fabi/Syplheed-Reborn
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

re: the base-solver's confidence axis was inverted

Browse Source 
The remaining named false-positive mode - "107 rows solve to a 64K-boundary
base, a bare addis with no addi of its own, so any scatter of displacements
votes for it" - is refuted by its own measurement.

New positive test in the tool: simulate lis/addis rD,r0,HI + addi rD,rA,N +
or rD,rA,rA forward through each row's function and ask whether the solved
base lands in the solved register.

  64K-boundary bases ("low confidence") : 107 / 107 confirmed
  non-zero low half ("trustworthy")     :   8 / 154 confirmed

A round base is the case where the compiler needed no second instruction, so
`addis r11, r0, 0x820B` stands in the code in full. A miss on the other class
is silence (base built in the caller or loaded from memory), not refutation.

Control: every row the corpus independently validated against the disc has a
64K-boundary base - debriefing, career, save, leaderboard, the 205-name PG*
HUD roster, material slots, the S16 boss collision/frames/motions and its
loader. 13 rows over 10 functions. The dense-short-string false positives the
corpus did name (r31 = 0x8202xxxx) all sit in the "trustworthy" class.

The 0x820B0000 cluster is DUPLICATION, not error: 60 of its 82 rows are one
function emitted 60 times, exactly 491 instructions each, two instructions
differing (both global data pointers), identical 41-address string sequences.
40 resource names written into a per-copy global via sub_8217FA08 at 24-byte
strides. 38 of the 40 are disc GameResourceID values (480 distinct); rot_n001
and rou_e202 are not, and no disc GameResourceID uses the rot_ prefix.

Artefact diff 13/4, confined to the replaced section; the 261-row table and
the 64K histogram untouched; byte-identical on a second run. Fourteen other
artefacts byte-identical.
This commit is contained in:
Sylpheed RE agent
2026-08-28 00:42:46 +00:00
parent bb6fb9024b
commit 105ccab038
4 changed files with 222 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
docs/re/data/name-block-bases.txt
View File

@@ -268,16 +268,25 @@
sub_82766DB0 r11 0x82050000 12 / 29
sub_827D7C00 r11 0x82060000 12 / 14
## Confidence split
bases with a non-zero low half (a real `addis`+`addi` pair): 154
bases on a 64K boundary (LOW CONFIDENCE, see below) : 107
## Is the base built by the function itself? (positive test only)
rows whose function materialises the solved base into the solved register: 115 / 261
bases on a 64K boundary : 107 / 107
bases with a non-zero low half : 8 / 154
A 64K-boundary base is `addis rX, r0, 0xHHHH` written out in full, so it confirms
directly; it is NOT the low-confidence class it was first called. A non-zero low
half usually means the base was built in the caller or loaded from memory, which
the simulation cannot see -- a miss there is silence, not a refutation.
64K-boundary bases by value:
0x820B0000 x82 rows
0x82030000 x10 rows
0x82050000 x7 rows
0x820A0000 x5 rows
0x82040000 x2 rows
0x82060000 x1 rows
⚠ the 0x820B0000 cluster is ~60 near-identical functions in 0x8281xxxx-0x8284xxxx that all name the same `rou_e0NN` list.
⚠ 60 of the 0x820B0000 rows are one function emitted 60 times: exactly 491
instructions each, an identical sequence of 41 string addresses, differing only
in two global data pointers. That is DUPLICATION, not error.
## Is the row a DATA-TABLE schema? (names that are IDXD record/field names on the disc)
distinct IDXD record+field names disc-wide: 13450