Proposals / #725

Signature generation and marker lookup take a byte-buffer input

applied · by Commit-Will · submitted 2026-11-01, applied 2026-11-02

Ghidra v1804 · 39698f0

These two integer-typed parameters are the same mutable byte-buffer address. SSignatureGenerate saves incoming ECX, pushes it as the marker helper's Stack[4] input, then loads it into ESI for SSIG_HashData, whose append callee reads input bytes. On success the generator stores a marker at base+byteOffset and copies signature bytes to base+byteOffset+4. The complete marker helper adds a byte count to that base and reads the marker word; it never treats the base as a scalar ID. Retype only generator ECX and marker Stack[4] to uint8_t*. Preserve names, returns, every other argument, and the marker's exact __stdcall_edxsafe custom ECX/EDX/ESI contract. Generator has no reported incoming refs; this is API-only dataflow proof, not runtime signing validation. No set_prototype, API-table, Mac-pairing or struct inference.

Changes 2, applied together

1. Retype variable win 0x0041d590 ECX

   typeint32_t→uint8_t *

2. Retype variable win 0x0041d340 Stack[0x4]

   typeint32_t→uint8_t *