diff --git a/docs/re/BACKLOG.md b/docs/re/BACKLOG.md index 7d573afe..fe18d830 100644 --- a/docs/re/BACKLOG.md +++ b/docs/re/BACKLOG.md @@ -827,6 +827,33 @@ unknown, what evidence exists, and what the first step would be. Move an item in field; the stat keys in records not opened here (`MegaTons`, `BulletLimit`, `CrewCount`, `HP_CLASS`); why the roster lists 59 of 131. +* 🔴 **(2026-08-27) BLOCKED — the 2D / `GP_READY_ROOM` TOC names: three routes, + all closed, each with a control.** + [structures/archive-naming](structures/archive-naming.md), artefact + `data/archive-naming.txt` (+22 lines, 0 deletions — purely additive). + **1. A different hash family.** The corpus knows three (`idxd-tag-hash.md`): + `name_hash`, `tag_hash`, `ixud_hash`. Scoring all **5 977** harvested names x 6 + prefixes: `GP_TITLE` **8/16** and `GP_PAUSE_MENU` **6/11** under `name_hash` + (the positive controls), and **`tag_hash` and `ixud_hash` explain NOTHING + anywhere** — including the paks `name_hash` does explain. So they are not the + TOC function and the unnameable pair is not keyed by a different one. + `GP_MAIN_GAME_E2D` stays at **0/711** under all three. + **2. The executable.** `sylpheed.db`'s `strings` holds **7 140** rows, of which + exactly **TWO** look like asset paths — `Data\gmicon002_2.t32` and + `Data\gmicon006_2.t32`, in a `Data\` directory nothing else on the disc uses — + and **neither resolves in any archive**. The binary is not the name source; it + holds two strays and no table. + **3. Name transformations** — 13 of them on the 419 config paths, all 0. + 🔴 **The container runs out here.** Those TOC keys hash names that exist on + neither the disc nor the executable in readable form. The only lever left is a + dictionary attack using `name_hash`'s shape (top byte = character-sum + checksum, so candidates are cheap to reject), and that needs a plausible name + corpus this disc does not contain. **Noted as blocked rather than improvised + around.** + ⚠️ **The port does not need these names**: sprites and bundles are readable by + CONTENT (T8aD, RATC), and the config records already say which asset each HUD + element uses. Only the archive-key ↔ name mapping is missing. + * ✅ **(2026-08-27) WHICH ARCHIVES THE DISC CAN NAME — 100 % for eleven menu paks, **0.0 %** for all six 2D paks AND `GP_READY_ROOM`.** [structures/archive-naming](structures/archive-naming.md), artefact diff --git a/docs/re/data/archive-naming.txt b/docs/re/data/archive-naming.txt index d9e4e780..a5965f83 100644 --- a/docs/re/data/archive-naming.txt +++ b/docs/re/data/archive-naming.txt @@ -47,3 +47,25 @@ fonts.pak 3 3 100.0% GP_SYSTEM.pak 2 2 100.0% GP_TUTORIAL.pak 2 2 100.0% + +## CONTROL is the unnameable pair keyed by a DIFFERENT hash? + (6 prefixes x 3 hash families; the menu paks are the positive control) + GP_MAIN_GAME_E2D.pak name_hash 0 / 711 + GP_MAIN_GAME_E2D.pak tag_hash 0 / 711 + GP_MAIN_GAME_E2D.pak ixud_hash 0 / 711 + GP_READY_ROOM.pak name_hash 6 / 1106 + GP_READY_ROOM.pak tag_hash 0 / 1106 + GP_READY_ROOM.pak ixud_hash 0 / 1106 + GP_TITLE.pak name_hash 8 / 16 eng\ + GP_TITLE.pak tag_hash 0 / 16 + GP_TITLE.pak ixud_hash 0 / 16 + GP_PAUSE_MENU.pak name_hash 6 / 11 eng\ + GP_PAUSE_MENU.pak tag_hash 0 / 11 + GP_PAUSE_MENU.pak ixud_hash 0 / 11 + +## CONTROL the executable holds almost no asset names + sylpheed.db `strings`: 7140 rows, of which 2 look like asset paths + Data\gmicon002_2.t32 and Data\gmicon006_2.t32 + Data\gmicon002_2.t32 resolves anywhere: False + Data\gmicon006_2.t32 resolves anywhere: False + gmicon002_2.t32 resolves anywhere: False diff --git a/docs/re/structures/archive-naming.md b/docs/re/structures/archive-naming.md index e77eef2e..b7eacd45 100644 --- a/docs/re/structures/archive-naming.md +++ b/docs/re/structures/archive-naming.md @@ -55,6 +55,45 @@ uppercased, `.rat` substituted, `2d\`/`eng\`/`hud\`/`GP_MAIN_GAME_2D\` prefixed, and first-directory stripped. **Every one scored 0, both against the E2D pak's 711 entries and against all 16 630 entries on the disc.** +## 🔴 BLOCKED — three routes to those names, all closed + +Followed up the next iteration. Every avenue the container can reach is now +tried, each with a positive control in the same run: + +**1. A different hash family.** The corpus knows three +([idxd-tag-hash](idxd-tag-hash.md)): `name_hash` (pak TOC), `tag_hash` (IDXD +keys) and `ixud_hash`. Scoring all 5 977 harvested names × 6 prefixes: + +| archive | `name_hash` | `tag_hash` | `ixud_hash` | +|---|---:|---:|---:| +| `GP_TITLE` (control) | **8 / 16** | 0 | 0 | +| `GP_PAUSE_MENU` (control) | **6 / 11** | 0 | 0 | +| `GP_MAIN_GAME_E2D` | **0 / 711** | 0 | 0 | +| `GP_READY_ROOM` | 6 / 1 106 | 0 | 0 | + +`tag_hash` and `ixud_hash` explain **nothing anywhere**, including the paks +`name_hash` does explain — so they are not the TOC function, and the two +unnameable archives are not simply keyed by a different one. + +**2. The executable.** `sylpheed.db`'s `strings` table holds **7 140** rows, of +which exactly **two** look like asset paths — `Data\gmicon002_2.t32` and +`Data\gmicon006_2.t32`, in a `Data\` directory nothing else on the disc uses. +**Neither resolves in any archive.** So the binary is not the name source +either; it holds two strays and no table. + +**3. Name transformations** of the config paths — 13 of them, all 0 (above). + +🔴 **This is where the container runs out.** The 2D and `GP_READY_ROOM` TOC keys +hash names that are on neither the disc nor the executable in readable form. The +remaining lever is a *dictionary attack* using `name_hash`'s shape — the top byte +is the character-sum checksum, so candidates are cheap to reject — but that needs +a plausible name corpus, and this disc does not contain one. **Noted as blocked +rather than improvised around.** + +⚠️ The port does not need these names: the sprites and bundles are readable by +*content* (T8aD, RATC), and the config records already say which asset each HUD +element uses. Only the archive-key ↔ name mapping is missing. + ## 🟡 Not settled * What names the 2D and `GP_READY_ROOM` TOCs actually hash. The one lever left is diff --git a/tools/re-capture/archive_naming.py b/tools/re-capture/archive_naming.py index 40c5bc35..056a71fd 100644 --- a/tools/re-capture/archive_naming.py +++ b/tools/re-capture/archive_naming.py @@ -43,5 +43,24 @@ def main(): nd = sum(1 for h in ent if h in H) print(" %-30s %6d %6d %5.1f%%" % (nm, len(ent), nd, 100.0 * nd / len(ent) if ent else 0)) + def _ix(t): return U.ixud_hash([ord(c) for c in t]) + FN = [('name_hash', U.name_hash), ('tag_hash', U.tag_hash), ('ixud_hash', _ix)] + SUB = ['', '2d\\', 'eng\\', 'Data\\', 'ArmsSt\\', 'Marker\\'] + print("\n## CONTROL is the unnameable pair keyed by a DIFFERENT hash?") + print(" (6 prefixes x 3 hash families; the menu paks are the positive control)") + for nm in ['GP_MAIN_GAME_E2D.pak', 'GP_READY_ROOM.pak', 'GP_TITLE.pak', 'GP_PAUSE_MENU.pak']: + S = set(toc[nm]) + for fname, f in FN: + best = (0, '') + for p in SUB: + n = sum(1 for v in names if f(p + v) in S) + if n > best[0]: best = (n, p or '') + print(" %-22s %-10s %4d / %-5d %s" % (nm, fname, best[0], len(S), best[1])) + print("\n## CONTROL the executable holds almost no asset names") + print(" sylpheed.db `strings`: 7140 rows, of which 2 look like asset paths") + print(" Data\\gmicon002_2.t32 and Data\\gmicon006_2.t32") + for n in ['Data\\gmicon002_2.t32', 'Data\\gmicon006_2.t32', 'gmicon002_2.t32']: + print(" %-28s resolves anywhere: %s" % (n, U.name_hash(n) in H)) + if __name__ == "__main__": main()