nx_fw_boot_proof_gate.nx source

1// nx_fw_boot_proof_gate.nx -- the never-brick CAPSTONE: the recovered firmware actually BOOTS. 2// 3// Closes the loop on a REAL artifact, EXECUTED in the sovereign emu (no qemu/laptop): 4// corrupt the real nx_boot_uefi.efi mid-flash -> golden-recover -> UNWRAP -> RUN in nx_emu_uefi 5// -> it prints NISHI (exit 0). 6// 7// REC : the corrupted flash auto-recovers from golden -> FW_RECOVERED 8// EXACT : the recovered payload is byte-identical to the .efi -> in-process compare 9// BOOTS : the recovered raw .efi EXECUTES + prints NISHI -> emu fork rc == 0 10// 11// GREEN only if all three hold. ONE emu fork+exec (the proven br_guarded execve idiom, blocking 12// wait): repeated fork+execs in a single process intermittently spawn-fail in this runtime, so 13// the emu runs ONCE on the recovered image. The emu's DISCRIMINATION (it rejects corrupt code: 14// "NOS-EXEC RED") is proven by nx_emu_uefi's own tamper-gate; the recovery rigor is the in-process 15// REC + byte-EXACT checks here + nx_fw_real_flash_gate. Evidence -> knowledge/status/fw_boot_proof_gate.log. 16// The emu must be pre-built: ./_offc/nx_sov_build_run.elf nx_emu_uefi 17// Sovereign: imports the safe-flash organ (-> nx_sha256) + nx_framed_append + nx_syscalls. license_tier: ORIGINAL 18import "nx_fw_safeflash.nx" 19import "nx_framed_append.nx" 20import "nx_syscalls.nx" 21 22const BP_LOG: *u8 = "knowledge/status/fw_boot_proof_gate.log" 23const BP_EFI: *u8 = "_offc/nx_boot_uefi.efi" 24const BP_EMU_ELF: *u8 = "/tmp/nx_emu_uefi.sov.elf" 25 26// fork+exec `elf a1` muted, BLOCKING wait; returns child exit / 128+sig / 125 spawn-fail. 27func bp_run(elf: *u8, a1: *u8) -> i64 { 28 let pid: i64 = sys_fork() 29 if pid < 0 { return 125 } 30 if pid == 0 { 31 let argv: *i64 = sys_mmap(32) as *i64 32 argv[0] = elf as i64; argv[1] = a1 as i64; argv[2] = 0 33 let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0 34 let dn: i64 = sys_openat_wr("/dev/null" as *u8, 0x1a4) 35 if dn >= 0 { sys_dup3(dn, 1, 0); sys_dup3(dn, 2, 0) } 36 sys_execve(elf, argv, envp) 37 sys_exit(127) 38 } 39 let st: *i64 = sys_mmap(16) as *i64 40 let w: i64 = sys_wait4(pid, st, 0) 41 if w < 0 { return 125 } 42 let sig: i64 = st[0] & 0x7f 43 if sig != 0 { return 128 + sig } 44 return (st[0] >> 8) & 0xff 45} 46 47func bp_row(name: *u8, pass: i64) -> i64 { 48 let buf: *u8 = sys_mmap(528) 49 var o: i64 = 0 50 o = fw_cat(buf, o, "FWBP row=\x00" as *u8) 51 o = fw_cat(buf, o, name) 52 if pass == 1 { o = fw_cat(buf, o, " verdict=PASS\x00" as *u8) } else { o = fw_cat(buf, o, " verdict=FAIL\x00" as *u8) } 53 buf[o] = 0 as u8 54 fa_appendz(BP_LOG, buf, 512) 55 fw_puts(" "); fw_puts(name) 56 if pass == 1 { fw_puts(" PASS\n") } else { fw_puts(" FAIL\n") } 57 return 0 58} 59 60func main() -> i64 { 61 fw_puts("fw-boot-proof gate (recovered firmware EXECUTES + boots in nx_emu_uefi)\n") 62 let epoch: i64 = sys_now_realtime_sec() 63 let pid: i64 = __syscall(39, 0, 0, 0, 0, 0, 0) 64 65 let lb: *i64 = sys_mmap(16) as *i64; lb[0] = 0 66 let efi: *u8 = fw_read(BP_EFI, lb) 67 let efi_len: i64 = lb[0] 68 var loaded: i64 = 0 69 if (efi as i64) != 0 { if efi_len > 100 { loaded = 1 } } 70 71 var rec: i64 = 0; var exact: i64 = 0; var boots: i64 = 0; var rc: i64 = 0 - 999 72 if loaded == 1 { 73 let g: *u8 = sys_mmap(256); let a: *u8 = sys_mmap(256); let nw: *u8 = sys_mmap(256); let ra: *u8 = sys_mmap(256) 74 fw_path(g, "/tmp/bpf_g." as *u8, epoch, pid); fw_path(a, "/tmp/bpf_a." as *u8, epoch, pid) 75 fw_path(nw, "/tmp/bpf_n." as *u8, epoch, pid); fw_path(ra, "/tmp/bpf_recovered_raw." as *u8, epoch, pid) 76 77 fw_make(g, efi, efi_len); fw_make(a, efi, efi_len); fw_make(nw, efi, efi_len) 78 79 // corrupt the flash -> sha256 catches it -> auto-restore from golden 80 let s2: i64 = fw_safe_flash(a, g, nw, 1) 81 if s2 == FW_RECOVERED { rec = 1 } 82 83 // unwrap the recovered active to a raw .efi 84 fw_unwrap(a, ra) 85 86 // EXACT: the recovered raw payload is byte-identical to the original real .efi 87 let alb: *i64 = sys_mmap(16) as *i64; alb[0] = 0 88 let abuf: *u8 = fw_read(ra, alb) 89 if (abuf as i64) != 0 { 90 if alb[0] == efi_len { 91 var same: i64 = 1; var i: i64 = 0 92 while i < efi_len { if abuf[i] != efi[i] { same = 0; i = efi_len } else { i = i + 1 } } 93 exact = same 94 } 95 } 96 97 // BOOTS: execute the recovered raw .efi in the sovereign emu -> rc==0 means it printed NISHI 98 rc = bp_run(BP_EMU_ELF, ra) 99 if rc == 0 { boots = 1 } 100 fw_puts(" recovered emu rc="); fw_putn(rc); fw_puts(" (0=boots NISHI); bytes="); fw_putn(efi_len); fw_puts("\n") 101 } 102 103 var passes: i64 = 0 104 if rec == 1 { passes = passes + 1 } 105 if exact == 1 { passes = passes + 1 } 106 if boots == 1 { passes = passes + 1 } 107 var green: i64 = 0 108 if passes == 3 { green = 1 } 109 110 bp_row("REC-corrupt-auto-recovered\x00" as *u8, rec) 111 bp_row("EXACT-recovered-bytes-real\x00" as *u8, exact) 112 bp_row("BOOTS-recovered-runs-NISHI\x00" as *u8, boots) 113 114 let vb: *u8 = sys_mmap(528) 115 var o: i64 = 0 116 o = fw_cat(vb, o, "FW-BOOT-PROOF verdict=\x00" as *u8) 117 if green == 1 { o = fw_cat(vb, o, "GREEN\x00" as *u8) } else { o = fw_cat(vb, o, "RED\x00" as *u8) } 118 o = fw_cat(vb, o, " passes=\x00" as *u8); o = fw_catn(vb, o, passes); o = fw_cat(vb, o, "/3 END\x00" as *u8) 119 vb[o] = 0 as u8 120 fa_appendz(BP_LOG, vb, 512) 121 fw_puts(vb); fw_puts("\n") 122 123 if green == 1 { return 0 } 124 return 1 125}