#!/usr/bin/env python3
"""Signed .54 0x100B reads nested +16/+20/+24 past four-byte declaration.
Artificial scratch-page boundary and sOS window; no hardware effect.
"""
from pathlib import Path
import sys
from unicorn import UC_HOOK_CODE
from unicorn.arm_const import UC_ARM_REG_R0,UC_ARM_REG_R1,UC_ARM_REG_R2
sys.path.insert(0,str(Path(__file__).resolve().parents[1]))
from pspemu import sysdrv_env
from pspemu.component import Fault
SIGNED=Path(__file__).resolve().parents[2]/'psp_out/elf/sys_drv_0.49.0.54_18bd9d26.elf'

def main():
    sd=sysdrv_env.make()
    assert Path(sd.image_path).read_bytes()==SIGNED.read_bytes()
    r,f,_=sysdrv_env.run_init(sd)
    assert r==0 and not f and sysdrv_env.init_flag(sd)==1
    req,cfg,nested,dummy=[sd.alloc(n) for n in (0x100,0x400,0x40,0x40)]
    sd.write(cfg,bytes(0x400));sd.write(nested,bytes(0x40));sd.write(dummy,bytes(0x40))
    sd.wr32(nested+16,0x12340000);sd.wr32(nested+20,1);sd.wr32(nested+24,0x1000)
    seen=[];allocator=[]
    sd.uc.hook_add(UC_HOOK_CODE,lambda uc,ea,size,data:seen.append(tuple(uc.reg_read(x) for x in (UC_ARM_REG_R0,UC_ARM_REG_R1,UC_ARM_REG_R2))),begin=0xE086FC,end=0xE086FD)
    sd.uc.hook_add(UC_HOOK_CODE,lambda uc,ea,size,data:allocator.append(ea),begin=0xE1BBAE,end=0xE1BBAF)
    def run(ptr,declared):
        sd.write(req,bytes(0x100))
        for i,v in ((0,0x100B),(1,2),(2,ptr),(3,declared),(4,dummy),(5,4),
                    (sysdrv_env.REQ_CONFIG_DWORD,cfg)):
            sd.wr32(req+4*i,v)
        try:return sd.run_function(0xE087E4,(req,2,0,0),count=2_000_000,timeout=2_000_000)
        except Fault as exc:return exc
    mapped=run(nested,4)
    assert seen and seen[-1]==(1,0x12340000,0x1000),(mapped,seen[-1] if seen else None)
    # The next page after scratch is deliberately UNMAPPED in this model.
    edge=sd.cmap.scratch+sd.cmap.scratch_size-4
    sd.write(edge,b'ABCD')
    def svc_window(comp,n):
        p=comp.uc.reg_read(UC_ARM_REG_R1)
        for i,v in enumerate((sd.cmap.scratch,sd.cmap.scratch+sd.cmap.scratch_size,0,0)):
            comp.wr32(p+4*i,v)
        return 0
    sd.svc.register(0xB5,svc_window)
    before=len(seen)
    fault=run(edge,4)
    assert isinstance(fault,Fault) and fault.addr==edge+24 and fault.pc==0xE1BB80,(fault,seen)
    assert len(seen)==before
    denied=run(edge,28)
    assert not isinstance(denied,Fault) and denied==0xFFFF000F and len(seen)==before,(denied,seen)
    assert not allocator,allocator
    print(f'signed 0x100B: nested +16/+20/+24 read after declared4; synthetic edge fault={fault.addr:#x}, declared28 denied={denied:#x}; no mapped hardware claim')
if __name__=='__main__':main()