Native debug maps and Windows resources
Static analysis, 2026-10-11. Reproduce with python3 scripts/analyze_native_metadata.py; validate with python3 scripts/test_native_metadata.py. The collector is part of analyze_binaries.py. Summary and per-image metadata reports record original SHA-256 identities. No supplied executable or library was run.
META-001: Mach-O STABS debug maps
The reader walks the original LC_SYMTAB nlist array, including anonymous/zero-string-index records, rather than relying on a filtered symbol inventory. It retains original symbol indices, file offsets, type, section, description and value. Record names follow Apple's STABS definitions. Paired N_FUN records delimit the function ranges in these images; closing values are treated as lengths and checked against file-backed executable sections. Embedded source paths and object timestamps are unverified build evidence.
| Image | Records | Source entries / object entries | Paired function ranges | Bytes in those ranges | Unmatched/invalid function records |
|---|---|---|---|---|---|
| SDL dylib | 4,719 | 78 / 78 | 1,012 | 327,111 | 0 |
| macOS client executable | 34 | 1 / 1 | 6 | 2,289 | 0 |
The SDL report associates functions with source files and object paths and hashes each byte range. Tests confirm the ranges do not overlap. SDL's __text section contains 327,635 bytes; the remaining 524 bytes are outside these function ranges and need reconciliation as padding or other code/data. Range recovery does not mean each function has been analyzed or matched to upstream source.
SDL source names cover common event/video/audio surfaces, software blitters, Quartz, X11/DGA and X extensions, CoreAudio, Darwin joystick/CD code, pthreads, Unix timers and dynamic loading. These are compilation provenance candidates, not proof that every backend is reachable on this macOS build. The recorded build prefix identifies SDL-1.2.15; upstream implementation comparison remains open.
The records comprise 2,024 N_FUN, 1,012 each N_BNSYM/N_ENSYM, 350 N_STSYM, 234 N_SO, 78 N_OSO and nine N_SOL. No local/register/parameter/type-description record classes were observed. Full C data types cannot be recovered from a debug map that does not contain them. Static and include records remain searchable in the raw compressed evidence under assets/analysis/native/.
The client report identifies SDLMain Objective-C methods for termination, working-directory setup, file opening, launch handling, NSString replacement, and _main. Its object path mentions libSDLmain.a(SDLMain.o) inside an ioq3-for-UrbanTerror build. This is a small retained launcher debug map, not debug coverage for the whole engine.
META-002: Windows resource variants
The parser follows directory-relative tree offsets and separately maps leaf payload RVAs to file-backed sections, with bounds/cycle checks. Paths retain type, name and language; named entries use UTF-16. This follows the Microsoft PE resource tree definition. Every leaf is preserved separately under assets/analysis/native/resources/windows--Quake3-UrT.exe/, using existing Xet filters.
The client report contains nine leaves, all language ID 1033: seven type-3 icon images, one type-6 string block and one type-14 icon group. Payloads total 353,268 bytes within the 353,788-byte resource directory region. Tree metadata, alignment and any remaining byte gaps require separate coverage reconciliation. No version, manifest or dialog leaf occurs in this tree. The dedicated report confirms its resource directory is absent; this says nothing about Windows installation files outside the supplied snapshot.
The string block has sixteen length-prefixed UTF-16 slots. Only ID 1 is nonempty: Quake3-UrT. Empty entries are retained. The group links images at 16, 32 and 48 pixels with both 8-bit and 32-bit variants, plus a 256-pixel 32-bit image. Reconstruction into a 353,230-byte ICO preserves the seven image payloads exactly and validates image size and language matches, using Microsoft's group/icon structures. Raw group and image leaves are preserved alongside the ICO.
META-003: icon extents need rendering checks
All seven images use a 40-byte uncompressed DIB header with a doubled stored height for pixel/mask planes. The three indexed images exactly match the computed palette, aligned pixel rows and standard one-bit AND mask extent. Four 32-bit variants have additional bytes:
| Dimensions | Payload bytes | Standard layout bytes | Surplus bytes retained |
|---|---|---|---|
| 16 × 16 | 1,320 | 1,128 | 192 |
| 32 × 32 | 5,160 | 4,264 | 896 |
| 48 × 48 | 11,560 | 9,640 | 1,920 |
| 256 × 256 | 327,720 | 270,376 | 57,344 |
The payload lengths fit a larger mask/data extent, but its interpretation is not established. All declared image-size fields are zero. The collector records and hashes surplus bytes instead of dropping them. ICO structural reconstruction and payload equality pass; visual correctness, alpha/mask behavior and operating-system handling of those bytes have not been tested. A future converter must retain the originals and compare rendered variants before normalization.
Verification and remaining tasks
Seven tests cover relative offsets versus RVAs, named resources, cycles, unbacked payloads, malformed string tables, language/size mismatch, function closure interpretation, every recovered real function hash, nonoverlapping ranges and all reconstructed icon payloads. Reports and derived assets regenerate byte-for-byte.
RE-214–216 complete this static metadata pass. RE-208 remains open for pinned SDL source comparison, implementation differences, absent-type reconstruction and helper behavior. RE-210 remains open for load/bind/relocation details and uncovered regions. Follow up icon surplus/mask rendering, the 524 SDL text bytes outside debug-map functions, and exact resource-region byte coverage before treating these formats as fully understood.
Follow-up: COV-001/002 resolves the 524 SDL text bytes as NOP sequences and accounts for all 520 non-payload resource bytes as directory structures. Earlier gap questions above are now resolved for these bounded regions; icon surplus remains open.