IjsXdZddlmZddlZddlZddlZddlZddlZddlm Z ejjde e e jjddlmZe e jj$dZedz ZdZd ZeZd Zd Zgd Zgd ZgdZdddddddddgZd$dZd$dZd%dZ d&dZ!d'dZ"d(dZ#d(dZ$d)dZ%d*dZ&d+dZ'd+d Z(edfd,d!Z)d-d"Z*e+d#k(re*yy).zLScan broad block write candidates that could cover opcode 0x24 mode1 source.) annotationsN)Path) read_sectionsoutiHYiY0i )eaxecxedxebxespebpesiedi)zmode1-source-block-writez covering-size-transfer-candidatezruntime-watchpoint-trace)zHbroad block write candidate covering opcode 0x24 mode1 source 0x0059e348zMnearby covering size and transfer instruction proving a static block producerz8runtime watchpoint trace proving the 0x0059e348 producer Hwanse2.exezztext_section..3s[wSZ@Z7[s rawraw_size)nextr)exer%s r text_sectionr+2s;[-*<[[G C'*:M)MN NNrctjd|}g}|j|}|dk\r,|j||j||dz}|dk\r,|S)Nffrwritereadmov z ds:[addr], axz ax, ds:[addr]zdirect-moffs16>rLrPzmov al, ds:[addr]z direct-moffs8rQzmov eax, ds:[addr]zdirect-moffs32rRzmov ds:[addr], alzmov ds:[addr], eax, imm32z mov-reg-imm32h push imm32z push-imm32f>rYzopcode 0x66 0xrz modrm 0xz direct disp32zdirect-modrm16> rYrZr:> r[r\r]r^rYr`r:rarb>r[r]r^r_r`raz opcode 0xz direct-modrmunknownzunclassified dword referencer) REG_NAMES)r2r6rMopcoderegmodrmr@s r classify_refrhAs axDqMT)d37mt.C#>0&'    axDqMT)d37m|.K#=0&'    axDq3'+EES1W %%*'!U/!PQ/&'    axcAg - -~"(#6'6./ ~"(#7'7./ ~")#6'6./ &3#3*+   6 !T !FTM*C'!%cU'2#2*+   T>'+#/*+   axDqMT)d37m|.KS1W  4<4 qMT)E).gF!/S1W c/B)ERU;Vde#3*+   axDqM%ggcAgS1W  4<4 TTE#GGAQE).gF!*6#,ic{.Y#1*+   5$"#  rc g}|}|t|t|kr||}|dk(rq|dzt|kr`tjd||dzd}d|cxkr tkr.nn+|j t ||z|t|dd|dz }|dvr|d zt|krvtjd ||dzd}d|cxkr tkrCnn@|j t ||z|t ||d k(rd nd t|dz dd|dz }|dk(r||dzt|krk||dzdvratjd ||dzd}d|cxkr tkr.nn+|j t ||z|t |dd|dz }|dz }|t|t|kr|S)Njrbrz push imm8)vaHexrvalueHexrArE>rVrSrTr>r-rVrWrOrSrUr;r:r9rFrDrI) minlenr. unpack_fromMAX_BLOCK_SIZEr1rr rd)r2startendtext_varowsindexrers rsmall_immediatesr|s D E #c3t9% %e T>eai#d)3&&sD%!)%#Iftm$<#=WE   QJE  T>eai#d)3UQY<8W&&tT519=a@EE+^+ "7U?3" %e #E  QJE   O #c3t9% %P Krcg}|}|t|t|kr_||dk(ri|dzt|krXtjd||dzd}||zdz|z}|j t ||zdt |d|dz }||d k(rC|dzt|kr2||dzd k(r'|j t ||zd dd|d z }||d k(rM|dzt|kr<||dzdvr2|j t ||zd||dzddd|dz }*||dvr(|j t ||zd||ddd|dz }|t|t|kr_|S)Nr>zz rep-opcode-0xrrE>rrzstos-opcode-0x)rsrtr.rur1r)r2rwrxryrzr{relr3s rcall_or_rep_rowsrs D E #c3t9% % ;$ 519s4y#8$$T4;A>Cu_q(3.F KKw/$"6]  QJE  ;$ 519s4y#8T%!)_PT=T KKw/"!  QJE  ;$ 519s4y#8T%!)_Ph=h KKw/'UQY'<=!  QJE  ;, & KKw/(eS(9:!   C #c3t9% %D Krclt|\}}g}tttdzD]p}t ||D]]}t ||}t d||jdxsdz }|dz}t|z dz} |ddk(xr;t|jdtxr|tcxkxr ||dzknc} |ddk(xr |tk} |} |tz} | r't|| | |d Dcgc] }|d | k\r|c}ng}| rt|| | |d ng}| xrt|xr t|}|jt!|t!|d |zt!|d |z|d|d|d |d | t!| | | |||d `s|j#d|Scc}w)NrrrCr>r?rMr@r=varrBrA) addressHexrefVaHexinstructionVaHexr?r@rBrArequiredSizeToCoverMode1requiredSizeToCoverMode1HexdirectCoveringWriteaddressLikeCoveringBasecoveringSizeCandidatestransferCandidatesblockWriteCandidatec|d|dfS)Nrrr)rows rzbuild_rows..,ss<0#j/Br)key)r+rangeBLOCK_SCAN_STARTBLOCK_SCAN_ENDr7rhmaxget MODE1_SOURCE isinstanceint WINDOW_BYTESr|rboolr1rsort)r*textr2rzr=r6refinstruction_indexinstruction_end required_sizedirect_covering_write address_like window_start window_endr size_rows transfer_rowsblock_candidates r build_rowsrs c"JD$ D)>A+=>#"41" CtS)C #Ascgg6N.O.TST'U V !AgO(72Q6ML!W,Eswww/5E|DgG .DD " |, 9Ug>UL*L(<7J 0lJPTUYPZ[w<=0$& ]i,T<TRVZXnpM*VtIV4 CVO KK#Gn!$t*s"23$)$t*7H*H$I!,/W#&'8#9"=1,9/4]/C'<+7*3&3'6 '" #H IIBIC K/s3F1cDt|}|Dcgc] }|ds | }}|Dcgc] }|ds | }}|Dcgc] }|ds | }}|s|s|rdt|dnd}d|d}nd }id d d ttd ttdtt dt dt|dt|dt|dt|d|d|d|d|dddddtdtdtttd|dScc}wcc}wcc}w) Nrrrz It did find zz address-like covering base ref(s), but none has a nearby covering size immediate, so they are not block-write candidates.z2 It found no address-like covering base candidate.a!No broad block write candidate was found for 0x0059e348. The scan covers dword immediates in 0x0059e300..0x0059e348 and looks for address-like uses with nearby covering size immediates and call/rep transfer instructions; it also checks direct wide stores that could cover the mode1 source.z This does not replace a runtime trace, but it removes the obvious static memset/memcpy-style producer shape from the current evidence.ztAt least one broad block write candidate was found; inspect candidate rows before treating 0x0059e348 as unresolved.scopezUdword references to 0x0059e300..0x0059e348 with nearby size/call/rep block-write scanmode1SourceHex scanRangeHexz.. windowBytesrowCountaddressLikeCoveringBaseCountdirectCoveringWriteCountblockWriteCandidateCountaddressLikeCoveringBasesdirectCoveringWritesblockWriteCandidatesrz proofFoundF!opcode24Mode1BlockWriteProofFound$failedOpcode24Mode1BlockWriteGateIdsmissingEvidence evidenceRefsblocked)evidenceRefCountpromotionStatus conclusion) rrtrrrrr*FAILED_OPCODE24_MODE1_BLOCK_WRITE_GATE_IDS+OPCODE24_MODE1_BLOCK_WRITE_MISSING_EVIDENCE(OPCODE24_MODE1_BLOCK_WRITE_EVIDENCE_REFS)r*rzrrdirect_coveringblock_candidates address_noters r build_summaryr0s c?D#'JC3/H+ICJLJ&*Isc2G.HsIOI'+Js3H/IJJ #3C -./O OF  snL L L  h % -  5!1232eN6K5LM  |   CI   'L(9   #C$8  #C(8$9  #L     0    e  ,U  /0Z  F! " @# $ HI$ ) 'KIJs DD DD DDcZddd|dddd|ddd |d dd |d d |dd|dd|dd|dd|ddd|ddd|ddd|ddddg}|jd|dD|jgd|jd |d!D|jgd"|jd#|d$D|jgd%|d&Dcgc]}|d's |d(s|d)r|}}|D]}d*jd+|d,Dxsd-}d*jd.|d/Dxsd-}|jd0|d1d2|d3d4|d5d6|d7d8|d9d4|d6|d6|d)d8|d:d;|s|jd<|jgd=|d&D]E}|jd0|d1d2|d3d4|d5d6|d7d6|d>|d>nd-d8|d9d2|d:d;G|jdd?j|Scc}w)@Nz.# Save Selector Opcode 0x24 Mode1 Block WriteszScope: r.z- mode1 source: `r`z- scan range: `rz- scan window bytes: rz- rows: rz- address-like covering bases: rz- direct covering writes: rz- block write candidates: rz- proofFound: `rz&- opcode24Mode1BlockWriteProofFound: `rz- promotion status: `rrz## Failed Gatesc3(K|] }d|d yw)- `rNrr$items rr&zmarkdown..ss[43tfA[sr)rz## Missing Evidencerc3&K|] }d| yw)z- Nrrs rr&zmarkdown..ysD2dVDsr)rz## Evidence Refsrc38K|]}d|dd|dyw)rrz`: rNrr$rs rr&zmarkdown..s/  c&k]#c-012sr)rz## Candidate Rowsrze| address | ref | kind | access | required size | sizes | transfers | block candidate | instruction |z8| --- | --- | --- | --- | ---: | --- | --- | --- | --- |rzrrr, c36K|]}|dd|dywrm@rlNrrs rr&zmarkdown..%jDT*-.aW ?jr-c36K|]}|dd|dywrrrlNrrs rr&zmarkdown..#fDfaW ?frrz| `rz` | `rz` | rBz | r?z | `rrAz` |z%| - | - | - | - | - | - | - | - | - |)rz## All ReferencesrzG| address | ref | kind | access | width | required size | instruction |z-| --- | --- | --- | --- | ---: | ---: | --- |r@ )extendjoinr1)summarylinesrcandidate_rowssizes transferss rmarkdownr]sW8 ''"#1% G$456a8 '.12!4  678 7:&'( )'2P*Q)RS $W-G%H$IJ $W-G%H$IJ ',/02 09\1]0^^_` (9 :;1=    ' E* LL[73Y+Z[[ LL  LLD1B)CDD LL  LL>* LLv ( )S1F-G3OdKe N  jCPhLijjqnqIIfCPdLeffmjm  #l#$E#.@*A)B$sK\G]F^^a< !c*G&H%IeWTWXaWbbe()*$s=/A.B# G    <= LLv  #l#$E#.@*A)B$sK\G]F^^a< !S\5MS\SV$WX1235]9K8LC Q   LL 99U 9s2H(c rg}|dD]+}|ds |ds|dsdjd|dDxsd}djd |d Dxsd}|jd tj|d d tj|ddtj|ddtj|ddtj|ddtj|dtj|d|ddtj|dd.djd|dD}djd|dD}djd|dD}djd|dD}djd d!d"d#tj|d$d%d&d'tj|d(d)d*tj|d+d)d,|d-d.d/|d0d.d1|d2d.d3|d4d.d5|d6d.d7tjt |d8d)d9tj|d:d)d;dd?d&|d;d@d&|d;dAd&|d;dBdCdj|xsdDdEdFdG|dEgS)HNrzrrrrc36K|]}|dd|dywrrrs rr&zhtml_page..rrrrc36K|]}|dd|dywrrrs rr&zhtml_page..rrrrrrB r?rrArc3hK|]}dtj|ddtj|ddtj|ddtj|dd|d|dnd d tj|d dtj|d dy w)rrrrrrBrr?r@NrrrrArhtmlescapers rr&zhtml_page..s   [[\!2345[[%7!89:;{{301234{{3|,-./"7|7s7|SAB[[%B!CDEF[[]!3456  sB0B2rc3NK|]}dtj|dyw)
    • Nrrs rr&zhtml_page..s+  T[[&'|4#%rc3NK|]}dtj|dyw)z
  • 
    • Nrrs rr&zhtml_page..s+  t{{4 !'rrc3K|]9}dtj|ddtj|dd;yw)rrz : rrNrrs rr&zhtml_page..sE  T[[V-.i C DV8W7XX]^s?Arz`Save Selector Opcode 0x24 Mode1 Block Writeszz5

    Save Selector Opcode 0x24 Mode1 Block Writes

    z

    Scope: rz.

    z
      z
    • mode1 source: rrz
    • scan range: rz
    • scan window bytes: rrz
    • rows: rz!
    • address-like covering bases: rz
    • direct covering writes: rz
    • block write candidates: rz
    • proofFound: rz
    • promotion status: rz
    z

    rz

    z

    Failed Gates

    z

    Missing Evidence

    z

    Evidence Refs

    z

    Candidate Rows

    zz8z
    addressrefkindaccessrequired sizesizestransfersblock candidateinstruction
    No block write candidates.
    z

    All References

    z)rr1rrstr) rrrrrall_rows failed_gatesmissing_evidence evidence_refss r html_pagers{Nv -.#6K2LPSTiPj  jCPhLijjqnqIIfCPdLeffmjm  S%6789S);%<=>?;;s#45678;;s<0123S)F%GHIJ;;u%&';;y)*+,-./S%789:   $yy 6?  H77BCLww-.GG>*M 99l n? T[[!12359 "4;;w7G/H#I"J,W W^-D!E FlS !'-"8!9? WZ()/ +G4R,S+TTYZ &w/I'J&K5Q &w/I'J&K5Q S1F-G!H IV &t{{7;L3M'N&O|\ dkk',/0 16 |nE"#  & }oU#! K .!_%_! a= rc|jdd|dz jtj|dddzd |:|jjdd|jt |d yy) NT)parentsexist_ok.save_selector_opcode24_mode1_block_writes.jsonF),:) ensure_ascii separatorsrzutf-8)encoding)mkdir write_textjsondumpsparentr)rout_dirhtml_outs r write_outputsrs MM$M. ??KK 7:FMLdT:Ig.Arctjt}|jdtt dz |jdtt |jdtdd|j}t|jj}t||j|jtd |jd z y) N)rz--exer)typedefaultz --out-dirz --html-outz!Optional HTML report output path.)rrhelpz%wrote opcode24 mode1 block writes -> r)argparseArgumentParser__doc__ add_argumentrROOTOUT parse_argsrr* read_bytesrrrprint)parserargsrs rmainr%s  $ $ 9F dD=4HI  $<  4Dgh    DDHH//12G'4<<7 1$,,Aq2q1r str__main__)rrreturnr)r*bytesr'ztuple[dict, bytes])r2r(r3rr'z list[int])r2r(r6rr'dict) r2r(rwrrxrryrr' list[dict])r*r(r'r*)r*r(r'r))rr)r'r)rr)rrrz Path | Noner'None)r'r+),r __future__rrrrr.syspathlibrrinsertr__file__resolverprobe_exe_scene_tablesrrrrrrrrrvrdrrrrr r+r7rhr|rrrrrrr%__name__rrrr4s6R" 3tH~--/66780 H~''* Ul   D .* /+ +ij BTFG 1Bqr,(O k\+\%P(V*ZIXK\25dBu zFr
    addressrefkindaccesswidthrequired sizeinstruction