# Native debug maps and Windows resources

Static analysis, 2026-10-11. Reproduce with `python3 scripts/analyze_native_metadata.py`; validate with `python3 scripts/test_native_metadata.py`. The collector is part of `analyze_binaries.py`. [Summary](metadata-summary.json) and per-image metadata reports record original SHA-256 identities. No supplied executable or library was run.

## META-001: Mach-O STABS debug maps

The reader walks the original `LC_SYMTAB` nlist array, including anonymous/zero-string-index records, rather than relying on a filtered symbol inventory. It retains original symbol indices, file offsets, type, section, description and value. Record names follow [Apple's STABS definitions](https://github.com/apple-oss-distributions/xnu/blob/main/EXTERNAL_HEADERS/mach-o/stab.h). Paired `N_FUN` records delimit the function ranges in these images; closing values are treated as lengths and checked against file-backed executable sections. Embedded source paths and object timestamps are unverified build evidence.

| Image | Records | Source entries / object entries | Paired function ranges | Bytes in those ranges | Unmatched/invalid function records |
| --- | --- | --- | --- | --- | --- |
| SDL dylib | 4,719 | 78 / 78 | 1,012 | 327,111 | 0 |
| macOS client executable | 34 | 1 / 1 | 6 | 2,289 | 0 |

The [SDL report](macos--libSDL-1.2.0.dylib.metadata.json) associates functions with source files and object paths and hashes each byte range. Tests confirm the ranges do not overlap. SDL's `__text` section contains 327,635 bytes; the remaining 524 bytes are outside these function ranges and need reconciliation as padding or other code/data. Range recovery does not mean each function has been analyzed or matched to upstream source.

SDL source names cover common event/video/audio surfaces, software blitters, Quartz, X11/DGA and X extensions, CoreAudio, Darwin joystick/CD code, pthreads, Unix timers and dynamic loading. These are compilation provenance candidates, not proof that every backend is reachable on this macOS build. The recorded build prefix identifies `SDL-1.2.15`; upstream implementation comparison remains open.

The records comprise 2,024 `N_FUN`, 1,012 each `N_BNSYM`/`N_ENSYM`, 350 `N_STSYM`, 234 `N_SO`, 78 `N_OSO` and nine `N_SOL`. No local/register/parameter/type-description record classes were observed. Full C data types cannot be recovered from a debug map that does not contain them. Static and include records remain searchable in the raw compressed evidence under `assets/analysis/native/`.

The [client report](macos--Quake3-UrT.x86_64.metadata.json) identifies SDLMain Objective-C methods for termination, working-directory setup, file opening, launch handling, NSString replacement, and `_main`. Its object path mentions `libSDLmain.a(SDLMain.o)` inside an ioq3-for-UrbanTerror build. This is a small retained launcher debug map, not debug coverage for the whole engine.

## META-002: Windows resource variants

The parser follows directory-relative tree offsets and separately maps leaf payload RVAs to file-backed sections, with bounds/cycle checks. Paths retain type, name and language; named entries use UTF-16. This follows the [Microsoft PE resource tree definition](https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-rsrc-section). Every leaf is preserved separately under `assets/analysis/native/resources/windows--Quake3-UrT.exe/`, using existing Xet filters.

The [client report](windows--Quake3-UrT.exe.metadata.json) contains **nine leaves**, all language ID 1033: seven type-3 icon images, one type-6 string block and one type-14 icon group. Payloads total **353,268 bytes** within the 353,788-byte resource directory region. Tree metadata, alignment and any remaining byte gaps require separate coverage reconciliation. No version, manifest or dialog leaf occurs in this tree. The [dedicated report](windows--Quake3-UrT-Ded.exe.metadata.json) confirms its resource directory is absent; this says nothing about Windows installation files outside the supplied snapshot.

The string block has sixteen length-prefixed UTF-16 slots. Only ID 1 is nonempty: `Quake3-UrT`. Empty entries are retained. The group links images at 16, 32 and 48 pixels with both 8-bit and 32-bit variants, plus a 256-pixel 32-bit image. Reconstruction into a **353,230-byte ICO** preserves the seven image payloads exactly and validates image size and language matches, using [Microsoft's group/icon structures](https://learn.microsoft.com/en-us/previous-versions/ms997538(v=msdn.10)). Raw group and image leaves are preserved alongside the ICO.

## META-003: icon extents need rendering checks

All seven images use a 40-byte uncompressed DIB header with a doubled stored height for pixel/mask planes. The three indexed images exactly match the computed palette, aligned pixel rows and standard one-bit AND mask extent. Four 32-bit variants have additional bytes:

| Dimensions | Payload bytes | Standard layout bytes | Surplus bytes retained |
| --- | --- | --- | --- |
| 16 × 16 | 1,320 | 1,128 | 192 |
| 32 × 32 | 5,160 | 4,264 | 896 |
| 48 × 48 | 11,560 | 9,640 | 1,920 |
| 256 × 256 | 327,720 | 270,376 | 57,344 |

The payload lengths fit a larger mask/data extent, but its interpretation is not established. All declared image-size fields are zero. The collector records and hashes surplus bytes instead of dropping them. ICO structural reconstruction and payload equality pass; visual correctness, alpha/mask behavior and operating-system handling of those bytes have not been tested. A future converter must retain the originals and compare rendered variants before normalization.

## Verification and remaining tasks

Seven tests cover relative offsets versus RVAs, named resources, cycles, unbacked payloads, malformed string tables, language/size mismatch, function closure interpretation, every recovered real function hash, nonoverlapping ranges and all reconstructed icon payloads. Reports and derived assets regenerate byte-for-byte.

RE-214–216 complete this static metadata pass. RE-208 remains open for pinned SDL source comparison, implementation differences, absent-type reconstruction and helper behavior. RE-210 remains open for load/bind/relocation details and uncovered regions. Follow up icon surplus/mask rendering, the 524 SDL text bytes outside debug-map functions, and exact resource-region byte coverage before treating these formats as fully understood.

Follow-up: [COV-001/002](COVERAGE.md) resolves the 524 SDL text bytes as NOP sequences and accounts for all 520 non-payload resource bytes as directory structures. Earlier gap questions above are now resolved for these bounded regions; icon surplus remains open.