#!/usr/bin/env python3
"""Run the REAL rom_parse_directory in the emulator, and differential it against
psp_out/ifwi_parse_model.py.

Why this is in scope: no hardware, no flash, no card. CONSTRAINTS.md bars issuing
flash commands to the card; this executes firmware under Unicorn.

Why it matters: ifwi_parse_model.py is a host-side reimplementation of the
pre-auth IFWI parser written to validate crafted images, and it has never been
checked against the firmware it models. The TSU disclosure chain (ANALYSIS-PSP-
CODE-EXEC-AVENUES.md 4.1b/4.1c) rests on that parser's wrapping bounds checks,
so the model has to be right before any crafted input means anything.

Address note: the v53 symbol map's TSU addresses do NOT match this image -- they
have zero callers, while the ANALYSIS/ifwi_parse_model set has 2/1/2/1. This
uses the latter, which is the set that matches the code.

    rom_parse_directory(ctx, img) -> err        @ 0xE16964
"""
import struct, sys
sys.path.insert(0, "/home/user/dev/amd-psp-re/psp_emu")
sys.path.insert(0, "/home/user/dev/amd-psp-re/psp_out")

from pspemu import sysdrv_env
import importlib.util
_s = importlib.util.spec_from_file_location(
    "ifwi", "/home/user/dev/amd-psp-re/psp_out/ifwi_parse_model.py")
IFWI = importlib.util.module_from_spec(_s); _s.loader.exec_module(IFWI)

RPD = 0xE16964
FLASH = "/home/user/dev/amd-psp-re/psp_out/flash_BIOS2_KNOWNGOOD_20260917.bin"

sd = sysdrv_env.make()
sysdrv_env.run_init(sd)

img = open(FLASH, "rb").read()
print("known-good flash image: %d bytes" % len(img))

# place the image somewhere the guest can read
IMG_VA = 0x10000000
sd.uc.mem_map(IMG_VA, (len(img) + 0xFFF) & ~0xFFF)
sd.uc.mem_write(IMG_VA, img)
assert bytes(sd.uc.mem_read(IMG_VA, 4)) == img[:4], "image not readable at IMG_VA"
print("image mapped at %#x, first4 = %s" % (IMG_VA, img[:4].hex()))
ctx = sd.alloc(0x400)


def firmware_parse(image_bytes):
    """Run the real parser over image_bytes; return its error code."""
    sd.uc.mem_write(IMG_VA, image_bytes.ljust(len(img), b"\x00")[:len(img)])
    sd.write(ctx, b"\x00" * 0x400)
    try:
        return sd.run_function(RPD, (ctx, IMG_VA, 0, 0), count=20_000_000)
    except Exception as e:
        return "FAULT:%s" % type(e).__name__


def model_parse(image_bytes):
    try:
        IFWI.parse(image_bytes)
        return 0
    except IFWI.Fail as e:
        return "Fail:%s" % str(e)[:44]


print("\n=== CONTROL: known-good image ===")
fw = firmware_parse(img)
md = model_parse(img)
print("   firmware rom_parse_directory -> %s" % (hex(fw) if isinstance(fw, int) else fw))
print("   ifwi_parse_model             -> %s" % md)
print("   both accept: %s" % (fw == 0 and md == 0))
if fw != 0:
    print("\n   Firmware rejects the known-good image: either the entry point or the")
    print("   calling convention is wrong. Nothing below would mean anything.")
    print("   RESULT NOT REPORTABLE")
    raise SystemExit(2)

print("\n=== negative control: corrupted magic ===")
bad = bytearray(img); bad[0:4] = b"\xde\xad\xbe\xef"
print("   firmware -> %s" % (lambda v: hex(v) if isinstance(v, int) else v)(firmware_parse(bytes(bad))))
print("   model    -> %s" % model_parse(bytes(bad)))

print("\n=== wrapping inputs (the 4.1b claim) ===")
for name, off, val in (("fw_tail slot0 ptr = -0x10", 20, (-0x10) & 0xFFFFFFFF),
                       ("fw_tail slot0 ptr = 0xFFFFFFF0", 20, 0xFFFFFFF0),
                       ("fw_tail slot0 ptr = 0x1FFFF0", 20, 0x1FFFF0)):
    t = bytearray(img)
    struct.pack_into("<I", t, off, val)
    f = firmware_parse(bytes(t)); m = model_parse(bytes(t))
    print("   %-30s firmware=%-14s model=%s"
          % (name, hex(f) if isinstance(f, int) else f, m))