nx_pe_compile_win_table.nx
buildroot/runtime/nx_pe_compile_win_table.nx
about
nx_pe_compile_win_table.nx -- W3b-5b: a MULTI-syscall organ runs native (redirect table).
W3b-4 redirected one real syscall (sys_write). This rung proves the keystone-linker resolves a
TABLE of syscall labels in ONE organ: both `sys_write` AND `sys_exit` are redirected to kernel32
thunks, so a compiled organ that calls more than one syscall runs natively. The generalization that
a real container-manager organ needs. No compiler or assembler edits.
sys_write shim -> jmp WRITE_THUNK (66B, fd-routed GetStdHandle+WriteFile, RETURNS; from W3b-4)
sys_exit shim -> jmp EXIT_THUNK (13B, mov ecx,edi; sub rsp,0x28; call[ExitProcess]; int3; from W3b-2)
.text = [entry stub][compiled code][WRITE_THUNK][EXIT_THUNK]
NO-FALSE-GREEN: source `{ let a = sys_write(1,"TABLE-OK\n",9); let b = sys_exit(55); return a+b }`.
stdout shows "TABLE-OK\n" (sys_write reached WriteFile) AND the process exits 55 (sys_exit reached
ExitProcess with arg 55 -- terminating BEFORE `return a+b`, so 55 != the entry-stub's main-return
path). Two distinct syscalls, both redirected, both observable. Tamper either import -> 0xC0000139.
Uses only the already-proven benign imports (GetStdHandle/WriteFile/ExitProcess). NOTE: sys_mmap ->
VirtualAlloc (W3b-5a) is BLOCKED by Windows Defender, which flags a minimal hand-built PE importing
VirtualAlloc as a shellcode-loader (see pe_compile_win_mmap_gate.log) -- a real finding for the
eventual container runtime; resolution (HeapAlloc vs an AV exclusion) is a user decision.
PIPELINE (build WSL sovereign, run native): src.nx
-> ./_offc/nx_compile_x86_native.elf <src> > /tmp/nxwin.s
-> ./_offc/nx_sov_build_run.elf nx_pe_compile_win_table (reads /tmp/nxwin.s)
-> _offc/nx_win_compiled_table.exe -> run native on Windows 11.
HONEST SCOPE: 2 syscalls (write, exit) via a hand-listed pair of redirects; a fully data-driven
N-entry table + the remaining syscalls (mmap/read/openat) are follow-ons. Replicates keystone
assemble (reuses axc_pass; no shared edit). lineage_id: substrate_pe_compile_win_table_v1
dependencies 3 imports · 0 importers
imports: nx_syscalls.nxnxasm_x86.nxnx_pe_writer.nx
imported by: nobody (leaf or entry point)
call flow from main pre-order; caps 40 nodes / depth 6 declared; ↻ = already shown
structs
| none |
consts
| 35 | const NXT_CODE_CAP: i64 = 1048576 |
| 36 | const NXT_FILE_SIZE: i64 = 0x800 |
| 37 | const NXT_STUB_LEN: i64 = 18 |
| 38 | const NXT_WTHUNK_LEN: i64 = 66 // fd-routed GetStdHandle+WriteFile returning thunk |
| 39 | const NXT_ETHUNK_LEN: i64 = 13 // ExitProcess thunk |
| 40 | const NXT_TEXT_CAP: i64 = 0x200 |
| 41 | const NXT_RVA_TEXT: i64 = 0x1000 |
| 42 | const NXT_RVA_RDATA: i64 = 0x2000 |
| 43 | const NXT_RVA_IDATA: i64 = 0x3000 |
| 44 | const NXT_FOFF_TEXT: i64 = 0x200 |
| 45 | const NXT_FOFF_RDATA:i64 = 0x400 |
| 46 | const NXT_FOFF_IDATA:i64 = 0x600 |
| 47 | const NXT_IAT_GSH: i64 = 0x3048 |
| 48 | const NXT_IAT_WF: i64 = 0x3050 |
| 49 | const NXT_IAT_EXIT: i64 = 0x3058 |
functions
| 52 | func nxt_assemble(src: *u8, n: i64, out: *u8, out_cap: i64, p_main: *i64, p_sw: *i64, p_se: *i64) -> i64 |
| 92 | func nxt_emit_pe(buf: *u8, code: *u8, code_len: i64, main_off: i64, sw_off: i64, se_off: i64) -> i64 |
| 212 | func main() -> i64 |