24k: application law EXACT — cutA=1.8345*cutV+0.1615dB (rms 0.0025dB, 8 drive levels); x1.805 = exponent product 0.984x1.8345; single instance confirmed; R-slots static; probe-multitone method

scripts/hunt2.py

@@ -0,0 +1,136 @@
+#!/usr/bin/env python3
+"""hunt2.py — enumerate ALL soothe2 module instances during offline render.
+
+Chunk-correct full-heap scan (rendersnap-style) collecting EVERY ctx candidate
+(vtable 0x1824AC210 or m48 marker), not just the first. Per candidate: sens,
+fir43/fir171 (via ctx+0x540668 ptr), scalar bank snapshot. Goal: find the
+GUI/DSP pair (24c/24j): visible instance holds shallow kernel while audio is
+processed by another instance with the deep one.
+"""
+import hashlib
+import os
+import signal
+import struct
+import subprocess
+import sys
+import time
+
+import numpy as np
+
+VT = struct.pack('<Q', 0x1824AC210)
+M48 = struct.pack('<I', 0x473b8000)
+
+
+def find_host():
+    import glob
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    rpp = sys.argv[1] if len(sys.argv) > 1 else '/tmp/opencode/multi.rpp'
+    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; "
+                   "rm -rf /run/user/1000/yabridge-soothe2_x64-*; sleep 1", shell=True)
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', rpp],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    t0 = time.time()
+    host = None
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        time.sleep(0.001)
+    if not host:
+        print('NO HOST')
+        return 1
+    fd = os.open(f'/proc/{host}/mem', os.O_RDONLY)
+
+    def rd(a, n):
+        try:
+            return os.pread(fd, n, a)
+        except OSError:
+            return None
+
+    def scan_all():
+        found = {}
+        for line in open(f'/proc/{host}/maps'):
+            parts = line.split()
+            if 'rw' not in parts[1]:
+                continue
+            lo, hi = (int(x, 16) for x in parts[0].split('-'))
+            CH = 16 * 1024 * 1024
+            a = lo
+            while a < hi:
+                d = rd(a, min(CH + 4096, hi - a))
+                if not d:
+                    break
+                for pat, off in ((VT, 0), (M48, -0x24)):
+                    j = d.find(pat)
+                    while j >= 0:
+                        cand = a + j + off
+                        if cand not in found:
+                            sb = rd(cand + 0x540870, 4)
+                            if sb and struct.unpack('<f', sb)[0] > 100:
+                                found[cand] = True
+                        j = d.find(pat, j + 1)
+                a += CH
+        return list(found)
+
+    known = {}
+    rounds = 0
+    while time.time() - t0 < 25:
+        rounds += 1
+        try:
+            os.kill(host, signal.SIGSTOP)
+        except ProcessLookupError:
+            break
+        try:
+            cands = scan_all()
+            new = [c for c in cands if c not in known]
+            for c in new:
+                known[c] = rounds
+                pb = rd(c + 0x540668, 8)
+                m43 = m171 = -1
+                if pb:
+                    p = struct.unpack('<Q', pb)[0]
+                    if p > 0x10000:
+                        fb = rd(p, 2049 * 8)
+                        if fb:
+                            arr = np.frombuffer(fb[:2049 * 8], dtype='<f4')
+                            mag = np.hypot(arr[0::2], arr[1::2])
+                            m43, m171 = float(mag[43]), float(mag[171])
+                sb = rd(c + 0x540888, 4)
+                s888 = struct.unpack('<f', sb)[0] if sb else -1
+                print('NEW ctx %#x @r%d t=%.2f fir43=%.4f fir171=%.4f s888=%.4f'
+                      % (c, rounds, time.time() - t0, m43, m171, s888), flush=True)
+            # status of known ones every round
+            for c in known:
+                pb = rd(c + 0x540668, 8)
+                if pb:
+                    p = struct.unpack('<Q', pb)[0]
+                    if p > 0x10000:
+                        fb = rd(p, 2049 * 8)
+                        if fb:
+                            arr = np.frombuffer(fb[:2049 * 8], dtype='<f4')
+                            mag = np.hypot(arr[0::2], arr[1::2])
+                            print('  st ctx %#x t=%.2f fir43=%.4f' % (c, time.time() - t0, mag[43]), flush=True)
+        finally:
+            try:
+                os.kill(host, signal.SIGCONT)
+            except ProcessLookupError:
+                pass
+        time.sleep(0.05)
+    print('total instances: %d' % len(known))
+    proc.kill()
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())