Extend the reference library with assembly-level and runtime reading

Add references/assembly-idioms.md: the x86/x64 conventions, frame and epilogue
fingerprints, string-instruction and x87 idioms, virtual dispatch, and WOW64 path
redirection, each stated with what it changes about reading or patching a routine.

Add the managed-decompilation, Unity IL2CPP and packaged-Python references, with
the capability registry, host-probe and plan entries they depend on.

Register all four in the routing index, symptom table, route inventory, coverage and
evidence records, and add P37 for a 32-bit target's registry and file views.
This commit is contained in:
root
2026-10-24 15:30:09 +08:00
parent 63b2aca8d8
commit 8e50676eba
18 changed files with 1347 additions and 13 deletions
+5 -1
View File
@@ -136,7 +136,9 @@ an evidence record.
What it covers, and what it deliberately does not, is stated in the skill itself
(`skills/exe-reverse/references/coverage-and-limits.md`). The short version: Windows PE on x86 and
x64, deep on the layers that have been worked through — triage, patching, signatures, licensing
classification, protectors, managed code, and the hardware-observation route map. Defeating a
classification, protectors, managed code, and the hardware-observation route map. Two
application-runtime layers — Unity IL2CPP metadata recovery and packaged Python — are documented
from public write-ups, and are graded `unverified` for that reason. Defeating a
server-side authority, a fully automated general-purpose devirtualiser, defeating a named commercial
protector as a product claim, and any guarantee on a Windows build this repository has not measured
are **not** covered, and the skill is written to say so and stop rather than apply the nearest
@@ -176,6 +178,8 @@ exercise.
---
Proudly supported by the [LINUX DO](https://linux.do) community.
## Disclaimer
The material is provided *as is*, without warranty of any kind. Results are recorded as they were