feat(F-NSWINDOW-E5 r7): E4 — security cookie + CPUID/RDTSC/IMUL + import 11 (insns 30→44) - #29
Merged
Merged
Conversation
…+ security-cookie arithmetic
Cross the r6 wall (unbound IAT call @0x5392D4, insns=30) and run deeper into
__scrt_common_main CRT init.
native/i386_cpu.{c,h}: 3 more kernel32 shims — GetStartupInfoW (buffer-write
STARTUPINFOW, cb=0x44), GetSystemInfo (bounded-synthetic SYSTEM_INFO), and
GetProcAddress (→ synthetic in-image stub). IAT now binds 11 slots
(0x538000..0x538028). Synthetic monotonic TSC field + I386_TSC_STEP added.
native/i386_decode.{c,h} + byte-equal .hexa mirror (RUNEQ): new opcodes
IMUL_R_RM (0F AF), IMUL_R_RM_IMM (69 id / 6B ib), CPUID (0F A2), RDTSC (0F 31).
Interpreter: IMUL 32-bit signed (low→dst, CF/OF on int32 overflow); CPUID writes
a synthetic GenuineIntel feature set; RDTSC writes a synthetic monotonic edx:eax.
native/i386_cpu_test.c: hermetic prologue extended with the 3 binds + the
__security_init_cookie shape (load FILETIME entropy → xor → imul → store a
non-default cookie to a global slot) + cpuid + rdtsc. Run A advances insns
30→44, halt 0x5392D4→0x539318 (UNBOUND_IMPORT slot 0x53802C, bound=11,
last=GetProcAddress); cookie/cpuid/rdtsc all asserted. B/D sentinel 0F A2→0F A3
(bt, next decoder gap). __SHIM_TEST__ PASS, clang -Wall -Wextra -Wpedantic clean.
main/WinMain NOT reached — still CRT-init (import binding); the hermetic prologue
is a documented SHAPE, not the real binary, so there is no real `call main` yet.
own1: loading our own kernel32 imports; CPUID/RDTSC are plain CPU ops; the cookie
is our arithmetic over our buffers. No Wine, no protection. validated_manjeom=0.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
E4 r7: import 3개(GetStartupInfoW·GetSystemInfo·GetProcAddress·11총) + CPUID(0F A2)·RDTSC(0F 31)·IMUL(0F AF/69/6B) opcode(C+hexa RUNEQ) + __security_init_cookie 산술 PASS(cookie 비-0). 측정 insns=44 halt@0x539318(unbound slot 0x53802C). own1: 자기 import 바인딩+CPU 명령(보호장치 아님). validated_manjeom 0.⚠️ hermetic prologue=합성 SHAPE(실 binary 부재)·main 미도달.
🤖 Generated with Claude Code
Need help on this PR? Tag
/codesmithwith what you need. Autofix is disabled.