injection-and-hooking.md gains where a stub can live, the jump encodings and the
64-bit distance problem, what the stub must preserve, the order the writes land in,
and how the bytes are produced and checked before use.
recon.md gains an import-cluster table: which API sets name which mechanism, and
which reference continues each one.
static-analysis.md reads the x64 exception directory as a function table, with the
three validity checks, the unwind record's contents, and the three limits. compiler-
fingerprints.md points at it.
dotnet-decompilation.md loses a product-name-with-version literal that the leak scan
reports as a strong finding once the file is tracked.
Add references/assembly-idioms.md: the x86/x64 conventions, frame and epilogue
fingerprints, string-instruction and x87 idioms, virtual dispatch, and WOW64 path
redirection, each stated with what it changes about reading or patching a routine.
Add the managed-decompilation, Unity IL2CPP and packaged-Python references, with
the capability registry, host-probe and plan entries they depend on.
Register all four in the routing index, symptom table, route inventory, coverage and
evidence records, and add P37 for a 32-bit target's registry and file views.
- check_budget.py escalated a hard index-row violation to 'warn' on both
branches, so INDEX_ROW_HARD could never fail anything. It fails now, and
tests/unit/test_budget_measurement.py pins both thresholds.
- The corpus note counted scripts/__pycache__/*.pyc, so the same commit
reported 27 scripts after the suite had run and 16 on a clean checkout.
- TOKENS_PER_CHAR is re-derived from a measurement (26,795 chars -> 6,065
tokens = 4.418); the comment's old figure and its arithmetic were both
wrong for this file.
- check_repo.py's yaml sentinel carries the type ignore, so mypy is clean
with PyYAML installed as well as without it.
- The CPUID test now skips with the probe's own note on a host without
CPUID instead of failing, and pytest.ini points at tests/README.md, which
exists, instead of an EXTENSION file that never did.
Tooling: .flake8 (a measured 120-column limit), .gitattributes, .gitignore
and .github/workflows/ci.yml (the five gates, the suite on 3.11-3.14 and a
lint job), which is what CONTRIBUTING.md already claimed CI runs. The
pull-request template it refers to now exists.
Content: pitfalls P26-P34 -- the analysis-level failures the catalogue was
missing (sampling read as observation, a self-built parser trusted, a
verification that could not have failed, a shell-mangled command line) --
registered in the symptom index and its routing mirror. FINDINGS F11-F15
record the defects above.
Tests: the coverage guard derives its subject from scripts/ rather than a
hand-written list, pe_triage.py and pe_diff.py gain their first tests, and
plan.py / preflight.py are declared uncovered with reasons.
root