nx_pe_compile_win_halloc.nx

nx_pe_compile_win_halloc.nx -- W3b-5a' : sys_mmap reaches a BENIGN allocator (HeapAlloc). W3b-5a redirected sys_mmap -> VirtualAlloc, which Windows Defender quarantined (a minimal hand-PE importing VirtualAlloc matches the shellcode-loader heuristic; see pe_compile_win_mmap_gate.log). This rung uses the recommended benign alternative: sys_mmap -> HeapAlloc(GetProcessHeap(), 0, size), the allocation pattern of ordinary programs, which should not trip the heuristic. No compiler/asm edits. thunk (SysV in: rdi=size): sub rsp, 0x28 ; shadow + 16-byte align call [rip+GetProcessHeap] ; rax = default heap handle; rdi(size) survives (MS-x64 non-volatile) mov rcx, rax ; arg1 hHeap xor edx, edx ; arg2 dwFlags = 0 mov r8, rdi ; arg3 dwBytes = size call [rip+HeapAlloc] ; rax = pointer add rsp, 0x28 / ret ; rax = base pointer (SysV return) NO-FALSE-GREEN: source `{ let p = sys_mmap(4096); p[0]=77; p[1]=22; return p[0]+p[1] }`. Exit 99 proves HeapAlloc returned a VALID, WRITABLE region the compiled code wrote+read back; a NULL/bad pointer faults (0xC0000005). Tamper (corrupt HeapAlloc import name) -> 0xC0000139. PIPELINE (build WSL sovereign, run native): src.nx -> nx_compile_x86_native.elf > /tmp/nxwin.s -> nx_sov_build_run.elf nx_pe_compile_win_halloc -> _offc/nx_win_compiled_halloc.exe -> run native. HONEST SCOPE: single redirect (sys_mmap) via HeapAlloc; combine with the W3b-5b table for a full multi-syscall organ. 3 imports (GetProcessHeap, HeapAlloc, ExitProcess). Replicates keystone assemble (reuses axc_pass; no shared edit). lineage_id: substrate_pe_compile_win_halloc_v1