167 lines
8.4 KiB
Markdown
167 lines
8.4 KiB
Markdown
# General models and specialist models: article evidence
|
|
|
|
Supporting record for `public/blog/reverse-engineering-models/index.html`.
|
|
The article is published from the English source and translated through the
|
|
website's gettext catalogs.
|
|
|
|
## Research scope
|
|
|
|
Repository history, maintained source and recorded comparison notes were reviewed
|
|
on 13 October 2026. This research did not run game targets, compile reconstruction
|
|
candidates or repeat historical runtime checks. Public commit availability was
|
|
checked through GitHub CLI.
|
|
|
|
The evidence describes specific historical functions and their recorded checks.
|
|
Source presence, compiler exactness, complete-product builds and runtime agreement
|
|
remain distinct. The proposed specialist/RL comparisons are future experiments;
|
|
no trained specialist was evaluated for this article.
|
|
|
|
## Model attribution
|
|
|
|
- The project operator identifies `gpt-dots` as **GPT-6-Astra**.
|
|
- `gpt-web` is a changing label for the model used at the time. The operator
|
|
describes then-latest models, usually xhigh, commonly GPT-5.6-Sol earlier and
|
|
GPT-6-Sol recently. Do not assign all such commits a single model or infer
|
|
individual identities from a release date.
|
|
- Explicit `gpt-6-sol` and `gpt-6.1-sol` subjects establish the recorded names.
|
|
Per-run reasoning effort and full budgets are not uniformly recorded.
|
|
- `gpt-6-luna-max` records GPT-6-Luna and max effort. It does not establish
|
|
parameter count or specialist training.
|
|
|
|
Later sessions inherited earlier source, diagnostics and failed experiments.
|
|
Historical before/after closures support the essay's questions; they are not
|
|
controlled estimates of model-size effects.
|
|
|
|
## TH09 Type18/24 attack update
|
|
|
|
Earlier source-context review:
|
|
[GPT-6-Sol, 26 September](https://github.com/N0zoM1z0/th09/commit/de63c0f9121963f3a6b1ab5471c4878625fd3425).
|
|
Closing reconstruction:
|
|
[GPT-6.1-Sol, 10 October](https://github.com/N0zoM1z0/th09/commit/52929ed7c299f1a5f29cc13964e22510145fd616).
|
|
|
|
The earlier candidate was 1,435 bytes against a 1,436-byte target. Matching the
|
|
overall frame size concealed different homes for returned vectors and real
|
|
collision storage. Declaration and helper-visibility controls did not close it.
|
|
|
|
The closing session introduces an ordinary XYZ destination assignment, consumes
|
|
real returned vectors directly and groups six actual publication/rotation
|
|
operations into one comma-sequenced full expression. Keeping the real collision
|
|
point at function scope preserves separate storage. The seventh warm candidate
|
|
matches, followed by a maintained-path canonical cold comparison of all 1,436
|
|
bytes and 44 encoded fields. Original class/source spelling and later runtime
|
|
gates remain separate.
|
|
|
|
The article's four-row table groups selected lessons from seven candidates. It
|
|
does not enumerate every build or reproduce a complete source listing.
|
|
|
|
## TH09 Front callback
|
|
|
|
Earlier diagnostic checkpoint:
|
|
[GPT-6.1-Sol, 2 October](https://github.com/N0zoM1z0/th09/commit/f8d12d72aaf02212ee1b585a8f3f86d7ed000269).
|
|
Full graph closure:
|
|
[GPT-6-Astra (`gpt-dots`), 6 October](https://github.com/N0zoM1z0/th09/commit/da33a646221198ceb7f3df2b96e2ca0e9b2f705f).
|
|
Accepted replay:
|
|
[6 October follow-up](https://github.com/N0zoM1z0/th09/commit/5f825b28a862f8e1a6d4aea2f78a42f04c09a1c0).
|
|
|
|
The earlier maintained owner was 1,510 bytes versus the 1,491-byte target. Its
|
|
prefix and suffix matched only as independently positioned diagnostic regions;
|
|
they did not establish a complete-function match.
|
|
|
|
A common outer continuation places completion and frame dispatch in complementary
|
|
arms with one final frame increment/return. Within this graph, the side/stage
|
|
decision recovers target block sharing. The record establishes the complete
|
|
1,491-byte owner, 107 independently bound fields, 384 instructions and 42 calls.
|
|
The follow-up records accepted forced-recompile replay for `da33a646`.
|
|
Bounded trace models are static checks, not game-runtime validation.
|
|
|
|
## TH095 identifier-bucket reuse
|
|
|
|
[Supervisor::LoadDat, 2 September](https://github.com/N0zoM1z0/th095/commit/26bb64bdb093a13f73abd0ee8ae7ce199ee4658f).
|
|
|
|
Under observed VC7.1 build 3077, declaration order alone did not recover the real
|
|
local homes. Earlier background work established useful identifier buckets.
|
|
Backing the real file-size scalar with `averagedPanLocal12` places it at
|
|
`EBP-0x04` and the genuine 128-byte buffer at `EBP-0x88`. All 151 bytes and 15
|
|
relocations close.
|
|
|
|
This is compiler-context evidence. It does not establish a universal C++ rule
|
|
or uniquely recover the original author's variable name. The `gpt-web` label
|
|
does not identify this run's model individually.
|
|
|
|
## TH09 Luna enemy-spawn closure
|
|
|
|
[GPT-6-Luna-max, 27 September](https://github.com/N0zoM1z0/th09/commit/1eb843383941d00065622a9e353146c4bb96979e).
|
|
|
|
An ordinary loop with `continue`/`break`, branch-local RunEcl failure handling
|
|
and a shared success tail closes the 373-byte owner. TH08 source supplies the
|
|
source-family hypothesis; TH09 establishes the bounds, fields, ABI and callees.
|
|
Two independent cold builds and canonical replay are recorded.
|
|
|
|
The earlier stable 361-byte candidate is `gpt-web`, with an individually
|
|
unresolved model identity. This case demonstrates a useful discovery across
|
|
model tiers, not a measured specialist or smaller-parameter advantage.
|
|
|
|
## TH04 compiler diversity
|
|
|
|
[Player MAIN_0 cohort, 15 September](https://github.com/N0zoM1z0/th04/commit/6dce0a79d5b931f0e2a08475b90e0c33d2321b98).
|
|
|
|
Natural Turbo C++ 4.0J source produces a 629-byte update/miss contribution and a
|
|
334-byte renderer. Expression lifetimes, branch-local stores, declaration order
|
|
and a shared firing tail matter. Correct physical linker order avoids an extra
|
|
alignment byte. The recorded focused and aggregate replays cover 129 and 208
|
|
owners respectively. These are historical owned-extent checks; this checkpoint
|
|
does not establish whole-game execution.
|
|
|
|
TH08 uses VC7, while TH095/TH09 use VC7.1. Avoid treating every game's source
|
|
patterns as output from the same compiler. Shared game authorship supplies a
|
|
prior; target-local evidence validates an actual transfer.
|
|
|
|
## TH08 numerical investigation
|
|
|
|
[Polar motion and x87 behavior, 13 October](https://github.com/N0zoM1z0/th08/commit/af9cb1d3e839b15a78b47ac1701506083cc82847).
|
|
|
|
A collision divergence at stage 2 frame 6,825 leads back to a one-ULP
|
|
displacement difference at frame 5,573. Historical CRT wrappers retain a wider
|
|
x87 return despite storing a rounded float. A distinct i386 case involves x87
|
|
precision-control state. The record includes field probes and replay checks for
|
|
specified scenarios. Several preceding investigations use the same model; this
|
|
is breadth-of-investigation evidence, not a model-switch comparison.
|
|
|
|
## TH08 floating-literal oracle repair
|
|
|
|
[Repository-wide audit, 2 September](https://github.com/N0zoM1z0/th08/commit/a393f400786e4cc6cbb1000af0dad3276da12c78).
|
|
|
|
Literal payload checks previously depended on optional explicit `data_hex`
|
|
attestation. The fix decodes and target-checks every VC7 `__real@...` relocation.
|
|
The follow-up audits 1,548 relocations and corrects 12 stale rows in five already
|
|
accepted units. One source change corrects a bullet-spread increment from
|
|
`1.0f` to `32.0f`.
|
|
|
|
Affected-unit replay and a complete 1,106-unit cold replay are recorded after
|
|
repair. This defect is separate from the later one-ULP numerical investigation.
|
|
The RL consequence in the article is an inference: a reward based on the earlier
|
|
check could reinforce wrong source. The record does not describe an actual RL
|
|
exploit or trained model doing so.
|
|
|
|
## TH09 target-sized replay-save candidate
|
|
|
|
[Replay-save closure, 2 October](https://github.com/N0zoM1z0/th09/commit/ab72fd77728293fc0beacfc656ca701b0e266016).
|
|
|
|
The earlier candidate already had the target's 1,825-byte length but 467 complete
|
|
comparison differences. Shared index identity, loop structure and the real
|
|
cancel/overwrite continuation close the complete owner. The example supports
|
|
using size as a diagnostic rather than final acceptance.
|
|
|
|
## Related research
|
|
|
|
The article links these primary sources:
|
|
|
|
- [LLM4Decompile, EMNLP 2024](https://aclanthology.org/2024.emnlp-main.203/).
|
|
- [AutoDecompiler, June 2026 preprint](https://arxiv.org/html/2606.16162v1).
|
|
- [When LLM Decompilers Recompile More and Preserve Less, September 2026 preprint](https://arxiv.org/html/2609.05370v1).
|
|
|
|
These works concern specialized decompilation, feedback-based refinement and
|
|
functional checking. Their published setups do not establish a winner for the
|
|
article's proposed historical-compiler reconstruction experiment. Preserve that
|
|
objective distinction when expanding the discussion.
|