nx_jpeg_census_oracle.nx source
↩ module page · 115 lines · 5216 B
1// nx_jpeg_census_oracle.nx -- per-assignment ORACLE STAGER for race 4 (JPEG marker census --
2// EMITTER-UNCOVERED ground when raced; B5's seed). Constructs a minimal synthetic JPEG
3// (SOI, APP0/JFIF, DQT, SOF2 *progressive*, DHT, SOS + entropy + EOI) and records every want
4// DURING construction -- ground truth by construction, no parser in the loop. Cases: real,
5// trunc (cut 3 bytes), garbage (zeros, no SOI). Writes TWO manifests for the generic referee:
6// /tmp/race_manifest_a.txt team lane A = covered-pattern attempt (_pe_lane_jpgtlv)
7// /tmp/race_manifest_b.txt team lane B = WIRE_MARKER lane (_pe_lane_jpgmk)
8// (stage the one to race as /tmp/race_manifest.txt). license_tier: ORIGINAL
9import "nx_syscalls.nx"
10import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc)
11
12func oj_puts(fd: i64, s: *u8) -> i64 {
13 var n: i64 = 0
14 while s[n] != (0 as u8) { n = n + 1 }
15 sys_write(fd, s, n)
16 return 0
17}
18
19// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer
20// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the
21// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls).
22// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign.
23func oj_putn(fd: i64, v: i64) -> i64 { nxi_fd(fd, v); return 0 }
24
25func oj_write_file(path: *u8, b: *u8, n: i64) -> i64 {
26 let fd: i64 = sys_openat_wr(path, 0x1a4)
27 if fd < 0 { return 0 - 1 }
28 if n > 0 { sys_write(fd, b, n) }
29 sys_close(fd)
30 return 0
31}
32
33// append one lengthed segment: FF <m> <len:2 incl> <payload len-2 filler>; returns new off;
34// records the content offset (after length) in rec[0]
35func oj_seg(img: *u8, off: i64, m: i64, payload: i64, rec: *i64) -> i64 {
36 img[off] = 0xFF as u8
37 img[off + 1] = m as u8
38 let l: i64 = payload + 2
39 img[off + 2] = ((l >> 8) & 0xff) as u8
40 img[off + 3] = (l & 0xff) as u8
41 rec[0] = off + 4
42 var i: i64 = 0
43 while i < payload { img[off + 4 + i] = (0x40 + i) as u8; i = i + 1 }
44 return off + 2 + l
45}
46
47func oj_row(fd: i64, casen: *u8, key: *u8, want: i64) -> i64 {
48 oj_puts(fd, "row \x00" as *u8)
49 oj_puts(fd, casen)
50 oj_puts(fd, " \x00" as *u8)
51 oj_puts(fd, key)
52 oj_puts(fd, " \x00" as *u8)
53 oj_putn(fd, want)
54 oj_puts(fd, "\n\x00" as *u8)
55 return 0
56}
57
58// write one manifest; team_elf selects lane A or B
59func oj_manifest(path: *u8, team_elf: *u8, wants: *i64) -> i64 {
60 let fd: i64 = sys_openat_wr(path, 0x1a4)
61 if fd < 0 { return 0 - 1 }
62 oj_puts(fd, "lane team \x00" as *u8)
63 oj_puts(fd, team_elf)
64 oj_puts(fd, "\n\x00" as *u8)
65 oj_puts(fd, "lane claude /tmp/_claude_jpeg_census.elf\n\x00" as *u8)
66 oj_puts(fd, "case real /tmp/race_jpeg.bin\n\x00" as *u8)
67 oj_puts(fd, "case trunc /tmp/race_jpeg_trunc.bin\n\x00" as *u8)
68 oj_puts(fd, "case garbage /tmp/race_jpeg_garbage.bin\n\x00" as *u8)
69 oj_row(fd, "real\x00" as *u8, "NSEG=\x00" as *u8, wants[0])
70 oj_row(fd, "real\x00" as *u8, "SOI=\x00" as *u8, wants[1])
71 oj_row(fd, "real\x00" as *u8, "APP0=\x00" as *u8, wants[2])
72 oj_row(fd, "real\x00" as *u8, "DQT=\x00" as *u8, wants[3])
73 oj_row(fd, "real\x00" as *u8, "SOF=\x00" as *u8, wants[4])
74 oj_row(fd, "real\x00" as *u8, "DHT=\x00" as *u8, wants[5])
75 oj_row(fd, "real\x00" as *u8, "SOS=\x00" as *u8, wants[6])
76 oj_row(fd, "trunc\x00" as *u8, "NSEG=\x00" as *u8, 0 - 1)
77 oj_row(fd, "garbage\x00" as *u8, "NSEG=\x00" as *u8, 0 - 1)
78 sys_close(fd)
79 return 0
80}
81
82func main() -> i64 {
83 let img: *u8 = sys_mmap(256)
84 let rec: *i64 = sys_mmap(16) as *i64
85 let wants: *i64 = sys_mmap(64) as *i64
86
87 // SOI (standalone) -- content offset = after marker
88 img[0] = 0xFF as u8; img[1] = 0xD8 as u8
89 wants[1] = 2
90 var off: i64 = 2
91 off = oj_seg(img, off, 0xE0, 14, rec); wants[2] = rec[0] // APP0/JFIF
92 off = oj_seg(img, off, 0xDB, 6, rec); wants[3] = rec[0] // DQT
93 off = oj_seg(img, off, 0xC2, 8, rec); wants[4] = rec[0] // SOF2 (progressive!)
94 off = oj_seg(img, off, 0xC4, 4, rec); wants[5] = rec[0] // DHT
95 off = oj_seg(img, off, 0xDA, 2, rec); wants[6] = rec[0] // SOS (terminator)
96 wants[0] = 6 // SOI..SOS
97 // entropy filler + EOI (past the terminator; census must have stopped)
98 img[off] = 0x12 as u8; img[off + 1] = 0x34 as u8
99 img[off + 2] = 0xFF as u8; img[off + 3] = 0xD9 as u8
100 let total: i64 = off + 4
101
102 if oj_write_file("/tmp/race_jpeg.bin\x00" as *u8, img, total) != 0 { return 7 }
103 if oj_write_file("/tmp/race_jpeg_trunc.bin\x00" as *u8, img, wants[5] + 1) != 0 { return 8 }
104 let g: *u8 = sys_mmap(16)
105 if oj_write_file("/tmp/race_jpeg_garbage.bin\x00" as *u8, g, 8) != 0 { return 9 }
106
107 if oj_manifest("/tmp/race_manifest_a.txt\x00" as *u8, "/tmp/_team_jpeg_a.elf\x00" as *u8, wants) != 0 { return 10 }
108 if oj_manifest("/tmp/race_manifest_b.txt\x00" as *u8, "/tmp/_team_jpeg_b.elf\x00" as *u8, wants) != 0 { return 11 }
109 oj_puts(1, "ORACLE-OK jpeg_bytes=\x00" as *u8)
110 oj_putn(1, total)
111 oj_puts(1, " nseg=\x00" as *u8)
112 oj_putn(1, wants[0])
113 oj_puts(1, " manifests=2\n\x00" as *u8)
114 return 0
115}