Joseph Doherty
460c61df43
Five-stage Ghidra headless decompile traces the byte-to-MXSTATUS_PROXY synthesis path end-to-end across LmxProxy.dll and Lmx.dll. New evidence files committed alongside R3/R4 verdict update: - analysis/ghidra/exports/LmxProxy.dll.fire-event-xrefs.md - analysis/ghidra/exports/LmxProxy.dll.status-synthesis-decompile.md - analysis/ghidra/exports/LmxProxy.dll.mxstatus-safearray-decompile.md - analysis/ghidra/exports/Lmx.dll.set-attribute-result-decompile.md Layer-by-layer findings (bytes flow inward; synthesis flows outward): 1. `Lmx.aaDCT` at 0x10178fc0 is `SysAllocString(L"Lmx.aaDCT")` — a tracing category BSTR, not a table. 2. `MXSTATUS_PROXY` is a 16-byte marshalled struct (4 × i16 padded to i32 boundaries with Pack=4) — the OUTPUT of synthesis, not a lookup entry. 3. `LmxProxy.dll` Fire_* event handlers receive already-populated `MXSTATUS_PROXY[]` and forward through ATL dispatch — no synthesis. 4. `LmxProxy.dll` Fire_* CALLERS (FUN_1001657f / FUN_10016b50 / FUN_10016d4b) call FUN_10003f60(out_safearray, in_status_ptr, count=1) which is a VERBATIM memcpy of an existing 14-byte buffer into the SAFEARRAY — no transformation. 5. `Lmx.dll`'s `PreboundReference::OnSetAttributeResult` (FUN_10114a90) receives an already-populated `short *param_7` status buffer. Log line confirms the layout: `<success %d category %d detectedBy %d detail %d>`. Dispatches on typed values — synthesis is upstream of this function too. The synthesizer is the NMX-frame decoder in Lmx.dll that calls OnSetAttributeResult / OnGetAttributeResult / equivalent OperationComplete handler. The decoder takes raw NMX bytes plus operation context (item handle, engine state, retry state, correlation id) and computes the populated MXSTATUS_PROXY. There is NO static lookup table — synthesis is per-message contextual. Two viable paths to typed promotion (both substantial; neither a small codec patch): - Path A: port the synthesizer. ~1-2 weeks. Requires extending the Rust session to track per-operation context (handles, retries, correlation ids). Out of V1 scope. - Path B: empirical capture pairs. ~30 min × 6-10 scenarios. Output is a (byte, context → status) mapping that approximates without re-implementing. Risk: mapping is only valid for captured contexts. R3/R4 stay settled at verbatim-preserve. The .NET reference does the same for the same reason: the synthesizer is too context- dependent to mirror without porting the entire operation-tracking state machine. Reopen criteria sharpened: either (a) a consumer files a concrete use case for typed promotion of a specific byte+context combination (Path B's empirical capture for that one combination is the cheapest answer); or (b) a major-version bump justifies the state-machine port (Path A). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
35 lines
706 B
Markdown
35 lines
706 B
Markdown
# LmxProxy.dll xrefs
|
|
|
|
## 0x15f72 at 10015f72
|
|
|
|
Target function: `FUN_10015f72`
|
|
|
|
| From | Ref type | Caller function |
|
|
| --- | --- | --- |
|
|
| `1001695a` | `UNCONDITIONAL_CALL` | `FUN_1001657f` |
|
|
|
|
## 0x1611f at 1001611f
|
|
|
|
Target function: `FUN_1001611f`
|
|
|
|
| From | Ref type | Caller function |
|
|
| --- | --- | --- |
|
|
| `10016cc8` | `UNCONDITIONAL_CALL` | `FUN_10016b50` |
|
|
|
|
## 0x16271 at 10016271
|
|
|
|
Target function: `FUN_10016271`
|
|
|
|
| From | Ref type | Caller function |
|
|
| --- | --- | --- |
|
|
| `10016eb3` | `UNCONDITIONAL_CALL` | `FUN_10016d4b` |
|
|
|
|
## 0x163c0 at 100163c0
|
|
|
|
Target function: `FUN_100163c0`
|
|
|
|
| From | Ref type | Caller function |
|
|
| --- | --- | --- |
|
|
| `10016ad8` | `UNCONDITIONAL_CALL` | `FUN_1001657f` |
|
|
|