nx_surrogate_satisfy_gate.nx source

1import "nx_gate_gn.nx" 2import "nx_gate_base.nx" 3// nx_surrogate_satisfy_gate.nx -- proves SURROGATE-AND-SATISFY end to end in our real JS engine: inject the 4// surrogate preamble, then run synthetic ad-GATED pages whose media fetch only fires if the anti-adblock/tracker 5// gate reads back as success. If the gated fetch is captured (pending), the decoys satisfied the gate -> the 6// media unlocks. This is the mechanism the /visit sandbox uses to make hostile-gated sites play. ORIGINAL expect_exit: 0 7import "nx_syscalls.nx" 8import "nx_js_eval.nx" 9import "nx_surrogate.nx" 10import "nx_gate_verdict.nx" 11 12func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 13" as *u8); return ok } 14func gsl(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 15func contains(hay: *u8, hl: i64, needle: *u8) -> i64 { let nl: i64=gsl(needle); if nl>hl {return 0} var i: i64=0; let last: i64=hl-nl; while i<=last { var j: i64=0; var m: i64=1; while j<nl { if (hay[i+j]&0xff)!=(needle[j]&0xff){m=0;j=nl} else {j=j+1} } if m==1 {return 1} i=i+1 } return 0 } 16 17// combine preamble + page, run in the engine, return 1 if a pending fetch URL contains `want` (gate satisfied). 18func satisfy(preamble: *u8, plen: i64, page: *u8, want: *u8) -> i64 { 19 let src: *u8 = sys_mmap(1048576) 20 var o: i64 = 0 21 var i: i64 = 0; while i < plen { src[o]=preamble[i]; o=o+1; i=i+1 } 22 src[o]=59 as u8; o=o+1; src[o]=10 as u8; o=o+1 // ";\n" 23 i = 0; while (page[i]&0xff)!=0 { src[o]=page[i]; o=o+1; i=i+1 } 24 src[o]=0 as u8 25 let obx: *i64 = sys_mmap(16) as *i64 26 if js_run_source_keep(src, o, obx) != 0 { return 0 } // parse error 27 let genv: *i64 = (obx[1]) as *i64 28 if (genv as i64) == 0 { return 0 } 29 let ubuf: *u8 = sys_mmap(4096) 30 var k: i64 = 0; var go: i64 = 1 31 while go == 1 { if k >= 4096 { go = 0 } else { let ul: i64 = js_pending_url(genv, k, ubuf, 4096); if ul == 0 { go = 0 } else { if contains(ubuf, ul, want) == 1 { return 1 } k = k + 1 } } } 32 return 0 33} 34 35func main() -> i64 { 36 gw("surrogate-satisfy SOVEREIGN gate (inject stubs -> ad-gated page's media fetch fires -> content unlocks)\n" as *u8) 37 var pass: i64 = 0 38 var ttl: i64 = 0 39 let pre: *u8 = sys_mmap(16384) 40 let t: *i64 = sg_new(); sg_seed(t) 41 let plen: i64 = sg_build_preamble(t, pre, 16384) 42 43 // P0: the preamble ITSELF runs clean in our engine (no parse/run failure) 44 let obx: *i64 = sys_mmap(16) as *i64 45 let pr0: i64 = js_run_source_keep(pre, plen, obx) 46 ttl=ttl+1; pass=pass+grow("P0 preamble runs clean in the engine\x00" as *u8, ((pr0 == 0)) as i64 * (((obx[1]) as i64 != 0) as i64)) 47 48 // P1: canRunAds gate -> media fetch fires 49 ttl=ttl+1; pass=pass+grow("P1 canRunAds gate satisfied -> fetch(canrun.m3u8) fires\x00" as *u8, 50 satisfy(pre, plen, "if(window.canRunAds){fetch('https://cdn.x/canrun.m3u8')}" as *u8, "canrun.m3u8" as *u8)) 51 // P2: FuckAdBlock not-detected callback fires the media fetch 52 ttl=ttl+1; pass=pass+grow("P2 FuckAdBlock onNotDetected cb -> fetch(fab.m3u8) fires\x00" as *u8, 53 satisfy(pre, plen, "var f=new FuckAdBlock();f.onNotDetected(function(){fetch('https://cdn.x/fab.m3u8')})" as *u8, "fab.m3u8" as *u8)) 54 // P3: adsbygoogle.push + gtag don't throw, page proceeds to fetch the stream 55 ttl=ttl+1; pass=pass+grow("P3 adsbygoogle.push/gtag no-throw -> fetch(ads.m3u8) fires\x00" as *u8, 56 satisfy(pre, plen, "adsbygoogle.push({});gtag('event','x');fetch('https://cdn.x/ads.m3u8')" as *u8, "ads.m3u8" as *u8)) 57 // P4: window.open returns a truthy decoy -> popup "succeeds", page continues to load media 58 ttl=ttl+1; pass=pass+grow("P4 window.open decoy truthy -> page proceeds, fetch(pop.m3u8) fires\x00" as *u8, 59 satisfy(pre, plen, "var w=window.open('http://ad/pop');if(w&&!w.closed){fetch('https://cdn.x/pop.m3u8')}" as *u8, "pop.m3u8" as *u8)) 60 // P5: google_ad_status success global gate 61 ttl=ttl+1; pass=pass+grow("P5 google_ad_status===1 gate -> fetch(gas.m3u8) fires\x00" as *u8, 62 satisfy(pre, plen, "if(window.google_ad_status===1){fetch('https://cdn.x/gas.m3u8')}" as *u8, "gas.m3u8" as *u8)) 63 // P6: NEGATIVE control -- a gate our stubs do NOT satisfy stays closed (no false unlock) 64 ttl=ttl+1; pass=pass+grow("P6 negative control: unmet gate -> media fetch does NOT fire\x00" as *u8, 65 (satisfy(pre, plen, "if(window.__nishi_never_defined_flag__){fetch('https://cdn.x/never.m3u8')}" as *u8, "never.m3u8" as *u8) == 0) as i64) 66 67 gw("pass=" as *u8); gn(pass); gw("/" as *u8); gn(ttl); gw("\n" as *u8) 68 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 69 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 70 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 71 let ctr__dry: *i64 = gv_ctr() 72 ctr__dry[0] = pass 73 ctr__dry[1] = ttl 74 let rc__dry: i64 = gv_verdict("SURROGATE-SATISFY-GATE" as *u8, ctr__dry, "surrogate-and-satisfy works in the engine: decoys unlock the gated media; unmet gates stay shut)" as *u8) 75 sys_exit(rc__dry) 76 return rc__dry 77}