Jj JdZddlmZddlZddlZddlZddlZddlZddlm Z ejjde e e jjddlmZe e jj$dZedz ZdZd Zd Zd Zd Zgd ZgdZdddddddddgZd!dZd"dZd#dZd$dZ d$dZ!d%dZ"d&dZ#d&dZ$d'd(dZ%d)dZ&e'd k(re&yy)*zJScan overlapping stores that may initialize opcode 0x24 mode1 source byte.) annotationsN)Path) read_sectionsoutiHYiDYiMYi@YiPY)zstatic-mode1-source-writezindexed-mode1-source-producerzruntime-watchpoint-trace)zEstatic overlapping write covering opcode 0x24 mode1 source 0x0059e348zAindexed or address-producer candidate that initializes 0x0059e348z8runtime watchpoint trace proving the 0x0059e348 producer Hwanse2.exezAabsolute-address and static producer-like scans around 0x0059e348)path descriptionz5out/save_selector_opcode24_mode1_runtime_context.jsonz+runtime-producer proof gap for mode1 sourcez"out/runtime_trace_feasibility.jsonz-runtime watchpoint trace availability blockercd|dS)N0x08x)values Q/home/exedev/hwanse/tools/summarize_save_selector_opcode24_mode1_source_writes.pyhex32r)s c{ c.g}|dk\rm||dz dvrc||dz }|dk(r|jdnD|dk(r|jdn-|dk(r|jdn|d k(r|jd |d k\rm||d z |d vrc||d z |}|d k(r|jdnD|dk(r|jdn-|dk(r|jdn|dk(r|jd|d k\rm||d z |dvrc||d z |}|dk(r|jdnD|dk(r|jdn-|dk(r|jdn|dk(r|jd|dk\r||dz |dk(r|jd |dk\r||dz |d!k(r|jd"|d k\r||d z |d#k(r|jd$|d k\r||d z |d%k(r|jd&|sd'dd(d)|tk(d*S|d)\}}}} |||| |tcxkxr ||zkd*Scd*S)+Nr>r)readrzmov al, ds:[addr]rr)rzmov eax, ds:[addr]rr)writerzmov ds:[addr], alrr)rrzmov ds:[addr], eaxr>    r)rrzmov cl, byte ptr ds:[addr]rr)rrzmov ecx, dword ptr ds:[addr]rr)rrzmov byte ptr ds:[addr], clrr)rrzmov dword ptr ds:[addr], ecxr>r")rrzmov dl, byte ptr ds:[addr]rr#)rrzmov edx, dword ptr ds:[addr]rr )rrzmov byte ptr ds:[addr], dlrr!)rrzmov dword ptr ds:[addr], edxrsf )rrzmov word ptr ds:[addr], cxr$sf )rrzmov cx, word ptr ds:[addr]r$s)rrzmov byte ptr ds:[addr], imm8rs)rrzmov dword ptr ds:[addr], imm32runknownz%unclassified direct address referencer) accessKindwidth instructioninstructionPrefixBytescoversMode1Source)append MODE1_SOURCE) dataposaddress candidatesopcodeprefixaccessr'r( prefix_lens r classify_refr5-sJ axDqM%==cAg T>   A B t^   B C t^   B C t^   C D axDq%)]]cAgc" [   J K { "   L M { "   K L { "   M N axDq%)]]cAgc" [   J K { "   L M { "   K L { "   M N axDq%8GH axDq%8FG axDq%4IJ axDq%4KL #B&'!(L!8   .8]*FE; "",$ FwF   G  rc \|dk\r1d||dz cxkrdkr nngd||dz dz }dddd|d dd d S|dk\r||dz d k(r dddd dd d S|dk\r<||dz dk(r1d||dz cxkrdkr nngd||dz dz }dddd|d dd d S|dk\rH||dz dvr>||dz }||dz }d|cxkrdkr#nn d|dvrdnd|dvrdndd|dd|ddd|dvd S|dk\rJ||dz dvr@||dz }||dz }||dz }|dvr$d|dvrdnd|dvrdndd|dd|dd|ddd|dvd Sy) Nr)eaxecxedxebxespebpesiediaddress-immediater/rzmov z, imm32F) candidateKindr&r'r(r)isWriteCandidatehz push imm32r>rEindexed-displacement>rGrHrKrErr>rGrIrKz opcode 0x02xz modrm 0xz disp32r$>r $,4<sib-displacementz sib 0xr)r-r.r/regr1modrmsibs r"classify_static_producer_candidaterbgs' axDDqM1T1FtCRSG}W[G[\0#!#g.&' %    axDqMT)0#'&' %    axDqMT)dd37m.Kt.KFtCRSG}W[G[\0#!#g.&' %    axDqM%IIcAgS1W  5 D !7)/3K)KgQW$(::!*6#,ic{'R*+$*.F$F   axDqM%IIcAgS1W 37m t t!3)/3K)KgQW$(::!*6#,ic{'RUVYQZZab*+$*.F$F   rcFt|}td|D}||d|d|dz}g}tttdzD]}t j d|}|j|}|dk\s0t|||}|jt|t|d|zt|dtd||jdxsdz z|d |d |d |d d |j||dz}|dk\r|jd|S)Nc32K|]}|ddk(s |ywnamez.textNr.0sections r zscan_refs..NG76?g3MN rawraw_sizerzscan_refs..s<0#j/Brkey)rnextrange SCAN_STARTSCAN_ENDstructpackfindr5r+rmaxgetsort) exesectionstextr-rowsr/needler.refs r scan_refsrs7S!H NxN ND tE{DK$z*:: ;D DX\2-T7+iiQhtS'2C KK#Gn!$t*s"23$)$t*s1cSWWMeEfEkjk>l7m*m$n!,/W"=1%()<%= ))FC!G,CQh- IIBIC KrcBt|}td|D}||d|d|dz}g}tttdzD]}t j d|}|j|}|dk\s0t|||}|rh|jt|t|d|zt|dtd||dz z|d |d |d |d |d |tk(d |j||dz}|dk\r|jd|S)Nc32K|]}|ddk(s |ywrerrgs rrjz2scan_static_producer_candidates..rkrlrmrnrrorrpr)rBr&r'r(rC) rqrrrsrBr&r'r(rCexactMode1Displacementc|d|dfSrurrvs rrxz1scan_static_producer_candidates..ryrrz)rr|r}PRODUCER_SCAN_STARTPRODUCER_SCAN_ENDrrrrbr+rrr,r) rrrr-rr/rr. candidates rscan_static_producer_candidatesrsDS!H NxN ND tE{DK$z*:: ;D D,.?!.CD-T7+iiQh:4gNI "'. %d4j3&6 7(-d4j3q# RjHkBk;l.l(m%.%?"+L"9&w/#,]#;(12D(E.5.E  ))FC!G,CQh-$ IIBIC KrcPt|}t|}|Dcgc])}|jdr|jddk(r|+}}|Dcgc]&}|jdttk(s%|(}}|Dcgc](}|jddvr|jdr|*}}|Dcgc]}|jddk(r|}}|s|s|sd nd }id d d ttdtt dtt dt|dt|dt|dt|dt|dt|d|d|d|d|d|dddddtttttd|d Scc}wcc}wcc}wcc}w)!Nr*r&rrqrB>r^rMrCrAaNo overlapping .text store covering 0x0059e348 was found in the absolute-address scan, and no static address-immediate or indexed-displacement producer candidate was found for the 0x0059e340..0x0059e350 neighborhood. The only exact mode1 source reference remains the opcode 0x24 mode1 read, so 0x0059e348 is still an unresolved runtime byte rather than a proven leaf selector. Adjacent references are useful for object-state context but do not initialize the current mode1 source.zAt least one static producer-like candidate was found near 0x0059e348; inspect those rows before treating mode1 source as unresolved.scopezrabsolute .text references to 0x0059e344..0x0059e34d plus static producer-like references to 0x0059e340..0x0059e350mode1SourceHexstaticProducerScanRangeHexz..rowCountexactMode1RefCountcoveringWriteCountindexedWriteCandidateCountaddressProducerCandidateCountstaticProducerCandidateCountcoveringWritesindexedWriteCandidatesaddressProducerCandidatesstaticProducerCandidatesr proofFoundF"opcode24Mode1SourceWriteProofFound%failedOpcode24Mode1SourceWriteGateIdsblocked)missingEvidence evidenceRefsevidenceRefCountpromotionStatus conclusion) rrrrr,rrlen+FAILED_OPCODE24_MODE1_SOURCE_WRITE_GATE_IDS,OPCODE24_MODE1_SOURCE_WRITE_MISSING_EVIDENCE)OPCODE24_MODE1_SOURCE_WRITE_EVIDENCE_REFS) rrstatic_candidatesrwcovering_writesexact_mode1_refsindexed_write_candidatesaddress_producer_candidatesrs r build_summaryrsQ S>D7< 77& 'CGGL,AW,L O(,\sww|/DlH[/[\\(  77? #'S S GG& '    )# 77? #': : ##'?Hc  S U F % -  %/B)C(DBuM^G_F`&a  CI   c"23   c/2   %c*B&C  (-H)I  ',=(>  /  !":  $%@  #$5    e  -e! " 01\# $HA IJ$ - /]  #s.F&F6F-F3F#czddd|dddd|ddd |d dd |d d |dd|dd|dd|ddd|ddd|dd|ddddg}|jd|dD|jgd|jd|d D|jgd!|jd"|d#D|jgd$|d%D]>}|jd&|d'd(|d)d*|d+d,|d-d,|d.d,|d/d,|d0d1@|d%s|jd2|jgd3|d4D]?}|jd&|d'd(|d)d*|d-d,|d.|d.nd5d,|d6d,|d0d1 A|jdd7j|S)8Nz/# Save Selector Opcode 0x24 Mode1 Source WriteszScope: r.z- mode1 source: `r`z- static producer scan range: `rz- exact mode1 refs: rz,- overlapping writes covering mode1 source: rz- indexed write candidates: rz- address producer candidates: rz- proofFound: `rz'- opcode24Mode1SourceWriteProofFound: `rz- promotion status: rz- conclusion: rz## Failed Gatesc3(K|] }d|d yw)- `rNrrhitems rrjzmarkdown..s\43tfA\sr)rz## Missing Evidencerc3&K|] }d| yw)z- Nrrs rrjzmarkdown..$sD2dVDsr)rz## Evidence Refsrc38K|]}d|dd|dyw)rr z`: r Nrrhrws rrjzmarkdown..*s/  c&k]#c-012sr)rz## Static Producer CandidatesrzR| address | ref | kind | access | width | exact mode1 displacement | instruction |z,| --- | --- | --- | --- | ---: | --- | --- |rz| `rqz` | `rsz` | rBz | r&r'rr(z |z| - | - | - | - | - | - | - |)rz## Absolute Referencesrz?| address | ref | access | width | covers mode1 | instruction |z&| --- | --- | --- | ---: | --- | --- |r-r* )extendr+join)summarylinesrws rmarkdownr s9 ''"#1% G$456a8 )'2N*O)PPQR w';<=> 6w?S7T6UV &w/K'L&MN )'2Q*R)ST ',/02 1':^2_1``ab w'89:; ./0  # E& LL\73Z+[\\ LL  LLD1B)CDD LL  LL>* LL12  #l#$E#.@*A)B$s?G[F\\_< !S\N#c:R6S5TTWX[\iXjWkkm o  - . 45 LLv  #l#$E#.@*A)B$srqrsrB r&r'rr( Nhtmlescapers rrjzhtml_page..Ms   [[\!2345[[%7!89:;{{3/012{{3|,-./7|n+,-.{{3}-./0  sBBrc3K|]~}dtj|ddtj|ddtj|dd|d|dnd d|d dtj|d d yw) rrqrrsrr&rr'Nrr*r(rrrs rrjzhtml_page..Ys   [[\!2345[[%7!89:;{{3|,-./"7|7s7|SAB&'(){{3}-./0   sBBrrc3NK|]}dtj|dyw)
  • z
    • Nrrs rrjzhtml_page..ds+  T[[&'|4#%rc3NK|]}dtj|dyw)z
  • 
    • Nrrs rrjzhtml_page..hs+  t{{4 !'rrc3K|]9}dtj|ddtj|dd;yw)rr z : r rNrrs rrjzhtml_page..lsE  T[[V-.i C DV8W7XX]^s?ArzaSave Selector Opcode 0x24 Mode1 Source Writeszz6

    Save Selector Opcode 0x24 Mode1 Source Writes

    z

    Scope: rz.

    z

    mode1 source rz$; static producer scan rz; exact refs rz,; overlapping writes covering mode1 source: rz; indexed write candidates: rz; address producer candidates: rz; proofFound rz; promotion status: rz

    z

    rz

    Failed Gates

    z
      z
    z

    Missing Evidence

    z

    Evidence Refs

    z#

    Static Producer Candidates

    zz<z
    addressrefkindaccesswidthexact mode1 displacementinstruction
    No static producer candidates.
    z

    Absolute References

    z)rrrstr)r producer_rowsr failed_gatesmissing_evidence evidence_refss r html_pagerLsII 56  M 99 6?  D77CDLww-.GG>*M 99m n@ T[[!12359 )9!: ;;_`giEaF`GG[\cdx\y[zzfgnoCgDfEEabijFbGaHHghopOhPgQQdeiepepqtu|}IuJqKeLdMMhimititu|}NuOiPhQQU V dkk',/0 16 |nE"#  & }oU#- lWW& S ) rc|jdd|dz }|jtj|dddzd |9|jjdd|jt |d |S) NT)parentsexist_okz/save_selector_opcode24_mode1_source_writes.jsonFr) ensure_asciiindentrzutf-8)encoding)mkdir write_textjsondumpsparentr)rout_dirhtml_outjson_outs r write_outputsrs MM$M.JJH  7q9D@dT:Ig.A Orctj}|jdttdz |jdtt |jdt|j }t|jj}t||j|j}td|y)Nz--exer)typedefaultz --out-dirz --html-out)rz&wrote opcode24 mode1 source writes -> )argparseArgumentParser add_argumentrROOTOUT parse_argsrr read_bytesrrrprint)parserargsrrs rmainrs  $ $ &F dD=4HI  $<  40    DDHH//12GWdllDMMBH 28* =>r__main__)rintreturnr)r-bytesr.rr/rrdict)r-rr.rr/rrz dict | None)rrrz list[dict])rrrr)rrrr)N)rrrrrz Path | Nonerr)rNone)(__doc__ __future__rrrrrsyspathlibrr insertr__file__resolverprobe_exe_scene_tablesrrrrr,r~rrrrrrrr5rbrrrrrrr__name__rrrr sP" 3tH~--/66780 H~''* Ul   /+ 0, +no DVCD 1Bqr-)7t9x061h?D9x ? zFr
    addressrefaccesswidthcovers mode1instruction