Proposals / #730

Type the custom-register path extraction inputs as query and node pointers

applied · by Commit-Will · submitted 2026-11-01, applied 2026-11-02

Ghidra v1804 · 39698f0

Win 0067b690 receives the existing D2PathTypeArg* in ECX and D2DrlgPathNodeStrc* in EAX, currently int32_t and void**. Its sole caller 0067b850 reloads the original query pointer into ECX and supplies the selected actual pool node in EAX. The complete 171-byte target loads query+48 as the owner dynamic path, adds156 for its waypoint array, and walks node parent+12 and coordinate words+0/+2. Independent callback dispatch constructs the exact existing52-byte query object and passes its address in ECX; native pool/list producers establish the56-byte node identity. Retype only ECX:4 and EAX:4, naming the query pPathTypeArg and preserving pCurNode, cdecl, custom storage, int32_t return and locals. Complete target, caller, dispatcher and producer bytes match the original Windows PE. No pending proposal metadata, Mac pair, shared layout or runtime claim is used. Both precise proposed pointee structures already exist in the database.

Changes 3, applied together

1. Retype variable win 0x0067b690 ECX

   typeint32_t→D2PathTypeArg *

2. Retype variable win 0x0067b690 EAX

   typevoid *32 *32→D2DrlgPathNodeStrc *

3. Rename variable win 0x0067b690 ECX

   namenParam→pPathTypeArg