fabi/Sylpheed
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

re: BLOCKED -- the 2D / READY_ROOM TOC names, three routes closed with controls

Browse Source 
1. A different hash family.  The corpus knows three (idxd-tag-hash.md):
name_hash, tag_hash, ixud_hash.  Scoring all 5977 harvested names x 6
prefixes: GP_TITLE 8/16 and GP_PAUSE_MENU 6/11 under name_hash (the
positive controls), and tag_hash and ixud_hash explain NOTHING anywhere
-- including the paks name_hash does explain.  So they are not the TOC
function, and the unnameable pair is not keyed by a different one.
GP_MAIN_GAME_E2D stays at 0/711 under all three.

2. The executable.  sylpheed.db's strings table holds 7140 rows, of
which exactly two look like asset paths -- Data\gmicon002_2.t32 and
Data\gmicon006_2.t32, in a Data\ directory nothing else on the disc
uses -- and neither resolves in any archive.  The binary is not the name
source; it holds two strays and no table.

3. Name transformations -- 13 of them on the 419 config paths, all 0.

The container runs out here.  Those TOC keys hash names that exist on
neither the disc nor the executable in readable form.  The only lever
left is a dictionary attack using name_hash's shape (top byte = the
character-sum checksum), and that needs a plausible name corpus this
disc does not contain.  Noted as blocked rather than improvised around.

The port does not need these names: sprites and bundles are readable by
content (T8aD, RATC), and the config records already say which asset
each HUD element uses.  Only the archive-key to name mapping is missing.

Artefact +22 lines / 0 deletions; the other eight regenerate
byte-identical.
This commit is contained in:
Sylpheed RE agent
2026-08-27 15:22:13 +00:00
parent 4e9d7deeb8
commit 431461a175
4 changed files with 107 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
docs/re/BACKLOG.md
View File

@@ -827,6 +827,33 @@ unknown, what evidence exists, and what the first step would be. Move an item in
field; the stat keys in records not opened here (`MegaTons`, `BulletLimit`,
`CrewCount`, `HP_CLASS`); why the roster lists 59 of 131.
* 🔴 **(2026-08-27) BLOCKED — the 2D / `GP_READY_ROOM` TOC names: three routes,
all closed, each with a control.**
[structures/archive-naming](structures/archive-naming.md), artefact
`data/archive-naming.txt` (+22 lines, 0 deletions — purely additive).
**1. A different hash family.** The corpus knows three (`idxd-tag-hash.md`):
`name_hash`, `tag_hash`, `ixud_hash`. Scoring all **5 977** harvested names x 6
prefixes: `GP_TITLE` **8/16** and `GP_PAUSE_MENU` **6/11** under `name_hash`
(the positive controls), and **`tag_hash` and `ixud_hash` explain NOTHING
anywhere** — including the paks `name_hash` does explain. So they are not the
TOC function and the unnameable pair is not keyed by a different one.
`GP_MAIN_GAME_E2D` stays at **0/711** under all three.
**2. The executable.** `sylpheed.db`'s `strings` holds **7 140** rows, of which
exactly **TWO** look like asset paths — `Data\gmicon002_2.t32` and
`Data\gmicon006_2.t32`, in a `Data\` directory nothing else on the disc uses —
and **neither resolves in any archive**. The binary is not the name source; it
holds two strays and no table.
**3. Name transformations** — 13 of them on the 419 config paths, all 0.
🔴 **The container runs out here.** Those TOC keys hash names that exist on
neither the disc nor the executable in readable form. The only lever left is a
dictionary attack using `name_hash`'s shape (top byte = character-sum
checksum, so candidates are cheap to reject), and that needs a plausible name
corpus this disc does not contain. **Noted as blocked rather than improvised
around.**
⚠️ **The port does not need these names**: sprites and bundles are readable by
CONTENT (T8aD, RATC), and the config records already say which asset each HUD
element uses. Only the archive-key ↔ name mapping is missing.
* ✅ **(2026-08-27) WHICH ARCHIVES THE DISC CAN NAME — 100 % for eleven menu
paks, **0.0 %** for all six 2D paks AND `GP_READY_ROOM`.**
[structures/archive-naming](structures/archive-naming.md), artefact

22
docs/re/data/archive-naming.txt
View File

@@ -47,3 +47,25 @@
fonts.pak 3 3 100.0%
GP_SYSTEM.pak 2 2 100.0%
GP_TUTORIAL.pak 2 2 100.0%
## CONTROL is the unnameable pair keyed by a DIFFERENT hash?
(6 prefixes x 3 hash families; the menu paks are the positive control)
GP_MAIN_GAME_E2D.pak name_hash 0 / 711
GP_MAIN_GAME_E2D.pak tag_hash 0 / 711
GP_MAIN_GAME_E2D.pak ixud_hash 0 / 711
GP_READY_ROOM.pak name_hash 6 / 1106 <bare>
GP_READY_ROOM.pak tag_hash 0 / 1106
GP_READY_ROOM.pak ixud_hash 0 / 1106
GP_TITLE.pak name_hash 8 / 16 eng\
GP_TITLE.pak tag_hash 0 / 16
GP_TITLE.pak ixud_hash 0 / 16
GP_PAUSE_MENU.pak name_hash 6 / 11 eng\
GP_PAUSE_MENU.pak tag_hash 0 / 11
GP_PAUSE_MENU.pak ixud_hash 0 / 11
## CONTROL the executable holds almost no asset names
sylpheed.db `strings`: 7140 rows, of which 2 look like asset paths
Data\gmicon002_2.t32 and Data\gmicon006_2.t32
Data\gmicon002_2.t32 resolves anywhere: False
Data\gmicon006_2.t32 resolves anywhere: False
gmicon002_2.t32 resolves anywhere: False

39
docs/re/structures/archive-naming.md
View File

@@ -55,6 +55,45 @@ uppercased, `.rat` substituted, `2d\`/`eng\`/`hud\`/`GP_MAIN_GAME_2D\` prefixed,
and first-directory stripped. **Every one scored 0, both against the E2D pak's
711 entries and against all 16 630 entries on the disc.**
## 🔴 BLOCKED — three routes to those names, all closed
Followed up the next iteration. Every avenue the container can reach is now
tried, each with a positive control in the same run:
**1. A different hash family.** The corpus knows three
([idxd-tag-hash](idxd-tag-hash.md)): `name_hash` (pak TOC), `tag_hash` (IDXD
keys) and `ixud_hash`. Scoring all 5 977 harvested names × 6 prefixes:
| archive | `name_hash` | `tag_hash` | `ixud_hash` |
|---|---:|---:|---:|
| `GP_TITLE` (control) | **8 / 16** | 0 | 0 |
| `GP_PAUSE_MENU` (control) | **6 / 11** | 0 | 0 |
| `GP_MAIN_GAME_E2D` | **0 / 711** | 0 | 0 |
| `GP_READY_ROOM` | 6 / 1 106 | 0 | 0 |
`tag_hash` and `ixud_hash` explain **nothing anywhere**, including the paks
`name_hash` does explain — so they are not the TOC function, and the two
unnameable archives are not simply keyed by a different one.
**2. The executable.** `sylpheed.db`'s `strings` table holds **7 140** rows, of
which exactly **two** look like asset paths — `Data\gmicon002_2.t32` and
`Data\gmicon006_2.t32`, in a `Data\` directory nothing else on the disc uses.
**Neither resolves in any archive.** So the binary is not the name source
either; it holds two strays and no table.
**3. Name transformations** of the config paths — 13 of them, all 0 (above).
🔴 **This is where the container runs out.** The 2D and `GP_READY_ROOM` TOC keys
hash names that are on neither the disc nor the executable in readable form. The
remaining lever is a *dictionary attack* using `name_hash`'s shape — the top byte
is the character-sum checksum, so candidates are cheap to reject — but that needs
a plausible name corpus, and this disc does not contain one. **Noted as blocked
rather than improvised around.**
⚠️ The port does not need these names: the sprites and bundles are readable by
*content* (T8aD, RATC), and the config records already say which asset each HUD
element uses. Only the archive-key ↔ name mapping is missing.
## 🟡 Not settled
* What names the 2D and `GP_READY_ROOM` TOCs actually hash. The one lever left is