| |
| """Recover native clip filtering and finite trace-selection decision slices.""" |
| import gzip |
| import itertools |
| import json |
| from pathlib import Path |
| import re |
| from analyze_chat_crosshair import bits,number |
| from analyze_engine_control import control_flow,windows |
| from analyze_qvm import write_json |
| from analyze_vm_extensions import native_functions,verified |
|
|
|
|
| def probe(graph,start,stops,memory,registers,limit=128): |
| """Restricted integer gates/finite COMISS, with supplied native word memory.""" |
| ins={x['address']:x for x in graph['instructions']};order={x['address']:i for i,x in enumerate(graph['instructions'])} |
| m=dict(memory);regs=dict(registers);pc=start;equal=ge=False;trace=[] |
| def value(arg): |
| if arg.startswith('$'):return int(arg[1:],0)&0xffffffff |
| if arg.startswith('%'): |
| if arg not in regs:raise ValueError('unknown collision register') |
| return regs[arg] |
| match=re.fullmatch(r'(0x[0-9a-f]+)?\((%\w+)\)',arg) |
| if not match or match[2] not in regs:raise ValueError('unsupported collision address') |
| address=regs[match[2]]+int(match[1] or '0',0) |
| if address not in m:raise ValueError('unknown collision word') |
| return m[address] |
| def store(arg,v): |
| if arg.startswith('%'):regs[arg]=v&0xffffffff;return |
| match=re.fullmatch(r'(0x[0-9a-f]+)?\((%\w+)\)',arg) |
| if not match or match[2] not in regs:raise ValueError('unsupported collision destination') |
| m[regs[match[2]]+int(match[1] or '0',0)]=v&0xffffffff |
| while pc not in stops: |
| if pc not in ins or len(trace)>=limit:raise ValueError('collision probe escaped bound') |
| x=ins[pc];trace.append(pc);op=x['opcode'];args=x['operands'].split('#')[0].strip() |
| i=order[pc];pc=graph['instructions'][i+1]['address'] if i+1<len(graph['instructions']) else None |
| if op in ['movl','movss']: |
| a,b=args.split(', ');store(b,value(a)) |
| elif op in ['cmpl','testl']: |
| a,b=args.split(', ');left,right=value(a)&0xffffffff,value(b)&0xffffffff |
| equal=(left==right) if op=='cmpl' else (left&right)==0 |
| elif op=='comiss': |
| a,b=args.split(', ');source,destination=number(value(a)),number(value(b)) |
| equal=source==destination;ge=destination>=source |
| elif op in ['je','jne','jmp','jae']: |
| taken=op=='jmp' or (equal if op=='je' else not equal if op=='jne' else ge) |
| if taken:pc=int(args.split()[0],16) |
| else:raise ValueError('unsupported collision probe opcode '+op) |
| return {'trace':trace,'stop':pc,'memory':m,'registers':regs} |
|
|
|
|
| def sites(graph): |
| rows=graph['instructions'] |
| start=next(i for i,x in enumerate(rows) if x['opcode']=='movl' and x['operands']=='0x74(%rbx), %eax') |
| passed=next(x['address'] for x in rows[start:] if x['opcode']=='movl' and x['operands']=='0x1b0(%rbp), %r9d') |
| |
| cmp=next(i for i in range(start,len(rows)) if rows[i]['opcode']=='cmpl' and rows[i]['operands']=='(%r12), %eax') |
| skipped=int(rows[cmp+1]['operands'].split()[0],16) |
| merge_start=next(x['address'] for x in rows if x['opcode']=='movl' and x['operands']=='0x1030(%rsp), %r10d') |
| fraction=next(i for i,x in enumerate(rows) if x['opcode']=='comiss' and x['operands']=='0x44(%rbx), %xmm0') |
| if rows[fraction+1]['opcode']!='jae':raise ValueError('fraction decision changed') |
| return {'filter_start':rows[start]['address'],'filter_pass':passed,'skip':skipped, |
| 'merge_start':merge_start,'replace':rows[fraction+2]['address']} |
|
|
|
|
| def main(): |
| out={'native':{},'limitations':'Verified static Linux ELF64 and restricted supplied-memory instruction ' |
| 'probes, not original runtime/native callee execution. Entity/owner/content fields and trace result ' |
| 'words/fractions are supplied fixtures. Float probes reject nonfinite values. Full copy/merge, ' |
| 'collision brush/patch/capsule geometry, producer invariants and other-platform parity remain open.'} |
| for label in ['linux--Quake3-UrT-Ded.x86_64','linux--Quake3-UrT.x86_64']: |
| r=json.loads(Path(f'docs/research/native/{label}.json').read_text()) |
| verified((Path('.cache/UrbanTerror43')/r['source']['path']).read_bytes(),r['source']['sha256']) |
| a=r['artifacts']['disassembly.txt'];fs=native_functions(verified(gzip.open(a['path'],'rb').read(),a['uncompressed_sha256']).decode()) |
| names=['SV_ClipMoveToEntities','CM_TraceThroughBrush','CM_BoxTrace','CM_TempBoxModel','CM_InlineModel'] |
| graphs={n:control_flow(fs[n]) for n in names};g=graphs['SV_ClipMoveToEntities'];s=sites(g) |
| clip,entity,array,stack=0x10000,0x20000,0x30000,0x40000 |
| registers={'%rbx':clip,'%rbp':entity,'%r12':array,'%rsp':stack} |
| filters=[] |
| for passing,owner,pass_owner,contents in itertools.product([1023,7,5,9],[1023,5,9,-1],[-1,9],[0,1,2,3]): |
| m={clip+0x74:passing,entity+0x200:owner,array:7,stack+0x2c:pass_owner, |
| clip+0x78:1,entity+0x1cc:contents} |
| t=probe(g,s['filter_start'],[s['filter_pass'],s['skip']],m,registers) |
| filters.append({'pass_entity':passing,'candidate_index':7,'candidate_field200':owner, |
| 'supplied_pass_related_word':pass_owner,'content_mask':1,'candidate_contents':contents, |
| 'accepted_at_model_gate':t['stop']==s['filter_pass'],'probe':t}) |
| merges=[] |
| for status0,status4,fraction,old_fraction in itertools.product([0,1],[0,1],[0,.25,.5,1],[.5,1]): |
| m={stack+0x1030:status0,stack+0x1034:status4,stack+0x1038:bits(fraction), |
| clip+0x3c:0,clip+0x40:0,clip+0x44:bits(old_fraction),entity:7} |
| t=probe(g,s['merge_start'],[s['replace'],s['skip']],m,registers) |
| merges.append({'candidate_status0':status0,'candidate_status4':status4,'candidate_fraction':fraction, |
| 'current_fraction':old_fraction,'replace_at_copy_gate':t['stop']==s['replace'],'probe':t}) |
| out['native'][label]={'source':r['source'],'disassembly_sha256':a['uncompressed_sha256'], |
| 'graphs':graphs,'sites':s,'filter_probes':filters,'merge_probes':merges, |
| 'trace_result_windows':windows(fs['CM_Trace'],[r'0xcc\(',r'0xd0\(',r'0xd4\(',r'0xfc\(',r'<CM_TraceThrough'],before=3,after=6)} |
| write_json(Path('docs/research/native-collision.json'),out) |
| print('Recovered paired entity filters, model paths and 320 collision decision probes') |
|
|
|
|
| if __name__=='__main__':main() |
|
|
