Recover SDL debug maps and Windows executable resource variants

assets/analysis/native/macos--Quake3-UrT.x86_64.stabs.jsonl.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ec0f05bd9d67f7745c355f0fa6ea350ac478eef8d3dfdb888ef38f4016240f74
+size 845

assets/analysis/native/macos--libSDL-1.2.0.dylib.stabs.jsonl.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:aeced137341935613e82e9945c340402d49f696415b06adebfed025ef4fbc458
+size 55820

assets/analysis/native/resources/windows--Quake3-UrT.exe/000000.bin

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7e91bc2f2c1cae398aed49c77e076f72fb7df4d37acf6e10535b5c87579c472c
+size 1384

assets/analysis/native/resources/windows--Quake3-UrT.exe/000001.bin

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d5697c5c2d3c4f6f9c3ecfd99c0137eea1098ff9941435974b2f9a62b4fa21e9
+size 1320

assets/analysis/native/resources/windows--Quake3-UrT.exe/000002.bin

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:5f182e38fd1044fb6cb701d0ffe4929546155f5a10c135a31e14f3b431227581
+size 2216

assets/analysis/native/resources/windows--Quake3-UrT.exe/000003.bin

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:7a766ebde718a8d82cade2d990b1025c6ee6e8b0e83361e7282c0dcb6e46899c
+size 5160

assets/analysis/native/resources/windows--Quake3-UrT.exe/000004.bin

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:561be52eacd9c73b5fb5141c636a8c3fc6090977476396fd7597c54472b195c9
+size 3752

assets/analysis/native/resources/windows--Quake3-UrT.exe/000005.bin

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:79e8a802daf7aa78838fc3e5d7837cffd4e09a7922264da9690bb28d0e286bb5
+size 11560

assets/analysis/native/resources/windows--Quake3-UrT.exe/000006.bin

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8c3a46e5fdc315824a8100c11a5bbf479df8d56266a4efc078a7d2a111e7e92f
+size 327720

assets/analysis/native/resources/windows--Quake3-UrT.exe/000007.bin

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:963f626117e91ab3f1f97e30ce012bb855bd564bbb3e8b745ee2a7424753c44c
+size 52

assets/analysis/native/resources/windows--Quake3-UrT.exe/000008.bin

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:35f2a898666580776a08e4e56ff6db778dc8abcfa74b6729a03407e0938884ef
+size 104

docs/FINDINGS.md

@@ -180,3 +180,8 @@ Exact native fork/source revision, runtime resource lookup, legacy launch enviro
 **F-028 — Observed/inferred: four extension entry roles.** Matching QVM bodies, string references and Linux ELF64 native callers identify qagame 11 as heartbeat, 12 as shutdown, 13 as server authentication message handling, and UI 11 as authentication response handling. These are descriptive roles, not recovered source names or complete protocol specifications. All four QVM entry cases discard the callee result and return zero. [ABI-001 evidence and limits](research/VM_EXTENSIONS.md).
 
 **F-029 — Observed: Linux ELF64 network/auth extension boundaries.** Game 600/UI 88 parse a string into a VM address buffer; game 601/UI 90 pass socket, length, packet buffer and resolved destination to `NET_SendPacket`, then return zero without checking the parser result in the dispatch case. Game 603 converts two pointers and checks the client index before calling `SV_Auth_DropClient`. The parser/send boundary uses a 12-byte native address, with IPv4 at offset 4 and port at offset 8. Other platform contracts and full error/packet semantics remain unresolved. [ABI-002/003](research/VM_EXTENSIONS.md).
+
+
+**F-030 — Observed: SDL/client Mach-O debug-map ranges.** Raw STABS yield 1,012 nonoverlapping SDL function ranges associated with 78 source/object entries, plus six client SDLMain launcher ranges. No local/parameter/type-description classes were observed. Source paths suggest SDL 1.2.15 build provenance, not a verified upstream implementation match. SDL text still contains 524 bytes outside these ranges. [META-001](research/native/METADATA.md).
+
+**F-031 — Observed: Windows resource contents and icon discrepancy.** The client PE has nine leaves: seven icon images, one string block and one icon group, all language 1033; the dedicated PE has no resource directory. A reconstructed ICO preserves every image byte. Four 32-bit image payloads exceed their standard DIB pixel/mask extent; their surplus remains preserved and unclassified. [META-002/003](research/native/METADATA.md).

docs/RESEARCH_LEDGER.md

@@ -73,3 +73,8 @@ Document inspection tooling used in this pass: Python standard library (`pathlib
 ## 2026-10-11 — VM extension follow-up
 
 Completed RE-211–213: extra entry command evidence, six QVM network/auth call-site cross-references, and selected Linux ELF64 native helpers. Findings F-028/029 and ABI-001–003 are documented in [VM_EXTENSIONS.md](research/VM_EXTENSIONS.md). `analyze_vm_extensions.py` verifies source/disassembly hashes and emits a deterministic focused report; five new fixture/boundary tests pass. Native command scanning includes tail calls and rejects local candidates after intervening control transfers/register writes. Reports retain broader limitations and unresolved routing, error paths, helper semantics and all-platform coverage. Originals remain in ignored cache; no original binary or QVM was run.
+
+
+## 2026-10-11 — Native metadata follow-up
+
+Completed static milestones RE-214–216 with `analyze_native_metadata.py`: all 4,753 Mach-O STABS records retained, 1,018 paired function ranges hashed, nine Windows resource leaves preserved by variant, string slots decoded, icon group reconstructed and unexpected image extents recorded. Findings F-030/031 and META-001–003 distinguish structural recovery from source matching or rendering semantics. Seven tests cover malformed structures and real function/resource reconstruction. New derived binary evidence stays under Xet-filtered assets; originals remain in ignored cache. RE-217/218 track icon surplus rendering and uncovered byte regions.

docs/REVERSE_ENGINEERING_TODO.md

@@ -247,9 +247,14 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [ ] RE-205 Name and specify qagame entry commands 11–13 and UI entry command 11 using native VM callers, argument flow and deterministic reference fixtures (VM-002). **Progress 2026-10-11:** All four roles have matching QVM/native evidence: heartbeat, shutdown, server auth messages and UI auth responses. Complete grammar, state effects, routing predicates and runtime fixtures remain open ([ABI-001](research/VM_EXTENSIONS.md)).
 - [ ] RE-206 Recover game trap 600/601/603 and UI trap 88/90 argument/result layouts, packet/address semantics and error paths on every native platform (NAT-004). **Progress 2026-10-11:** Linux ELF64 argument slots, VM pointer conversions, send/parser return handling, client-index guard and 12-byte address layout documented. Invalid-index continuation, helper semantics and other platforms remain open ([ABI-002/003](research/VM_EXTENSIONS.md)).
 - [ ] RE-207 Extend native switch recognition to i386, Windows and macOS; compare numeric cases, pointer width, validation and results with the two ELF64 tables.
-- [ ] RE-208 Decode all retained SDL/app STABS source/type/function records; compare SDL 1.2.15 implementations and identify modifications (NAT-003).
+- [ ] RE-208 Decode all retained SDL/app STABS source/type/function records; compare SDL 1.2.15 implementations and identify modifications (NAT-003). **Progress 2026-10-11:** All raw debug-map records retained; SDL has 1,012 paired function ranges associated with 78 source/object entries, launcher six ranges. No type-description records observed; upstream comparison remains open ([META-001](research/native/METADATA.md)).
 - [ ] RE-209 Resolve all 519 currently indirect QVM calls and remaining computed jumps through stack/dataflow analysis, retaining unresolved coverage rather than inventing targets (VM-003/004).
-- [ ] RE-210 Decode Windows client resource leaves, native load/bind/relocation details and unclassified tail/embedded regions; extend recursion beyond supported plain-image signatures (NAT-001/002).
+- [ ] RE-210 Decode Windows client resource leaves, native load/bind/relocation details and unclassified tail/embedded regions; extend recursion beyond supported plain-image signatures (NAT-001/002). **Progress 2026-10-11:** Nine Windows client resource leaves extracted, string block decoded and seven-image icon group reconstructed; dedicated resource directory absent. Icon surplus, byte gaps and loader metadata remain open ([META-002/003](research/native/METADATA.md)).
 - [x] RE-211 Collect source-verified QVM bodies and Linux ELF64 callers for all four extra entry commands, including native tail calls. **Evidence:** `scripts/analyze_vm_extensions.py`, `docs/research/vm-extensions.json`, ABI-001; five focused tests pass. This completes static evidence collection, not RE-205's behavioral specification.
 - [x] RE-212 Cross-reference all six observed call sites for game 600/601/603 and UI 88/90 with both ELF64 game dispatchers and the ELF64 UI dispatcher. **Evidence:** generated service cases and local QVM argument windows; ABI-002; fixture tests validate trap encoding and native helper targets.
 - [x] RE-213 Preserve and inspect complete Linux ELF64 address-parser/send/drop helper bodies; document address layout, port conversion and dispatch return handling. **Evidence:** ABI-003 and hash-verified generated native functions. Full helper semantics and platform parity remain part of RE-206.
+- [x] RE-214 Recover raw Mach-O STABS, source/object associations and bounded paired function ranges for SDL and the client launcher. **Evidence:** `scripts/analyze_native_metadata.py`, both Mach-O metadata reports, META-001; 1,018 ranges with source hashes, no unmatched function records; seven metadata tests pass. Source comparison and types remain RE-208.
+- [x] RE-215 Enumerate every supplied Windows PE resource leaf by type/name/language, preserve all variants, decode the string block and reconstruct the linked icon group. **Evidence:** nine client leaves, zero dedicated leaves, seven-image ICO with identical payloads, META-002.
+- [x] RE-216 Calculate supplied icon DIB header/palette/pixel/mask extents; hash and preserve unexpected surplus bytes. **Evidence:** META-003 and per-leaf structural reports. This completes extent analysis, not visual/pixel semantics.
+- [ ] RE-217 Explain/render the four 32-bit Windows icon payloads with surplus bytes; compare alpha/mask behavior across reference decoders before normalizing them.
+- [ ] RE-218 Reconcile the 524 SDL text bytes outside paired debug-map functions and all Windows resource-region metadata/padding gaps; preserve evidence for every byte classification.

docs/research/README.md

@@ -8,6 +8,8 @@ Read [QVM findings and ABI candidates](qvm/README.md), [native images, libraries
 
 The [extension follow-up](VM_EXTENSIONS.md) traces all four extra game/UI entry commands and five network/auth syscall numbers through QVM callers and the Linux ELF64 engines. Its [focused generated report](vm-extensions.json) preserves selected function bodies and instruction evidence; descriptive roles and partial signatures are distinguished from unresolved behavior.
 
+The [native metadata follow-up](native/METADATA.md) recovers SDL/client debug-map ranges and all supplied Windows resource leaves, reconstructs the icon group and records unclassified icon surplus.
+
 ## Reproduce
 
 From the repository root, with the verified source installation and extracted assets present:
@@ -16,10 +18,11 @@ From the repository root, with the verified source installation and extracted as
 python3 scripts/analyze_binaries.py
 python3 scripts/test_binary_analysis.py
 python3 scripts/test_vm_extensions.py
+python3 scripts/test_native_metadata.py
 python3 scripts/storage_policy.py check --require-setup
 ```
 
-The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, and `analyze_vm_extensions.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
+The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, and `analyze_native_metadata.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
 
 Generated JSON/JSONL and compressed evidence are regenerated in place; keep prose notes in Markdown. Rerunning the four analysis stages reproduced every generated report and gzip artifact byte-for-byte on the same toolchain. gzip timestamps and stored filenames are fixed. Different objdump versions can produce different disassembly text, so tool version and uncompressed evidence hashes are recorded. Reports are UTF-8 normal Git text, with individual files below the storage policy's 2 MiB limit.
 

docs/research/native/METADATA.md

@@ -0,0 +1,47 @@
+# Native debug maps and Windows resources
+
+Static analysis, 2026-10-11. Reproduce with `python3 scripts/analyze_native_metadata.py`; validate with `python3 scripts/test_native_metadata.py`. The collector is part of `analyze_binaries.py`. [Summary](metadata-summary.json) and per-image metadata reports record original SHA-256 identities. No supplied executable or library was run.
+
+## META-001: Mach-O STABS debug maps
+
+The reader walks the original `LC_SYMTAB` nlist array, including anonymous/zero-string-index records, rather than relying on a filtered symbol inventory. It retains original symbol indices, file offsets, type, section, description and value. Record names follow [Apple's STABS definitions](https://github.com/apple-oss-distributions/xnu/blob/main/EXTERNAL_HEADERS/mach-o/stab.h). Paired `N_FUN` records delimit the function ranges in these images; closing values are treated as lengths and checked against file-backed executable sections. Embedded source paths and object timestamps are unverified build evidence.
+
+| Image | Records | Source entries / object entries | Paired function ranges | Bytes in those ranges | Unmatched/invalid function records |
+| --- | --- | --- | --- | --- | --- |
+| SDL dylib | 4,719 | 78 / 78 | 1,012 | 327,111 | 0 |
+| macOS client executable | 34 | 1 / 1 | 6 | 2,289 | 0 |
+
+The [SDL report](macos--libSDL-1.2.0.dylib.metadata.json) associates functions with source files and object paths and hashes each byte range. Tests confirm the ranges do not overlap. SDL's `__text` section contains 327,635 bytes; the remaining 524 bytes are outside these function ranges and need reconciliation as padding or other code/data. Range recovery does not mean each function has been analyzed or matched to upstream source.
+
+SDL source names cover common event/video/audio surfaces, software blitters, Quartz, X11/DGA and X extensions, CoreAudio, Darwin joystick/CD code, pthreads, Unix timers and dynamic loading. These are compilation provenance candidates, not proof that every backend is reachable on this macOS build. The recorded build prefix identifies `SDL-1.2.15`; upstream implementation comparison remains open.
+
+The records comprise 2,024 `N_FUN`, 1,012 each `N_BNSYM`/`N_ENSYM`, 350 `N_STSYM`, 234 `N_SO`, 78 `N_OSO` and nine `N_SOL`. No local/register/parameter/type-description record classes were observed. Full C data types cannot be recovered from a debug map that does not contain them. Static and include records remain searchable in the raw compressed evidence under `assets/analysis/native/`.
+
+The [client report](macos--Quake3-UrT.x86_64.metadata.json) identifies SDLMain Objective-C methods for termination, working-directory setup, file opening, launch handling, NSString replacement, and `_main`. Its object path mentions `libSDLmain.a(SDLMain.o)` inside an ioq3-for-UrbanTerror build. This is a small retained launcher debug map, not debug coverage for the whole engine.
+
+## META-002: Windows resource variants
+
+The parser follows directory-relative tree offsets and separately maps leaf payload RVAs to file-backed sections, with bounds/cycle checks. Paths retain type, name and language; named entries use UTF-16. This follows the [Microsoft PE resource tree definition](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-rsrc-section). Every leaf is preserved separately under `assets/analysis/native/resources/windows--Quake3-UrT.exe/`, using existing Xet filters.
+
+The [client report](windows--Quake3-UrT.exe.metadata.json) contains **nine leaves**, all language ID 1033: seven type-3 icon images, one type-6 string block and one type-14 icon group. Payloads total **353,268 bytes** within the 353,788-byte resource directory region. Tree metadata, alignment and any remaining byte gaps require separate coverage reconciliation. No version, manifest or dialog leaf occurs in this tree. The [dedicated report](windows--Quake3-UrT-Ded.exe.metadata.json) confirms its resource directory is absent; this says nothing about Windows installation files outside the supplied snapshot.
+
+The string block has sixteen length-prefixed UTF-16 slots. Only ID 1 is nonempty: `Quake3-UrT`. Empty entries are retained. The group links images at 16, 32 and 48 pixels with both 8-bit and 32-bit variants, plus a 256-pixel 32-bit image. Reconstruction into a **353,230-byte ICO** preserves the seven image payloads exactly and validates image size and language matches, using [Microsoft's group/icon structures](https://learn.microsoft.com/en-us/previous-versions/ms997538(v=msdn.10)). Raw group and image leaves are preserved alongside the ICO.
+
+## META-003: icon extents need rendering checks
+
+All seven images use a 40-byte uncompressed DIB header with a doubled stored height for pixel/mask planes. The three indexed images exactly match the computed palette, aligned pixel rows and standard one-bit AND mask extent. Four 32-bit variants have additional bytes:
+
+| Dimensions | Payload bytes | Standard layout bytes | Surplus bytes retained |
+| --- | --- | --- | --- |
+| 16 × 16 | 1,320 | 1,128 | 192 |
+| 32 × 32 | 5,160 | 4,264 | 896 |
+| 48 × 48 | 11,560 | 9,640 | 1,920 |
+| 256 × 256 | 327,720 | 270,376 | 57,344 |
+
+The payload lengths fit a larger mask/data extent, but its interpretation is not established. All declared image-size fields are zero. The collector records and hashes surplus bytes instead of dropping them. ICO structural reconstruction and payload equality pass; visual correctness, alpha/mask behavior and operating-system handling of those bytes have not been tested. A future converter must retain the originals and compare rendered variants before normalization.
+
+## Verification and remaining tasks
+
+Seven tests cover relative offsets versus RVAs, named resources, cycles, unbacked payloads, malformed string tables, language/size mismatch, function closure interpretation, every recovered real function hash, nonoverlapping ranges and all reconstructed icon payloads. Reports and derived assets regenerate byte-for-byte.
+
+RE-214–216 complete this static metadata pass. RE-208 remains open for pinned SDL source comparison, implementation differences, absent-type reconstruction and helper behavior. RE-210 remains open for load/bind/relocation details and uncovered regions. Follow up icon surplus/mask rendering, the 524 SDL text bytes outside debug-map functions, and exact resource-region byte coverage before treating these formats as fully understood.

docs/research/native/README.md

@@ -69,3 +69,7 @@ The 100-series memory/math traps illustrate module-specific numbering: game slot
 All eight images have complete static section/symbol and LLVM disassembly artifacts, but their functions are mostly unreviewed. ELF64 switch recovery covers four dispatchers only; i386/Windows/macOS correspondence needs separate recognizers and validation. Dynamic loads, transitive dependencies, DLL runtime behavior, resources, STABS types, full relocation/bind metadata, native CFGs and source correspondence remain open. Preserve each binary's distinct address space/hash when tracing the same named function across platforms.
 
 Use the generated `*.symbols.jsonl` and `anchors` lists to import analysis tools and prioritize VM loading/calls, pointer validation, syscall dispatch, filesystem order and frame loops. Follow the QVM call sites into their argument layouts before writing Rust services.
+
+## Metadata follow-up
+
+[META-001–003](METADATA.md) recover all retained Mach-O debug-map records and paired ranges, plus Windows resource variants, string contents and a reconstructed ICO. Function implementation comparison and icon surplus interpretation remain open.

docs/research/native/macos--Quake3-UrT.x86_64.metadata.json

@@ -0,0 +1,113 @@
+{
+  "functions": [
+    {
+      "address": 4296138656,
+      "bytes": 32,
+      "directory": "/Users/Admin/Downloads/SDL-1.2.15/",
+      "end_record": 5,
+      "file_offset": 1171360,
+      "name": "-[NSApplication(SDLApplication) terminate:]",
+      "object": "/Volumes/BARBIE/ioq3-for-UrbanTerror-4/build/release-darwin-x86_64/libSDLmain.a(SDLMain.o)",
+      "record": 4,
+      "section": 1,
+      "sha256": "a7d95529b23866a6dce18e81b2ac826b99ed498d5c993771813b8ef09f87a7a9",
+      "source": "./src/main/macosx/SDLMain.m"
+    },
+    {
+      "address": 4296138688,
+      "bytes": 176,
+      "directory": "/Users/Admin/Downloads/SDL-1.2.15/",
+      "end_record": 9,
+      "file_offset": 1171392,
+      "name": "-[SDLMain setupWorkingDirectory:]",
+      "object": "/Volumes/BARBIE/ioq3-for-UrbanTerror-4/build/release-darwin-x86_64/libSDLmain.a(SDLMain.o)",
+      "record": 8,
+      "section": 1,
+      "sha256": "6b740a1727e8f1223527bfe3f4b6eaa9ef0a46588204437ddce29eafe412a88f",
+      "source": "./src/main/macosx/SDLMain.m"
+    },
+    {
+      "address": 4296138864,
+      "bytes": 240,
+      "directory": "/Users/Admin/Downloads/SDL-1.2.15/",
+      "end_record": 13,
+      "file_offset": 1171568,
+      "name": "-[SDLMain application:openFile:]",
+      "object": "/Volumes/BARBIE/ioq3-for-UrbanTerror-4/build/release-darwin-x86_64/libSDLmain.a(SDLMain.o)",
+      "record": 12,
+      "section": 1,
+      "sha256": "cc261d68512fac8d0966a416ce74d78f0b9bc490b083ba1cec589209ff0b999c",
+      "source": "./src/main/macosx/SDLMain.m"
+    },
+    {
+      "address": 4296139104,
+      "bytes": 64,
+      "directory": "/Users/Admin/Downloads/SDL-1.2.15/",
+      "end_record": 17,
+      "file_offset": 1171808,
+      "name": "-[SDLMain applicationDidFinishLaunching:]",
+      "object": "/Volumes/BARBIE/ioq3-for-UrbanTerror-4/build/release-darwin-x86_64/libSDLmain.a(SDLMain.o)",
+      "record": 16,
+      "section": 1,
+      "sha256": "431014a664456fda2b2a741d0c12f9ce49b8bcb9da7088ad60293cd0cc651f59",
+      "source": "./src/main/macosx/SDLMain.m"
+    },
+    {
+      "address": 4296139168,
+      "bytes": 304,
+      "directory": "/Users/Admin/Downloads/SDL-1.2.15/",
+      "end_record": 21,
+      "file_offset": 1171872,
+      "name": "-[NSString(ReplaceSubString) stringByReplacingRange:with:]",
+      "object": "/Volumes/BARBIE/ioq3-for-UrbanTerror-4/build/release-darwin-x86_64/libSDLmain.a(SDLMain.o)",
+      "record": 20,
+      "section": 1,
+      "sha256": "3989d46a01f29da7a6668d76090813ca573ff70700665e171f20cf105bc0fc7e",
+      "source": "./src/main/macosx/SDLMain.m"
+    },
+    {
+      "address": 4296139472,
+      "bytes": 1473,
+      "directory": "/Users/Admin/Downloads/SDL-1.2.15/",
+      "end_record": 25,
+      "file_offset": 1172176,
+      "name": "_main",
+      "object": "/Volumes/BARBIE/ioq3-for-UrbanTerror-4/build/release-darwin-x86_64/libSDLmain.a(SDLMain.o)",
+      "record": 24,
+      "section": 1,
+      "sha256": "e92ecdfcc2202d456809dec21790660833a1b0b6719458ed907c27184aba399c",
+      "source": "./src/main/macosx/SDLMain.m"
+    }
+  ],
+  "kind_counts": {
+    "N_BNSYM": 6,
+    "N_ENSYM": 6,
+    "N_FUN": 12,
+    "N_OSO": 1,
+    "N_SO": 3,
+    "N_STSYM": 6
+  },
+  "limitations": "N_FUN end values are interpreted as byte lengths for this linker debug-map pattern. Source/object paths and timestamps are embedded build evidence, not verified source identities. Raw records retain begin/end/include/static symbols; source types are not reconstructed from absent records.",
+  "objects": [
+    {
+      "mtime_untrusted": 1417210094,
+      "object": "/Volumes/BARBIE/ioq3-for-UrbanTerror-4/build/release-darwin-x86_64/libSDLmain.a(SDLMain.o)",
+      "record": 2
+    }
+  ],
+  "raw_records": "assets/analysis/native/macos--Quake3-UrT.x86_64.stabs.jsonl.gz",
+  "record_count": 34,
+  "source": {
+    "bytes": 1713680,
+    "path": "Quake3-UrT.app/Contents/MacOS/Quake3-UrT.x86_64",
+    "sha256": "cb5e347d57124e317d3e15c0faebaabb98b314d2d3b7fa297f8639b6c69d182e"
+  },
+  "sources": [
+    {
+      "directory": "/Users/Admin/Downloads/SDL-1.2.15/",
+      "record": 1,
+      "source": "./src/main/macosx/SDLMain.m"
+    }
+  ],
+  "unresolved": []
+}

docs/research/native/metadata-summary.json

@@ -0,0 +1,32 @@
+[
+  {
+    "function_ranges": 1012,
+    "image": "macos--libSDL-1.2.0.dylib",
+    "objects": 78,
+    "stabs": 4719,
+    "unresolved": 0
+  },
+  {
+    "function_ranges": 6,
+    "image": "macos--Quake3-UrT.x86_64",
+    "objects": 1,
+    "stabs": 34,
+    "unresolved": 0
+  },
+  {
+    "icon_groups": 1,
+    "image": "windows--Quake3-UrT.exe",
+    "resource_leaves": 9,
+    "type_counts": {
+      "14": 1,
+      "3": 7,
+      "6": 1
+    }
+  },
+  {
+    "icon_groups": 0,
+    "image": "windows--Quake3-UrT-Ded.exe",
+    "resource_leaves": 0,
+    "type_counts": {}
+  }
+]

docs/research/native/windows--Quake3-UrT-Ded.exe.metadata.json

@@ -0,0 +1,10 @@
+{
+  "icon_groups": [],
+  "leaves": [],
+  "limitations": "All leaves are preserved. Shipped icon groups, DIB headers/extents and string tables are decoded. Pixel/mask behavior and surplus icon bytes remain unclassified; other resource types are not decoded.",
+  "source": {
+    "bytes": 1082800,
+    "path": "Quake3-UrT-Ded.exe",
+    "sha256": "808369f9b16054e0408e91bdf15f56098fac78279e4a092c95a24d943381352b"
+  }
+}

docs/research/native/windows--Quake3-UrT.exe.metadata.json

@@ -0,0 +1,363 @@
+{
+  "icon_groups": [
+    {
+      "bytes": 353230,
+      "entries": [
+        {
+          "bits": 8,
+          "bytes": 1384,
+          "colors": 0,
+          "height": 16,
+          "planes": 1,
+          "resource_id": 1,
+          "width": 16
+        },
+        {
+          "bits": 32,
+          "bytes": 1320,
+          "colors": 0,
+          "height": 16,
+          "planes": 1,
+          "resource_id": 2,
+          "width": 16
+        },
+        {
+          "bits": 8,
+          "bytes": 2216,
+          "colors": 0,
+          "height": 32,
+          "planes": 1,
+          "resource_id": 3,
+          "width": 32
+        },
+        {
+          "bits": 32,
+          "bytes": 5160,
+          "colors": 0,
+          "height": 32,
+          "planes": 1,
+          "resource_id": 4,
+          "width": 32
+        },
+        {
+          "bits": 8,
+          "bytes": 3752,
+          "colors": 0,
+          "height": 48,
+          "planes": 1,
+          "resource_id": 5,
+          "width": 48
+        },
+        {
+          "bits": 32,
+          "bytes": 11560,
+          "colors": 0,
+          "height": 48,
+          "planes": 1,
+          "resource_id": 6,
+          "width": 48
+        },
+        {
+          "bits": 32,
+          "bytes": 327720,
+          "colors": 0,
+          "height": 256,
+          "planes": 1,
+          "resource_id": 7,
+          "width": 256
+        }
+      ],
+      "group_path": [
+        14,
+        1,
+        1033
+      ],
+      "output": "assets/analysis/native/resources/windows--Quake3-UrT.exe/000008.ico",
+      "sha256": "40c88b2ed549500a26e3fa2a23b2e3d56d8b880afc9b651391418f1259f1e4bd"
+    }
+  ],
+  "leaves": [
+    {
+      "bytes": 1384,
+      "codepage": 0,
+      "data_entry_relative_offset": 376,
+      "dib": {
+        "bits": 8,
+        "declared_image_bytes": 0,
+        "height": 16,
+        "palette_bytes": 1024,
+        "standard_and_mask_bytes": 64,
+        "standard_layout_bytes": 1384,
+        "surplus_bytes": 0,
+        "surplus_sha256": null,
+        "width": 16,
+        "xor_bytes": 256
+      },
+      "file_offset": 1972232,
+      "output": "assets/analysis/native/resources/windows--Quake3-UrT.exe/000000.bin",
+      "path": [
+        3,
+        1,
+        1033
+      ],
+      "rva": 13074952,
+      "sha256": "7e91bc2f2c1cae398aed49c77e076f72fb7df4d37acf6e10535b5c87579c472c"
+    },
+    {
+      "bytes": 1320,
+      "codepage": 0,
+      "data_entry_relative_offset": 392,
+      "dib": {
+        "bits": 32,
+        "declared_image_bytes": 0,
+        "height": 16,
+        "palette_bytes": 0,
+        "standard_and_mask_bytes": 64,
+        "standard_layout_bytes": 1128,
+        "surplus_bytes": 192,
+        "surplus_sha256": "e663401f7744b55a1ea571d084fe6ce72af609925658462600176fe93b95f717",
+        "width": 16,
+        "xor_bytes": 1024
+      },
+      "file_offset": 1973616,
+      "output": "assets/analysis/native/resources/windows--Quake3-UrT.exe/000001.bin",
+      "path": [
+        3,
+        2,
+        1033
+      ],
+      "rva": 13076336,
+      "sha256": "d5697c5c2d3c4f6f9c3ecfd99c0137eea1098ff9941435974b2f9a62b4fa21e9"
+    },
+    {
+      "bytes": 2216,
+      "codepage": 0,
+      "data_entry_relative_offset": 408,
+      "dib": {
+        "bits": 8,
+        "declared_image_bytes": 0,
+        "height": 32,
+        "palette_bytes": 1024,
+        "standard_and_mask_bytes": 128,
+        "standard_layout_bytes": 2216,
+        "surplus_bytes": 0,
+        "surplus_sha256": null,
+        "width": 32,
+        "xor_bytes": 1024
+      },
+      "file_offset": 1974936,
+      "output": "assets/analysis/native/resources/windows--Quake3-UrT.exe/000002.bin",
+      "path": [
+        3,
+        3,
+        1033
+      ],
+      "rva": 13077656,
+      "sha256": "5f182e38fd1044fb6cb701d0ffe4929546155f5a10c135a31e14f3b431227581"
+    },
+    {
+      "bytes": 5160,
+      "codepage": 0,
+      "data_entry_relative_offset": 424,
+      "dib": {
+        "bits": 32,
+        "declared_image_bytes": 0,
+        "height": 32,
+        "palette_bytes": 0,
+        "standard_and_mask_bytes": 128,
+        "standard_layout_bytes": 4264,
+        "surplus_bytes": 896,
+        "surplus_sha256": "bb319f4f341ebd5c30485c842ec737f0ee3a5652b00221e65914ebf069fb6655",
+        "width": 32,
+        "xor_bytes": 4096
+      },
+      "file_offset": 1977152,
+      "output": "assets/analysis/native/resources/windows--Quake3-UrT.exe/000003.bin",
+      "path": [
+        3,
+        4,
+        1033
+      ],
+      "rva": 13079872,
+      "sha256": "7a766ebde718a8d82cade2d990b1025c6ee6e8b0e83361e7282c0dcb6e46899c"
+    },
+    {
+      "bytes": 3752,
+      "codepage": 0,
+      "data_entry_relative_offset": 440,
+      "dib": {
+        "bits": 8,
+        "declared_image_bytes": 0,
+        "height": 48,
+        "palette_bytes": 1024,
+        "standard_and_mask_bytes": 384,
+        "standard_layout_bytes": 3752,
+        "surplus_bytes": 0,
+        "surplus_sha256": null,
+        "width": 48,
+        "xor_bytes": 2304
+      },
+      "file_offset": 1982312,
+      "output": "assets/analysis/native/resources/windows--Quake3-UrT.exe/000004.bin",
+      "path": [
+        3,
+        5,
+        1033
+      ],
+      "rva": 13085032,
+      "sha256": "561be52eacd9c73b5fb5141c636a8c3fc6090977476396fd7597c54472b195c9"
+    },
+    {
+      "bytes": 11560,
+      "codepage": 0,
+      "data_entry_relative_offset": 456,
+      "dib": {
+        "bits": 32,
+        "declared_image_bytes": 0,
+        "height": 48,
+        "palette_bytes": 0,
+        "standard_and_mask_bytes": 384,
+        "standard_layout_bytes": 9640,
+        "surplus_bytes": 1920,
+        "surplus_sha256": "8d510c750cfecb5deb96233ebb713d61fec182fca34431897067294394fb0e15",
+        "width": 48,
+        "xor_bytes": 9216
+      },
+      "file_offset": 1986064,
+      "output": "assets/analysis/native/resources/windows--Quake3-UrT.exe/000005.bin",
+      "path": [
+        3,
+        6,
+        1033
+      ],
+      "rva": 13088784,
+      "sha256": "79e8a802daf7aa78838fc3e5d7837cffd4e09a7922264da9690bb28d0e286bb5"
+    },
+    {
+      "bytes": 327720,
+      "codepage": 0,
+      "data_entry_relative_offset": 472,
+      "dib": {
+        "bits": 32,
+        "declared_image_bytes": 0,
+        "height": 256,
+        "palette_bytes": 0,
+        "standard_and_mask_bytes": 8192,
+        "standard_layout_bytes": 270376,
+        "surplus_bytes": 57344,
+        "surplus_sha256": "df0269970fcb45f8ca856ead57e3a630d5f43f84bd9fbefb496921536c836131",
+        "width": 256,
+        "xor_bytes": 262144
+      },
+      "file_offset": 1997624,
+      "output": "assets/analysis/native/resources/windows--Quake3-UrT.exe/000006.bin",
+      "path": [
+        3,
+        7,
+        1033
+      ],
+      "rva": 13100344,
+      "sha256": "8c3a46e5fdc315824a8100c11a5bbf479df8d56266a4efc078a7d2a111e7e92f"
+    },
+    {
+      "bytes": 52,
+      "codepage": 0,
+      "data_entry_relative_offset": 488,
+      "file_offset": 2325344,
+      "output": "assets/analysis/native/resources/windows--Quake3-UrT.exe/000007.bin",
+      "path": [
+        6,
+        1,
+        1033
+      ],
+      "rva": 13428064,
+      "sha256": "963f626117e91ab3f1f97e30ce012bb855bd564bbb3e8b745ee2a7424753c44c",
+      "strings": [
+        {
+          "id": 0,
+          "text": ""
+        },
+        {
+          "id": 1,
+          "text": "Quake3-UrT"
+        },
+        {
+          "id": 2,
+          "text": ""
+        },
+        {
+          "id": 3,
+          "text": ""
+        },
+        {
+          "id": 4,
+          "text": ""
+        },
+        {
+          "id": 5,
+          "text": ""
+        },
+        {
+          "id": 6,
+          "text": ""
+        },
+        {
+          "id": 7,
+          "text": ""
+        },
+        {
+          "id": 8,
+          "text": ""
+        },
+        {
+          "id": 9,
+          "text": ""
+        },
+        {
+          "id": 10,
+          "text": ""
+        },
+        {
+          "id": 11,
+          "text": ""
+        },
+        {
+          "id": 12,
+          "text": ""
+        },
+        {
+          "id": 13,
+          "text": ""
+        },
+        {
+          "id": 14,
+          "text": ""
+        },
+        {
+          "id": 15,
+          "text": ""
+        }
+      ]
+    },
+    {
+      "bytes": 104,
+      "codepage": 0,
+      "data_entry_relative_offset": 504,
+      "file_offset": 2325396,
+      "output": "assets/analysis/native/resources/windows--Quake3-UrT.exe/000008.bin",
+      "path": [
+        14,
+        1,
+        1033
+      ],
+      "rva": 13428116,
+      "sha256": "35f2a898666580776a08e4e56ff6db778dc8abcfa74b6729a03407e0938884ef"
+    }
+  ],
+  "limitations": "All leaves are preserved. Shipped icon groups, DIB headers/extents and string tables are decoded. Pixel/mask behavior and surplus icon bytes remain unclassified; other resource types are not decoded.",
+  "source": {
+    "bytes": 2634689,
+    "path": "Quake3-UrT.exe",
+    "sha256": "94111a3091c7e70e534720585df58820f0481c0894ba7b29f4f7de09accbaf90"
+  }
+}

scripts/analyze_binaries.py

@@ -9,7 +9,8 @@ def main():
     if not Path('docs/inventory/snapshot.json').is_file():
         raise SystemExit('Run from the repository root')
     for script in ('fetch_analysis_references.py', 'analyze_qvm.py', 'analyze_native.py',
-                   'analyze_vm_abi.py', 'analyze_native_dispatch.py', 'analyze_vm_extensions.py'):
+                   'analyze_vm_abi.py', 'analyze_native_dispatch.py', 'analyze_vm_extensions.py',
+                   'analyze_native_metadata.py'):
         subprocess.run([sys.executable, str(Path('scripts')/script)], check=True)
 
 

scripts/analyze_native_metadata.py

@@ -0,0 +1,250 @@
+#!/usr/bin/env python3
+"""Bounded Mach-O STABS and PE resource recovery; no native code execution."""
+from collections import Counter
+import hashlib
+import json
+from pathlib import Path
+import struct
+from analyze_native import parse, take, unpack, cstring
+from analyze_qvm import write_json, write_rows
+from analyze_vm_extensions import verified
+
+STABS = {0x20: 'N_GSYM', 0x22: 'N_FNAME', 0x24: 'N_FUN', 0x26: 'N_STSYM',
+         0x28: 'N_LCSYM', 0x2e: 'N_BNSYM', 0x32: 'N_AST', 0x3c: 'N_OPT',
+         0x40: 'N_RSYM', 0x44: 'N_SLINE', 0x4e: 'N_ENSYM', 0x60: 'N_SSYM',
+         0x64: 'N_SO', 0x66: 'N_OSO', 0x80: 'N_LSYM', 0x82: 'N_BINCL',
+         0x84: 'N_SOL', 0x86: 'N_PARAMS', 0x88: 'N_VERSION', 0x8a: 'N_OLEVEL',
+         0xa0: 'N_PSYM', 0xa2: 'N_EINCL', 0xa4: 'N_ENTRY', 0xc0: 'N_LBRAC',
+         0xc2: 'N_EXCL', 0xe0: 'N_RBRAC', 0xe2: 'N_BCOMM', 0xe4: 'N_ECOMM'}
+
+
+def stab_records(data, layout):
+    if layout['format'] != 'Mach-O' or layout['bits'] != 64:
+        raise ValueError('STABS reader supports thin Mach-O64 only')
+    cmd = next(c for c in layout['load_commands'] if c['command'] == '0x2')
+    offset, count, strings_at, strings_bytes = unpack('<4I', data, cmd['file_offset']+8)
+    strings = take(data, strings_at, strings_bytes)
+    take(data, offset, count*16)
+    rows = []
+    for i in range(count):
+        name, typ, section, desc, value = unpack('<IBBHQ', data, offset+i*16)
+        if typ & 0xe0:
+            rows.append({'symbol_index': i, 'file_offset': offset+i*16, 'name': cstring(strings, name),
+                         'type': typ, 'kind': STABS.get(typ, 'UNKNOWN'), 'section': section,
+                         'description': desc, 'value': value})
+    return rows
+
+
+def decode_stabs(data, layout, rows):
+    sources, objects, functions, unresolved = [], [], [], []
+    directory = source = obj = None
+    active = None
+    for row in rows:
+        kind, name = row['kind'], row['name']
+        if kind == 'N_SO':
+            if name.endswith('/'):
+                directory = name
+            elif name:
+                source = name
+                sources.append({'directory': directory, 'source': source, 'record': row['symbol_index']})
+            else:
+                source = obj = None
+                directory = None
+        elif kind == 'N_OSO':
+            obj = name
+            objects.append({'object': obj, 'mtime_untrusted': row['value'], 'record': row['symbol_index']})
+        elif kind == 'N_FUN' and name:
+            if active:
+                unresolved.append({'reason': 'function without closing N_FUN', 'record': active['record']})
+            active = {'name': name, 'address': row['value'], 'section': row['section'],
+                      'directory': directory, 'source': source, 'object': obj, 'record': row['symbol_index']}
+        elif kind == 'N_FUN' and not name:
+            if not active:
+                unresolved.append({'reason': 'closing N_FUN without open function', 'record': row['symbol_index']})
+                continue
+            size = row['value']
+            section = next((s for s in layout['sections'] if s['index'] == active['section'] and
+                            s['executable'] and not s['zero_fill'] and s['address'] <= active['address'] and
+                            active['address']+size <= s['address']+s['bytes']), None)
+            if section is None or size == 0:
+                unresolved.append({'reason': 'function range is not nonempty file-backed executable code',
+                                   'record': active['record'], 'size': size})
+            else:
+                offset = section['file_offset']+active['address']-section['address']
+                functions.append({**active, 'bytes': size, 'file_offset': offset,
+                                  'sha256': hashlib.sha256(take(data, offset, size)).hexdigest(),
+                                  'end_record': row['symbol_index']})
+            active = None
+        elif kind == 'UNKNOWN':
+            unresolved.append({'reason': 'unknown STABS type', 'record': row['symbol_index']})
+    if active:
+        unresolved.append({'reason': 'unclosed final function', 'record': active['record']})
+    return {'record_count': len(rows), 'kind_counts': dict(sorted(Counter(r['kind'] for r in rows).items())),
+            'sources': sources, 'objects': objects, 'functions': functions, 'unresolved': unresolved,
+            'limitations': 'N_FUN end values are interpreted as byte lengths for this linker debug-map pattern. '
+            'Source/object paths and timestamps are embedded build evidence, not verified source identities. '
+            'Raw records retain begin/end/include/static symbols; source types are not reconstructed from absent records.'}
+
+
+def rva_range(data, layout, rva, size):
+    matches = [s for s in layout['sections'] if s['rva'] <= rva and rva+size <= s['rva']+s['bytes']]
+    if len(matches) != 1:
+        raise ValueError('resource range is not uniquely file-backed')
+    offset = matches[0]['file_offset']+rva-matches[0]['rva']
+    return offset, take(data, offset, size)
+
+
+def resource_leaves(data, layout):
+    if layout['format'] != 'PE':
+        raise ValueError('resource reader expects PE')
+    directory = next((d for d in layout['data_directories'] if d['index'] == 2), None)
+    if not directory or not directory['bytes']:
+        return []
+    base = directory['rva_or_security_file_offset']
+    _, tree = rva_range(data, layout, base, directory['bytes'])
+    leaves = []
+    nodes = 0
+    def walk(offset, path, ancestors):
+        nonlocal nodes
+        nodes += 1
+        if offset in ancestors or len(path) > 8 or nodes > 65536:
+            raise ValueError('cyclic or excessive resource tree')
+        header = unpack('<IIHHHH', tree, offset)
+        named, ids = header[-2:]
+        entries = take(tree, offset+16, (named+ids)*8)
+        for i in range(named+ids):
+            name, target = unpack('<II', entries, i*8)
+            if bool(name & 0x80000000) != (i < named):
+                raise ValueError('resource named/ID entry ordering mismatch')
+            if name & 0x80000000:
+                at = name & 0x7fffffff
+                length = unpack('<H', tree, at)[0]
+                component = take(tree, at+2, length*2).decode('utf-16le')
+            else:
+                component = name
+            current = path+[component]
+            if target & 0x80000000:
+                walk(target & 0x7fffffff, current, ancestors | {offset})
+            else:
+                rva, size, codepage, reserved = unpack('<4I', tree, target)
+                if reserved:
+                    raise ValueError('nonzero resource data reserved field')
+                file_offset, payload = rva_range(data, layout, rva, size)
+                leaves.append({'path': current, 'data_entry_relative_offset': target,
+                               'rva': rva, 'file_offset': file_offset, 'bytes': size, 'codepage': codepage,
+                               'sha256': hashlib.sha256(payload).hexdigest()})
+    walk(0, [], set())
+    return leaves
+
+
+def icon_group(payload):
+    reserved, kind, count = unpack('<3H', payload, 0)
+    if reserved or kind != 1 or len(payload) != 6+14*count:
+        raise ValueError('invalid group icon header/length')
+    rows = []
+    for i in range(count):
+        width, height, colors, reserved, planes, bits, size, ident = unpack('<4B2HIH', payload, 6+i*14)
+        if reserved:
+            raise ValueError('invalid icon entry reserved field')
+        rows.append({'width': width or 256, 'height': height or 256, 'colors': colors,
+                     'planes': planes, 'bits': bits, 'bytes': size, 'resource_id': ident})
+    return rows
+
+
+def string_table(payload, block):
+    if not isinstance(block, int) or block < 1:
+        raise ValueError('string table requires a positive numeric block ID')
+    rows, offset = [], 0
+    for i in range(16):
+        length = unpack('<H', payload, offset)[0]
+        offset += 2
+        value = take(payload, offset, length*2).decode('utf-16le')
+        offset += length*2
+        rows.append({'id': (block-1)*16+i, 'text': value})
+    if offset != len(payload):
+        raise ValueError('trailing string table bytes')
+    return rows
+
+
+def icon_dib(payload):
+    # Retain surplus bytes rather than assuming Windows ignores them.
+    size, width, doubled_height, planes, bits, compression, image_bytes, _, _, colors, _ = unpack('<IiiHHIIiiII', payload, 0)
+    if size != 40 or width <= 0 or doubled_height <= 0 or doubled_height % 2 or planes != 1 or bits not in (8, 32) or compression:
+        raise ValueError('unsupported icon DIB layout')
+    height = doubled_height//2
+    palette = (colors or (1 << bits if bits <= 8 else 0))*4
+    xor = ((width*bits+31)//32)*4*height
+    mask = ((width+31)//32)*4*height
+    expected = 40+palette+xor+mask
+    take(payload, 0, expected)
+    return {'width': width, 'height': height, 'bits': bits, 'declared_image_bytes': image_bytes,
+            'palette_bytes': palette, 'xor_bytes': xor, 'standard_and_mask_bytes': mask,
+            'standard_layout_bytes': expected, 'surplus_bytes': len(payload)-expected,
+            'surplus_sha256': hashlib.sha256(payload[expected:]).hexdigest() if len(payload)>expected else None}
+
+
+def reconstruct_icon(data, leaves, group):
+    rows = icon_group(take(data, group['file_offset'], group['bytes']))
+    header = bytearray(struct.pack('<3H', 0, 1, len(rows)))
+    images = []
+    offset = 6+16*len(rows)
+    for row in rows:
+        matches = [r for r in leaves if r['path'] == [3, row['resource_id'], group['path'][2]]]
+        if len(matches) != 1 or matches[0]['bytes'] != row['bytes']:
+            raise ValueError('missing/ambiguous icon language or mismatched image size')
+        leaf = matches[0]
+        image = take(data, leaf['file_offset'], leaf['bytes'])
+        header.extend(struct.pack('<4B2H2I', row['width'] % 256, row['height'] % 256,
+                                  row['colors'], 0, row['planes'], row['bits'], len(image), offset))
+        images.append(image)
+        offset += len(image)
+    return bytes(header)+b''.join(images), rows
+
+
+def main():
+    summaries = []
+    for label in ('macos--libSDL-1.2.0.dylib', 'macos--Quake3-UrT.x86_64',
+                  'windows--Quake3-UrT.exe', 'windows--Quake3-UrT-Ded.exe'):
+        report = json.loads(Path(f'docs/research/native/{label}.json').read_text())
+        data = verified((Path('.cache/UrbanTerror43')/report['source']['path']).read_bytes(), report['source']['sha256'])
+        layout, _ = parse(data)
+        output = {'source': report['source']}
+        if layout['format'] == 'Mach-O':
+            rows = stab_records(data, layout)
+            output.update(decode_stabs(data, layout, rows))
+            artifact = Path(f'assets/analysis/native/{label}.stabs.jsonl.gz')
+            write_rows(artifact, rows)
+            output['raw_records'] = str(artifact)
+            summaries.append({'image': label, 'stabs': len(rows), 'function_ranges': len(output['functions']),
+                              'objects': len(output['objects']), 'unresolved': len(output['unresolved'])})
+        else:
+            leaves = resource_leaves(data, layout)
+            root = Path(f'assets/analysis/native/resources/{label}')
+            icons = []
+            for i, leaf in enumerate(leaves):
+                path = root/f'{i:06d}.bin'
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_bytes(take(data, leaf['file_offset'], leaf['bytes']))
+                leaf['output'] = str(path)
+                if len(leaf['path']) == 3 and leaf['path'][0] == 3:
+                    leaf['dib'] = icon_dib(take(data, leaf['file_offset'], leaf['bytes']))
+                if len(leaf['path']) == 3 and leaf['path'][0] == 6:
+                    leaf['strings'] = string_table(take(data, leaf['file_offset'], leaf['bytes']), leaf['path'][1])
+                if len(leaf['path']) == 3 and leaf['path'][0] == 14:
+                    ico, entries = reconstruct_icon(data, leaves, leaf)
+                    path = root/f'{i:06d}.ico'
+                    path.write_bytes(ico)
+                    icons.append({'group_path': leaf['path'], 'entries': entries, 'output': str(path),
+                                  'bytes': len(ico), 'sha256': hashlib.sha256(ico).hexdigest()})
+            output.update({'leaves': leaves, 'icon_groups': icons, 'limitations':
+                           'All leaves are preserved. Shipped icon groups, DIB headers/extents and string tables are decoded. '
+                           'Pixel/mask behavior and surplus icon bytes remain unclassified; other resource types are not decoded.'})
+            summaries.append({'image': label, 'resource_leaves': len(leaves),
+                              'type_counts': dict(Counter(str(r['path'][0]) for r in leaves)), 'icon_groups': len(icons)})
+        write_json(Path(f'docs/research/native/{label}.metadata.json'), output)
+    write_json(Path('docs/research/native/metadata-summary.json'), summaries)
+    print(json.dumps(summaries, indent=2))
+
+
+if __name__ == '__main__':
+    main()

scripts/test_native_metadata.py

@@ -0,0 +1,103 @@
+#!/usr/bin/env python3
+"""Malformed metadata, resource variants and supplied image reconstruction checks."""
+import gzip
+import hashlib
+import json
+from pathlib import Path
+import struct
+import unittest
+from analyze_native import parse
+from analyze_native_metadata import resource_leaves, decode_stabs, string_table, icon_group, reconstruct_icon, icon_dib
+
+
+def resource_fixture():
+    data = bytearray(512)
+    for offset, ident, target in [(0, 3, 0x80000018), (24, 7, 0x80000030), (48, 1033, 72)]:
+        struct.pack_into('<IIHHHHII', data, offset, 0, 0, 0, 0, 0, 1, ident, target)
+    struct.pack_into('<4I', data, 72, 0x1080, 4, 0, 0)
+    data[128:132] = b'icon'
+    return data, {'format': 'PE', 'data_directories': [{'index': 2, 'rva_or_security_file_offset': 0x1000, 'bytes': 128}],
+                  'sections': [{'rva': 0x1000, 'bytes': 512, 'file_offset': 0}]}
+
+
+class MetadataTests(unittest.TestCase):
+    def test_rva_and_relative_offsets(self):
+        data, layout = resource_fixture()
+        r = resource_leaves(data, layout)
+        self.assertEqual(r[0]['path'], [3, 7, 1033])
+        self.assertEqual(r[0]['file_offset'], 128)
+        self.assertEqual(r[0]['sha256'], hashlib.sha256(b'icon').hexdigest())
+
+    def test_named_resource(self):
+        data, layout = resource_fixture()
+        struct.pack_into('<HH', data, 12, 1, 0)
+        struct.pack_into('<I', data, 16, 0x80000064)
+        struct.pack_into('<H', data, 100, 2)
+        data[102:106] = '名字'.encode('utf-16le')
+        self.assertEqual(resource_leaves(data, layout)[0]['path'][0], '名字')
+
+    def test_cycle_and_unbacked_payload_rejected(self):
+        for offset, value in [(20, 0x80000000), (72, 0x11ff)]:
+            data, layout = resource_fixture()
+            struct.pack_into('<I', data, offset, value)
+            with self.subTest(offset=offset), self.assertRaises(ValueError):
+                resource_leaves(data, layout)
+
+    def test_string_table_lengths_and_ids(self):
+        payload = struct.pack('<H', 2)+'Hi'.encode('utf-16le')+b'\0\0'*15
+        self.assertEqual(string_table(payload, 2)[0], {'id': 16, 'text': 'Hi'})
+        for malformed in (payload[:-1], payload+b'\0'):
+            with self.assertRaises(ValueError):
+                string_table(malformed, 2)
+
+    def test_icon_variant_must_match_language_and_length(self):
+        group = struct.pack('<3H4B2HIH', 0, 1, 1, 16, 16, 0, 0, 1, 32, 4, 7)
+        rows = icon_group(group)
+        self.assertEqual(rows[0]['resource_id'], 7)
+        leaf = {'path': [14, 1, 1033], 'file_offset': 0, 'bytes': len(group)}
+        for variant in ({'path': [3, 7, 1031], 'bytes': 4}, {'path': [3, 7, 1033], 'bytes': 3}):
+            with self.assertRaises(ValueError):
+                reconstruct_icon(group, [variant], leaf)
+
+    def test_stabs_end_is_length_and_unmatched_retained(self):
+        layout = {'sections': [{'index': 1, 'executable': True, 'zero_fill': False,
+                                'address': 0x1000, 'bytes': 16, 'file_offset': 0}]}
+        rows = [{'kind': 'N_FUN', 'name': '_fn', 'value': 0x1004, 'section': 1, 'symbol_index': 1},
+                {'kind': 'N_FUN', 'name': '', 'value': 4, 'section': 0, 'symbol_index': 2}]
+        r = decode_stabs(b'0123456789abcdef', layout, rows)
+        self.assertEqual(r['functions'][0]['sha256'], hashlib.sha256(b'4567').hexdigest())
+        self.assertEqual(len(decode_stabs(b'0'*16, layout, rows[:1])['unresolved']), 1)
+
+    def test_shipped_ranges_and_icon_reconstruction(self):
+        for label, count in [('macos--libSDL-1.2.0.dylib', 1012), ('macos--Quake3-UrT.x86_64', 6)]:
+            r = json.loads(Path(f'docs/research/native/{label}.metadata.json').read_text())
+            data = (Path('.cache/UrbanTerror43')/r['source']['path']).read_bytes()
+            self.assertEqual(hashlib.sha256(data).hexdigest(), r['source']['sha256'])
+            self.assertEqual(len(r['functions']), count)
+            self.assertEqual(r['unresolved'], [])
+            previous_end = 0
+            for f in sorted(r['functions'], key=lambda f: f['address']):
+                self.assertGreaterEqual(f['address'], previous_end)
+                previous_end = f['address']+f['bytes']
+                self.assertEqual(hashlib.sha256(data[f['file_offset']:f['file_offset']+f['bytes']]).hexdigest(), f['sha256'])
+            raw = [json.loads(line) for line in gzip.open(r['raw_records'], 'rt')]
+            self.assertEqual(len(raw), r['record_count'])
+        r = json.loads(Path('docs/research/native/windows--Quake3-UrT.exe.metadata.json').read_text())
+        data = (Path('.cache/UrbanTerror43')/r['source']['path']).read_bytes()
+        leaves = resource_leaves(data, parse(data)[0])
+        self.assertEqual(len(leaves), 9)
+        for leaf in r['leaves']:
+            self.assertEqual(hashlib.sha256(Path(leaf['output']).read_bytes()).hexdigest(), leaf['sha256'])
+        group = next(l for l in leaves if l['path'][0] == 14)
+        ico, rows = reconstruct_icon(data, leaves, group)
+        self.assertEqual(ico, Path(r['icon_groups'][0]['output']).read_bytes())
+        self.assertEqual(len(rows), 7)
+        for i, row in enumerate(rows):
+            _, _, _, _, _, _, size, offset = struct.unpack_from('<4B2H2I', ico, 6+i*16)
+            image = ico[offset:offset+size]
+            self.assertEqual(size, row['bytes'])
+            self.assertEqual(icon_dib(image)['width'], row['width'])
+
+
+if __name__ == '__main__':
+    unittest.main()