XFE Git
XFE Studio Git
Git 首页 全局搜索
XFE 主站 文档 NuGet

XFEEDToolBox

【WinUI】XFE精英危险工具箱

公开
关注 0 Fork 0 Star 0
UTF-8
"""Pin the observed D50 Extra dataflow without assigning it a guessed render unit."""
from pathlib import Path
import hashlib,json
import pefile
from capstone import Cs,CS_ARCH_X86,CS_MODE_64

root=Path(__file__).resolve().parents[1]
raw=(root/'artifacts/ship-model-reference/client-copy/EliteDangerous64.exe').read_bytes()
sha=hashlib.sha256(raw).hexdigest()
assert sha=='6891f70a021fa9f3a0e00458c284f48d1226e68ae7fc02ad48081aed47857e93'
pe=pefile.PE(data=raw,fast_load=True);decoder=Cs(CS_ARCH_X86,CS_MODE_64);guards=[]
def instruction(rva,expected):
    item=next(decoder.disasm(pe.get_data(rva,15),rva));actual=item.mnemonic+' '+item.op_str
    assert actual==expected,(hex(rva),actual,expected)
    guards.append(dict(rva=hex(rva),bytes=item.bytes.hex(),instruction=actual))

# Provider48 and provider60 are independent channels; only the latter is the Extra.
instruction(0x3B347D9,'mov rcx, qword ptr [rbx + 0x148]')
instruction(0x3B347E3,'call qword ptr [rax + 0x60]')
instruction(0x3B347E6,'movss dword ptr [rdi + 0x1c], xmm0')
instruction(0x3A15DA6,'mov r12, r9')
instruction(0x3A15F77,'movss xmm0, dword ptr [rsp + 0x7c]')
instruction(0x3A15F84,'maxss xmm0, dword ptr [rbx + 4]')
instruction(0x3A15F89,'movss dword ptr [r12], xmm0')
instruction(0x3A16158,'movups xmmword ptr [rbx + 0x14], xmm0')
instruction(0x3A16161,'movups xmmword ptr [rbx + 0x24], xmm1')
instruction(0x3A16170,'mov eax, dword ptr [r12]')
instruction(0x3A16174,'mov dword ptr [rbx + 0x10], eax')

# The same output pointer writes the ordinary octree record+C, or D50+C.
# This side effect must be traced independently of the 56-byte copied field.
instruction(0x3A66814,'addss xmm0, dword ptr [rbx + 0x10]')
instruction(0x3A66835,'lea r9, [rbx + 0xc]')
instruction(0x3A66841,'movss dword ptr [rbx + 0x10], xmm1')
instruction(0x3A6684E,'call 0x3a15d90')
instruction(0x3A6685D,'movss dword ptr [rbx + 8], xmm0')
instruction(0x3A669B6,'lea r9, [rbx + 0xc]')
instruction(0x3A669C7,'call 0x3a15d90')

# Ordinary GPU-point producer receives the original style at record+14.
# The later 20640 call likewise gets style+14 and the separate record+C alpha.
instruction(0x3A25A4A,'lea r15, [rbx + 0x14]')
instruction(0x3A25A9E,'mov qword ptr [rsp + 0x20], r15')
instruction(0x3A25AC0,'call 0x3a431c0')
instruction(0x3A25C2F,'movss xmm2, dword ptr [rbx + 0xc]')
instruction(0x3A25C5A,'mov qword ptr [rsp + 0x20], r15')
instruction(0x3A25C5F,'call 0x3a20640')

# Main+C8 publishes the same 56-byte buffer to a nearest-point selector.
instruction(0x3A58AB3,'lea r8, [rcx + 0xd20]')
instruction(0x3A58AD1,'imul rcx, qword ptr [r8 + rcx*8 + 8], 0x38')
instruction(0x3B91BC3,'call qword ptr [rax + 0xc8]')
instruction(0x3B91C0A,'comiss xmm8, dword ptr [rsi + 0xc]')
instruction(0x3B91DBF,'add rsi, 0x38')

folder=root/'artifacts/galaxy-query-research/point-overrides/extra-consumer'
sources=[]
for name in ['3b346b0','3a20640','3b91b00','3a58ab0','3a44e80']:
    path=folder/f'solo-{name}.c'
    sources.append(dict(path=str(path.relative_to(root)),sha256=hashlib.sha256(path.read_bytes()).hexdigest()))
result=dict(imageSha256=sha,gameProcessAccess=False,gameCalls=0,guards=guards,sources=sources,
    closed=dict(provider='selected provider virtual60 ->style+1C; separate from provider48 primary size',
        override='max(style+1C,D50+C)',callbackOutput='ordinary octree record+C or remaining D50 record+C',
        copiedOutput='56-byte submitted record+10; original style stays at+14, including its own original Extra at+30',
        ordinaryPoint='3A431C0 receives original style+14; no proved Extra-floor size binding',
        otherPointSubmission='3A20640 receives separate record+C alpha and original style+14',
        publicBuffer='Renderer main+C8 ->3A58AB0 ->same56B range; observed3B91B00 consumer is position/alpha-based selection',
        workerPostpass='3A44E80 erases previous buffer and releases its references, not a sorting/render-size stage'),
    unresolved=dict(extraUnits=None,row10RenderConsumerConfirmed=False,ordinaryCacheRecordCReaderConfirmed=False,
        nextRequired='Follow ordinary cache record+C reads / selected provider60 semantics before applying Extra to any tool channel'),
    productionDecision=dict(primarySizeUnchanged=True,minimumPixelSizeAdded=False,extraAppliedToGpu=False),
    visualFinding=dict(requirement='d50-forced-visible',status='fail',record='work/visual/galaxy-full/original-data-37/d50-visual/known-failure.json',
        notice='CPU VisibleStars1 is not evidence of nonzero stellar RGB pixels; the requirement was not changed'))
output=folder/'flow.json';output.write_text(json.dumps(result,indent=2)+'\n',encoding='utf-8')
print(json.dumps(dict(guards=len(guards),output=str(output),primarySizeUnchanged=True,extraConsumerStillUnknown=True)))