UHjYpdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ejjdee ej!j"ddlmZmZmZe ej!j,dZedz Zd Zd Zd d hZd ZhdZhdZgdZgdZ dddddddddgZ!d*dZ"d*dZ#d+dZ$d,dZ%d-dZ&d.dZ'd/dZ( d0d Z) d1d!Z* d2d"Z+d3d#Z,d4d5d$Z-d6d%Z.d6d&Z/efd7d'Z0d8d(Z1e2d)k(re1yy)9zGSummarize opcode 0x20 descriptor rows that select runtime object bases.) annotationsN)Path)Any)find_cns_strings read_sections va_to_offsetoutmap1_01amap2_02d`>>(@ABCD)z!runtime-context-f2-object-pointerzdescriptor-script-gate-rowzfield-map-or-frontier-referencezspecific-gate-base-proof)zLruntime context+0xf2 object pointer selected by the active descriptor scriptzbdescriptor+4 script row that reads/writes gate offsets 0xe8 or 0xea after the object-base selectorzKfield-map CNS or current-frontier reference after the object-base candidatez1specific gate-base proof for map1_01a -> map2_02d Hwanse2.exez:descriptor+4 script scans and opcode 0x42 handler evidence)path descriptionz2out/save_selector_opcode20_descriptor_scripts.jsonz8descriptor script rows and frontier/gate reference scansz-out/save_selector_selection_buffer_bases.jsonz;runtime object pointer mode still required for context+0xa8cd|dS)N0x08xvalues T/home/exedev/hwanse/tools/summarize_save_selector_opcode20_object_base_candidates.pyhex32r$6 c{ cd|dS)Nr02xr r!s r#hex8r):r%r&cp|js|Stj|jdS)Nutf-8encoding)existsjsonloads read_text)rfallbacks r# load_jsonr3>s* ;;= ::dnngn6 77r&c"|r t|dSdS)Nr)intr!s r# parse_hexr6Ds"3ub>,,r&cvt||}||dzt|kDrytjd||dS)Nzrrr)selectionOperation isGateOffsetwritesSelectionBufferreadsSelectionBuffercnscurrentFrontierTarget)itemsrangemaxmin SCAN_DWORDSr@r$r)SELECTION_OPCODESBASE_SETTER_OPCODESrupdaterJ GATE_OFFSETSappend)r<r=strings script_va frontier_refs start_index end_indexrowslabelr"frontier_by_var`row_varIrYrZrXs r# script_wordsrts D7D7J7J7LM|ueeUlMNMs1k*C Y,GHUQY&h/ = 8 K7!t+ ", 6]e f"=1"=1"ERK4#78!'+s+C034G0H&3CR&8+.}+=-:3B-?25m2D  Ns+C/AC4%C9<C9cxt|}t||}|jdxsijDcic]\}}|t |}}}|jDcic] \}}| || }}}g}|jdxsgD]}t d|jdxsgDi} t | jd} | G| jdxsgD cgc]&} | jdr| jds| (} } | D]} | jd d k7r| jd } t | ts;| jdxsgDcgc]<}|jdr)t |jd tr |d | kDr|>}}|Dcgc]}|jdr|}}t|||| | |}|jd |jd |jd xsg| jd| | jd| jd| jd | jd| jd| jdd t| t|||| || dz | dzt|td|Dt|t|dk(| jd| jddd|}|j||Scc}}wcc}}wcc} wcc}wcc}w)N frontierRefsdescriptorRowsc3JK|]}|jddk(s|yw)slotzscript+4NrG).0scripts r# z%collect_candidates..s%q6PVPZPZ[aPbfpPpqs##scripts scriptVaHexbaseSetterRowswritesContextA8rgrc0x42r`descriptorVaHexscript0LinkedCnsrarbrLrMrd) descriptorIndexrr script4VaHexcandidateIndexcandidateVaHexcandidateValueHexrcrLrMrdc3DK|]}|jdsdyw)rgr NrG)rlaters r#rz%collect_candidates..s%D",) qZ^^I-F-L"qsuvw{{=9:   ";;'78>B ww()#'':J2K    # )Cww{#v-GGG$EeS)#*;;/?#@#FB%99./Juyy?QSV4W\abi\jmr\r% !%=R(u5Y^YbYbcsYt(u %(u-c8WjRWYfgJ#->>'#:#->>2C#D$.NN3E$F$L" ' M :"'"%'''"2%(WWZ%8 WW[1"%''*:";"%''*:";"%''*:";.c2+3':}^cfg^ginqrirs-01F-G8;?X;Y]^;^+2;;7O+P5<[[Ac5d05)*+I.   i (G# ),)Z gb %)vs*L!* L'5L'2+L-3AL2:L7L7ci}|D] }|xsd}|j|ddz||<"t|jDcgc] \}}||d c}}Scc}}w)Nnonerr )r"count)rHsortedrn)valuescountsr"keyrs r# histogramrsnF-ovjja(1,s - #6<<>2  E5%(  sAcd||nttdz i}||nttdz i}t||}t|Dchc]}|d c}}|Dcgc]}|j ddk(r|}}t d|D}t d|D}t d|D} |Dcgc]}|j dd k(s|} }d } id t d td |j d dt|dt|d|dt|Dcgc]}|j dc}dt|Dcgc]}|j dc}dt|Dcgc]}|j dc}dt| dt|d|d|d| dt d|Ddtd|Dd|j d d!d"d#d$d%|d&d'd(d(tttttd'| d) Scc}wcc}wcc}wcc}wcc}wcc}w)*N.save_selector_opcode20_descriptor_scripts.json)save_selector_selection_buffer_bases.jsonrrPrUc3&K|] }|d yw)rNr rrXs r#rz build_summary..s$gUXS)O%P$gc3&K|] }|d yw)rNr rs r#rz build_summary..s]3$E F]rc3&K|] }|d yw)rNr rs r#rz build_summary..scQTs#KLcrrNa The 16 non-pointer descriptor+4 context+0xa8 rows are all opcode 0x42 object-base selectors with stream+1 == 0, so the handler chooses dword[0x0059db30 + context[0xf2]*4] rather than a fixed stream+2 object index. Scanning the rest of each descriptor+4 script after these rows finds no 0xe8/0xea selection-buffer reads or writes, no field-map CNS records, and no current-frontier direct references. These rows are therefore generic runtime object-base reselections, not a specific gate-base proof for map1_01a -> map2_02d.sourcetargetdescriptorTableVaHexcandidateCountdescriptorCountWithCandidatesdescriptorIndicesWithCandidatesopcodeHistogramrcstreamPlus1HistogramrLobjectSelectorModeHistogramcontextF2ObjectSelectorCount"immediateObjectIndexCandidateCountrrrlastNonPointerCandidateCountc3,K|] }|ds dyw)rr Nr rs r#rz build_summary../s+v#sKtGuA+vs (anyCandidateContributesSpecificGateProofc3&K|] }|d yw)rNr rs r#rz build_summary..0s7r`c> T8N7Y3_h 99 `$C);?U?Y?YZ{?|## &%1#/!-\  !-1"+(-+O@: BC$ E# ##!O)m &R*[1fs* HH4HHH# H( .H- c|ddd|dd|dd|dd d |d d |d d|dd|dd|dd|dd|dd|dd|dd|dd d|dd d |d!d d|d"dd#dg}|jd$|d%D|jgd&|jd'|d(D|jgd)|jd*|d+D|jdd,dd-d.d/|d0d1d2|d0d3d2|d0d4d5|d0d6d7 dd8dd9d:g |d;D]c}|jd<|d=d>d?j|d@xsdAdB|dCd2|dDd2|dEd5|dd>|dd>|dd>|dFd>|dGd7e|jddHj|S)INz2# Save Selector Opcode 0x20 Object Base Candidatesrz - route: rz -> rz- descriptor table: `r`z&- non-pointer object-base candidates: rz- descriptors with candidates: rz!- context+0xf2 object selectors: rz#- fixed stream+2 object selectors: rz*- gate `0xe8/0xea` rows after candidates: rz'- field-map CNS rows after candidates: rz*- current-frontier refs after candidates: rz- specific gate proof: rz)- runtime object pointer proof required: rz- proofFound: `rz!- opcode20ObjectBaseProofFound: `rz- promotion status: `rrz## Failed Gatesc3(K|] }d|d yw)- `rNr ritems r#rzmarkdown..^sV43tfAVsr)rz## Missing Evidencerc3&K|] }d| yw)z- Nr rs r#rzmarkdown..dsD2dVDrr)rz## Evidence Refsrc38K|]}d|dd|dyw)rrz`: rNr rs r#rzmarkdown..js/  c&k]#c-012srz## Handler Evidencez8| handler | context+0xf2 write | stream+2 write | mode |z| --- | --- | --- | --- |z| `rrz` | `rrz` | rz |z ## Candidatesz| descriptor | script+0 CNS | candidate | stream+1 | effective base | gate rows after | field maps after | frontier refs after | last non-pointer | later pointer-like setters |zB| ---: | --- | --- | --- | --- | ---: | ---: | ---: | --- | ---: |rz| rz | , rrWz | `rrLrQrr )extendrwjoin)summarylinesrXs r#markdownrFs< GH%&d78+<*=> (> ?@B 09I1J0KL )'2Q*R)ST +G4R,S+TU -g6Z.[-\] 4W=c5d4ef 1':[2\1]^ 4W=e5f4gh !'*T"U!VW 3G<_4`3ab ',/02 +G4R,S+TTUV (9 :;1=    + E. LLV73T+UVV LL  LLD1B)CDD LL  LL>* LL  B#'+,-CDEF)*+@ABC)*+>?@()-89 =   {L!$|$   &'(DIIc:L6M,N,URU+VW$%&eC0@,A+BC-./t9:;3456c;<=S<=>c9:;2 ?    LL 99U r&cdjd|dD}djd|dD}djd|dD}g}|dD]}|jd |d d tjd j|d xsddtj|ddtj|ddtj|dd|dd |dd |dd |dd |dddjgddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0tj|d1d2tj|d3d4|d5d6|d7d8|d9d:|dd;|dd<|dd=|d>d?tj|d@dAdBtj|dCdDdEdF|dGdHdF|dGdIdF|dGdJdKdLtj|dMdNdtj|dMdOdtj|dMdPdtj|dMdQd dRdSdT|dRdUdVdS)WNrc3NK|]}dtj|dyw)
  • z
    • Nhtmlescapers r#rzhtml_page..s+  T[[&'|4#%rc3NK|]}dtj|dyw)z
  • 
    • Nrrs r#rzhtml_page..s+  t{{4 !'rrc3K|]9}dtj|ddtj|dd;yw)rrz : rrNrrs r#rzhtml_page..sE  T[[V-.i C DV8W7XX]^s?Arrzrz r rrWzrzrLrQzrrrrrz r zzzz zF zA Save Selector Opcode 0x20 Object Base Candidatesz zzz;

    Save Selector Opcode 0x20 Object Base Candidates

    z

    route rz -> rz&; non-pointer object-base candidates: rz!; context+0xf2 object selectors: rz#; fixed stream+2 object selectors: rz; gate rows after candidates z"; field-map rows after candidates z!; frontier refs after candidates z; proofFound rz ; promotion status rz .

    z

    rz

    z

    Failed Gates

    z
      z
    z

    Missing Evidence

    z

    Evidence Refs

    z

    Handler Evidence

    zw z
    handlercontext+0xf2 writestream+2 writemode
    rrrrrz
    z

    Candidates

    a zz)rrwrr)r failed_gatesmissing_evidence evidence_refscandidate_rowsrXs r# html_pager sY77=>Lww-.GG>*MN|$  ()*+;;tyy-?)@AHSIJKS)9%:;<=S)9%:;<=S)B%CDEF=>?@89:;?@AB@ABC=>?@    99--- - # - Q - L - - r- 1- 7- :- G- f- t- Q- '!-" #-$ %-& '-( F)-* dkk'("345WT[[QYIZ=[<\]CDKL\D]C^^@GHf@ghhKLSTxLyKzzWX_`FXGWHHjkrsTkUjVVwx@hxiwjj}~E F R ~S }T T t u y u @ u @ A H I Z A [ u \ t ] ] i j +-,  GL12348--. "/-0 e$1-2 &3-4 !"%(5-6 #7-8 u%9-: &;-< B=-> [[):!; r')argparseArgumentParser__doc__ add_argumentrROOTr parse_argsrr< read_bytesr3rrr,r+print)parserargsrs r#mainr:s  $ $ 9F dD=4HI .T3IyCyz 2sMxGxy  $<    D $))2.$--r2G '4<<( D <<N N O Qr&__main__)r"r5returnstr)rrr2rr<r)r"z str | Noner< int | None)r<bytesr= list[dict]r>r5r<r>)rIr5r<r=)rXdictr<rA)r<r?r=r@rxdict[int, str]ryr5rzdict[str, int]r{r5r|r5r<r@)r<r?r=r@rxrBryr5r{r5rzrCr<rA)r<r?rrAr<r@)rzlist[str | None]r<r@)NN)r<r?r dict | NonerrDr<rA)rrAr<r=)rrAr+rr<None)r<rE)3r2 __future__rr0rr/r:syspathlibrtypingrrinsertr=__file__resolveparentprobe_exe_scene_tablesrrrr"r4rrrrvrrrsrtrrrr$r)r3r6r@rJr[rrrrrrr r,r:__name__r r&r#rPsM" 3tH~--/6678PP H~''* Ul  d|  ,:($ )%S EQ @T &" 8 -48+ +++ + " +  +++\     "  89 999x>BFRJZ25 & zFr&
    descriptorscript+0 CNScandidatestream+1effective basegate rows afterfield maps afterfrontier refs afterlast non-pointerlater pointer-like setters