mirror of
https://github.com/morluto/rea
synced 2026-10-28 23:11:11 -04:00
N0zoM1z0
f44dca9c37
Share exact jump-table metadata and paged case relationships across CLI, MCP and Code Mode. Keep labels, row identities, recovered edges and machine defaults separate; reclaim independent facts under output capacity. Verify all 182 SQLite table targets against ELF bytes through both MCP adapters and retain cases/calls when a real 2 MiB native budget omits IR. Freeze the next analyst question and oracle before real-model trials. [AUTOMATED] Experimental native patch; no upstream integration or PR. Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com> Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
77 lines
4.7 KiB
Markdown
77 lines
4.7 KiB
Markdown
# SQLite indirect-dispatch oracle
|
|
|
|
Freeze this question/oracle before measured model launches. The question supplies
|
|
a function name, two formats and selected case values, without code/table/graph
|
|
addresses. This is a scoped investigation. Both atomic adapters share facts;
|
|
no traditional-provider cell exists for its required native identities. The
|
|
direct client also has its own JavaScript executor.
|
|
|
|
Target: Debian SQLite `3.40.1-2+deb12u2` amd64,
|
|
`/usr/lib/x86_64-linux-gnu/libsqlite3.so.0` -> `.0.8.6`, SHA-256
|
|
`2e6eef9a727f081f0d453b4e5e6cbd8b9ef8b6f86cbf7681cbad444d3b0b55c8`.
|
|
Final engine SHA-256:
|
|
`a9ca8a8ac224936afb08a9d4be9c1225feb69473ad9f35764e8d1c4f04875b5b`.
|
|
|
|
Callable entries `0x288f0` and `0xea6d0` share the VDBE name; the two format
|
|
references establish owning entry `0xea6d0` before deep analysis. Names do not
|
|
establish runtime binding. One snapshot has 21,349 recovered operations, 35,755
|
|
values, 1,229 blocks, zero omitted definitions and one indirect branch:
|
|
`0xea801:fe`, block 8. The switch facet has 182 labelled rows and mappings,
|
|
149 distinct targets/edges, partial=false, and zero missing/no-label/unmapped/
|
|
unknown-target rows. Consumed mask is `0xff`; signed_render_hint=false is not
|
|
itself an unsignedness proof.
|
|
|
|
The current selector is eight-byte `v100031675` at `register:0x10`, defined by
|
|
`0xea7f6:c353 CPUI_INT_ZEXT`. Its one-byte input `v10000024f` is defined by LOAD
|
|
`0xea7e1:de`. Those widths/definitions are verified in structured native facts.
|
|
The machine reads one byte, indexes through R15B/EDX, computes a target in RAX
|
|
and jumps through RAX. The normalized BRANCHIND input is not that jump address.
|
|
Storage offsets do not specify arbitrary computed contents.
|
|
|
|
Independent GNU disassembly and ELF program-header/file reads establish:
|
|
|
|
| Address | Bytes | Machine fact |
|
|
| ------- | -------------- | ------------------------------- |
|
|
| 0xea7e1 | 440fb638 | MOVZX R15D,byte [RAX] |
|
|
| 0xea7e5 | 4180ffb5 | CMP R15B,0xb5 |
|
|
| 0xea7e9 | 0f87a9010000 | JA 0xea998; fallthrough 0xea7ef |
|
|
| 0xea7ef | 488d0d121f0400 | LEA RCX,[0x12c708] |
|
|
| 0xea7f6 | 410fb6d7 | MOVZX EDX,R15B |
|
|
| 0xea7fa | 48630491 | MOVSXD RAX,dword [RCX+RDX*4] |
|
|
| 0xea7fe | 4801c8 | ADD RAX,RCX |
|
|
| 0xea801 | ffe0 | JMP RAX |
|
|
|
|
Table base is `0x12c708`: 182 entries for zero-extended byte values `0..0xb5`,
|
|
each a signed little-endian 32-bit displacement added to the base. Local
|
|
`.cache/atomic-codemode/sqlite-switch-machine-oracle.json` records all bytes,
|
|
file offsets and 149 unique targets, reconstructed before native verification.
|
|
Both MCP paths compare all 182 native labelled rows to that independent table.
|
|
|
|
| Case / row | Table address | Raw bytes / signed displacement | Native edge -> block | Original target |
|
|
| ---------- | ------------- | ------------------------------- | -------------------- | --------------- |
|
|
| 0x0 / 0 | 0x12c708 | d814fcff / -256808 | 8:0 -> 1140 | 0xedbe0 |
|
|
| 0x2a / 42 | 0x12c7b0 | a8e7fbff / -268376 | 8:34 -> 864 | 0xeaeb0 |
|
|
| 0x34 / 52 | 0x12c7d8 | e8e5fbff / -268824 | 8:42 -> 778 | 0xeacf0 |
|
|
| 0x39 / 57 | 0x12c7ec | e8e5fbff / -268824 | 8:42 -> 778 | 0xeacf0 |
|
|
| 0xb5 / 181 | 0x12c9dc | 16eefbff / -266730 | 8:8 -> 1011 | 0xeb51e |
|
|
|
|
The middle pair shares an edge/target but keeps distinct case identities.
|
|
Row and edge ordinals differ: row 181 maps to edge 8. Relations carry case_id
|
|
and a separate relation id; multiple edges share case_id and page separately.
|
|
|
|
Native model default: `8:42`, block 778, origin `0xeacf0`, raw default index 42,
|
|
default_is_folded=false. Known values `0x34..0x39` share it. It is not the
|
|
machine out-of-range guard destination `0xea998`. No explicit native row is
|
|
labelled `0xb6`. If the selected local byte were `0xb6`, unsigned JA bypasses
|
|
the table and reaches `0xea998`; this does not prove that such input occurs.
|
|
|
|
Grade the complete answer and trace: correct ownership before one VM capture,
|
|
selected case reads, source-byte versus normalized-selector widths, row/edge
|
|
identities and shared targets, selected raw displacement arithmetic, the two
|
|
different defaults, real source IDs/digest and static coverage limitations.
|
|
No whole case inventory/C report/graph fetch, source field/opcode-name guesses,
|
|
SQL trigger or runtime binding claim. Full recovery does not prove complete
|
|
machine flow, memory aliases, nontermination or feasible inputs. Producer
|
|
equality is not independent machine/IR equivalence. Include discovery, schema
|
|
reads, errors/retries, all responses and final answers in whole-task costs.
|