| |
| """Verified native frequencies, supplied memset initialization and seed-loop requests.""" |
| import copy |
| import gzip |
| import hashlib |
| import json |
| from pathlib import Path |
| import re |
| import struct |
| from analyze_area_queries import site |
| from analyze_bsp_references import global_address,trace_fields |
| from analyze_collision_composition import evaluate,get_word,put_word |
| from analyze_engine_control import control_flow |
| from analyze_frame_timing import read_address |
| from analyze_native import elf |
| from analyze_qvm import write_json |
| from analyze_vm_extensions import native_functions,verified |
|
|
|
|
| SIZE=0xc830 |
|
|
|
|
| def run(g,start,stops,m,regs):return evaluate(g,start,stops,m,regs,limit=10000,capture_registers=True) |
|
|
|
|
| def omit_push(g): |
| out=copy.deepcopy(g);addresses=[] |
| for x in out['instructions']: |
| if x['opcode']=='pushq':addresses.append(x['address']);x['opcode']='nop';x['operands']='' |
| return out,addresses |
|
|
|
|
| def main(): |
| out={'native':{},'limitations':'Paired Linux ELF64 bounded synthetic initialization/schedule slices. Original processes/native callees never execute. PUSH omitted, POP/RET stopped; memset effects supplied. Real frequency table extracted from verified file-backed image, but conceptual full schedule digest is generated from counts, not evaluated through all native training iterations. Huff_addRef requests stop before calls; no trained/adaptive tree or actual codebook/runtime/platform conformance is established.'} |
| for label in ['linux--Quake3-UrT-Ded.x86_64','linux--Quake3-UrT.x86_64']: |
| r=json.loads(Path(f'docs/research/native/{label}.json').read_text());data=verified((Path('.cache/UrbanTerror43')/r['source']['path']).read_bytes(),r['source']['sha256']);meta,_=elf(data);a=r['artifacts']['disassembly.txt'];fs=native_functions(verified(gzip.open(a['path'],'rb').read(),a['uncompressed_sha256']).decode());graphs={n:control_flow(fs[n]) for n in ['MSG_initHuffman','Huff_Init','Huff_addRef','increment']} |
| g,omitted=omit_push(graphs['MSG_initHuffman']);rows=g['instructions'];table_ins=next(x for x in rows if x['opcode']=='cmpl' and '(,%r13,4)' in x['operands']);address=int(re.search(r'0x([0-9a-f]+)\(',table_ins['operands'])[1],16);raw,offset=read_address(data,meta['sections'],address,1024);frequencies=list(struct.unpack('<256I',raw)) |
| digest=hashlib.sha256() |
| |
| for symbol,count in enumerate(frequencies):digest.update(bytes([symbol,0,symbol,1])*count) |
| init_idx=next(i for i,x in enumerate(rows) if '<Huff_Init>' in x['operands']);flag=global_address(next(x for x in rows if x['opcode']=='movl' and '(%rip)' in x['operands'])) |
| entry=run(g,rows[0]['address'],[rows[init_idx]['address']],{}, {'%rsp':0x90000}) |
| add_calls={x['address']:i for i,x in enumerate(rows) if '<Huff_addRef>' in x['operands']};end=site(g,'addq','$0x8, %rsp');schedule=[] |
| for name in ['zero','edges','sparse','ones']: |
| counts=[0]*256 |
| if name=='edges':counts[0]=2;counts[255]=3 |
| elif name=='sparse':counts[1]=1;counts[127]=2;counts[128]=1;counts[254]=2 |
| elif name=='ones':counts=[1]*256 |
| m=dict(entry['memory']) |
| for i,count in enumerate(counts):put_word(m,address+4*i,count) |
| regs=dict(entry['registers']);start=rows[init_idx+1]['address'];requests=[];trace=[] |
| while True: |
| t=run(g,start,list(add_calls)+[end],m,regs);trace+=t['trace'];m=t['memory'];regs=t['registers'] |
| if t['stop']==end:break |
| requests.append([regs['rdi'],regs['rsi']]);start=rows[add_calls[t['stop']]+1]['address'] |
| if len(requests)>512:raise ValueError('fixture request bound') |
| schedule.append({'fixture':name,'supplied_counts':counts,'requests':requests,'final_symbol':regs['rbp'],'flag_word':get_word(m,flag),**trace_fields({'trace':trace},False)}) |
| init,init_omitted=omit_push(graphs['Huff_Init']);ir=init['instructions'];calls={x['address']:i for i,x in enumerate(ir) if x['opcode']=='callq'};end_init=next(x['address'] for x in ir if x['opcode']=='popq');probes=[] |
| for base,sentinel in [(0x10000,0xa5),(0x40000,255)]: |
| m={base+i:sentinel for i in range(-1,2*SIZE+1)};regs={'%rdi':base};start=ir[0]['address'];requests=[];trace=[] |
| while True: |
| t=run(init,start,list(calls)+[end_init],m,regs);trace+=t['trace'];m=t['memory'];regs=t['registers'] |
| if t['stop']==end_init:break |
| requests.append([regs[k] for k in ['rdi','rsi','rdx']]) |
| if 'memset@plt' not in ir[calls[t['stop']]]['operands']:raise ValueError('unexpected initialization callee') |
| for i in range(regs['rdx']):m[regs['rdi']+i]=regs['rsi']&255 |
| start=ir[calls[t['stop']]+1]['address'] |
| objects=[] |
| for obj in [base,base+SIZE]: |
| node=get_word(m,obj+8,8);objects.append({'offset':obj-base,'node_count':get_word(m,obj),'root_pointer':node,'list_pointers':[get_word(m,obj+x,8) for x in [16,24]],'nyt_lookup_pointer':get_word(m,obj+0x820,8),'node_pool_offset':node-obj,'node_bytes':[m[node+i] for i in range(56)],'nonzero_bytes':[[i,m[obj+i]] for i in range(SIZE) if m[obj+i]]}) |
| probes.append({'base':base,'sentinel':sentinel,'memset_requests':requests,'objects':objects,'canaries':[m[base-1],m[base+2*SIZE]],**trace_fields({'trace':trace},True)}) |
| out['native'][label]={'source':r['source'],'disassembly_sha256':a['uncompressed_sha256'],'graphs':graphs,'frequency_table':{'address':address,'file_offset':offset,'sha256':hashlib.sha256(raw).hexdigest(),'counts':frequencies,'total':sum(frequencies),'paired_request_count':2*sum(frequencies),'conceptual_schedule_sha256':digest.hexdigest(),'digest_encoding':'for each symbol ascending, repeated count times: bytes(symbol,tree0,symbol,tree1)'},'entry_request':{'huff_init_pointer':entry['registers']['rdi'],'flag_word':get_word(entry['memory'],flag),'omitted_push_addresses':omitted,**trace_fields(entry,True)},'schedule_probes':schedule,'initialization_probes':probes,'init_omitted_push_addresses':init_omitted} |
| write_json(Path('docs/research/huffman-initialization.json'),out);print('Recovered paired 256-entry frequencies, eight schedule and four empty-tree initialization probes') |
|
|
|
|
| if __name__=='__main__':main() |
|
|
