Probe observer1 route service lookup

2026-06-20 01:30:56 -05:00
parent ad4907040a
commit 8c8cc784e0
3 changed files with 149 additions and 2 deletions
@@ -40,6 +40,10 @@ Current behavior:
  active byte at offset `0x84`, the service lookup key at offset `0x8c`, and
  the runtime observer1 service-owner path used before its vtable `0x220`
  lookup.
+- Hooks observer1's generic service lookup at `0x287c44`, filters it to the
+  runtime type pointer at `.data` RVA `0x342f6a8`, logs the returned service
+  object and slot `0x220`, then dynamically hooks that service `0x220` route
+  lookup to log its route-id output handle.
 - Resolves the native mappin system when one of those paths fires, logs relevant
  vtable slot addresses, and temporarily hooks the route-adjacent slots.

@@ -58,6 +62,8 @@ Current route-probe focus:
 - mappin route activate/deactivate: `0xaa6330`, `0x27abd7c`
 - mappin route observer callbacks: `0xaa6610`, `0xaa6628`, `0xaa63e0`,
  `0x27b10c0`, `0x295d4a0`, `0x286a85c`
+- observer1 service lookup and returned service route lookup:
+  `0x287c44`, dynamic service vtable slot `0x220`
 - route-build candidate called by the bridge: `0x5625a4`

 Quest/objective pins did not fire the mappin tracking hooks in live tests. The