Lj+\dZddlmZddlZddlZddlZddlmZddlm Z ddl m Z ddl m Z mZmZe ej#j$dZed z Zed z Zed z Zed z Zed z ZdZdZdZdddZddZd dZd!dZd"dZ d#dZ!d$dZ"d%dZ#d&dZ$d'dZ%d(dZ&e'dk(re&yy))aGround the generic VM opcode 0x14 branch shape. Opcode 0x14 is easy to misread because the opcode byte overlaps the low byte of the branch target dword. A plausible command therefore starts with a file-backed target VA whose low byte is 0x14, but raw VA-shaped hits are still only candidates until a known stream boundary reaches them. This report records that rule and explicitly checks the HUD top-menu post-selectedRoot table, where a byte also looks like 0x14 but the overlapped dword is not a VA. ) annotationsN)Counter)Path)Any) offset_to_va read_sections va_to_offsetz Hwanse2.exeoutwebz&generic_vm_opcode14_branch_review.jsonz&generic_vm_opcode14_branch_review.htmli8Di8@ipGc|dSd|d|dS)N-0x0x)valuewidths 0tools/build_generic_vm_opcode14_branch_review.pyhxr$s#-3;r%%z):%;;cVtj|ddSt|dS)NT)quote)htmlescapestr)rs rhr(s% ;;U]r$ GGE $ GGrc|y|D]?}t|d}|t|dz}||cxkr|ks.n1t|dcSy)Nvaraw_sizename)intr)sectionsr sectionstartends rsection_name_forr(,s\ z(GDM"c'*-.. B  wv' ' ( rcvt||}||dzt|kDrytjd||dS)N>s 4.data.rdatarawr!r@r+rr  r02x) r vaHex rawFirst8Hextarget targetVaHex targetIsVa targetSectionbyte1Hexbyte2Hexbyte3HexexpectedLength sourceModerPz%va-shaped-overlapped-target-candidateclassificationzinvalid-or-data-byte)getr#findrr,r-r.rhexr r(rAr>append) r/r$validinvalidr%r&r'posr rNr9rows rscan_opcode14_candidatesrb[s"$E$&G2 ;;v &9 9 GEN#c'*-..hhws+Rih,B~#'SX"5++D#s;A>C!G V$'cAg$6$:$:3$?$#%f:".x"@"L%5h%G"$U3K 0"$Sq\#$6 7"$Sq\#$6 7&5e&<"-e"4 |$&4-D)@,SC()LL%,BC()NN3'((7C!GS1C3Ri 2@ '>rc tj}t|}t||tdz}t ||\}}t||t }td|Dd}td|D}td|D}td|D} t||tk(t|t|tt|jtt|jtt| jtt t|t|dd } dd d | ttdzt|d d d dd||dd|ddddgd S)NPc3:K|]}|dtk(s|yw)r N)HUD_POST_SELECTED_ROOT_TABLE_VA.0ras r zbuild_report..s[Cc$i;Z.ZC[sc3&K|] }|d yw)rRNrrgs rrizbuild_report..s;c#j/;c3&K|] }|d yw)rQNrrgs rrizbuild_report..sCcS1Crkc3.K|] }|dsdndyw)rPz target-not-vaztarget-low-byte-not-0x14Nrrgs rrizbuild_report..s%$  #<06PP$saOpcode 0x14 handler semantics are grounded as an overlapped-target conditional branch shape: dword[stream] is the true target and must be file-backed with low byte 0x14 for a plausible command. Raw VA-shaped hits are not promoted by themselves; a known stream boundary must reach them. The false path advance is +8 only for inline-u16 right operands, otherwise +4. The HUD 0x0047e670 byte is not a valid 0x14 command because dword[stream] is 0x0002c614, not a file-backed VA.) opcode14HandlerVaHexopcode14HandlerGrounded&vaShapedOverlappedTargetCandidateCountinvalidOrDataByteCountvaShapedModeByteCountsvaShapedTargetSectionCountsinvalidReasonCountshudPostSelectedRootVaHex hudPostSelectedRootFirstDwordHexhudRejectedAsOpcode14decisionz(hwanse-generic-vm-opcode14-branch-reviewz0tools/build_generic_vm_opcode14_branch_review.pyz7opcode14-branch-shape-grounded-boundary-filter-requiredzDtarget is dword[stream], so opcode 0x14 overlaps the target low bytezobject+0x40 = dword[stream]z=advance +8 for inline-u16 right operand, otherwise advance +4 0x0040370a)handlerTableEntryVaHex handlerVaHexbranchTargetEncodingtruePath falsePathcompareHelperVaHexzeDo not classify a raw byte 0x14 as a command unless dword[stream] is a file-backed VA ending in 0x14.z^0x0047e670 is explicitly rejected by that rule and remains a post-selectedRoot table/data row.) kindsourcestatussummary semanticshudFalsePositiveRowvaShapedCandidateSamplesinvalidSamplesnegativeEvidence)EXE read_bytesrr1GENERAL_VM_TABLE_VArbrfnextrrOPCODE14_HANDLER_VAr,dictsorteditemsbool) r/r$handlerr^r_ hud_firsthud_row mode_countssection_countsinvalid_reason_countsrs r build_reportrs} .. CS!HsH&9H&DEG-c83G3G3I,J'K#F+@+F+F+H$IJ$&'F$G,.yM!%g bG*;DK&()rLzrOz
rQz rRz
rVrUzrMzzerz
VAtargetmodelenraw
)r]rrZjoin)rowsbodyras rtablers  D    3777+,-.377=123;qAY?Z>[\SWWZ()*$q1F/G.HISWW-./01377>2345      suwu|u|~BvC CFX XXrc `|d}d|dfd|dfd|dfd|dfd |d fg}d jd |D}tj|d }d|dt|ddttj|dd ddt |ddt |dd|d S)Nrrrrnz VA-shapedrpr_rqz HUD rejectedrwrc3XK|]"\}}dt|dt|d$yw)z
z z
N)r)rhkvs rrizrender_html..s/fX\XY[\/!vZ!v]Sfs(*F) ensure_asciiuf Generic VM Opcode 0x14 Branch Review

Generic VM Opcode 0x14 Branch Review

opcode 0x14의 target-overlap branch 형태와 HUD false positive 배제 규칙.

z&

Decision

rxz:

HUD False Positive

rrJrindentz@

VA-shaped Candidate Samples

rz.

Invalid Samples

rzi

Raw JSON


  


)rjsondumpsrr)reportrcards	card_htmlpayloads     rrender_htmlrsYG	6(#$	G234	gFGH	G456	!89:
Ef`effIjje4G2 [!  !'*"5 678,,-djj@U9Vejst.u,v+wx005f=W6X0Y/Z[$$)&1A*B$C#DEIA%%rc t}tjdtjdtjt
j|dddtjt|dtdy)	NT)exist_okFrJrzutf-8)encodingz$generic_vm_opcode14_branch_review ok)rOUTmkdirWEBJSON_OUT
write_textrrHTML_OUTrprint)rs rmainrsg
^FIItIIItI

6aHSZ[F+g>	
01r__main__)r@)r
int | Nonerr#returnr)rrrr)r$list[dict[str, Any]]r rrz
str | None)r/bytesr$rr r#rr)r9r#rr)r9r#rr#)r/rr$rrz1tuple[list[dict[str, Any]], list[dict[str, Any]]])rdict[str, Any])rrrr)rrrr)rNone)(__doc__
__future__rrrr-collectionsrpathlibrtypingrprobe_exe_scene_tablesrrr	__file__resolveparentsROOTrrrrrrrrfrrr(r1r>rArbrrrr__name__rrrrs#
LLH~''*
]
Ul
Ul9999  ",<H1(2.#L6rX0f2zFr