code wiki / _hdl_build / nx_recycler_discover.nx
nx_recycler_discover.nx source
↩ module page · 122 lines · 6910 B
1// nx_recycler_discover.nx -- Identifies and adds new CVEs from fetched data to a unique discovery queue for further assessment.
2import "nx_gate_gn.nx"
3// nx_recycler_discover.nx -- R2 DYNAMIC DISCOVERY (the operator's "researcher logically looking for bugs that apply"
4// instead of a hardcoded intake). Rather than a curated list, it MINES the corpus we already fetched: it scans the
5// real knowledge/fetched/recyc_*.raw bytes for CVE-IDs (CVE-YYYY-NNNN+), dedups them, and flags the ones BEYOND our
6// already-assessed seed = the self-feeding discovery queue (each new CVE is a next-intake candidate to fetch+assess).
7// Grounded by construction (reads real fetched bytes, no fabricated CVEs). Self-gating. license_tier: ORIGINAL
8import "nx_syscalls.nx"
9
10func gp(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} sys_write(1,s,n); return 0 }
11func isdig(c: i64) -> i64 { if c>=48 { if c<=57 { return 1 } } return 0 }
12// length of a CVE-YYYY-NNNN+ token starting at i, or 0 if none.
13func cve_len(buf: *u8, n: i64, i: i64) -> i64 {
14 if i+4 > n { return 0 }
15 if buf[i]!=(67 as u8) { return 0 }
16 if buf[i+1]!=(86 as u8) { return 0 }
17 if buf[i+2]!=(69 as u8) { return 0 }
18 if buf[i+3]!=(45 as u8) { return 0 }
19 var p: i64=i+4; var d1: i64=0; var go: i64=1
20 while go==1 { if p<n { if isdig(buf[p] as i64)==1 { p=p+1; d1=d1+1 } else { go=0 } } else { go=0 } }
21 if d1 < 4 { return 0 }
22 if p>=n { return 0 }
23 if buf[p]!=(45 as u8) { return 0 } // year must be followed by '-'
24 p=p+1
25 var d2: i64=0; go=1
26 while go==1 { if p<n { if isdig(buf[p] as i64)==1 { p=p+1; d2=d2+1 } else { go=0 } } else { go=0 } }
27 if d2 < 4 { return 0 }
28 return p - i
29}
30func streqn(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i]{return 0} i=i+1 } return 1 }
31// 1 if the CVE token at buf[i..i+L) is one of our 5 already-assessed seed CVEs.
32func is_seed(buf: *u8, i: i64, L: i64) -> i64 {
33 let s0: *u8 = "CVE-2014-0160" as *u8
34 let s1: *u8 = "CVE-2014-6271" as *u8
35 let s2: *u8 = "CVE-2021-44228" as *u8
36 let s3: *u8 = "CVE-2016-5195" as *u8
37 let s4: *u8 = "CVE-2017-5753" as *u8
38 var hit: i64=0
39 if L==slen0(s0) { if streqn_at(buf, i, s0, L)==1 { hit=1 } }
40 if L==slen0(s1) { if streqn_at(buf, i, s1, L)==1 { hit=1 } }
41 if L==slen0(s2) { if streqn_at(buf, i, s2, L)==1 { hit=1 } }
42 if L==slen0(s3) { if streqn_at(buf, i, s3, L)==1 { hit=1 } }
43 if L==slen0(s4) { if streqn_at(buf, i, s4, L)==1 { hit=1 } }
44 return hit
45}
46func slen0(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n }
47func streqn_at(buf: *u8, i: i64, lit: *u8, L: i64) -> i64 { var k: i64=0; while k<L { if buf[i+k]!=lit[k]{return 0} k=k+1 } return 1 }
48// add the CVE token buf[i..i+L) to the unique store if absent; returns 1 if newly added.
49func uniq_add(store: *u8, lens: *i64, cntp: *i64, buf: *u8, i: i64, L: i64, capn: i64) -> i64 {
50 let cnt: i64 = cntp[0]
51 var e: i64=0
52 while e < cnt {
53 if lens[e]==L { var k: i64=0; var same: i64=1; while k<L { if store[e*24+k]!=buf[i+k]{same=0;k=L} else {k=k+1} } if same==1 { return 0 } }
54 e=e+1
55 }
56 if cnt >= capn { return 0 }
57 if L > 23 { return 0 }
58 var k: i64=0; while k<L { store[cnt*24+k]=buf[i+k]; k=k+1 }
59 lens[cnt]=L; cntp[0]=cnt+1
60 return 1
61}
62
63func scan_file(path: *u8, store: *u8, lens: *i64, cntp: *i64, seedp: *i64, newp: *i64, capn: i64) -> i64 {
64 let lp: *i64 = sys_mmap(16) as *i64; lp[0]=0
65 let buf: *u8 = sys_read_file(path, lp)
66 if (buf as i64)==0 { return 0 }
67 let n: i64 = lp[0]
68 var i: i64=0
69 while i < n {
70 let L: i64 = cve_len(buf, n, i)
71 if L > 0 {
72 let added: i64 = uniq_add(store, lens, cntp, buf, i, L, capn)
73 if added==1 { if is_seed(buf, i, L)==1 { seedp[0]=seedp[0]+1 } else { newp[0]=newp[0]+1 } }
74 i = i + L
75 } else { i=i+1 }
76 }
77 return 1
78}
79
80func main() -> i64 {
81 gp("=== nx_recycler_discover: mine the fetched corpus for MORE bugs to consume (R2 dynamic discovery) ===\n" as *u8)
82 let capn: i64 = 512
83 let store: *u8 = sys_mmap(capn*24)
84 let lens: *i64 = sys_mmap(capn*8) as *i64
85 let cntp: *i64 = sys_mmap(16) as *i64; cntp[0]=0
86 let seedp: *i64 = sys_mmap(16) as *i64; seedp[0]=0
87 let newp: *i64 = sys_mmap(16) as *i64; newp[0]=0
88
89 var files: i64=0
90 files = files + scan_file("knowledge/fetched/recyc_heartbleed.raw" as *u8, store, lens, cntp, seedp, newp, capn)
91 files = files + scan_file("knowledge/fetched/recyc_shellshock.raw" as *u8, store, lens, cntp, seedp, newp, capn)
92 files = files + scan_file("knowledge/fetched/recyc_log4shell.raw" as *u8, store, lens, cntp, seedp, newp, capn)
93 files = files + scan_file("knowledge/fetched/recyc_dirtycow.raw" as *u8, store, lens, cntp, seedp, newp, capn)
94 files = files + scan_file("knowledge/fetched/recyc_spectre.raw" as *u8, store, lens, cntp, seedp, newp, capn)
95 files = files + scan_file("knowledge/fetched/recyc_bufferoverread.raw" as *u8, store, lens, cntp, seedp, newp, capn)
96 files = files + scan_file("knowledge/fetched/recyc_intoverflow.raw" as *u8, store, lens, cntp, seedp, newp, capn)
97 files = files + scan_file("knowledge/fetched/recyc_leftpad.raw" as *u8, store, lens, cntp, seedp, newp, capn)
98
99 let total: i64 = cntp[0]
100 gp(" DISCOVERED CVE-IDs (unique) from real fetched bytes: " as *u8); gn(total)
101 gp(" (of which already-assessed seed=" as *u8); gn(seedp[0]); gp(", NEW discovery candidates=" as *u8); gn(newp[0]); gp(")\n" as *u8)
102 // print a sample of the NEW discoveries
103 gp(" sample discovered: " as *u8)
104 var s: i64=0; var shown: i64=0
105 while s < total {
106 if shown < 12 { var k: i64=0; while k<lens[s] { let o: *u8=sys_mmap(1); o[0]=store[s*24+k]; sys_write(1,o,1); k=k+1 } gp(" " as *u8); shown=shown+1 }
107 s=s+1
108 }
109 gp("\n" as *u8)
110
111 var pass: i64=0; var fail: i64=0
112 if files >= 6 { pass=pass+1 } else { fail=fail+1; gp(" FAIL too-few-files-scanned (intake missing?)\n" as *u8) }
113 if total >= 6 { pass=pass+1 } else { fail=fail+1; gp(" FAIL too-few-cves (scan not meaningful)\n" as *u8) }
114 if seedp[0] >= 3 { pass=pass+1 } else { fail=fail+1; gp(" FAIL did-not-rediscover-our-seed-CVEs\n" as *u8) }
115 if newp[0] >= 1 { pass=pass+1 } else { fail=fail+1; gp(" FAIL no-NEW-discovery (the corpus should reference bugs beyond our curated 8)\n" as *u8) }
116 // liar-kill: cve_len rejects a non-CVE
117 if cve_len("CVE-XX-1" as *u8, 8, 0)==0 { pass=pass+1 } else { fail=fail+1; gp(" FAIL cve_len-false-positive\n" as *u8) }
118
119 gp("RECYCLER-DISCOVER pass=" as *u8); gn(pass); gp(" fail=" as *u8); gn(fail)
120 if fail==0 { gp(" verdict=GREEN (dynamically discovered CVEs from the real corpus incl. NEW ones beyond the curated seed -> the next intake queue)\n" as *u8); sys_exit(0); return 0 }
121 gp(" verdict=RED\n" as *u8); sys_exit(1); return 1
122}