assembly-idioms.md records that an __int64 comes back in EDX:EAX, with a 64-bit
argument taking two stack slots, and that a direct absolute operand names a
global rather than a local.
Both were present in the tutorial corpus and left out of the previous commit.
The rest of its C-to-assembly material stays out: a reference needs a symptom that
routes to it, and not being able to read a listing is a prerequisite, not a
symptom of an artifact.
references/crt-startup-and-main.md covers what runs before main: the entry
symbols the linker places, the startup order under VS2015 and later, the VC++ 6.0
prologue, __chkesp and SEH tells in 32-bit builds, the /GS cookie construction,
and the procedure for reaching main in a stripped image.
assembly-idioms.md gains two sections: structure layout and stride (pack
arithmetic, by-value copies, hidden return pointers, two-dimensional strides)
and dispatch shapes (comparison chain, address table, offset table, binary
tree), with the case set recovered from the bounds check rather than from
quoted thresholds.
Register the file in both symptom tables, the routing index, the coverage and
route-inventory tables and the evidence note. The startup shapes come from a
public tutorial corpus and are graded unverified; only the call into main,
observed in a run, would promote them.
references/cpu-vendor-divergence.md records where the two x86-64 implementations
diverge: undefined results, vendor-string dispatch, feature-gated decoding,
system-instruction fault timing, and model-specific cost, each stated with what
it changes for reading a binary or writing a specification.
Register it in the routing index, both symptom tables and the route table; add
the coverage row (inferred, no second-vendor host), the route-inventory row
(argued) and the evidence note that every measurement here came from one
implementation.
Append P38 for an undefined result recorded as a defined one, and point
assembly-idioms and hypervisor-observation at the new file.
injection-and-hooking.md gains where a stub can live, the jump encodings and the
64-bit distance problem, what the stub must preserve, the order the writes land in,
and how the bytes are produced and checked before use.
recon.md gains an import-cluster table: which API sets name which mechanism, and
which reference continues each one.
static-analysis.md reads the x64 exception directory as a function table, with the
three validity checks, the unwind record's contents, and the three limits. compiler-
fingerprints.md points at it.
dotnet-decompilation.md loses a product-name-with-version literal that the leak scan
reports as a strong finding once the file is tracked.
Add references/assembly-idioms.md: the x86/x64 conventions, frame and epilogue
fingerprints, string-instruction and x87 idioms, virtual dispatch, and WOW64 path
redirection, each stated with what it changes about reading or patching a routine.
Add the managed-decompilation, Unity IL2CPP and packaged-Python references, with
the capability registry, host-probe and plan entries they depend on.
Register all four in the routing index, symptom table, route inventory, coverage and
evidence records, and add P37 for a 32-bit target's registry and file views.
- check_budget.py escalated a hard index-row violation to 'warn' on both
branches, so INDEX_ROW_HARD could never fail anything. It fails now, and
tests/unit/test_budget_measurement.py pins both thresholds.
- The corpus note counted scripts/__pycache__/*.pyc, so the same commit
reported 27 scripts after the suite had run and 16 on a clean checkout.
- TOKENS_PER_CHAR is re-derived from a measurement (26,795 chars -> 6,065
tokens = 4.418); the comment's old figure and its arithmetic were both
wrong for this file.
- check_repo.py's yaml sentinel carries the type ignore, so mypy is clean
with PyYAML installed as well as without it.
- The CPUID test now skips with the probe's own note on a host without
CPUID instead of failing, and pytest.ini points at tests/README.md, which
exists, instead of an EXTENSION file that never did.
Tooling: .flake8 (a measured 120-column limit), .gitattributes, .gitignore
and .github/workflows/ci.yml (the five gates, the suite on 3.11-3.14 and a
lint job), which is what CONTRIBUTING.md already claimed CI runs. The
pull-request template it refers to now exists.
Content: pitfalls P26-P34 -- the analysis-level failures the catalogue was
missing (sampling read as observation, a self-built parser trusted, a
verification that could not have failed, a shell-mangled command line) --
registered in the symptom index and its routing mirror. FINDINGS F11-F15
record the defects above.
Tests: the coverage guard derives its subject from scripts/ rather than a
hand-written list, pe_triage.py and pe_diff.py gain their first tests, and
plan.py / preflight.py are declared uncovered with reasons.
README 242 -> 180 lines: the 14-row tool table becomes three sentences pointing at capabilities.py, Read this first merges into Scope, and the six-script maintenance block becomes a table. Every path, command and anchor is unchanged.
README.zh-CN follows the same eight sections, and picks up two drifts: it named hwprobe.py as the cheapest first command (SKILL.md and the English README say doctor.py), and it translated triage as 'three categories', which sends a reader looking for categories that do not exist.
docs/primer is the Windows reverse-engineering tutorial series with an index, corrected in three places: x64dbg instead of OllyDbg, offsets fixed only within one build, and IAT hooking assuming the target imports the API it hooks.
docs/tool-acquisition keeps the part capabilities.py does not answer: licence classes, id resolution on the host, and what proves a tool runs.
root