Matiq/soothe2-re
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

24mm12: detector cascade FOUND = vtable stage vt+0x28 = 180529c60 (0x281 bytes, mixes bands@678 + prev track, x0.5, vec6f8 helpers); vtable pipeline map; fn529fe0 only builds kernel from ready tracks

Browse Source
This commit is contained in:
Matiq
2026-08-26 14:53:44 +03:00
parent 60421c32c9
commit 943e781720
3 changed files with 428 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/wine_ptrace_trace.py
+133 -2
View File
@@ -28,6 +28,11 @@ BP_EXP = 0x1803831c0
BP_DF0 = 0x18000b3c0
BP_COPY = 0x1800136e0
BP_DF0RET = 0x18052b898
BP_TRACKSAVE = 0x18052b574
BP_DIV = 0x1803a06a0
BP_DC40 = 0x1800dc40
BP_EXPVAR = 0x1802dc0e0
BP_FN = 0x180529fe0
CTX_SLOTS = {'scr': 0x540628, 'trk': 0x540688, 'cur': 0x540678,
'fir_ptr': 0x540668}
@@ -256,18 +261,40 @@ def main():
# Фаза 3: int3 и запуск
bps = {}
# проверка маппенности по /proc/pid/maps
maps_txt = open(f'/proc/{host}/maps').read()
def mapped(a):
for ln in maps_txt.splitlines():
rng = ln.split()[0]
lo, hi = (int(x, 16) for x in rng.split('-'))
if lo <= a < hi:
return True
return False
for name, addr in (('COPY', BP_COPY), ('EXP', BP_EXP), ('DF0', BP_DF0),
('DF0RET', BP_DF0RET)):
('DF0RET', BP_DF0RET), ('TRACKSAVE', BP_TRACKSAVE),
('DIV', BP_DIV), ('DC40', BP_DC40),
('EXPVAR', BP_EXPVAR), ('FN', BP_FN)):
if not mapped(addr):
print('!! %s@%#x не смапплен — пропуск' % (nm_ := name, addr), flush=True)
continue
orig = peek(host, addr)
poke(host, addr, (orig & ~0xFF) | 0xCC)
bps[addr] = (name, orig & 0xFF)
print('int3 installed:', {hex(a): n for a, (n, _) in bps.items()}, flush=True)
for addr, (nm, _) in bps.items():
rb = peek(host, addr) & 0xFF
if rb != 0xCC:
print('!! %s@%#x НЕ 0xCC: %#02x' % (nm, addr, rb), flush=True)
for tid in attached:
pt(PTRACE_CONT, tid, 0, 0)
samples = []
hits = {'COPY': 0, 'EXP': 0, 'DF0': 0, 'DF0RET': 0}
hits = {'COPY': 0, 'EXP': 0, 'DF0': 0, 'DF0RET': 0, 'TRACKSAVE': 0,
'DIV': 0, 'DC40': 0, 'EXPVAR': 0, 'FN': 0}
track_by_tid = {}
track_dumps = []
t_start = time.time()
def snapshot_slots(rec):
@@ -309,6 +336,70 @@ def main():
pt(PTRACE_CONT, pid, 0, 0)
continue
kind, obyte = info
if kind == 'TRACKSAVE':
# rax = track-ptr текущей полосы, r12 = индекс полосы,
# [rsp+0x138] = база таблицы указателей (arg2 fn529fe0)
tbl = rd_q(regs.rsp + 0x138) if regs.rsp else 0
rec_t = {'kind': 'TRACKSAVE', 'tid': pid, 'band': regs.r12,
'track_ptr': regs.rax, 'tbl': tbl,
't': round(time.time()-t_start, 4)}
if len(track_dumps) < 48:
try:
rec_t['tbl_entries'] = [rd_q(tbl+8*i) for i in range(16)]
rec_t['trk_curve'] = rd_f32(regs.rax, 2049*2)
except OSError as e:
rec_t['err'] = str(e)
track_dumps.append(rec_t)
samples.append(rec_t)
hits['TRACKSAVE'] += 1
poke(pid, site, (peek(pid, site) & ~0xFF) | obyte)
regs.rip = site
setregs(pid, regs)
pt(PTRACE_SINGLESTEP, pid, 0, 0)
os.waitpid(pid, __WALL)
poke(pid, site, (peek(pid, site) & ~0xFF) | 0xCC)
pt(PTRACE_CONT, pid, 0, 0)
continue
if kind == 'FN':
ra = rd_q(regs.rsp)
rec_f = {'kind':'FN','tid':pid,
'rcx':regs.rcx,'rdx':regs.rdx,'r8':regs.r8,'r9':regs.r9,
'ret':ra,'t':round(time.time()-t_start,4)}
samples.append(rec_f); hits['FN'] += 1
if hits['FN'] <= 3:
print('FN: rcx=%#x rdx=%#x r8=%#x r9=%#x ret=%#x'%(
regs.rcx,regs.rdx,regs.r8,regs.r9,ra), flush=True)
poke(pid, site, (peek(pid, site) & ~0xFF) | obyte)
regs.rip = site
setregs(pid, regs)
pt(PTRACE_SINGLESTEP, pid, 0, 0)
os.waitpid(pid, __WALL)
poke(pid, site, (peek(pid, site) & ~0xFF) | 0xCC)
pt(PTRACE_CONT, pid, 0, 0)
continue
if kind in ('DIV','DC40','EXPVAR'):
rec_a = {'kind': kind, 'tid': pid,
't': round(time.time()-t_start, 4),
'rcx': regs.rcx, 'rdx': regs.rdx,
'r8': regs.r8, 'r9': regs.r9}
try:
for nm, p, cnt in (('a', regs.rcx, 2050),
('b', regs.rdx, 2050),
('c', regs.r8, 2050)):
if p > 0x10000:
rec_a[nm] = rd_f32(p, cnt)
except OSError as e:
rec_a['err'] = str(e)
samples.append(rec_a)
hits[kind] += 1
poke(pid, site, (peek(pid, site) & ~0xFF) | obyte)
regs.rip = site
setregs(pid, regs)
pt(PTRACE_SINGLESTEP, pid, 0, 0)
os.waitpid(pid, __WALL)
poke(pid, site, (peek(pid, site) & ~0xFF) | 0xCC)
pt(PTRACE_CONT, pid, 0, 0)
continue
if kind == 'DF0':
track_by_tid[pid] = regs.rdx
if kind == 'DF0RET':
@@ -387,6 +478,46 @@ def main():
flush=True)
if good:
ctx = good
if kind == 'FN':
ra = rd_q(regs.rsp)
rec_f = {'kind':'FN','tid':pid,
'rcx':regs.rcx,'rdx':regs.rdx,'r8':regs.r8,'r9':regs.r9,
'ret':ra,'t':round(time.time()-t_start,4)}
samples.append(rec_f); hits['FN'] += 1
if hits['FN'] <= 3:
print('FN: rcx=%#x rdx=%#x r8=%#x r9=%#x ret=%#x'%(
regs.rcx,regs.rdx,regs.r8,regs.r9,ra), flush=True)
poke(pid, site, (peek(pid, site) & ~0xFF) | obyte)
regs.rip = site
setregs(pid, regs)
pt(PTRACE_SINGLESTEP, pid, 0, 0)
os.waitpid(pid, __WALL)
poke(pid, site, (peek(pid, site) & ~0xFF) | 0xCC)
pt(PTRACE_CONT, pid, 0, 0)
continue
if kind in ('DIV','DC40','EXPVAR'):
rec_a = {'kind': kind, 'tid': pid,
't': round(time.time()-t_start, 4),
'rcx': regs.rcx, 'rdx': regs.rdx,
'r8': regs.r8, 'r9': regs.r9}
try:
for nm, p, cnt in (('a', regs.rcx, 2050),
('b', regs.rdx, 2050),
('c', regs.r8, 2050)):
if p > 0x10000:
rec_a[nm] = rd_f32(p, cnt)
except OSError as e:
rec_a['err'] = str(e)
samples.append(rec_a)
hits[kind] += 1
poke(pid, site, (peek(pid, site) & ~0xFF) | obyte)
regs.rip = site
setregs(pid, regs)
pt(PTRACE_SINGLESTEP, pid, 0, 0)
os.waitpid(pid, __WALL)
poke(pid, site, (peek(pid, site) & ~0xFF) | 0xCC)
pt(PTRACE_CONT, pid, 0, 0)
continue
if kind == 'DF0':
track_by_tid[pid] = regs.rdx
rec = {'kind': kind, 'tid': pid,