Initial curated chimera source from a8ae5b1db07fb49926c94585e2718e5130330974

test/autonomous/build-kstuff-diagnostic-loader.test.mjs

@@ -0,0 +1,61 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  buildDiagnosticLoader,
+  inspectFrankenElf,
+  sha256,
+} from '../../scripts/autonomous/build-kstuff-diagnostic-loader.mjs';
+
+const MARKER = Buffer.from([0xeb, 0x0b, 0x50, 0x4c, 0x44, 0x00]);
+
+function frankenElf(size) {
+  const buffer = Buffer.alloc(size, 0x41);
+  MARKER.copy(buffer);
+  buffer.writeBigUInt64LE(64n, 32);
+  buffer.writeUInt16LE(1, 56);
+  buffer.writeUInt32LE(1, 64);
+  buffer.writeUInt32LE(5, 68);
+  buffer.writeBigUInt64LE(0n, 72);
+  buffer.writeBigUInt64LE(BigInt(size), 96);
+  buffer.writeBigUInt64LE(BigInt(size), 104);
+  return buffer;
+}
+
+test('in-place diagnostic build preserves bytes after the exact embedded image span', () => {
+  const prefix = Buffer.alloc(96, 0x23);
+  const officialPayload = frankenElf(192);
+  const suffix = Buffer.alloc(80, 0x7d);
+  const officialLoader = Buffer.concat([prefix, officialPayload, suffix]);
+  const diagnosticPayload = frankenElf(160);
+  const manifest = { officialLoader: {
+    size: officialLoader.length,
+    sha256: sha256(officialLoader),
+    embeddedPayloadOffset: prefix.length,
+    embeddedPayloadSize: officialPayload.length,
+  } };
+
+  const result = buildDiagnosticLoader({ officialLoader, diagnosticPayload, manifest });
+  assert.deepEqual(result.output.subarray(prefix.length + officialPayload.length), suffix);
+  assert.equal(result.evidence.zeroPaddingBytes, 32);
+  assert.equal(inspectFrankenElf(diagnosticPayload).imageSpan, diagnosticPayload.length);
+});
+
+test('in-place diagnostic build rejects a payload larger than the official image span', () => {
+  const prefix = Buffer.alloc(96, 0x23);
+  const officialPayload = frankenElf(192);
+  const suffix = Buffer.alloc(80, 0x7d);
+  const officialLoader = Buffer.concat([prefix, officialPayload, suffix]);
+  const diagnosticPayload = frankenElf(208);
+  const manifest = { officialLoader: {
+    size: officialLoader.length,
+    sha256: sha256(officialLoader),
+    embeddedPayloadOffset: prefix.length,
+    embeddedPayloadSize: officialPayload.length,
+  } };
+
+  assert.throws(
+    () => buildDiagnosticLoader({ officialLoader, diagnosticPayload, manifest }),
+    /rebuild the loader from pinned source/,
+  );
+});

test/autonomous/inspect-ps5-fih-route.test.mjs

@@ -0,0 +1,87 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import { comparePs5FihRoute, inspectPs5FihPackage } from '../../scripts/autonomous/inspect-ps5-fih-route.mjs';
+
+function writeFixture(root, name, { contentFlags = 0x00020000, outerFileCount = 1, extraEntry = false } = {}) {
+  const filename = path.join(root, name);
+  const pfsOffset = 0x10000;
+  const pfsSize = 0x10000;
+  const cntOffset = pfsOffset + pfsSize;
+  const imageKeyOffset = 0x1000;
+  const entryCount = extraEntry ? 2 : 1;
+  const bytes = Buffer.alloc(cntOffset + imageKeyOffset + 0x800);
+
+  Buffer.from([0x7f, 0x46, 0x49, 0x48]).copy(bytes, 0);
+  bytes[4] = 1;
+  bytes.writeUInt16LE(3, 6);
+  bytes.writeBigUInt64LE(BigInt(pfsOffset), 0x10);
+  bytes.writeBigUInt64LE(BigInt(pfsSize), 0x18);
+  bytes.writeUInt32LE(outerFileCount, 0xf0);
+  bytes.writeBigUInt64LE(BigInt(cntOffset), 0x58);
+
+  bytes.writeBigUInt64LE(2n, pfsOffset);
+  bytes.writeUInt32LE(20_130_315, pfsOffset + 8);
+  bytes.writeUInt16LE(0x0d, pfsOffset + 0x1c);
+  bytes.writeUInt32LE(1, pfsOffset + 0x24);
+
+  Buffer.from([0x7f, 0x43, 0x4e, 0x54]).copy(bytes, cntOffset);
+  bytes.writeUInt32BE(0x81000000, cntOffset + 4);
+  bytes.writeUInt32BE(entryCount, cntOffset + 0x10);
+  bytes.writeUInt16BE(1, cntOffset + 0x14);
+  bytes.writeUInt16BE(entryCount, cntOffset + 0x16);
+  bytes.writeUInt32BE(0x100, cntOffset + 0x18);
+  bytes.writeBigUInt64BE(0x1000n, cntOffset + 0x20);
+  Buffer.from('IV9999-FAKE00000_00-ROUTEINSPECT0001').copy(bytes, cntOffset + 0x40);
+  bytes.writeUInt32BE(0, cntOffset + 0x70);
+  bytes.writeUInt32BE(0x20, cntOffset + 0x74);
+  bytes.writeUInt32BE(contentFlags, cntOffset + 0x78);
+  bytes.writeUInt32BE(1, cntOffset + 0x404);
+  bytes.writeBigUInt64BE(BigInt(pfsOffset), cntOffset + 0x410);
+  bytes.writeBigUInt64BE(BigInt(pfsSize), cntOffset + 0x418);
+
+  bytes.writeUInt32BE(0x20, cntOffset + 0x100);
+  bytes.writeUInt32BE(0, cntOffset + 0x104);
+  bytes.writeUInt32BE(0x60000000, cntOffset + 0x108);
+  bytes.writeUInt32BE(0, cntOffset + 0x10c);
+  bytes.writeUInt32BE(imageKeyOffset, cntOffset + 0x110);
+  bytes.writeUInt32BE(0x800, cntOffset + 0x114);
+  if (extraEntry) {
+    bytes.writeUInt32BE(0x402, cntOffset + 0x120);
+    bytes.writeUInt32BE(1, cntOffset + 0x124);
+    bytes.writeUInt32BE(0x08000000, cntOffset + 0x128);
+    bytes.writeUInt32BE(0, cntOffset + 0x12c);
+    bytes.writeUInt32BE(0x1800, cntOffset + 0x130);
+    bytes.writeUInt32BE(0, cntOffset + 0x134);
+  }
+  bytes.fill(0xa5, cntOffset + imageKeyOffset, cntOffset + imageKeyOffset + 0x800);
+  fs.writeFileSync(filename, bytes);
+  return filename;
+}
+
+test('route inspector separates trust-profile fields from content accounting and asset entries', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'chimera-fih-route-'));
+  try {
+    const reference = writeFixture(root, 'reference.pkg');
+    const candidate = writeFixture(root, 'candidate.pkg', {
+      contentFlags: 0x02000000,
+      outerFileCount: 71,
+      extraEntry: true,
+    });
+
+    const inspected = inspectPs5FihPackage(reference);
+    assert.equal(inspected.cnt.header.contentFlags, '0x00020000');
+    assert.equal(inspected.fih.accounting.outerFileCount, 1);
+
+    const comparison = comparePs5FihRoute(reference, candidate);
+    assert.equal(comparison.schemaVersion, 2);
+    assert.deepEqual(comparison.routeGate.mismatches.map((item) => item.field), ['cnt.header.contentFlags']);
+    assert.deepEqual(comparison.contentAccountingDifferences.map((item) => item.field), ['fih.accounting.outerFileCount']);
+    assert.deepEqual(comparison.entrySetDifferences.onlyInCandidate.map((item) => item.id), ['0x00000402']);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});

test/autonomous/parse-kstuff-mailbox-capture.test.mjs

@@ -0,0 +1,63 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import {
+  parseMailboxCaptures,
+  summarizeMailboxCaptures,
+} from '../../scripts/autonomous/parse-kstuff-mailbox-capture.mjs';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(here, '../..');
+
+test('verifyImage diagnostic patch is source-pinned and observe-only', () => {
+  const manifest = JSON.parse(fs.readFileSync(
+    path.join(root, 'tools/ps5-kstuff-diagnostics/verify-image-observability.json'),
+    'utf8',
+  ));
+  const patch = fs.readFileSync(
+    path.join(root, 'tools/ps5-kstuff-diagnostics/verify-image-observability.patch'),
+    'utf8',
+  );
+
+  assert.equal(manifest.upstreamCommit, '3b2ab4a16ba43c8ab38daf7ec83cc297014e0e47');
+  assert.equal(manifest.observabilityOnly, true);
+  assert.equal(manifest.firmware, '9.60');
+  assert.match(patch, /KSTUFF_SYSCALL_NMOUNT/);
+  assert.match(patch, /observe_unhandled_mailbox/);
+  assert.match(patch, /mailbox_capture_copy_failures/);
+  assert.doesNotMatch(patch, /regs\[RAX\]\s*=/);
+  assert.doesNotMatch(patch, /regs\[RIP\]\s*=/);
+  assert.doesNotMatch(patch, /copy_to_kernel\s*\(/);
+  assert.doesNotMatch(patch, /register_fake_key\s*\(/);
+});
+
+test('parser retains exact request words and reports capture gaps', () => {
+  const parsed = parseMailboxCaptures(`
+mailbox-capture[41] syscall=nmount lr=0xffffffff81234567 request=0xffff800001020000 copy=ok rdi=0x1 rsi=0x2 rcx=0x3 req0=0x10 req1=0x11 req2=0x12 req3=0x13 req4=0x14 req5=0x15 req6=0x16 req7=0x17
+mailbox-capture-gap expected=42 actual=44 dropped=2
+mailbox-capture[44] syscall=nmount lr=0xffffffff81234567 request=0xffff800001020000 copy=EFAULT rdi=0x1 rsi=0x2 rcx=0x3 req0=0x0 req1=0x0 req2=0x0 req3=0x0 req4=0x0 req5=0x0 req6=0x0 req7=0x0
+`);
+
+  assert.equal(parsed.captures.length, 2);
+  assert.equal(parsed.captures[0].sequence, 41n);
+  assert.equal(parsed.captures[0].lr, 0xffffffff81234567n);
+  assert.deepEqual(parsed.captures[0].requestWords, [
+    0x10n, 0x11n, 0x12n, 0x13n, 0x14n, 0x15n, 0x16n, 0x17n,
+  ]);
+  assert.equal(parsed.captures[1].copyStatus, 'EFAULT');
+  assert.deepEqual(parsed.gaps, [{ expected: 42n, actual: 44n, dropped: 2n }]);
+
+  const summary = summarizeMailboxCaptures(parsed);
+  assert.equal(summary.total, 2);
+  assert.equal(summary.uniqueReturnAddresses, 1);
+  assert.equal(summary.copyFailures, 1);
+  assert.equal(summary.dropped, 2n);
+});
+
+test('parser ignores unrelated debug-reader output', () => {
+  const parsed = parseMailboxCaptures('core handle=10\nfpkg verify=0 verify_emu=0\n');
+  assert.deepEqual(parsed, { captures: [], gaps: [] });
+});