The public xvmp tree ships a compiler half that was never compiled (no TU
includes the virtualizer headers; on dev trees they do not build), a weak
empty vm_exec stub, silent skips for unsupported IR, and a companion article
describing an earlier prototype that is not in the tree. This change completes
and measures the chain:
- Completed toolchain, merged into all four omp branches of that tree: gated
new-PM pass wiring (-mllvm -irobf-irvm, section .irvm), FORMAT v3 bytecode
(8-byte aligned slots, explicit load/store widths, stable CC_ cast kinds,
per-index GEP byte scales, branch condition = operand 0), a strong-symbol
vm_exec interpreter with a 23-check unit suite, and a VMP.h user header.
Virtualized vs native output identical at -O0/-O1/-O2 on all four
branches. One branch's ungated IRVM call in Obfuscation::runOnModule
(rewrote .irvm functions in plain native builds) removed; IRVM is
strictly flag-gated.
- Fixture measured end to end (fco+bcfobf+subobf+IRVM build): native-identical
output; 17,961-step guest trace via VMP_TRACE; 24.6M-instruction host trace
via a ptrace single-stepper; vm_handler_slice yields 95,184 segments / 18
unique signatures; the fla outer state machine separates as a shuttle class,
round-boundary segments split the trajectory, positional alignment names
every handler segment (59/59 in a round; counts match the guest histograms
exactly), zero unmapped with --opcode-map.
- Tooling hardening measured on the real fixture: opcode maps key by
signature (first-block keys collide under a shared dispatch successor);
apply_map keeps first-block keys as fallback, regression tests added.
- Environment boundary recorded: frida stalker does not work in these
containers (measured past the syscall layer: primitives pass, agent loads,
zero denied syscalls; the failure is inside the injected agent's hook
machinery), an outer ptrace tracer conflicts with frida spawn, and the
ptrace stepper is the working host capture path. Design lesson: a pure
virtualized call can still be LICM-hoisted by the compiling optimizer.
Records: EXTENSION-sampling-crash.md SS5-SS6 (final-state rewrite),
known-limitations.md, ete-diff-tracing.md SS5, vm_handler_slice.py header,
capability matrix.
