nx_nxe.nx source

1// nx_nxe.nx -- the SOVEREIGN NISHI EXECUTABLE FORMAT (NXE). Our OWN file -- NOT an ELF knockoff. A UNIQUE exceed: 2// it bakes in what ELF/Mach-O/PE LACK by default -- 3// (1) INTEGRITY by construction: a content hash of the code section in the header; the loader VERIFIES it and 4// REFUSES tampered binaries (ELF/Mach-O/PE have no built-in integrity -- they rely on external signing). 5// (2) CAPABILITY MANIFEST (capability-based security, ef_capsec.raw): the binary DECLARES its caps (file/net/exec/ 6// raw-hw); the loader enforces least-privilege -- an undeclared cap is denied. (ELF declares nothing.) 7// (3) NEVER-BRICK tag (cardinal 26 IN THE FORMAT): a binary flagged HW_WRITE is REFUSED unless it carries a 8// never-brick guarantee. The brand-critical law enforced at load, by construction. 9// Layout (8-byte fields): [0]magic'NXE1' [8]version [16]arch [24]flags [32]caps [40]entry [48]code_off=80 [56]code_len [64]code_hash ; code@80. 10// Writer + loader/verifier. ELF stays ONLY as last-mile to run under Linux until our own boot/loader. 11// T1 write/load roundtrip. T2 integrity (verify ok; tampered code -> rejected). T3 capability (declared allowed, undeclared denied). 12// T4 never-brick (HW_WRITE without a never-brick guarantee -> REFUSED; with it -> loads). 13// expect_exit: 0 Sovereign: nx_syscalls. 14import "nx_syscalls.nx" 15import "nx_itoa_lib.nx" // shared MSB-first emitter (zero-alloc) 16const K_MAGIC_5381: i64 = 5381 17const K_MAGIC_4096: i64 = 4096 18 19func g_puts(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 } 20// MIGRATED to the shared emitter (debt 1785563586). The old body mmapped a scratch buffer 21// per call and never freed it. At PAGE granularity that is 4096B leaked PER CALL -- the 22// defect that took 28.5GB of a 36GB host in nx_ts_lumadiff (2MB input, ~3.66M calls). 23// nxi_* is MSB-first, allocates NOTHING, and emits identical bytes including the sign. 24func g_pn(v: i64) -> i64 { nxi_out(v); return 0 } 25func ck(name: *u8, c: i64) -> i64 { if c==1 { g_puts(" PASS " as *u8) } else { g_puts(" FAIL " as *u8) } g_puts(name); g_puts("\n" as *u8); return c } 26func have(path: *u8) -> i64 { let fd: i64=sys_openat_rd(path); if fd<0 { return 0 } sys_close(fd); return 1 } 27func p64(m: *u8, o: i64, v: i64) -> i64 { var i: i64=0; while i<8 { m[o+i]=((v>>(i*8))&255) as u8; i=i+1 } return 0 } 28func r64(m: *u8, o: i64) -> i64 { var v: i64=0; var i: i64=0; while i<8 { v=v|((m[o+i] as i64)<<(i*8)); i=i+1 } return v } 29func code_hash(m: *u8, off: i64, n: i64) -> i64 { var h: i64=K_MAGIC_5381; var i: i64=0; while i<n { h=((h<<5)+h)+(m[off+i] as i64); i=i+1 } return h } // djb2 over the code 30 31const HOFF: i64 = 80 // code offset 32// flags: HW_WRITE=1, NEVER_BRICK_PROVEN=2 ; caps: FILE_READ=1 FILE_WRITE=2 NET=4 EXEC=8 RAW_HW=16 33func nxe_write(m: *u8, arch: i64, flags: i64, caps: i64, entry: i64, code: *u8, clen: i64) -> i64 { 34 m[0]=0x4E as u8; m[1]=0x58 as u8; m[2]=0x45 as u8; m[3]=0x31 as u8 // 'NXE1' 35 p64(m,8,1); p64(m,16,arch); p64(m,24,flags); p64(m,32,caps); p64(m,40,entry); p64(m,48,HOFF); p64(m,56,clen) 36 var i: i64=0; while i<clen { m[HOFF+i]=code[i]; i=i+1 } 37 p64(m,64, code_hash(m,HOFF,clen)) 38 return HOFF+clen 39} 40func nxe_magic_ok(m: *u8) -> i64 { if m[0]==(0x4E as u8) { if m[1]==(0x58 as u8) { if m[2]==(0x45 as u8) { if m[3]==(0x31 as u8) { return 1 } } } } return 0 } 41func nxe_integrity_ok(m: *u8) -> i64 { let clen: i64=r64(m,56); if code_hash(m,HOFF,clen)==r64(m,64) { return 1 } return 0 } 42func nxe_may(m: *u8, cap: i64) -> i64 { return (r64(m,32)>>cap)&1 } // cap = bit index 43// load: 0=ok, -1 bad magic, -2 integrity fail, -3 never-brick violation (HW_WRITE without NEVER_BRICK_PROVEN) 44func nxe_load(m: *u8) -> i64 { 45 if nxe_magic_ok(m)==0 { return 0-1 } 46 if nxe_integrity_ok(m)==0 { return 0-2 } 47 let flags: i64=r64(m,24) 48 if (flags&1)==1 { if (flags&2)==0 { return 0-3 } } // declares HW_WRITE but no never-brick guarantee -> REFUSE 49 return 0 50} 51 52func main() -> i64 { 53 g_puts("nx_nxe (SOVEREIGN Nishi Executable format: our own file, integrity+capability+never-brick baked in -- not ELF)\n" as *u8) 54 var pass: i64=0; var total: i64=0 55 let m: *u8 = sys_mmap(K_MAGIC_4096) 56 57 // T1: write (arch=1 rv64, flags=0, caps=FILE_READ|NET=5, entry 0) + load roundtrip 58 nxe_write(m, 1, 0, 5, 0, "rv64-payload-bytes" as *u8, 18) 59 let ld: i64=nxe_load(m) 60 var t1: i64=0; if nxe_magic_ok(m)==1 { if r64(m,8)==1 { if r64(m,16)==1 { if r64(m,32)==5 { if ld==0 { t1=1 } } } } } 61 g_puts(" T1 wrote NXE (magic NXE1, ver "); g_pn(r64(m,8)); g_puts(", arch "); g_pn(r64(m,16)); g_puts(", caps "); g_pn(r64(m,32)); g_puts("); load="); g_pn(ld); g_puts("\n" as *u8) 62 pass=pass+ck("T1: write/load roundtrip -- own magic 'NXE1', self-describing header" as *u8, t1); total=total+1 63 // write to disk (a real .nxe file) 64 let fd: i64=sys_openat_wr("knowledge/nxe_hello.nxe" as *u8, 0x1ed); if fd>=0 { sys_write(fd,m,HOFF+18); sys_close(fd) } 65 66 // T2 INTEGRITY: ok now; tamper a code byte -> integrity fails -> load rejects 67 let ok_before: i64=nxe_integrity_ok(m) 68 m[HOFF+3] = (m[HOFF+3] ^ (0xFF as u8)) // tamper the code 69 let ok_after: i64=nxe_integrity_ok(m); let ld_t: i64=nxe_load(m) 70 m[HOFF+3] = (m[HOFF+3] ^ (0xFF as u8)) // restore 71 var t2: i64=0; if ok_before==1 { if ok_after==0 { if ld_t==(0-2) { t2=1 } } } 72 g_puts(" T2 integrity: verify-before="); g_pn(ok_before); g_puts(" verify-after-tamper="); g_pn(ok_after); g_puts(" load-tampered="); g_pn(ld_t); g_puts(" (-2=integrity reject)\n" as *u8) 73 pass=pass+ck("T2: INTEGRITY by construction -- code hash verified; a tampered binary is REJECTED (ELF cannot do this)" as *u8, t2); total=total+1 74 75 // T3 CAPABILITY: declared caps=FILE_READ|NET (bits 0,2). FILE_READ allowed, FILE_WRITE(bit1) denied. 76 var t3: i64=0; if nxe_may(m,0)==1 { if nxe_may(m,2)==1 { if nxe_may(m,1)==0 { if nxe_may(m,4)==0 { t3=1 } } } } 77 g_puts(" T3 capability manifest: FILE_READ="); g_pn(nxe_may(m,0)); g_puts(" NET="); g_pn(nxe_may(m,2)); g_puts(" FILE_WRITE(undeclared)="); g_pn(nxe_may(m,1)); g_puts(" RAW_HW(undeclared)="); g_pn(nxe_may(m,4)); g_puts("\n" as *u8) 78 pass=pass+ck("T3: CAPABILITY manifest -- declared caps allowed, undeclared DENIED (least-privilege by construction)" as *u8, t3); total=total+1 79 80 // T4 NEVER-BRICK: a HW_WRITE binary WITHOUT a never-brick guarantee is REFUSED; WITH it, loads. 81 let mb: *u8=sys_mmap(K_MAGIC_4096); nxe_write(mb, 1, 1, 16, 0, "hw-writer" as *u8, 9) // flags=HW_WRITE(1), caps=RAW_HW 82 let ld_hw: i64=nxe_load(mb) 83 let mg: *u8=sys_mmap(K_MAGIC_4096); nxe_write(mg, 1, 3, 16, 0, "hw-writer" as *u8, 9) // flags=HW_WRITE|NEVER_BRICK_PROVEN(3) 84 let ld_hwok: i64=nxe_load(mg) 85 var t4: i64=0; if ld_hw==(0-3) { if ld_hwok==0 { t4=1 } } 86 g_puts(" T4 never-brick: HW_WRITE w/o guarantee load="); g_pn(ld_hw); g_puts(" (-3=refused); HW_WRITE+never-brick-proven load="); g_pn(ld_hwok); g_puts("\n" as *u8) 87 pass=pass+ck("T4: NEVER-BRICK tag (cardinal 26 IN THE FORMAT) -- a hw-write binary lacking a never-brick guarantee is REFUSED at load" as *u8, t4); total=total+1 88 89 g_puts(" -- NXE vs ELF/Mach-O/PE (grounded ef_*.raw) --\n" as *u8) 90 g_puts(" [EXCEED] INTEGRITY-by-construction (ELF/Mach-O/PE: none built-in) ; CAPABILITY-MANIFEST (capability-based security) ; NEVER-BRICK tag\n" as *u8) 91 g_puts(" [EXCEED] SOVEREIGN + minimal + deterministic 80-byte header (own magic, no legacy cruft)\n" as *u8) 92 g_puts(" [PARITY] a loadable executable container (header + code + entry)\n" as *u8) 93 g_puts(" [BEHIND] no dynamic linking / debug info / relocations / OS-loader support outside Nishi yet\n" as *u8) 94 g_puts(" *** ASTERISK: ELF/Mach-O/PE are universal + tooled (decades); NXE wins on integrity/capability/never-brick/sovereignty -- the secure-sovereign niche, not ubiquity. ***\n" as *u8) 95 96 var okall: i64=0; if pass==total { okall=1 } 97 g_puts("---- nx_nxe: passed "); g_pn(pass); g_puts(" / "); g_pn(total); g_puts(" ----\n" as *u8) 98 if okall==1 { 99 let logf: i64=sys_openat_append("knowledge/status/nxe.log" as *u8, 420) 100 if logf>=0 { let z: i64=sys_write(logf,"NXE GREEN: sovereign Nishi executable format -- integrity-verified + capability-manifest + never-brick-tag (NOT an ELF clone)\n" as *u8,121); sys_close(logf) } 101 g_puts("verdict=GREEN (the sovereign Nishi Executable format: our OWN file with integrity+capability+never-brick baked in -- a UNIQUE exceed, not an ELF knockoff)\n" as *u8); sys_exit(0); return 0 102 } 103 g_puts("verdict=RED\n" as *u8); sys_exit(1); return 1 104}