IjddZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ejjdee ej!j"ddlmZmZmZddlmZmZmZe ej!j4dZed z Zd Zd Zgd Zhd Z gdZ!gdZ"ddZ#ddZ$ddZ%d dZ&d!dZ'd"d#dZ(d$dZ)d%dZ* d& d'dZ+d(dZ,d(dZ-edfd)dZ.d*dZ/e0dk(re/yy)+zLMap route-relevant save-selector low bytes that resolve to data descriptors.) annotationsN)Path)Any) offset_to_va read_sections va_to_offset)HANDLER_TABLE_VAhandler_for_opcodesection_name_for_vaoutmap1_01amap2_02d))route-dispatch-stopi(T)wrapper-child-pointeri*T)direct-leaf-entry-0i)T)zdirect-leaf-entry-1i)T)predecessor-root-entry-stopiG)predecessor-fill-fragment-stopiDH>.text.rdata.data)zruntime-leaf-selectionz$reader-control-path-after-descriptorz%predecessor-root-to-fill-control-pathz"predecessor-fill-descriptor-bridgezstrict-source-hotspot)zNruntime selector/index choosing wrapper 0x00542a04 or frontier leaf 0x00542ae8zKcontrol path reaching reader 0x00542b0c after the route descriptor boundaryzRdecoded or observed predecessor root path from 0x004783e0 to 0x004844d0/0x004844d8zPexecution bridge across predecessor fill-fragment descriptor boundary 0x004844dcz,strict map1_01a source coordinate or hotspotc|d|dSdS)N0x08xvalues O/home/exedev/hwanse/tools/summarize_save_selector_data_descriptor_opcode_map.pyhex32r0s$0Rc{ :d:c*|y|dkrd|dSd|dS)Nr02xxrrs r hex_opcoder%4s, }$}Rc{ @BuQi.@r cvt||}||dzt|kDrytjd||dS)N  00 .:a.?LSTDTXYDY*_c v!#c^f e "0%/%?(6d(B(bqNGb^bGb!/t!;!\^@\W\@\   r cg}t|D]W}||dzz}t|||}| t||nd}|jt |t |||rdn|dnddY|S)Nr'pointerscalar unreadable)vaHexr= valueSectionkind)ranger0r rEr) r,r-start_vacountrowsindexr.rr4s rdescriptor_windowrZhs Du    !h+:?:K%h6QU 2Ye #!(I%:KhQ]     Kr c Zt|||}||dznd}t|||xsd}|t|t|| t||nd|t ||j d|j d|j d|j d|j ddk(d S) Nr"r entryVaHex handlerVaHexhandlerSection isCodeHandlerr) role siteVaHexr=rS lowByteOpcodelowByteOpcodeHexhandlerEntryVaHexhandlerValueHexr^r_isDataDescriptor)r0r rr r%get)r,r-r`r.ropcodehandlers rsite_rowrjws S(B 'E".UT\DF h !C> DD D c t|}tDcgc]\}}t||||}}}t|Dchc],}|j ddk(r|j dr|d.c}} | D cgc]} t ||| } } |Dcic]}|d| } }| j dxsi} | j dxsi}| j dxsi}| j dxsi}| j d xsi}| j d d k(xr@|j d d k(xr*| j dd k(xr|j dd k(}|j dd k(xr#|j d| j dk7}t d| Di}t d| Di}t d| Di}|j d dk(xr*|j ddk(xr|j ddk(}|j d dk(xr*|j dd k(xr|j ddk(}d}dgdddgdddgdddgddg}idtdtd ttd!|d"| d#|d$|d%|d&|d'|j d(xsgd)|j d*xsgd+|j d,xsgd-|j d(xsgd.|j d*xsgd/|j d,xsgd0|j d(xsgd1|j d*xsgid2|j d,xsgd3|xsij d4d5|xsij d6d7|xsij d7d8|xsij d8d9|xsij d9d:|xsij d:d;|xsij d;d<|xsij d<d=d>d?d>d@tdAtdB|dCt|d4dDdEgdFdG|iScc}}wcc}wcc} wcc}w)HNr^rrer`rrrrrrc0xe8 0x00440c28 0x00440c5cc32K|]}|ddk(s |yw)rmrNr.0rows r z build_summary..h#EVAW[gAg#h c32K|]}|ddk(s |yw)rm 0x00440a9cNrrs rrz build_summary..rrc32K|]}|ddk(s |yw)rmrNrrs rrz build_summary..rr0xd0r0xc0aiThe route dispatch stop at 0x005428f4 and the wrapper child pointer at 0x00542a08 both resolve low byte 0xe8 through the save-selector table to data descriptor 0x00440c28. That descriptor is shared by byte-opcode entries 0xa7, 0xaf, 0xe0, and 0xe8; its table-aligned refs also include 0x100 and 0x109, and all refs are data-only. The direct current-root leaf entry 0x005429f4 resolves through a different data descriptor, 0x00440c5c. The predecessor root-entry traversal stop at 0x004783e0 resolves low byte 0xd0 to data descriptor 0x00440a9c, while the predecessor fill-fragment stop at 0x004844dc resolves low byte 0xc0 to descriptor 0x00440c5c. Each row is a data-descriptor boundary, not executable control-flow proof that the route dispatch reaches wrapper 0x00542a04, frontier leaf 0x00542ae8, reader 0x00542b0c, or the predecessor fill sites from the 1:0 root entry. Hwanse2.exe)zhandler table 0x00440720zroute-dispatch-stop 0x005428f4z wrapper-child-pointer 0x00542a08z&predecessor-root-entry-stop 0x004783e0z)predecessor-fill-fragment-stop 0x004844dc)pathfieldsz,out/save_selector_dispatch_stop_context.json)promotionStatusrouteStopVaHexwrapperChildPointerVaHexfrontierReaderHexz)out/save_selector_leaf_table_context.json)runtimeSelectionProvenwrapperLeafHexfrontierLeafHexrz-out/save_selector_opcode24_payload_table.json)payloadDirectlyTargetsLeafTablepayloadGraphEdgeCountpayloadGraphAllEdgesLocal!payloadGraphReachesFrontierTargetsourceryhandlerTableVaHexsitesdataDescriptors routeAndWrapperShareE8Descriptor directLeafUsesDistinctDescriptor#predecessorRootStopIsDataDescriptor#predecessorFillStopIsDataDescriptor d0DescriptorSharedHandlerOpcodesrr"d0DescriptorTableAlignedRefIndexesrtd0DescriptorPointerRefSectionsrp c0DescriptorSharedHandlerOpcodes"c0DescriptorTableAlignedRefIndexesc0DescriptorPointerRefSections e8DescriptorSharedHandlerOpcodes"e8DescriptorTableAlignedRefIndexese8DescriptorPointerRefSectionsdispatchStopContextStatusrleafTableRuntimeSelectionProvenrrrpayloadGraphComponentCountpayloadGraphExternalEdgeCountrr proofFoundFdataDescriptorOpcodeProofFoundfailedDataDescriptorGateIdsmissingEvidence evidenceRefsevidenceRefCountblockedremainingProofs)zIprove runtime selection of wrapper 0x00542a04 or frontier leaf 0x00542ae8zNprove the control path reaches reader 0x00542b0c after the descriptor boundaryz[decode or observe the non-linear predecessor root path from 0x004783e0 to the fill fragmentzibridge the predecessor fill-fragment descriptor boundary at 0x004844dc without guessing through data rowsz3find a strict map1_01a source coordinate or hotspot conclusion)rRELEVANT_SITESrjrwrgrnext ROUTE_SOURCE ROUTE_TARGETrr FAILED_DATA_DESCRIPTOR_GATE_IDSMISSING_EVIDENCEr))r,dispatch_stop_contextleaf_table_contextopcode24_payload_tabler-r`r.rr data_targetsrydescriptor_summariesby_role route_stop wrapper_child direct_leafpredecessor_root_stoppredecessor_fill_stop%route_and_wrapper_share_e8_descriptor$direct_leaf_uses_distinct_descriptor e8_descriptor d0_descriptor c0_descriptor#predecessor_root_stop_is_descriptor#predecessor_fill_stop_is_descriptorr evidence_refss r build_summaryrs S!H?M N84Xc8T2 . NE N  77# $ /CGGBM++34:K#KK(EFL"#KK(HIOR)*f4 A   0 1V ; A NN, - = A   / 0L @ * )*l: T OO- .*..AR2S S)h)=hjlmMh)=hjlmMh)=hjlmM!!"45? C ! % %&7 8L H C ! % %&6 77 B( !!"45? C ! % %&7 8L H C ! % %&6 77 B(  A" C @ D ;&MN* ,* ,*  U#34*   *  / *  +,Q *  +,P*  ./R*  ./R*  +M,=,=>T,U,[Y[*  -m.?.?@X.Y._]_*  )-*;*;T,U,[Y[*  -m.?.?@X.Y._]_*  )-*;*;T,U,[Y[!* " -m.?.?@X.Y._]_#* $ )-*;*;,D"+I+IJb+c)* * *,B,Hb+M+MNo+p+* , "8">B!C!CD[!\-* . %'='C&H&HIe&f/* 0 (*@*FB)K)KLk)l1* 2 $&<&B%G%GHc%d3* 4 ,.D.J-O-OPs-t5* 6 e7* 8 )%9* : &'F;* < +=* >  ?* @ C .A* B 9C* D  E* R jS* *m O g1sQ1Q 5Q QcZddd|dd|dd|dd d |d d d j|dxsddd j|dxsddd j|dxsdd|dd|ddd j|dxsdd|ddd j|dxsdd|dd |d!d"|d#d$|d%d&|d'd(d j|d)xsdd*t|d+d,|d-d.|d/d|d0dd1dd2d3g}|d4D]`}|jd5|d6d7|d8d9|d:d9|d;d9|d<d9|d=d>|jd?xsdd@|jdAdBb|j gdC|dDD]+}|j dE|dFddG|dHdId j|dJxsddKd j|dLxsddMd j|dNxsdddOdPg|dQD]<}|jdR|dSd9|d:d>|dTd@|jdUxsddB >|j gdV|dWD]H}|jdR|dXd>|dYd@|jdZd@|jd[xsddB J|jd.|j d\dg|d]D]}|jd^||j gd_|d+D]}|jd^||j gd`|daD]B}|jd^|dbdcd j|jddxsgxsdD|jddej|S)fNz*# Save Selector Data Descriptor Opcode Mapz - route: rz -> ryz- handler table: `r`z+- route and wrapper share 0xe8 descriptor: rz- e8 shared handler opcodes: , r-z- e8 table-aligned refs: rz- e8 descriptor refs: rz(- direct leaf uses distinct descriptor: rz,- predecessor root stop is data descriptor: rz- d0 shared handler opcodes: rz,- predecessor fill stop is data descriptor: rz- c0 shared handler opcodes: rz'- payload directly targets leaf table: rz- payload graph components: rz!- payload graph all edges local: rz)- payload graph reaches frontier target: rz- proof found: rz - failed data-descriptor gates: rz- missing evidence count: rz- evidence refs: rz- promotion status: rrz## Relevant SiteszT| role | site | value | low byte | handler entry | handler value | section | code? |z1| --- | --- | --- | --- | --- | --- | --- | --- |rz| r`z | `raz` | `r=rcrdrez` | r^z | r_z |)rz## Data Descriptorsrrz### rmz- refs: ro in rpz- byte-opcode handler entries: rrz- table-aligned refs: rtz%| va | value | kind | value section || --- | --- | --- | --- |ruz| `rRrTrS)rzRefs:rz.| ref | section | byte opcode? | table index |rrGr<r4r@r?z## Remaining Proofsrz- )rz## Missing Evidencer)rz## Evidence Refsrrrz: r )joinr)rErgextend)summarylinesr descriptorrzproofitems rmarkdownr1sD4 GH%&d78+<*=> W%89:!< 5g>`6a5bc ' ':\2](^(ebe'fg #DIIg6Z.[$\$c`c#de 73S+T!U!\Y\ ]^ 27;]3^2_` 6w?d7e6fg ' ':\2](^(ebe'fg 6w?d7e6fg ' ':\2](^(ebe'fg 1':[2\1]^ &w/K'L&MN +G4O,P+QR 3G<_4`3ab ',/01 *499W=Z5[+\+c`c*de $S1B)C%D$EF G$6789 w'89:;    ^;; E>w  V T#k"2!35Z8IsSeOfNgh'()s3D/E.Fd377ScKdKkhkJllopspwpwyHqIpJJL M   LL01/0  :/01 2 z"345T$))JOcDd:e:lil9m n-dii CY8Z.[.b_b-c d$TYYz:R/S%T%[X[$\ ]  3 '  01 C LLc'l^5Z(9c&k]#cggVdNeNlilMmmop    uvf% C LLc*o&d3y>*:#cggF`>a=bbefifmfmoFgGgNKNfOOQR    R)* LL',-*+# r%\"# LL01)*" r$[!" LL-.~&V r#f+b37783D3J)K)Rs(STUV LL 99U r c| drd g}|dD]}|jd |dd |dd |dd |d d |d d |d d  |jd xsdd |jddg}|dD]v}g}|dD]T}|jd |dd |dd  |dd |jdxsdd Vg}|dD]`}|jd |dd  |dd |jdd |jdxsdd b|jd |dd |d d! d"j|d#xsdd$ d"j|d%xsdd& d"j|d'xsdd(d)j|d*d)j|d+yd)j fd,|d-D}d)j fd.|d/D} d)j fd0|d1D} d2jd3d4d5d6d7d8d9d:d;dd? |d@dA |dBdC |dDdE dF |dGdH d"j|dIxsddJ d"j|dKxsddL |dMdE dN |dOdP d"j|dQxsddR |dSdT d"j|dUxsddE dV |dWdX |dYdZ |d[d\ |d]dE d^ |d_d` d"j|daxsddb t|d/dc |dddE de |dfdgdhdidjd)j|d+d2j|dkdl|dmdndl| dmdodl| dmdpdqd)gS)sNc>tjt|S)N)htmlescapestrrs resczhtml_page..esczs{{3u:&&r rzr`zrazr=rcrdrezr^rz r_z rruzrRrTrSrGr<r4r@r?z

rmz

refs: rorrrpz; byte-opcode handler entries: rrz; table-aligned refs: rtzf

rz{
vavaluekindvalue section
z
refsectionbyte opcode?table index
c36K|]}d|dywz
  • 
    • Nr)rrrs rrzhtml_page..s[uDU E2[rc36K|]}d|dywrr)rrrs rrzhtml_page..s[d3t9+U3rc 3K|]B}d|dddj|jdxsgxsddDyw)z
  • rz : rrrrN)rrg)rrzrs rrzhtml_page..sW!  SV%&iDIIcggh>O>USU4V4]Z]0^/__de!sAA rrzzzz zF z9 Save Selector Data Descriptor Opcode Mapa zzz3

    Save Selector Data Descriptor Opcode Map

    z

    route rz -> ryz; handler table rz; promotion status: rz.

    z.

    route and wrapper share 0xe8 descriptor: rz; e8 shared handler opcodes: rz; e8 table-aligned refs: rz(; direct leaf uses distinct descriptor: rz/

    predecessor root stop is data descriptor: rz; d0 shared handler opcodes: rz,; predecessor fill stop is data descriptor: rz; c0 shared handler opcodes: rz

    payload graph components: rz!; payload graph all edges local: rz); payload graph reaches frontier target: rz'; payload directly targets leaf table: rz

    proofFound: rz; failedDataDescriptorGates: rz; missingEvidenceCount: z; evidenceRefs: rz

    rz

    z

    Relevant Sites

    z z z

    Remaining Proofs

    z
      z
    z

    Missing Evidence

    z

    Evidence Refs

    zz)rrreturnr)rErgrr)) r site_rowsrdescriptor_sectionsr window_rowsref_rowsrz proof_items missing_itemsevidence_ref_itemsrs @r html_pagerysJ'Iw   s6{#$%S-./0S_-./S!34567S!45678S!23456sww/07C89:sww/012    /0  01 C    W./0 Z1233v;'()377>29c:;<   f% C OO Z1233y>*+,377#=>?@A377#:;BsCDE    ""3z"34567J'89:;4DIIjYmNnDoDvsv@w?xy,,/ *E[:\0]0dad,e+fg##&tyy''[HY@Z[[KGG[HY@Z[[M!>*! 99"PC O= C 1233GGT\L]H^G_`"7+>#?@AA\]`ahiza{]|\}~C D 8WEg=h9i8jk&&)$))G<^4_*`*gdg&h%ij""%dii8\0]&^&ebe"f!gh114W=_5`1a0bbg i :#gFk>l:m9no&&)$))G<^4_*`*gdg&h%ij558Af9g5h4ij&&)$))G<^4_*`*gdg&h%iin p *#g6R.S*T)UV**-g6Q.R*S)TU225g>a6b2c1de003G<]4^0_/``e g C 5678&&)$))G>JJ 7:FKdT:Ig.Ar c Rtjt}|jdtt dz |jdtt dz |jdtt dz |jd tt d z |jd tt |jd tdd |j}t|jj|jjr/tj|jjdni|j jr/tj|j jdni|j"jr/tj|j"jdni}t%||j&|j(t+dt-|dd|j&dz y)N) descriptionz--exer)typedefaultz--dispatch-stop-contextz(save_selector_dispatch_stop_context.jsonz--leaf-table-contextz%save_selector_leaf_table_context.jsonz--opcode24-payload-tablez)save_selector_opcode24_payload_table.jsonz --out-dirz --html-outz!Optional HTML report output path.)rrhelprrz0wrote save-selector data descriptor opcode map (rz descriptors) -> r)argparseArgumentParser__doc__ add_argumentrROOTOUT parse_argsrr, read_bytesrexistsrloads read_textrrr r r printr))parserargsrs rmainr!s  $ $ 9F dD=4HI 1cLvFvw .T3IpCpq 2sMxGxy  $<  4Dgh    D NRNhNhNoNoNq 4--777IJwyKOKbKbKiKiKk 4**44g4FGqsOSOjOjOqOqOs 4..88'8JKy{ G '4<<7  )* + ,,=dllM|>|=} r __main__)r int | Nonerz str | None)r,bytesr- list[dict]r.rvrr#)r-r%r/rvr dict | None)r,r$r-r%rrvrr%)rl) r,r$r-r%rVrvrWrvrr%) r,r$r-r%r`rr.rvrdict)r,r$r-r%rxrrr')NNN) r,r$rr&rr&rr&rr')rr'rr)rr'r rr z Path | NonerNone)rr()1r __future__rrrrr*syspathlibrtypingrrinsertr__file__resolver probe_exe_scene_tablesrrrsummarize_script_handler_tabler r r rrrrrrrDrrrr%r0r7rMrZrjrrrrr r!__name__rr rr3sHR" 3tH~--/6678LLdd H~''* Ul  - #;A 4< &>*.&**. G G&G$G( G  GTEPcL25dB, zFr
    rolesitevaluelow bytehandler entryhandler valuesectioncode?