code wiki / _hdl_build / nx_esp_boot.nx
nx_esp_boot.nx source
↩ module page · 270 lines · 13088 B
1// nx_esp_boot.nx -- NOS-ESP-R1: the sovereign ESP READER -- the missing half of the
2// no-qemu boot preview (operator 2026-08-04: "get to the point i can use nishi emulator").
3//
4// nx_efi_fat32_image AUTHORS an MBR+FAT32 ESP; until now NOTHING sovereign could read one
5// back -- image-level boot proof leaned on OVMF+QEMU (kept as the EXTERNAL ORACLE; this
6// organ is the sovereign lane). It parses the image with geometry taken FROM THE IMAGE
7// (MBR partition LBA + BPB reserved/nfats/fatsz32/rootclus/sec-per-clus -- never the
8// writer's constants, so writer+reader are two implementations, not one), walks
9// root -> EFI -> BOOT -> BOOTX64.EFI FOLLOWING THE FAT CHAIN, extracts the payload,
10// structurally verifies it (MZ + PE + subsystem-10), and writes /tmp/nx_esp_extracted.efi
11// for the UNMODIFIED nx_emu_uefi to boot (single responsibility; no second emulator).
12// Compose: nx_esp_boot <img> then nx_emu_uefi /tmp/nx_esp_extracted.efi
13//
14// Self-teeth, ALL in-process on scratch copies EVERY invocation (non-vacuity built in):
15// T1 corrupt MBR signature -> must refuse T2 partition type != 0x0C -> must refuse
16// T3 corrupt BPB fs-type string -> must refuse T4 FAT chain broken -> must refuse
17// T5 payload first byte flipped -> must refuse (extracted image no longer MZ)
18// Usage: nx_esp_boot [img=_offc/nishi-boot.img] [out=/tmp/nx_esp_extracted.efi]
19// Log -> knowledge/status/nishi_os.log. Sovereign: syscalls only, no qemu/.sh. license_tier: ORIGINAL
20import "nx_syscalls.nx"
21const EB_MAGIC_1024: i64 = 1024
22const EB_MAGIC_4194304: i64 = 4194304
23
24const EB_OUTCAP: i64 = 4194304 // refuse payloads beyond 4MB (a boot stub is ~1KB)
25const EB_CHAINCAP: i64 = 70000 // FAT-chain step guard (> any valid chain in a 34MB volume)
26const EB_SEC: i64 = 512
27
28// geometry slots (parsed FROM the image; g = *i64 scratch)
29const G_VOLB: i64 = 0 // volume base byte offset
30const G_FATO: i64 = 1 // FAT #1 byte offset
31const G_DATB: i64 = 2 // data region byte offset (cluster 2)
32const G_BPC: i64 = 3 // bytes per cluster
33const G_ROOTC: i64 = 4 // root directory first cluster
34
35func b_r16(b: *u8, off: i64) -> i64 { return (b[off] as i64) | ((b[off+1] as i64) << 8) }
36func b_r32(b: *u8, off: i64) -> i64 {
37 return (b[off] as i64) | ((b[off+1] as i64) << 8) | ((b[off+2] as i64) << 16) | ((b[off+3] as i64) << 24)
38}
39func clus_off(g: *i64, c: i64) -> i64 { return g[G_DATB] + (c - 2) * g[G_BPC] }
40func fat_next(img: *u8, g: *i64, c: i64) -> i64 { return b_r32(img, g[G_FATO] + c * 4) & 0x0FFFFFFF }
41
42// 11-byte 8.3 name match
43func nm11(img: *u8, off: i64, want: *u8) -> i64 {
44 var i: i64 = 0
45 while i < 11 { if img[off + i] != want[i] { return 0 } i = i + 1 }
46 return 1
47}
48
49// find `name` in the directory whose chain starts at dirclus; returns first cluster or 0-miss;
50// file size (bytes) written to szp[0]
51func dir_find(img: *u8, g: *i64, dirclus: i64, name: *u8, szp: *i64) -> i64 {
52 var c: i64 = dirclus
53 var guard: i64 = 0
54 while guard < EB_CHAINCAP {
55 guard = guard + 1
56 if c < 2 { return 0 }
57 if c >= 0x0FFFFFF8 { return 0 }
58 let base: i64 = clus_off(g, c)
59 let nent: i64 = g[G_BPC] / 32
60 var e: i64 = 0
61 while e < nent {
62 let eo: i64 = base + e * 32
63 if (img[eo] as i64) == 0 { return 0 } // end-of-directory marker
64 if nm11(img, eo, name) == 1 {
65 szp[0] = b_r32(img, eo + 28)
66 return (b_r16(img, eo + 20) << 16) | b_r16(img, eo + 26)
67 }
68 e = e + 1
69 }
70 c = fat_next(img, g, c)
71 }
72 return 0
73}
74
75// parse + walk + extract; returns payload length or 0-err
76// -1 img too short -2 MBR sig -3 partition type -4 partition LBA out of range
77// -5 BPB fs-type -6 geometry insane -7 /EFI missing
78// -8 /EFI/BOOT missing -9 BOOTX64.EFI missing -10 payload too big
79// -11 FAT chain broken -12 extracted not MZ/PE/subsystem-10
80func esp_extract(img: *u8, imglen: i64, g: *i64, out: *u8) -> i64 {
81 if imglen < EB_MAGIC_4194304 { return 0 - 1 }
82 if (img[510] as i64) != 0x55 { return 0 - 2 }
83 if (img[511] as i64) != 0xAA { return 0 - 2 }
84 // GPT (FS-1): the disk is now GPT, so the MBR is PROTECTIVE (type 0xEE) and carries no real
85 // geometry. The partition start comes from the GPT entry array, and the header signature is
86 // checked first -- reading LBAs out of a table we have not identified is how a reader invents
87 // a filesystem. We deliberately do NOT accept the old 0x0C MBR any more: two accepted layouts
88 // means the one you did not test is the one that ships.
89 if (img[446 + 4] as i64) != 0xEE { return 0 - 3 } // protective MBR only
90 let gsig: *u8 = "EFI PART" as *u8
91 var gi: i64 = 0
92 while gi < 8 { if (img[512 + gi] as i64) != (gsig[gi] as i64) { return 0 - 3 } gi = gi + 1 }
93 // entry 0's PartitionTypeGUID must be the EFI System Partition GUID, first four bytes are
94 // enough to separate it from every other type we would refuse to boot from.
95 if (img[EB_MAGIC_1024 + 0] as i64) != 0x28 { return 0 - 3 }
96 if (img[EB_MAGIC_1024 + 1] as i64) != 0x73 { return 0 - 3 }
97 if (img[EB_MAGIC_1024 + 2] as i64) != 0x2A { return 0 - 3 }
98 if (img[EB_MAGIC_1024 + 3] as i64) != 0xC1 { return 0 - 3 }
99 let lba: i64 = b_r32(img, EB_MAGIC_1024 + 32) // StartingLBA from the GPT entry
100 let volb: i64 = lba * EB_SEC
101 if volb <= 0 { return 0 - 4 }
102 if volb >= imglen { return 0 - 4 }
103 // FAT32 BPB -- every figure read from the image
104 if (img[volb + 82] as i64) != 70 { return 0 - 5 } // 'F'
105 if (img[volb + 83] as i64) != 65 { return 0 - 5 } // 'A'
106 if (img[volb + 84] as i64) != 84 { return 0 - 5 } // 'T'
107 if (img[volb + 85] as i64) != 51 { return 0 - 5 } // '3'
108 if (img[volb + 86] as i64) != 50 { return 0 - 5 } // '2'
109 let bps: i64 = b_r16(img, volb + 11)
110 let spc: i64 = img[volb + 13] as i64
111 let resv: i64 = b_r16(img, volb + 14)
112 let nfat: i64 = img[volb + 16] as i64
113 let fatsz: i64 = b_r32(img, volb + 36)
114 let rootc: i64 = b_r32(img, volb + 44)
115 if bps != EB_SEC { return 0 - 6 }
116 if spc < 1 { return 0 - 6 }
117 if resv < 1 { return 0 - 6 }
118 if nfat < 1 { return 0 - 6 }
119 if fatsz < 1 { return 0 - 6 }
120 if rootc < 2 { return 0 - 6 }
121 g[G_VOLB] = volb
122 g[G_FATO] = volb + resv * bps
123 g[G_DATB] = volb + (resv + nfat * fatsz) * bps
124 g[G_BPC] = spc * bps
125 g[G_ROOTC] = rootc
126 if g[G_DATB] >= imglen { return 0 - 6 }
127 // walk root -> EFI -> BOOT -> BOOTX64.EFI
128 let szp: *i64 = sys_mmap(16) as *i64
129 szp[0] = 0
130 let c_efi: i64 = dir_find(img, g, rootc, "EFI " as *u8, szp)
131 if c_efi == 0 { return 0 - 7 }
132 let c_boot: i64 = dir_find(img, g, c_efi, "BOOT " as *u8, szp)
133 if c_boot == 0 { return 0 - 8 }
134 let c_file: i64 = dir_find(img, g, c_boot, "BOOTX64 EFI" as *u8, szp)
135 if c_file == 0 { return 0 - 9 }
136 let fsize: i64 = szp[0]
137 if fsize <= 0 { return 0 - 9 }
138 if fsize > EB_OUTCAP { return 0 - 10 }
139 // extract by FOLLOWING THE FAT CHAIN (never assume contiguity)
140 var left: i64 = fsize
141 var c: i64 = c_file
142 var w: i64 = 0
143 var guard: i64 = 0
144 while left > 0 {
145 guard = guard + 1
146 if guard > EB_CHAINCAP { return 0 - 11 }
147 if c < 2 { return 0 - 11 }
148 if c >= 0x0FFFFFF8 { return 0 - 11 } // chain ended before the bytes did
149 let src: i64 = clus_off(g, c)
150 var take: i64 = g[G_BPC]
151 if take > left { take = left }
152 var i: i64 = 0
153 while i < take { out[w + i] = img[src + i]; i = i + 1 }
154 w = w + take
155 left = left - take
156 c = fat_next(img, g, c)
157 }
158 // structural verify: MZ + PE + subsystem 10 (EFI application)
159 if (out[0] as i64) != 0x4D { return 0 - 12 }
160 if (out[1] as i64) != 0x5A { return 0 - 12 }
161 let pesig: i64 = b_r32(out, 0x3C)
162 if pesig + 4 >= fsize { return 0 - 12 }
163 if b_r32(out, pesig) != 0x00004550 { return 0 - 12 }
164 if b_r16(out, 0x98 + 68) != 10 { return 0 - 12 }
165 return fsize
166}
167
168func e_p(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(1, s, n); return 0 }
169func e_fp(fd: i64, s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } sys_write(fd, s, n); return 0 }
170func e_n(fd: i64, v: i64) -> i64 {
171 let bb: *u8 = sys_mmap(28); var m: i64 = v
172 var neg: i64 = 0
173 if m < 0 { neg = 1; m = 0 - m }
174 let t: *u8 = sys_mmap(28); var k: i64 = 0
175 if m == 0 { t[0] = 48; k = 1 }
176 while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
177 var i: i64 = 0
178 if neg == 1 { bb[0] = 45; i = 1 }
179 var j: i64 = 0
180 while j < k { bb[i] = t[k - 1 - j]; i = i + 1; j = j + 1 }
181 sys_write(fd, bb, i); return 0
182}
183
184func img_copy(dst: *u8, src: *u8, n: i64) -> i64 {
185 var i: i64 = 0
186 while i < n { dst[i] = src[i]; i = i + 1 }
187 return 0
188}
189
190// one tamper tooth: copy, mutate one thing, extraction MUST return an error
191func tooth(name: *u8, scratch: *u8, img: *u8, imglen: i64, g: *i64, out: *u8, mut_off: i64, mut_val: i64) -> i64 {
192 img_copy(scratch, img, imglen)
193 scratch[mut_off] = mut_val as u8
194 let r: i64 = esp_extract(scratch, imglen, g, out)
195 e_p(" " as *u8); e_p(name)
196 if r < 0 { e_p(" refused(" as *u8); e_n(1, r); e_p(") PASS\n" as *u8); return 1 }
197 e_p(" ACCEPTED A TAMPERED IMAGE -- FAIL\n" as *u8)
198 return 0
199}
200
201func main(argc: i64, argv: *i64) -> i64 {
202 var path: *u8 = "_offc/nishi-boot.img" as *u8
203 if argc >= 2 { path = argv[1] as *u8 }
204 var outpath: *u8 = "/tmp/nx_esp_extracted.efi" as *u8
205 if argc >= 3 { outpath = argv[2] as *u8 }
206
207 let lenp: *i64 = sys_mmap(16) as *i64
208 let img: *u8 = sys_read_file(path, lenp)
209 let imglen: i64 = lenp[0]
210 if imglen <= 0 { e_p("NOS-ESP REFUSED: cannot read " as *u8); e_p(path); e_p("\n" as *u8); sys_exit(2); return 2 }
211
212 let g: *i64 = sys_mmap(64) as *i64
213 let out: *u8 = sys_mmap(EB_OUTCAP)
214 e_p("NOS-ESP: sovereign ESP reader (geometry FROM the image, FAT-chain walk)\n" as *u8)
215 let flen: i64 = esp_extract(img, imglen, g, out)
216 if flen < 0 {
217 e_p("NOS-ESP RED: clean image refused, err=" as *u8); e_n(1, flen); e_p("\n" as *u8)
218 sys_exit(1); return 1
219 }
220 e_p(" parsed: vol_base=" as *u8); e_n(1, g[G_VOLB])
221 e_p(" fat_off=" as *u8); e_n(1, g[G_FATO])
222 e_p(" data_base=" as *u8); e_n(1, g[G_DATB])
223 e_p(" bytes_per_cluster=" as *u8); e_n(1, g[G_BPC])
224 e_p(" root_cluster=" as *u8); e_n(1, g[G_ROOTC])
225 e_p("\n extracted BOOTX64.EFI bytes=" as *u8); e_n(1, flen)
226 e_p(" (MZ+PE+subsystem-10 verified)\n" as *u8)
227
228 // ---- the 5 teeth, every run, on scratch copies ----
229 let scratch: *u8 = sys_mmap(imglen + EB_SEC)
230 var teeth: i64 = 0
231 teeth = teeth + tooth("T1 mbr-sig" as *u8, scratch, img, imglen, g, out, 510, 0)
232 teeth = teeth + tooth("T2 gpt-sig" as *u8, scratch, img, imglen, g, out, 513, 0x58)
233 teeth = teeth + tooth("T3 bpb-fstype" as *u8, scratch, img, imglen, g, out, g[G_VOLB] + 82, 88)
234 // T4: break the payload's FAT chain -- first FAT entry of the file's cluster run.
235 // find the file's first cluster again on the CLEAN image to aim the mutation
236 let szp: *i64 = sys_mmap(16) as *i64
237 let c_efi: i64 = dir_find(img, g, g[G_ROOTC], "EFI " as *u8, szp)
238 let c_boot: i64 = dir_find(img, g, c_efi, "BOOT " as *u8, szp)
239 let c_file: i64 = dir_find(img, g, c_boot, "BOOTX64 EFI" as *u8, szp)
240 teeth = teeth + tooth("T4 fat-chain" as *u8, scratch, img, imglen, g, out, g[G_FATO] + c_file * 4, 0)
241 teeth = teeth + tooth("T5 payload-mz" as *u8, scratch, img, imglen, g, out, clus_off(g, c_file), 0)
242
243 // re-extract clean (teeth used `out`) and persist for nx_emu_uefi
244 let flen2: i64 = esp_extract(img, imglen, g, out)
245 var ok: i64 = 0
246 if flen2 == flen { if teeth == 5 { ok = 1 } }
247 if ok == 1 {
248 let ofd: i64 = sys_openat_wr(outpath, 0x1a4)
249 if ofd < 0 { e_p("NOS-ESP RED: cannot write " as *u8); e_p(outpath); e_p("\n" as *u8); sys_exit(1); return 1 }
250 sys_write(ofd, out, flen2)
251 sys_close(ofd)
252 }
253 let lf: i64 = sys_openat_append("knowledge/status/nishi_os.log" as *u8, 0x1a4)
254 if lf >= 0 {
255 e_fp(lf, "NOSESP name=" as *u8); e_fp(lf, path)
256 e_fp(lf, " reader=sovereign-fat32 geometry=from-image efi_bytes=" as *u8); e_n(lf, flen)
257 e_fp(lf, " teeth=" as *u8); e_n(lf, teeth)
258 e_fp(lf, "of5 out=" as *u8); e_fp(lf, outpath)
259 e_fp(lf, " verdict=" as *u8)
260 if ok == 1 { e_fp(lf, "GREEN\n" as *u8) } else { e_fp(lf, "RED\n" as *u8) }
261 sys_close(lf)
262 }
263 if ok == 1 {
264 e_p("NOS-ESP GREEN: teeth=5of5, payload at " as *u8); e_p(outpath)
265 e_p(" -- boot it: nx_emu_uefi " as *u8); e_p(outpath); e_p("\n" as *u8)
266 sys_exit(0); return 0
267 }
268 e_p("NOS-ESP RED: teeth=" as *u8); e_n(1, teeth); e_p("of5\n" as *u8)
269 sys_exit(1); return 1
270}