# Original galaxy map social data evidence

This analysis uses only the installed, pinned original `EliteDangerous64.exe` SHA-256
`6891f70a021fa9f3a0e00458c284f48d1226e68ae7fc02ad48081aed47857e93`.
The game was not run or attached to for this work. The generated decompilations
are in `artifacts/galaxy-query-research/social-sources/decompiled/`.

## Binding to the current context

Original galaxy component constructor `3AC8AC0` obtains both registered interfaces:

| Interface | Type ID global RVA | Stored at original component |
| --- | --- | --- |
| Friends | `5F05CBC` | `+B8` |
| Wing manager | `5F2E7F8` | `+E8` |

The adapter starts from the existing `TryGetGalaxyAccountRegistry(frame)` helper,
whose game context is bound to the active route/life. It does not combine all
instances from component pools, look in another process, or inspect chat content.
It runs only on the established original game owning thread and checks snapshot
validity, game state and physics binding before copying either source.

## Friends

`1CFFE00` constructs the friends component with vtables `5238FC0` (base),
`5238FF0` (`+8`) and `52390F0` (`+58`). Its interface ID getter `1D50740`
returns the value at `5F05CBC`. `1D6DCA0` feeds the component's `+200` working
hash map to the original friend JSON decoder `33FF020`. Crucially, original
marker producer `3AFF080` uses interface vfunc `+28`, leaf getter `58DD30`,
which returns the published map at manager `+220`. The adapter reads **+220**.

`33FF020` explicitly decodes `user_id`, `name`, `commander_id`, `lastLocation`,
`systemAddr`, `state`, `pending`, `canAccept`, and `ignored`. Node key is the
32-bit user ID at `+8`, repeated at `+10`; `+20` is relationship state,
`+24` ignored, `+28` online/game state, `+30` commander ID, and `+40` system
address. Relationship value **2** is proven by `pending == false`, independent
of `canAccept`. Original marker producer `3AFF080` explicitly permits values
**2 or 3**; the separate meaning of 3 is not guessed. The adapter exports
only these two values, non-ignored, with a positive original system address,
preserving all 64-bit integer precision.

State string decoder `33FE690` proves:

| Raw value | Original string |
| --- | --- |
| 0 | `offline` (also the decoder fallback) |
| 1 | `main_menu` |
| 2 | `solo` |
| 3 | `cqc` |
| 4 | `privategroup_other` |
| 5 | `privategroup_current` |
| 6 | `open` |
| 8 | `multicrew` |
| 9 | `threepointx` |
| 10 | `odyssey` |
| 11 | `38in40` |
| 12 | `training_simulation` |
| 13 | `operation` |

Original marker producer **3AFF080**, lines 305–344, establishes the condition:
nonzero state; relationship 2 or 3; local component `5F05BC4` vfunc `+100` true;
local vfunc `+1E0` mode nonzero; and either mode1/state5 or mode2/state6. It
also removes users already represented as active wing markers. Therefore all
states other than **5 or 6** are provably excluded and export `locationCurrent=false`.
For state5/6, eligibility is calculated from the existing original mode and
activity cache; unavailable/uninitialised state remains nullable. Offline and operation13 are excluded
by the original predicate, not by interpretation of their names.

`5F05BC4` interface vtable is `5239F90`; vfunc `+100` is `1D5F600`, testing
the original CSM state-name against `InGame`, pause and respawn states.
Vfunc `+1E0`, **1D53050**, is more than a pure getter: if its `+568` config
reference is empty it registers/obtains `MatchMakingMode`, and it also applies
a multiplayer/avatar restriction. The read-only adapter deliberately does not
invoke it. `Navigation.GalaxyAccountSocialModes.cs` now copies its complete
existing-data decision:

* Flow interface `5239F90` has CSM at `+310`, vtable `513BE00`.
  Getter `A22280` returns `*(CSM+100)`'s first pointer, the current state name.
  The adapter reproduces all 48 exact allowed state literals from `1D5F600`,
  archived in `original-gameplay-states.json`. The literal-prefix loops include
  the NUL byte and therefore do not accept e.g. `InGameX`.
* Existing `flow+568` must reference original integer-value vtable `4DDED20`,
  whose type getter `150DD0` returns `5F059C0`. Value is signed integer at `+10`.
  A null reference remains null and is never initialised by the adapter.
* Modes0/1 are returned unchanged. For mode2, original interface at `flow+90`,
  vtable `5269B58`, getter `2175F70`, returns true precisely for signed-byte
  states12–15 at `+140`. Those states preserve mode2.
* Otherwise local-user `flow+D8`, vtable `52A0288`, getter `978AF0`, supplies
  weak life at `+138`. If its signed life state is greater than4, original
  registered interface `5F2E7E8`, vtable `52A31B8`, getter `26055E0`, supplies
  unsigned value at `+138`. Values below100 suppress mode2 to0. A missing
  weak life or missing avatar interface preserves2 exactly as original code;
  unreadable/unknown layouts remain null, rather than assuming availability.

The cache, flow/current-state binding, CSM state name, multiplayer byte,
local-user/life binding, and avatar value are rechecked after copying. No
original game function is invoked by this evaluation.

The map is bounded by bucket/node limits, cycle and duplicate-key checks,
repeated key agreement, original vtables, original owner pointer, and stable
before/after row and bucket copies. A failed copy supplies no rows.

## Wing

Registration `2522E90` names the WingManager pool `5F96C20`, size `678`.
Factory `24E6070` calls constructor `25C4580`. Its vtables are `52A54C8`,
`52A54F8` (`+8`), and `52A55F8` (`+58`). Getter `26009C0` identifies that
interface as `5F2E7F8`.

The original roster getter `26074D0` bounds indices to six fixed slots at
manager `+2A8`, stride `40`, with first word `FFFFFFFFFFFFFFFF` meaning empty.
Original `26075B0` resolves slot `+18`'s weak life, then looks up registered
interface `5F771DC` in that life. Existing original getters `636A80` and
`647EF0` establish life validity and the `life+C8` component container link.
The adapter requires fully active life state 8, retaining no unresolved member
as a negative result.

WingMemberInfo constructor `25C4E00` supplies vtables `52A8568`, `52A8598`
(`+8`) and `52A8698` (`+58`). Address setter `2644BF0` stores the address
at base `+80`, then masks the lower **55** bits (`7FFFFFFFFFFFFF`) for its
galaxy system lookup. The adapter uses that exact mask. Raw travel state at
base `+8C` is retained as an integer without inventing its enum names. Roster
identity is not relabelled as `commander_id`; that correspondence is unproven.

Original marker producer **3AFF080**, lines 237–274, requires an enabled wing
display option and an unsuppressed category bit, nonempty wing vfunc `+48`,
vfunc `+2C0(2)==false`, a valid nonlocal user ID, and a member's positive
system address via vfunc `+B8`. Leaf `20E27B0` confirms this is the very same
address at member base `+80`.

`2607D00` establishes the nonempty test over `manager+59C` slots; `26178A0`
compares phase byte `manager+590` to 2. Local user interface `5F05BAC`, getter
`26008D0`, has vtable `52A0288`; vfunc `+28` / `2600E90` returns its `+1AC`
user ID. The adapter copies these exact fields. Known invalid/self/phase
conditions export false; a loaded member satisfying the original per-member
condition exports true; a missing local-user binding preserves unknown.
It does **not** interpret the unrelated raw travel-state enum as this gate.
Display-option and duplicate-category handling belongs to the map UI layer.

Each life/registry/member binding, address, state, owner, phase, slot limit and
entire roster is rechecked after copying. Missing or unloaded members yield
only a partial result.

## Completeness, testing and runtime boundary

Both sources are caches. Empty, structurally valid caches are not evidence that
all account/server updates have arrived. Every social result has `complete=false`.
This adapter makes no requests, invokes no game functions, sends no social
messages and performs no in-game edits. It only copies existing fields.

`Navigation.GalaxyAccountSocialTests.cs` exports
`XFENavigationGalaxySocialSelfTest` (expected mask `65535`): positive/offline
facts and nullable eligibility; pending/ignored exclusion; invalid-address
exclusion; cycles, key mismatch and owner mismatch; honest empty partial
results; exact 55-bit wing addresses; unloaded members; invalid member vtables;
duplicate roster identities and wing owner mismatch; original local-user and
wing-phase exclusions; exact offline/operation exclusions and mode-dependent
friend uncertainty. All fixtures use memory
allocated by the selftest, never original account memory.

Additional export `XFENavigationGalaxySocialModesSelfTest` expects mask `8191`:
uninitialised config stays untouched; mode0/1/2 and friend5/6 combinations;
multiplayer/avatar99/100 boundary; absent weak life; unknown dependency layouts;
CSM exclusion; invalid integer type; exact state-name comparison. The original
Social export remains `65535`.

Managed compilation was checked with an isolated artifacts path and passed with
zero warnings and errors. Runtime NativeAOT selftest and live original-game
captures must be recorded separately; compilation does not prove those checks.

## Executable version audit

On2026-10-23 the Steam executable changed to SHA-256
`ed5a8f8cd10f9a80d3bda5badd7ba1d4fcfc15996c8c7e018852cb170e264b63`.
The dedicated Ghidra project and plugin hash remain the pinned `6891...` build.
The matching original image is retained at
`artifacts/ship-model-reference/client-copy/EliteDangerous64.exe`.
SocialModes' vtables and leaf getters, exact state literals, friends published
map getter, and wing phase getter were rechecked against **that pinned copy**.
Intermediate current-Steam-PE xref outputs are navigation leads, not pinned
evidence; their function entry points may differ. Neither this adapter nor
this document claims compatibility with the newly updated Steam executable.