New reference:
- dart-aot.md: pinning the Dart version, building a matching decompiler, the object-pool
model and reference indexes, register/boolean conventions, the three assembly signatures
that identify most business logic, the locating workflow, patch strategy, and the traps
specific to this layer (including ambiguous identifiers that resolve to protocol fields).
New scripts (parameterized, no machine-specific paths):
- dart_pprefs.py: object-pool offset -> code-site index, decoded arithmetically. Avoids the
full-capstone pass that costs minutes and 1-2 GB and reads as a hang.
- dart_pool_strings.py: framed literal recovery with file offsets. Defaults to one-byte
because automatic two-byte (UTF-16) detection is unreliable; --find searches both
encodings and is the reliable way to locate a known literal.
- dart_disasm.py: annotated windowed disassembly (pool + boolean annotations) and a B/BL
caller index that needs no disassembler.
Fixes and integration:
- framework-runtimes.md: point the Dart depth at dart-aot.md, and make the string-encoding
rule precise (ASCII is one-byte/UTF-8; CJK is UTF-16LE) instead of leaving it as 'try both'.
- pitfalls.md: P26 -- self-built tooling that fails in a way that reads as a target finding
(silent arithmetic, helper shadowing a stdlib module, measuring against an incomplete
reference, and a knob that does not move the metric).
- SKILL.md / README.md: index the new reference and scripts.
Validated by running all three scripts against a real Dart AOT sample: the pool-ref index
agrees with an independently built index to 99.2%, and the literal extractor's one-byte
output was verified string-by-string against a decompiler's pool listing.
