#!/usr/bin/env python3 """Reconcile bounded source byte ranges against structural analysis evidence.""" import hashlib import json from pathlib import Path from analyze_native import parse, take from analyze_native_metadata import resource_leaves, rva_range from analyze_qvm import write_json from analyze_vm_extensions import verified def partition(data, offset, size, ranges, gap_classifier): take(data, offset, size) end = offset+size points = {offset, end} for r in ranges: if r['bytes'] < 0 or not offset <= r['file_offset'] <= r['file_offset']+r['bytes'] <= end: raise ValueError('evidence range outside coverage region') points.update([r['file_offset'], r['file_offset']+r['bytes']]) points = sorted(points) segments = [] for start, stop in zip(points, points[1:]): if start == stop: continue labels = sorted({r['kind'] for r in ranges if r['file_offset'] <= start and stop <= r['file_offset']+r['bytes']}) payload = take(data, start, stop-start) segments.append({'file_offset': start, 'bytes': stop-start, 'evidence_kinds': labels, 'classification': 'referenced_structure' if labels else gap_classifier(payload), 'sha256': hashlib.sha256(payload).hexdigest(), **({'hex': payload.hex()} if not labels else {})}) counts = {} for s in segments: counts[s['classification']] = counts.get(s['classification'], 0)+s['bytes'] return {'region_file_offset': offset, 'region_bytes': size, 'segments': segments, 'classification_bytes': counts} def main(): results = [] for label in ('macos--libSDL-1.2.0.dylib', 'windows--Quake3-UrT.exe'): report = json.loads(Path(f'docs/research/native/{label}.json').read_text()) data = verified((Path('.cache/UrbanTerror43')/report['source']['path']).read_bytes(), report['source']['sha256']) layout, _ = parse(data) if layout['format'] == 'Mach-O': from analyze_native_metadata import stab_records, decode_stabs metadata = decode_stabs(data, layout, stab_records(data, layout)) section = next(s for s in layout['sections'] if s['name'] == '__text') ranges = [{**f, 'kind': 'paired_STABS_function'} for f in metadata['functions']] coverage = partition(data, section['file_offset'], section['bytes'], ranges, lambda b: 'x86_single_byte_NOP_sequence' if b == b'\x90'*len(b) else 'unclassified') else: ranges = [] leaves = resource_leaves(data, layout, ranges) directory = next(d for d in layout['data_directories'] if d['index'] == 2) offset, _ = rva_range(data, layout, directory['rva_or_security_file_offset'], directory['bytes']) coverage = partition(data, offset, directory['bytes'], ranges, lambda b: 'zero_filled_gap' if not any(b) else 'unclassified') coverage['leaf_count'] = len(leaves) output = {'source': report['source'], **coverage, 'limitations': 'Coverage is limited to the named SDL text section or PE resource-directory region. ' 'Byte-pattern gap classification does not prove runtime unreachability, alignment intent or payload semantics.'} write_json(Path(f'docs/research/native/{label}.coverage.json'), output) results.append({'image': label, 'region_bytes': coverage['region_bytes'], 'classification_bytes': coverage['classification_bytes'], 'gap_count': sum(not s['evidence_kinds'] for s in coverage['segments'])}) write_json(Path('docs/research/native/coverage-summary.json'), results) print(json.dumps(results, indent=2)) if __name__ == '__main__': main()