An empty pair list had two causes and one verdict. When the run never found the import
table at all, the report said needs-trace, which sends the reader off to write a trace of
the protector's resolver -- the right move for a table full of handles and the wrong move
for a table this run simply never located. The misdiagnosis is the expensive kind: it
costs a debugger session and it looks like progress.
decide_result now returns no-slots when the inventory is empty, and the printed hint says
which of the two it is (supply --iat, or reconstruct the table). no-slots exits 1 with
needs-trace, because the run did not do the job it was asked to do; the docstring's exit
code table says so.
The reference gains the matching sentence in the inventory step: an inventory that came
back empty is a finding about the run, not a table that holds no addresses.
Test: test_no_slot_values_is_its_own_verdict pins both sides -- no slots plus unpaired
calls is no-slots, some slots plus unpaired calls is still needs-trace -- and the existing
token test now carries a slot count so it cannot pass for the wrong reason.
references/iat-virtualization-and-call-site-rewriting.md records the two edits one
protector family makes to a native image: the import slot stops holding an address and
the indirect call that read it becomes a relative call to a stub. It carries the pairing
rule -- a site's target equals a slot's value -- the three placements of the filler byte
in a six-byte rewrite and the refusal when there is none, the divergence between builds
that modify the code section and builds that only redirect the table, the small set of
imports redirected twice, the choice between repairing, extracting a payload, observing
and reporting, and the limits an automatic unpacker inherits from its own dump.
scripts/iat_callsite_restore.py implements the mechanical half offline: inventory the
slots from three sources, pair by value, decide the six-byte window per site, refuse an
ambiguous slot and a site whose sixth byte is the next instruction, rewrite, then
re-decode every written site from the file it wrote. It is report-only unless --out is
given, and it does not unpack: a virtualised entry has no site list to restore.
Registered in both symptom tables, the routing, reference and script indexes, the
capability registry as call_site_restore, and the coverage, route-inventory and evidence
tables. dynamic-debugging.md gains the instrument rule the second write-up demonstrates
(a target that runs at full speed and dies when stopped has a perturbation detector),
memory-and-dumps.md gains the call-site step of a rebuild, environment.md gains the
compatibility-shim trap, and protectors-and-packers.md gains one recognition row plus a
pointer rather than the detail, because that file makes no product-level claims.
The target-behaviour claims stay unverified: no protected sample was analysed here. What
is observed is the tool's behaviour on a generated image -- both filler positions, both
refusals, both displacement forms -- and what the source material states about itself.
FINDINGS F16 records the defect this pass produced, a slot's magnitude read as its
meaning, with the test that fails without the fix. .gitignore gains ref/, which was not
covered by the existing rule because that rule carries a leading dot.
- check_budget.py escalated a hard index-row violation to 'warn' on both
branches, so INDEX_ROW_HARD could never fail anything. It fails now, and
tests/unit/test_budget_measurement.py pins both thresholds.
- The corpus note counted scripts/__pycache__/*.pyc, so the same commit
reported 27 scripts after the suite had run and 16 on a clean checkout.
- TOKENS_PER_CHAR is re-derived from a measurement (26,795 chars -> 6,065
tokens = 4.418); the comment's old figure and its arithmetic were both
wrong for this file.
- check_repo.py's yaml sentinel carries the type ignore, so mypy is clean
with PyYAML installed as well as without it.
- The CPUID test now skips with the probe's own note on a host without
CPUID instead of failing, and pytest.ini points at tests/README.md, which
exists, instead of an EXTENSION file that never did.
Tooling: .flake8 (a measured 120-column limit), .gitattributes, .gitignore
and .github/workflows/ci.yml (the five gates, the suite on 3.11-3.14 and a
lint job), which is what CONTRIBUTING.md already claimed CI runs. The
pull-request template it refers to now exists.
Content: pitfalls P26-P34 -- the analysis-level failures the catalogue was
missing (sampling read as observation, a self-built parser trusted, a
verification that could not have failed, a shell-mangled command line) --
registered in the symptom index and its routing mirror. FINDINGS F11-F15
record the defects above.
Tests: the coverage guard derives its subject from scripts/ rather than a
hand-written list, pe_triage.py and pe_diff.py gain their first tests, and
plan.py / preflight.py are declared uncovered with reasons.
root