vt1200/xie/probe_verify.py

#!/usr/bin/env python3
"""Verified probe: slot 33 / slot 44 against two live resources.

Rules enforced here (each one cost a wrong answer at some point):
  * ONE helper for object fields:  byte(ptr, N) == memory at ptr + N*8
    (ptr is a BIT address; ptr+8 is byte 1, not byte 8).
  * every request reply is read and asserted; connections are not reused
    across requests that can fail.
  * raw bytes of any reply are printed, never interpreted silently.
"""
import struct
import sys
import time

sys.path.insert(0, "/home/arti/code/k-space/vt1200/xie")
sys.path.insert(0, "/home/arti/code/k-space/vt1200/dwt")

import probe23 as P          # noqa: E402
import xie_raw as XR         # noqa: E402
import exploit               # noqa: E402

LOG = "/home/arti/code/k-space/vt1200/debug.log"
MINOR_SET_OP_DEFAULTS = 3
MINOR_CREATE = 8
MINOR_SLOT33 = 33
MINOR_SLOT44 = 44


def stores():
    try:
        with open(LOG) as f:
            return [l.strip() for l in f if l.startswith("REGIDSTORE")]
    except OSError:
        return []


class Dev:
    """Thin wrapper giving the one field-access helper."""

    def __init__(self):
        self.rd = exploit.RDebug("192.168.99.2", 771, 5.0, False)
        self.rd.connect()

    def byte(self, ptr, n):
        return self.rd.peek(ptr + n * 8, 1)[0]

    def u32(self, ptr, n):
        return struct.unpack("<I", self.rd.peek(ptr + n * 8, 4))[0]

    def close(self):
        self.rd.close()


def send(conn, minor, words, payload):
    conn.sock.sendall(struct.pack("<BBH", 0x81, minor, words)
                      + payload.ljust((words - 1) * 4, b"\0"))


def reply(conn, timeout=1.0):
    conn.sock.settimeout(timeout)
    try:
        return XR.read_packet(conn.sock)
    except Exception:
        return None


def describe(r):
    if r is None:
        return "SILENT (accepted, no reply)"
    kind, head, extra = r
    if kind == 0:
        return "ERROR code=%d bad=%#x minor=%d" % (
            head[1], struct.unpack("<I", head[4:8])[0],
            struct.unpack("<H", head[8:10])[0])
    return "REPLY len=%d head=%s extra=%s" % (
        struct.unpack("<I", head[4:8])[0], head.hex(" "),
        (extra or b"").hex(" ") or "(none)")


def snapshot(dev, tag, objs):
    print("   %s" % tag)
    for oid, ptr in objs.items():
        p44 = dev.u32(ptr, 44) if ptr else 0
        elem = dev.u32(p44, 27) if p44 else 0
        print("      id=%08X obj=%08X class=%d byte8=%d byte9=%d p44=%08X "
              "elem(+0xd8)=%08X elem.byte0=%02X"
              % (oid, ptr, dev.byte(ptr, 4), dev.byte(ptr, 8), dev.byte(ptr, 9),
                 p44, elem, dev.byte(elem, 0) if elem else 0))


def trial(tag):
    print("\n=== %s ===" % tag)
    conn = P.Cli()
    P.session(conn)
    a_id = conn.new_id(0x1000)
    b_id = conn.new_id(0x2000)

    send(conn, MINOR_SET_OP_DEFAULTS, 2, struct.pack("<I", 1))
    print("   SET_OP_DEFAULTS(bpp=1) -> %s" % describe(reply(conn)))

    n0 = len(stores())
    for i in (a_id, b_id):
        send(conn, MINOR_CREATE, 12,
             struct.pack("<I", 2)
             + b"".join(struct.pack("<I", v)
                        for v in [i, 64, 64, 0, 0, 2, 0, 0, 0x100, 0]))
        print("   create %08X -> %s" % (i, describe(reply(conn))))
        time.sleep(0.05)

    objs = {}
    for line in stores()[n0:]:
        oid = int(line.split("id=")[1].split()[0], 16)
        ptr = int(line.split("obj=")[1].split()[0], 16)
        objs[oid] = ptr
    print("   registered: %s" % {hex(k): hex(v) for k, v in objs.items()})
    if len(objs) < 2:
        conn.close()
        return None

    dev = Dev()
    snapshot(dev, "before any slot request", objs)

    results = {}
    for name, minor, words, payload in (
            ("slot33 [A,B,0]", MINOR_SLOT33, 4,
             struct.pack("<III", a_id, b_id, 0)),
            ("slot44 [A,B,1,1]", MINOR_SLOT44, 5,
             struct.pack("<IIII", a_id, b_id, 1, 1))):
        n1 = len(stores())
        send(conn, minor, words, payload)
        r = reply(conn)
        time.sleep(0.2)
        new = stores()[n1:]
        print("   %-17s -> %s" % (name, describe(r)))
        print("      new REGIDSTORE: %s" % (new or "(none)"))
        snapshot(dev, "after " + name, objs)
        results[name] = (describe(r), tuple(new))

    dev.close()
    conn.close()
    return results


def main():
    r1 = trial("run 1")
    r2 = trial("run 2")
    print("\n=== reproducibility ===")
    if r1 and r2:
        for k in r1:
            same = r1[k][0] == r2[k][0]
            print("   %-17s run1=%s" % (k, "MATCH" if same else "DIFFERS"))
            if not same:
                print("        run1: %s" % r1[k][0])
                print("        run2: %s" % r2[k][0])
    else:
        print("   a run failed to set up (see above)")


if __name__ == "__main__":
    main()