#!/usr/bin/env python3
# wall2_resolver6.py - resolver5 logic for BOTH current push windows:
#   pair A: push 0x4480000 (0x20000) + ring 0x44a0000 (0x40000)
#   pair B: push 0x4ca0000 (0x20000) + ring 0x4cc0000 (0x40000)
# Scans guest RAM continuously; injects PUSH_VA -> every 0x20000 memdesc PA
# found in a page holding both window records.
import subprocess, struct, time, sys, os

RAM = "/dev/shm/vgpu-guest-ram"
PARAM = "/sys/module/vgsp/parameters/sema_map_add"
LOG = "/tmp/opencode/wall2_resolver6.log"
WATCH_S = int(os.environ.get("W2_WATCH", "420"))
PAIRS = [(0x4480000, 0x44a0000), (0x4ca0000, 0x4cc0000)]

logf = open(LOG, "a", buffering=1)
def log(*a):
    s = " ".join(str(x) for x in a)
    print(s, flush=True)
    logf.write("[%s] %s\n" % (time.strftime("%H:%M:%S"), s))

img = open(RAM, "rb", buffering=0)
def off2gpa(off):
    return off if off < 0x80000000 else 0x100000000 + (off - 0x80000000)
def gpa2off(pa):
    if pa < 0x80000000: return pa
    if pa < 0x180000000: return 0x80000000 + (pa - 0x100000000)
    return None
def rd(pa, n):
    off = gpa2off(pa)
    if off is None: return None
    img.seek(off); return img.read(n)

def inject(va, pa, ln=0x1000, ap=1):
    cmd = "echo 0x%x,0x%x,0x%x,%d > %s" % (va, pa, ln, ap, PARAM)
    r = subprocess.run(["sudo", "sh", "-c", cmd], capture_output=True, text=True)
    if r.returncode == 0:
        log("INJECT va=0x%x -> pa=0x%x" % (va, pa))
        return True
    log("inject FAIL rc=%d %s" % (r.returncode, r.stderr.strip()))
    return False

def find_qpair(a, b):
    img.seek(0, 2); fsz = img.tell()
    pat = struct.pack("<QQ", a, b)
    out = []
    CH = 64 << 20
    pos = 0
    while pos < fsz:
        img.seek(pos); d = img.read(min(CH, fsz - pos))
        st = 0
        while True:
            i = d.find(pat, st)
            if i < 0: break
            st = i + 1
            out.append(off2gpa(pos + i) & ~0xfff)
        pos += CH
    return out

def main():
    log("=== resolver6 start (watch=%ds) ===" % WATCH_S)
    injected = set()
    deadline = time.time() + WATCH_S
    while time.time() < deadline:
        for (pva, rva) in PAIRS:
            try:
                pages = set(find_qpair(pva, 0x20000)) & set(find_qpair(rva, 0x40000))
            except Exception as e:
                log("scan error:", e); continue
            for page in sorted(pages):
                d = rd(page, 0x1000)
                if not d: continue
                cands = []
                for o in range(0, 0x1000 - 24, 8):
                    sz, fl = struct.unpack_from("<QQ", d, o)
                    if sz == 0x20000 and fl == 0x03008000:
                        pa = struct.unpack_from("<Q", d, o + 16)[0]
                        if 0x100000000 <= pa < 0x180000000:
                            cands.append((o, pa))
                for (o, pa) in cands:
                    key = (pva, page, o)
                    if key in injected: continue
                    pd = rd(pa, 0x40)
                    nz = sum(1 for b in pd if b) if pd else -1
                    log("pair=0x%x page=0x%x desc@0x%x pa=0x%x live_nz=%d head=%s"
                        % (pva, page, o, pa, nz, pd.hex()[:64] if pd else "?"))
                    if inject(pva, pa):
                        injected.add(key)
        time.sleep(1)
    log("=== resolver6 done: %d injection(s) ===" % len(injected))
    return 0

if __name__ == "__main__":
    sys.exit(main())