nx_drm_audit_test.nx source
↩ module page · 51 lines · 3484 B
1// nx_drm_audit_test.nx -- gate for the DRM auditor (nx_drm_audit). Grounded in the researcher's cited cases.
2// Unique exit codes per invariant:
3// 1-4 Brother (chipless TN-630, says EMPTY but our coverage says 99.91%) -> FAKE_EMPTY + FIRMWARE_BLOCK,
4// NOT chip; bypass = Continue + refuse-firmware (exactly what we LIVE-PROVED on the real Brother)
5// 10-12 chipped HP fake-empty -> FAKE_EMPTY + FIRMWARE_BLOCK + CHIP; chip bypass = external reset
6// 20-21 NEG control: genuinely empty (coverage also 0) -> NO fake-empty cry (honest), firmware-block only
7// 30 NEG: no vendor-block + chipless + not-empty -> NO DRM
8// 40-44 NEVER-BRICK (#26) proven mechanically: every recommended bypass writes ZERO firmware; the dangerous
9// firmware-downgrade action is flagged 1 (so the check isn't trivially-always-0) and is NEVER emitted
10// expect_exit: 0 ; license_tier: ORIGINAL ; genealogy_id: project-printer-management-ipp-sclass-2026-06-20
11
12import "nx_syscalls.nx"
13import "nx_drm_audit.nx"
14
15func t_puts(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
16
17func main() -> i64 {
18 // ===== Brother live case: chipless, reports EMPTY, our coverage says 99.91% (9991 bp) =====
19 let bf: i64 = nx_drm_classify(NX_DRMV_BROTHER, 0, 1, 9991)
20 if bf != (NX_DRM_FAKE_EMPTY | NX_DRM_FIRMWARE_BLOCK) { return 1 }
21 if (bf & NX_DRM_CHIP) != 0 { return 2 } // chipless TN-630 -> no chip DRM
22 if nx_drm_bypass_for(NX_DRM_FAKE_EMPTY) != NX_BYP_CONTINUE_MODE { return 3 }
23 if nx_drm_bypass_for(NX_DRM_FIRMWARE_BLOCK) != NX_BYP_REFUSE_FIRMWARE { return 4 }
24
25 // ===== chipped HP fake-empty (says empty, 80% remains) =====
26 let hf: i64 = nx_drm_classify(NX_DRMV_HP, 1, 1, 8000)
27 if hf != (NX_DRM_FAKE_EMPTY | NX_DRM_FIRMWARE_BLOCK | NX_DRM_CHIP) { return 10 }
28 if nx_drm_flag_count(hf) != 3 { return 11 }
29 if nx_drm_bypass_for(NX_DRM_CHIP) != NX_BYP_CHIP_RESET { return 12 }
30
31 // ===== NEG control: genuinely empty (coverage ALSO 0) -> do NOT falsely cry fake-empty =====
32 let ef: i64 = nx_drm_classify(NX_DRMV_BROTHER, 0, 1, 0)
33 if (ef & NX_DRM_FAKE_EMPTY) != 0 { return 20 } // honest: genuinely empty, not DRM
34 if ef != NX_DRM_FIRMWARE_BLOCK { return 21 }
35
36 // ===== NEG: no vendor-block + chipless + not-empty -> no DRM =====
37 if nx_drm_classify(NX_DRMV_UNKNOWN, 0, 0, 10000) != NX_DRM_NONE { return 30 }
38
39 // ===== NEVER-BRICK (#26), proven mechanically =====
40 if nx_drm_bypass_writes_firmware(NX_BYP_CONTINUE_MODE) != 0 { return 40 }
41 if nx_drm_bypass_writes_firmware(NX_BYP_REFUSE_FIRMWARE) != 0 { return 41 }
42 if nx_drm_bypass_writes_firmware(NX_BYP_CHIP_RESET) != 0 { return 42 }
43 if nx_drm_bypass_writes_firmware(NX_BYP_FIRMWARE_DOWNGRADE) != 1 { return 43 } // the check discriminates
44 // the recommender NEVER emits a firmware-writing action for ANY DRM flag:
45 if nx_drm_bypass_writes_firmware(nx_drm_bypass_for(NX_DRM_FAKE_EMPTY)) != 0 { return 44 }
46 if nx_drm_bypass_writes_firmware(nx_drm_bypass_for(NX_DRM_FIRMWARE_BLOCK)) != 0 { return 44 }
47 if nx_drm_bypass_writes_firmware(nx_drm_bypass_for(NX_DRM_CHIP)) != 0 { return 44 }
48
49 t_puts("nx_drm_audit: PASS Brother=FAKE_EMPTY+FIRMWARE_BLOCK (Continue+refuse-fw, live-proven) · chipped HP +CHIP (reset) · genuinely-empty NOT cried as DRM · NEVER-BRICK: no bypass writes firmware (#26 mechanical)\n")
50 return 0
51}