IjdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ejjdee ej!j"ddlmZmZmZe ej!j,dZedz Zd Zd Zd Zd Zd ZdZdZdZ eez Z!dZ"dZ#dZ$dZ%dZ&dddddZ'dgdddgddd gd!dgZ(e)jUd"d#d$fe)jUd%d#d&fe)jUd'd#d(fe)jUd)d*d$fe)jUd+d*d&fe)jUd,d*d(ffZ+d-Z,d.efd/efd0effZ-dMd1Z.dNd2Z/dOd3Z0dPd4Z1dQd5Z2dRd6Z3dSd7Z4dTd8Z5dUdVd9Z6e"f dWd:Z7dXd;Z8dSd<Z9dYd=Z:dZd>Z;d[d?Zd]dBZ?d^dCZ@d_dDZAd`dEZBdadFZCdbdcdGZDdddHZEdddIZFedfdedJZGdfdKZHeIdLk(reHyy)gzNDocument save-selector dispatch-table anchoring for the current route blocker.) annotationsN)Path)Any) offset_to_va read_sections va_to_offsetoutmap1_01amap2_02di8Di DiGi#@i!#@iL#@) )) ?r&,Hr8cPr))zroute-dispatch-stopi(T)zwrapper-child-pointeri*Tr)zdirect-leaf-entry-0i)Tr )zdirect-leaf-entry-1i)T)zpredecessor-root-entry-stopiG)zpredecessor-fill-fragment-stopiDHr z=runtime dispatch proof for the 0x00440720 save-selector slicezLruntime bridge from route descriptor boundaries into the save-selector slicezKdynamic register-base dispatch candidate using the save-selector table basezCroute-relevant table-base switch proof for descriptor-boundary rows)$save-selector-slice-runtime-dispatch"descriptor-boundary-runtime-bridge*dynamic-save-selector-table-base-candidate&route-relevant-slice-table-base-switch Hwanse2.exe)z-0x0040234c generic indexed dispatch immediatez!0x00440538 general dispatch tablez'0x00440720 save-selector dispatch slicez&0x0047f1d8 event-object dispatch table)pathfieldsz$out/save_selector_stream_traces.json)sourcetargettrace opcodeHex handlerVaHexz-out/save_selector_dispatch_table_context.json)relativeOpcodeRowsrouteRelevantDispatchRowsdynamicIndexedDispatchRowsdynamicScopeTableCallbackRows)dynamicSaveSelectorTableBaseCandidateRowsff1485calleaxff148decxff1495edxff2485jmpff248dff2495)r3r5r7ebxespebpesiedigeneral-object save-selector event-objectc|yd|dS)N0x08x)values 7tools/summarize_save_selector_dispatch_table_context.pyhex32rJjs } c{ cp|js|Stj|jdS)Nutf-8encoding)existsjsonloads read_text)r%fallbacks rI load_jsonrUps* ;;= ::dnngn6 77rKcr|D]2}t|d}|t|dz}||cxkr |ks.|cS4y)Nrawraw_size)int)sectionsoffsetsectionstartends rIsection_for_offsetr_vsOGEN#c'*-.. F S N ! rKcvt||}||dzt|kDrytjd||dS)N|j |dt |d|ddc)Nrbrr rjrE06x)r\refVaHex fileOffsetHex)rdpackfindr_rappendrJ) rfrZrHneedlerefssearchhitr\ref_vas rIfind_dword_refsrys [[u %F D F hhvv& 7  Kq$Xs3 h, >  vf !#c^   rKcZtd|D}t|d}|||t|dz}g}tdtdt |dz D]}t D]\}}} |||t |z|k7r||zt |z} t jd|| d} t|d|z} |jt| || t| t| | t |z t||| t |z dtfd tfd tfgd |S) Nc32K|]}|ddk(s |ywrj.textNrG.0r\s rI z*find_indexed_dispatches..NG76?g3MN rWrXrrrbrg general-tablesave-selector-tablesave-selector-slice-delta)instructionVaHexkind indexRegister tableBaseHex tableRole rawOffsetnearbyTableBaseArithmeticRefs)nextrYrangemaxrcINDEXED_PATTERNSrdrersrJ table_rolenearby_dword_immediatesGENERAL_HANDLER_TABLESAVE_SELECTOR_HANDLER_TABLE SAVE_SELECTOR_SLICE_OFFSET_BYTES) rfrZtext raw_startrWrowsindexpatternrregister imm_offsetbasergs rIfind_indexed_dispatchesrsN NxN NDDK I iSj)9%:: ;C Dq#aSA./'7  #GT85W-.'9"U*S\9J%%dC.rrrWrXrrbr+#x)r tableVaHexrorelativeToInstructionHexr c|d|dfS)NrorrGrows rIz)nearby_table_immediates..ss:K0@ArKkey) rrrYminDISPATCH_TABLESrdrqrrrrsrJsort)rfrZ raw_offsetwindowrr]r^rroletable_vartcursorrwrxs rInearby_table_immediatesrs NxN ND DK *v"5 6E c$u+T*%5!66 R HC D)hT8,((663/CQw!(C0F! !%"'/ %f 363CC2H  1WF  IIAIB KrKctd|D}tt|d||z }tt|dt|dz|dz}g}|D]w\} } t j d| } |} |j | | |} | dkr8t|| }|-|j| t| t|| |z dd| d z} Z|jd |S) Nc32K|]}|ddk(s |ywr|rGr~s rIrz*nearby_dword_immediates..rrrWrXrrbrr)rvalueHexrorr c|d|dfS)NrorrGrs rIrz)nearby_dword_immediates..ss:F <rKr) rrrYrrdrqrrrrsrJr)rfrZrvaluesrrr]r^rrrHrtrrwrxs rIrrs  NxN ND DK *v"5 6E c$u+T*%5!66 R HC D eT5)((663/CQw!(C0F!  %e %f 363CC2H  1WF  II. rrrWrXr@ss4vs vsd5sd%s&sscalera displacement>rar%seh-registration-scope-table-callbackzSnearby fs:0 SEH registration plus state==-1 sentinel and index*3 triplet table walkseh-scope-table-callbackz[state==-1 sentinel and index*3 triplet table walk; helper calls the SEH registration walkerz1state==-1 sentinel and index*3 triplet table walk z%unclassified-dynamic-indexed-dispatchz+no local SEH scope-table pattern identified%nearbySaveSelectorTableImmediateCountr)contextClassification contextReasonscopeTableStrideByteshasSehRegistrationPatternhasSentinelMinusOneStateCheckhasTripletIndexScalePattern!candidateForSaveSelectorTableBase)rrYrrget)rfrZrrr text_starttext_endbeforeafterhas_sentinel_statehas_triplet_indexhas_seh_registrationcalls_unwind_helperis_scope_table_callbackclassificationreason scope_stride candidates rIdynamic_dispatch_contextr s NxN NDT%[!JCZ 011H Zc!12: >F  3xb9 :E(F2'61N_5N'61 5 *f 42V;_?VZ_?_ .  . GGG  ! . GGN #v -   DN%  8N'.I   @>  7;a? F E E "0!-%9);'8-6 rKcntd|D}t|d}|t|dz}g}t||dz D]n}||dk7r ||dz}|dz dz}|d vr"|dzd k7r+|d z dz} | dk(r9||dz} | d z dz} | dz dz} | dz} | d k(r\| dk7rb| d k(xr| d k(}|rq| dk(rdn| dk(rd nd }|dz|z|kDrt||dz|}t ||}|t |||}t ||dk(rdndt| t| d| z| dk(||d|||dz|zj||t|||dtfdtfdtfgtd|Dt|d}|jt!|||||j#|q|S)zHFind indirect call/jmp rows with a register table base and scaled index.c32K|]}|ddk(s |ywr|rGr~s rIrz2find_dynamic_indexed_dispatches..BrrrWrXr r>rrararr2r9rrrrc3JK|]}|jddk(sdyw)rrBr Nrrrs rIrz2find_dynamic_indexed_dispatches..{s%9sww{';'N9##)rr baseRegisterrrisDwordScaledIndexrdisplacementHex encodingHexrnearbyTableImmediateRefsrr&nearbyKnownDispatchTableImmediateCount)rrYrrrrrJREG32hexrrrrsumrcupdaterrs)rfrZrrraw_endrr[modrmregmodsib scale_bitsrrno_base_disp32 disp_sizerinstruction_vanearbyrs rIfind_dynamic_indexed_dispatchesr@sN NxN NDDK I#d:.//G D 7Q;/; v;$  FQJzT! f   DLQ  zT! !8 &1*oQh$& T!Tz A:  ? /dai  AC1Hq! A: !G + "3 I> %h7  ! (h? %n 5!QhFE!$K"5\*_",/(".s!3vvzI'=>BBD(.-D$&;<*,GH02RS .699#967:&k3 6 +C63GH Cw;x KrKc@|tk(ry|tk(ry|tk(ryy)NrArBrCother)rrEVENT_OBJECT_HANDLER_TABLE)rs rIrrs) $$ ** )) rKci}|D]8}t|jdxsd}|j|ddz||<:|S)Nr unclassifiedrr )rkr)rcountsrrs rI&dynamic_dispatch_classification_countsrsOF-#''12DnEjja(1,s - MrKc|Dcgc]}t|jdxsdjdr|jd|jd|jd|jd|jd|jd |jd|jd |jd |jd |jd |jdd c}Scc}w)Nrzseh-rrrrrrrrrrr) rrrrrrrrrrrr)rkr startswithrrs rI!dynamic_scope_table_callback_rowsrs    sww./52 6 A A& I!$(: ;GGFOGGN3 WW_5WWW%"ww'89%(WW-D%E WW_5%(WW-D%E149\1]58WW=d5e69gg>f6g   sC7C?c|Dcgc]}|jddur|jd|jd|jd|jd|jd|jd|jd |jd |jd xsg|jd |jdd c}Scc}w)NrTrrrrrrrrrr) rrrrrrrrrrrrrs rI/dynamic_save_selector_table_base_candidate_rowsr s   776 74 ?!$(: ;GGFOGGN3 WW_5WWW%"ww'89%(WW-D%E WW_5(+0J(K(Qr58WW=d5e149\1]   sCCcg}|D]W}|jd}t|ts&|jdxsg}td|D}td|D}td|D}|jddvxr|dkDxs |dkDxr|dkD}|dkDrd } n|dkDr|dkDrd } n|dkDrd } n |dkDrd } nd } |j |jd|jd|jd|jd|jd|jd|jd|jd|||||| dZ|S)Nrrc3JK|]}|jddk(sdyw)rrr Nrrrefs rIrz;save_selector_table_base_arithmetic_rows..s_#CGGFO<^A_rc3JK|]}|jddk(sdyw)rrr Nrr s rIrz;save_selector_table_base_arithmetic_rows..s bsLa9abrc3JK|]}|jddk(sdyw)rrr Nrr s rIrz;save_selector_table_base_arithmetic_rows..s ocSn@norr>rrrz2direct-save-selector-table-immediate-near-dispatchz1general-table-plus-save-slice-delta-near-dispatchzgeneric-table-immediate-onlyzslice-delta-without-table-basez#no-table-base-arithmetic-immediatesrrrrrrr)rrrrrrrr nearbyGeneralTableImmediateCountr&nearbySaveSelectorSliceDeltaImm32Countr+candidateForSaveSelectorTableBaseArithmeticr)r isinstancerYrrs) dispatch_rowsrrrarithmetic_refs general_count save_countslice_delta_countrrs rI(save_selector_table_base_arithmetic_rowsrs D( WW[) *c* ''"ABHb___ bobb o_oo GG+ ,5  RaPMA$5$O:Ka:O  >QN Q #4q#8PN Q ;N  "=NBN #(: ;GGFOGGN3 WW_5WWW%GGN3-%(WW-D%E0=5?6G-<;D,  3( R KrKc`djd|jdxsgDxsdS)N, c3fK|])}|jdd|jd+yw)r@roNrr s rIrz#nearby_refs_text..s7  77;  #''*"5!67s/1r-)joinrrs rInearby_refs_textr s9 997756<"    rKct|||}|Dcgc]"}|jdt|k(s!|$}}t|t|t d|Dt||dd|dScc}w)Nrc3JK|]}|jddk(sdyw)r\r}r Nrrs rIrz$table_ref_summary..s Tscggi6HG6S Tr )rdirectDwordRefCounttextDwordRefCountindexedDispatchCountruindexedDispatches)ryrrJrcr)rfrZtable dispatchesrurindexeds rItable_ref_summaryr+sv 3% 0D(TsCGGN,CuU|,SsTGTEl"4y Td TT #G Sb $  Us "A2A2ct|dzz}t|||}t|dzz}t|||}|tz dz}t|dzz}t|||} d|cxkxrdknc} id|dd|ddt|d t|d t ||d t|d t|d t ||d|dd|dd| rd|dndd| dt|dt| d| |k(d| xr| |k(d|t k(S)NrarrrelativeOpcoderelativeOpcodeHexrE02xsaveEntryVaHexsaveHandlerVaHexsaveHandlerSectiongeneralRawEntryVaHexgeneralRawHandlerVaHexgeneralRawHandlerSectiongeneralAbsoluteOpcodegeneralAbsoluteOpcodeHexgeneralAbsoluteDispatchByteHexgeneralAbsoluteByteReachablegeneralAbsoluteEntryVaHexgeneralAbsoluteHandlerVaHex!generalAbsoluteMatchesSaveHandler.generalAbsoluteHandlerReachableViaByteDispatchsaveHandlerIsDefault)rrhrrJrlDEFAULT_HANDLER) rfrZopcode save_entry save_handlergeneral_raw_entrygeneral_raw_handlerabsolute_indexgeneral_absolute_entrygeneral_absolute_handlergeneral_absolute_byte_reachables rI opcode_rowrIs,vz9JC:6L- :"32CD #88Q>N2^a5GG'X7MN&'>&AT&A# & r&.  % +  E,/   1(LI   &7 8   !%(;"<  #$7BU$V    #b(<$=  ))Hb$ %d  '(G  $U+A%B  &u-E'F! " ,-E-U# $ 9 + X0HL0X' *   ?+ rKct|||}|j|t||d|d|jddk(|jddk(|jdttk(|jddk(|jd|jdk7|jd t |jd  d |S) NrEr/r2z.datar}r4r5r1r=r9) r siteVaHex lowByteOpcodelowByteOpcodeHexsliceHandlerIsDataDescriptorsliceHandlerIsCoderawGeneralHandlerIsDefaultrawGeneralHandlerIsCoderawGeneralDiffersFromSlice+sliceHandlerReachableViaGenericByteDispatch)sliceHandlerRequiresSaveSelectorTableBase)rIrrJrr?bool)rfrZrsite_var@rs rIroute_relevant_dispatch_rowrW$s S(F +CJJ7^  -(+0D(E(P!gg&:;wF&)gg.F&G5Q`Ka&a#&77+E#F'#Q&)gg.F&G377SeKf&f7:ww <8 :> GG2 3: 6 " JrKct}g}|D]}|jdtk7s|jdtk7r4|jdxsgD]h}|jd}|!|jd}|r t |dnd}|||vr>|j ||j t |j|S)Nr'r(r)r@r*r)setrSOURCETARGETrYaddrs) stream_tracesseenopcodesr)steprH opcode_hexs rIroute_trace_opcodesrb:s 5DG ' 99X & (EIIh,?6,I IIg&," 'DHHX&E}!XXk2 /9J+t}  HHUO NN3u: & ' ' NrKc t|}||nttdz g}t||}t ||}t ||t |}t ||t|}t ||t|}tt z dz}t|D cgc]} | ttvr| c} xstt} tt| ttzttzD cgc]} t!||| } } | D cgc]} | dtvs| } } | D cgc]} | dtvs| }} t#d| D}t$D cgc]\}}} t'||||| }}}} |D cgc]} | j)ddur| d}} |D cgc]} | j)ddur| d}} |D cgc]} | j)d dur| d}} |D cgc]-} | j)ddur| j)d dur| d/}} |D cgc]-} | j)ddur| j)d dur| d/}} |d k(xrZt+|j)d xr>|j)d dk(xr(|j)ddk(xrt#d| D}|j)d ddkDxs|j)dddkD}t-d|D}t/|}t1|}t3||z}|D cgc]} | j)ddur| }} t5|}t-d|D} | xr&|dk(xrt+|xrt7d|D}!g}"|s|"j9d|!r|"j9d|dk(r|s|"j9d|r|s|"j9d|"D#cgc] }#t:|# }$}#|" }%idt<dt>dtAt dtAtdtAtdtBd tAtBd!tAtDtAtFtAt d"d#d$d%|d&d'|d(d)|d*|d+|d,|d-t5|d.|d/t5|id0tI|d1t-d2|Dd3| d4|d5|D cgc]} | j)d6c} d7|d8t-d9|Dd:|d;|D cgc]} | j)d6c} d<|d=|dkDxs t+|d>tJd?t5|d@|dAt5|dB|dCt+|idD| D cgc]} d'| d( c} dE| dFt5| dG|dHt5|dI|dJt5|dKt5|dL|dMt5|dN|dOt5|dP|dQt5|dR|dSt5|dT|||||%|!dU|%|"|$tLt5tLdVdWgdXdYScc} wcc} wcc} wcc} wcc} }}wcc} wcc} wcc} wcc} wcc} wcc} wcc}#wcc} wcc} wcc} w)ZN save_selector_stream_traces.jsonrar-c3BK|]}|jddvyw)r1> 0x0040ad9b 0x0040adc9 0x0040ae0eNrrs rIrz build_summary.._s(6  "#'QQ6rNTrrPrTrSzr'r&rr$c3BK|]}|jdduyw)r<TNrrs rIrz build_summary..s^;<D^rir%c3BK|]}|jdduyw)rTNrrs rIrz build_summary..s)B  34<Brirc3FK|]}|jdddkDyw)rrNrrs rIrz build_summary..s):  8!.sf#45=frir r!r"r#r'r(generalHandlerTableHexsaveSelectorHandlerTableHexeventObjectHandlerTableHexsaveSelectorSliceOffsetBytessaveSelectorSliceOffsetBytesHexgenericDispatcheru8z#byte at context+0x40 stream pointer) entryVaHexindexedCallVaHexr indexWidth indexSourcesaveSelectorSliceOffsetEntriessaveSelectorSliceOffsetHexrEr/ generalTablesaveSelectorTableeventObjectTableindexedDispatchRowsindexedDispatchRowCountr.dynamicIndexedDispatchRowCount*dynamicIndexedDispatchClassificationCounts"dynamicDwordScaledDispatchRowCountc3HK|]}|jddusdyw)rTr Nrrs rIrz build_summary..s'2 sww7K/LPT/TA2 s""+dynamicKnownDispatchTableImmediateNearCountdynamicScopeTableCallbackCountdynamicScopeTableCallbackSitesrr/*dynamicSaveSelectorTableImmediateNearCountc3@K|]}|jddyw)rrNrrs rIrz build_summary..sb?Cbs*dynamicSaveSelectorTableBaseCandidateCount*dynamicSaveSelectorTableBaseCandidateSitesr06dynamicSaveSelectorTableBaseSwitchStaticCandidateFound.saveSelectorTableBaseArithmeticScanWindowBytes'saveSelectorTableBaseArithmeticRowCount#saveSelectorTableBaseArithmeticRows-saveSelectorTableBaseArithmeticCandidateCount,saveSelectorTableBaseArithmeticCandidateRows-saveSelectorTableBaseArithmeticCandidateFoundrouteTraceRelativeOpcodesr,#selectedPointerRelativeHandlerCount'selectedPointerRelativeHandlersVerifiedbranchRelativeHandlerCountr-routeRelevantDispatchRowCount%routeRelevantSliceDataDescriptorCount%routeRelevantSliceDataDescriptorRoles#routeRelevantRawGeneralDefaultCount#routeRelevantRawGeneralDefaultRoles.routeRelevantSliceRequiresTableBaseSwitchCount.routeRelevantSliceRequiresTableBaseSwitchRolesMI 00 EM)h7J8hGX/DjQG%c85PR\]M$S(4NPZ[L7:OOTUU0? S)* *    FLCP]`de}`~P~BFGUBVQVMWFXY6ZXv6YMY$1gSS9I5JNf5fSgMg"/[337G3HN3Z3[K[256 63/ &C$$ !D'6 $C4&I$ $ 02  771 2d : F 2.200  77/ 0D 8 F 0,00=  77> ?4 G F =9=0M  771 2d : GG? @D H F MIM0A  771 2d : GGA Bd J F A=A $ _ 01 2 _   4 5 : _   3 4 9 _ ^P]^ ^ ! 0!4q8 9   0! 4q 8<?BB%B?;;;MNLM_`>''O #!  77@ AT I !! *--?)@&69:%:73 DC g Cq H g ; < g fIef f = &(" B&--.TU?&--.RS?1D)&--.Z[=I&--.VW6  8@54K| &| &|  !%(=">|  &u-H'I |  %e,F&G |  '(H |  *51Q+R|   89 %&E F 56@  |  )*>|  %+?*D&E!| " #| $ ]%| & L'| ( z)| * "3z?+| , %&8-| . )#.@*A/| 0 5 23E F3| 6 -c2 +2 / 7| < 67f=| > )*L?| @ )3E+ ,/CGG& '+ A| F ();G| H 5 bOab bK| N 5 CQ| T 53I7 ,/CGG& '7 U| Z 45K[| \ A Ca G /-.a| d 9 ;g| j 233Gk| l .m| n 8=V9Wo| p 78Qq| r 8>W9Xs| t $m%TF6#,&7%Tu| v mw| x .s=/Ay| z 23^{| | %c+&6}| ~ $%A| @ (-I)JA| B 05_1`C| D 01[E| F .s3[/\G| H ./WI| J 9# A; K| P 9 AS| V G QI W| \ G Q_| b DS EF c| h D Ek| n&BJ+ 7 &UsfX$2X) X.X.'X38X3X8<X?!YY +2Y#2YYYY" Y' 6 Y, ctj|jdxsidd}gddd|dd |d d d |d d d|dd d|ddd|jdxsijdd|jdxsijdd|jdxsijdd d|ddd|ddd |ddd!|jd"d#|d d$|jd%d&d'j|jd(xsgxsd)d d*|jd+d,|jd-d.|jd/d0|jd1d2d'j|jd3xsgxsd)d d4|d5d6|d7d8|d9d:|jd;dt |jd?xsgd@|jdAdB|dCdD|jdEdF|jdGdH|dIdJ|dKd d|dLddMddNdO}dP|dfdQ|dfdR|dSffD]2\}}|j dT|dUdV|dW|ddW|dXdW|ddY 4|j gdZ|d[D]J}|j dT|d\d]|d^d]|d_d]|d`d]|dadV|jdbdW|dcdYL|j gdd|deD]}|j df|dgdh|did]|djd]|d_dV|dkxsd)dh|d`dV|dlxsd)dh|jdadV|jdbdW|jdmdW|dndW|dodY|j gdp|jdqxsgD]}t|}|j dT|jdrdV|jdsdh|jdtd]|jdudV|jdvdh|jdwdV|jdxdW|jdydW|dY|j gdz|jd{xsgD]}|j dT|jdrdV|jdsdh|jdtd]|jdud]|jdwdV|jdxdW|jd|dW|jdydY|j gd}|jd~r|j ddg|jd~xsgD]}|j dT|jdrdV|jdsdh|jdtd]|jdud]|jdwdV|jdxdWt|dYn|j d|j gd|jdxsgD]}|j dT|jdrdV|jdsdh|jdxs|jdtxsd)dV|jddW|jddW|jddW|jddW|jddY|j gd|j d|dD|j ddj|S)NrT,: sort_keys separatorsz&# Save Selector Dispatch Table Contextrz - route: `r'z -> r(`z- general handler table: `roz - save-selector handler table: `rpz- save-selector slice offset: `r{z ` entriesz- generic dispatcher: `rtrvz` indexed call `rwz ` index `rxz"- generic indexed dispatch count: r|r&z#- save-selector direct dword refs: r}r$z(- save-selector indexed dispatch count: z0- dynamic register-base indexed dispatch count: rz%- dynamic dispatch classifications: `z*- dynamic SEH scope-table callback count: rz+- dynamic SEH scope-table callback sites: `rrrz9- dynamic save-selector table-base immediate candidates: rz6- dynamic save-selector table-base static candidates: rz<- save-selector table-base arithmetic scan rows/candidates: rz / rz5- dynamic save-selector table-base candidate sites: `rz/- selected-pointer relative handlers verified: rz - save-selector slice anchored: rz5- save-selector direct runtime dispatch proof found: rz- proof found: rz - failed dispatch table gates: `rz- missing evidence count: rz- evidence refs: rz<- descriptor boundary depends on save-selector slice model: rz9- route-relevant slice rows requiring table-base switch: rzI- route-relevant data descriptors byte-reachable via generic dispatcher: rz.- selected-root execution dispatch ref found: rz- promotion status: `rrz## Table Referencesz?| table | role | dword refs | .text refs | indexed dispatches |z"| --- | --- | ---: | ---: | ---: |rrBrCr~z| `rz` | z | r%z |)rz## Relative Opcode Rowsrzx| relative opcode | save entry | save handler | general raw handler | general absolute opcode | byte reachable | match |+| --- | --- | --- | --- | --- | --- | --- |r,r.z` | `r0r1r4r7r9r<)rz### Route-Relevant Raw vs Slice Rowsrz| role | site | low byte | slice handler | slice section | raw general handler | raw section | absolute opcode | byte reachable | requires table base | raw default | differs |zI| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |r-z| rz | `rKrMr2r5rTrPrR)rz ## Dynamic Indexed Dispatch Rowsrzz| site | kind | base | index | scale | displacement | classification | save-selector candidate | nearby table immediates |z8| --- | --- | --- | --- | ---: | --- | --- | --- | --- |r.rrrrrrrr)rz(## Dynamic SEH Scope-Table Callback Rowsrza| site | kind | base | index | displacement | classification | reason | save-selector candidate |z1| --- | --- | --- | --- | --- | --- | --- | --- |r/r)rz2## Dynamic Save-Selector Table-Base Candidate Rowsrr0zX| site | kind | base | index | displacement | classification | nearby table immediates |rz- none)rz+## Save-Selector Table-Base Arithmetic Rowsrz{| site | kind | table base | classification | general refs | save-selector refs | slice-delta refs | arithmetic candidate |z4| --- | --- | --- | --- | ---: | ---: | ---: | --- |rrrrrrr)rz## Remaining Proofsrc3&K|] }d| yw)z- NrGritems rIrzmarkdown..sD2dVDsr )rQdumpsrrrcrsextendr )summarydynamic_class_countslinesrr(rrs rImarkdownr9s :: @AGR ; 0;  ;  WX&'tGH,=+>a@;  %W-E%F$GqI ;  +73P+Q*RRST ;  *'2N*O)PPYZ ;  017R<<\JKL%kk*=>D"IIJ\]^_{{#67=2BB<PQQR T;  -W^-DE[-\,]^;  .g6I.JK`.a-bc;  37;N3OPf3g2hi;  ;7;;Gg;h:ij!; " 00D/EQG#; $ 5W[[Aa5b4cd%; & 6dii Ll@m@sqs6t6{x{5||}~'; * H{{GHI K+; 2 E{{GHI K3; : K{{DEFc{{JKL N;; B @ '++WCKDKJHJAKAROR@SST UC; D :'Bk:l9mnE; F +73N+O*PQG; H @Hz@{?|}I; J '++l345K; L +499W[[A]5^5dbd+e+lil*mmnoM; N %S5F)G)M2%N$OPO; P GKK(:;<=Q; R GwPCHDGE FS; V H{{KLM OW; ^ X{{VWX Z_; d 9Ah9i8jke; f (9 :;1=g; h i; j  k; l m; n o; p q; r Js; t -u; Ez GN+, '"567 !345 e  % %&d4&E:O4P3QQT()*#e4J.K-LB P   LL+,  #)*+55E1F0GuSQcMdLef,-.eC8R4S3TTXww567s3?b;c:ddf h   LL23   V T#k"2!35=O9P8QR&'(S1E-F-M#,NO,-.d37Q3R3YVY2Z[234Dww567swwBCDC/01S9U5V4WWY  [    LL{{78>B !#& #'',-.d3776?2CD'(cggo.F-Gtwww SWW->%?$@ww./0ww:;? f 9  ;;JKQr C LLcgg012$swwv6GHGGN+,E#''/2J1KLGG-./tCGG+BIcJ$ww'()ww9:;3ww>?@ww?@AwwDEFb  J    LL01 LLD1B)CDD LL 99U rKc, djdd|dfd|dfd|dffD}djd |d D}djd |d D}djd |jdxsgD}djd|jdxsgD}djd|jdxsgDxsd}djd|jdxsgDxsd}djd|dD}djgddddtj|ddtj|d d!tj|d"d#tj|d$d%tj|d&d'tjt |jd(xsijd)d*tjt |jd(xsijd+d,tjt |jd(xsijd-d.djgd/|d0d1|d2d3|jd4d5tjd6j|jd7xsgxsd8d9t |jd:xsgd;|jd<d=|d>d?|jd@dA|jdBdC|jdDdEtjt j|jdFxsidGdHIdJ|jdKdLtjd6j|jdMxsgxsd8dN|jdOdP|jdQdR|jdSdT|jdUdVtjd6j|jdWxsgxsd8dX|dYdZtj|d[d.d\tj|d]d^d_d`|dadbdc|daddde|dadfdg|dadhdi|dadjdk|dadldm|dadn|doS)pNrc 3K|]K\}}dtj|ddtj|d|dd|dd|dd Myw) r r$r%r& Nhtmlescape)rrr(s rIrzhtml_page..s  D% [[|!4567{{4 !"*+,-()*++,-.   sAArr|rBr}rCr~c3\K|]}dtj|ddtj|ddtj|dxsddtj|dxsddtj|dd|jd d |d d y w)rr.r0r1rr4r7rr9rr<rN)rrrrs rIrzhtml_page..s   [[%8!9:;<[[%5!6789[[%7!8!?C@AB[[%=!>!E#FGH[[%?!@ABCww56786789  sB*B,r,c3hK|])}dtj|ddtj|ddtj|ddtj|dxsddtj|d xsddtj|d xsddtj|d xsddtjt|jd xsdd|jd d|jdd|dd|dd,yw)zrrKrrMr1rrr2r4r5r7r9rrTrPrRrNrrrkrrs rIrzhtml_page..s_$  {{3v;'()[[[!1234[[%7!89:;[[%7!8!?C@AB{{334;<=>[[%=!>!E#FGH{{39:AcBCD[[SWW-G%H%OC!PQRSww5678wwBCDE/012/012 $sD0D2r-c3DK|]}dtjt|jddtjt|jddtjt|jddtjt|jddtjt|jddtjt|jd dtjt|jd d tjt|jd d tjt |d yw)rrrrrrrrrrrrrrNrrrkrr rs rIrzhtml_page..sR   [[SWW-?%@!ABCD{{3swwv/012[[SWW^%?@[[SWW_%=!>?@A{{3swww/0123[[SWW->%?!@ABC{{3sww'>?@ABC{{3sww'JKLMNO{{+C0123  sFF r.c3K|]x}dtjt|jddtjt|jddtjt|jddtjt|jddtjt|jddtjt|jd d tjt|jd d tjt|jd d {yw)rrrrrrrrrrrrrrNrrs rIrzhtml_page..$s8 #  [[SWW-?%@!ABCD{{3swwv/012[[SWW^%?@[[SWW_%=!>?@A[[SWW->%?!@ABC{{3sww'>?@ABC{{3sww789:;{{3sww'JKLMNO  #sE?Fr/c3K|];}dtjt|jddtjt|jddtjt|jddtjt|jddtjt|jddtjt|jd d tjt |d >y w) rrrrrrrrrrrrNrrs rIrzhtml_page..1s  '  [[SWW-?%@!ABCD{{3swwv/012[[SWW^%?@[[SWW_%=!>?@A[[SWW->%?!@ABC{{3sww'>?@ABC{{+C0123  'sEEr0z"nonec34K|]}dtjt|jddtjt|jddtjt|jdxs|jdxsddtjt|jdd tjt|jd d tjt|jd d tjt|jd d tjt|jd dyw)rrrrrrrrrrrrrrrNrrs rIrzhtml_page..=sN   [[SWW-?%@!ABCD{{3swwv/012[[SWW^%<%^@W%^[^!_`ab{{3sww'789:;<{{3sww'IJKLMN{{3sww'NOPQRS{{3sww'OPQRST{{3sww'TUVWXY  sFFrz"nonerc3NK|]}dtj|dyw)z
  • z
    • Nrrs rIrzhtml_page..Js#\tDKK-.e4\s#%rzXSave Selector Dispatch Table Contextzz-

    Save Selector Dispatch Table Context

    z

    Route r'z -> r(z; general table roz#; save-selector table rpz; slice offset r{z"; generic dispatcher rtrvz indexed call rwz uses rxz .

    z!

    save-selector slice anchored: rz5; save-selector direct runtime dispatch proof found: rz; proof found: rz; failed dispatch table gates: rrrz; missing evidence count: rz; evidence refs: rz<; descriptor boundary depends on save-selector slice model: rz); route-relevant table-base switch rows: rz>; data descriptors byte-reachable through generic dispatcher: rz!; dynamic indexed dispatch rows: rz$; dynamic dispatch classifications: rTrrz*; dynamic SEH scope-table callback count: rz*; dynamic SEH scope-table callback sites: rz9; dynamic save-selector table-base immediate candidates: rz6; dynamic save-selector table-base static candidates: rz<; save-selector table-base arithmetic scan rows/candidates: r/rz4; dynamic save-selector table-base candidate sites: rz.; selected-root execution dispatch ref found: rz; promotion status: rz

    rz

    z

    Table References

    zz
    tableroledword refs.text refsindexed dispatches
    z

    Relative Opcode Rows

    zz)

    Route-Relevant Raw vs Slice Rows

    a
    relative opcodesave entrysave handlergeneral raw handlergeneral absolute opcodebyte reachablematch
    z&

    Dynamic Indexed Dispatch Rows

    z
    rolesitelow byteslice handlerslice sectionraw general handlerraw sectionabsolute opcodebyte reachablerequires table baseraw defaultdiffers
    z.

    Dynamic SEH Scope-Table Callback Rows

    z
    sitekindbaseindexscaledisplacementclassificationsave-selector candidatenearby table immediates
    z8

    Dynamic Save-Selector Table-Base Candidate Rows

    z
    sitekindbaseindexdisplacementclassificationreasonsave-selector candidate
    z1

    Save-Selector Table-Base Arithmetic Rows

    z
    sitekindbaseindexdisplacementclassificationnearby table immediates
    z

    Remaining Proofs

      z
    )rrrrrkrcrQr) r table_rows opcode_rowsroute_relevant_rows dynamic_rowsrrrproofss rI html_pager s  / 0 g&9: ; W%78 9   J)) /0  K))$67$"99 ;;;<B  L #;;>?E2 # "YY ';;JKQr '  0 0ii ;;DEK   0 0WW\IZA[\ \F 99$d$ y$ 8$ $++gh&789WU]M^A_@``}CJJKRSkKlm~nnQRVR]R]^efC^DREQFFbcgcncnovwSoTcUbVVxy}yDyDEHJQJUJUViJjJpnpIuIuvBICEDyExFFabfbmbmnqszs~s~RsSsYWYr^r^_qrrnsbtauuH I M I T I T U X Z a Z e Z e f y Z z Z @ ~ @ Y E Y E F R Y S U T I U H V V b c $ f f + fG4O,P+Q fRG fHOPBHCGD fDS fT[T_T_`lTmSn fnM fNRNYNYZ^ZcZcdkdodopLdMdSQSZTZ[X[N\M] f]w fx{|C|G|GHY|Z|`^`xawb fbs ft{tt@RtSsT fTP fQXYL QM PN fN w fx  x C x C D t x u w v fv t fu | u @ u @ A | u } t ~ f~ _ f` g ` k ` k l L` M_ N fNr fsws~s~CIIJQJUJUVBJCJIGIUYfpqsrrs fs] f^e^i^ijJ^K]L fLv fw{wBwBCGCLCLMTMXMXYyMzM@~@CACHEHwIvJ fJC fDKDODOP|D}C~ f~t fu|u@u@Amunto fok flslwlwxalbkc fcd felepepq`eadb fbV fW[WbWbcgclclmtmxmxyemfmljlcmctqtWuVv fvd felmTeUdV fVp fquq|q|}DEV}WqXpY fYe f $ dkk',/0 16 $ $$ M$ $ $ ($ R$ $ $ 4$ g!$" #$$ %$& 1'$( `)$* +$, -$. 9/$0 A1$2 3$4 5$6 C7$8 r9$: ;$< =$> r)argparseArgumentParser__doc__ add_argumentrROOTr parse_argsrrf read_bytesrUr]rrrprint)parserargsrs rImainr&}s  $ $ 9F dD=4HI )cDf>fg  $<  4Dgh    D $$$b)G'4<<7 :4<r:sT" 3tH~--/6678LL H~''* Ul  "('%",#>AV#V 25/-)U! H W V N 3/  7  @  )($B ]]8fe, ]]8fe, ]]8fe, ]]8eU+ ]]8eU+ ]]8eU+  A,-12/0 8 4.B <B   "     >3lBJ*(+\  D,$jZnbEP25dB y zFrK
    sitekindtable baseclassificationgeneral refssave-selector refsslice-delta refsarithmetic candidate