nx_pe_compile_win_mmap.nx
buildroot/runtime/nx_pe_compile_win_mmap.nx
about
nx_pe_compile_win_mmap.nx -- W3b-5a: an organ's REAL sys_mmap reaches VirtualAlloc.
sys_mmap is the allocation primitive EVERY organ uses, so it is the gating syscall for running a
real organ native. W3b-4 redirected sys_write -> WriteFile; this redirects the genuine nx_syscalls
name `sys_mmap` -> a kernel32 VirtualAlloc thunk (VERIFIED the compiler emits a direct `call sys_mmap`,
SysV rdi=size). So a compiled organ's own sys_mmap(size) returns real, writable Windows memory. No
compiler or assembler edits.
thunk (SysV in: rdi=size -> VirtualAlloc(NULL, size, MEM_COMMIT|MEM_RESERVE, PAGE_READWRITE)):
sub rsp, 0x28 ; shadow + 16-byte align (rsp 8 mod16 at entry -> 0x30 -> 0 mod16)
mov rdx, rdi ; arg2 dwSize = size
xor ecx, ecx ; arg1 lpAddress = NULL
mov r8d, 0x3000 ; arg3 MEM_COMMIT(0x1000)|MEM_RESERVE(0x2000)
mov r9d, 0x04 ; arg4 PAGE_READWRITE
call [rip+VirtualAlloc]
add rsp, 0x28 / ret ; rax = base pointer (SysV return)
NO-FALSE-GREEN: source `{ let p = sys_mmap(4096); p[0]=77; p[1]=22; return p[0]+p[1] }`. Exit 99
proves VirtualAlloc returned a VALID, WRITABLE region and the compiled code wrote+read it back. A
NULL/fake pointer would fault on p[0]=77 (exit 0xC0000005), not 99. Tamper (corrupt VirtualAlloc
import name) -> 0xC0000139 (real OS binding).
PIPELINE (build WSL sovereign, run native): src.nx
-> ./_offc/nx_compile_x86_native.elf <src> > /tmp/nxwin.s
-> ./_offc/nx_sov_build_run.elf nx_pe_compile_win_mmap (reads /tmp/nxwin.s)
-> _offc/nx_win_compiled_mmap.exe -> run native on Windows 11.
HONEST SCOPE: single redirect (sys_mmap). The TABLE rung (W3b-5b) combines sys_write+sys_mmap+
sys_exit in one organ so a multi-syscall organ runs native. 2 imports (VirtualAlloc, ExitProcess).
Replicates keystone assemble (reuses axc_pass; no shared edit). lineage_id: substrate_pe_compile_win_mmap_v1
dependencies 3 imports · 0 importers
imports: nx_syscalls.nxnxasm_x86.nxnx_pe_writer.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 36 | const NXMM_CODE_CAP: i64 = 1048576 |
| 37 | const NXMM_FILE_SIZE: i64 = 0x600 // headers + .text + .idata |
| 38 | const NXMM_STUB_LEN: i64 = 18 |
| 39 | const NXMM_THUNK_LEN: i64 = 32 |
| 40 | const NXMM_TEXT_CAP: i64 = 0x200 |
| 41 | const NXMM_RVA_TEXT: i64 = 0x1000 |
| 42 | const NXMM_RVA_IDATA: i64 = 0x2000 |
| 43 | const NXMM_FOFF_TEXT: i64 = 0x200 |
| 44 | const NXMM_FOFF_IDATA:i64 = 0x400 |
| 45 | const NXMM_IAT_VA: i64 = 0x2040 // IAT VirtualAlloc RVA |
| 46 | const NXMM_IAT_EXIT: i64 = 0x2048 // IAT ExitProcess RVA |
functions
| 49 | func nxmm_assemble(src: *u8, n: i64, out: *u8, out_cap: i64, p_main: *i64, p_mm: *i64) -> i64 |
| 86 | func nxmm_emit_pe(buf: *u8, code: *u8, code_len: i64, main_off: i64, mm_off: i64) -> i64 |
| 183 | func main() -> i64 |