code wiki / (root) / nx_pe_compile_win_table.nx

nx_pe_compile_win_table.nx

buildroot/runtime/nx_pe_compile_win_table.nx

13354 B245 linesdepth 4pulls 6 transitivereach 0 importersview sourcekind tooltopic pe
docsdependenciesstructsconstsfunctions

about

nx_pe_compile_win_table.nx -- W3b-5b: a MULTI-syscall organ runs native (redirect table). W3b-4 redirected one real syscall (sys_write). This rung proves the keystone-linker resolves a TABLE of syscall labels in ONE organ: both `sys_write` AND `sys_exit` are redirected to kernel32 thunks, so a compiled organ that calls more than one syscall runs natively. The generalization that a real container-manager organ needs. No compiler or assembler edits. sys_write shim -> jmp WRITE_THUNK (66B, fd-routed GetStdHandle+WriteFile, RETURNS; from W3b-4) sys_exit shim -> jmp EXIT_THUNK (13B, mov ecx,edi; sub rsp,0x28; call[ExitProcess]; int3; from W3b-2) .text = [entry stub][compiled code][WRITE_THUNK][EXIT_THUNK] NO-FALSE-GREEN: source `{ let a = sys_write(1,"TABLE-OK\n",9); let b = sys_exit(55); return a+b }`. stdout shows "TABLE-OK\n" (sys_write reached WriteFile) AND the process exits 55 (sys_exit reached ExitProcess with arg 55 -- terminating BEFORE `return a+b`, so 55 != the entry-stub's main-return path). Two distinct syscalls, both redirected, both observable. Tamper either import -> 0xC0000139. Uses only the already-proven benign imports (GetStdHandle/WriteFile/ExitProcess). NOTE: sys_mmap -> VirtualAlloc (W3b-5a) is BLOCKED by Windows Defender, which flags a minimal hand-built PE importing VirtualAlloc as a shellcode-loader (see pe_compile_win_mmap_gate.log) -- a real finding for the eventual container runtime; resolution (HeapAlloc vs an AV exclusion) is a user decision. PIPELINE (build WSL sovereign, run native): src.nx -> ./_offc/nx_compile_x86_native.elf <src> > /tmp/nxwin.s -> ./_offc/nx_sov_build_run.elf nx_pe_compile_win_table (reads /tmp/nxwin.s) -> _offc/nx_win_compiled_table.exe -> run native on Windows 11. HONEST SCOPE: 2 syscalls (write, exit) via a hand-listed pair of redirects; a fully data-driven N-entry table + the remaining syscalls (mmap/read/openat) are follow-ons. Replicates keystone assemble (reuses axc_pass; no shared edit). lineage_id: substrate_pe_compile_win_table_v1

dependencies 3 imports · 0 importers

nx_syscalls.nx nxasm_x86.nx nx_pe_writer.nx nx_pe_compile_win_table.nx

imports: nx_syscalls.nxnxasm_x86.nxnx_pe_writer.nx

imported by: nobody (leaf or entry point)

call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown

main sys_mmap sys_read_file sys_openat_rd sys_lseek sys_mmap ↻ sys_read sys_close nxt_assemble sys_mmap ↻ axc_pass axc_is_space axc_is_ident axc_apply_section axc_tok_is axc_cstr_len axc_is_space ↻ axc_is_ident ↻ axc_tok_is ↻ axc_emit_bytes axc_is_digit axc_parse_int axc_is_digit ↻ axc_parse_operand axc_is_space ↻ axc_is_ident ↻ axc_reg_num axc_tok_is ↻ axc_parse_int ↻ axc_is_digit ↻ axc_tok_is ↻ axc_emit axc_tok_is ↻ axc_alu x86_alu_imm x86_rex_w x86_modrm x86_put_u32le x86_alu_rr x86_rex_w ↻

structs

none

consts

35const NXT_CODE_CAP: i64 = 1048576
36const NXT_FILE_SIZE: i64 = 0x800
37const NXT_STUB_LEN: i64 = 18
38const NXT_WTHUNK_LEN: i64 = 66 // fd-routed GetStdHandle+WriteFile returning thunk
39const NXT_ETHUNK_LEN: i64 = 13 // ExitProcess thunk
40const NXT_TEXT_CAP: i64 = 0x200
41const NXT_RVA_TEXT: i64 = 0x1000
42const NXT_RVA_RDATA: i64 = 0x2000
43const NXT_RVA_IDATA: i64 = 0x3000
44const NXT_FOFF_TEXT: i64 = 0x200
45const NXT_FOFF_RDATA:i64 = 0x400
46const NXT_FOFF_IDATA:i64 = 0x600
47const NXT_IAT_GSH: i64 = 0x3048
48const NXT_IAT_WF: i64 = 0x3050
49const NXT_IAT_EXIT: i64 = 0x3058

functions

52func nxt_assemble(src: *u8, n: i64, out: *u8, out_cap: i64, p_main: *i64, p_sw: *i64, p_se: *i64) -> i64
92func nxt_emit_pe(buf: *u8, code: *u8, code_len: i64, main_off: i64, sw_off: i64, se_off: i64) -> i64
212func main() -> i64