Type WAYPOINT_HandleActivation’s packet input as bytes
Ghidra v1797 · 3bccb89
ECX pMessage is a byte-buffer pointer. Its sole 0x60 adapter copies one DWORD, one WORD and one BYTE into an 8-byte scratch block, initializing bytes 0..6, then passes its base in ECX. The complete 146-byte target preserves that address in EDI and reads only DWORD+3 (bytes 3..6), BYTE+2 and BYTE+1. Every packet access therefore fits the seven initialized bytes, including the unaligned GUID read. Full adapter and target bytes were checked against the original Windows PE, and the sole incoming argument path was verified. Retype only existing pMessage int32_t to uint8_t*, preserving its chosen name, ECX storage, fastcall and void return. The normal exit is a bare RET; existing null/assert paths and all other contracts remain. No fixed packet extent, semantic structure or runtime/byte-match improvement is claimed.
Changes 1, applied together
Retype variable
win 0x004bdf30 ECXtypeint32_t→uint8_t *