Proposals / #629

Type WARDEN_ComputeModuleHash’s digest output as bytes

applied · by Commit-Will · submitted 2026-11-01, applied 2026-11-01

Ghidra v1797 · 3bccb89

pHashOut is a writable byte-buffer pointer in Stack[0x8], not a scalar. Sole caller WARDEN_VerifyModuleSignature obtains the buffer from SMemAlloc, fills it as bytes, then PUSH ESI at 0x0047faab supplies pHashOut before ESI is reused for nSplitOffset. Complete 132-byte target loads that unchanged stacked argument at 0x0047fa01 and pushes it to Sha1_Finalize. Complete finalizer emits five words with four BYTE stores per iteration, covering output offsets0..19. Full target/caller/finalizer/allocator bytes independently match the original Windows PE. Retype only existing Stack[0x8] pHashOut int32_t to uint8_t*, preserving its chosen name, void return, convention, szModuleName stack slot and all three custom register inputs ESI/EAX/EBX. No fixed array extent, runtime change or byte-match improvement is claimed.

Changes 1, applied together

1. Retype variable win 0x0047f990 Stack[0x8]

   typeint32_t→uint8_t *