"""Emitter scan that handles BOTH `str rX,[sp]` and `stm sp,{rX,...}` opcode stores.

The earlier version only matched `str [sp]` and therefore MISSED every stub that
uses STM -- which is how several HDCP disp_* stubs write frame[0]. Any previous
"no module emits X" conclusion produced by the old scanner is unsound.
"""
import struct, os, sys
from capstone import *
md=Cs(CS_ARCH_ARM,CS_MODE_THUMB)
MODS=(('sos','handover/elf/sos2.elf'),('sys_drv','handover/elf/sys_drv2.elf'),
      ('asd','handover/elf/asd2.elf'),('hdcp','handover/elf/hdcp2.elf'),
      ('dtm','handover/elf/dtm2.elf'),('ras','handover/elf/ras2.elf'))
def load(p):
    raw=open(p,'rb').read(); ph=struct.unpack('<I',raw[28:32])[0]
    o,v,pa,f=struct.unpack('<IIII',raw[ph+4:ph+20]); return raw[o:o+f],v
def emitted(body,v):
    out={}
    sites=[v+a for a in range(0,len(body)-1,2) if body[a]==0xF2 and body[a+1]==0xDF]
    for s in sites:
        lo=max(v,s-0x60); regs={}; svc_r0=None
        for i in md.disasm(body[lo-v:s-v+2], lo):
            m=i.mnemonic; op=i.op_str
            if m in ('movs','mov.w','movw','mov') and ',' in op:
                d,src=[x.strip() for x in op.split(',',1)]
                if src.startswith('#'):
                    try: regs[d]=int(src[1:],0)
                    except: pass
                elif src in regs: regs[d]=regs[src]
                else: regs.pop(d,None)
            elif m.startswith('str') and '[sp]' in op:
                r=op.split(',')[0].strip()
                if r in regs: out.setdefault(regs[r],[]).append(hex(s))
            elif m.startswith('stm') and 'sp' in op.split('{')[0]:
                inner=op.split('{')[1].split('}')[0]
                first=inner.split(',')[0].strip()      # STM writes the FIRST reg to [sp]
                if first in regs: out.setdefault(regs[first],[]).append(hex(s))
    return out
targets=[int(x,0) for x in sys.argv[1:]] or None
for name,p in MODS:
    if not os.path.exists(p): continue
    body,v=load(p); e=emitted(body,v)
    if targets:
        hit={k:v2 for k,v2 in e.items() if k in targets}
        print("  %-8s emits %s"%(name, {hex(k):v2[:2] for k,v2 in sorted(hit.items())} or 'NONE'))
    else:
        print("  %-8s %d distinct opcodes: %s"%(name, len(e), sorted(hex(k) for k in e)[:24]))