nx_video_sniff_gate.nx source

1import "nx_gate_gn.nx" 2import "nx_gate_base.nx" 3// nx_video_sniff_gate.nx -- proves the discovery->download bridge: run a JS-hardened video page, capture the 4// stream URLs its obfuscated code builds, rank them, and emit the right X-DLP download route. license_tier: ORIGINAL expect_exit: 0 5import "nx_syscalls.nx" 6import "nx_js_eval.nx" 7import "nx_media_jsexec.nx" 8import "nx_video_sniff.nx" 9import "nx_gate_verdict.nx" 10 11func grow(name: *u8, ok: i64) -> i64 { if ok==1 { gw(" PASS " as *u8) } else { gw(" FAIL " as *u8) } gw(name); gw(" 12" as *u8); return ok } 13func gsl(s: *u8) -> i64 { var n: i64=0; while s[n]!=(0 as u8){n=n+1} return n } 14func plan_has(planbuf: *u8, want: *u8) -> i64 { return mjx_contains(planbuf, gsl(planbuf), want, gsl(want)) } 15 16// run vs_sniff on `js`; pass iff returned kind == want_kind AND the plan contains both want_route and want_url. 17func run_vs(js: *u8, want_kind: i64, want_route: *u8, want_url: *u8) -> i64 { 18 let listbuf: *u8 = sys_mmap(4096) 19 let planbuf: *u8 = sys_mmap(2560) 20 let k: i64 = vs_sniff(js, gsl(js), listbuf, 4096, planbuf, 2560) 21 if k != want_kind { gw(" (kind=" as *u8); gn(k); gw(" plan=[" as *u8); gw(planbuf); gw("])\n" as *u8); return 0 } 22 if plan_has(planbuf, want_route) == 0 { gw(" (route miss, plan=[" as *u8); gw(planbuf); gw("])\n" as *u8); return 0 } 23 if plan_has(planbuf, want_url) == 0 { gw(" (url miss, plan=[" as *u8); gw(planbuf); gw("])\n" as *u8); return 0 } 24 return 1 25} 26 27func main() -> i64 { 28 gw("video-sniff SOVEREIGN gate (run hardened page JS -> capture stream URL -> rank -> X-DLP route)\n" as *u8) 29 var pass: i64 = 0 30 var ttl: i64 = 0 31 32 // VS1: obfuscated page builds the HLS master at runtime + also fetches a segment + a poster; the MASTER 33 // must win (a manifest gets all qualities+segments; the lone .ts and the image are not the target). 34 ttl=ttl+1; pass=pass+grow("VS1 runtime master.m3u8 beats segment+poster -> route=hls\x00" as *u8, 35 run_vs("function m(id){return 'https://cdn/'+id+'/master.m3u8';} var v='X7'; fetch(m(v)); fetch('https://cdn/X7/seg1.ts'); fetch('https://cdn/X7/poster.jpg');" as *u8, 36 VSK_HLS, "ROUTE=hls\x00" as *u8, "https://cdn/X7/master.m3u8\x00" as *u8)) 37 // VS2: only a direct file -> route=direct (nx_video_get). 38 ttl=ttl+1; pass=pass+grow("VS2 direct .mp4 -> route=direct\x00" as *u8, 39 run_vs("var u='https://cdn/'+'movie'+'.mp4'; fetch(u);" as *u8, 40 VSK_DIRECT, "ROUTE=direct\x00" as *u8, "https://cdn/movie.mp4\x00" as *u8)) 41 // VS3: manifest AND direct present -> manifest wins (all qualities). 42 ttl=ttl+1; pass=pass+grow("VS3 .m3u8 present beats .mp4 -> route=hls\x00" as *u8, 43 run_vs("fetch('https://c/index.m3u8'); fetch('https://c/fallback.mp4');" as *u8, 44 VSK_HLS, "ROUTE=hls\x00" as *u8, "https://c/index.m3u8\x00" as *u8)) 45 // VS4: DASH manifest -> honestly routed dash-todo (nx_hls_get is HLS-only). 46 ttl=ttl+1; pass=pass+grow("VS4 .mpd -> route=dash-todo (honest: not yet downloadable)\x00" as *u8, 47 run_vs("fetch('https://c/manifest.mpd');" as *u8, 48 VSK_DASH, "ROUTE=dash-todo\x00" as *u8, "https://c/manifest.mpd\x00" as *u8)) 49 // VS5: images only, no video -> no target (route=none). The sniffer is video-focused, not noisy. 50 ttl=ttl+1; pass=pass+grow("VS5 images only -> route=none\x00" as *u8, 51 run_vs("fetch('https://c/thumb.jpg'); fetch('https://c/logo.png');" as *u8, 52 VSK_NONE, "ROUTE=none\x00" as *u8, "URL=-\x00" as *u8)) 53 // VS6: SIGNED/tokened manifest built at runtime -> captured WITH its token, routed hls. 54 ttl=ttl+1; pass=pass+grow("VS6 signed ?token m3u8 -> route=hls, token preserved\x00" as *u8, 55 run_vs("var t='?token=abc123&e=999'; fetch('https://cdn/vid/master.m3u8'+t);" as *u8, 56 VSK_HLS, "ROUTE=hls\x00" as *u8, "master.m3u8?token=abc123\x00" as *u8)) 57 // VS7: a bare segment with NO manifest -> honestly flagged segment-only (can't stitch without the playlist). 58 ttl=ttl+1; pass=pass+grow("VS7 bare .ts, no manifest -> route=segment-only\x00" as *u8, 59 run_vs("fetch('https://cdn/only_seg.ts');" as *u8, 60 VSK_SEGMENT, "ROUTE=segment-only\x00" as *u8, "https://cdn/only_seg.ts\x00" as *u8)) 61 62 gw("pass=" as *u8); gn(pass); gw("/" as *u8); gn(ttl); gw("\n" as *u8) 63 // MIGRATED onto nx_gate_verdict by nx_gate_dry_apply (D001, minimal form): every check 64 // row above is untouched, so the PASS/FAIL vector cannot change; only the hand-rolled 65 // verdict emission is replaced by the ONE shared base class. Proven by nx_gate_migrate verify. 66 let ctr__dry: *i64 = gv_ctr() 67 ctr__dry[0] = pass 68 ctr__dry[1] = ttl 69 let rc__dry: i64 = gv_verdict("VIDEO-SNIFF-GATE" as *u8, ctr__dry, "hardened page -> sniff runtime stream URL -> ranked X-DLP download route)" as *u8) 70 sys_exit(rc__dry) 71 return rc__dry 72}