EXPcalibur guide
Three separate jump probes reveal three different VM notes. Three jumps ask three different questions Three jumps ask three different questions SEPARATE ONE-TICK PROGRAMS · FLAGS SHOWN ARE THE ONES THESE CHAINS NEED V E C T O R Question: where did the target number come from? L O A D 18 f r o m s c r a t c h Value came from memory J u m p t o b y t e 18 Original instruction start c o m p u t e d _ j u m p = t r u e Target can be perfectly valid G A D G E T Question: did the jump land on an original instruction start? PUSH 2 ; J M P _ A B S Literal target, not computed 01 00 F F 00 00 B y t e 2 i s d a t a i n PUSH c f i _ v i o l a t i o n = t r u e F e t c h F F a s H A L T T R A M P O L I N E Question: did the VM fetch an instruction beyond the upload? S T O R E F F a t 0 x D 000 PUSH 0 x D 000 ; J M P _ A B S 0 x D 000 i s p a s t c o d e _ e n d F e t c h s t o r e d F F a s H A L T c f i _ v i o l a t i o n = t r u e e x e c _ o f f _ i m a g e = t r u e These flags are observations. A CLASSIC meter still needs its own magic, fresh answer, and repeated ticks. The target value, landing address, and actual instruction fetch matter in different ways. The off-image jump sets both the GADGET and TRAMPOLINE notes; the three probes alone do not fill any CLASSIC meter.