JjZdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ejjdee ej!j"ddlmZmZddlmZmZe ej!j0dZed z Zd Zd Zd Zd ZdZdZ dZ!dZ"dZ#dZ$dZ%d"dZ&d#dZ'd$dZ(d%dZ)d&dZ*d'dZ+d(dZ,d)dZ-d*dZ.d+dZ/d+dZ0edfd,dZ1d-d Z2e3d!k(re2yy).zOSummarize the descriptor context for the 0x00542a04 frontier wrapper candidate.) annotationsN)Path)Any) read_sections va_to_offset)handler_for_opcodesection_name_for_vaoutmap1_01amap2_02diTi)Ti)Ti*Ti)Ti*Ti +T?cp|js|Stj|jdS)Nutf-8encoding)existsjsonloads read_text)pathfallbacks O/home/exedev/hwanse/tools/summarize_save_selector_wrapper_descriptor_context.py load_jsonr#s* ;;= ::dnngn6 77cd|dS)N0x08xvalues rhex32r")s c{ rc"|r t|dSdS)N)intr s r parse_hexr&-s"3ub>,,rcvt||}||dzt|kDrytjd||dS)Nz'field_maps_for_child..Ms"Y:J1Ky1XYs$$ fieldRecordsmap)nextrG) leaf_streamsrJrowrecords ` rfield_maps_for_childrRJs]  YY[_ `C  ,/GGN,C,Ir _&VZZX]M^FJJu  __ _s A# A#c t|||}|t||| t|ndt|cxkxr tkncd}|d|d<|St ||}t|||}|t k(rt|||dznd}|t k(rT| t|nd} |j dt|t|| t|| |tk(|tk(d|S|r|j d|d|Sd |d<|S) N)r/vaHexr!valueHexinsideCurrentRootEntryRun unreadablekindr(descriptor-pointer)rX descriptorHexdescriptorMarkerHexchildPointerHexchildFieldMapspointsToWrapperDescriptorchildIsFrontierLeafpointer)rX targetSectionscalar) r1r"ROOT_TABLE_POINTERROOT_TABLE_END_EXCLUSIVEr DESCRIPTOR_MARKERupdaterRWRAPPER_DESCRIPTOR FRONTIER_LEAF) r-r.r/rOr!rPr6markerchildrJs rroot_table_rowrkSs S(B 'Er$)$5E%L4%72%X@X%X  C }"F  !(E2G c8U +F28"?  '  /  "y7L5#3RV  #EWEcb);C(@$Aim  )*=*A*A,*O  $%8%<%<^%L  ()<)@)@AQ)R  '(;(?(?(PTX(X  / $ $^ 4 : ? ?@W X\` `# & !,&"S;S"S' ( $%76%\D\%\) *$,/ 3s)Ic t|}tttdDcgc]}t ||||}}|Dcgc]}|j ds|}}|Dcgc]}|j ddk(s|}}t ||t}t ||tD cgc]} t||| } } t ||t} |D cgc]} t| dcxkr tkrnn| } } |D cgc]} t| dcxkr tkrnn| } } | D cgc]} t| dcxkr tkrnn| }} | D cgc]} | j dr| }} tdDcgc]<}tt|dzztt||t|dzzxsdd >}}t||tdz}d }id td td tt dttdttdttdz dttdttdz dttdttdttdtt"d| t|nddt%|| t|ndd|dt'|d|d| dt'| idt)d| Ddt)d | Dd!t'|d"|d#| d$| d%| d&|d't+d(| Dd)t-| d*t-|d+|tk(d,|d-d.d/d0d1gd2|Scc}wcc}wcc}wcc} wcc} wcc} wcc} wcc} wcc}w)3Nr(rVrXrYr7rrnr)rTrUaThe 0x00542a04 candidate has descriptor shape 0x3f + child pointer 0x00542ae8, but its table reference is 0x005429ac, which is before the current 2:0 root table pointer 0x005429dc. The current root entry run contains later descriptors such as 0x00542a84, 0x00542a98, 0x00542aac, 0x00542ac0, and 0x00542ad4, not 0x00542a04. The 0x00542ae8 reference at 0x00542a08 is therefore a descriptor child pointer rather than a direct current-root table entry. A separate current-root dword 0x0054090c equals 0x005429ac, but it follows opcode 0x5a mode 0 at 0x00540908; that handler advances by +4 and does not jump to [stream+4], so this is a fallthrough stream word rather than wrapper selection proof. Interpreted as the next stream word, 0x005429ac has low opcode 0xac and that handler-table entry resolves to scalar 0x00000003 outside executable code, so the word also does not provide a code-backed wrapper jump. This keeps wrapper execution/selection unproven and the route blocked.sourcetargetrootHexrootTablePointerHextableWindowHexz..currentRootEntryRunHexwrapperEntryHexwrapperDescriptorHexfrontierLeafHexfrontierReaderHexwrapperChildPointerHexwrapperChildFieldMaps tableRowscurrentRootDescriptorCountcurrentRootDescriptorRowswrapperEntryRefswrapperEntryRefCount$wrapperEntryCurrentRootRangeRefCountc3DK|]}|jdsdyw)rr NrFrHrs rrKz build_summary..s3y#WZW^W^_wWxA3y  'wrapperEntryCurrentRootEntryRunRefCountc3DK|]}|jdsdyw)rVr NrFrs rrKz build_summary..s6SZ]ZaZab}Z~q6rwrapperEntryPromotingRefCount wrapperRefswrapperTableRefswrapperCurrentRootRefsfrontierLeafRefsfrontierLeafCurrentRootRefswrapperRefBeforeCurrentRootc34K|]}|dtkyw)r7N)rcrs rrKz build_summary..s*kQT3w<:L+L*kscurrentRootReferencesWrapper frontierLeafDirectCurrentRootRefwrapperChildIsFrontierLeafwrapperDescriptorWordspromotionStatusblockedremainingProofsznprove a runtime path selects descriptor 0x00542a04 despite its table ref being before the current root pointerz3or find a strict map1_01a source coordinate/hotspot conclusion)rrangeTABLE_WINDOW_STARTrdrkrGrBrg WRAPPER_ENTRYrrhrcr"r1SOURCETARGETrFRONTIER_READERrRr*sumanybool)r-rOr.r/ table_rowsrPcurrent_root_rowscurrent_root_descriptor_rows wrapper_refsrwrapper_entry_refs frontier_refswrapper_table_refswrapper_current_root_refsfrontier_current_root_refswrapper_entry_promoting_refsindexwrapper_descriptor_wordsrjrs r build_summaryrsS!H*,DaH  sHb,7J)3[cgg>Y6Z[[($CGGFO?S,S$ $!h0BCL!h >  #3#6"#x?M# W H0H H  $! W H0H H !! %" W H0H H "" *$ 77- . $ $1X   - 9:hsH6H5ST96TUZYZ[    S($6$: ;E >% &% &%  5&%  u%78 %  U#567r%@X[\@\:]9^_ %  !U+=%>$?r%H`cdHdBeAf"g %  5/%  &8 9%  5/%  U?3%  !%2C%,%  !5lTYTeE%Lko!p%  Z%  %c*F&G%  $%A%  .!% " $6 7#% $ /3yAS3y0y%% & 236DV63'% ( (-I)J)% * |+% , .-% . !";/% 0 M1% 2 &'A3% 4 &s*kXj*k'k5% 6 '-F(G7% 8 +D1K,L9% : %e}&<;% < !":=% > 9?% @  | A A% H jI% %e\$ !"$ sAMMMM9M#M""M'6"M,"M1M6/AM;c!vddd|dd|dd|dd d |d d d |d d d|dd d|dd d|dd d|dd d|dd|dd|dd|dd|dd |d!d"|d#d$|d%d&|d'd(|d)d|d*dd+dd,d-g}|d.D]}|jd/|d0d1|jd2d3|jd4d5|jd6d7|jd8xsd9d3d:j|jd;xsgxsd9d< |jgd=|d>D]M}|d?tk}t|d?cxkxr t knc}|jd/|d@d3|dAd5|d5|d< O|jgdB|dCD]}|jd/|d@d3|dAd7|jdDdE|jdFd1|jdGd3|jdHd7|jdId1|jdJdK|jdLd1|jdMdN|jdOxsd9d5|jdPd5|jdQd5|jdRd<|jgdS|dTD] }|jd/|d0d1|d2dU"|jgdV|jdW|dXD|jddYj|S)ZNz*# Save Selector Wrapper Descriptor Contextz - route: rz -> rz - root: `r`z- root table pointer: `rz- current root entry run: `rz- wrapper entry: `rz- wrapper descriptor: `rz- wrapper child pointer: `rz- frontier leaf: `rz!- current root descriptor count: rz#- wrapper ref before current root: rz#- current root references wrapper: rz)- frontier leaf direct current-root ref: rz"- wrapper child is frontier leaf: rz- wrapper entry ref count: rz,- wrapper entry refs in current root range: rz0- wrapper entry refs in current root entry run: rz - wrapper entry promoting refs: rz- promotion status: rrz## Table Windowz8| va | value | root entry? | kind | child | child maps |z%| --- | --- | --- | --- | --- | --- |rz| `rTz` | `rUz` | rVz | rXz | `r\rv, r]z |)rz## Wrapper Referencesrz?| ref | section | before current root? | inside current root? |z| --- | --- | --- | --- |rr7r8r6)rz## Wrapper Entry Referencesrzy| ref | section | previous | opcode | mode | handler | fallthrough word | fallthrough handler | role | promotes? | note |zD| --- | --- | --- | --- | ---: | --- | --- | --- | --- | --- | --- |rrxz` `ryrzr{r|rz` / `rrz` / rrrr)rz## Wrapper Descriptor Wordsrz| va | value |z | --- | --- |rz` |)rz## Remaining Proofsrc3&K|] }d| yw)z- NrrHrIs rrKzmarkdown..YsD2dVDsr )r;rGjoinextendrcrd)summarylinesrPrbeforeinsides rmarkdownrs[4 GH%&d78+<*=> GI&'q) !'*?"@!AC %g.F&G%HJ W%678: !'*@"A!B!D $W-E%F$GqI W%678: +G4P,Q+RS -g6S.T-UV -g6T.U-VW 3G<^4_3`a ,W5Q-R,ST %g.D&E%FG 6w?e7f6gh :7Cl;m:no *73R+S*TU w'89:;    B/7 E:{#  #g,uSWWZ%8$9cggFa>b=ccfwwvtCGG,=$>$E##Fdyy!128b9@SA E   LL}%ZW 22#s7|N6NN s3z?+4I/?s6(#fXUWXYZ LL)*  #j/"$s9~&6d377?;S:TU*+,E#'':M2N1Otww+,-T#'':N2O1PQ1235A[9\8]^345T#''Ba:b:ifi9jjmww'(CGG4N,O+PPSTWT[T[\bTcSddf  h   LL[\/0D s3w<.c*o->cBCD LL01 LLD1B)CDD LL 99U rc!Z g}|dD]}|jdtj|ddtjt|j dd|j ddtjt|j d d tj|j d xsd dtjd j |j dxsgxsd d g}|dD]s}|dt k}t |dcxkxr tknc}|jdtj|ddtj|dd|d|d ug}|dD] }|j dd|j d}|jdtj|ddtj|dd tj|dtj|j dxsd dtjt|j dd tj|j dxsd dtj|j dxsd dtj|j dxsd dtj|j dxsd dtj|j d xsd dtj|j d!xsd d|j d"dtj|j d#xsd d d$j d%|d&D} d$j d'|d(D} d)j gd*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:tj|d;d|d?d@|dAdB|dCdD dE|dFdG|dHdI|dJdK|dLdM|dNdD dO|dPdQ|dRdS|dTdU|dVdW|dXdY|dZd[tj|d\d]d^tj|d_d]d`dadbd$j |dcdddedbd$j |dcdfdgdbd$j |dcdhdidb| dcdjdk| dldmdnd$S)oNrrTrUzrVz rXzr\rvrr]z rr7r8r6rrx ryrzr{r|rz / rrz / rrrrrc3K|]9}dtj|ddtj|dd;yw)rrTrrUzNhtmlescape)rHrPs rrKzhtml_page..sH  S\233I$++VYZdVeJfIggxys?Arc3NK|]}dtj|dyw)z
  • z
    • Nrrs rrKzhtml_page..s#adDT!2 359as#%rrzzzz zF z9 Save Selector Wrapper Descriptor Contextz zzz3

    Save Selector Wrapper Descriptor Context

    z

    route: rz -> rz ; root rz"; root table pointer rz&; current root entry run rz .

    z

    wrapper entry rz"; wrapper descriptor rz%; wrapper child pointer rz; frontier leaf rz; frontier reader rz&

    wrapper ref before current root: rz#; current root references wrapper: rz); frontier leaf direct current-root ref: rz"; wrapper child is frontier leaf: rz; wrapper entry refs: rz ; wrapper entry promoting refs: rz; promotion status: rz

    z

    rz

    Table Window

    z| z z
    vavalueroot entry?kindchildchild maps
    z

    Wrapper References

    zw z#

    Wrapper Entry References

    z
    refsectionbefore current root?inside current root?
    z#

    Wrapper Descriptor Words

    z:
    refsectionpreviousopcodemodehandlerfallthrough wordfallthrough handlerrolepromotes?note
    z

    Remaining Proofs

    z
      z
    zz)r;rrstrrGrrcrd) r table_bodyrPref_bodyrrrentry_ref_bodyprevious word_body proof_itemss r html_pager^sJ{#   S\234S)<%=>?@776789;;s3776?3456SWW->%?%F3GHI;;tyy1A)B)HbIPSQRS     H}%  W 22#s7|N6NN S_567;;s9~./0((     N)* ggo./q9K1L0MN S_567;;s9~./0X./0SWW-@%A%HSIJK;;s377+?#@ABCDSWW-A%B%IcJKLSWW-F%G%N3OPQ[[)C!D!KLMNSWW-H%I%PSQRR\{{377#BCJsKLM;;sww7>3?@A775678;;swwv5#678   &34I''agN_F`aaK 99&&& & # & Q & D & & f& U& [& D& '& & & & >!&" t{{78#456gdkk'RZJ[>\=]]jkrs|k}j~abijb@aAAghopHhIgJJV W#&$ $G,=$>#??abikAcBbCChipqIiJhKKhipqBiChDDcdkld@cAAM N%&& 19V1W0XX{}DEc}d|eeNOVWyOzN{{]^efB^C]DDZ[bcy[zZ{{[\cdC\D[EEYZ^ZeZefmnf@ZAYBBF G'&(  GL12348)&* "+&, G-&. BGGJ'((89/&0 (1&2 B3&4 BGGH%&&675&6 .7&8 f9&: BGGN+,,<=;&< .=&> E?&@ I;./A&B &C&D  U#E&F G&H I&J K&& &rc|jdd|dz }|jtj|dddzd |9|jjdd|jt |d |S) NT)parentsexist_okz-save_selector_wrapper_descriptor_context.jsonF) ensure_asciiindentrrr)mkdir write_textrdumpsparentr)rout_dirhtml_outjson_outs r write_outputsr s MM$M.HHH  7q9D@dT:Ig.A Orctj}|jdttdz |jdtt dz |jdtt |jdt|j }t|jjt|jg}t||j|j}td |y) Nz--exez Hwanse2.exe)typedefaultz--leaf-streamszsave_selector_leaf_streams.jsonz --out-dirz --html-out)r z$wrote wrapper descriptor context -> )argparseArgumentParser add_argumentrROOTOUT parse_argsrr- read_bytesrrOr rrprint)parserargsrrs rmainrs  $ $ &F dD=4HI (tSCd=de  $<  40    D $##R(GWdllDMMBH 0 ;r*sU" 3tH~--/6678>R H~''* Ul   %  8 -4$`!H@FYxEPXv25d  = zFr
    vavalue