From 1323ec88525aee44e277ad379dec5bbcaf244beb Mon Sep 17 00:00:00 2001 From: gamer147 Date: Tue, 7 Jul 2026 11:46:17 -0400 Subject: [PATCH] chore: pe-sieve32.exe -> bin/ (3rd-party binary convention) + doc refs Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/PROJECT-STRUCTURE.md | 3 ++- docs/engine-re.md | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/PROJECT-STRUCTURE.md b/docs/PROJECT-STRUCTURE.md index 71a331a..2476401 100644 --- a/docs/PROJECT-STRUCTURE.md +++ b/docs/PROJECT-STRUCTURE.md @@ -49,7 +49,8 @@ S:\Game Hacking\Eushully\Himegari\ ← workspace root (three siblings) │ ├── bin/ 3rd-party binaries we use (not ours, not the game's) │ ├── BinExtractALF.exe ALF archive extractor → produces extracted/ - │ └── LzssCpp.dll its LZSS codec dependency + │ ├── LzssCpp.dll its LZSS codec dependency + │ └── pe-sieve32.exe (hollowsprocess) unpacked-PE dumper — engine-RE escalation (see docs/engine-re.md) │ ├── vm-map/ VM / reverse-engineering reference artifacts │ ├── opcodes.toml ★ CANONICAL opcode reference (hand-edited: ABI + semantics diff --git a/docs/engine-re.md b/docs/engine-re.md index 9f089b3..b61b09c 100644 --- a/docs/engine-re.md +++ b/docs/engine-re.md @@ -34,7 +34,7 @@ Related: `docs/scjump-progression.md` (the SCJUMP decoder that hit this wall), ` → `run_analysis`. - **Load sanity check (AGF-decoder landmark):** at VA `0x474f23`, `CMP word ptr [ESI + 0x4], 0x4d42` (the `BM`/BMP-magic check) confirms the image is correctly based + decoded. -- Escalation (unused so far): `tools/pe-sieve32.exe /pid /imp 3 /dmode 3 /dir ` (run from +- Escalation (unused so far): `bin/pe-sieve32.exe /pid /imp 3 /dmode 3 /dir ` (run from **PowerShell**, not Git Bash — it mangles `/flags`) rebuilds the IAT into a clean PE. Only needed if raw-dump analysis is inadequate; it was fine for reading logic, so we stayed on the raw dump.