3526320, 0x35263B4, 0x35263C2)
copy_mode = block(0x3526320, 0x3526436, 0x3526444)
if [r["instruction"] for r in copy_ev] != [
"mov eax, dword ptr [r14 + 0x100]", "mov rcx, qword ptr [r14 + 0xd8]",
"mov dword ptr [rcx + 0x6fc], eax"]:
raise ValueError("Owner EV to shadow binding changed")
if [r["instruction"] for r in copy_mode] != [
"mov eax, dword ptr [r14 + 0x120]", "mov rcx, qword ptr [r14 + 0xd8]",
"mov dword ptr [rcx + 0x6c8], eax"]:
raise ValueError("Owner mode to shadow binding changed")
one = image.data(0x4DE165C, 4)
if one != struct.pack("<f", 1) or image.section(0x4DE165C) != ".rdata":
raise ValueError("Original override-disabled constant changed")
stores = {}
for name, rva, expected in [
("ToeModifier", 0x5E8B918, "d7a3803f"),
("ShoulderModifier", 0x5E8B910, "33331340"),
("Offset", 0x5E8B908, "0000a040"),
("Slope", 0x5E8B914, "0000803f"),
]:
raw = image.data(rva, 4)
if raw.hex() != expected or image.section(rva) != ".data":
raise ValueError("Original curve initial store changed")
stores[name] = dict(rva=hex(rva), raw=raw.hex(), initialValue=struct.unpack("<f", raw)[0])
if image.data(0x5E8B997, 1) != b"\x01" or image.data(0x5E8B994, 1) != b"\x01":
raise ValueError("Original exposure flag initial store changed")
compressed = image.data(0x54C4568 + 16, 7370)
program = zlib.decompress(compressed, -15)
program_sha = hashlib.sha256(program).hexdigest()
if program_sha != "62ef0e8e73e653df972031438fdf5a44e5c152e3c7aa0c9af8fd42e14df7cea7":
raise ValueError("Original exposure program changed")
effect = program.index(b"\x08\x02xfxd3f")
cursor = effect + 8
objects = []
for _ in range(2):
marker = program.index(b"\0\1voMrtP", cursor)
length, count = struct.unpack_from("<2I", program, marker + 8)
objects.append(program[marker + 16:marker + 16 + length])
cursor = marker + 16 + length + count * 4
first, second = objects
pass_pointer, pass_count = struct.unpack_from("<2Q", first, 8)
passes = []
for n in range(pass_count):
ptr = struct.unpack_from("<Q", first, pass_pointer + n * 0x70)[0]
passes.append(first[ptr:first.index(b"\0", ptr)].decode("ascii"))
if passes != ["AnalyseLuminance_AutoExposure", "AnalyseLuminance_ManualExposure"]:
raise ValueError("Original exposure pass selection changed")
variables_pointer, variable_count = struct.unpack_from("<2Q", second, 0x48)
names = {"c_manualExposure": "cb0[6].x", "c_exposureCompensationCurveToeModifier": "cb0[6].y",
"c_exposureCompensationCurveShoulderModifier": "cb0[6].z",
"c_exposureCompensationCurveOffset": "cb0[6].w", "c_exposureCompensationCurveSlope": "cb0[7].x"}
reflection = []
for n in range(variable_count):
at = variables_pointer + n * 32
ptr = struct.unpack_from("<Q", second, at)[0]
name = second[ptr:second.index(b"\0", ptr)].decode("ascii")
if name not in names:
continue
packed = struct.unpack_from("<H", second, at + 10)[0]
offset = (packed >> 1) & 0x7FFC
reflection.append(dict(name=name, dataOffset=offset, storageBank=packed & 3,
shaderRegister=names[name], raw=second[at:at + 32].hex()))
if {r["dataOffset"] for r in reflection} != {112, 116, 120, 124, 128}:
raise ValueError("Original exposure uniform offsets changed")
publisher = Path("artifacts/galaxy-query-research/power-outer-sources/focus-ring/decompiled/3523480.c")
source = publisher.read_text(encoding="utf-8")
for token in ["+ 0x6fc", "cRam0000000145e8b997", "fRam0000000145e8b918",
"fRam0000000145e8b910", "uRam0000000145e8b908", "fRam0000000145e8b914",
"lVar20 + 2,0", "iVar2 == 0,0"]:
if token not in source:
raise ValueError("Original exposure publication source changed")
selection = block(0x3523480, 0x3525DC4, 0x3525DDB)
if [r["instruction"] for r in selection][-5:] != [
"mov rdx, r12", "sete sil", "xor r9d, r9d", "mov r8d, esi", "call 0x1404f8d70"]:
raise ValueError("Original mode-zero/manual-pass binding changed")
out = Path("artifacts/galaxy-query-research/power-outer-sources/focus-ring/exposure-controls.json")
result = dict(
image=str(image_path), imageSha256=image_sha, gameProcessAccess=False, gameCalls=0,
productionSourcesModified=False, originalComputeExecuted=False,
functions=functions, publisherDecompilation=dict(path=str(publisher), sha256=hashlib.sha256(publisher.read_bytes()).hexdigest()),
ownerDefaults=dict(exposureEv=0, exposureMode=0, stores=constructor),
perRenderCopy=dict(exposureEv=copy_ev, exposureMode=copy_mode),
curveOverride=dict(flagRva="0x5E8B997", initialFlag=True, initialStores=stores,
disabledValues=dict(ToeModifier=1, ShoulderModifier=1, Offset=0, Slope=1),
disabledConstant=dict(rva="0x4DE165C", raw=one.hex()),
liveValuesCopied=False, staticInitialValuesAreNotRuntimeReadiness=True),
compiledProgram=dict(sha256=program_sha, passes=passes, reflection=reflection, gpuConstantDataStart=16),
modeSelection=dict(modeField="shadow+6C8", modeSource="owner+120", manualWhenModeZero=True,
passArgument="mode==0", assembly=selection),
dispatchGate=dict(source="3526320", required=[
"(global5E8B994 && owner+D0<2) || owner+120!=0", "owner+E0 != 0",
"renderContext+1DA8 != 0", "per-view bVar24 allows work",
"global5FC8392==0 inside 3523480"], initialGlobal5E8B994=True,
initialDefaultStoreDoesNotProveDispatch=True),
sourceContract=dict(
manualInputs="EV belongs to the tool's current rendered view; use the documented original curve branch only when explicitly selected/bound",
histogram="Automatic exposure must analyze the tool view's own HDR scene, never another game camera",
defaultResource="A successfully created/bound 6x1 zero histogram remains a distinct known-default source; it is not a completed manual/auto computation",
unresolved=["runtime overrides/current producer-ready state", "full automatic histogram control source and dispatch", "tool common-HDR exposure integration"]),
)
out.parent.mkdir(parents=True, exist_ok=True)
out.write_text(json.dumps(result, indent=2) + "\n", encoding="utf-8")
print(json.dumps(dict(path=str(out), controls=stores, initialMode=0, passes=passes, runtimeReadinessClaimed=False)))