wip: tool README, DuckDB wording, zq.py escape hatch

This commit is contained in:
MechaCat02
2026-09-13 19:42:26 +02:00
parent 8738e36374
commit 62b0f79590
7 changed files with 163 additions and 83 deletions

View File

@@ -2,8 +2,17 @@
"""Sylpheed static-analysis helper over DuckDB `sylpheed.db`.
Hides the gotchas: DECIMAL bounds (DuckDB rejects 0x literals), read-only connect,
and the fact that the engine vtable / rdata is NOT in the DB (read it from guest
memory with `xenia-rs exec ... --dump-addr=0x<va>` instead).
and the fact that the engine vtable / rdata is NOT in the DB.
🔴 THAT LAST LINE USED TO SAY "read it from guest memory with
`xenia-rs exec ... --dump-addr=0x<va>`". That emulator is retired, and the
command no longer exists -- see docs/agents/CONSOLIDATION.md. Two replacements,
both static, neither needing anything to run:
* the extracted PE is a FLAT VA DUMP: byte offset = VA - 0x82000000, so
`dd`/`xxd` on `*.pe` reads any address directly;
* `sylph-xexdb extract <xex>` regenerates that `.pe` (byte-identical, verified)
alongside a metadata JSON.
Usage:
zq.py dis <lo_hex> <hi_hex> # disassemble [lo,hi) (jump-table words shown as .long)