File size: 6,439 Bytes
37a2f91 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 | #!/usr/bin/env python3
"""Verified native frequencies, supplied memset initialization and seed-loop requests."""
import copy
import gzip
import hashlib
import json
from pathlib import Path
import re
import struct
from analyze_area_queries import site
from analyze_bsp_references import global_address,trace_fields
from analyze_collision_composition import evaluate,get_word,put_word
from analyze_engine_control import control_flow
from analyze_frame_timing import read_address
from analyze_native import elf
from analyze_qvm import write_json
from analyze_vm_extensions import native_functions,verified
SIZE=0xc830
def run(g,start,stops,m,regs):return evaluate(g,start,stops,m,regs,limit=10000,capture_registers=True)
def omit_push(g):
out=copy.deepcopy(g);addresses=[]
for x in out['instructions']:
if x['opcode']=='pushq':addresses.append(x['address']);x['opcode']='nop';x['operands']=''
return out,addresses
def main():
out={'native':{},'limitations':'Paired Linux ELF64 bounded synthetic initialization/schedule slices. Original processes/native callees never execute. PUSH omitted, POP/RET stopped; memset effects supplied. Real frequency table extracted from verified file-backed image, but conceptual full schedule digest is generated from counts, not evaluated through all native training iterations. Huff_addRef requests stop before calls; no trained/adaptive tree or actual codebook/runtime/platform conformance is established.'}
for label in ['linux--Quake3-UrT-Ded.x86_64','linux--Quake3-UrT.x86_64']:
r=json.loads(Path(f'docs/research/native/{label}.json').read_text());data=verified((Path('.cache/UrbanTerror43')/r['source']['path']).read_bytes(),r['source']['sha256']);meta,_=elf(data);a=r['artifacts']['disassembly.txt'];fs=native_functions(verified(gzip.open(a['path'],'rb').read(),a['uncompressed_sha256']).decode());graphs={n:control_flow(fs[n]) for n in ['MSG_initHuffman','Huff_Init','Huff_addRef','increment']}
g,omitted=omit_push(graphs['MSG_initHuffman']);rows=g['instructions'];table_ins=next(x for x in rows if x['opcode']=='cmpl' and '(,%r13,4)' in x['operands']);address=int(re.search(r'0x([0-9a-f]+)\(',table_ins['operands'])[1],16);raw,offset=read_address(data,meta['sections'],address,1024);frequencies=list(struct.unpack('<256I',raw))
digest=hashlib.sha256()
# Relative tree ordinals keep this conceptual request digest independent of addresses.
for symbol,count in enumerate(frequencies):digest.update(bytes([symbol,0,symbol,1])*count)
init_idx=next(i for i,x in enumerate(rows) if '<Huff_Init>' in x['operands']);flag=global_address(next(x for x in rows if x['opcode']=='movl' and '(%rip)' in x['operands']))
entry=run(g,rows[0]['address'],[rows[init_idx]['address']],{}, {'%rsp':0x90000})
add_calls={x['address']:i for i,x in enumerate(rows) if '<Huff_addRef>' in x['operands']};end=site(g,'addq','$0x8, %rsp');schedule=[]
for name in ['zero','edges','sparse','ones']:
counts=[0]*256
if name=='edges':counts[0]=2;counts[255]=3
elif name=='sparse':counts[1]=1;counts[127]=2;counts[128]=1;counts[254]=2
elif name=='ones':counts=[1]*256
m=dict(entry['memory'])
for i,count in enumerate(counts):put_word(m,address+4*i,count)
regs=dict(entry['registers']);start=rows[init_idx+1]['address'];requests=[];trace=[]
while True:
t=run(g,start,list(add_calls)+[end],m,regs);trace+=t['trace'];m=t['memory'];regs=t['registers']
if t['stop']==end:break
requests.append([regs['rdi'],regs['rsi']]);start=rows[add_calls[t['stop']]+1]['address']
if len(requests)>512:raise ValueError('fixture request bound')
schedule.append({'fixture':name,'supplied_counts':counts,'requests':requests,'final_symbol':regs['rbp'],'flag_word':get_word(m,flag),**trace_fields({'trace':trace},False)})
init,init_omitted=omit_push(graphs['Huff_Init']);ir=init['instructions'];calls={x['address']:i for i,x in enumerate(ir) if x['opcode']=='callq'};end_init=next(x['address'] for x in ir if x['opcode']=='popq');probes=[]
for base,sentinel in [(0x10000,0xa5),(0x40000,255)]:
m={base+i:sentinel for i in range(-1,2*SIZE+1)};regs={'%rdi':base};start=ir[0]['address'];requests=[];trace=[]
while True:
t=run(init,start,list(calls)+[end_init],m,regs);trace+=t['trace'];m=t['memory'];regs=t['registers']
if t['stop']==end_init:break
requests.append([regs[k] for k in ['rdi','rsi','rdx']])
if 'memset@plt' not in ir[calls[t['stop']]]['operands']:raise ValueError('unexpected initialization callee')
for i in range(regs['rdx']):m[regs['rdi']+i]=regs['rsi']&255
start=ir[calls[t['stop']]+1]['address']
objects=[]
for obj in [base,base+SIZE]:
node=get_word(m,obj+8,8);objects.append({'offset':obj-base,'node_count':get_word(m,obj),'root_pointer':node,'list_pointers':[get_word(m,obj+x,8) for x in [16,24]],'nyt_lookup_pointer':get_word(m,obj+0x820,8),'node_pool_offset':node-obj,'node_bytes':[m[node+i] for i in range(56)],'nonzero_bytes':[[i,m[obj+i]] for i in range(SIZE) if m[obj+i]]})
probes.append({'base':base,'sentinel':sentinel,'memset_requests':requests,'objects':objects,'canaries':[m[base-1],m[base+2*SIZE]],**trace_fields({'trace':trace},True)})
out['native'][label]={'source':r['source'],'disassembly_sha256':a['uncompressed_sha256'],'graphs':graphs,'frequency_table':{'address':address,'file_offset':offset,'sha256':hashlib.sha256(raw).hexdigest(),'counts':frequencies,'total':sum(frequencies),'paired_request_count':2*sum(frequencies),'conceptual_schedule_sha256':digest.hexdigest(),'digest_encoding':'for each symbol ascending, repeated count times: bytes(symbol,tree0,symbol,tree1)'},'entry_request':{'huff_init_pointer':entry['registers']['rdi'],'flag_word':get_word(entry['memory'],flag),'omitted_push_addresses':omitted,**trace_fields(entry,True)},'schedule_probes':schedule,'initialization_probes':probes,'init_omitted_push_addresses':init_omitted}
write_json(Path('docs/research/huffman-initialization.json'),out);print('Recovered paired 256-entry frequencies, eight schedule and four empty-tree initialization probes')
if __name__=='__main__':main()
|