137 lines
4.6 KiB
Python
137 lines
4.6 KiB
Python
#!/usr/bin/env python3
|
|
"""hunt2.py — enumerate ALL soothe2 module instances during offline render.
|
|
|
|
Chunk-correct full-heap scan (rendersnap-style) collecting EVERY ctx candidate
|
|
(vtable 0x1824AC210 or m48 marker), not just the first. Per candidate: sens,
|
|
fir43/fir171 (via ctx+0x540668 ptr), scalar bank snapshot. Goal: find the
|
|
GUI/DSP pair (24c/24j): visible instance holds shallow kernel while audio is
|
|
processed by another instance with the deep one.
|
|
"""
|
|
import hashlib
|
|
import os
|
|
import signal
|
|
import struct
|
|
import subprocess
|
|
import sys
|
|
import time
|
|
|
|
import numpy as np
|
|
|
|
VT = struct.pack('<Q', 0x1824AC210)
|
|
M48 = struct.pack('<I', 0x473b8000)
|
|
|
|
|
|
def find_host():
|
|
import glob
|
|
for p in glob.glob('/proc/[0-9]*'):
|
|
pid = int(os.path.basename(p))
|
|
try:
|
|
cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
|
|
maps = open(f'/proc/{pid}/maps').read()
|
|
except Exception:
|
|
continue
|
|
if 'soothe2' in maps and 'reaper' not in cmd:
|
|
return pid
|
|
return None
|
|
|
|
|
|
def main():
|
|
rpp = sys.argv[1] if len(sys.argv) > 1 else '/tmp/opencode/multi.rpp'
|
|
subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; "
|
|
"rm -rf /run/user/1000/yabridge-soothe2_x64-*; sleep 1", shell=True)
|
|
proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
|
|
'-renderproject', rpp],
|
|
stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
|
|
t0 = time.time()
|
|
host = None
|
|
while time.time() - t0 < 30 and not host:
|
|
host = find_host()
|
|
time.sleep(0.001)
|
|
if not host:
|
|
print('NO HOST')
|
|
return 1
|
|
fd = os.open(f'/proc/{host}/mem', os.O_RDONLY)
|
|
|
|
def rd(a, n):
|
|
try:
|
|
return os.pread(fd, n, a)
|
|
except OSError:
|
|
return None
|
|
|
|
def scan_all():
|
|
found = {}
|
|
for line in open(f'/proc/{host}/maps'):
|
|
parts = line.split()
|
|
if 'rw' not in parts[1]:
|
|
continue
|
|
lo, hi = (int(x, 16) for x in parts[0].split('-'))
|
|
CH = 16 * 1024 * 1024
|
|
a = lo
|
|
while a < hi:
|
|
d = rd(a, min(CH + 4096, hi - a))
|
|
if not d:
|
|
break
|
|
for pat, off in ((VT, 0), (M48, -0x24)):
|
|
j = d.find(pat)
|
|
while j >= 0:
|
|
cand = a + j + off
|
|
if cand not in found:
|
|
sb = rd(cand + 0x540870, 4)
|
|
if sb and struct.unpack('<f', sb)[0] > 100:
|
|
found[cand] = True
|
|
j = d.find(pat, j + 1)
|
|
a += CH
|
|
return list(found)
|
|
|
|
known = {}
|
|
rounds = 0
|
|
while time.time() - t0 < 25:
|
|
rounds += 1
|
|
try:
|
|
os.kill(host, signal.SIGSTOP)
|
|
except ProcessLookupError:
|
|
break
|
|
try:
|
|
cands = scan_all()
|
|
new = [c for c in cands if c not in known]
|
|
for c in new:
|
|
known[c] = rounds
|
|
pb = rd(c + 0x540668, 8)
|
|
m43 = m171 = -1
|
|
if pb:
|
|
p = struct.unpack('<Q', pb)[0]
|
|
if p > 0x10000:
|
|
fb = rd(p, 2049 * 8)
|
|
if fb:
|
|
arr = np.frombuffer(fb[:2049 * 8], dtype='<f4')
|
|
mag = np.hypot(arr[0::2], arr[1::2])
|
|
m43, m171 = float(mag[43]), float(mag[171])
|
|
sb = rd(c + 0x540888, 4)
|
|
s888 = struct.unpack('<f', sb)[0] if sb else -1
|
|
print('NEW ctx %#x @r%d t=%.2f fir43=%.4f fir171=%.4f s888=%.4f'
|
|
% (c, rounds, time.time() - t0, m43, m171, s888), flush=True)
|
|
# status of known ones every round
|
|
for c in known:
|
|
pb = rd(c + 0x540668, 8)
|
|
if pb:
|
|
p = struct.unpack('<Q', pb)[0]
|
|
if p > 0x10000:
|
|
fb = rd(p, 2049 * 8)
|
|
if fb:
|
|
arr = np.frombuffer(fb[:2049 * 8], dtype='<f4')
|
|
mag = np.hypot(arr[0::2], arr[1::2])
|
|
print(' st ctx %#x t=%.2f fir43=%.4f' % (c, time.time() - t0, mag[43]), flush=True)
|
|
finally:
|
|
try:
|
|
os.kill(host, signal.SIGCONT)
|
|
except ProcessLookupError:
|
|
pass
|
|
time.sleep(0.05)
|
|
print('total instances: %d' % len(known))
|
|
proc.kill()
|
|
return 0
|
|
|
|
|
|
if __name__ == '__main__':
|
|
sys.exit(main())
|