Four Scouts into the so Stratum: The vtable Callback Protocol, the Hunt for the RequestAd Wait, and a Three-Line Encirclement of the No-Ad Path

The last shift staked the three gates; this one sent four scouts to measure the hinges. The encirclement has a single objective: fix the landing point of the patch — move libcupid, or move the kernel wait.

I. The Division of Four Routes

The deployment follows the house law: Subagent One reverse-engineers the kernel RequestAd call chain, locating the equivalent of ad-ready / no-ad events; Subagent Two disassembles the ARM32 shared library for the vtable of the CUPID ad-callback protocol — the IAdJsonDelegate virtual function table is the receipt contract between CUPID and the kernel; Subagent Three hunts libcupid.so for the no-ad adjudication path (make the state machine walk the no-ad branch directly, failing fast without hanging); Subagent Four observes live CUPID event logs on the rooted box, extracting real request/response sequences. The first two answer what the kernel is waiting for; the last two answer under what conditions libcupid says none.

II. The vtable: Carrier of the Callback Protocol

Subagent Two’s battlefield is the fog of function pointers: the callback object the kernel registers with CUPID is a C++ object, and every virtual slot of its vtable is a receipt channel — which slot carries ad-ready, which failure, which no-ad. To map that vtable’s memory layout is to obtain the codebook between the two armies: whether the patch lands on libcupid’s exit or forges the kernel’s entry, it must be written in this codebook. Combined with the mainline findings (the slot_type mask, event 13’s failure branch, the 0x6f9f4 exit), the full picture of the callback protocol lacks only its final pages.

III. The Wait: The Direction of the Hang’s Root Cause

Subagent One chases another cold case: after RequestAd, what is the kernel waiting for, and for how long — the root of the v13 test package’s hang after the ad passed lies in this stretch of waiting logic. If the wait has a timeout ceiling, the epilogue after a forged no-ad callback can land gracefully; if the wait blocks without limit, the patch must carry its own wake-up. This is the key precondition for the TEST-ONLY package to be hang-free.

IV. The Methodology of Encirclement

The value of four parallel lines is not parallelism itself but cross-verification: static disassembly (vtable and wait mechanism), in-library paths (the no-ad adjudication), and dynamic logs (real event sequences on the box) mutually correct one another — any misreading on a single line is caught by the other two; the wrongful conviction of thumb BLX was precisely the lesson of single-line scanning. The preconditions for the cloud-built TEST-ONLY are complete: gate addresses, forgery recipe, protocol codebook, the direction of the hang’s root. What remains is writing the patch, and turning the hundred-and-some seconds of waiting in The Shadow Catcher into one graceful no-ad receipt.