# Phase C — first byte-diff report

- canary image.bin: snap-001/canary/image.bin (9568256 bytes)
- ours   image.bin: snap-001/ours/image.bin (9568256 bytes)
- pe     reference: /home/fabi/RE - Project Sylpheed/Project Sylpheed - Arc of Deception (USA, Europe) (En,Ja).pe (9568256 bytes)
- image_base: 0x82000000
- import-slot ranges (merged): 3, bytes=3920

## Raw byte hashes
- canary sha256: `a70993b77ca9e29218d033fad7c0b45c874676c4e0edd966545d39b266486a9c`
- ours   sha256: `ea8d160e9369328a5b922258a92113efb8d7ce3e1a5c12cc521e375985c91c18`
- pe     sha256: `9be5f5621c517c78a451245eca25d54388af741ed20e669b2f78438aaa429e72`

## Pass 1 — raw byte-diff (uncanonicalized)

- first byte-diff at off=0x00000600 VA=0x82000600
- classification: .rdata (off=+0x0 into section)
- canary byte: 0xde
- ours   byte: 0x00
- pe ref byte: 0x00

context canary: `00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 de ad c0 de de ad c0 de de ad c0 de de ad c0 de de`
context ours  : `00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00`
context pe    : `00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 8c 00 00 02 bc 00 00 02 c1 00 00 02 d5 00`

## Pass 2 — canonicalized (import slots masked to 0xCD)

- canary canonical sha256: `62c51908e2df705583fe81a084f39bd399196f9000cfa7bffd56127b41a4ab96`
- ours   canonical sha256: `62c51908e2df705583fe81a084f39bd399196f9000cfa7bffd56127b41a4ab96`
- pe     canonical sha256: `62c51908e2df705583fe81a084f39bd399196f9000cfa7bffd56127b41a4ab96`

- **canary == ours canonical match ✅**
- the image_loaded_sha256 mismatch is **fully explained** by legitimate engine-specific import-thunk patches.
- NO real engine divergence at this layer.

## Pass 3 — engine vs .pe ground truth (canonicalized)

- canary canonical == pe canonical ✅
- ours canonical == pe canonical ✅

## Summary

- bytes differing raw: 3704
- bytes differing canonical: 0
- import-slot mask bytes: 3920