Files
Sylpheed/tools/re-capture/ob_hunt.py
Sylpheed RE agent ca133c0220 tools+docs: the bit-level OB test, and a liveness hole - GAME OVER animates
ob_bitflag.py is the follow-on the word-level refutation named: for every 4-byte
offset in the window and every one of its 32 bits, count how many entities have
it set, keep the pairs whose count is exactly the counter, and require them to
match again after a transition. Both polarities, since an objective could be
marked by a bit that is CLEAR on it.

Three runs, no verification, and the reasons are recorded: run 1 gave 187 + 33
candidates at counter 4 and then reported "the counter never moved" for 700 s -
about a mission that had ENDED in GAME OVER partway through; run 2 hit the same
dead mission; run 3 had the counter at a different address (the guard refused,
correctly) and then froze after one filter.

The hole is closed. frozen() asks whether the guest is ANIMATING, and the GAME
OVER screen animates happily - mean colour (114,22,63) - so every liveness check
passed while the mission was over. frozen.in_flight() classifies the screen with
screen_id, and ob_hunt/ob_flag/ob_bitflag now abort with NO LONGER IN FLIGHT.
That is the second confident negative in this investigation that was really about
a dead world, so the rule is written down: before believing "X never happened",
show that the thing that would produce X was still running.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PMRJjbxLqZtsb5Vb7KunPE
2026-08-24 00:20:04 +00:00

121 lines
4.6 KiB
Python
Executable File

#!/usr/bin/env python3
"""Find `REMAINING OB` in RAM by value-scanning against the HUD, automatically.
The method is `ob_scan.py`'s, and the two traps it records are what this
automates away, because both were paid twice by hand:
* **Confirm the HUD on BOTH sides of the scan.** The scan itself takes ~0.9 s,
but the counter climbs 004 -> 008 -> 012 within the first minutes of Stage 02,
and a scan taken across a step selects nothing. A pass whose before- and
after-readings disagree is thrown away and retried rather than used.
* **Verify across a transition you did NOT select on.** The first filter only
narrows; the SECOND one is the evidence. Two hand attempts each managed one
filter and then lost the counter — once because the pilot stopped killing
anything, once because the mission ended.
The HUD is read by `ob_read.py`, which returns `?` rather than a wrong digit, so
an unreadable frame (explosion, GAME OVER) stalls the hunt instead of poisoning
it.
Usage: ob_hunt.py <out-dir> [transitions] [timeout_s]
"""
import json
import os
import subprocess
import sys
import time
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
import frozen # noqa: E402
import gmem # noqa: E402
import ob_read # noqa: E402
import ob_scan # noqa: E402
def hud(shot):
subprocess.run(["screenshot", shot], stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL)
txt, _ = ob_read.read(shot)
return int(txt) if txt.isdigit() else None
def main():
out = sys.argv[1]
want = int(sys.argv[2]) if len(sys.argv) > 2 else 2
deadline = time.time() + (float(sys.argv[3]) if len(sys.argv) > 3 else 900)
os.makedirs(out, exist_ok=True)
mem = gmem.mem_path()
log = lambda *a: print(*a, flush=True)
# --- the scan, with the HUD confirmed on both sides -----------------------
cands = None
while cands is None and time.time() < deadline:
v0 = hud(f"{out}/scan-before.png")
if v0 is None:
time.sleep(3)
continue
offs = ob_scan.scan(mem, v0)
v1 = hud(f"{out}/scan-after.png")
if v1 != v0:
log(f"scan at {v0} discarded: HUD moved to {v1} across it")
continue
cands = offs
log(f"scanned at {v0:03d}: {len(cands)} candidates")
if cands is None:
log("never got a clean scan")
return 1
# --- filter on each following transition ---------------------------------
prev, done, results = v0, 0, []
stuck = 0
while done < want and time.time() < deadline:
time.sleep(5)
v = hud(f"{out}/poll.png")
if v is None or v == prev:
# "the counter never moved" is a claim about the GAME; a frozen
# guest makes it a claim about a dead world instead, and the run
# then burns its whole timeout saying nothing. Measured once: the
# world stopped ~10 s into flight and everything downstream --
# screen_id, the liveness check, the CPU -- stayed happy.
stuck += 1
if stuck % 12 == 0:
if frozen.frozen(6.0)[0]:
log("GUEST FROZEN — the world stopped advancing; abandoning")
break
if not frozen.in_flight():
log("NO LONGER IN FLIGHT — the mission ended; abandoning")
break
continue
stuck = 0
# Confirm the new value before spending a filter on it.
time.sleep(1.5)
if hud(f"{out}/poll2.png") != v:
continue
vals = ob_scan.read_at(mem, cands)
cands = [o for o, x in vals.items() if x == v]
done += 1
kind = "SELECTED ON" if done == 1 else "verification (unselected)"
log(f"{prev:03d} -> {v:03d} [{kind}] {len(cands)} survive")
results.append({"from": prev, "to": v, "survivors": len(cands)})
prev = v
if not cands:
log("no survivors — the scan value or a reading was wrong")
break
payload = {"scan_value": v0, "transitions": results,
"survivors": [{"off": o, "va": gmem.primary_va(o)} for o in sorted(cands)]}
json.dump(payload, open(f"{out}/hunt.json", "w"), indent=1)
# Cap the listing. On a clean run this is a handful of addresses; on an
# aborted one (frozen guest, no transition) it is the whole scan, and 21 482
# lines of noise buried the one line that mattered.
for o in sorted(cands)[:40]:
log(f" va {gmem.primary_va(o):#x}")
if len(cands) > 40:
log(f" ... and {len(cands) - 40} more (see hunt.json)")
log(f"wrote {out}/hunt.json")
return 0
if __name__ == "__main__":
raise SystemExit(main())