#!/usr/bin/env python3 # a8clear.py - no-ptrace A8/NvOgl count clearer: finds each live vk_frame's # libnvidia-eglcore base (the off==0 mapping) and writes 0 to the u32 at # base+0x2070b7c whenever it is nonzero (the count gate t91 cleared via gdb). import os, subprocess, sys, time DUR = float(sys.argv[1]) if len(sys.argv) > 1 else 600 def pids(): try: out = subprocess.run(["pgrep", "-x", "vk_frame"], capture_output=True).stdout return [int(x) for x in out.split()] except Exception: return [] log = set() end = time.time() + DUR while time.time() < end: for pid in pids(): base = None try: for line in open("/proc/%d/maps" % pid): p = line.split() if len(p) < 6 or "libnvidia-eglcore" not in p[-1]: continue try: off = int(p[2], 16) except Exception: continue if off == 0: base = int(p[0].split("-")[0], 16) break except Exception: continue if not base: continue w = base + 0x2070b7c try: fd = os.open("/proc/%d/mem" % pid, os.O_RDWR) os.lseek(fd, w, 0) v = os.read(fd, 4) if len(v) == 4: n = int.from_bytes(v, "little") if n: os.lseek(fd, w, 0) os.write(fd, b"\x00\x00\x00\x00") k = (pid, n) if len(log) < 40: log.add(k) print("A8CLEAR pid=%d count=%u -> 0" % (pid, n), flush=True) os.close(fd) except Exception: pass time.sleep(0.5) print("A8CLEAR-DONE", flush=True)