UHjadZddlmZddlZddlZddlZddlZddlZddlm Z ejjde e e jjddlmZmZe e jj&dZedz ZddZdd Zdd Zdd Zdd Zdd ZddZd dZd!dZd"dZd#d$dZ d%dZ! d&dZ"d'dZ#d'dZ$efd(dZ%d)dZ&e'dk(re&yy)*zGSummarize branch-state source candidates for the current selector root.) annotationsN)Path) read_sections va_to_offsetoutc"|r t|dSdS)N)intvalues J/home/exedev/hwanse/tools/summarize_save_selector_current_state_sources.py parse_hexrs"3ub>,,cd|dS)N0x08xr s rhex32r c{ rcd|dS)Nr02xrr s rhex8rrrct|dzt|dz dzt|dz dzt|dz dzdS)Nr )byte0Hexbyte1Hexbyte2Hexbyte3Hex)rr s r word_bytesr"!sK&%1*,-%2+-.%2+-.  rcvt||}||dzt|kDrytjd||dS)Nz$pointer_ref_count..9s1dPWwu~Kwu~ 8K'KKKds&)r)r'packfindany)r)r*targetpatterncountr,r4s @rpointer_ref_countr<1sbkk$'G E F hhw' 7L d[cd d QJEq rcnt|||dz }|y|dz}|dk(r|dz dz}|dz dz}|dk(rdnd}t|||}|duxrt||du} d} | | rd n|d krd nd } d t|dz t|dt|||t||d|dd| t|nd| | ddddSy)Nr$rrr rprimaryBranchStatesecondaryBranchStater+small-scalar-not-va non-va-scalarbranchTargetOperand0x11z[selectionBuffer[0xrz]] == 1TFzpopcode 0x11 reads this dword as its branch target operand, so this position is not a normal linear opcode entry.)kind ownerVaHex ownerValueHexownerOpcodeHexownerStateSelectorByteHexownerStateTableownerSelectionBufferOffsetownerSelectionBufferOffsetHexownerConditionoperandValueHex operandAsVaoperandValueKindlinearOpcodeFalsePositivepromotesPrimaryFillmeaning)r-rrr) r)r*r+previousprevious_opcodestate_selectorselection_offset state_table operand_value operand_as_va operand_kinds r operand_roler]>sXrAv.HoO$"a-4/$Nd2.<.A*G]  h3 %T1gl8]6[cg6g   $#04}_fOf6Kl{L)Q-"8_$)-n)=**:-12B-C!, -@AQRU@VV]^7D7Pu]3VZ( ,)-#(J  " rc t|d}t|Dchc]'}t|jdts#|d)c}}|Dcgc] }||kDs | }}||r|dfS|dzfScc}wcc}w)Nr selectedPointerri@)r sorted isinstanceget)root_hex selectorsrootrowrootsr next_rootss rselector_root_rangeri`s| x D ios:cggVgNhjmCnC)*o pE%*;Eedl%;J; *A ??$- ??p;s$A-A- A2A2c |dzdk7ry|dz dz}|dz dz}|dk(rdnd}t|t|t|||dk|dkr d|d |d d Sd |d d d S)Nrr rrr?r@ zhelper 0x00410c90 fills z with case 0xrz/helper 0x00410c90 receives out-of-range case 0xz; no table fill)valueHexstreamPlus1HexhelperArgumentHex stateTablehelperDispatchValidrT)rr)r stream_plus_1 helper_argtables r decode_op10rtgs  aZ4'M2+%J$1Q$6 |j|dS|||fS)NactivationContext contextRowsvaHextrace opcodeHex0x12)setrbadd)current_writer_paths activationry writer_tracerfitems rcollect_trace_membersr{sJ EE5L#4WW017R<<]KQr .Dxx tG}- .GGG$* 4Dxx  $w-(88K(F2 $$T']3  4 4 ul **rcg}t| |dzD]L}||dzz}t|||}||j|t|t|dt |N|S)Nrr$) relativeIndexrxrl)ranger-appendrr") r)r* center_vabeforeafterrowsrelative_indexr+r s r nearby_wordsrs D3   !+ +h+ =  +2Ye       Krc |jdxsi}|jddk7ryt|jd}t|jd}||yt|||}t|||}||yt||du}|rdn|dkrdnd } idt |d t |d t |d zd |jd d|jdd|jdd|jdd|jddt |||dt |dt |d|jddd|d| d|jdd|jdd|jdt|||d d!|jdd"|jdd#d$S)%N operandRolerFrDrGrxr+rArBrCrHrIrrJrKrLrMrNownerPointerRefCount operandVaHexrOoperandPointerRefCountpointerRefCountrrPrQoperandWouldDecodeAsStateTablero%operandWouldDecodeAsHelperArgumentHexrn'operandWouldDecodeAsHelperDispatchValidrpTFz9 is the branch-target operand consumed by opcode 0x11 at z+, not a linear opcode 0x10 helper-fill row.) nearbyWordsrRrS explanation)rbrr-rrrr<r) r)r*rfroleowner_va operand_va owner_valuerZr[r\s rbranch_operand_contextrsG 77= ! 'RD xx00,/0H3777+,J:-3(3KS(J7Mm3 =9EM(4}W^G^.CdsL eHo {+  ${T12  $TXX.I%J   488$56   %dhh/K&L   (2Q)R  $((#34   1#x J  j)  5/  !#''*;Q"?  }  L  )#'',*?  09L1M! " 2377;P3Q# $$C8<%)$www Yxx %&&Q S- rc t|}|jdxsg}|r|dnd}t||\}}td|jdxsgDd} t |\} } } g} t ||dD]}t |||}|t|}|s!t|}t|||}t|||}|| vxs|| v}| jd|i|| duxr|| k|| v|| v|| v||||| vrd n || vrd n|rd nd d | Dcgc] }|ds | }}| Dcgc]}|dr|dr|}}|Dcgc] }|dr| }}|Dcgc]}|jds|}}|Dcgc]}|dr|jds|}}| Dcgc]+}|jdxsijddk(r|-}}|Dcgc]}t|||}||}}}td|D}|Dcgc] }|ds | }}|Dcgc] }|dr | } }id|dt|dt|d| t| ndddddddt| d t|d!t|d"t|d#t|d$t|d%|d&|r|djdndd'|r'|djdxsijd(ndd)|r'|djdxsijd*ndd+t|d,t|d-t| d.| ||||d/Scc}wcc}wcc}wcc}wcc}wcc}wcc}}wcc}wcc}w)0NcurrentFrontierRootHexesr 0x00000000c3K|]8}t|jdt|jd:yw)rxN)rrb)r2rfs rr5z build_summary..s: )*6 cggg& ' s>AcurrentFrontierRows)defaultr$rxzexecuted activation contextzexecuted writer tracezbranch operand dwordzroot-range dword candidate)beforeFirstFrontierReader inCurrentWriterActivationContextinCurrentWriterTraceinCurrentWriterOpcode12TracerrhasExecutionEvidence confidencerrrprrrFrDc3HK|]}|jddk(rdyw)rQrBrN)rb)r2contexts rr5z build_summary..s+, ;;) *.C C ,s "rootHex rootRangeHexz..firstFrontierReaderHexhelper 0x00410c90z 0x00..0x0b 0x0040b49e) handlerVaHexvalidCaseRangeHexcalledByOpcode10HandlerHexcandidateCount#validBeforeFirstFrontierReaderCount8validBeforeFirstFrontierReaderWithExecutionEvidenceCount-validBeforeFirstFrontierReaderNonOperandCount0validBeforeFirstFrontierReaderPromotingFillCountbranchOperandCandidateCountbranchOperandSmallScalarCountbranchOperandVaHexbranchOperandOwnerVaHexrGbranchOperandOwnerConditionrNactivationCandidateCountvalidActivationCandidateCount"outOfRangeActivationCandidateCountaThe current writer activation trace contains no valid opcode 0x10 helper fill. Its opcode 0x10 rows pass 0x20, outside helper 0x00410c90's 0x00..0x0b dispatch range. The only root-range valid-looking candidate before the frontier is 0x00542244, the small-scalar branch-target operand of opcode 0x11 at 0x00542240, not an executable linear opcode 0x10 helper-fill row. primaryBranchState is inherited from earlier runtime state at this point.) conclusion candidatesactivationCandidatesvalidBeforeFirstFrontierReader,validBeforeFirstFrontierReaderPromotingFillsbranchOperandContexts)rrbriminrrr-rtrr<r]rrsumr&)!r)selection_writersr~rdr* root_hexesrc root_startroot_endfirst_frontier_readeractivation_vas trace_vaswriter_trace_vasrr+r decodedva_hexrefsrexecutedrfactivation_candidatesvalid_before_frontiervalid_with_executionvalid_without_operand_rolepromoting_valid_before_frontierbranch_operand_candidatesrbranch_operand_contexts!branch_operand_small_scalar_countvalid_activationout_of_range_activations! r build_summaryrs S!H"&&'ABHbJ *z!} H.xCJ (,,-BCIr  3HH\2]/NI/JJ!, h+ = e$ r h3C2.^+Bv/B V  *?d)J)irTiOi06.0H$*i$7,26F,F#$,^+.Y&-,1#   >-7bS#>`:aSbb! * +4I0J  - % &  -"ww}% "" -' % &sww}/E '#' "! GGM " (b - -f 59N N !! - .sHcBG    ),,0,)%(=[DY@Z[[.Cfs3OdKesff* 8* 5,-Rh/@A*  !BWBc%(=">im*  (!-*6 *  #j/*  .s3H/I*  CCH\D]*  8=W9X*  ;C@_<`*  &s+D'E*  ()J*  Kd7:>>wGjn!* " "('q ) - -m < B G G U)* , &('q ) - -m < B G GHX Y3* 6 #C(=$>7* 8 (-=)>9* : -c2I.J;* > X ! 5*?8W!8S* *Cc"'!\fsH MM(M MM5M0M M% M+ M+ M0"M0c ddddd|dd|ddd |d d d |d dd|d dd d|dd|dd|dd|dd|dd|dd|dd|d d!d|d"dd#dd$d%g}|d&D]B}|jd'|d(d)|d*d+|d,d-|d.d-|d/rd0nd1d-|d2d-|d3d4D|d&s|jd5|jgd6|d7D]}|jd8xsi}|jd'|d(d)|d*d+|d,d-|d.d-|d9rd0nd1d-|jd:d;d-|jd<xsd=d>|jd?xsdd-|d2d4|d7s|jd@|jgdA|jdBxsgD]~}|jd'|d?d)|dCdD|jdEd+|dFd)|dGd+|dHd-|jdIdJ|jdKd-|jdLrd0nd1d4|jdBs|jd@|jgdM|jdBxsigd;jdNxsg}|D]8}|jd'|d(d)|d*d+|dOd-|dPd-|dQd-|dRd4 :|s|jdS|jddTj|S)UNz%# Save Selector Current State SourceszJOpcode `0x10` branch-state source candidates in the current selector root.z - root: `rz` (`rz`)z- first frontier reader: `r`z - helper: `rrz`, valid dispatch cases `rz(- activation-context `0x10` candidates: rz"- valid activation-context fills: rz7- root-range valid fills before first frontier reader: rz2- root-range valid fills with execution evidence: rz7- root-range valid fills that are not branch operands: rz$- root-range valid promoting fills: rz"- branch operand false positives: r (small scalar: r)rz## Activation ContextzC| va | value | table | helper arg | valid? | confidence | meaning |z+| --- | --- | --- | --- | --- | --- | --- |rz| rxz | `rlz` | roz | rnrpyesnorrTz |z| - | - | - | - | - | - | - |)rz.## Valid Root-Range Candidates Before Frontierrzb| va | value | table | helper arg | activation trace? | pointer refs | operand role | confidence |z2| --- | --- | --- | --- | --- | ---: | --- | --- |rrrrrrF- rGz!| - | - | - | - | - | - | - | - |)rz ## Branch Operand False Positiverzp| owner | owner value | condition | operand | operand value | operand kind | would decode as | promoting fill? |z1| --- | --- | --- | --- | --- | --- | --- | --- |rrHz` | `rNrrOrQrz case rrS)rz### Nearby Wordsrz"| va | value | b0 | b1 | b2 | b3 |z%| --- | --- | --- | --- | --- | --- |rrrr r!z| - | - | - | - | - | - | )rextendrbjoin)summarylinesrfrrnearbywords rmarkdownrJs/ T GI&'tGN,C+DBG $W-E%F$GqI gh'788QRYZbRcdwRxQyyz{ 27;U3V2WX ,W5T-U,VW A'JoBpAqr A=B C A'JyBzA{| .w7i/j.kl ,W5R-S,TTdelnMfNeOOP Q    M5+ E.-.  Wd3z?"34L8I7J#&'(S9N5OEUY+ZZ]< !S^$4B 8  ) * 45 LL78 ww}%+ Wd3z?"34L8I7J#&'(S9[5\Ebf+ggjww(!,-S&1A1HS0I488T`KaKgegJhhk< ! %   3 4 89 LL;;67=2  &'tGO,D+EU7;;WgKhJiim~&'tG4E,F+GtGTfLgKhhk{{;<=VGKKPwDxCyy| $9:uER I   ;;. / 89 LLkk12:rdA > B B= Q WUWF  gtD$4#5T$z:J9K3J D$4#5Sj9I8J" N   01 LL 99U rctdZddjfd|dD}djfd|dD}g}|jdxsgD]"}|jdtj|d d tj|d d tj|jd xsd d tj|dd tj|ddtj|jdxsd dtjt |jddtj|jdxsdd%g}|jdxsigdjdxsg}|D]}|jdtj|dd tj|dd tj|dd tj|dd tj|dd tj|dd djgd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0tj|d1d2tj|d3d4tj|d5xsd d6d7tj|d8d9d:tj|d8d;d6d<|d=d>d?|d@d>dA|dBd>dC|dDdE|dFdGdHtj|dId>dJdKdL|xsdMdNdOdPdL|xsdQdNdRdSdLdj|xsdTdNdUdVdLdj|xsdWdNdXdYdS)[Nc |jdxsi}dtj|dddtj|dddtj|dddtj|d dd|d rd nd ddtj|d dg}|r,|jdtj|ddny|j d|jddddtj|jdxsd|jdrd|jdzndzdgddj |zdzS)Nrz rxz rlzrozrnrprrrrTrrrFrrGrrzz)rbhtmlescaperrr)rfinclude_meaningrcellss rrow_htmlzhtml_page..row_htmls|ww}%+S\23< @S_56l C4;;s<012% 8S)<%=>?| LC 565DA G4;;s<012% 8    LL4 C N ;.sZ38C.Zrc30K|] }|dyw)FNrrs rr5zhtml_page..s`shsE*`rrrzrGzrHrNrrrOzrQz rSrrz rrrxrlrrr r!zzzzz zF z4 Save Selector Current State Sourcesz zzz.

Save Selector Current State Sources

z

Root rz range rz%. First frontier reader rz .

z

Helper rrz accepts cases rz%

valid activation-context fills: rz

z5

root-range valid fills with execution evidence: rz'

root-range valid promoting fills: rz%

branch operand false positives: rrrz)

z

rz

Activation Context

z z z7z
vavaluetablehelper argvalid?confidencemeaning
No activation candidates.
z6

Valid Root-Range Candidates Before Frontier

z z2z(

Branch Operand False Positive

z
vavaluetablehelper argvalid?confidencepointer refsoperand role
No valid candidates.
z@z

Nearby Words

zf
ownerowner valueconditionoperandoperand valueoperand kindpromoting fill?explanation
No branch operand false positives.
z.zz)rfdictrboolreturnstr)rrbrrrr) rrvalidbranch_context_rowsr nearby_rowsrrrs @r html_pagers1&Z'BX:YZZJ II`g>^6_` `E;;67=2  "" W\%:;<=W_%=>?@W[[1A%B%IcJKLW^%<=>?W->%?@AB;;w{{+=>E#FGH;;s7;;/D#EFGHI;;w{{=9?R@AB    Kkk12:rdA > B B= Q WUWF   T']345T*%5678T*%5678T*%5678T*%5678T*%5678      99''' ' # ' Q ' ? ' ' i' U' X' D' '' ' ' ' 9!'" 4;;wy'9:;;OPTP[P[\cdr\sPtOuv[\`\g\ghopHhIhPMP\Q[RR^ _#'$ T[[):>)JKLLhimititu|~FvGH[v\j]i^^j k%'& 08W0X/YY]^''( @ICAD@EEI J)'* 2':l2m1nnrs+', 08U0V/WWghoqPiQhRRW X-'.  GL12348/'0 (1'2 X3'4 J]"]^^no5'6 A7'8 r9': ESSTTde;'< 3='> G?'@ BGG/0x4xyzJ KA'B "C'D qE'F BGGK(^,^__opG'H I'J K'L M'' 'rc|jdd|dz jtj|dddzd |d z jt |d y) NT)parentsexist_okz(save_selector_current_state_sources.jsonF) ensure_asciiindentrutf-8encoding(save_selector_current_state_sources.html)mkdir write_textjsondumpsr)rout_dirs r write_outputsrsf MM$M. 99EE 7q9D@F 99EEiPWFXcjEkrc Ptjt}|jdtt dz |jdtt dz |jdtt dz |jd tt d z |jd tt |j}t|jjtj|jjd tj|jjd tj|j jd }t#||j$t'd|dd|j$dz y)N) descriptionz--exez Hwanse2.exe)typerz--selection-writersz$save_selector_selection_writers.jsonz--current-writer-pathsz'save_selector_current_writer_paths.jsonz --selectorszsave_scene_selectors.jsonz --out-dirr r z$wrote current state source summary (rz valid activation fills) -> r )argparseArgumentParser__doc__ add_argumentrROOTOUT parse_argsrr) read_bytesrloadsr read_textr~rdrrprint)parserargsrs rmainr$s^  $ $ 9F dD=4HI -D#HnBno 0tSKtEtu  D#@[:[\  $<    D  4))33W3EF 4,,666HI 4>>++W+=> G '4<<(  3 4 56llGG H Jr__main__)r z str | Noner int | None)r r rr)r r rr)r)bytesr* list[dict]r+r rr&)r)r'r*r(r9r rr )r)r'r*r(r+r r dict | None)rcrrdr(rztuple[int, int])r r rr))r~r(rz#tuple[set[str], set[str], set[str]])r*) r)r'r*r(rr rr rr rr()r)r'r*r(rfrrr)) r)r'rrr~r(rdr(rr)rrrr)rrrrrNone)rr+)(r __future__rrrrr'syspathlibrpathinsertr__file__resolveparentprobe_exe_scene_tablesrrrrrrrrr"r-r<r]rirtrrrrrrrr$__name__rrrr6sAM" 3tH~--/6678> H~''* Ul-4 D@( +  + ++ + +\~ ~~%~ ~  ~BQhXv25l, zFr
vavalueb0b1b2b3
No nearby words.