Skip to content

Commit bdfd46e

Browse files
VrUaComVrUaCom
committed
reverse: add verified canonical EXE range and transfer census
Record 12,235 unwind ranges, 229 imports and address-only transfer candidates. Cross-check ranges against C++ extraction and 65,704 direct targets against bytes. Document unresolved decoding and semantic completion gates without claiming full reverse.
1 parent 2ae7c56 commit bdfd46e

7 files changed

Lines changed: 557 additions & 0 deletions

File tree

‎data/reverse/exe-census-20260914/imports.tsv‎

Lines changed: 230 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,230 @@
1+
iat_slot_va symbol
2+
0x14034F000 DINPUT8.dll!DirectInput8Create
3+
0x14034F010 GDI32.dll!DeleteObject
4+
0x14034F018 GDI32.dll!SetBitmapBits
5+
0x14034F020 GDI32.dll!CreateCompatibleBitmap
6+
0x14034F030 KERNEL32.dll!LocalFree
7+
0x14034F038 KERNEL32.dll!SystemTimeToFileTime
8+
0x14034F040 KERNEL32.dll!CreateFileW
9+
0x14034F048 KERNEL32.dll!WideCharToMultiByte
10+
0x14034F050 KERNEL32.dll!InitializeSListHead
11+
0x14034F058 KERNEL32.dll!GetSystemTimeAsFileTime
12+
0x14034F060 KERNEL32.dll!GetCurrentProcessId
13+
0x14034F068 KERNEL32.dll!GetStartupInfoW
14+
0x14034F070 KERNEL32.dll!IsDebuggerPresent
15+
0x14034F078 KERNEL32.dll!IsProcessorFeaturePresent
16+
0x14034F080 KERNEL32.dll!TerminateProcess
17+
0x14034F088 KERNEL32.dll!GetCurrentProcess
18+
0x14034F090 KERNEL32.dll!GetFileInformationByHandleEx
19+
0x14034F098 KERNEL32.dll!UnhandledExceptionFilter
20+
0x14034F0A0 KERNEL32.dll!RtlVirtualUnwind
21+
0x14034F0A8 KERNEL32.dll!RtlLookupFunctionEntry
22+
0x14034F0B0 KERNEL32.dll!RtlCaptureContext
23+
0x14034F0B8 KERNEL32.dll!GetProcAddress
24+
0x14034F0C0 KERNEL32.dll!FileTimeToSystemTime
25+
0x14034F0C8 KERNEL32.dll!VirtualAlloc
26+
0x14034F0D0 KERNEL32.dll!GetSystemTime
27+
0x14034F0D8 KERNEL32.dll!CreateEventW
28+
0x14034F0E0 KERNEL32.dll!ResetEvent
29+
0x14034F0E8 KERNEL32.dll!DeleteCriticalSection
30+
0x14034F0F0 KERNEL32.dll!LeaveCriticalSection
31+
0x14034F0F8 KERNEL32.dll!FindClose
32+
0x14034F100 KERNEL32.dll!FindFirstFileA
33+
0x14034F108 KERNEL32.dll!SetUnhandledExceptionFilter
34+
0x14034F110 KERNEL32.dll!EnterCriticalSection
35+
0x14034F118 KERNEL32.dll!InitializeCriticalSection
36+
0x14034F120 KERNEL32.dll!SetLastError
37+
0x14034F128 KERNEL32.dll!SetFilePointer
38+
0x14034F130 KERNEL32.dll!ReadFile
39+
0x14034F138 KERNEL32.dll!GetFileSize
40+
0x14034F140 KERNEL32.dll!FileTimeToLocalFileTime
41+
0x14034F148 KERNEL32.dll!CreateFileA
42+
0x14034F150 KERNEL32.dll!GetModuleHandleW
43+
0x14034F158 KERNEL32.dll!GetCurrentThreadId
44+
0x14034F160 KERNEL32.dll!OutputDebugStringW
45+
0x14034F168 KERNEL32.dll!CreateDirectoryW
46+
0x14034F170 KERNEL32.dll!GetModuleFileNameW
47+
0x14034F178 KERNEL32.dll!CreateProcessW
48+
0x14034F180 KERNEL32.dll!MultiByteToWideChar
49+
0x14034F188 KERNEL32.dll!GetModuleFileNameA
50+
0x14034F190 KERNEL32.dll!GetLastError
51+
0x14034F198 KERNEL32.dll!WaitForSingleObject
52+
0x14034F1A0 KERNEL32.dll!Sleep
53+
0x14034F1A8 KERNEL32.dll!VerifyVersionInfoW
54+
0x14034F1B0 KERNEL32.dll!CreateThread
55+
0x14034F1B8 KERNEL32.dll!SwitchToThread
56+
0x14034F1C0 KERNEL32.dll!CreateEventExW
57+
0x14034F1C8 KERNEL32.dll!SetEvent
58+
0x14034F1D0 KERNEL32.dll!QueryPerformanceFrequency
59+
0x14034F1D8 KERNEL32.dll!QueryPerformanceCounter
60+
0x14034F1E0 KERNEL32.dll!VerSetConditionMask
61+
0x14034F1E8 KERNEL32.dll!CloseHandle
62+
0x14034F1F8 MFPlat.DLL!MFllMulDiv
63+
0x14034F200 MFPlat.DLL!MFCreateMediaType
64+
0x14034F208 MFPlat.DLL!MFTEnum
65+
0x14034F210 MFPlat.DLL!MFCreateSample
66+
0x14034F218 MFPlat.DLL!MFCreateMemoryBuffer
67+
0x14034F220 MFPlat.DLL!MFShutdown
68+
0x14034F228 MFPlat.DLL!MFStartup
69+
0x14034F238 MFReadWrite.dll!MFCreateSourceReaderFromURL
70+
0x14034F248 MSVCP140.dll!?_Xbad_alloc@std@@YAXXZ
71+
0x14034F250 MSVCP140.dll!?_Xlength_error@std@@YAXPEBD@Z
72+
0x14034F258 MSVCP140.dll!?_Xout_of_range@std@@YAXPEBD@Z
73+
0x14034F268 OLEAUT32.dll!ordinal:9
74+
0x14034F270 OLEAUT32.dll!ordinal:6
75+
0x14034F278 OLEAUT32.dll!ordinal:2
76+
0x14034F288 SHELL32.dll!SHGetFolderPathW
77+
0x14034F298 USER32.dll!FindWindowW
78+
0x14034F2A0 USER32.dll!MonitorFromWindow
79+
0x14034F2A8 USER32.dll!GetMonitorInfoW
80+
0x14034F2B0 USER32.dll!CallNextHookEx
81+
0x14034F2B8 USER32.dll!UnhookWindowsHookEx
82+
0x14034F2C0 USER32.dll!SetWindowsHookExW
83+
0x14034F2C8 USER32.dll!SetWindowLongW
84+
0x14034F2D0 USER32.dll!GetWindowLongW
85+
0x14034F2D8 USER32.dll!ShowCursor
86+
0x14034F2E0 USER32.dll!UpdateWindow
87+
0x14034F2E8 USER32.dll!GetSystemMetrics
88+
0x14034F2F0 USER32.dll!SetWindowPos
89+
0x14034F2F8 USER32.dll!ShowWindow
90+
0x14034F300 USER32.dll!CreateWindowExW
91+
0x14034F308 USER32.dll!RegisterClassExW
92+
0x14034F310 USER32.dll!UnregisterClassW
93+
0x14034F318 USER32.dll!PostQuitMessage
94+
0x14034F320 USER32.dll!LoadCursorW
95+
0x14034F328 USER32.dll!DefWindowProcW
96+
0x14034F330 USER32.dll!GetFocus
97+
0x14034F338 USER32.dll!OpenClipboard
98+
0x14034F340 USER32.dll!CloseClipboard
99+
0x14034F348 USER32.dll!SetClipboardData
100+
0x14034F350 USER32.dll!EmptyClipboard
101+
0x14034F358 USER32.dll!GetDC
102+
0x14034F360 USER32.dll!TranslateMessage
103+
0x14034F368 USER32.dll!DispatchMessageW
104+
0x14034F370 USER32.dll!PeekMessageW
105+
0x14034F378 USER32.dll!PostMessageW
106+
0x14034F388 VCRUNTIME140.dll!__std_exception_copy
107+
0x14034F390 VCRUNTIME140.dll!strrchr
108+
0x14034F398 VCRUNTIME140.dll!_CxxThrowException
109+
0x14034F3A0 VCRUNTIME140.dll!__CxxFrameHandler3
110+
0x14034F3A8 VCRUNTIME140.dll!memcpy
111+
0x14034F3B0 VCRUNTIME140.dll!memset
112+
0x14034F3B8 VCRUNTIME140.dll!_purecall
113+
0x14034F3C0 VCRUNTIME140.dll!__std_terminate
114+
0x14034F3C8 VCRUNTIME140.dll!memcmp
115+
0x14034F3D0 VCRUNTIME140.dll!strstr
116+
0x14034F3D8 VCRUNTIME140.dll!__RTDynamicCast
117+
0x14034F3E0 VCRUNTIME140.dll!__C_specific_handler
118+
0x14034F3E8 VCRUNTIME140.dll!__vcrt_InitializeCriticalSectionEx
119+
0x14034F3F0 VCRUNTIME140.dll!__std_exception_destroy
120+
0x14034F3F8 VCRUNTIME140.dll!memmove
121+
0x14034F408 XINPUT9_1_0.dll!XInputSetState
122+
0x14034F410 XINPUT9_1_0.dll!XInputGetState
123+
0x14034F420 api-ms-win-crt-convert-l1-1-0.dll!atoi
124+
0x14034F428 api-ms-win-crt-convert-l1-1-0.dll!atof
125+
0x14034F430 api-ms-win-crt-convert-l1-1-0.dll!mbstowcs
126+
0x14034F440 api-ms-win-crt-heap-l1-1-0.dll!_aligned_free
127+
0x14034F448 api-ms-win-crt-heap-l1-1-0.dll!realloc
128+
0x14034F450 api-ms-win-crt-heap-l1-1-0.dll!malloc
129+
0x14034F458 api-ms-win-crt-heap-l1-1-0.dll!calloc
130+
0x14034F460 api-ms-win-crt-heap-l1-1-0.dll!_aligned_malloc
131+
0x14034F468 api-ms-win-crt-heap-l1-1-0.dll!free
132+
0x14034F470 api-ms-win-crt-heap-l1-1-0.dll!_callnewh
133+
0x14034F478 api-ms-win-crt-heap-l1-1-0.dll!_set_new_mode
134+
0x14034F488 api-ms-win-crt-locale-l1-1-0.dll!_configthreadlocale
135+
0x14034F498 api-ms-win-crt-math-l1-1-0.dll!sqrtf
136+
0x14034F4A0 api-ms-win-crt-math-l1-1-0.dll!_fdtest
137+
0x14034F4A8 api-ms-win-crt-math-l1-1-0.dll!sinf
138+
0x14034F4B0 api-ms-win-crt-math-l1-1-0.dll!cosf
139+
0x14034F4B8 api-ms-win-crt-math-l1-1-0.dll!tanf
140+
0x14034F4C0 api-ms-win-crt-math-l1-1-0.dll!acosf
141+
0x14034F4C8 api-ms-win-crt-math-l1-1-0.dll!__setusermatherr
142+
0x14034F4D0 api-ms-win-crt-math-l1-1-0.dll!fmodf
143+
0x14034F4D8 api-ms-win-crt-math-l1-1-0.dll!powf
144+
0x14034F4E0 api-ms-win-crt-math-l1-1-0.dll!pow
145+
0x14034F4E8 api-ms-win-crt-math-l1-1-0.dll!atan2f
146+
0x14034F4F8 api-ms-win-crt-runtime-l1-1-0.dll!_c_exit
147+
0x14034F500 api-ms-win-crt-runtime-l1-1-0.dll!_register_thread_local_exe_atexit_callback
148+
0x14034F508 api-ms-win-crt-runtime-l1-1-0.dll!_exit
149+
0x14034F510 api-ms-win-crt-runtime-l1-1-0.dll!_invalid_parameter_noinfo_noreturn
150+
0x14034F518 api-ms-win-crt-runtime-l1-1-0.dll!exit
151+
0x14034F520 api-ms-win-crt-runtime-l1-1-0.dll!_initterm_e
152+
0x14034F528 api-ms-win-crt-runtime-l1-1-0.dll!_initterm
153+
0x14034F530 api-ms-win-crt-runtime-l1-1-0.dll!_get_narrow_winmain_command_line
154+
0x14034F538 api-ms-win-crt-runtime-l1-1-0.dll!_set_app_type
155+
0x14034F540 api-ms-win-crt-runtime-l1-1-0.dll!_seh_filter_exe
156+
0x14034F548 api-ms-win-crt-runtime-l1-1-0.dll!terminate
157+
0x14034F550 api-ms-win-crt-runtime-l1-1-0.dll!_cexit
158+
0x14034F558 api-ms-win-crt-runtime-l1-1-0.dll!__p___argv
159+
0x14034F560 api-ms-win-crt-runtime-l1-1-0.dll!__p___argc
160+
0x14034F568 api-ms-win-crt-runtime-l1-1-0.dll!_configure_narrow_argv
161+
0x14034F570 api-ms-win-crt-runtime-l1-1-0.dll!_crt_atexit
162+
0x14034F578 api-ms-win-crt-runtime-l1-1-0.dll!_initialize_narrow_environment
163+
0x14034F580 api-ms-win-crt-runtime-l1-1-0.dll!_initialize_onexit_table
164+
0x14034F588 api-ms-win-crt-runtime-l1-1-0.dll!_register_onexit_function
165+
0x14034F590 api-ms-win-crt-runtime-l1-1-0.dll!_invalid_parameter_noinfo
166+
0x14034F598 api-ms-win-crt-runtime-l1-1-0.dll!_errno
167+
0x14034F5A0 api-ms-win-crt-runtime-l1-1-0.dll!_beginthreadex
168+
0x14034F5B0 api-ms-win-crt-stdio-l1-1-0.dll!__p__commode
169+
0x14034F5B8 api-ms-win-crt-stdio-l1-1-0.dll!__stdio_common_vsprintf
170+
0x14034F5C0 api-ms-win-crt-stdio-l1-1-0.dll!__acrt_iob_func
171+
0x14034F5C8 api-ms-win-crt-stdio-l1-1-0.dll!__stdio_common_vswprintf
172+
0x14034F5D0 api-ms-win-crt-stdio-l1-1-0.dll!_set_fmode
173+
0x14034F5D8 api-ms-win-crt-stdio-l1-1-0.dll!__stdio_common_vfprintf
174+
0x14034F5E8 api-ms-win-crt-string-l1-1-0.dll!strncpy
175+
0x14034F5F0 api-ms-win-crt-string-l1-1-0.dll!_strupr
176+
0x14034F5F8 api-ms-win-crt-string-l1-1-0.dll!_stricmp
177+
0x14034F600 api-ms-win-crt-string-l1-1-0.dll!strcmp
178+
0x14034F608 api-ms-win-crt-string-l1-1-0.dll!strnlen
179+
0x14034F610 api-ms-win-crt-string-l1-1-0.dll!_strdup
180+
0x14034F618 api-ms-win-crt-string-l1-1-0.dll!strncmp
181+
0x14034F628 api-ms-win-crt-time-l1-1-0.dll!clock
182+
0x14034F638 api-ms-win-crt-utility-l1-1-0.dll!qsort
183+
0x14034F640 api-ms-win-crt-utility-l1-1-0.dll!bsearch
184+
0x14034F650 d3d11.dll!D3D11CreateDeviceAndSwapChain
185+
0x14034F660 dxgi.dll!CreateDXGIFactory
186+
0x14034F670 fmod64.dll!FMOD_Sound_GetUserData
187+
0x14034F678 fmod64.dll!FMOD_Channel_Stop
188+
0x14034F680 fmod64.dll!FMOD_Channel_SetPaused
189+
0x14034F688 fmod64.dll!FMOD_Channel_GetPaused
190+
0x14034F690 fmod64.dll!FMOD_Sound_SetUserData
191+
0x14034F698 fmod64.dll!FMOD_Sound_SetLoopCount
192+
0x14034F6A0 fmod64.dll!FMOD_Memory_Initialize
193+
0x14034F6A8 fmod64.dll!FMOD_Debug_Initialize
194+
0x14034F6B0 fmod64.dll!FMOD_Channel_SetVolume
195+
0x14034F6B8 fmod64.dll!FMOD_Channel_SetPan
196+
0x14034F6C0 fmod64.dll!FMOD_Channel_SetFrequency
197+
0x14034F6C8 fmod64.dll!FMOD_Channel_SetPriority
198+
0x14034F6D0 fmod64.dll!FMOD_Channel_SetChannelGroup
199+
0x14034F6D8 fmod64.dll!FMOD_Channel_SetLoopPoints
200+
0x14034F6E0 fmod64.dll!FMOD_ChannelGroup_Stop
201+
0x14034F6E8 fmod64.dll!FMOD_ChannelGroup_SetVolume
202+
0x14034F6F0 fmod64.dll!FMOD_ChannelGroup_AddGroup
203+
0x14034F6F8 fmod64.dll!FMOD_System_LockDSP
204+
0x14034F700 fmod64.dll!FMOD_System_UnlockDSP
205+
0x14034F708 fmod64.dll!FMOD_System_SetSoftwareChannels
206+
0x14034F710 fmod64.dll!FMOD_System_GetAdvancedSettings
207+
0x14034F718 fmod64.dll!FMOD_Sound_GetOpenState
208+
0x14034F720 fmod64.dll!FMOD_System_RegisterCodec
209+
0x14034F728 fmod64.dll!FMOD_System_Update
210+
0x14034F730 fmod64.dll!FMOD_System_SetStreamBufferSize
211+
0x14034F738 fmod64.dll!FMOD_System_GetVersion
212+
0x14034F740 fmod64.dll!FMOD_Sound_Release
213+
0x14034F748 fmod64.dll!FMOD_System_SetReverbProperties
214+
0x14034F750 fmod64.dll!FMOD_System_GetMasterChannelGroup
215+
0x14034F758 fmod64.dll!FMOD_System_PlaySound
216+
0x14034F760 fmod64.dll!FMOD_System_CreateChannelGroup
217+
0x14034F768 fmod64.dll!FMOD_System_CreateStream
218+
0x14034F770 fmod64.dll!FMOD_System_CreateSound
219+
0x14034F780 fmodstudio64.dll!FMOD_Studio_System_Create
220+
0x14034F788 fmodstudio64.dll!FMOD_Studio_System_Initialize
221+
0x14034F790 fmodstudio64.dll!FMOD_Studio_System_GetLowLevelSystem
222+
0x14034F7A0 ole32.dll!CoCreateInstance
223+
0x14034F7A8 ole32.dll!CoTaskMemFree
224+
0x14034F7B8 steam_api64.dll!SteamAPI_GetHSteamUser
225+
0x14034F7C0 steam_api64.dll!SteamAPI_Init
226+
0x14034F7C8 steam_api64.dll!SteamAPI_RestartAppIfNecessary
227+
0x14034F7D0 steam_api64.dll!SteamInternal_ContextInit
228+
0x14034F7D8 steam_api64.dll!SteamInternal_CreateInterface
229+
0x14034F7E0 steam_api64.dll!SteamAPI_GetHSteamPipe
230+
0x14034F7E8 steam_api64.dll!SteamAPI_Shutdown

‎data/reverse/exe-census-20260914/ranges.tsv.gz‎

124 KB
Binary file not shown.

‎data/reverse/exe-census-20260914/summary.json‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
{
2+
"schema": "dmc3-exe-census-v1",
3+
"sha256": "e454272ed0fb0247fcbcf300e5d55d7a3e96d50b89b9ffaff81bb978dcbdd082",
4+
"file_size": 6356432,
5+
"status": "STRUCTURAL_CONFIRMED",
6+
"semantic_completion_claim": false,
7+
"image_base": "0x140000000",
8+
"entry_va": "0x14034615C",
9+
"objdump_version": "GNU objdump (GNU Binutils for Ubuntu) 2.42",
10+
"sections": [
11+
{
12+
"name": ".text",
13+
"rva": 4096,
14+
"virtual_size": 3464526,
15+
"raw_size": 3464704,
16+
"raw_offset": 1024,
17+
"flags": 1610612768
18+
},
19+
{
20+
"name": ".rdata",
21+
"rva": 3469312,
22+
"virtual_size": 2110312,
23+
"raw_size": 2110464,
24+
"raw_offset": 3465728,
25+
"flags": 1073741888
26+
},
27+
{
28+
"name": ".data",
29+
"rva": 5582848,
30+
"virtual_size": 8516024,
31+
"raw_size": 548864,
32+
"raw_offset": 5576192,
33+
"flags": 3221225536
34+
},
35+
{
36+
"name": ".pdata",
37+
"rva": 14102528,
38+
"virtual_size": 146820,
39+
"raw_size": 146944,
40+
"raw_offset": 6125056,
41+
"flags": 1073741888
42+
},
43+
{
44+
"name": ".gfids",
45+
"rva": 14249984,
46+
"virtual_size": 80,
47+
"raw_size": 512,
48+
"raw_offset": 6272000,
49+
"flags": 1073741888
50+
},
51+
{
52+
"name": ".tls",
53+
"rva": 14254080,
54+
"virtual_size": 9,
55+
"raw_size": 512,
56+
"raw_offset": 6272512,
57+
"flags": 3221225536
58+
},
59+
{
60+
"name": ".rsrc",
61+
"rva": 14258176,
62+
"virtual_size": 3888,
63+
"raw_size": 4096,
64+
"raw_offset": 6273024,
65+
"flags": 1073741888
66+
},
67+
{
68+
"name": ".reloc",
69+
"rva": 14262272,
70+
"virtual_size": 73136,
71+
"raw_size": 73216,
72+
"raw_offset": 6277120,
73+
"flags": 1107296320
74+
}
75+
],
76+
"runtime_function_ranges": 12235,
77+
"import_slots": 229,
78+
"disassembled_instruction_starts": 880446,
79+
"instruction_starts_outside_runtime_ranges": 180553,
80+
"bad_decodes": 3488,
81+
"bad_decodes_inside_runtime_ranges": 3133,
82+
"transfer_counts": {
83+
"call:direct": 44407,
84+
"call:import_slot": 651,
85+
"call:indirect_unresolved": 10308,
86+
"jmp:direct": 21297,
87+
"jmp:import_slot": 96,
88+
"jmp:indirect_unresolved": 699
89+
},
90+
"ranges_without_instruction_starts": 0,
91+
"limitations": [
92+
"Unwind ranges are not a complete function list: leaf functions may have no entry; fragments may be separate entries.",
93+
"Linear disassembly is not proof of reachability or code/data separation.",
94+
"Indirect register/vtable transfers, delay imports, callback and exception edges are not resolved.",
95+
"No semantic coverage percentage is inferred from instruction or range counts."
96+
]
97+
}

‎data/reverse/exe-census-20260914/transfers.tsv.gz‎

508 KB
Binary file not shown.

‎data/reverse/exe-census-20260914/verification.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"range_rows_match_existing_cpp_extractor": 12235,
3+
"direct_targets_independently_checked_from_machine_bytes": 65704,
4+
"unsupported_direct_encodings": [],
5+
"bad_decodes_inside_runtime_ranges": 3133
6+
}

0 commit comments

Comments
 (0)