WJjnRdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ejjdee ej!j"ddlmZe ej!j(dZedz Zd Zd Zeez Zd Zd ZeZd ZgdZgdZgdZ ddddddddddddgZ!d-dZ"d-dZ#d.dZ$d/dZ%d0dZ&d1dZ'd2d Z(d3d!Z)d4d"Z*d5d#Z+d6d$Z,d7d%Z-d8d&Z. d9 d:d'Z/d;d(Z0d;d)Z1edfdzGSummarize static indirect candidates for opcode 0x24 mode1 source byte.) annotationsN)Path)Any) read_sectionsoutiYiHY iY`)eaxecxedxebxespebpesiedi)z&static-base-plus-mode1-offset-producerznearby-base-mode1-window-writezruntime-watchpoint-trace)zAstatic base+0x38 producer for opcode 0x24 mode1 source 0x0059e348z2nearby-base short-window write covering 0x0059e348z8runtime watchpoint trace proving the 0x0059e348 producer Hwanse2.exez/global base, base+offset, and nearby-base scans)path descriptionz3out/save_selector_opcode24_mode1_source_writes.jsonz.direct/static source-write scan for 0x0059e348z-out/save_selector_selection_buffer_bases.jsonz.known global selection-buffer base assignmentsz"out/runtime_trace_feasibility.jsonz-runtime watchpoint trace availability blockercd|dS)N0x08xvalues T/home/exedev/hwanse/tools/summarize_save_selector_opcode24_mode1_indirect_context.pyhex32r. c{ cd|dS)Nr02xrrs rhex8r"2rrcp|js|Stj|jdS)Nutf-8encoding)existsjsonloads read_text)rfallbacks r load_jsonr,6s* ;;= ::dnngn6 77rc^tdt|D}|||d|d|dzfS)Nc32K|]}|ddk(s |yw)namez.textNr).0sections r ztext_section..=s[wSZ@Z7[s rawraw_size)nextr)exer1s r text_sectionr7<s;[-*<[[G C'*:M)MN NNrctjd|}g}|j|}|dk\r,|j||j||dz}|dk\r,|S)NzNsǀz address-writezmov dword ptr [eax+0xa8], imm32context-a8-imm32) accessKindwidth instructioninstructionPrefixBytesinstructionKindregister>ffrwritereadzmov z ds:[addr], axz ax, ds:[addr]zdirect-moffs16ax>rPrTzmov al, ds:[addr]z direct-moffs8alrUzmov eax, ds:[addr]zdirect-moffs32r rVzmov ds:[addr], alzmov ds:[addr], eaxaddress, imm32 mov-reg-imm32hz push imm32 push-imm32f>razopcode 0x66 0xr! modrm 0xz direct disp32zdirect-modrm16>rarb>rfra>rfrg opcode 0xz direct-modrm>rcriz modrm 0x05 direct disp32zdirect-imm-storeunknownzunclassified dword immediater) REG_NAMES)r=rArQopcoderegmodrms rclassify_dword_refroKs? axDq3'+FF)<&'1    axDq3'+EES1W %%*'!U/!PQ&'/    axcAg - -~"(#6./'6 $ ~"(#7./'7 % ~")#6./'6 $ &3*+#3!   6 !T !FTM*C'!%cU'2*+#2   T>'+*+#/   axDqMT)d37m|.KS1W  4<4 qMT)E).gF!/S1W c/B)ERU;Vde*+#3   axDqM%==cAgS1W  4<4 l*E).gF$ 4!!*6#,ic{.Y*+#1   axDqM\1cAgS1W  D=%$n!!*6#,6OP*+#5   5"#$  rc lt|\}}g}t||D]}t||}td||j dxsdz }|j t |t |d|zt |d|z||d|d|d|d|dd |jd |S) NrrJvarGrHrIrKrL) targetHexrefVaHexinstructionVaHex dataIndexrGrHrIrKrLc |dS)Nrsr)rows rz"scan_target_refs..s c*orkey)r7rBromaxgetr<rsort)r6r>textr=rowsrArefinstruction_indexs rscan_target_refsrsc"JD$ DtV,   s+3#''2J*K*Pq#QR vd4j3./ %d4j3D&D El+\}-"#45J     II-I. Krc.|dzt|krQ||dk(rI||dzd|zk(r;tjd||dzd}|t|dzd t|d dd S|d zt|krQ||d k(rI||dzd|zk(r;tjd||dzd}|t |dzd t|dd d S|dk(rI|dzt|kr8||dk(r0tjd||dzd}|t |dzddd S|d zt|krr||dk(rj||dz}|d z dz}|dz}|dk(rP||k(rKtjd||dzd}|t |dzdt|dz dzdt|dd d Sy)Nr_rbrMrzadd z, imm8)offset offsetHexnextInstructionnextInstructionBytesrDqAv 23!%i &:%;7C$%   A~)a-3t94iD9P##D$ A >qAv 23/$%   1}D !d9o&=Y]#zT! T\ !8i''dIMB1EF "6J#67%))UaZ44G*H)IYW`MaLbbi#j()   rc|t|kxr||dk(}|r|dzn|}|dzt|kDry||}|dvry||dz}|dz dz}|dz}|dz} |} |dk(r)| t|k\ry|| } | dz } | dz} |d k(r| d k(r y|d k(r|d k(ry| |k7s|d vry|dk(r2| t|k\rytjd || d } | dz|z } n4| dzt|kDrytjd || d } | dz|z } |dvrdnd}|dvrd}n|rd}nd}||t|t|| |dk(rt | dzn t| dzd|dd|ddt |d|dk(rt | dzn t| dzd | dS)Nr`rrM>rfrargrbrircrDr_rrErrd>rrMrr>rfrarircrQrR>rfrgrirrrhr!rez [+])rGrH opcodeHexmodrmHex displacementdisplacementHexrI byteLength)rr9rr"rrk)r=indexbase_regprefix66 opcode_indexrlrnrr disp_indexbasesibrlengthaccessrHs rdecode_mem_access_with_basersOs4y 8T%[D%8H (519eLa#d)# , F 99 ! "E A: C B!J D Qw T ":a Tz !8  bAg x3f, ax T "))#tZ@C a%' >CI %))$jA!D a%'"::WF ## &\K$?Bax5 !:;TR^aeReMf"6#,ic{"YxEXDYYZ@CGH@H[`ampzaz[{NRS_bfSfNg[hhij  rc6t|||}|r|d|k7ry|S)Nr)r)r=rr target_offsetrs rdecode_mem_access_atr:s' (uh ?F VN+}< Mrc t|\}}g}g}|D]&}|jddk7r|jd}|tvr3tj|}t |d} | dz} t || |} | rR|j |d|| d| dtt| dzt|d | z| d | dtk(d tt|| tz} t| | D]@} t|| |t}|s|j |dt|d | z|d |B)|jd |jd||fS)NrKr\rLrurErtrrrqr) baseLoadVaHexrLrrrrnextInstructionVaHexrequalsMode1Offset)r accessVaHexrLc |dS)Nrritems rrxz'scan_base_offset_rows..ds d?&;rryc |dS)Nrrrs rrxz'scan_base_offset_rows..es d=&9r)r7r|rkrintrr<rGLOBAL_BUFFER_BASE MODE1_OFFSETminr WINDOW_BYTESrangerr})r6 base_rowsr~r= offset_rows window_rowsrwrmrrArdecoded window_endrrs rscan_base_offset_rowsrAsc"JD$KK 77$ % 8 ggj! i  OOC( #k"#!G )$ 9E    !$%7!8!(+$[1"#58I#IJ(-d4j9.D(E#*+<#=%,X%6,%F  TI $<= 9j1 E)$y,OF""%();%<#(de);#< #$ $ ->;<9:  ##rc t|\}}g}tttdzD]5}t ||D]"}|j ddk7r|j d}|t vr3t j|}t|d}|dz} tt|| tz} t| | D]} t|| |} | s|| dz} t| j dxsd }| tcxkxr| t|dzknc}|s]|jt!||d t!|d | z|t!| d z|d | %8|j#d|S)NrrKr\rLrurErrHrrtrqr)baseHexrrrLrrcoversMode1Sourcec|d|d|dfS)Nrrrrrs rrxz.scan_nearby_base_window_rows..sYo1F]H[\rry)r7rNEARBY_BASE_SCAN_STARTNEARBY_BASE_SCAN_ENDrr|rkrrrrNEARBY_BASE_WINDOW_BYTESr MODE1_SOURCEr{r<rr})r6r~r=rrZrwrmrrArrrrr>rH covers_mode1s rscan_nearby_base_window_rowsrisc"JD$ D/1E1IJ#C1 Cww()_<''*%C)#!,Ic+&'CaISY 4L(LMJy*5 4T5)L 6.#99FJJw/415%NUA8NN # $W~%();%<#(de);#< #!&v ':!;)5   : II\I] Krcb|jDcic]\}}|dk7s ||c}}Scc}}w)Nru)items)rwrzrs r compact_rowrs+), K:3{8JCJ KK Ks ++c |xsi}|xsi}t|t}t|t}t||\}}t |}|Dcgc]}|j ddk(r|} }|Dcgc]}|j ddk(r|} }|Dcgc]}|j ddvr|} }|Dcgc]}|j ddvr|} }|Dcgc]}|j ddk(r|} }|Dcgc]}|j ds|}}|Dcgc]}|j ddk(r|}}|Dcgc]}|j ddk(r|}}|j d xsgDcgc]%}|j d t tk(r|'}}|j d t||j d |j d |j dd}t| dk(xr>t| dk(xr.t|dk(xrt|dk(xrt|dk(}|rdnd}idt tdt tdttdtdt tdt tdtdt|dt| dt| dt| dt|dt|d t| d!t| d"t|d#t|d$t|id%t|d&t|d't|d(|d)|d*|d+|d,|d-|d.|d/|d0|Dcgc] }t|c}d1|Dcgc] }t|c}d2|d3d4d5d4d6tt t"tt"d7|d8Scc}wcc}wcc}wcc}wcc}wcc}wcc}wcc}wcc}wcc}wcc}w)9NrKrFr\rG>rRrQ>r^r\rQrimmediateAssignmentsrexactMode1RefCountcoveringWriteCountindexedWriteCandidateCountaddressProducerCandidateCount)rrrrracThe static 0x0059e310 base-reference scan found global selection-buffer assignments and direct flag/input/object-state uses, but no immediate 0x0059e310+0x38 materialization and no short-window store to [base+0x38]. A wider nearby-base scan also found no short-window write through an alternate base such as 0x0059e340+0x08. The only exact 0x0059e348 reference is still the opcode 0x24 mode1 read, so this scan does not prove an indirect producer. This is a bounded static scan, not a full runtime data-flow proof; route promotion remains blocked until a runtime producer or stricter control-flow proof appears.zAt least one static base-derived candidate reaches 0x0059e348; inspect candidate rows before treating the mode1 source as unresolved.mode1SourceHexglobalBufferBaseHexmode1OffsetHex windowBytesnearbyBaseScanRangeHexz..nearbyBaseWindowBytesglobalBaseDirectRefCountglobalBaseAssignmentCountglobalBaseMovImmediateCountglobalBaseDirectDataAccessCount%globalBaseKnownContextAssignmentCountmode1DirectRefCountmode1DirectWriteCountmode1AddressImmediateCountbasePlusOffsetRowCount!basePlusMode1OffsetCandidateCount#baseWindowMode1AccessCandidateCount"baseWindowMode1WriteCandidateCount)nearbyBaseWindowMode1AccessCandidateCount(nearbyBaseWindowMode1WriteCandidateCountdirectProducerSummaryknownContextBaseAssignmentsbasePlusOffsetRowsbasePlusMode1OffsetCandidatesbaseWindowMode1AccessCandidatesbaseWindowMode1WriteCandidates%nearbyBaseWindowMode1AccessCandidates$nearbyBaseWindowMode1WriteCandidatesglobalBaseDirectRefsmode1DirectRefsnoStaticBaseIndirectCandidate proofFoundFopcode24Mode1IndirectProofFound"failedOpcode24Mode1IndirectGateIdsblocked)missingEvidence evidenceRefsevidenceRefCountpromotionStatus conclusion)rrrrrr|rrr"rrrrrr'FAILED_OPCODE24_MODE1_INDIRECT_GATE_IDS(OPCODE24_MODE1_INDIRECT_MISSING_EVIDENCE%OPCODE24_MODE1_INDIRECT_EVIDENCE_REFS)r6mode1_source_writesselection_buffer_basesr mode1_rowsrrnearby_base_window_rowsrwglobal_assignment_rows base_mov_rowsbase_direct_data_rowsmode1_address_rowsmode1_write_rowsmode1_offset_rowsmode1_window_writesnearby_base_window_writesknown_base_assignmentsdirect_summary!no_static_base_indirect_candidaters r build_summaryrs{ .339r &89I!#|4J4S)DK:3?  77$ %); ;   77$ % 8 M  77< $5 5   77$ %)H H   77< G +  #cgg.A&B   77< G + +!  77< G + !!*--.DEK  779 '9!: :  2556JCPZO\1556JK&9&=&=>Z&[)<)@)@A`)a N " 0 " #q ( 0 ! "a ' 0 # $ ) 0 ) *a / & - &U( % -( u%78(  $|,(  | (  !U+A%B$C2eL`FaEb"c (  !9 (  #C N(  $S)?%@(  &s='9(  *3/D+E(  05K1L(  s:(  %5!6(  %c*<&=(  !#k"2(  ,S1B-C!( " .s;/?#( $ -c2E.F%( & 4S9P5Q'( ( 3C8Q4R)( * +( , &'=-( . k/( 0 ():1( 2 *;3( 4 )*=5( 6 01H7( 8 /0I9( : Y GcS!1 G;( <  CK,C=( > ()J?( @ eA( B *5C( D -.UE( FD= EF$ O( (G      ! t!HCsH O.O O3OO8OOO"<O'2*O,&O1 O6 cddd|ddd|ddd|d dd |d d |d d|dd|dd|dd|dd|dd|dd|ddd|dd|ddd |d!dd"|d#dd|d$dd%dg}|jd&|d'D|jgd(|jd)|d*D|jgd+|jd,|d-D|jgd.|d/D]>}|jd0|d1d2|d3d4|d5d6|d7d6|d8d9|d:d2|d;d<@|d/s|jd=|jgd>|d?D]8}|jd0|d1d6|d@d2|d3dA|dBdA|dCd4|dDdE :|d?s|jd=|jgdF|dGD]D}|jd0|dHd6|d1d6|d@d2|d3d4|d7d2|dBdA|dCd4|dDdEF|dGs|jdI|jgdJ|dKD]3}|jd0|dLd2|dBdA|dC|dCndMd4|dDdE 5|jgdN|dOD]9}|jd0|dLd2|dBdA|dC|dCndMdA|dPd4|dDdE ;|jddQj|S)RNz2# Save Selector Opcode 0x24 Mode1 Indirect Contextz- mode1 source: `r`z- global buffer base: `rz"- mode1 offset from global base: `rz- global base direct refs: rz#- global base context assignments: rz"- global base mov-immediate refs: rz- exact mode1 refs: rz- exact mode1 direct writes: rz"- exact mode1 address immediates: rz%- base plus mode1-offset candidates: rz-- short-window [base+0x38] write candidates: rz- nearby-base scan range: `rz-- nearby-base short-window write candidates: rz- proofFound: `rz$- opcode24Mode1IndirectProofFound: `rz- promotion status: `rrz## Failed Gatesc3(K|] }d|d yw)- `rNrr0rs rr2zmarkdown..$sY43tfAYsr)rz## Missing Evidencerc3&K|] }d| yw)z- Nrrs rr2zmarkdown..*sD2dVDsr)rz## Evidence Refsrc38K|]}d|dd|dyw)rrz`: rNrr0rws rr2zmarkdown..0s/  c&k]#c-012sr)rz## Base Plus Offset RowsrzL| base load | register | offset | target | next instruction | mode1 offset |z%| --- | --- | --- | --- | --- | --- |rz| `rz` | rLz | `rz` | `rrr rrz |z| - | - | - | - | - | - |)rz+## Short-Window Base+0x38 Access Candidatesrz>| base load | access | register | kind | width | instruction |z&| --- | --- | --- | --- | ---: | --- |rrz | rGrHrIz` |)rz&## Nearby-Base Mode1 Access CandidatesrzN| base | base load | access | register | target | kind | width | instruction |z2| --- | --- | --- | --- | --- | --- | ---: | --- |rrz!| - | - | - | - | - | - | - | - |)rz ## Exact Mode1 Direct Referencesrz&| ref | access | width | instruction |z| --- | --- | ---: | --- |rrt-)rz ## Global Base Direct Referencesrz-| ref | access | width | kind | instruction |z | --- | --- | ---: | --- | --- |rrK )extendr<join)summarylinesrws rmarkdownr  s< G$456a8 !'*?"@!AC ,W5E-F,GqI %g.H&I%JK -g6Q.R-ST ,W5R-S,TU w'<=>? '0G(H'IJ ,W5Q-R,ST /8[0\/]^ 7@d8e7fg %g.F&G%HJ 7@j8k7lm ',/02 .w7X/Y.ZZ[\ (9 :;1=    / E2 LLY73W+XYY LL  LLD1B)CDD LL  LL>* LL+,  #o&'tC O+?  #i.!s?';&d?|xsd@dAdBdC|xsdDdAdEdF|xsdGdAdHdI|dAdJdK|dAS)LNrc3ZK|]}dtj|ddtj|ddtj|ddtj|ddtj|dd tj|d d|d d y w)rrLrrrrrrrz Nhtmlescapers rr2zhtml_page..~s   [[_!5678{{3z?+,-[[[!1234[[[!1234[[%;!<=>a CPaLb@c?de&'()   sB)B+rc3(K|]}dtj|ddtj|ddtj|ddtj|dd|dd tj|d d y w) r#rr&rr$rL rGrHr%rINr'rs rr2zhtml_page..s   [[_!5678[[]!3456{{3z?+,-{{3|,-./7|n[[]!3456   sBBrc3K|]}dtj|ddtj|ddtj|ddtj|ddtj|ddtj|d d |d dtj|d d yw)r#rr&rrr$rLr%rrrGr+rHrIr,Nr'rs rr2zhtml_page..s   [[Y012[[_!5678[[]!3456{{3z?+,-[[[!1234{{3|,-./7|n[[]!3456  sCCrc 3K|]_}dtj|ddtj|dd|d|dnddtj|d d ayw) r#rtr$rGr+rHNrr%rIr,r'rs rr2zhtml_page..s   [[%7!89:;{{3|,-./"7|7s7|SAB[[]!3456  sA%A'rc3K|]x}dtj|ddtj|dd|d|dnddtj|dd tj|d d zyw) r#rtr$rGr+rHNrrKr%rIr,r'rs rr2zhtml_page..s   [[%7!89:;{{3|,-./"7|7s7|SAB{{301234[[]!3456   sA>Brrc3NK|]}dtj|dyw)
    • Nr'rs rr2zhtml_page..s+  T[[&'|4#%rc3NK|]}dtj|dyw)z
  • 
    • Nr'rs rr2zhtml_page..s+  t{{4 !'r3rc3K|]9}dtj|ddtj|dd;yw)r1rz : rr5Nr'rs rr2zhtml_page..sE  T[[V-.i C DV8W7XX]^s?ArzdSave Selector Opcode 0x24 Mode1 Indirect Contextzz9

    Save Selector Opcode 0x24 Mode1 Indirect Context

    z
      z
    • mode1 source: rr2z
    • global buffer base: rz
    • mode1 offset: rz
    • global base direct refs: rr5z%
    • global base context assignments: rz$
    • global base mov-immediate refs: rz
    • exact mode1 refs: rz
    • exact mode1 direct writes: rz$
    • exact mode1 address immediates: rz'
    • base plus mode1-offset candidates: rz/
    • short-window [base+0x38] write candidates: rz"
    • nearby-base scan range: rz/
    • nearby-base short-window write candidates: rz
    • proofFound: rz
    • promotion status: rz
    z

    rz

    z

    Failed Gates

    z

    Missing Evidence

    z

    Evidence Refs

    z

    Base Plus Offset Rows

    zz7z
    base loadregisteroffsettargetnext instructionmode1 offset
    No base-plus-offset rows.
    z1

    Short-Window Base+0x38 Access Candidates

    zzLz,

    Nearby-Base Mode1 Access Candidates

    z
    base loadaccessregisterkindwidthinstruction
    No short-window [base+0x38] access candidates.
    zLz&

    Exact Mode1 Direct References

    zc
    basebase loadaccessregistertargetkindwidthinstruction
    No nearby-base short-window access candidates.
    z&

    Global Base Direct References

    zp
    refaccesswidthinstruction
    )rr(r)str) rrr nearby_rowsrr failed_gatesmissing_evidence evidence_refss r html_pager<}s)) /0  K)) <=  K)) BC  K,-J 12  I77@ALww-.GG>*M 990p0 n0 D0  0 #4;;w7G/H#I"J,W 0 )W=R5S)T(UUab 0 #4;;w7G/H#I"J,W0 (0J(K'LER0 08S0T/UUZ[0 /w7T/U.VV[\0 !)>!? @F0 *'2I*J)K5Q0 /w7S/T.UUZ[0 2':]2^1__de0 :'Bf:g9hhmn0 -T[[AY9Z-[,\\hi!0" :'Bl:m9nnst#0$ !S1F-G!H IV%0& 't{{7;L3M'N&O|\'0( )0* dkk',/0 16+0, -0. |nE"/00 $102  &304 !506 }oU#708 )90: `;0< PP=0> ?0@ )argparseArgumentParser__doc__ add_argumentrROOTOUT parse_argsrr6 read_bytesr,rrrIrFrGprint)parserargsrrHs rmainrXs  $ $ 9F dD=4HI /dCJ{D{| 2sMxGxy  $<  40    D $**B/$--r2G WdllDMMBH 5hZ @Ar__main__)rrreturnr7)rrr+rrZr)r6bytesrZztuple[dict, bytes])r=r[r>rrZz list[int])r=r[rArrZdict)r6r[r>rrZ list[dict])r=r[rrrrrZ dict | None)r=r[rrrrrZr^) r=r[rrrrrrrZr^)r6r[rr]rZztuple[list[dict], list[dict]])r6r[rZr])rwr\rZr\)NN)r6r[rr^rr^rZr\)rr\rZr7)rr\rFrrGz Path | NonerZr)rZNone)5rO __future__rrMr(r(r9syspathlibrtypingrrinsertr7__file__resolverEprobe_exe_scene_tablesrr>rQrRrrrrrrrrkrrrrr"r,r7rBrorrrrrrrrr r<rIrX__name__rrrrisM" 3tH~--/66780 H~''* Ul 00  ## D +' ,( +\] BTDE
    refaccesswidthkindinstruction