`nx_pe_writer.nx` source

↩ module page · 952 lines · 37359 B
1// nx_pe_writer.nx -- substrate-emitted Windows PE32+ bytes.
2//
3// Arc Step 1 of the nxc2 Windows PE backend.  Per cardinal 2026-05-21
4// ("always do the bits up harder investment"): substrate produces a
5// valid, runnable Windows PE32+ executable from NishiLang source +
6// the substrate's existing byte-writing primitives + sys_openat
7// to flush to disk.  No assembler, no linker, no MinGW, no MSVC,
8// no third-party PE writer.
9//
10// What this Step 1 ships:
11//   - nx_pe_emit_exit42(buf): writes the bytes of a complete PE32+
12//     executable that calls kernel32!ExitProcess(42) and returns
13//     to the Windows loader cleanly
14//   - Bytes are byte-for-byte deterministic for this minimal case;
15//     subsequent steps generalize (variable .text, multiple imports,
16//     real codegen integration with nxc2 x86_64 backend)
17//   - sys_openat + sys_write flush bytes to a Windows-visible path
18//     (/mnt/c/...) so PowerShell / cmd can execute it
19//
20// What this Step 1 does NOT ship (queued for next steps):
21//   Step 2: generalize -- accept (code_bytes, code_len, imports[])
22//           and lay out sections dynamically; supports any kernel32
23//           function the substrate wants to call
24//   Step 3: integrate with nxc2 x86_64 backend so a NishiLang
25//           program compiles to PE directly (--target pe32plus);
26//           emits MS x64 calling convention instead of SysV
27//   Step 4: substrate-side .obj+.lib equivalents (still no MS toolchain)
28//   Step 5: retire WSL2/qemu/binutils from the Win-native build path
29//
30// Why a minimal PE matters as foundation:
31//   - Validates byte layout against the real Windows loader
32//   - Establishes import-table mechanics (Import Descriptor + INT +
33//     IAT + IMAGE_IMPORT_BY_NAME + dll-name string)
34//   - Lets the substrate's HAL gain a Windows shim that calls
35//     kernel32 functions (the future NX_HAL_SHIM_WINDOWS sealed-enum
36//     option finally has an implementation path)
37//   - Proves the substrate doesn't need MinGW/MSVC to produce
38//     Windows-native binaries
39//
40// PE32+ layout for this minimal case (file size = 0x600 = 1536 bytes):
41//
42//   0x0000  DOS Header (64 bytes; only MZ + e_lfanew = 0x80 nonzero)
43//   0x0040  DOS Stub (zeros)
44//   0x0080  PE Signature "PE\0\0"
45//   0x0084  COFF File Header (20 bytes)
46//   0x0098  Optional Header PE32+ (240 bytes)
47//   0x0188  Section Header .text (40 bytes)
48//   0x01B0  Section Header .idata (40 bytes)
49//   0x01D8  ...padding to 0x200...
50//   0x0200  .text section (file): 16 bytes of code + padding
51//             RVA 0x1000, virtual size 0x1000
52//   0x0400  .idata section (file): import descriptors + INT/IAT
53//             + IMAGE_IMPORT_BY_NAME + "kernel32.dll" string
54//             RVA 0x2000, virtual size 0x1000
55//   0x0600  end of file
56//
57// SizeOfImage = 0x3000 (headers 0x1000 + .text 0x1000 + .idata 0x1000
58// at SectionAlignment 0x1000 each).
59//
60// genealogy_id: pe_coff_spec_2010 + cardinal_2026-05-21_bits_up_harder_investment
61// lineage_id:   substrate_pe_writer_v1_exit42
62
63import "nx_syscalls.nx"
64import "nx_hal.nx"
65
66// ===== Byte writers (little-endian) =================================================
67func _w8(buf: *u8, off: i64, v: i64) -> i64 {
  buf[off] = (v & 0xFF) as u8
  return off + 1
70}
71func _w16(buf: *u8, off: i64, v: i64) -> i64 {
  buf[off]   = (v & 0xFF) as u8
  buf[off+1] = ((v >> 8) & 0xFF) as u8
  return off + 2
75}
76func _w32(buf: *u8, off: i64, v: i64) -> i64 {
  buf[off]   = (v & 0xFF) as u8
  buf[off+1] = ((v >> 8) & 0xFF) as u8
  buf[off+2] = ((v >> 16) & 0xFF) as u8
  buf[off+3] = ((v >> 24) & 0xFF) as u8
  return off + 4
82}
83func _w64(buf: *u8, off: i64, lo32: i64, hi32: i64) -> i64 {
  // Write as two 32-bit halves to avoid relying on >>32 codegen.
  _w32(buf, off, lo32)
  _w32(buf, off + 4, hi32)
  return off + 8
88}
89
90// ===== Constants (PE/COFF spec) =================================================
91const PE_FILE_SIZE:       i64 = 0x600
92const PE_MACHINE_AMD64:   i64 = 0x8664
93const PE_OH_MAGIC_PEPLUS: i64 = 0x020B
94const PE_SUBSYSTEM_CONSOLE: i64 = 3
95const PE_CHAR_EXEC:         i64 = 0x0002
96const PE_CHAR_LARGE_ADDR:   i64 = 0x0020
97const PE_SECT_CODE_X_R:     i64 = 0x60000020
98const PE_SECT_DATA_R:       i64 = 0x40000040
99const PE_SECT_DATA_RW:      i64 = 0xC0000040  // INITIALIZED_DATA | READ | WRITE
100
101// File offsets
102const FOFF_PE_SIG:    i64 = 0x80
103const FOFF_COFF:      i64 = 0x84
104const FOFF_OPT:       i64 = 0x98
105const FOFF_SECT_TBL:  i64 = 0x188
106const FOFF_TEXT:      i64 = 0x200
107const FOFF_IDATA:     i64 = 0x400
108
109// RVAs (post-load image addresses)
110const RVA_TEXT:       i64 = 0x1000
111const RVA_IDATA:      i64 = 0x2000
112const RVA_IMP_DESC:   i64 = 0x2000
113const RVA_INT:        i64 = 0x2028
114const RVA_IAT:        i64 = 0x2038
115const RVA_IMP_NAME:   i64 = 0x2048
116const RVA_DLL_STR:    i64 = 0x2056
117
118// ImageBase = 0x140000000 -- typical PE32+ user-mode preferred base.
119const IMG_BASE_LO: i64 = 0x40000000
120const IMG_BASE_HI: i64 = 0x1
121
122// ===== Verdicts =================================================
123const NX_PE_OK:        i64 = 0
124const NX_PE_BAD_INPUT: i64 = 1
125const NX_PE_FAULT:     i64 = 2
126const NX_PE_N_VERDICTS: i64 = 3
127
128func nx_pe_verdict_is_valid(v: i64) -> i64 {
  if v < 0 { return 0 }
  if v >= NX_PE_N_VERDICTS { return 0 }
  return 1
132}
133
134// ===== Section table writer =================================================
135func _emit_section_header(buf: *u8, off: i64, name0: i64, name1: i64, name2: i64, name3: i64, name4: i64, name5: i64, name6: i64, name7: i64, vsize: i64, vaddr: i64, rawsize: i64, rawptr: i64, chars: i64) -> i64 {
  _w8(buf, off + 0, name0)
  _w8(buf, off + 1, name1)
  _w8(buf, off + 2, name2)
  _w8(buf, off + 3, name3)
  _w8(buf, off + 4, name4)
  _w8(buf, off + 5, name5)
  _w8(buf, off + 6, name6)
  _w8(buf, off + 7, name7)
  _w32(buf, off + 8, vsize)
  _w32(buf, off + 12, vaddr)
  _w32(buf, off + 16, rawsize)
  _w32(buf, off + 20, rawptr)
  _w32(buf, off + 24, 0)         // PointerToRelocations
  _w32(buf, off + 28, 0)         // PointerToLinenumbers
  _w16(buf, off + 32, 0)         // NumberOfRelocations
  _w16(buf, off + 34, 0)         // NumberOfLinenumbers
  _w32(buf, off + 36, chars)
  return off + 40
154}
155
156// ===== Main emitter =================================================
157// Returns NX_PE_OK + writes PE_FILE_SIZE bytes into buf, or -verdict.
158// Caller must ensure buf has >= PE_FILE_SIZE bytes of zero-init storage.
159func nx_pe_emit_exit42(buf: *u8) -> i64 {
  if (buf as i64) == 0 { return 0 - NX_PE_BAD_INPUT }
161
  // ===== DOS Header =====
  _w16(buf, 0, 0x5A4D)          // 'MZ'
  _w32(buf, 0x3C, FOFF_PE_SIG)  // e_lfanew -> PE signature
165
  // ===== PE Signature =====
  _w32(buf, FOFF_PE_SIG, 0x00004550)   // 'PE\0\0'
168
  // ===== COFF File Header (20 bytes) =====
  _w16(buf, FOFF_COFF + 0, PE_MACHINE_AMD64)
  _w16(buf, FOFF_COFF + 2, 2)           // NumberOfSections (.text + .idata)
  _w32(buf, FOFF_COFF + 4, 0)           // TimeDateStamp
  _w32(buf, FOFF_COFF + 8, 0)           // PointerToSymbolTable
  _w32(buf, FOFF_COFF + 12, 0)          // NumberOfSymbols
  _w16(buf, FOFF_COFF + 16, 0xF0)       // SizeOfOptionalHeader (240)
  _w16(buf, FOFF_COFF + 18, PE_CHAR_EXEC | PE_CHAR_LARGE_ADDR)
177
  // ===== Optional Header (PE32+) =====
  _w16(buf, FOFF_OPT + 0, PE_OH_MAGIC_PEPLUS)
  _w8(buf,  FOFF_OPT + 2, 1)         // MajorLinkerVersion
  _w8(buf,  FOFF_OPT + 3, 0)         // MinorLinkerVersion
  _w32(buf, FOFF_OPT + 4, 0x200)     // SizeOfCode
  _w32(buf, FOFF_OPT + 8, 0x200)     // SizeOfInitializedData
  _w32(buf, FOFF_OPT + 12, 0)        // SizeOfUninitializedData
  _w32(buf, FOFF_OPT + 16, RVA_TEXT) // AddressOfEntryPoint
  _w32(buf, FOFF_OPT + 20, RVA_TEXT) // BaseOfCode
  _w64(buf, FOFF_OPT + 24, IMG_BASE_LO, IMG_BASE_HI)  // ImageBase 0x140000000
  _w32(buf, FOFF_OPT + 32, 0x1000)   // SectionAlignment
  _w32(buf, FOFF_OPT + 36, 0x200)    // FileAlignment
  _w16(buf, FOFF_OPT + 40, 6)        // MajorOSVersion
  _w16(buf, FOFF_OPT + 42, 0)        // MinorOSVersion
  _w16(buf, FOFF_OPT + 44, 0)        // MajorImageVersion
  _w16(buf, FOFF_OPT + 46, 0)        // MinorImageVersion
  _w16(buf, FOFF_OPT + 48, 6)        // MajorSubsystemVersion
  _w16(buf, FOFF_OPT + 50, 0)        // MinorSubsystemVersion
  _w32(buf, FOFF_OPT + 52, 0)        // Win32VersionValue
  _w32(buf, FOFF_OPT + 56, 0x3000)   // SizeOfImage
  _w32(buf, FOFF_OPT + 60, 0x200)    // SizeOfHeaders
  _w32(buf, FOFF_OPT + 64, 0)        // CheckSum
  _w16(buf, FOFF_OPT + 68, PE_SUBSYSTEM_CONSOLE)
  _w16(buf, FOFF_OPT + 70, 0)        // DllCharacteristics
  _w64(buf, FOFF_OPT + 72, 0x100000, 0)   // SizeOfStackReserve = 1 MB
  _w64(buf, FOFF_OPT + 80, 0x1000, 0)     // SizeOfStackCommit
  _w64(buf, FOFF_OPT + 88, 0x100000, 0)   // SizeOfHeapReserve = 1 MB
  _w64(buf, FOFF_OPT + 96, 0x1000, 0)     // SizeOfHeapCommit
  _w32(buf, FOFF_OPT + 104, 0)            // LoaderFlags
  _w32(buf, FOFF_OPT + 108, 16)           // NumberOfRvaAndSizes
208
  // DataDirectories[16] at FOFF_OPT + 112, each 8 bytes
  // [0] Export = 0,0 (already zero)
  // [1] Import = (RVA_IMP_DESC, size=40 bytes for 2 import descriptors)
  _w32(buf, FOFF_OPT + 112 + 8, RVA_IMP_DESC)
  _w32(buf, FOFF_OPT + 112 + 12, 0x28)
  // [2..15] zero (already)
215
  // ===== Section Headers =====
  // .text
  _emit_section_header(buf, FOFF_SECT_TBL, 46, 116, 101, 120, 116, 0, 0, 0, 0x10, RVA_TEXT, 0x200, FOFF_TEXT, PE_SECT_CODE_X_R)
  // .idata
  _emit_section_header(buf, FOFF_SECT_TBL + 40, 46, 105, 100, 97, 116, 97, 0, 0, 0x63, RVA_IDATA, 0x200, FOFF_IDATA, PE_SECT_DATA_R)
221
  // ===== .text section =====
  // sub rsp, 0x28           (48 83 EC 28)   -- 4 bytes
  _w8(buf, FOFF_TEXT + 0, 0x48)
  _w8(buf, FOFF_TEXT + 1, 0x83)
  _w8(buf, FOFF_TEXT + 2, 0xEC)
  _w8(buf, FOFF_TEXT + 3, 0x28)
  // mov ecx, 42             (B9 2A 00 00 00)   -- 5 bytes (zero-extends to RCX, MS x64 arg0)
  _w8(buf, FOFF_TEXT + 4, 0xB9)
  _w8(buf, FOFF_TEXT + 5, 0x2A)
  _w8(buf, FOFF_TEXT + 6, 0x00)
  _w8(buf, FOFF_TEXT + 7, 0x00)
  _w8(buf, FOFF_TEXT + 8, 0x00)
  // call qword ptr [rip + disp32]  (FF 15 disp32)   -- 6 bytes
  // disp = RVA(IAT_ExitProcess) - RVA(next_insn)
  //      = 0x2038 - (0x1000 + 4 + 5 + 6) = 0x2038 - 0x100F = 0x1029
  _w8(buf, FOFF_TEXT + 9, 0xFF)
  _w8(buf, FOFF_TEXT + 10, 0x15)
  _w32(buf, FOFF_TEXT + 11, 0x1029)
  // int3 (safety; never reached if ExitProcess works)
  _w8(buf, FOFF_TEXT + 15, 0xCC)
242
  // ===== .idata section =====
  // Import Descriptor for kernel32 (20 bytes, RVA 0x2000 = file 0x400)
  _w32(buf, FOFF_IDATA + 0, RVA_INT)         // OriginalFirstThunk -> INT
  _w32(buf, FOFF_IDATA + 4, 0)               // TimeDateStamp
  _w32(buf, FOFF_IDATA + 8, 0)               // ForwarderChain
  _w32(buf, FOFF_IDATA + 12, RVA_DLL_STR)    // Name -> "kernel32.dll"
  _w32(buf, FOFF_IDATA + 16, RVA_IAT)        // FirstThunk -> IAT
  // Null Import Descriptor (20 bytes of zeros) -- already zero
251
  // INT at file 0x428 (RVA 0x2028)
  _w64(buf, FOFF_IDATA + 0x28, RVA_IMP_NAME, 0)  // Thunk[0] -> hint/name
  _w64(buf, FOFF_IDATA + 0x30, 0, 0)              // Thunk[1] = 0 terminator
255
  // IAT at file 0x438 (RVA 0x2038)
  _w64(buf, FOFF_IDATA + 0x38, RVA_IMP_NAME, 0)  // loader replaces with real addr
  _w64(buf, FOFF_IDATA + 0x40, 0, 0)              // terminator
259
  // IMAGE_IMPORT_BY_NAME at file 0x448 (RVA 0x2048)
  _w16(buf, FOFF_IDATA + 0x48, 0)            // Hint
  // "ExitProcess\0"
  _w8(buf, FOFF_IDATA + 0x4A, 69)    // 'E'
  _w8(buf, FOFF_IDATA + 0x4B, 120)   // 'x'
  _w8(buf, FOFF_IDATA + 0x4C, 105)   // 'i'
  _w8(buf, FOFF_IDATA + 0x4D, 116)   // 't'
  _w8(buf, FOFF_IDATA + 0x4E, 80)    // 'P'
  _w8(buf, FOFF_IDATA + 0x4F, 114)   // 'r'
  _w8(buf, FOFF_IDATA + 0x50, 111)   // 'o'
  _w8(buf, FOFF_IDATA + 0x51, 99)    // 'c'
  _w8(buf, FOFF_IDATA + 0x52, 101)   // 'e'
  _w8(buf, FOFF_IDATA + 0x53, 115)   // 's'
  _w8(buf, FOFF_IDATA + 0x54, 115)   // 's'
  _w8(buf, FOFF_IDATA + 0x55, 0)     // null
275
  // "kernel32.dll\0" at file 0x456 (RVA 0x2056), 13 bytes
  _w8(buf, FOFF_IDATA + 0x56, 107)   // 'k'
  _w8(buf, FOFF_IDATA + 0x57, 101)   // 'e'
  _w8(buf, FOFF_IDATA + 0x58, 114)   // 'r'
  _w8(buf, FOFF_IDATA + 0x59, 110)   // 'n'
  _w8(buf, FOFF_IDATA + 0x5A, 101)   // 'e'
  _w8(buf, FOFF_IDATA + 0x5B, 108)   // 'l'
  _w8(buf, FOFF_IDATA + 0x5C, 51)    // '3'
  _w8(buf, FOFF_IDATA + 0x5D, 50)    // '2'
  _w8(buf, FOFF_IDATA + 0x5E, 46)    // '.'
  _w8(buf, FOFF_IDATA + 0x5F, 100)   // 'd'
  _w8(buf, FOFF_IDATA + 0x60, 108)   // 'l'
  _w8(buf, FOFF_IDATA + 0x61, 108)   // 'l'
  _w8(buf, FOFF_IDATA + 0x62, 0)     // null
290
  return NX_PE_OK
292}
293
294// ===== Hello World PE (Step 2) =================================================
295//
296// Three sections: .text (RVA 0x1000) + .rdata (RVA 0x2000) +
297// .idata (RVA 0x3000).  Three kernel32 imports: GetStdHandle,
298// WriteFile, ExitProcess.  Writes "Hello from Nishi PE!\n" to
299// stdout, exits 0.
300//
301// File size = 2048 bytes (4 file-aligned 0x200 chunks).
302// SizeOfImage = 0x4000 (headers + 3 sections * 0x1000).
303//
304// .idata layout (file 0x600, RVA 0x3000):
305//   0x000  Import Descriptor for kernel32 (20 bytes)
306//   0x014  Null Import Descriptor (20 bytes zeros)
307//   0x028  INT: 3 thunks + null (32 bytes)
308//   0x048  IAT: 3 thunks + null (32 bytes)
309//   0x068  IMAGE_IMPORT_BY_NAME GetStdHandle (16 bytes, pad to even)
310//   0x078  IMAGE_IMPORT_BY_NAME WriteFile (12 bytes)
311//   0x084  IMAGE_IMPORT_BY_NAME ExitProcess (14 bytes)
312//   0x092  "kernel32.dll\0" (13 bytes)
313//
314// IAT RVAs:
315//   IAT_GetStdHandle = 0x3048
316//   IAT_WriteFile    = 0x3050
317//   IAT_ExitProcess  = 0x3058
318//
319// Code at RVA 0x1000 (58 bytes):
320//   sub rsp, 0x38
321//   mov ecx, -11                       ; STD_OUTPUT_HANDLE
322//   call [rip + disp_to_GetStdHandle]
323//   mov rcx, rax                       ; arg1 = handle
324//   lea rdx, [rip + disp_to_msg]       ; arg2 = pointer
325//   mov r8d, 21                        ; arg3 = bytes
326//   xor r9, r9                         ; arg4 = NULL (lpNumberOfBytesWritten)
327//   mov qword [rsp+0x20], 0            ; arg5 = NULL (lpOverlapped)
328//   call [rip + disp_to_WriteFile]
329//   xor ecx, ecx                       ; exit 0
330//   call [rip + disp_to_ExitProcess]
331//   int3
332const PE_HELLO_FILE_SIZE: i64 = 0x800   // 2048 bytes
333const PE_HELLO_FOFF_TEXT:  i64 = 0x200
334const PE_HELLO_FOFF_RDATA: i64 = 0x400
335const PE_HELLO_FOFF_IDATA: i64 = 0x600
336const PE_HELLO_RVA_TEXT:   i64 = 0x1000
337const PE_HELLO_RVA_RDATA:  i64 = 0x2000
338const PE_HELLO_RVA_IDATA:  i64 = 0x3000
339
340func nx_pe_emit_hello(buf: *u8) -> i64 {
  if (buf as i64) == 0 { return 0 - NX_PE_BAD_INPUT }
342
  // ===== DOS Header =====
  _w16(buf, 0, 0x5A4D)
  _w32(buf, 0x3C, FOFF_PE_SIG)
346
  // ===== PE Signature =====
  _w32(buf, FOFF_PE_SIG, 0x00004550)
349
  // ===== COFF File Header =====
  _w16(buf, FOFF_COFF + 0, PE_MACHINE_AMD64)
  _w16(buf, FOFF_COFF + 2, 3)             // 3 sections
  _w16(buf, FOFF_COFF + 16, 0xF0)
  _w16(buf, FOFF_COFF + 18, PE_CHAR_EXEC | PE_CHAR_LARGE_ADDR)
355
  // ===== Optional Header =====
  _w16(buf, FOFF_OPT + 0, PE_OH_MAGIC_PEPLUS)
  _w8(buf,  FOFF_OPT + 2, 1)
  _w32(buf, FOFF_OPT + 4, 0x200)          // SizeOfCode
  _w32(buf, FOFF_OPT + 8, 0x400)          // SizeOfInitializedData (.rdata + .idata)
  _w32(buf, FOFF_OPT + 16, PE_HELLO_RVA_TEXT)
  _w32(buf, FOFF_OPT + 20, PE_HELLO_RVA_TEXT)
  _w64(buf, FOFF_OPT + 24, IMG_BASE_LO, IMG_BASE_HI)
  _w32(buf, FOFF_OPT + 32, 0x1000)
  _w32(buf, FOFF_OPT + 36, 0x200)
  _w16(buf, FOFF_OPT + 40, 6)
  _w16(buf, FOFF_OPT + 48, 6)
  _w32(buf, FOFF_OPT + 56, 0x4000)        // SizeOfImage (1 header + 3 sections)
  _w32(buf, FOFF_OPT + 60, 0x200)         // SizeOfHeaders
  _w16(buf, FOFF_OPT + 68, PE_SUBSYSTEM_CONSOLE)
  _w64(buf, FOFF_OPT + 72, 0x100000, 0)
  _w64(buf, FOFF_OPT + 80, 0x1000, 0)
  _w64(buf, FOFF_OPT + 88, 0x100000, 0)
  _w64(buf, FOFF_OPT + 96, 0x1000, 0)
  _w32(buf, FOFF_OPT + 108, 16)
  // DataDirectory[1] = Import Table
  _w32(buf, FOFF_OPT + 112 + 8, PE_HELLO_RVA_IDATA)
  _w32(buf, FOFF_OPT + 112 + 12, 0x28)    // 2 descriptors = 40 bytes
379
  // ===== Section Headers =====
  // .text
  _emit_section_header(buf, FOFF_SECT_TBL, 46, 116, 101, 120, 116, 0, 0, 0, 0x3A, PE_HELLO_RVA_TEXT, 0x200, PE_HELLO_FOFF_TEXT, PE_SECT_CODE_X_R)
  // .rdata
  _emit_section_header(buf, FOFF_SECT_TBL + 40, 46, 114, 100, 97, 116, 97, 0, 0, 21, PE_HELLO_RVA_RDATA, 0x200, PE_HELLO_FOFF_RDATA, PE_SECT_DATA_R)
  // .idata
  _emit_section_header(buf, FOFF_SECT_TBL + 80, 46, 105, 100, 97, 116, 97, 0, 0, 0xA1, PE_HELLO_RVA_IDATA, 0x200, PE_HELLO_FOFF_IDATA, PE_SECT_DATA_R)
387
  // ===== .text (58 bytes of MS-x64 code) =====
  let t: i64 = PE_HELLO_FOFF_TEXT
  // sub rsp, 0x38
  _w8(buf, t + 0, 0x48)
  _w8(buf, t + 1, 0x83)
  _w8(buf, t + 2, 0xEC)
  _w8(buf, t + 3, 0x38)
  // mov ecx, -11 (0xFFFFFFF5)
  _w8(buf, t + 4, 0xB9)
  _w8(buf, t + 5, 0xF5)
  _w8(buf, t + 6, 0xFF)
  _w8(buf, t + 7, 0xFF)
  _w8(buf, t + 8, 0xFF)
  // call [rip + 0x2039]  -> IAT_GetStdHandle at RVA 0x3048
  _w8(buf, t + 9, 0xFF)
  _w8(buf, t + 10, 0x15)
  _w32(buf, t + 11, 0x2039)
  // mov rcx, rax
  _w8(buf, t + 15, 0x48)
  _w8(buf, t + 16, 0x89)
  _w8(buf, t + 17, 0xC1)
  // lea rdx, [rip + 0xFE7]  -> msg at RVA 0x2000
  _w8(buf, t + 18, 0x48)
  _w8(buf, t + 19, 0x8D)
  _w8(buf, t + 20, 0x15)
  _w32(buf, t + 21, 0xFE7)
  // mov r8d, 21
  _w8(buf, t + 25, 0x41)
  _w8(buf, t + 26, 0xB8)
  _w32(buf, t + 27, 21)
  // xor r9, r9
  _w8(buf, t + 31, 0x4D)
  _w8(buf, t + 32, 0x31)
  _w8(buf, t + 33, 0xC9)
  // mov qword ptr [rsp+0x20], 0 (9 bytes)
  _w8(buf, t + 34, 0x48)
  _w8(buf, t + 35, 0xC7)
  _w8(buf, t + 36, 0x44)
  _w8(buf, t + 37, 0x24)
  _w8(buf, t + 38, 0x20)
  _w32(buf, t + 39, 0)
  // call [rip + 0x201F]  -> IAT_WriteFile at RVA 0x3050
  _w8(buf, t + 43, 0xFF)
  _w8(buf, t + 44, 0x15)
  _w32(buf, t + 45, 0x201F)
  // xor ecx, ecx
  _w8(buf, t + 49, 0x31)
  _w8(buf, t + 50, 0xC9)
  // call [rip + 0x201F]  -> IAT_ExitProcess at RVA 0x3058
  _w8(buf, t + 51, 0xFF)
  _w8(buf, t + 52, 0x15)
  _w32(buf, t + 53, 0x201F)
  // int3
  _w8(buf, t + 57, 0xCC)
442
  // ===== .rdata: "Hello from Nishi PE!\n" (21 bytes) =====
  let r: i64 = PE_HELLO_FOFF_RDATA
  _w8(buf, r + 0, 72)    // 'H'
  _w8(buf, r + 1, 101)   // 'e'
  _w8(buf, r + 2, 108)   // 'l'
  _w8(buf, r + 3, 108)   // 'l'
  _w8(buf, r + 4, 111)   // 'o'
  _w8(buf, r + 5, 32)    // ' '
  _w8(buf, r + 6, 102)   // 'f'
  _w8(buf, r + 7, 114)   // 'r'
  _w8(buf, r + 8, 111)   // 'o'
  _w8(buf, r + 9, 109)   // 'm'
  _w8(buf, r + 10, 32)   // ' '
  _w8(buf, r + 11, 78)   // 'N'
  _w8(buf, r + 12, 105)  // 'i'
  _w8(buf, r + 13, 115)  // 's'
  _w8(buf, r + 14, 104)  // 'h'
  _w8(buf, r + 15, 105)  // 'i'
  _w8(buf, r + 16, 32)   // ' '
  _w8(buf, r + 17, 80)   // 'P'
  _w8(buf, r + 18, 69)   // 'E'
  _w8(buf, r + 19, 33)   // '!'
  _w8(buf, r + 20, 10)   // '\n'
466
  // ===== .idata =====
  let d: i64 = PE_HELLO_FOFF_IDATA
  // Import Descriptor for kernel32
  _w32(buf, d + 0, 0x3028)        // OriginalFirstThunk = INT RVA
  _w32(buf, d + 4, 0)
  _w32(buf, d + 8, 0)
  _w32(buf, d + 12, 0x3092)       // Name = "kernel32.dll" RVA
  _w32(buf, d + 16, 0x3048)       // FirstThunk = IAT RVA
475
  // Null Import Descriptor (zeros) already zero
477
  // INT at offset 0x28 (RVA 0x3028)
  _w64(buf, d + 0x28, 0x3068, 0)  // Thunk[0] -> GetStdHandle hint/name
  _w64(buf, d + 0x30, 0x3078, 0)  // Thunk[1] -> WriteFile hint/name
  _w64(buf, d + 0x38, 0x3084, 0)  // Thunk[2] -> ExitProcess hint/name
  _w64(buf, d + 0x40, 0, 0)       // Thunk[3] = null terminator
483
  // IAT at offset 0x48 (RVA 0x3048) -- same values, loader replaces
  _w64(buf, d + 0x48, 0x3068, 0)
  _w64(buf, d + 0x50, 0x3078, 0)
  _w64(buf, d + 0x58, 0x3084, 0)
  _w64(buf, d + 0x60, 0, 0)
489
  // IMAGE_IMPORT_BY_NAME entries
  // GetStdHandle at offset 0x68 (RVA 0x3068)
  _w16(buf, d + 0x68, 0)               // Hint
  _w8(buf, d + 0x6A, 71)               // 'G'
  _w8(buf, d + 0x6B, 101)              // 'e'
  _w8(buf, d + 0x6C, 116)              // 't'
  _w8(buf, d + 0x6D, 83)               // 'S'
  _w8(buf, d + 0x6E, 116)              // 't'
  _w8(buf, d + 0x6F, 100)              // 'd'
  _w8(buf, d + 0x70, 72)               // 'H'
  _w8(buf, d + 0x71, 97)               // 'a'
  _w8(buf, d + 0x72, 110)              // 'n'
  _w8(buf, d + 0x73, 100)              // 'd'
  _w8(buf, d + 0x74, 108)              // 'l'
  _w8(buf, d + 0x75, 101)              // 'e'
  _w8(buf, d + 0x76, 0)                // null
  _w8(buf, d + 0x77, 0)                // pad to even
507
  // WriteFile at offset 0x78 (RVA 0x3078)
  _w16(buf, d + 0x78, 0)               // Hint
  _w8(buf, d + 0x7A, 87)               // 'W'
  _w8(buf, d + 0x7B, 114)              // 'r'
  _w8(buf, d + 0x7C, 105)              // 'i'
  _w8(buf, d + 0x7D, 116)              // 't'
  _w8(buf, d + 0x7E, 101)              // 'e'
  _w8(buf, d + 0x7F, 70)               // 'F'
  _w8(buf, d + 0x80, 105)              // 'i'
  _w8(buf, d + 0x81, 108)              // 'l'
  _w8(buf, d + 0x82, 101)              // 'e'
  _w8(buf, d + 0x83, 0)                // null
520
  // ExitProcess at offset 0x84 (RVA 0x3084)
  _w16(buf, d + 0x84, 0)               // Hint
  _w8(buf, d + 0x86, 69)               // 'E'
  _w8(buf, d + 0x87, 120)              // 'x'
  _w8(buf, d + 0x88, 105)              // 'i'
  _w8(buf, d + 0x89, 116)              // 't'
  _w8(buf, d + 0x8A, 80)               // 'P'
  _w8(buf, d + 0x8B, 114)              // 'r'
  _w8(buf, d + 0x8C, 111)              // 'o'
  _w8(buf, d + 0x8D, 99)               // 'c'
  _w8(buf, d + 0x8E, 101)              // 'e'
  _w8(buf, d + 0x8F, 115)              // 's'
  _w8(buf, d + 0x90, 115)              // 's'
  _w8(buf, d + 0x91, 0)                // null
535
  // "kernel32.dll\0" at offset 0x92 (RVA 0x3092)
  _w8(buf, d + 0x92, 107)              // 'k'
  _w8(buf, d + 0x93, 101)              // 'e'
  _w8(buf, d + 0x94, 114)              // 'r'
  _w8(buf, d + 0x95, 110)              // 'n'
  _w8(buf, d + 0x96, 101)              // 'e'
  _w8(buf, d + 0x97, 108)              // 'l'
  _w8(buf, d + 0x98, 51)               // '3'
  _w8(buf, d + 0x99, 50)               // '2'
  _w8(buf, d + 0x9A, 46)               // '.'
  _w8(buf, d + 0x9B, 100)              // 'd'
  _w8(buf, d + 0x9C, 108)              // 'l'
  _w8(buf, d + 0x9D, 108)              // 'l'
  _w8(buf, d + 0x9E, 0)                // null
550
  return NX_PE_OK
552}
553
554// ===== CreateProcessW spawn PE (Step 3) =================================================
555//
556// Substrate emits a PE that calls
557//   CreateProcessW(NULL, "cmd.exe /c exit 42", NULL, NULL, FALSE, 0,
558//                  NULL, NULL, &startupInfo, &processInfo)
559//   WaitForSingleObject(processInfo.hProcess, INFINITE)
560//   GetExitCodeProcess(processInfo.hProcess, &exitCode)
561//   ExitProcess(exitCode)
562//
563// Successful execution returns 42 -- proving the substrate-emitted
564// PE correctly invoked the 4-step spawn-wait-read-exit pattern that
565// Elder AI's supervisor will need on Windows.
566//
567// 4 kernel32 imports.  3 sections (.text + .rdata + .idata).
568// File size = 2048 bytes.  Code size = 163 bytes.
569//
570// Stack frame layout (rsp+0x00 to rsp+0xE8):
571//   0x00..0x1F  shadow space for callees
572//   0x20        arg5 (BOOL bInheritHandles = FALSE)
573//   0x28        arg6 (DWORD dwCreationFlags = 0)
574//   0x30        arg7 (LPVOID lpEnvironment = NULL)
575//   0x38        arg8 (LPCWSTR lpCurrentDirectory = NULL)
576//   0x40        arg9 (LPSTARTUPINFOW &startupInfo)
577//   0x48        arg10 (LPPROCESS_INFORMATION &processInfo)
578//   0x50..0x57  unused alignment
579//   0x58..0xBF  STARTUPINFOW (104 bytes; cb set to 0x68, rest zeros)
580//   0xC0..0xD7  PROCESS_INFORMATION (24 bytes; loader fills in)
581//   0xD8..0xDB  exitCode DWORD (4 bytes)
582//   0xDC..0xE7  alignment padding
583//
584// .idata layout (4 imports from kernel32, RVA 0x3000):
585//   0x000  Import Descriptor + null
586//   0x028  INT: 4 thunks + null (40 bytes)
587//   0x050  IAT: 4 thunks + null (40 bytes)
588//   0x078  IMAGE_IMPORT_BY_NAME CreateProcessW (18 bytes after pad)
589//   0x08A  IMAGE_IMPORT_BY_NAME WaitForSingleObject (24 bytes)
590//   0x0A2  IMAGE_IMPORT_BY_NAME GetExitCodeProcess (22 bytes)
591//   0x0B8  IMAGE_IMPORT_BY_NAME ExitProcess (14 bytes)
592//   0x0C6  "kernel32.dll\0"
593//
594// IAT RVAs:
595//   IAT_CreateProcessW       = 0x3050
596//   IAT_WaitForSingleObject  = 0x3058
597//   IAT_GetExitCodeProcess   = 0x3060
598//   IAT_ExitProcess          = 0x3068
599
600const PE_SPAWN_FILE_SIZE: i64 = 0x800
601
602func nx_pe_emit_spawn42(buf: *u8) -> i64 {
  if (buf as i64) == 0 { return 0 - NX_PE_BAD_INPUT }
604
  // ===== DOS Header =====
  _w16(buf, 0, 0x5A4D)
  _w32(buf, 0x3C, FOFF_PE_SIG)
608
  // ===== PE Signature =====
  _w32(buf, FOFF_PE_SIG, 0x00004550)
611
  // ===== COFF File Header =====
  _w16(buf, FOFF_COFF + 0, PE_MACHINE_AMD64)
  _w16(buf, FOFF_COFF + 2, 3)
  _w16(buf, FOFF_COFF + 16, 0xF0)
  _w16(buf, FOFF_COFF + 18, PE_CHAR_EXEC | PE_CHAR_LARGE_ADDR)
617
  // ===== Optional Header =====
  _w16(buf, FOFF_OPT + 0, PE_OH_MAGIC_PEPLUS)
  _w8(buf,  FOFF_OPT + 2, 1)
  _w32(buf, FOFF_OPT + 4, 0x200)
  _w32(buf, FOFF_OPT + 8, 0x400)
  _w32(buf, FOFF_OPT + 16, PE_HELLO_RVA_TEXT)
  _w32(buf, FOFF_OPT + 20, PE_HELLO_RVA_TEXT)
  _w64(buf, FOFF_OPT + 24, IMG_BASE_LO, IMG_BASE_HI)
  _w32(buf, FOFF_OPT + 32, 0x1000)
  _w32(buf, FOFF_OPT + 36, 0x200)
  _w16(buf, FOFF_OPT + 40, 6)
  _w16(buf, FOFF_OPT + 48, 6)
  _w32(buf, FOFF_OPT + 56, 0x4000)
  _w32(buf, FOFF_OPT + 60, 0x200)
  _w16(buf, FOFF_OPT + 68, PE_SUBSYSTEM_CONSOLE)
  _w64(buf, FOFF_OPT + 72, 0x100000, 0)
  _w64(buf, FOFF_OPT + 80, 0x1000, 0)
  _w64(buf, FOFF_OPT + 88, 0x100000, 0)
  _w64(buf, FOFF_OPT + 96, 0x1000, 0)
  _w32(buf, FOFF_OPT + 108, 16)
  _w32(buf, FOFF_OPT + 112 + 8, PE_HELLO_RVA_IDATA)
  _w32(buf, FOFF_OPT + 112 + 12, 0x28)
640
  // ===== Section Headers =====
  _emit_section_header(buf, FOFF_SECT_TBL, 46, 116, 101, 120, 116, 0, 0, 0, 0xA3, PE_HELLO_RVA_TEXT, 0x200, PE_HELLO_FOFF_TEXT, PE_SECT_CODE_X_R)
  // .data (writable -- CreateProcessW may modify lpCommandLine)
  _emit_section_header(buf, FOFF_SECT_TBL + 40, 46, 100, 97, 116, 97, 0, 0, 0, 38, PE_HELLO_RVA_RDATA, 0x200, PE_HELLO_FOFF_RDATA, PE_SECT_DATA_RW)
  _emit_section_header(buf, FOFF_SECT_TBL + 80, 46, 105, 100, 97, 116, 97, 0, 0, 0xD3, PE_HELLO_RVA_IDATA, 0x200, PE_HELLO_FOFF_IDATA, PE_SECT_DATA_R)
646
  // ===== .text (163 bytes) =====
  let t: i64 = PE_HELLO_FOFF_TEXT
  // sub rsp, 0xE8  (48 81 EC E8 00 00 00)
  _w8(buf, t + 0, 0x48)
  _w8(buf, t + 1, 0x81)
  _w8(buf, t + 2, 0xEC)
  _w32(buf, t + 3, 0xE8)
  // xor eax, eax  (31 C0)
  _w8(buf, t + 7, 0x31)
  _w8(buf, t + 8, 0xC0)
  // lea rdi, [rsp+0x58]  (48 8D 7C 24 58)
  _w8(buf, t + 9, 0x48)
  _w8(buf, t + 10, 0x8D)
  _w8(buf, t + 11, 0x7C)
  _w8(buf, t + 12, 0x24)
  _w8(buf, t + 13, 0x58)
  // mov ecx, 13  (B9 0D 00 00 00)
  _w8(buf, t + 14, 0xB9)
  _w32(buf, t + 15, 13)
  // rep stosq  (F3 48 AB)
  _w8(buf, t + 19, 0xF3)
  _w8(buf, t + 20, 0x48)
  _w8(buf, t + 21, 0xAB)
  // mov dword [rsp+0x58], 0x68   (C7 44 24 58 68 00 00 00)  -- cb=104
  _w8(buf, t + 22, 0xC7)
  _w8(buf, t + 23, 0x44)
  _w8(buf, t + 24, 0x24)
  _w8(buf, t + 25, 0x58)
  _w32(buf, t + 26, 0x68)
  // xor ecx, ecx  (31 C9)  -- arg1 = NULL
  _w8(buf, t + 30, 0x31)
  _w8(buf, t + 31, 0xC9)
  // lea rdx, [rip + disp_cmdline]  (48 8D 15 disp32)  -- arg2
  // disp = RVA(cmdline) - RVA(next) = 0x2000 - 0x1027 = 0xFD9
  _w8(buf, t + 32, 0x48)
  _w8(buf, t + 33, 0x8D)
  _w8(buf, t + 34, 0x15)
  _w32(buf, t + 35, 0xFD9)
  // xor r8, r8  (4D 31 C0)  -- arg3
  _w8(buf, t + 39, 0x4D)
  _w8(buf, t + 40, 0x31)
  _w8(buf, t + 41, 0xC0)
  // xor r9, r9  (4D 31 C9)  -- arg4
  _w8(buf, t + 42, 0x4D)
  _w8(buf, t + 43, 0x31)
  _w8(buf, t + 44, 0xC9)
  // mov dword [rsp+0x20], 0   -- arg5 = FALSE
  _w8(buf, t + 45, 0xC7)
  _w8(buf, t + 46, 0x44)
  _w8(buf, t + 47, 0x24)
  _w8(buf, t + 48, 0x20)
  _w32(buf, t + 49, 0)
  // mov dword [rsp+0x28], 0   -- arg6 = 0
  _w8(buf, t + 53, 0xC7)
  _w8(buf, t + 54, 0x44)
  _w8(buf, t + 55, 0x24)
  _w8(buf, t + 56, 0x28)
  _w32(buf, t + 57, 0)
  // mov qword [rsp+0x30], 0  -- arg7 = NULL
  _w8(buf, t + 61, 0x48)
  _w8(buf, t + 62, 0xC7)
  _w8(buf, t + 63, 0x44)
  _w8(buf, t + 64, 0x24)
  _w8(buf, t + 65, 0x30)
  _w32(buf, t + 66, 0)
  // mov qword [rsp+0x38], 0  -- arg8 = NULL
  _w8(buf, t + 70, 0x48)
  _w8(buf, t + 71, 0xC7)
  _w8(buf, t + 72, 0x44)
  _w8(buf, t + 73, 0x24)
  _w8(buf, t + 74, 0x38)
  _w32(buf, t + 75, 0)
  // lea rax, [rsp+0x58]  (48 8D 44 24 58)
  _w8(buf, t + 79, 0x48)
  _w8(buf, t + 80, 0x8D)
  _w8(buf, t + 81, 0x44)
  _w8(buf, t + 82, 0x24)
  _w8(buf, t + 83, 0x58)
  // mov [rsp+0x40], rax  (48 89 44 24 40)  -- arg9 = &si
  _w8(buf, t + 84, 0x48)
  _w8(buf, t + 85, 0x89)
  _w8(buf, t + 86, 0x44)
  _w8(buf, t + 87, 0x24)
  _w8(buf, t + 88, 0x40)
  // lea rax, [rsp+0xC0]  (48 8D 84 24 C0 00 00 00)
  _w8(buf, t + 89, 0x48)
  _w8(buf, t + 90, 0x8D)
  _w8(buf, t + 91, 0x84)
  _w8(buf, t + 92, 0x24)
  _w32(buf, t + 93, 0xC0)
  // mov [rsp+0x48], rax  (48 89 44 24 48)  -- arg10 = &pi
  _w8(buf, t + 97, 0x48)
  _w8(buf, t + 98, 0x89)
  _w8(buf, t + 99, 0x44)
  _w8(buf, t + 100, 0x24)
  _w8(buf, t + 101, 0x48)
  // call [rip + disp_CreateProcessW]  (FF 15 disp32)
  // disp = 0x3050 - 0x106C = 0x1FE4
  _w8(buf, t + 102, 0xFF)
  _w8(buf, t + 103, 0x15)
  _w32(buf, t + 104, 0x1FE4)
  // mov rcx, [rsp+0xC0]  (48 8B 8C 24 C0 00 00 00)  -- pi.hProcess
  _w8(buf, t + 108, 0x48)
  _w8(buf, t + 109, 0x8B)
  _w8(buf, t + 110, 0x8C)
  _w8(buf, t + 111, 0x24)
  _w32(buf, t + 112, 0xC0)
  // mov edx, -1  (BA FF FF FF FF)  -- INFINITE
  _w8(buf, t + 116, 0xBA)
  _w8(buf, t + 117, 0xFF)
  _w8(buf, t + 118, 0xFF)
  _w8(buf, t + 119, 0xFF)
  _w8(buf, t + 120, 0xFF)
  // call [rip + disp_WaitForSingleObject]  (FF 15 disp32)
  // disp = 0x3058 - 0x107F = 0x1FD9
  _w8(buf, t + 121, 0xFF)
  _w8(buf, t + 122, 0x15)
  _w32(buf, t + 123, 0x1FD9)
  // mov rcx, [rsp+0xC0]  (8 bytes)
  _w8(buf, t + 127, 0x48)
  _w8(buf, t + 128, 0x8B)
  _w8(buf, t + 129, 0x8C)
  _w8(buf, t + 130, 0x24)
  _w32(buf, t + 131, 0xC0)
  // lea rdx, [rsp+0xD8]  (48 8D 94 24 D8 00 00 00)  -- &exitCode
  _w8(buf, t + 135, 0x48)
  _w8(buf, t + 136, 0x8D)
  _w8(buf, t + 137, 0x94)
  _w8(buf, t + 138, 0x24)
  _w32(buf, t + 139, 0xD8)
  // call [rip + disp_GetExitCodeProcess]  (FF 15 disp32)
  // disp = 0x3060 - 0x1095 = 0x1FCB
  _w8(buf, t + 143, 0xFF)
  _w8(buf, t + 144, 0x15)
  _w32(buf, t + 145, 0x1FCB)
  // mov ecx, [rsp+0xD8]  (8B 8C 24 D8 00 00 00)  -- 7 bytes
  _w8(buf, t + 149, 0x8B)
  _w8(buf, t + 150, 0x8C)
  _w8(buf, t + 151, 0x24)
  _w32(buf, t + 152, 0xD8)
  // call [rip + disp_ExitProcess]  (FF 15 disp32)
  // disp = 0x3068 - 0x10A2 = 0x1FC6
  _w8(buf, t + 156, 0xFF)
  _w8(buf, t + 157, 0x15)
  _w32(buf, t + 158, 0x1FC6)
  // int3
  _w8(buf, t + 162, 0xCC)
794
  // ===== .rdata: "cmd.exe /c exit 42\0" as UTF-16 (38 bytes) =====
  let r: i64 = PE_HELLO_FOFF_RDATA
  _w16(buf, r + 0, 0x63)     // 'c'
  _w16(buf, r + 2, 0x6D)     // 'm'
  _w16(buf, r + 4, 0x64)     // 'd'
  _w16(buf, r + 6, 0x2E)     // '.'
  _w16(buf, r + 8, 0x65)     // 'e'
  _w16(buf, r + 10, 0x78)    // 'x'
  _w16(buf, r + 12, 0x65)    // 'e'
  _w16(buf, r + 14, 0x20)    // ' '
  _w16(buf, r + 16, 0x2F)    // '/'
  _w16(buf, r + 18, 0x63)    // 'c'
  _w16(buf, r + 20, 0x20)    // ' '
  _w16(buf, r + 22, 0x65)    // 'e'
  _w16(buf, r + 24, 0x78)    // 'x'
  _w16(buf, r + 26, 0x69)    // 'i'
  _w16(buf, r + 28, 0x74)    // 't'
  _w16(buf, r + 30, 0x20)    // ' '
  _w16(buf, r + 32, 0x34)    // '4'
  _w16(buf, r + 34, 0x32)    // '2'
  _w16(buf, r + 36, 0)       // null
816
  // ===== .idata =====
  let d: i64 = PE_HELLO_FOFF_IDATA
  // Import Descriptor (kernel32)
  _w32(buf, d + 0, 0x3028)         // OriginalFirstThunk = INT
  _w32(buf, d + 12, 0x30C6)        // Name = "kernel32.dll"
  _w32(buf, d + 16, 0x3050)        // FirstThunk = IAT
823
  // INT (4 thunks + null at offset 0x28)
  _w64(buf, d + 0x28, 0x3078, 0)   // CreateProcessW
  _w64(buf, d + 0x30, 0x308A, 0)   // WaitForSingleObject
  _w64(buf, d + 0x38, 0x30A2, 0)   // GetExitCodeProcess
  _w64(buf, d + 0x40, 0x30B8, 0)   // ExitProcess
  _w64(buf, d + 0x48, 0, 0)
830
  // IAT (offset 0x50)
  _w64(buf, d + 0x50, 0x3078, 0)
  _w64(buf, d + 0x58, 0x308A, 0)
  _w64(buf, d + 0x60, 0x30A2, 0)
  _w64(buf, d + 0x68, 0x30B8, 0)
  _w64(buf, d + 0x70, 0, 0)
837
  // IMAGE_IMPORT_BY_NAME structures
  // CreateProcessW at offset 0x78 (RVA 0x3078)
  _w16(buf, d + 0x78, 0)
  _w8(buf, d + 0x7A, 67)   // 'C'
  _w8(buf, d + 0x7B, 114)  // 'r'
  _w8(buf, d + 0x7C, 101)  // 'e'
  _w8(buf, d + 0x7D, 97)   // 'a'
  _w8(buf, d + 0x7E, 116)  // 't'
  _w8(buf, d + 0x7F, 101)  // 'e'
  _w8(buf, d + 0x80, 80)   // 'P'
  _w8(buf, d + 0x81, 114)  // 'r'
  _w8(buf, d + 0x82, 111)  // 'o'
  _w8(buf, d + 0x83, 99)   // 'c'
  _w8(buf, d + 0x84, 101)  // 'e'
  _w8(buf, d + 0x85, 115)  // 's'
  _w8(buf, d + 0x86, 115)  // 's'
  _w8(buf, d + 0x87, 87)   // 'W'
  _w8(buf, d + 0x88, 0)    // null
  _w8(buf, d + 0x89, 0)    // pad
857
  // WaitForSingleObject at offset 0x8A (RVA 0x308A)
  _w16(buf, d + 0x8A, 0)
  _w8(buf, d + 0x8C, 87)   // 'W'
  _w8(buf, d + 0x8D, 97)   // 'a'
  _w8(buf, d + 0x8E, 105)  // 'i'
  _w8(buf, d + 0x8F, 116)  // 't'
  _w8(buf, d + 0x90, 70)   // 'F'
  _w8(buf, d + 0x91, 111)  // 'o'
  _w8(buf, d + 0x92, 114)  // 'r'
  _w8(buf, d + 0x93, 83)   // 'S'
  _w8(buf, d + 0x94, 105)  // 'i'
  _w8(buf, d + 0x95, 110)  // 'n'
  _w8(buf, d + 0x96, 103)  // 'g'
  _w8(buf, d + 0x97, 108)  // 'l'
  _w8(buf, d + 0x98, 101)  // 'e'
  _w8(buf, d + 0x99, 79)   // 'O'
  _w8(buf, d + 0x9A, 98)   // 'b'
  _w8(buf, d + 0x9B, 106)  // 'j'
  _w8(buf, d + 0x9C, 101)  // 'e'
  _w8(buf, d + 0x9D, 99)   // 'c'
  _w8(buf, d + 0x9E, 116)  // 't'
  _w8(buf, d + 0x9F, 0)    // null
  _w8(buf, d + 0xA0, 0)    // pad
  _w8(buf, d + 0xA1, 0)    // pad
882
  // GetExitCodeProcess at offset 0xA2 (RVA 0x30A2)
  _w16(buf, d + 0xA2, 0)
  _w8(buf, d + 0xA4, 71)   // 'G'
  _w8(buf, d + 0xA5, 101)  // 'e'
  _w8(buf, d + 0xA6, 116)  // 't'
  _w8(buf, d + 0xA7, 69)   // 'E'
  _w8(buf, d + 0xA8, 120)  // 'x'
  _w8(buf, d + 0xA9, 105)  // 'i'
  _w8(buf, d + 0xAA, 116)  // 't'
  _w8(buf, d + 0xAB, 67)   // 'C'
  _w8(buf, d + 0xAC, 111)  // 'o'
  _w8(buf, d + 0xAD, 100)  // 'd'
  _w8(buf, d + 0xAE, 101)  // 'e'
  _w8(buf, d + 0xAF, 80)   // 'P'
  _w8(buf, d + 0xB0, 114)  // 'r'
  _w8(buf, d + 0xB1, 111)  // 'o'
  _w8(buf, d + 0xB2, 99)   // 'c'
  _w8(buf, d + 0xB3, 101)  // 'e'
  _w8(buf, d + 0xB4, 115)  // 's'
  _w8(buf, d + 0xB5, 115)  // 's'
  _w8(buf, d + 0xB6, 0)    // null
  _w8(buf, d + 0xB7, 0)    // pad
905
  // ExitProcess at offset 0xB8 (RVA 0x30B8)
  _w16(buf, d + 0xB8, 0)
  _w8(buf, d + 0xBA, 69)   // 'E'
  _w8(buf, d + 0xBB, 120)  // 'x'
  _w8(buf, d + 0xBC, 105)  // 'i'
  _w8(buf, d + 0xBD, 116)  // 't'
  _w8(buf, d + 0xBE, 80)   // 'P'
  _w8(buf, d + 0xBF, 114)  // 'r'
  _w8(buf, d + 0xC0, 111)  // 'o'
  _w8(buf, d + 0xC1, 99)   // 'c'
  _w8(buf, d + 0xC2, 101)  // 'e'
  _w8(buf, d + 0xC3, 115)  // 's'
  _w8(buf, d + 0xC4, 115)  // 's'
  _w8(buf, d + 0xC5, 0)    // null
920
  // "kernel32.dll\0" at offset 0xC6 (RVA 0x30C6)
  _w8(buf, d + 0xC6, 107)  // 'k'
  _w8(buf, d + 0xC7, 101)  // 'e'
  _w8(buf, d + 0xC8, 114)  // 'r'
  _w8(buf, d + 0xC9, 110)  // 'n'
  _w8(buf, d + 0xCA, 101)  // 'e'
  _w8(buf, d + 0xCB, 108)  // 'l'
  _w8(buf, d + 0xCC, 51)   // '3'
  _w8(buf, d + 0xCD, 50)   // '2'
  _w8(buf, d + 0xCE, 46)   // '.'
  _w8(buf, d + 0xCF, 100)  // 'd'
  _w8(buf, d + 0xD0, 108)  // 'l'
  _w8(buf, d + 0xD1, 108)  // 'l'
  _w8(buf, d + 0xD2, 0)    // null
935
  return NX_PE_OK
937}
938
939// ===== File-flush helper =================================================
940// Writes the PE bytes to a Windows-visible path via sys_openat + sys_write.
941// Returns NX_PE_OK or -verdict.
942func nx_pe_write_to_file(path: *u8, buf: *u8, n_bytes: i64) -> i64 {
  if (path as i64) == 0 { return 0 - NX_PE_BAD_INPUT }
  if (buf as i64) == 0 { return 0 - NX_PE_BAD_INPUT }
  if n_bytes <= 0 { return 0 - NX_PE_BAD_INPUT }
  let fd: i64 = sys_openat_wr(path, 0x1ED)   // mode 0755
  if fd < 0 { return 0 - NX_PE_FAULT }
  let written: i64 = sys_write(fd, buf, n_bytes)
  sys_close(fd)
  if written != n_bytes { return 0 - NX_PE_FAULT }
  return NX_PE_OK
952}
nx_pe_writer.nx source

`nx_pe_writer.nx` source
