VerifiedBuild 2026.06.26.1097863.1, CU2

HaloSimulation_tag_release.dll

Native Blam simulation module loaded by the UE5 BlamEngine plugin. This page records the current factory ABI and interface shape recovered from the installed CU2 build.

Artifact fingerprint

Size: 14,670,608 bytes
SHA-256: 8EE1A37F6F0BC89241F47946546EDCA798962F81E2D06B386196BC75DE991705
Image base: 0x180000000

Shell factory

bool CreateBlamEngineShell(void* context, void** outShell)

Export RVA: 0x6980.
Allocates 0x5A0 bytes aligned to 0x20 bytes.
Installs interface tables at object offsets 0x0 and 0x140.
Initializes three lock-free lists and a 32-entry reusable event pool.
Replaces the process-global shell, frees the previous allocation, writes outShell, and returns 1.

Primary interface

The table at RVA 0x7B1560 has nine entries. Names below describe observed behavior; they are not recovered source symbols.

Slot	RVA	Observed behavior
0	0x7230	Releases the global shell allocation and clears shell state.
1	0x7280	Performs one-time initialization and normalizes a caller-supplied path.
2	0x7360	Large startup path: initializes tag systems and can create a worker thread.
3	0x89F0	Clears queues, frees worker state, waits for the worker, and closes its handle.
4	0x6940	Returns the embedded interface at this + 0x140.
5	0x8B00	Builds an auxiliary result/container; semantic role is not yet identified.
6	0x9A00	Allocates and returns an auxiliary callback object.
7	0x9A70	Releases four callback/object references.
8	0x6130	Control Flow Guard placeholder in the recovered table.

Embedded output interface

Slot 4 returns this + 0x140, whose table is at RVA 0x7B1610. It also has nine entries. One method drains and dispatches shell events, four methods enqueue typed payloads through the lock-free pool, and three small thunks release payload objects.

UE5 loader path

The matching host is CU2 build 2026.06.26.1097863.1. Its SHA-256 is 0670FAA751E2553940B90DF6BE43D3B0FF59EA87F22155CF3C3FE9D439367F1D.

A launcher method constructs the wide module basename HaloSimulation.
The engine module loader stores its handle at launcher offset 0x1A0.
The export resolver looks up CreateBlamEngineShell.
The factory writes the shell pointer at launcher offset 0x1C8.
UE5 immediately invokes primary interface slot 1.

The host does not contain a contiguous tag_release filename. That suffix is selected below this recovered launcher layer.

Current limits

Slot names remain behavioral labels, not source symbols. Runtime invocation has not yet established which startup structures select CTF or another game variant. The next useful step is to trace host call sites for primary slots 2 and 3, then correlate their inputs with the reflected BlamGameEngineBaseVariant and BlamGameEngineCampaignVariant objects.

Reproduce

analyzeHeadless <project-dir> HaloSimulation \
  -import HaloSimulation_tag_release.dll \
  -scriptPath tools/ghidra \
  -postScript AnalyzeBlamShell.java <output-dir>

The reusable probe is checked in at tools/ghidra/AnalyzeBlamShell.java.