DARKER Research archive

Live convoy capture attempt: 04_009 / 7

These are partial DOSBox debugger captures, not full-route validation. See the discrepancy report. All game execution used /tmp/darker-convoy-live/game, copied from darker/. The original installation was not modified.

Captured evidence

Each *.bin.gz contains a gzip-compressed 1 MiB physical-memory dump. captures.json reports SHA-256 of the uncompressed memory, code identity, loaded route prefix and object fields. Reproduce it with:

python3 tools/inspect_convoy_capture.py analysis/missions/convoy-live/attempt-*/*.bin.gz > analysis/missions/convoy-live/captures.json

The inspector decodes the expected object addresses even before construction; plausible_route_object: false warns that those fields are not usable vehicle state. In particular, stage-patched and briefing-state are startup evidence, not movement captures. A true flag only checks the callback and route-pointer range; it is not a general validity or activity guarantee.

At mission entry, CS/DS = 01A2, SS = 2C42; shared data starts at CS:F000. Object 6 starts at SS:DC26, with next-route pointer at SS:DC7E. The first route instruction at CS:F136 maps to resource offset 42B5. convoy-first-fetch2 and the later first-fetch captures show next pointer F137, while the action byte is still zero: execution stopped at 8F78, before storing the new action. A similarly named earlier dump, convoy-first-fetch, still has F136; it is not evidence of a completed fetch.

Controlled-start interventions

The saved driver scripts depend on the temporary debugger path, Xvfb, pexpect, xdotool and ImageMagick. They accept newline-delimited JSON commands on stdin; they are preserved as capture provenance, not a portable test suite. The terminal logs contain the debugger commands and register displays.

  1. Run the temporary copy under DOSBox debug (normal CPU core, fixed 20,000 cycles; per-attempt dosbox.conf retained).
  2. Pass the intro with Escape, select menu option 1, pause with Alt+Pause, set BP 01A2:BB12, resume with terminal F5 and press Return in the game.
  3. At the stage-reader breakpoint, write SM 2C42:0FB0 50. Internal stage 80 decimal selects 04_009 / 7.
  4. Set a breakpoint at 01A2:D95C, resume to the briefing loop, then set SR EIP D9F8 to its normal return sequence. This bypasses the briefing; it is an intervention whose complete side effects have not been verified.
  5. Attempts 3 and 4 additionally write SM 01A2:C059 57 F4, advancing the text cursor to F457, corresponding to resource 45D6, the counted in-flight messages. Attempts 1 and 2 leave it at F34A, inside a briefing page. That earlier cursor is incorrect for subsequent message reading.
  6. Break at 01A2:8F3B to capture the first truck callback, then use MEMDUMPBIN 0:0 100000 and compress the result.

Neither the movement code nor route bytes were intentionally edited. Software breakpoints and debugger-controlled startup still make this an instrumented run, not an untouched playthrough.

Attempts and limitations

Attempt Conditions Result
1 Mus=0; route watchpoint; included an attempted Alt+F12 fast-forward Initial callback and first pointer advance; later illegal-instruction loop
2 Mus=1; no fast-forward; route watchpoint Same initial fetch; cockpit screenshot; later illegal-instruction loop
3 Mus=1; corrected message cursor; route watchpoint Same initial fetch; later repeated unhandled interrupt 1
4 Mus=1; corrected message cursor; all breakpoints removed after initial callback, no memory watchpoint Initial callback captured; repeated unhandled interrupt 1 before timed pause/dump succeeded

A memory watchpoint appeared to stop once without a pointer change, so those stops are not counted as route fetches. No successful later movement capture exists. Repeated interrupt/illegal-instruction output is preserved compressed in terminal.txt.gz; its cause remains unknown. Removing fast-forward and watchpoints did not resolve the failure, nor did correcting the text cursor.

The next decisive observation is object 6's second instruction fetch: F138 after reading B1 would support sequential consumption of the prefix; a different pointer or changed stream would identify a missing runtime mechanism. At an approximately 500 Hz clock, the first 13-cell run alone lasts about 106.5 seconds. Full off-map behaviour needs a longer observation. A stable normal briefing transition or normal-play capture is preferable to further conclusions from these failing controlled starts.