REDIVIVUS

Proposals / #709

UTF8 boundary helpers take a byte-buffer base pointer

applied · by Commit-Will · submitted 2026-11-01, applied 2026-11-01

Ghidra v1797 · 3bccb89

The base argument is a byte-buffer pointer in all three helpers, not an integer. The complete core reads byte [EDX+EAX] at 006c7794, stops at NUL, masks the byte with 0xc0 and compares 0x80, while only the numeric position in EAX advances. Both complete wrappers load Stack[4] into EDX unchanged before calling the core; direction remains in ESI. Retype only the existing base slots to uint8_t*, preserving all names, returns, conventions and custom EDX/EAX/ESI storage. Core refs are exactly the two wrapper calls. The wrappers have no reported incoming code or data refs, so this is an API-only correction with no runtime producer claim. All 77 bytes were checked against the original Windows PE; no return inference, Mac pairing or API-table assumption.

Changes 3, applied together

  1. Retype variable win 0x006c7790 EDX

    typeint→uint8_t *
  2. Retype variable win 0x006c77b0 Stack[0x4]

    typeint→uint8_t *
  3. Retype variable win 0x006c77d0 Stack[0x4]

    typeint→uint8_t *