fabi/xenia-rs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: track audit-runs summary artifacts (md/csv/diff/txt/json/etc)

Browse Source 
Snapshot of every non-log artifact under audit-runs/ from audits 003
through 058: findings.md per audit, comparison CSVs, probe diffs,
schema docs, register-dump txts, lr-trace JSONL streams, the saved
canary patch diffs, etc. ~284 files / ~52 MB total.

Excluded (per .gitignore): probe stdout/stderr/log streams (the raw
firehose), guest-memory dumps under audit-026/027/029 (4.5 GB of
.bin files; *.bin pattern added to .gitignore this commit).

Also adds the orphan audit-058-sub825070F0-activation directory that
a subagent accidentally created at project-root instead of
under xenia-rs/audit-runs/; relocated to its proper home.

Purpose: cross-machine continuity. With these summaries committed,
a fresh clone gives the next session the full per-audit context
(findings + tables + cascade predictions) without dependence on
local-only working tree.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
MechaCat02
2026-05-10 21:36:41 +02:00
parent 609f586ed8
commit 8e709b0a24
284 changed files with 677656 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
audit-runs/audit-027-v40-mem-diff/anchors.txt Normal file
View File

@@ -0,0 +1,4 @@
# Diff entries within +/-0x100 of named anchor addresses
=== 0x40ba9a80 (audit-016 listener struct (heap)) ===

116
audit-runs/audit-027-v40-mem-diff/cluster_l1_pcs.txt Normal file
View File

@@ -0,0 +1,116 @@
0x822851e0 sub_822851E0
0x82285c78 sub_82285C78
0x82285d58 sub_82285D58
0x82285dd0 sub_82285DD0
0x82285e30 sub_82285E30
0x82285f80 sub_82285F80
0x82286030 sub_82286030
0x82286118 sub_82286118
0x822861f0 sub_822861F0
0x822862d0 sub_822862D0
0x82286438 sub_82286438
0x82286528 sub_82286528
0x82286628 sub_82286628
0x82286798 sub_82286798
0x82286908 sub_82286908
0x82286b40 sub_82286B40
0x82286bc8 sub_82286BC8
0x822873a8 sub_822873A8
0x822878a8 sub_822878A8
0x82287f08 sub_82287F08
0x82288028 sub_82288028
0x82288a18 sub_82288A18
0x82288e70 sub_82288E70
0x82289950 sub_82289950
0x82289c68 sub_82289C68
0x82289dd0 sub_82289DD0
0x82289fd0 sub_82289FD0
0x8228a140 sub_8228A140
0x8228a150 sub_8228A150
0x8228a220 sub_8228A220
0x8228a260 sub_8228A260
0x8228a268 sub_8228A268
0x8228a318 sub_8228A318
0x8228a478 sub_8228A478
0x8228a548 sub_8228A548
0x8228a5b8 sub_8228A5B8
0x8228a628 sub_8228A628
0x8228a650 sub_8228A650
0x8228a700 sub_8228A700
0x8228a7a8 sub_8228A7A8
0x8228a810 sub_8228A810
0x8228a890 sub_8228A890
0x8228a920 sub_8228A920
0x8228aa30 sub_8228AA30
0x8228aac8 sub_8228AAC8
0x8228aed0 sub_8228AED0
0x8228b000 sub_8228B000
0x8228b0a0 sub_8228B0A0
0x8228b188 sub_8228B188
0x8228b208 sub_8228B208
0x8228b2d0 sub_8228B2D0
0x8228b3b0 sub_8228B3B0
0x8228b458 sub_8228B458
0x8228b580 sub_8228B580
0x8228b638 sub_8228B638
0x8228b688 sub_8228B688
0x8228b6e8 sub_8228B6E8
0x8228bb00 sub_8228BB00
0x8228bbc8 sub_8228BBC8
0x8228bc48 sub_8228BC48
0x8228bd18 sub_8228BD18
0x8228bd90 sub_8228BD90
0x8228be08 sub_8228BE08
0x8228bf00 sub_8228BF00
0x8228c0b8 sub_8228C0B8
0x8228c150 sub_8228C150
0x8228c3f0 sub_8228C3F0
0x8228c4a0 sub_8228C4A0
0x8228c678 sub_8228C678
0x8228c7f0 sub_8228C7F0
0x8228c9a8 sub_8228C9A8
0x8228caf8 sub_8228CAF8
0x8228cc18 sub_8228CC18
0x8228cd10 sub_8228CD10
0x8228ce50 sub_8228CE50
0x8228cf50 sub_8228CF50
0x8228d0d0 sub_8228D0D0
0x8228d138 sub_8228D138
0x8228d150 sub_8228D150
0x8228d320 sub_8228D320
0x8228d418 sub_8228D418
0x8228d598 sub_8228D598
0x8228d670 sub_8228D670
0x8228d760 sub_8228D760
0x8228daf8 sub_8228DAF8
0x8228e030 sub_8228E030
0x8228e0a0 sub_8228E0A0
0x8228e138 sub_8228E138
0x8228e208 sub_8228E208
0x8228e498 sub_8228E498
0x8228e4d0 sub_8228E4D0
0x8228e538 sub_8228E538
0x8228e5e8 sub_8228E5E8
0x8228e688 sub_8228E688
0x8228ef60 sub_8228EF60
0x8228f6d0 sub_8228F6D0
0x8228f7c0 sub_8228F7C0
0x8228f808 sub_8228F808
0x8228f858 sub_8228F858
0x8228fbb8 sub_8228FBB8
0x8228fbd0 sub_8228FBD0
0x8228fd48 sub_8228FD48
0x8228fdb8 sub_8228FDB8
0x822900a8 sub_822900A8
0x82290bc8 sub_82290BC8
0x82290c70 sub_82290C70
0x82290d00 sub_82290D00
0x82291410 sub_82291410
0x822917a0 sub_822917A0
0x822919c8 sub_822919C8
0x82292838 sub_82292838
0x82292d80 sub_82292D80
0x82293448 sub_82293448
0x82293ec8 sub_82293EC8
0x82293f30 sub_82293F30
0x82293f80 sub_82293F80

31948
audit-runs/audit-027-v40-mem-diff/diff-b.txt Normal file
View File

File diff suppressed because it is too large Load Diff

538
audit-runs/audit-027-v40-mem-diff/diff.txt Normal file
View File

@@ -0,0 +1,538 @@
# A-list: 536 entries -- canary has 0x82xxxxxx PC, ours differs
# (truncated to first 200000 if larger)
addr=0x400006ec canary=0x82883000 ours=0x00000000
addr=0x40000770 canary=0x8284da50 ours=0x00000000
addr=0x40000774 canary=0x8284da60 ours=0x00000000
addr=0x40000778 canary=0x8284da70 ours=0x00000000
addr=0x4000077c canary=0x825fb958 ours=0x00000000
addr=0x40000780 canary=0x8284c988 ours=0x00000000
addr=0x40000784 canary=0x8284c990 ours=0x00000000
addr=0x40000788 canary=0x8284d9b8 ours=0x00000000
addr=0x4000078c canary=0x8284d9d0 ours=0x00000000
addr=0x40000790 canary=0x8284d9e8 ours=0x00000000
addr=0x40000794 canary=0x8284da00 ours=0x00000000
addr=0x40000798 canary=0x8284d7a8 ours=0x00000000
addr=0x4000079c canary=0x8284ca80 ours=0x00000000
addr=0x400007a0 canary=0x8284cb28 ours=0x00000000
addr=0x400007a4 canary=0x8284cb40 ours=0x00000000
addr=0x400007a8 canary=0x8284cb48 ours=0x00000000
addr=0x400007ac canary=0x8284cb58 ours=0x00000000
addr=0x400007b0 canary=0x8284cb68 ours=0x00000000
addr=0x400007b4 canary=0x8284c9e0 ours=0x00000000
addr=0x400007b8 canary=0x8284c9f0 ours=0x00000000
addr=0x400007bc canary=0x8284cca0 ours=0x00000000
addr=0x400007c0 canary=0x8284ccb0 ours=0x00000000
addr=0x400007c4 canary=0x8284d798 ours=0x00000000
addr=0x400007c8 canary=0x8284d790 ours=0x00000000
addr=0x400007cc canary=0x8284cd00 ours=0x00000000
addr=0x400007d0 canary=0x8284cd20 ours=0x00000000
addr=0x400007d4 canary=0x8284cd40 ours=0x00000000
addr=0x400007d8 canary=0x8284cd48 ours=0x00000000
addr=0x400007dc canary=0x8284cd68 ours=0x00000000
addr=0x400007e0 canary=0x8284cd70 ours=0x00000000
addr=0x400007e4 canary=0x8284cd90 ours=0x00000000
addr=0x400007e8 canary=0x8284cdb0 ours=0x00000000
addr=0x400007ec canary=0x8284cdd0 ours=0x00000000
addr=0x40000d90 canary=0x82882910 ours=0x00000000
addr=0x40000d94 canary=0x82882930 ours=0x00000000
addr=0x40000d98 canary=0x82882950 ours=0x00000000
addr=0x40000d9c canary=0x82882970 ours=0x00000000
addr=0x40000da0 canary=0x82882990 ours=0x00000000
addr=0x40000da4 canary=0x828829b0 ours=0x00000000
addr=0x40000da8 canary=0x828829d0 ours=0x00000000
addr=0x40000dac canary=0x828829f0 ours=0x00000000
addr=0x40000db0 canary=0x82882a10 ours=0x00000000
addr=0x40000db4 canary=0x82882a30 ours=0x00000000
addr=0x40000db8 canary=0x82882a50 ours=0x00000000
addr=0x40000dbc canary=0x82882a70 ours=0x00000000
addr=0x40000dc0 canary=0x82882a90 ours=0x00000000
addr=0x40000dc4 canary=0x82882ab0 ours=0x00000000
addr=0x40000dc8 canary=0x82882ad0 ours=0x00000000
addr=0x40000dcc canary=0x82882af0 ours=0x00000000
addr=0x40000dd0 canary=0x82882b10 ours=0x00000000
addr=0x40000dd4 canary=0x82882b30 ours=0x00000000
addr=0x40000dd8 canary=0x82882b50 ours=0x00000000
addr=0x40000ddc canary=0x82882b70 ours=0x00000000
addr=0x400015a0 canary=0x8284da50 ours=0x00000000
addr=0x400015a4 canary=0x8284da60 ours=0x00000000
addr=0x400015a8 canary=0x8284da70 ours=0x00000000
addr=0x400015ac canary=0x825fb958 ours=0x00000000
addr=0x400015b0 canary=0x8284c988 ours=0x00000000
addr=0x400015b4 canary=0x8284c990 ours=0x00000000
addr=0x400015b8 canary=0x8284d9b8 ours=0x00000000
addr=0x400015bc canary=0x8284d9d0 ours=0x00000000
addr=0x400015c0 canary=0x8284d9e8 ours=0x00000000
addr=0x400015c4 canary=0x8284da00 ours=0x00000000
addr=0x400015c8 canary=0x8284d7a8 ours=0x00000000
addr=0x400015cc canary=0x8284ca80 ours=0x00000000
addr=0x400015d0 canary=0x8284cb28 ours=0x00000000
addr=0x400015d4 canary=0x8284cb40 ours=0x00000000
addr=0x400015d8 canary=0x8284cb48 ours=0x00000000
addr=0x400015dc canary=0x8284cb58 ours=0x00000000
addr=0x400015e0 canary=0x8284cb68 ours=0x00000000
addr=0x400015e4 canary=0x8284c9e0 ours=0x00000000
addr=0x400015e8 canary=0x8284c9f0 ours=0x00000000
addr=0x400015ec canary=0x8284cca0 ours=0x00000000
addr=0x400015f0 canary=0x8284ccb0 ours=0x00000000
addr=0x400015f4 canary=0x8284d798 ours=0x00000000
addr=0x400015f8 canary=0x8284d790 ours=0x00000000
addr=0x400015fc canary=0x8284cd00 ours=0x00000000
addr=0x40001600 canary=0x8284cd20 ours=0x00000000
addr=0x40001604 canary=0x8284cd40 ours=0x00000000
addr=0x40001608 canary=0x8284cd48 ours=0x00000000
addr=0x4000160c canary=0x8284cd68 ours=0x00000000
addr=0x40001610 canary=0x8284cd70 ours=0x00000000
addr=0x40001614 canary=0x8284cd90 ours=0x00000000
addr=0x40001618 canary=0x8284cdb0 ours=0x00000000
addr=0x4000161c canary=0x8284cdd0 ours=0x00000000
addr=0x40001620 canary=0x8284cde0 ours=0x00000000
addr=0x40001624 canary=0x8284ce00 ours=0x00000000
addr=0x40001628 canary=0x8284ce08 ours=0x00000000
addr=0x4000162c canary=0x8284ce28 ours=0x00000000
addr=0x40001630 canary=0x8284ce48 ours=0x00000000
addr=0x40001634 canary=0x8284ce68 ours=0x00000000
addr=0x40001638 canary=0x8284ce88 ours=0x00000000
addr=0x4000163c canary=0x8284ce98 ours=0x00000000
addr=0x40001640 canary=0x8284ceb8 ours=0x00000000
addr=0x40001644 canary=0x8284ced8 ours=0x00000000
addr=0x40001648 canary=0x8284cef8 ours=0x00000000
addr=0x4000164c canary=0x8284cf18 ours=0x00000000
addr=0x40001650 canary=0x8284cf38 ours=0x00000000
addr=0x40001654 canary=0x8284cf58 ours=0x00000000
addr=0x40001658 canary=0x8284cf78 ours=0x00000000
addr=0x4000165c canary=0x8284cf98 ours=0x00000000
addr=0x40001660 canary=0x8284cfb8 ours=0x00000000
addr=0x40001664 canary=0x8284cfd8 ours=0x00000000
addr=0x40001668 canary=0x8284cff8 ours=0x00000000
addr=0x4000166c canary=0x8284d018 ours=0x00000000
addr=0x40001670 canary=0x8284d038 ours=0x00000000
addr=0x40001674 canary=0x8284d058 ours=0x00000000
addr=0x40001678 canary=0x8284d078 ours=0x00000000
addr=0x4000167c canary=0x8284d098 ours=0x00000000
addr=0x40001680 canary=0x8284d0b8 ours=0x00000000
addr=0x40001684 canary=0x8284d0d8 ours=0x00000000
addr=0x40001688 canary=0x8284d0e0 ours=0x00000000
addr=0x4000168c canary=0x8284d100 ours=0x00000000
addr=0x40001690 canary=0x8284d120 ours=0x00000000
addr=0x40001694 canary=0x8284d140 ours=0x00000000
addr=0x40001698 canary=0x8284d160 ours=0x00000000
addr=0x4000169c canary=0x8284d180 ours=0x00000000
addr=0x400016a0 canary=0x8284d1a0 ours=0x00000000
addr=0x400016a4 canary=0x8284d1c0 ours=0x00000000
addr=0x400016a8 canary=0x8284d1e0 ours=0x00000000
addr=0x400016ac canary=0x8284d200 ours=0x00000000
addr=0x400016b0 canary=0x8284d220 ours=0x00000000
addr=0x400016b4 canary=0x8284d240 ours=0x00000000
addr=0x400016b8 canary=0x8284d260 ours=0x00000000
addr=0x400016bc canary=0x8284d280 ours=0x00000000
addr=0x400016c0 canary=0x8284d2a0 ours=0x00000000
addr=0x400016c4 canary=0x8284d2c0 ours=0x00000000
addr=0x400016c8 canary=0x8284d2e0 ours=0x00000000
addr=0x400016cc canary=0x8284d300 ours=0x00000000
addr=0x400016d0 canary=0x8284d320 ours=0x00000000
addr=0x400016d4 canary=0x8284d340 ours=0x00000000
addr=0x400016d8 canary=0x8284d360 ours=0x00000000
addr=0x400016dc canary=0x8284d380 ours=0x00000000
addr=0x400016e0 canary=0x8284d3a0 ours=0x00000000
addr=0x400016e4 canary=0x8284d3c0 ours=0x00000000
addr=0x400016e8 canary=0x8284d3e0 ours=0x00000000
addr=0x400016ec canary=0x8284d400 ours=0x00000000
addr=0x400016f0 canary=0x8284d420 ours=0x00000000
addr=0x400016f4 canary=0x8284d440 ours=0x00000000
addr=0x400016f8 canary=0x8284d460 ours=0x00000000
addr=0x400016fc canary=0x8284d480 ours=0x00000000
addr=0x40001700 canary=0x8284d4a0 ours=0x00000000
addr=0x40001704 canary=0x8284d8c8 ours=0x00000000
addr=0x40001708 canary=0x8284d8d8 ours=0x00000000
addr=0x4000170c canary=0x8284d8f8 ours=0x00000000
addr=0x40001710 canary=0x8284d908 ours=0x00000000
addr=0x40001714 canary=0x8284d920 ours=0x00000000
addr=0x40001718 canary=0x8284d930 ours=0x00000000
addr=0x4000171c canary=0x8284d950 ours=0x00000000
addr=0x40001720 canary=0x8284d960 ours=0x00000000
addr=0x40001724 canary=0x8284d970 ours=0x00000000
addr=0x40001728 canary=0x8284d980 ours=0x00000000
addr=0x4000172c canary=0x8284d990 ours=0x00000000
addr=0x40001730 canary=0x8284d9b0 ours=0x00000000
addr=0x40001734 canary=0x8284ca90 ours=0x00000000
addr=0x40001738 canary=0x8284cb20 ours=0x00000000
addr=0x4000173c canary=0x8284d770 ours=0x00000000
addr=0x40001740 canary=0x8284d860 ours=0x00000000
addr=0x40001744 canary=0x8284d760 ours=0x00000000
addr=0x40001748 canary=0x8284d780 ours=0x00000000
addr=0x4000174c canary=0x8284d870 ours=0x00000000
addr=0x40001750 canary=0x8284d7e8 ours=0x00000000
addr=0x40001754 canary=0x8284ccc0 ours=0x00000000
addr=0x7006fe58 canary=0x822f2304 ours=0x00000000
addr=0x7006fec8 canary=0x824beaac ours=0x00000000
addr=0x700efd38 canary=0x824d6624 ours=0x00000000
addr=0x700efda8 canary=0x824d7b48 ours=0x00000000
addr=0x700efe18 canary=0x824d6844 ours=0x00000000
addr=0x700efe88 canary=0x824d2ad8 ours=0x00000000
addr=0x700efee0 canary=0x828a3244 ours=0x00000000
addr=0x700efee4 canary=0x828a3220 ours=0x00000000
addr=0x701ce138 canary=0x824c0ff8 ours=0x00000000
addr=0x701ce198 canary=0x824c10e4 ours=0x00000000
addr=0x701ce948 canary=0x824cc194 ours=0x00000000
addr=0x701cebcc canary=0x828083c0 ours=0x00000000
addr=0x701cec48 canary=0x825fd818 ours=0x00000000
addr=0x701cec58 canary=0x824cc4b8 ours=0x00000000
addr=0x701cecb8 canary=0x825fd818 ours=0x00000000
addr=0x701cecc8 canary=0x825f6928 ours=0x00000000
addr=0x701ced28 canary=0x825fd818 ours=0x00000000
addr=0x701ced58 canary=0x82153c04 ours=0x00000000
addr=0x701ceda8 canary=0x825f6928 ours=0x00000000
addr=0x701cedb8 canary=0x82150f90 ours=0x00000000
addr=0x701cedcc canary=0x828083c0 ours=0x00000000
addr=0x701cee28 canary=0x8244db30 ours=0x00000000
addr=0x701cee94 canary=0x828e2b20 ours=0x00000000
addr=0x701ceea8 canary=0x821520f8 ours=0x00000000
addr=0x701ceec8 canary=0x82153dcc ours=0x00000000
addr=0x701ceef8 canary=0x82153c04 ours=0x00000000
addr=0x701cef28 canary=0x82153c04 ours=0x00000000
addr=0x701cef68 canary=0x82153c04 ours=0x00000000
addr=0x701cef88 canary=0x82150f90 ours=0x00000000
addr=0x701cef98 canary=0x82169d5c ours=0x00000000
addr=0x701cefc8 canary=0x82150f90 ours=0x00000000
addr=0x701cefec canary=0x828e2af8 ours=0x00000000
addr=0x701ceff8 canary=0x8244db30 ours=0x00000000
addr=0x701cf018 canary=0x82153c04 ours=0x00000000
addr=0x701cf038 canary=0x8244db30 ours=0x00000000
addr=0x701cf068 canary=0x821511b4 ours=0x00000000
addr=0x701cf078 canary=0x821520f8 ours=0x00000000
addr=0x701cf0a4 canary=0x828e2b20 ours=0x00000000
addr=0x701cf0b8 canary=0x821520f8 ours=0x00000000
addr=0x701cf0d8 canary=0x82150774 ours=0x00000000
addr=0x701cf0e8 canary=0x8244db30 ours=0x00000000
addr=0x701cf0f8 canary=0x82150f90 ours=0x00000000
addr=0x701cf138 canary=0x82150f90 ours=0x00000000
addr=0x701cf144 canary=0x828e2af8 ours=0x00000000
addr=0x701cf158 canary=0x82150df8 ours=0x00000000
addr=0x701cf198 canary=0x821509b8 ours=0x00000000
addr=0x701cf1a8 canary=0x82169d5c ours=0x00000000
addr=0x701cf1c4 canary=0x828e2af8 ours=0x00000000
addr=0x701cf1d8 canary=0x82151184 ours=0x00000000
addr=0x701cf1fc canary=0x828e2af8 ours=0x00000000
addr=0x701cf204 canary=0x828f3844 ours=0x00000000
addr=0x701cf234 canary=0x828e2af8 ours=0x00000000
addr=0x701cf248 canary=0x821505a8 ours=0x00000000
addr=0x701cf2bc canary=0x828a327c ours=0x00000000
addr=0x701cf2d8 canary=0x824d441c ours=0x00000000
addr=0x701cf2e4 canary=0x828e0000 ours=0x00000000
addr=0x701cf318 canary=0x827ea56c ours=0x00000000
addr=0x701cf334 canary=0x828e0000 ours=0x00000000
addr=0x701cf344 canary=0x828f3edc ours=0x00000000
addr=0x701cf364 canary=0x82872684 ours=0x00000000
addr=0x701cf368 canary=0x824d1020 ours=0x00000000
addr=0x701cf374 canary=0x82026670 ours=0x00000000
addr=0x701cf388 canary=0x827eb998 ours=0x00000000
addr=0x701cf394 canary=0x828b0000 ours=0x00000000
addr=0x701cf398 canary=0x827e7688 ours=0x00000000
addr=0x701cf3c4 canary=0x828e0000 ours=0x00000000
addr=0x701cf3d8 canary=0x82610b70 ours=0x00000000
addr=0x701cf3e4 canary=0x828f3edc ours=0x00000000
addr=0x701cf408 canary=0x827e822c ours=0x00000000
addr=0x701cf428 canary=0x82452810 ours=0x00000000
addr=0x701cf444 canary=0x82611468 ours=0x00000000
addr=0x701cf448 canary=0x826114a8 ours=0x00000000
addr=0x701cf44c canary=0x828f3dec ours=0x00000000
addr=0x701cf478 canary=0x8260c30c ours=0x00000000
addr=0x701cf488 canary=0x82453018 ours=0x00000000
addr=0x701cf4b8 canary=0x82605edc ours=0x00000000
addr=0x701cf4c8 canary=0x8260c510 ours=0x00000000
addr=0x701cf4cc canary=0x828f39d0 ours=0x00000000
addr=0x701cf4fc canary=0x8260c208 ours=0x00000000
addr=0x701cf524 canary=0x828a6904 ours=0x00000000
addr=0x701cf528 canary=0x82606d28 ours=0x00000000
addr=0x701cf544 canary=0x828f3dd0 ours=0x00000000
addr=0x701cf568 canary=0x82452e78 ours=0x00000000
addr=0x701cf594 canary=0x828f3844 ours=0x00000000
addr=0x701cf5a4 canary=0x828e0000 ours=0x00000000
addr=0x701cf604 canary=0x828f3844 ours=0x00000000
addr=0x701cf614 canary=0x828e0000 ours=0x00000000
addr=0x701cf624 canary=0x828f3edc ours=0x00000000
addr=0x701cf62c canary=0x828f3ef8 ours=0x00000000
addr=0x701cf634 canary=0x828f3efc ours=0x00000000
addr=0x701cf63c canary=0x828f3ec0 ours=0x00000000
addr=0x701cf648 canary=0x821790f4 ours=0x00000000
addr=0x701cf668 canary=0x8216df64 ours=0x00000000
addr=0x701cf69c canary=0x828f3ee0 ours=0x00000000
addr=0x701cf6a4 canary=0x828f3ec0 ours=0x00000000
addr=0x701cf704 canary=0x820a17a8 ours=0x00000000
addr=0x701cf71c canary=0x828f3ec0 ours=0x00000000
addr=0x701cf728 canary=0x82178ee4 ours=0x00000000
addr=0x701cf748 canary=0x8216e83c ours=0x00000000
addr=0x701cf780 canary=0x828f3ec0 ours=0x00000000
addr=0x701cf784 canary=0x820a17a8 ours=0x00000000
addr=0x701cf7a8 canary=0x82173a4c ours=0x00000000
addr=0x701cf7dc canary=0x828e2b14 ours=0x00000000
addr=0x701cf7e4 canary=0x828b0000 ours=0x00000000
addr=0x701cf804 canary=0x828f3844 ours=0x00000000
addr=0x701cf808 canary=0x825ed278 ours=0x00000000
addr=0x701cf868 canary=0x822f1428 ours=0x00000000
addr=0x701cf884 canary=0x828f3844 ours=0x00000000
addr=0x701cf894 canary=0x828e0000 ours=0x00000000
addr=0x701cf89c canary=0x828e2b14 ours=0x00000000
addr=0x701cf8a4 canary=0x828b0000 ours=0x00000000
addr=0x701cf8c8 canary=0x822f1b50 ours=0x00000000
addr=0x701cf8dc canary=0x828e2b14 ours=0x00000000
addr=0x701cf908 canary=0x822f1a80 ours=0x00000000
addr=0x701cf938 canary=0x82173440 ours=0x00000000
addr=0x701cf99c canary=0x828e2b14 ours=0x00000000
addr=0x701cf9a4 canary=0x828b0000 ours=0x00000000
addr=0x701cf9c8 canary=0x8216ee14 ours=0x00000000
addr=0x701cf9cc canary=0x828f3dd0 ours=0x00000000
addr=0x701cf9dc canary=0x828f3dd0 ours=0x00000000
addr=0x701cf9f4 canary=0x828f3dec ours=0x00000000
addr=0x701cfa08 canary=0x8244ddb0 ours=0x00000000
addr=0x701cfa14 canary=0x828f3dc4 ours=0x00000000
addr=0x701cfa6c canary=0x820ad8b8 ours=0x00000000
addr=0x701cfa7c canary=0x828f3dd0 ours=0x00000000
addr=0x701cfa88 canary=0x82153c04 ours=0x00000000
addr=0x701cfaac canary=0x82900000 ours=0x00000000
addr=0x701cfb4c canary=0x828708c4 ours=0x00000000
addr=0x701cfb58 canary=0x825ed238 ours=0x00000000
addr=0x701cfb5c canary=0x828f2c20 ours=0x00000000
addr=0x701cfb78 canary=0x825f5bd4 ours=0x00000000
addr=0x701cfb84 canary=0x828f310c ours=0x00000000
addr=0x701cfba4 canary=0x828f48d4 ours=0x00000000
addr=0x701cfbac canary=0x828f3ec0 ours=0x00000000
addr=0x701cfbb0 canary=0x8284d970 ours=0x00000000
addr=0x701cfbb8 canary=0x828f39d0 ours=0x00000000
addr=0x701cfbcc canary=0x828708c4 ours=0x00000000
addr=0x701cfbd8 canary=0x825ed238 ours=0x00000000
addr=0x701cfc1c canary=0x828708c4 ours=0x00000000
addr=0x701cfc24 canary=0x828708bc ours=0x00000000
addr=0x701cfc28 canary=0x825ed278 ours=0x00000000
addr=0x701cfc2c canary=0x828f4aa8 ours=0x00000000
addr=0x701cfc30 canary=0x8284d9b0 ours=0x00000000
addr=0x701cfc34 canary=0x828f310c ours=0x00000000
addr=0x701cfc7c canary=0x828708c4 ours=0x00000000
addr=0x701cfc84 canary=0x828708c0 ours=0x00000000
addr=0x701cfc88 canary=0x825ed278 ours=0x00000000
addr=0x701cfc94 canary=0x828f2fc8 ours=0x00000000
addr=0x701cfca4 canary=0x828f326c ours=0x00000000
addr=0x701cfcc4 canary=0x824c8f00 ours=0x00000000
addr=0x701cfcdc canary=0x828708c4 ours=0x00000000
addr=0x701cfce4 canary=0x828708b4 ours=0x00000000
addr=0x701cfce8 canary=0x824acbf0 ours=0x00000000
addr=0x701cfcf8 canary=0x824abc40 ours=0x00000000
addr=0x701cfd58 canary=0x824ab8e0 ours=0x00000000
addr=0x7026f728 canary=0x825fd818 ours=0x00000000
addr=0x7026f7a8 canary=0x825f6928 ours=0x00000000
addr=0x7026fcac canary=0x82870918 ours=0x00000000
addr=0x7026fcbc canary=0x82000988 ours=0x00000000
addr=0x7026fcd4 canary=0x828a28f0 ours=0x00000000
addr=0x7026fcd8 canary=0x825ed33c ours=0x00000000
addr=0x7026fd64 canary=0x828a28f0 ours=0x00000000
addr=0x7026fe50 canary=0x824a9178 ours=0x00000000
addr=0x702afa58 canary=0x82153c04 ours=0x00000000
addr=0x702afab8 canary=0x82150f90 ours=0x00000000
addr=0x702afb28 canary=0x8244db30 ours=0x00000000
addr=0x702afb68 canary=0x821511b4 ours=0x00000000
addr=0x702afb94 canary=0x828e2b20 ours=0x00000000
addr=0x702afba8 canary=0x821520f8 ours=0x00000000
addr=0x702afbb4 canary=0x828f3d34 ours=0x00000000
addr=0x702afbd8 canary=0x82150774 ours=0x00000000
addr=0x702afc28 canary=0x82150f90 ours=0x00000000
addr=0x702afc44 canary=0x828e2af8 ours=0x00000000
addr=0x702afc58 canary=0x82150df8 ours=0x00000000
addr=0x702afc88 canary=0x821508f0 ours=0x00000000
addr=0x702afc98 canary=0x82169d5c ours=0x00000000
addr=0x702afcc4 canary=0x828e2af8 ours=0x00000000
addr=0x702afcd8 canary=0x821514e4 ours=0x00000000
addr=0x702afcec canary=0x828e2af8 ours=0x00000000
addr=0x702afcf8 canary=0x82150428 ours=0x00000000
addr=0x702afd1c canary=0x828f3d58 ours=0x00000000
addr=0x702afd34 canary=0x828e2af8 ours=0x00000000
addr=0x702afd48 canary=0x821505a8 ours=0x00000000
addr=0x702afd9c canary=0x828f3d58 ours=0x00000000
addr=0x702afdac canary=0x828f3d08 ours=0x00000000
addr=0x702afdbc canary=0x828f3d08 ours=0x00000000
addr=0x702afdc4 canary=0x828f3d34 ours=0x00000000
addr=0x702afdcc canary=0x82181830 ours=0x00000000
addr=0x702afdd8 canary=0x824aa074 ours=0x00000000
addr=0x702afe1c canary=0x828f3d08 ours=0x00000000
addr=0x702afe24 canary=0x828f3d34 ours=0x00000000
addr=0x702afe2c canary=0x82181830 ours=0x00000000
addr=0x702afe38 canary=0x82181988 ours=0x00000000
addr=0x702afe48 canary=0x824accd8 ours=0x00000000
addr=0x702afeb4 canary=0x828f3d08 ours=0x00000000
addr=0x702afebc canary=0x82181830 ours=0x00000000
addr=0x702afec8 canary=0x824affc4 ours=0x00000000
addr=0x702df788 canary=0x82153c04 ours=0x00000000
addr=0x702df7c8 canary=0x821511b4 ours=0x00000000
addr=0x702df7dc canary=0x828f4880 ours=0x00000000
addr=0x702df7e8 canary=0x82153c1c ours=0x00000000
addr=0x702df838 canary=0x82150774 ours=0x00000000
addr=0x702df868 canary=0x821511b4 ours=0x00000000
addr=0x702df8b8 canary=0x8245c930 ours=0x00000000
addr=0x702df8c4 canary=0x828f4868 ours=0x00000000
addr=0x702df8d8 canary=0x82150774 ours=0x00000000
addr=0x702df8f8 canary=0x82153bec ours=0x00000000
addr=0x702df918 canary=0x822a8710 ours=0x00000000
addr=0x702df93c canary=0x828f4838 ours=0x00000000
addr=0x702df958 canary=0x82335094 ours=0x00000000
addr=0x702df968 canary=0x82153c64 ours=0x00000000
addr=0x702df984 canary=0x828f4874 ours=0x00000000
addr=0x702df9bc canary=0x828f4880 ours=0x00000000
addr=0x702df9c4 canary=0x828f4880 ours=0x00000000
addr=0x702df9c8 canary=0x8245bd38 ours=0x00000000
addr=0x702df9d8 canary=0x82150f90 ours=0x00000000
addr=0x702df9e4 canary=0x828f4868 ours=0x00000000
addr=0x702dfa04 canary=0x828f4874 ours=0x00000000
addr=0x702dfa0c canary=0x828f4854 ours=0x00000000
addr=0x702dfa1c canary=0x828f4838 ours=0x00000000
addr=0x702dfa3c canary=0x828f3dc4 ours=0x00000000
addr=0x702dfa48 canary=0x82456eac ours=0x00000000
addr=0x702dfa64 canary=0x828f4880 ours=0x00000000
addr=0x702dfa68 canary=0x8231ad58 ours=0x00000000
addr=0x702dfa88 canary=0x8215079c ours=0x00000000
addr=0x702dfa98 canary=0x82445a00 ours=0x00000000
addr=0x702dfaac canary=0x828f3dc4 ours=0x00000000
addr=0x702dfac8 canary=0x82456da4 ours=0x00000000
addr=0x702dfadc canary=0x828f4838 ours=0x00000000
addr=0x702dfafc canary=0x828f4880 ours=0x00000000
addr=0x702dfb08 canary=0x82459cbc ours=0x00000000
addr=0x702dfb18 canary=0x82459a3c ours=0x00000000
addr=0x702dfb24 canary=0x828f4880 ours=0x00000000
addr=0x702dfb3c canary=0x828f3da8 ours=0x00000000
addr=0x702dfb48 canary=0x8245495c ours=0x00000000
addr=0x702dfb5c canary=0x828f4838 ours=0x00000000
addr=0x702dfb70 canary=0x828f4880 ours=0x00000000
addr=0x702dfb78 canary=0x828f4880 ours=0x00000000
addr=0x702dfb80 canary=0x828f4880 ours=0x00000000
addr=0x702dfb9c canary=0x828f4838 ours=0x00000000
addr=0x702dfba4 canary=0x828f3da8 ours=0x00000000
addr=0x702dfbbc canary=0x8245a5d0 ours=0x00000000
addr=0x702dfbc8 canary=0x8245a660 ours=0x00000000
addr=0x702dfc2c canary=0x828f4838 ours=0x00000000
addr=0x702dfe48 canary=0x824accd8 ours=0x00000000
addr=0x702dfeb4 canary=0x828f4838 ours=0x00000000
addr=0x702dfebc canary=0x8245a5d0 ours=0x00000000
addr=0x702dfec8 canary=0x824affc4 ours=0x00000000
addr=0x7033f6b8 canary=0x82153c04 ours=0x00000000
addr=0x7033f718 canary=0x82150f90 ours=0x00000000
addr=0x7033f758 canary=0x82153c04 ours=0x00000000
addr=0x7033f788 canary=0x82360070 ours=0x00000000
addr=0x7033f7b8 canary=0x82150f90 ours=0x00000000
addr=0x7033f7f4 canary=0x828f3dc4 ours=0x00000000
addr=0x7033f808 canary=0x8244ddb0 ours=0x00000000
addr=0x7033f818 canary=0x82153c04 ours=0x00000000
addr=0x7033f828 canary=0x82360070 ours=0x00000000
addr=0x7033f858 canary=0x821511b4 ours=0x00000000
addr=0x7033f888 canary=0x821511b4 ours=0x00000000
addr=0x7033f898 canary=0x82153c04 ours=0x00000000
addr=0x7033f8c8 canary=0x82150774 ours=0x00000000
addr=0x7033f8f8 canary=0x82150774 ours=0x00000000
addr=0x7033f908 canary=0x82360070 ours=0x00000000
addr=0x7033f938 canary=0x821511b4 ours=0x00000000
addr=0x7033f968 canary=0x821511b4 ours=0x00000000
addr=0x7033f978 canary=0x82335094 ours=0x00000000
addr=0x7033f988 canary=0x8235fe0c ours=0x00000000
addr=0x7033f98c canary=0x828f3dc4 ours=0x00000000
addr=0x7033f9a8 canary=0x82150774 ours=0x00000000
addr=0x7033f9d8 canary=0x82150774 ours=0x00000000
addr=0x7033f9ec canary=0x828f3da8 ours=0x00000000
addr=0x7033f9f4 canary=0x828f3ba0 ours=0x00000000
addr=0x7033fa04 canary=0x828f3b84 ours=0x00000000
addr=0x7033fa24 canary=0x828f3ba0 ours=0x00000000
addr=0x7033fa34 canary=0x828f3b84 ours=0x00000000
addr=0x7033fa3c canary=0x828f3b68 ours=0x00000000
addr=0x7033fa58 canary=0x82335094 ours=0x00000000
addr=0x7033fa5c canary=0x828f3dc4 ours=0x00000000
addr=0x7033fa68 canary=0x82456eac ours=0x00000000
addr=0x7033fa78 canary=0x821511b4 ours=0x00000000
addr=0x7033fa7c canary=0x828f3bf0 ours=0x00000000
addr=0x7033fa98 canary=0x82151574 ours=0x00000000
addr=0x7033fa9c canary=0x828f3dc4 ours=0x00000000
addr=0x7033fab8 canary=0x82456da4 ours=0x00000000
addr=0x7033facc canary=0x828f3dc4 ours=0x00000000
addr=0x7033fae8 canary=0x82456da4 ours=0x00000000
addr=0x7033fb04 canary=0x828f3ba0 ours=0x00000000
addr=0x7033fb14 canary=0x828f3b84 ours=0x00000000
addr=0x7033fb1c canary=0x828f3b68 ours=0x00000000
addr=0x7033fb24 canary=0x828f3b68 ours=0x00000000
addr=0x7033fb3c canary=0x828f3dc4 ours=0x00000000
addr=0x7033fb48 canary=0x82456eac ours=0x00000000
addr=0x7033fb4c canary=0x828f3bf0 ours=0x00000000
addr=0x7033fb54 canary=0x828f3b68 ours=0x00000000
addr=0x7033fb5c canary=0x828f3bf0 ours=0x00000000
addr=0x7033fb78 canary=0x821512a4 ours=0x00000000
addr=0x7033fb88 canary=0x8280ab30 ours=0x00000000
addr=0x7033fb98 canary=0x82150774 ours=0x00000000
addr=0x7033fb9c canary=0x828f39d0 ours=0x00000000
addr=0x7033fbac canary=0x828f3dc4 ours=0x00000000
addr=0x7033fbbc canary=0x828f3bf0 ours=0x00000000
addr=0x7033fbd8 canary=0x821511e4 ours=0x00000000
addr=0x7033fbe8 canary=0x82150774 ours=0x00000000
addr=0x7033fbfc canary=0x828f39d0 ours=0x00000000
addr=0x7033fc04 canary=0x828f3dd0 ours=0x00000000
addr=0x7033fc18 canary=0x824549e0 ours=0x00000000
addr=0x7033fc2c canary=0x828f3bf0 ours=0x00000000
addr=0x7033fc48 canary=0x82150774 ours=0x00000000
addr=0x7033fc68 canary=0x82458448 ours=0x00000000
addr=0x7033fc74 canary=0x828f3dd0 ours=0x00000000
addr=0x7033fc98 canary=0x82451694 ours=0x00000000
addr=0x7033fca4 canary=0x828f3da8 ours=0x00000000
addr=0x7033fcac canary=0x828f3bf0 ours=0x00000000
addr=0x7033fcc8 canary=0x8244fdfc ours=0x00000000
addr=0x7033fcd8 canary=0x82452810 ours=0x00000000
addr=0x7033fd0c canary=0x828f3b68 ours=0x00000000
addr=0x7033fd14 canary=0x828f3b68 ours=0x00000000
addr=0x7033fd1c canary=0x828f3bf0 ours=0x00000000
addr=0x7033fd38 canary=0x82450ecc ours=0x00000000
addr=0x7033fd94 canary=0x828f3ba0 ours=0x00000000
addr=0x7033fde4 canary=0x828f3b68 ours=0x00000000
addr=0x7033fde8 canary=0x82450b48 ours=0x00000000
addr=0x7033fe54 canary=0x828f3b68 ours=0x00000000
addr=0x7033fe5c canary=0x82450a28 ours=0x00000000
addr=0x7033fe64 canary=0x828f3b68 ours=0x00000000
addr=0x7033fe68 canary=0x82450a50 ours=0x00000000
addr=0x7033feb4 canary=0x828f3b68 ours=0x00000000
addr=0x7033febc canary=0x82450a28 ours=0x00000000
addr=0x7033fec8 canary=0x824affc4 ours=0x00000000
addr=0x7036f9a8 canary=0x821511b4 ours=0x00000000
addr=0x7036fa18 canary=0x82150774 ours=0x00000000
addr=0x7036fa98 canary=0x82335094 ours=0x00000000
addr=0x7036fb7c canary=0x828f3dc4 ours=0x00000000
addr=0x7036fb88 canary=0x82456eac ours=0x00000000
addr=0x7036fb8c canary=0x82066260 ours=0x00000000
addr=0x7036fbbc canary=0x828998d8 ours=0x00000000
addr=0x7036fbec canary=0x828f3dc4 ours=0x00000000
addr=0x7036fc08 canary=0x82456da4 ours=0x00000000
addr=0x7036fc7c canary=0x828f3da8 ours=0x00000000
addr=0x7036fc88 canary=0x8245495c ours=0x00000000
addr=0x7036fce4 canary=0x828f3da8 ours=0x00000000
addr=0x7036fd08 canary=0x82458728 ours=0x00000000
addr=0x7036fd8c canary=0x828f3b08 ours=0x00000000
addr=0x7036fda4 canary=0x828f3b24 ours=0x00000000
addr=0x7036fdac canary=0x828f3b24 ours=0x00000000
addr=0x7036fdb8 canary=0x82458d68 ours=0x00000000
addr=0x7036fe14 canary=0x828f3b08 ours=0x00000000
addr=0x7036fe18 canary=0x828f3b24 ours=0x00000000
addr=0x7036fe54 canary=0x828f3b08 ours=0x00000000
addr=0x7036fe5c canary=0x82457ef0 ours=0x00000000
addr=0x7036fe64 canary=0x828f3b08 ours=0x00000000
addr=0x7036fe68 canary=0x82457f18 ours=0x00000000
addr=0x7036feb4 canary=0x828f3b08 ours=0x00000000
addr=0x7036febc canary=0x82457ef0 ours=0x00000000
addr=0x7036fec8 canary=0x824affc4 ours=0x00000000
addr=0x7043fde8 canary=0x822f1fa4 ours=0x00000000
addr=0x7043fe48 canary=0x824accd8 ours=0x00000000
addr=0x7043fe5c canary=0x822f1ee0 ours=0x00000000
addr=0x7043fe68 canary=0x822f1f08 ours=0x00000000
addr=0x7043febc canary=0x822f1ee0 ours=0x00000000
addr=0x7043fec8 canary=0x824affc4 ours=0x00000000
addr=0x704dfe38 canary=0x824d2320 ours=0x00000000
addr=0x704dfe44 canary=0x828a326c ours=0x00000000
addr=0x704dfe48 canary=0x824d2188 ours=0x00000000
addr=0x704dfea4 canary=0x828a3230 ours=0x00000000
addr=0x704dfeac canary=0x828a3244 ours=0x00000000
addr=0x704dfeb4 canary=0x828a3254 ours=0x00000000
addr=0x704dfebc canary=0x828a0000 ours=0x00000000
addr=0x704dfec8 canary=0x824d291c ours=0x00000000
addr=0x7057fe48 canary=0x824d22d8 ours=0x00000000
addr=0x7057fecc canary=0x828a3230 ours=0x00000000
addr=0x7057fed4 canary=0x828a0000 ours=0x00000000
addr=0x7057fed8 canary=0x824d29a8 ours=0x00000000

179
audit-runs/audit-027-v40-mem-diff/diff_v40.py Normal file
View File

@@ -0,0 +1,179 @@
#!/usr/bin/env python3
"""Comprehensive dword-level diff of canary's v40 vs ours.
For every 4-byte BE-aligned dword in [0x40000000, 0x7F000000):
- canary_dw = canary[i*4..i*4+4] interpreted as BE u32
- ours_dw = ours [i*4..i*4+4] interpreted as BE u32
Records:
CASE A (primary): canary_dw in 0x82000000..0x82A00000 (game-code addr) AND ours_dw != canary_dw
CASE B (inverse): ours_dw in 0x82000000..0x82A00000 AND canary_dw != ours_dw
Produces:
diff.txt full sorted A-list (truncated for very large outputs)
diff-b.txt inverse B-list
histogram.txt bucket count by canary PC's 0x1000-aligned function
l1-hits.txt specific renderer cluster L1 PC hits (from cluster_l1_pcs.txt)
tables.txt runs of >=4 consecutive dwords with canary-PC where ours differs
anchors.txt diff entries within +/-0x100 of named anchor addresses (e.g. 0x40BA9A80)
pages.txt which 64K pages contain divergences and how many
"""
import struct
import sys
import os
from collections import defaultdict
V40_BASE = 0x40000000
V40_LEN = 0x3F000000
PC_LO = 0x82000000
PC_HI = 0x82A00000
NAMED_ANCHORS = {
0x40BA9A80: "audit-016 listener struct (heap)",
}
def main():
here = os.path.dirname(os.path.abspath(__file__))
canary_path = os.path.join(here, "canary-v40.bin")
ours_path = os.path.join(here, "ours-v40.bin")
# Load cluster L1 PCs (full set)
cluster_pcs = {}
cl1_path = os.path.join(here, "cluster_l1_pcs.txt")
if os.path.exists(cl1_path):
with open(cl1_path) as f:
for ln in f:
ln = ln.strip()
if not ln: continue
parts = ln.split()
addr = int(parts[0], 16)
name = parts[1] if len(parts) > 1 else f"sub_{addr:08X}"
cluster_pcs[addr] = name
# Hand-curated narrow set (for emphasis if cluster_pcs is empty)
NARROW = {
0x822919C8: "sub_822919C8",
0x82293448: "sub_82293448",
0x82288028: "sub_82288028",
0x82292D80: "sub_82292d80",
0x822851E0: "sub_822851e0",
0x82286BC8: "sub_82286bc8",
}
canary = open(canary_path, "rb").read()
ours = open(ours_path, "rb").read()
assert len(canary) == V40_LEN, len(canary)
assert len(ours) == V40_LEN, len(ours)
a_list = [] # canary has PC, ours different
b_list = [] # ours has PC, canary different
page_size = 65536
page_a_count = defaultdict(int)
for i in range(0, V40_LEN, 4):
cdw = struct.unpack_from(">I", canary, i)[0]
odw = struct.unpack_from(">I", ours, i)[0]
if cdw == odw:
continue
addr = V40_BASE + i
if PC_LO <= cdw < PC_HI:
a_list.append((addr, cdw, odw))
page_a_count[addr & ~(page_size - 1)] += 1
if PC_LO <= odw < PC_HI:
b_list.append((addr, cdw, odw))
print(f"[i] case A divergences (canary has PC, ours differs): {len(a_list)}")
print(f"[i] case B divergences (ours has PC, canary differs): {len(b_list)}")
LIMIT = 200000 # cap diff.txt
with open(os.path.join(here, "diff.txt"), "w") as f:
f.write(f"# A-list: {len(a_list)} entries -- canary has 0x82xxxxxx PC, ours differs\n")
f.write(f"# (truncated to first {LIMIT} if larger)\n")
for addr, c, o in a_list[:LIMIT]:
f.write(f"addr={addr:#010x} canary={c:#010x} ours={o:#010x}\n")
with open(os.path.join(here, "diff-b.txt"), "w") as f:
f.write(f"# B-list: {len(b_list)} entries -- ours has 0x82xxxxxx PC, canary differs\n")
for addr, c, o in b_list[:LIMIT]:
f.write(f"addr={addr:#010x} canary={c:#010x} ours={o:#010x}\n")
# Histogram by canary PC value (0x1000-aligned)
bucket = defaultdict(int)
for _addr, c, _o in a_list:
bucket[c & ~0xFFF] += 1
sorted_b = sorted(bucket.items(), key=lambda x: -x[1])
with open(os.path.join(here, "histogram.txt"), "w") as f:
f.write("# canary PC value bucket (0x1000-aligned) -> count of A-list entries\n")
for k, v in sorted_b:
f.write(f"{k:#010x} {v}\n")
print(f"[i] top 20 PC buckets (canary value):")
for k, v in sorted_b[:20]:
print(f" {k:#010x} {v}")
# L1 PC hits (full 116 + narrow)
l1_hits = []
narrow_hits = []
for addr, c, o in a_list:
if c in cluster_pcs:
l1_hits.append((addr, c, o, cluster_pcs[c]))
if c in NARROW:
narrow_hits.append((addr, c, o, NARROW[c]))
with open(os.path.join(here, "l1-hits.txt"), "w") as f:
f.write(f"# Renderer cluster L1 PC hits in canary's v40 (broad set, count={len(l1_hits)})\n")
for addr, c, o, name in l1_hits:
f.write(f"addr={addr:#010x} canary={c:#010x} ours={o:#010x} // {name}\n")
f.write(f"\n# Narrow hand-picked subset (count={len(narrow_hits)})\n")
for addr, c, o, name in narrow_hits:
f.write(f"addr={addr:#010x} canary={c:#010x} ours={o:#010x} // {name}\n")
print(f"[i] L1 PC hits (broad 116-fn cluster): {len(l1_hits)}")
print(f"[i] L1 PC hits (narrow 6-fn picks): {len(narrow_hits)}")
for addr, c, o, name in l1_hits[:30]:
print(f" addr={addr:#010x} canary={c:#010x} // {name}")
# Table detection: runs of 4+ consecutive 4-byte dwords where canary
# has any 0x82xxxxxx and ours differs.
runs = []
a_sorted = sorted(a_list, key=lambda x: x[0])
j = 0
while j < len(a_sorted):
start = j
while j + 1 < len(a_sorted) and a_sorted[j+1][0] == a_sorted[j][0] + 4:
j += 1
if j - start + 1 >= 4:
entries = a_sorted[start:j+1]
zero_count = sum(1 for _a, _c, o in entries if o == 0)
runs.append((entries[0][0], len(entries), zero_count, entries))
j += 1
runs.sort(key=lambda r: -r[1])
with open(os.path.join(here, "tables.txt"), "w") as f:
f.write(f"# Consecutive A-list runs (>=4 dwords): {len(runs)} runs\n\n")
for base, length, zeros, entries in runs[:120]:
f.write(f"=== run base={base:#010x} length={length} zeros_in_ours={zeros} ===\n")
for addr, c, o in entries[:64]:
f.write(f" +{addr-base:#06x}: canary={c:#010x} ours={o:#010x}\n")
if length > 64:
f.write(f" ... and {length-64} more\n")
f.write("\n")
print(f"[i] table-shaped runs (>=4 consecutive A-list dwords): {len(runs)}")
for base, length, zeros, _ in runs[:12]:
print(f" base={base:#010x} length={length} zeros={zeros}")
# Pages with divergences
page_sorted = sorted(page_a_count.items(), key=lambda x: -x[1])
with open(os.path.join(here, "pages.txt"), "w") as f:
f.write(f"# 64K pages with A-list divergences (count={len(page_sorted)})\n")
for pg, cnt in page_sorted:
f.write(f"page={pg:#010x} count={cnt}\n")
print(f"[i] pages with divergences: {len(page_sorted)}")
for pg, cnt in page_sorted[:10]:
print(f" page={pg:#010x} divergent_dwords={cnt}")
# Anchor neighborhood
with open(os.path.join(here, "anchors.txt"), "w") as f:
f.write("# Diff entries within +/-0x100 of named anchor addresses\n\n")
for anchor, name in NAMED_ANCHORS.items():
f.write(f"=== {anchor:#010x} ({name}) ===\n")
for addr, c, o in a_list:
if abs(addr - anchor) <= 0x100:
f.write(f" addr={addr:#010x} canary={c:#010x} ours={o:#010x}\n")
f.write("\n")
if __name__ == "__main__":
main()

56
audit-runs/audit-027-v40-mem-diff/extract_v40.py Normal file
View File

@@ -0,0 +1,56 @@
#!/usr/bin/env python3
"""Extract canary's v40000000 1008MB span as a flat binary mirroring our format.
Reads the canary Memory::Save dump at audit-runs/audit-024a-canary-diff/canary-memory.dump,
walks heaps in order (v00 v40 v80 v90 physical), and for v40 writes each committed
65536-byte page to its file offset (page_idx * 65536). Uncommitted pages stay zero.
v40000000 layout (canary memory.cc:222-242):
base 0x40000000, size 0x3F000000 (1008 MiB), page_size 65536
page_count = 0x3F000000 / 65536 = 16128 pages
"""
import struct
import sys
import os
HEAPS = [
("v00000000", 0x00000000, 0x40000000, 4096),
("v40000000", 0x40000000, 0x3F000000, 65536),
("v80000000", 0x80000000, 0x10000000, 65536),
("v90000000", 0x90000000, 0x10000000, 4096),
("physical", 0x00000000, 0x20000000, 4096),
]
K_COMMIT = 0x2
def main():
src = sys.argv[1] if len(sys.argv) > 1 else \
"/home/fabi/RE Project Sylpheed/xenia-rs/audit-runs/audit-024a-canary-diff/canary-memory.dump"
out = sys.argv[2] if len(sys.argv) > 2 else \
os.path.join(os.path.dirname(__file__), "canary-v40.bin")
with open(src, "rb") as f:
data = f.read()
print(f"[i] dump size: {len(data)} bytes ({len(data)/1024/1024:.1f} MiB)")
cursor = 0
out_buf = None
for name, base, size, page_size in HEAPS:
page_count = size // page_size
committed = 0
if name == "v40000000":
out_buf = bytearray(size)
for i in range(page_count):
qword = struct.unpack_from("<Q", data, cursor)[0]
cursor += 8
state = (qword >> 60) & 0x3
if state != 0 and (state & K_COMMIT):
if name == "v40000000":
out_buf[i*page_size:(i+1)*page_size] = data[cursor:cursor+page_size]
cursor += page_size
committed += 1
print(f"[i] {name}: pages={page_count} committed={committed}")
print(f"[i] total parsed: {cursor:#x} (file size: {len(data):#x})")
with open(out, "wb") as f:
f.write(out_buf)
print(f"[i] wrote {len(out_buf)} bytes to {out}")
if __name__ == "__main__":
main()

88
audit-runs/audit-027-v40-mem-diff/histogram.txt Normal file
View File

@@ -0,0 +1,88 @@
# canary PC value bucket (0x1000-aligned) -> count of A-list entries
0x828f3000 90
0x8284d000 78
0x8284c000 64
0x82150000 30
0x828f4000 23
0x82882000 20
0x82153000 16
0x828e2000 16
0x82151000 15
0x82870000 9
0x828a3000 8
0x82456000 8
0x8244d000 7
0x822f1000 7
0x824d2000 6
0x828e0000 6
0x825ed000 6
0x824af000 5
0x82450000 5
0x825fd000 4
0x82152000 4
0x828b0000 4
0x824ac000 4
0x82181000 4
0x82335000 4
0x825f6000 3
0x82169000 3
0x82452000 3
0x8260c000 3
0x82454000 3
0x8245a000 3
0x82360000 3
0x82458000 3
0x82457000 3
0x825fb000 2
0x824d6000 2
0x824cc000 2
0x82808000 2
0x82611000 2
0x820a1000 2
0x8216e000 2
0x82173000 2
0x828f2000 2
0x824ab000 2
0x828a2000 2
0x82459000 2
0x828a0000 2
0x82883000 1
0x822f2000 1
0x824be000 1
0x824d7000 1
0x824c0000 1
0x824c1000 1
0x824d4000 1
0x827ea000 1
0x82872000 1
0x824d1000 1
0x82026000 1
0x827eb000 1
0x827e7000 1
0x82610000 1
0x827e8000 1
0x82453000 1
0x82605000 1
0x828a6000 1
0x82606000 1
0x82179000 1
0x8216d000 1
0x82178000 1
0x820ad000 1
0x82900000 1
0x825f5000 1
0x824c8000 1
0x82000000 1
0x824a9000 1
0x824aa000 1
0x8245c000 1
0x822a8000 1
0x8245b000 1
0x8231a000 1
0x82445000 1
0x8235f000 1
0x8280a000 1
0x82451000 1
0x8244f000 1
0x82066000 1
0x82899000 1

3
audit-runs/audit-027-v40-mem-diff/l1-hits.txt Normal file
View File

@@ -0,0 +1,3 @@
# Renderer cluster L1 PC hits in canary's v40 (broad set, count=0)
# Narrow hand-picked subset (count=0)

13
audit-runs/audit-027-v40-mem-diff/pages.txt Normal file
View File

@@ -0,0 +1,13 @@
# 64K pages with A-list divergences (count=12)
page=0x40000000 count=163
page=0x701c0000 count=147
page=0x70330000 count=81
page=0x702d0000 count=51
page=0x702a0000 count=34
page=0x70360000 count=26
page=0x70260000 count=8
page=0x704d0000 count=8
page=0x700e0000 count=6
page=0x70430000 count=6
page=0x70570000 count=4
page=0x70060000 count=2

132
audit-runs/audit-027-v40-mem-diff/tables.txt Normal file
View File

@@ -0,0 +1,132 @@
# Consecutive A-list runs (>=4 dwords): 4 runs
=== run base=0x400015a0 length=110 zeros_in_ours=110 ===
+0x0000: canary=0x8284da50 ours=0x00000000
+0x0004: canary=0x8284da60 ours=0x00000000
+0x0008: canary=0x8284da70 ours=0x00000000
+0x000c: canary=0x825fb958 ours=0x00000000
+0x0010: canary=0x8284c988 ours=0x00000000
+0x0014: canary=0x8284c990 ours=0x00000000
+0x0018: canary=0x8284d9b8 ours=0x00000000
+0x001c: canary=0x8284d9d0 ours=0x00000000
+0x0020: canary=0x8284d9e8 ours=0x00000000
+0x0024: canary=0x8284da00 ours=0x00000000
+0x0028: canary=0x8284d7a8 ours=0x00000000
+0x002c: canary=0x8284ca80 ours=0x00000000
+0x0030: canary=0x8284cb28 ours=0x00000000
+0x0034: canary=0x8284cb40 ours=0x00000000
+0x0038: canary=0x8284cb48 ours=0x00000000
+0x003c: canary=0x8284cb58 ours=0x00000000
+0x0040: canary=0x8284cb68 ours=0x00000000
+0x0044: canary=0x8284c9e0 ours=0x00000000
+0x0048: canary=0x8284c9f0 ours=0x00000000
+0x004c: canary=0x8284cca0 ours=0x00000000
+0x0050: canary=0x8284ccb0 ours=0x00000000
+0x0054: canary=0x8284d798 ours=0x00000000
+0x0058: canary=0x8284d790 ours=0x00000000
+0x005c: canary=0x8284cd00 ours=0x00000000
+0x0060: canary=0x8284cd20 ours=0x00000000
+0x0064: canary=0x8284cd40 ours=0x00000000
+0x0068: canary=0x8284cd48 ours=0x00000000
+0x006c: canary=0x8284cd68 ours=0x00000000
+0x0070: canary=0x8284cd70 ours=0x00000000
+0x0074: canary=0x8284cd90 ours=0x00000000
+0x0078: canary=0x8284cdb0 ours=0x00000000
+0x007c: canary=0x8284cdd0 ours=0x00000000
+0x0080: canary=0x8284cde0 ours=0x00000000
+0x0084: canary=0x8284ce00 ours=0x00000000
+0x0088: canary=0x8284ce08 ours=0x00000000
+0x008c: canary=0x8284ce28 ours=0x00000000
+0x0090: canary=0x8284ce48 ours=0x00000000
+0x0094: canary=0x8284ce68 ours=0x00000000
+0x0098: canary=0x8284ce88 ours=0x00000000
+0x009c: canary=0x8284ce98 ours=0x00000000
+0x00a0: canary=0x8284ceb8 ours=0x00000000
+0x00a4: canary=0x8284ced8 ours=0x00000000
+0x00a8: canary=0x8284cef8 ours=0x00000000
+0x00ac: canary=0x8284cf18 ours=0x00000000
+0x00b0: canary=0x8284cf38 ours=0x00000000
+0x00b4: canary=0x8284cf58 ours=0x00000000
+0x00b8: canary=0x8284cf78 ours=0x00000000
+0x00bc: canary=0x8284cf98 ours=0x00000000
+0x00c0: canary=0x8284cfb8 ours=0x00000000
+0x00c4: canary=0x8284cfd8 ours=0x00000000
+0x00c8: canary=0x8284cff8 ours=0x00000000
+0x00cc: canary=0x8284d018 ours=0x00000000
+0x00d0: canary=0x8284d038 ours=0x00000000
+0x00d4: canary=0x8284d058 ours=0x00000000
+0x00d8: canary=0x8284d078 ours=0x00000000
+0x00dc: canary=0x8284d098 ours=0x00000000
+0x00e0: canary=0x8284d0b8 ours=0x00000000
+0x00e4: canary=0x8284d0d8 ours=0x00000000
+0x00e8: canary=0x8284d0e0 ours=0x00000000
+0x00ec: canary=0x8284d100 ours=0x00000000
+0x00f0: canary=0x8284d120 ours=0x00000000
+0x00f4: canary=0x8284d140 ours=0x00000000
+0x00f8: canary=0x8284d160 ours=0x00000000
+0x00fc: canary=0x8284d180 ours=0x00000000
... and 46 more
=== run base=0x40000770 length=32 zeros_in_ours=32 ===
+0x0000: canary=0x8284da50 ours=0x00000000
+0x0004: canary=0x8284da60 ours=0x00000000
+0x0008: canary=0x8284da70 ours=0x00000000
+0x000c: canary=0x825fb958 ours=0x00000000
+0x0010: canary=0x8284c988 ours=0x00000000
+0x0014: canary=0x8284c990 ours=0x00000000
+0x0018: canary=0x8284d9b8 ours=0x00000000
+0x001c: canary=0x8284d9d0 ours=0x00000000
+0x0020: canary=0x8284d9e8 ours=0x00000000
+0x0024: canary=0x8284da00 ours=0x00000000
+0x0028: canary=0x8284d7a8 ours=0x00000000
+0x002c: canary=0x8284ca80 ours=0x00000000
+0x0030: canary=0x8284cb28 ours=0x00000000
+0x0034: canary=0x8284cb40 ours=0x00000000
+0x0038: canary=0x8284cb48 ours=0x00000000
+0x003c: canary=0x8284cb58 ours=0x00000000
+0x0040: canary=0x8284cb68 ours=0x00000000
+0x0044: canary=0x8284c9e0 ours=0x00000000
+0x0048: canary=0x8284c9f0 ours=0x00000000
+0x004c: canary=0x8284cca0 ours=0x00000000
+0x0050: canary=0x8284ccb0 ours=0x00000000
+0x0054: canary=0x8284d798 ours=0x00000000
+0x0058: canary=0x8284d790 ours=0x00000000
+0x005c: canary=0x8284cd00 ours=0x00000000
+0x0060: canary=0x8284cd20 ours=0x00000000
+0x0064: canary=0x8284cd40 ours=0x00000000
+0x0068: canary=0x8284cd48 ours=0x00000000
+0x006c: canary=0x8284cd68 ours=0x00000000
+0x0070: canary=0x8284cd70 ours=0x00000000
+0x0074: canary=0x8284cd90 ours=0x00000000
+0x0078: canary=0x8284cdb0 ours=0x00000000
+0x007c: canary=0x8284cdd0 ours=0x00000000
=== run base=0x40000d90 length=20 zeros_in_ours=20 ===
+0x0000: canary=0x82882910 ours=0x00000000
+0x0004: canary=0x82882930 ours=0x00000000
+0x0008: canary=0x82882950 ours=0x00000000
+0x000c: canary=0x82882970 ours=0x00000000
+0x0010: canary=0x82882990 ours=0x00000000
+0x0014: canary=0x828829b0 ours=0x00000000
+0x0018: canary=0x828829d0 ours=0x00000000
+0x001c: canary=0x828829f0 ours=0x00000000
+0x0020: canary=0x82882a10 ours=0x00000000
+0x0024: canary=0x82882a30 ours=0x00000000
+0x0028: canary=0x82882a50 ours=0x00000000
+0x002c: canary=0x82882a70 ours=0x00000000
+0x0030: canary=0x82882a90 ours=0x00000000
+0x0034: canary=0x82882ab0 ours=0x00000000
+0x0038: canary=0x82882ad0 ours=0x00000000
+0x003c: canary=0x82882af0 ours=0x00000000
+0x0040: canary=0x82882b10 ours=0x00000000
+0x0044: canary=0x82882b30 ours=0x00000000
+0x0048: canary=0x82882b50 ours=0x00000000
+0x004c: canary=0x82882b70 ours=0x00000000
=== run base=0x701cfc24 length=5 zeros_in_ours=5 ===
+0x0000: canary=0x828708bc ours=0x00000000
+0x0004: canary=0x825ed278 ours=0x00000000
+0x0008: canary=0x828f4aa8 ours=0x00000000
+0x000c: canary=0x8284d9b0 ours=0x00000000
+0x0010: canary=0x828f310c ours=0x00000000