ebaa41df1a
Recon script, three capture templates (walk / parts / alpha-depth), runner, and operator README under tools/walk-oracle/oh/. FW0 line formats are kept byte-identical; new EC/OC/PD/DM/AM/FL/PM/PC line kinds are documented. Auto-detach uses the fall-through + top-level qd recipe; qd never appears inside a breakpoint action. Lead-resolved: DBObj::m_DID is +0x28 (header layout, first base of CGfxObj and CObjCell, matches the proven FW0 cell reads); the three D3DPolyRender alpha functions are static cdecl with stack arguments, uint8 arguments read with by(). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
75 lines
4.7 KiB
Text
75 lines
4.7 KiB
Text
* OH1 walk-oracle capture: WALK (2026-09-02). Adds the cell-shell/object-cell
|
|
* stamp events (EC/OC) to the exact proven FW0 F/P/LS/BLD/DI/DC per-frame
|
|
* shape. Frame count default 5 (substitute <FRAMES> via
|
|
* oh-run-capture.ps1 -Frames, or by hand).
|
|
*
|
|
* AUTO-DETACH: this file deliberately does NOT reuse FW0's own
|
|
* ".if (@$t0 >= 0nN) { qd } .else { gc }" shape -- that puts `qd` inside a
|
|
* CONDITIONAL bp action, which the project's own retail-debugger toolchain
|
|
* memory documents as NEVER FIRING (qd/q/qq inside a bp action is silently
|
|
* ignored; re-confirmed the hard way on issue #177, see
|
|
* claude-memory/project_retail_debugger.md). Instead this uses the proven
|
|
* tools/cdb/pview-spiral2.cdb recipe: the frame-marker bp's action calls
|
|
* `gc` while below threshold and simply omits `gc` on the terminal hit (so
|
|
* the action "falls through" and the whole process genuinely stops); control
|
|
* then returns to the script's single top-level `g`, and a TOP-LEVEL `qd`
|
|
* (not inside any bp action) detaches cleanly. Every other bp in this file
|
|
* always `gc`s unconditionally -- only the frame marker decides when to
|
|
* stop, exactly like every other capture script in this directory.
|
|
*
|
|
* LINE FORMATS:
|
|
* F <n> -- unchanged from FW0
|
|
* P <cellid> <ox> <oy> <oz> <qw> <qx> <qy> <qz> -- unchanged from FW0
|
|
* LS -- unchanged from FW0
|
|
* BLD <cellid> -- unchanged from FW0
|
|
* DI <cellid> -- unchanged from FW0
|
|
* DC pv=<PView*> ov=<n> n=<n>: <ids...> -- unchanged from FW0
|
|
* EC <cellid> -- NEW. RenderDeviceD3D::DrawEnvCell
|
|
* @0x0059F170 entry; id is the
|
|
* CEnvCell's m_DID (arg2+0x28).
|
|
* OC <cellid> -- NEW. RenderDeviceD3D::
|
|
* DrawObjCellForDummies
|
|
* @0x005A0760 entry; id is the
|
|
* CObjCell's m_DID (arg2+0x28).
|
|
* EC/OC together let a human line up "which cell shells/object lists did
|
|
* PView::DrawCells' reverse loops (steps 9-10 in oh1-depth-lifecycle.md)
|
|
* actually stamp-draw this frame" against the DC line's flood-cell roster.
|
|
*
|
|
* OFFSETS (VERIFY-IN-RECON -- see oh-recon.cdb, all in this file's dt list):
|
|
* CEnvCell+0x28 / CObjCell+0x28 = m_DID -- PROVEN, not a guess: this is
|
|
* the exact offset the existing FW0 DI/DC/BLD lines already read in
|
|
* production captures (docs/research/2026-08-30-fw-walk-oracle/*.log),
|
|
* and CEnvCell : CObjCell (acclient.h:32072) shares the base-class
|
|
* layout, so DrawObjCellForDummies's CObjCell* argument reads the same
|
|
* way. Still listed in oh-recon.cdb's dt for a fresh re-confirmation.
|
|
* RenderDeviceD3D::DrawEnvCell(this@ecx, CEnvCell* arg2) -- arg2 @ esp+4.
|
|
* Signature: acclient_2013_pseudo_c.txt:427885. Same "this@ecx, one
|
|
* stack arg" shape as the already-proven DrawBuilding/DrawInside hooks.
|
|
* RenderDeviceD3D::DrawObjCellForDummies(this, CObjCell* arg2) -- plain
|
|
* __thiscall, arg2 @ esp+4. Signature: acclient_2013_pseudo_c.txt:429177.
|
|
*
|
|
* BEFORE USE: replace <FRAMES> (plain decimal digits, e.g. "5" -- the
|
|
* template already supplies the "0n" decimal-radix prefix) and <LOG>
|
|
* (output path). oh-run-capture.ps1 -Frames does this substitution.
|
|
* <VPOS> is pre-resolved to Render::viewer_pos @0x0081ef00 (the address the
|
|
* FW0 posed captures already used successfully -- see
|
|
* claude-memory/project_frame_walk_campaign.md 2026-08-30 evening entry and
|
|
* tools/walk-oracle/fw0-capture-pose.cdb.template's own <VPOS> note). Re-run
|
|
* `x acclient!*viewer_pos*` in oh-recon.cdb if this session's binary differs.
|
|
|
|
.logopen <LOG>
|
|
.sympath C:\Users\erikn\source\repos\acdream\refs
|
|
.symopt+ 0x40
|
|
.reload /f acclient.exe
|
|
r $t0 = 0
|
|
bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0081ef00+4), poi(0081ef00+0x3c), poi(0081ef00+0x40), poi(0081ef00+0x44), poi(0081ef00+8), poi(0081ef00+0xc), poi(0081ef00+0x10), poi(0081ef00+0x14); .if (@$t0 < 0n<FRAMES>) { gc }"
|
|
bp 005a4840 "r $t2 = poi(@ecx+0x60); .printf \"DC pv=%08x ov=%d n=%d:\", @ecx, poi(@ecx+0x38), @$t2; r $t3 = poi(@ecx+0x50); r $t4 = 0; .while (@$t4 < @$t2) { r $t5 = poi(@$t3 + @$t4*4); .printf \" %08x\", poi(@$t5+0x28); r $t4 = @$t4 + 1 }; .printf \"\\n\"; gc"
|
|
bp 005a5860 ".printf \"DI %08x\\n\", poi(poi(@esp+4)+0x28); gc"
|
|
bp 00506330 ".printf \"LS\\n\"; gc"
|
|
bp 0059f2a0 ".printf \"BLD %08x\\n\", poi(poi(@esp+4)+0x4c); gc"
|
|
bp 0059f170 ".printf \"EC %08x\\n\", poi(poi(@esp+4)+0x28); gc"
|
|
bp 005a0760 ".printf \"OC %08x\\n\", poi(poi(@esp+4)+0x28); gc"
|
|
g
|
|
.echo ===DETACHING===
|
|
qd
|
|
.logclose
|