nx_fw_real_flash_gate.nx source

1// nx_fw_real_flash_gate.nx -- never-brick golden recovery on a REAL UEFI artifact. 2// 3// Proves the safe-flash mechanism (sovereign sha256 integrity + dual-image golden recovery) 4// works on the ACTUAL sovereign UEFI boot stub _offc/nx_boot_uefi.efi (a 1024-byte PE32+ 5// EFI_APPLICATION emitted by nx_boot_uefi), not just a synthetic payload: 6// 7// T0 real-efi-loaded : _offc/nx_boot_uefi.efi reads as a non-trivial image 8// T1 clean-reflash-ok : re-flash the real image cleanly -> FW_OK + bootable 9// N2 midflash-recovered : corrupt the real image mid-flash -> FW_RECOVERED + bootable 10// T2 recovered-bytes-exact: the recovered payload is BYTE-IDENTICAL to the original .efi 11// 12// GREEN only if all four hold. Evidence -> knowledge/status/fw_real_flash_gate.log. 13// HONEST: the image is still NXFW-wrapped (sha256 over the real .efi bytes); it is NOT yet 14// BOOTED inside nx_emu_uefi (that execution-proof is the next sub-rung). 15// Sovereign: imports the safe-flash organ (-> nx_sha256) + nx_framed_append + nx_syscalls. 16// license_tier: ORIGINAL 17import "nx_fw_safeflash.nx" 18import "nx_framed_append.nx" 19import "nx_syscalls.nx" 20 21const RF_LOG: *u8 = "knowledge/status/fw_real_flash_gate.log" 22const RF_EFI: *u8 = "_offc/nx_boot_uefi.efi" 23 24func rf_row(name: *u8, pass: i64) -> i64 { 25 let buf: *u8 = sys_mmap(528) 26 var o: i64 = 0 27 o = fw_cat(buf, o, "FWRF row=\x00" as *u8) 28 o = fw_cat(buf, o, name) 29 if pass == 1 { o = fw_cat(buf, o, " verdict=PASS\x00" as *u8) } else { o = fw_cat(buf, o, " verdict=FAIL\x00" as *u8) } 30 buf[o] = 0 as u8 31 fa_appendz(RF_LOG, buf, 512) 32 fw_puts(" "); fw_puts(name) 33 if pass == 1 { fw_puts(" PASS\n") } else { fw_puts(" FAIL\n") } 34 return 0 35} 36 37func main() -> i64 { 38 fw_puts("fw-real-flash gate (never-brick golden recovery on the REAL nx_boot_uefi.efi)\n") 39 let epoch: i64 = sys_now_realtime_sec() 40 let pid: i64 = __syscall(39, 0, 0, 0, 0, 0, 0) 41 42 // ---- T0: load the real UEFI boot stub ---- 43 let lb: *i64 = sys_mmap(16) as *i64; lb[0] = 0 44 let efi: *u8 = sys_read_file(RF_EFI, lb) 45 let efi_len: i64 = lb[0] 46 var t0: i64 = 0 47 if (efi as i64) != 0 { if efi_len > 100 { t0 = 1 } } 48 fw_puts(" real .efi = "); fw_puts(RF_EFI); fw_puts(" bytes="); fw_putn(efi_len); fw_puts("\n") 49 50 var t1: i64 = 0; var n2: i64 = 0; var ex: i64 = 0 51 if t0 == 1 { 52 let g: *u8 = sys_mmap(256); let a: *u8 = sys_mmap(256); let nw: *u8 = sys_mmap(256) 53 fw_path(g, "/tmp/rf_g." as *u8, epoch, pid); fw_path(a, "/tmp/rf_a." as *u8, epoch, pid); fw_path(nw, "/tmp/rf_n." as *u8, epoch, pid) 54 55 // wrap the REAL .efi bytes as golden / active / new firmware images (sha256-protected) 56 fw_make(g, efi, efi_len); fw_make(a, efi, efi_len); fw_make(nw, efi, efi_len) 57 58 // T1 clean re-flash of the real image 59 let s1: i64 = fw_safe_flash(a, g, nw, 0) 60 if s1 == FW_OK { if fw_bootable(a) == 1 { t1 = 1 } } 61 62 // N2 corrupt the real image mid-flash -> sha256 catches it -> auto-restore from golden 63 fw_make(a, efi, efi_len) // reset active to a good real image 64 let s2: i64 = fw_safe_flash(a, g, nw, 1) 65 if s2 == FW_RECOVERED { if fw_bootable(a) == 1 { n2 = 1 } } 66 67 // T2 the recovered payload is byte-identical to the original .efi (exact recovery) 68 let alb: *i64 = sys_mmap(16) as *i64; alb[0] = 0 69 let abuf: *u8 = sys_read_file(a, alb) 70 if (abuf as i64) != 0 { 71 let aplen: i64 = fw_rd_u32(abuf, 4) 72 if aplen == efi_len { 73 var same: i64 = 1; var i: i64 = 0 74 while i < efi_len { if abuf[8 + i] != efi[i] { same = 0; i = efi_len } else { i = i + 1 } } 75 ex = same 76 } 77 } 78 } 79 80 var passes: i64 = 0 81 if t0 == 1 { passes = passes + 1 } 82 if t1 == 1 { passes = passes + 1 } 83 if n2 == 1 { passes = passes + 1 } 84 if ex == 1 { passes = passes + 1 } 85 var green: i64 = 0 86 if passes == 4 { green = 1 } 87 88 rf_row("T0-real-efi-loaded \x00" as *u8, t0) 89 rf_row("T1-clean-reflash-ok \x00" as *u8, t1) 90 rf_row("N2-midflash-recovered \x00" as *u8, n2) 91 rf_row("T2-recovered-bytes-exact\x00" as *u8, ex) 92 93 let vb: *u8 = sys_mmap(528) 94 var o: i64 = 0 95 o = fw_cat(vb, o, "FW-REAL-FLASH verdict=\x00" as *u8) 96 if green == 1 { o = fw_cat(vb, o, "GREEN\x00" as *u8) } else { o = fw_cat(vb, o, "RED\x00" as *u8) } 97 o = fw_cat(vb, o, " passes=\x00" as *u8); o = fw_catn(vb, o, passes); o = fw_cat(vb, o, "/4 END\x00" as *u8) 98 vb[o] = 0 as u8 99 fa_appendz(RF_LOG, vb, 512) 100 fw_puts(vb); fw_puts("\n") 101 102 if green == 1 { return 0 } 103 return 1 104}