UHj=dZddlmZddlZddlZddlZddlZddlZddlm Z ejjde e e jjddlmZmZe e jj&dZedz ZgdZgd Zgd Zd d d gZddZddZddZddZddZddZddZ ddZ!d dZ"d dZ#efd!dZ$d"dZ%e&dk(re%yy)#zPSummarize code paths that assign the context+0xa8 selection-buffer base pointer.) annotationsN)Path) offset_to_va read_sectionsout) )zfixed-selection-buffer-basezstatic-gate-address-refzruntime-pointer-mode-proof)z2fixed context+0xa8 base for the current route pathz7direct static reference to the 0xe8/0xea gate addresseszXruntime pointer-mode proof selecting the correct global/save/object base before the gate Hwanse2.exezEcontext+0xa8 assignment scan and static gate-address reference checks)path descriptioncd|dS)N0x08xvalues K/home/exedev/hwanse/tools/summarize_save_selector_selection_buffer_bases.pyhex32r& c{ cd|dS)Nr02xrrs rhex8r*rrcg}d} |j||}|dkr|St||}||j||dz}>)Nrr)findrappend)exesectionspatternrowsoffsethitvas r pattern_hitsr&.sU D F hhw' 7K (C ( > KKOq rctjd|}t|||}t||ddDcgc] }t |c}fScc}w)NcCL014C@%%dCs7|1CDQGD KKr ;z).z).)<  q+ rc tjd}dddddddddd d dd d ddddd }t|||Dcgc]&}|t|dd|j |ddd(c}Scc}w)N 8981a8000000z(saved pointer table 0x0059dd70[stream+2]zdword[0x0059dd70 + stream[2]*4])r9baseExpressionz$save block slot selected by stream+1z0x00457750 + stream[1] * 0xd8z5runtime object pointer table selected by context+0xf2z#dword[0x0059db30 + context[0xf2]*4]z1runtime object pointer table selected by stream+2zdword[0x0059db30 + stream[2]*4]z+save block slot selected by object field +3z0x00457750 + object[3] * 0xd8)iZW@i=d@id@id@iAiAzmov dword [ecx+0xa8], eax)r%r6r:zregister-computed baseeax)r;r<r&rget)rr r!knownr%s rregister_assignmentsrF^smmN+GA? == NC J? D= NC + EBsHg6   2Y6 ii'?SXYZ    s+A.c \ddddddddddd d d d dd ddd ddddd dg}g}|D]}tD]y}t|jdtr|d|znd}d}g}|t |||\}}|j |d|dt || t|nd|||dd{|S)N 0x0059e310r4z,global selection buffer immediate assignmentT)r8r7r9static 0x004576d8r5z'save/runtime block immediate assignmentz0x00457750+n*0xd8iPwEzindexed save block slot baseFzdword[0x0059db30+i*4]z!runtime object pointer table basezdword[0x0059dd70+i*4]zsaved pointer table baser7rr8r9rI)r8 baseSource offsetHex addressHexdirectDwordRefCountdirectDwordRefs staticAddress) GATE_OFFSETS isinstancerDintr0rrr) rr basesr"r7r#addresscountr.s rgate_address_rowsrWs$D  $?  +4  /9  /0  3 E@ D" F/9$((6:JC/Pd6lV+VZGE D"5c8WM t KK ?"8n!&\070CeGn',#'!%h    Krct|}t||}t||}t||}|Dcgc]}|ddvr|dr |ddkDr|}}d}iddd t |d t |d |d |d |dt |dddddddt dt dtdt tddd|Scc}w)NrL>0xe80xearPrNraThe selection-buffer pointer at context+0xa8 is not a single fixed array. Static handler paths can point it at 0x0059e310 or 0x004576d8, while other paths compute a save-slot base or load an object pointer from 0x0059db30/0x0059dd70. The gate offsets 0xe8/0xea therefore need runtime pointer-mode evidence before they can prove fallthrough. Exact dword refs to the static 0x0059e310+0xe8/0xea and 0x004576d8+0xe8/0xea addresses are absent, so the producer is still unresolved.contextFieldHex 0x000000a8immediateAssignmentCountregisterAssignmentCountimmediateAssignmentsregisterAssignmentsgateAddressRows#knownStaticGateOffsetDirectRefCountruntimePointerModeStillRequiredT proofFoundFselectionBufferBaseProofFound failedSelectionBufferBaseGateIdsmissingEvidence evidenceRefsevidenceRefCountpromotionStatusblocked conclusion)rr?rFrWr,%FAILED_SELECTION_BUFFER_BASE_GATE_IDS&SELECTION_BUFFER_BASE_MISSING_EVIDENCE#SELECTION_BUFFER_BASE_EVIDENCE_REFS)rr immediates registers address_rowsrowknown_static_e8_ea_refsrls r build_summaryrus_S!H&sH5J$S(3I$S(3L# { / /  % & *  Z < "C O  "3y>     y   <   .s3J/K  *4  e  (  +,Q  A  ;  C CD  9  j! sB;cddd|ddd|dd|d d |d d |d d|ddd|ddd|ddd|ddddg}|jd|dD|jgd|jd|dD|jgd|jd|dD|jgd|dD],}|jd |d!d"|d#d$|d%d&|d'd( .|jgd)|d*D],}|jd |d!d$|d%d&|d+d"|d'd( .|jgd,|d-D]O}|jd |d#d$|d.d&|d/d"|d0xsd1d$|d2d3d4j|d5xsd1d6 Q|jdd7j|S)8Nz&# Save Selector Selection Buffer Basesz- context field: `r[`z- immediate assignments: r]z!- register/computed assignments: r^z"- static gate-offset direct refs: rbz'- runtime pointer mode still required: rcz- proofFound: `rdz"- selectionBufferBaseProofFound: `rez- promotion status: `rjrlz## Failed Gatesc3(K|] }d|d yw)- `rxNr.0items r zmarkdown..sW43tfAWsrf)rwz## Missing Evidencerwc3&K|] }d| yw)z- Nrr{s rr~zmarkdown..sD2dVDsrg)rwz## Evidence Refsrwc38K|]}d|dd|dyw)rzr z`: rNrr|rss rr~zmarkdown..s/  c&k]#c-012srh)rwz## Immediate Assignmentsrwz$| va | base | source | instruction || --- | --- | --- | --- |r_z| `r6z` | `r8z` | r9z | `r:z` |)rwz## Register Assignmentsrwz/| va | source | base expression | instruction |rr`rB)rwz## Gate Offset Address ChecksrwzF| base | source | offset | address | direct dword refs | sample refs |z&| --- | --- | --- | --- | ---: | --- |rarKrLrM-rNz | , rOz | )extendrjoin)summarylinesrss rmarkdownrs0 W%678: #G,F$G#HI +G4M,N+OP ,W5Z-[,\] 1':[2\1]^ ',/02 ,W5T-U,VVWX (9 :;1=     E" LLW73U+VWW LL  LLD1B)CDD LL  LL>* LL-.n s3w<.c)n-=T#h-PTUXYfUgThhklmn LL,-  #g,tCM?$s;K7L6MUSVWdSeRffi j   LL()  #i.!c,&7%8S=Md?tj|d@dAdBtj|dCdDdEdF|dGdHdF|dGdIdF|dGdJdK|dLdMdN|dLdOdP|dLdQdRdS)SNrwc3NK|]}dtj|dyw)
  • z
    • Nhtmlescaper{s rr~zhtml_page..(s+  T[[&'|4#%rfc3NK|]}dtj|dyw)z
  • 
    • Nrr{s rr~zhtml_page..,s+  t{{4 !'rrgc3K|]9}dtj|ddtj|dd;yw)rr z : rrNrrs rr~zhtml_page..0sE  T[[V-.i C DV8W7XX]^s?Arhr_zr6zr8zr9zr:zr`rBrarKrLrMrrNz rrOz rzzzz zF z5 Save Selector Selection Buffer Basesz zzz/

    Save Selector Selection Buffer Bases

    z

    context field r[z; immediate assignments r]z ; register/computed assignments r^z!; static gate-offset direct refs rbz'; runtime pointer mode still required: rcz; proofFound rdz; promotion status: rjz.

    z

    rlz

    z

    Failed Gates

    z
      z
    z

    Missing Evidence

    z

    Evidence Refs

    z

    Immediate Assignments

    zc z
    vabasesourceinstruction
    z

    Register Assignments

    zn z%

    Gate Offset Address Checks

    z
    vasourcebase expressioninstruction
    zz)rrrr)r failed_gatesmissing_evidence evidence_refsimmediate_rowsrs register_rowsrrs r html_pager's77>?Lww-.GG>*MN-.  S\234S^456;;s8}-./S%789:    M,-  S\234;;s8}-./S)9%:;<=S%789:    L()   S^456;;s<0123S%5678S%6%=#>?@,-./;;tyy->)?@GCHIJ      99,,, , # , Q , @ , , r, 1, 7, :, G, f, t, Q, '!," #,$ %,& ',( :),* $DKK8I0J$K#LLklsuOmPlQQqryzSrTqUUvw~dwevffMNUVwNxMyyLMTUaMbLcc~CJJKRSdKef~ggl m+,,  GL12348-,. "/,0 e$1,2 &3,4 !"%(5,6 #7,8 u%9,: +;,< n=,> ?,@ A,B *C,D yE,F G,H I,J 0K,L \M,N O,P Q,R S,T U,V W,, ,rc|jdd|dz jtj|dddzd |d z jt |d y) NT)parentsexist_okz)save_selector_selection_buffer_bases.jsonF) ensure_asciiindentrzutf-8)encoding)save_selector_selection_buffer_bases.html)mkdir write_textjsondumpsr)rout_dirs r write_outputsrsf MM$M. ::FF 7q9D@G ::FFyQXGYdkFlrcvtjt}|jdtt dz |jdtt |j}t|jj}t||jtd|jdz y)N)rz--exer )typedefaultz --out-dirz.wrote save selector selection buffer bases -> r)argparseArgumentParser__doc__ add_argumentrROOTOUT parse_argsrur read_bytesrrprint)parserargsrs rmainrs  $ $ 9F dD=4HI  $<    DDHH//12G'4<<( :4<rsV" 3tH~--/6678> H~''* Ul! )% *&^'# 8 :$N2j#LDNYx25my zFr
    basesourceoffsetaddressdirect dword refssample refs