docs: the bit-level OB flag is refuted - two transitions, no common survivor
The short-run strategy paid off: both counter steps happen in the first minutes of flight, so one run yielded two complete passes before anything froze or was killed. Pass 1 scanned at counter 4 and filtered on 4->8, leaving 29 of 710 candidates; pass 2 scanned at 8 and filtered on 8->12, leaving 2 of 197. The intersection of the two survivor sets is EMPTY. So no per-entity bit, in either polarity, anywhere in -0x400..+0xC00 around the position triple, has a population that tracks REMAINING OB. With the word-level refutation that closes the "objectives are marked in the entity object" family as far as this method reaches. Also recorded: 16 of pass 1's 29 survivors are the SAME word, pos+0x0250, with sixteen different bits - the signature of a shared value rather than a flag, and the same offset the word-level sweep found shared by 12 attackers. And a caveat kept rather than smoothed: pass 2's B-sample HUD read 8 while RAM read 12. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PMRJjbxLqZtsb5Vb7KunPE
This commit is contained in:
Sylpheed RE agent
186
docs/re/captures/ob-bitflag-refuted-stage02.json
Normal file
186
docs/re/captures/ob-bitflag-refuted-stage02.json
Normal file
@@ -0,0 +1,186 @@
|
||||
{
|
||||
"pass1": {
|
||||
"nA": 4,
|
||||
"nB": 8,
|
||||
"hud_a": 4,
|
||||
"hud_b": 8,
|
||||
"entities_a": 24,
|
||||
"entities_b": 74,
|
||||
"candidates_a": {
|
||||
"set": 255,
|
||||
"clear": 455
|
||||
},
|
||||
"survivors": [
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 1
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 4
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 5
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 2080,
|
||||
"bit": 5
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 2100,
|
||||
"bit": 5
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 348,
|
||||
"bit": 6
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 8
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 9
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 10
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 624,
|
||||
"bit": 10
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 1936,
|
||||
"bit": 12
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 13
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 14
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 2084,
|
||||
"bit": 14
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 388,
|
||||
"bit": 16
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 16
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 640,
|
||||
"bit": 16
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 18
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 984,
|
||||
"bit": 18
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 19
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 20
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 628,
|
||||
"bit": 21
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 23
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 24
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 25
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 592,
|
||||
"bit": 29
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 636,
|
||||
"bit": 30
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 644,
|
||||
"bit": 31
|
||||
},
|
||||
{
|
||||
"polarity": "clear",
|
||||
"offset": 1204,
|
||||
"bit": 25
|
||||
}
|
||||
]
|
||||
},
|
||||
"pass2": {
|
||||
"nA": 8,
|
||||
"nB": 12,
|
||||
"hud_a": 8,
|
||||
"hud_b": 8,
|
||||
"entities_a": 100,
|
||||
"entities_b": 217,
|
||||
"candidates_a": {
|
||||
"set": 133,
|
||||
"clear": 64
|
||||
},
|
||||
"survivors": [
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 1080,
|
||||
"bit": 17
|
||||
},
|
||||
{
|
||||
"polarity": "set",
|
||||
"offset": 2096,
|
||||
"bit": 25
|
||||
}
|
||||
]
|
||||
},
|
||||
"intersection": []
|
||||
}
|
||||
@@ -269,3 +269,43 @@ The freeze was caught in about a minute by `frozen()` instead of consuming the
|
||||
whole 700 s window — which is the difference the guard makes, and the only thing
|
||||
this attempt bought. Still **no verification**: four runs, four windows, zero
|
||||
second transitions.
|
||||
|
||||
---
|
||||
|
||||
## 🔴 2026-08-24 — the BIT-level flag is refuted too, on two independent transitions
|
||||
|
||||
The short-run strategy worked: both counter steps happen in the first minutes of
|
||||
flight, so `ob_bitflag.py` got two complete passes out of one run before anything
|
||||
could freeze or be killed.
|
||||
|
||||
| pass | scan | filter | candidates at A | survivors |
|
||||
|---|---|---|---|---|
|
||||
| 1 | counter **4**, 24 entities | **4 → 8** (HUD confirmed) | 255 set + 455 clear | **29** |
|
||||
| 2 | counter **8**, 100 entities | **8 → 12** | 133 set + 64 clear | **2** |
|
||||
|
||||
**The intersection of the two survivor sets is EMPTY.**
|
||||
([`captures/ob-bitflag-refuted-stage02.json`](captures/ob-bitflag-refuted-stage02.json))
|
||||
|
||||
Not one `(offset, bit)` survives two independently selected transitions. So there
|
||||
is **no per-entity bit** — in either polarity, anywhere in `-0x400 … +0xC00`
|
||||
around the position triple — whose population tracks `REMAINING OB`. Together
|
||||
with the word-level refutation this closes the "objectives are marked in the
|
||||
entity object" family as far as this method can reach.
|
||||
|
||||
### Why pass 1 looked richer than it was
|
||||
|
||||
**16 of its 29 survivors are the same word**, `pos+0x0250`, with sixteen
|
||||
different bits. That is the signature of a **shared value**, not a flag: if four
|
||||
entities hold the identical word at `+0x250`, every set bit of it "survives"
|
||||
together, and the bit framing is spurious. It is the same offset the word-level
|
||||
sweep found shared by 12 attackers (`pos+0x0250 = 239d6732`), so `+0x250` is a
|
||||
per-class or per-group word — a parameter or a pointer — and its bit counts track
|
||||
the class population rather than the objective count.
|
||||
|
||||
⚠️ **One reading caveat, kept:** pass 2's B-sample HUD read `8` while RAM read
|
||||
`12`; the address had been HUD-verified at sample A and the RAM value is what the
|
||||
filter used, but the confirming screenshot at that instant did not agree.
|
||||
|
||||
**What is still not ruled out** is unchanged from the word-level pass: anything
|
||||
outside the window, and anything on entities `entities2.typed` cannot see (it
|
||||
types by position *changing*, so stationary objectives are invisible).
|
||||
|
||||
Reference in New Issue
Block a user