"""Enumerate the SVC numbers each TA actually issues (function-accurate disassembly),
then map them to the sOS handler side. TA-reachable SVCs are the host->TA->kernel
privilege boundary."""
import struct, json, sys
from capstone import *

BASE = '/Users/user/dev/amd-psp-re/psp_out/handover/'

def load(mod):
    raw = open(BASE + 'elf/%s2.elf' % mod, 'rb').read()
    ph = struct.unpack('<I', raw[28:32])[0]
    o, v, pa, f = struct.unpack('<IIII', raw[ph+4:ph+20])
    d = json.load(open(BASE + 'symbols/%s.json' % mod))
    return raw[o:o+f], v, {int(k, 16): val for k, val in d['functions'].items()}

def svcs_of(mod):
    body, vaddr, funcs = load(mod)
    md = Cs(CS_ARCH_ARM, CS_MODE_THUMB)
    out = {}
    for ea, f in funcs.items():
        end = f.get('end', ea + 0x40)
        if end <= ea or end - ea > 0x4000: end = ea + 0x40
        off = ea - vaddr
        if off < 0 or off >= len(body): continue
        for i in md.disasm(body[off:off + (end - ea)], ea):
            if i.mnemonic.startswith('svc'):
                try: n = int(i.op_str.replace('#', ''), 0)
                except Exception: continue
                out.setdefault(n, []).append(f['name'])
    return out

if __name__ == '__main__':
    allsvc = {}
    for mod in ('hdcp', 'asd', 'dtm', 'ras'):
        s = svcs_of(mod)
        print("%-5s : %s" % (mod, sorted(hex(k) for k in s)))
        for k, v in s.items(): allsvc.setdefault(k, set()).update([mod])
    print("\n=== union of TA-reachable SVC numbers ===")
    for k in sorted(allsvc):
        print("  %#04x  used by %s" % (k, sorted(allsvc[k])))