scientific-method-engine 0.6.0__tar.gz → 0.8.0__tar.gz

{scientific_method_engine-0.6.0 → scientific_method_engine-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: scientific-method-engine
-Version: 0.6.0
+Version: 0.8.0
 Summary: Bounded instruction-derived x86 evidence reports for segmented MZ/FBOV and PE32/i386 code.
 Project-URL: Source, https://github.com/kibertoad/refurbished-dinosaurs-toolkit/tree/main/packages/scientific-method-engine
 Author: kibertoad

{scientific_method_engine-0.6.0 → scientific_method_engine-0.8.0}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "hatchling.build"
 [project]
 name = "scientific-method-engine"
 # The release workflow writes the published version from the package's release tag.
-version = "0.6.0"
+version = "0.8.0"
 description = "Bounded instruction-derived x86 evidence reports for segmented MZ/FBOV and PE32/i386 code."
 readme = "README.md"
 requires-python = ">=3.12"

{scientific_method_engine-0.6.0 → scientific_method_engine-0.8.0}/src/scientific_method_engine/cli.py

@@ -3,10 +3,16 @@ import json
 import sys
 from pathlib import Path
 
+import capstone
+import pypcode
+
 from . import PREPARED_PROTOCOL
 
 CONFIG_LIMIT = 1024 * 1024
 PREPARED_CONFIG_LIMIT = 16 * 1024 * 1024
+# The header names the decoder and instruction semantics that actually ran, not the pins in pyproject.toml.
+DECODER = "capstone " + capstone.__version__
+INSTRUCTION_SEMANTICS = f"pypcode {pypcode.__version__} (Ghidra SLEIGH x86)"
 USAGE = ("Usage: scientific-method-engine <operand|operand-candidates|target|bounds|owner|callees|trace|uses|arguments|"
          "effects|returns|memory|incoming|call-order|guards|allocation|dispatch> <config.json|->\n"
          "effects includes ordered path writes/calls and local restoration witnesses; transactionality remains unestablished.\n"
@@ -60,7 +66,8 @@ def main(argv):
         raise ValueError("preparedProtocol is set by the reader and cannot be supplied")
     data, identity = read_source(config, base)
     result = run_report(data, config, command)
-    print(json.dumps({"schema": "bounded-x86-v1", "decoder": "capstone 5.0.7", "sourceIdentity": identity,
+    print(json.dumps({"schema": "bounded-x86-v1", "decoder": DECODER,
+                      "instructionSemantics": INSTRUCTION_SEMANTICS, "sourceIdentity": identity,
                       "status": "Conditional static report; never promotes an evidence entry", **result}, indent=2))
 
 

{scientific_method_engine-0.6.0 → scientific_method_engine-0.8.0}/src/scientific_method_engine/x86/machine.py

@@ -1,8 +1,7 @@
-"""Path state for the evidence layer. Instruction semantics come from the backend a State holds (semantics.py)."""
+"""Path state for the evidence layer. Instruction semantics come from pypcode (pcode_backend.py)."""
 from copy import deepcopy
 from capstone.x86 import X86_OP_REG, X86_OP_IMM, X86_OP_MEM
 from .values import Value, const, unknown, op, extract, join, resize, sources, address_parts, producers
-from . import semantics
 
 REGISTERS = ("eax", "ebx", "ecx", "edx", "esi", "edi", "ebp", "esp", "cs", "ds", "es", "ss", "fs", "gs")
 ALIASES = {}
@@ -39,7 +38,10 @@ def alias(name):
 class State:
     def __init__(self, entry, image, config):
         self.bits, self.flat, self.mask = image.bits, image.flat, image.mask
-        self.semantics = semantics.current()
+        # Imported here: the backend imports this module, so a module-level import would make the
+        # import order matter.
+        from .pcode_backend import BACKEND
+        self.semantics = BACKEND
         self.sp, self.bp = ("esp", "ebp") if self.flat else ("sp", "bp")
         self.at = entry
         self.regs = {r: unknown("initial:" + r, ALIASES[r][2]) for r in REGISTERS}
@@ -64,7 +66,8 @@ class State:
         self.guards = []
         self.assumptions = {}
         self.flags = None
-        # Arithmetic flags as values when the last flag-writing instruction ran on p-code; None otherwise.
+        # Arithmetic flags as values from the last flag-writing instruction's p-code; None when no
+        # instruction computed them yet or the last one forgot them.
         self.flag_values = None
         # CF when an instruction sets it without leaving a comparable flag producer; None defers to flags.
         self.carry = None
@@ -123,9 +126,10 @@ class State:
     def carry_value(self):
         """CF as a one-bit value: from the last comparable flag producer, an explicit carry, or unknown."""
         if self.flags is not None:
-            answer, _ = self.semantics.condition(self, "jb")
-            if answer is not None:
-                return const(int(answer), 1, self.flags[3])
+            if self.flag_values is not None and "CF" in self.flag_values:
+                answer, _ = self.semantics.condition(self, "jb")
+                if answer is not None:
+                    return const(int(answer), 1, self.flags[3])
             # Name the carry by its producer's operands, so every reading of one comparison shares an assumption.
             a, b, operation, site = self.flags
             return unknown(f"carry:{site}:{(operation, a.term, b.term)!r}", 1, site)
@@ -367,11 +371,10 @@ def string_effect(state, ins, count, remaining, charge=None):
     # any segment override.
     source_name = (segment_register(ins, ins.operands[1].mem) if operation in ("movs", "lods") else
                    segment_register(ins, ins.operands[0].mem) if operation == "cmps" else None)
-    delta = -width if state.direction_flag.number else width
     counter = "ecx" if state.flat else "cx"
     if not compare or not repeated(ins):
         for _ in range(count.number):
-            state.semantics.string_iteration(state, ins, operation, width, source_name, delta)
+            state.semantics.string_iteration(state, ins, operation, width, source_name)
         if repeated(ins):
             state.setreg(counter, const(0, state.bits, state.at), state.at)
         return count.number
@@ -381,7 +384,7 @@ def string_effect(state, ins, count, remaining, charge=None):
             raise StopPath("String iteration budget exhausted; remaining effects unresolved")
         if charge is not None:
             charge(1)
-        holds = state.semantics.string_iteration(state, ins, operation, width, source_name, delta)
+        holds = state.semantics.string_iteration(state, ins, operation, width, source_name)
         iterations += 1
         outcomes.append(holds)
         if iterations == count.number:
@@ -398,7 +401,3 @@ def string_effect(state, ins, count, remaining, charge=None):
     state.event("string-compare-exit", iterations=iterations, exit=reason, counter=state.reg(counter).report())
     return iterations
 
-
-# The handwritten backend registers itself as the default; it imports names defined above.
-from . import handwritten  # noqa: E402,F401
-from . import pcode_backend  # noqa: E402,F401

{scientific_method_engine-0.6.0 → scientific_method_engine-0.8.0}/src/scientific_method_engine/x86/pcode.py

@@ -300,8 +300,11 @@ def evaluate(code, args, bits, site):
             # Identities that keep flag expressions small; constants fold in values.op.
             mask = (1 << bits) - 1
             for x, y in ((a, b), (b, a)):
-                if x.number == 0:
-                    return Value(bits, ("constant", 0), origin) if name == "and" else Value(bits, y.term, origin)
+                if x.number == 0 and name == "and":
+                    return Value(bits, ("constant", 0), origin)
+                if x.number == 0 and boolean(y):
+                    # Flag selections OR a zero arm in; a value operand keeps its OR, as reports write it.
+                    return Value(bits, y.term, origin)
                 if name == "and" and (x.number == mask or (x.number == 1 and boolean(y))):
                     return Value(bits, y.term, origin)
                 if name == "or" and (x.number == mask):

{scientific_method_engine-0.6.0 → scientific_method_engine-0.8.0}/src/scientific_method_engine/x86/pcode_backend.py

@@ -1,31 +1,30 @@
-"""The pypcode semantics backend (ADR 0003, phase 3).
-
-Values come from the p-code pypcode lifts. The evidence layer keeps what it always decided: which
-segment register an access uses (from Capstone, decision 3), access roles, the model's acceptance
-rules, flag-producer records and the events each instruction reports. Groups of mnemonics move to
-this backend one at a time; the others still run on the handwritten backend.
+"""Instruction semantics from pypcode (ADR 0003).
+
+Values, flags and branch conditions come from the p-code pypcode lifts from Ghidra's SLEIGH
+specification. The evidence layer keeps what it always decided: which segment register an access
+uses (from Capstone, decision 3), access roles, the model's acceptance rules, flag-producer records
+and the events each instruction reports. A ``State`` reaches this module through ``BACKEND``.
+
+What this module and ``pcode.Run`` use of a ``State``:
+
+- Methods: ``get``, ``put``, ``reg``, ``setreg``, ``segment``, ``access``, ``address``, ``event``,
+  ``set_flags``, ``forget_flags``, ``carry_value``, ``save_flags`` and ``restore_flags``.
+- Read only: ``at``, ``bits``, ``flat``, ``sp``, ``flags``, ``flag_serial``, ``flag_epoch``,
+  ``unknown_flag_site``, ``segment_bases`` and ``value_transfers``.
+- Read and assigned: ``flag_values`` (the arithmetic flags p-code computed, or None), ``carry``,
+  ``direction_flag`` and ``interrupt_flag``. ``conditional`` is appended to (the divide-error
+  assumption).
+
+Every member above belongs to one path, and ``trace`` copies a path with ``deepcopy`` when a branch
+splits it. The backend keeps no path state of its own: ``Pypcode.__deepcopy__`` returns the same
+object, so a value this module stores must live on the ``State`` to be copied with its path.
 """
 from capstone.x86 import X86_OP_REG, X86_OP_IMM, X86_OP_MEM
 
-from . import handwritten, semantics
 from .machine import ALIASES, StopPath
 from .pcode import LIFTER, Address, Run, FLAGS, SEGMENT_BASES, segment_base
 from .values import Value, const, unknown, op, extract, join, resize, sources
 
-GROUPS = {
-    "data movement": ("mov", "movzx", "movsx", "xchg", "nop"),
-    "address forms": ("lea", "lds", "les"),
-    "stack": ("push", "pop", "leave", "pushf", "pushfd", "popf", "popfd"),
-    "compare": ("cmp", "test"),
-    "arithmetic and logic": ("add", "sub", "and", "or", "xor", "inc", "dec", "not", "neg"),
-    "carry chain": ("adc", "sbb", "clc", "stc", "cmc"),
-    "shifts and rotates": ("shl", "sal", "shr", "sar", "rol", "ror", "rcl", "rcr"),
-    "multiply and divide": ("mul", "imul", "div", "idiv"),
-    "conversions": ("cbw", "cwde", "cwd", "cdq"),
-    "flags and direction": ("cld", "std", "cli", "sti"),
-    "string operations": ("movs", "stos", "lods", "cmps", "scas"),
-}
-
 # Conditional branches by the condition code SLEIGH decodes from 0x70 + code.
 CONDITION_CODES = {}
 for code, names in enumerate((("jo",), ("jno",), ("jb", "jc", "jnae"), ("jae", "jnb", "jnc"), ("je", "jz"),
@@ -77,7 +76,7 @@ def bit(value, site):
     # SLESS(x, 0) is the sign bit of x; a SLEIGH shift writes it as SLESS(x << k, 0).
     if term[0] == "sless" and term[2] == ("constant", 0):
         inner, shift = term[1], 0
-        if inner[0] == "shl" and inner[2][0] == "constant":
+        if inner[0] == "shl" and inner[2][0] == "constant" and inner not in LEAVES:
             inner, shift = inner[1], inner[2][1]
         width = width_of(inner, value)
         if width is not None and shift < width:
@@ -90,7 +89,7 @@ def bit(value, site):
         inner, mask = term[1][1], term[1][2]
         if mask[0] == "constant" and mask[1] and mask[1] & (mask[1] - 1) == 0:
             position = mask[1].bit_length() - 1
-            if inner[0] in ("shr", "sar") and inner[2][0] == "constant":
+            if inner[0] in ("shr", "sar") and inner[2][0] == "constant" and inner not in LEAVES:
                 position += inner[2][1]
                 inner = inner[1]
             width = width_of(inner, value)
@@ -121,6 +120,9 @@ def width_of(term, value):
 
 # Widths of the terms the current instruction read or computed; set per frame.
 WIDTHS = {}
+# The current instruction's operand values. Field decomposition stops at them, because reports
+# treat each operand as one value even when an earlier instruction built it from fields.
+LEAVES = set()
 
 
 def fields(term, width):
@@ -130,6 +132,8 @@ def fields(term, width):
     (right when negative). Rotates and shifts of joined values take this form in p-code.
     """
     head = term[0]
+    if term in LEAVES:
+        return [(term, width, 0)]
     top = top_bit(term)
     if top is not None:
         return [top]
@@ -252,6 +256,7 @@ class Frame:
 
     def __init__(self, state, ins, image, widths=None, roles=None, present=None):
         self.state, self.ins, self.image = state, ins, image
+        # present(value, frame) may rewrite a written value into the equal term reports use.
         self.present = present
         self.widths = widths or {}
         self.roles = roles or {}
@@ -275,7 +280,7 @@ class Frame:
         self.addresses = {}
         if ins.mnemonic != "pop":
             # Operands address with the registers the instruction started with. POP's destination
-            # is addressed after the stack pointer moves, as the handwritten backend does.
+            # is addressed after the stack pointer moves, as the CPU addresses it.
             for index, operand in enumerate(ins.operands):
                 if operand.type == X86_OP_MEM:
                     self.address(index)
@@ -325,6 +330,7 @@ class Frame:
                                                      addressing_register=register)
                     self.loaded[index] = self.cache[index]
                     WIDTHS.setdefault(self.cache[index].term, self.cache[index].bits)
+                    LEAVES.add(self.cache[index].term)
                 return extract(self.cache[index], d * 8, size * 8)
             location = evidence if d == 0 else op("add", evidence, const(d, evidence.bits), state.at)
             state.access(segment, location, size, value, addressing_register=register)
@@ -345,9 +351,12 @@ class Frame:
 
     def execute(self):
         WIDTHS.clear()
+        LEAVES.clear()
         for index, value in self.before.items():
             WIDTHS[value.term] = value.bits
-        self.run = Run(self.state, self.ops, self.memory, self.constant, present=self.present)
+            LEAVES.add(value.term)
+        present = (lambda value: self.present(value, self)) if self.present else None
+        self.run = Run(self.state, self.ops, self.memory, self.constant, present=present)
         self.run.execute()
         for value in [*self.loaded.values(), *self.run.temps.values(), *self.run.registers.values()]:
             if isinstance(value, Value):  # Real-mode temporaries may hold a segmented Address.
@@ -412,41 +421,59 @@ def carry_out(state, run, site):
 
 
 class Pypcode:
-    """Instruction semantics from pypcode for the moved groups; the handwritten backend for the rest."""
-
-    name = "pypcode"
-
-    def __init__(self, groups):
-        self.groups = tuple(groups)
-        self.mnemonics = {m for group in self.groups for m in GROUPS[group]}
+    """The engine's instruction semantics: ordinary instructions, branch conditions and string bodies."""
 
     def __deepcopy__(self, memo):
+        # The backend holds no path state, so every copied path shares it.
         return self
 
     def ordinary(self, state, ins, image):
-        m = ins.mnemonic
-        if m not in self.mnemonics:
-            return handwritten.ordinary(state, ins, image)
-        HANDLERS[m](state, ins, image)
+        """Apply one instruction that is neither a control transfer nor a string operation."""
+        handler = HANDLERS.get(ins.mnemonic)
+        if handler is None:
+            raise StopPath("Unsupported instruction semantics: " + ins.mnemonic)
+        handler(state, ins, image)
 
     def condition(self, state, mnemonic):
-        answer, info = handwritten.predicate(state, mnemonic)
-        if "compare" not in self.groups or mnemonic not in CONDITION_CODES:
-            return answer, info
-        flags = state.flag_values
-        if flags is None:
-            return answer, info
+        """Evaluate a conditional branch on the current flags.
+
+        Returns ``(answer, info)``: True, False or None when unresolved, and the ``branch`` event
+        fields. They describe the evidence layer's record of the flag producer, then either
+        ``decidedBy: "p-code flags"`` for a decided branch or a ``reason`` for an undecided one.
+        """
         ops, _ = LIFTER.ops(state.flat, bytes((0x70 + CONDITION_CODES[mnemonic], 0)), 0x100)
         needed = {LIFTER.register(state.flat, v[1], v[2]) for o in ops for v in o.inputs if v[0] == "register"}
-        if not needed <= set(flags):
-            # A handwritten instruction produced some of these flags; its predicate decides.
-            return answer, info
-        condition = Run(state, ops, None, flags=flags).execute(stop_at_branch=True)
-        return (None if condition.number is None else bool(condition.number)), info
-
-    def string_iteration(self, state, ins, operation, width, source_segment, delta_step):
-        if operation not in self.mnemonics:
-            return handwritten.string_iteration(state, ins, operation, width, source_segment, delta_step)
+        carry_only = needed == {"CF"} and state.flags is None and state.carry is not None
+        if carry_only:
+            info = {"predicate": mnemonic, "flag": "CF", "carry": state.carry.report()}
+        elif state.flags is None:
+            info = {"predicate": mnemonic, "reason": "flag producer unresolved",
+                    "flagProducer": state.unknown_flag_site, "flagGeneration": state.flag_epoch}
+        else:
+            a, b, operation, site = state.flags
+            info = {"predicate": mnemonic, "flagProducer": site, "operation": operation,
+                    "left": a.report(), "right": b.report()}
+        # CF is always readable: the evidence layer names it when no instruction resolved it.
+        if not needed <= set(state.flag_values or ()) | {"CF"}:
+            info.setdefault("reason", "flags unresolved")
+            return None, info
+        condition = Run(state, ops, None, flags=state.flag_values or {}).execute(stop_at_branch=True)
+        if condition.number is None:
+            # Every undecided branch says why: the carry, the producer or its flags are unknown.
+            info.setdefault("reason", "carry unresolved" if carry_only else "flags unresolved")
+            return None, info
+        # p-code decides every branch the engine resolves; the record above only describes the producer.
+        info.pop("reason", None)
+        info["decidedBy"] = "p-code flags"
+        return bool(condition.number), info
+
+    def string_iteration(self, state, ins, operation, width, source_segment):
+        """Apply one iteration of an accepted string form; see ``machine.string_effect``.
+
+        ``source_segment`` names the source operand's segment register (MOVS, LODS and CMPS only).
+        p-code steps SI and DI by the direction flag. For a repeated CMPS or SCAS, returns whether
+        the repeat condition holds afterwards (1, 0 or unknown); otherwise None.
+        """
         si, di = ("esi", "edi") if state.flat else ("si", "di")
         source, destination = state.reg(si), state.reg(di)
         loaded = {}
@@ -605,9 +632,25 @@ def compare(state, ins, image):
     state.event("compare", operation=m, left=a.report(), right=b.report())
 
 
+def unfolded(name, value, f, site):
+    """A logic result p-code folded to one operand, written as the operation reports use.
+
+    ``x | 0``, ``x ^ 0`` and ``x & ~0`` equal ``x``; the interpreter folds them, and reports
+    keep the instruction's operation in the result's expression.
+    """
+    if name not in ("and", "or", "xor") or value.number is not None:
+        return value
+    a = f.value(0)
+    b = resize(f.value(1), a.bits)
+    neutral = (1 << a.bits) - 1 if name == "and" else 0
+    if value.bits == a.bits and (b.number == neutral and value.term == a.term or a.number == neutral and value.term == b.term):
+        return Value(value.bits, op(name, a, b, site).term, value.sources)
+    return value
+
+
 def arithmetic(state, ins, image):
     m = ins.mnemonic
-    f = run_plain(state, ins, image)
+    f = run_plain(state, ins, image, present=lambda v, frame: unfolded(m, v, frame, state.at))
     a = f.value(0)
     b = resize(f.value(1), a.bits)
     result = f.result(0)
@@ -705,7 +748,7 @@ def rotate(state, ins, image):
         state.forget_flags(keep_carry=True)
         return
     # Reports write a rotate as its shifted copies, from the leftmost copy for ROL and RCL.
-    f = run_plain(state, ins, image, present=lambda v: arranged(v, m in ("rol", "rcl"), state.at))
+    f = run_plain(state, ins, image, present=lambda v, _: arranged(v, m in ("rol", "rcl"), state.at))
     a = f.value(0)
     value = f.result(0)
     carry = bit(f.run.flags["CF"], state.at)
@@ -733,10 +776,33 @@ def temporary(f, code):
     return f.run.temps[o.output[1]]
 
 
+def low_product(value, site):
+    """The low half of a product of two extended values, as the product at the operands' width.
+
+    SLEIGH writes a two- or three-operand IMUL as the double-width product of the sign-extended
+    operands, truncated; the low half does not depend on the extension, and reports write it as
+    the operand-width product. An operand that already holds a sign extension (after CBW or MOVSX)
+    reaches the product as one extension of the narrower value, which is extended back to the
+    operand's width here.
+    """
+    term = value.term
+    if term[0] != "extract" or term[2] != 0 or term[1][0] != "mul":
+        return value
+    factors = []
+    for factor in term[1][1:]:
+        if factor[0] in ("signExtend", "zeroExtend") and factor[2] <= value.bits:
+            factors.append(resize(Value(factor[2], factor[1]), value.bits, signed=factor[0] == "signExtend"))
+        elif factor[0] == "constant":
+            factors.append(const(factor[1], value.bits))
+        else:
+            return value
+    return Value(value.bits, op("mul", *factors, site).term, value.sources)
+
+
 def multiply(state, ins, image):
     m = ins.mnemonic
     if m == "imul" and len(ins.operands) in (2, 3):
-        f = run_plain(state, ins, image)
+        f = run_plain(state, ins, image, present=lambda v, _: low_product(v, state.at))
         left = resize(f.value(0 if len(ins.operands) == 2 else 1), ins.operands[0].size * 8)
         right = resize(f.value(1 if len(ins.operands) == 2 else 2), left.bits, signed=True)
         result = f.result(0)
@@ -786,10 +852,37 @@ def divide(state, ins, image):
                 quotient=quotient.report(), remainder=remainder.report(), fault=fault)
 
 
+def through_extension(value, source, form):
+    """``value`` as ``form(source)`` when p-code wrote ``form`` of the value ``source`` sign-extends.
+
+    When the source register holds a sign extension (after CBW, CWDE or MOVSX), p-code reads
+    through it to the narrower value it extended, because ``pcode.evaluate`` folds an extension
+    of an extension. Both name the same bits; reports name them in the register the instruction
+    reads.
+    """
+    if value.number is not None or source.term[0] != "signExtend":
+        return value
+    inner = Value(source.term[2], source.term[1])
+    if value.term == form(inner).term:
+        return Value(value.bits, form(source).term, value.sources)
+    return value
+
+
 def conversion(state, ins, image):
     m = ins.mnemonic
     before = {name: state.reg(name) for name in ("al", "ax", "eax")}
-    f = run_plain(state, ins, image)
+
+    def present(value, _):
+        if value.bits not in (16, 32):
+            return value
+        if m in ("cwd", "cdq"):
+            # The high half is the sign bit of AX or EAX.
+            return through_extension(value, before["ax" if value.bits == 16 else "eax"],
+                                     lambda v: resize(extract(v, v.bits - 1, 1), value.bits, signed=True))
+        # CBW and CWDE write the sign extension of AL or AX.
+        return through_extension(value, before["al" if value.bits == 16 else "ax"],
+                                 lambda v: resize(v, value.bits, signed=True))
+    f = run_plain(state, ins, image, present=present)
     (destination, value), = f.run.registers.items()
     wide = value.bits == 32
     if m in ("cbw", "cwde"):
@@ -828,8 +921,5 @@ for names, handler in ((("mov", "movzx", "movsx", "xchg"), move), (("nop",), nop
     for name in names:
         HANDLERS[name] = handler
 
-MOVED = ("data movement", "address forms", "stack", "compare", "arithmetic and logic", "carry chain",
-         "shifts and rotates", "multiply and divide", "conversions", "flags and direction",
-         "string operations")
-
-semantics.register(Pypcode(MOVED), default=bool(MOVED))
+# The backend every State uses.
+BACKEND = Pypcode()

{scientific_method_engine-0.6.0 → scientific_method_engine-0.8.0}/tests/oracle.py

@@ -4,12 +4,14 @@ Unicorn is a test dependency only. ``check`` runs one synthetic routine on the e
 Unicorn with the same segment layout and concrete registers, and compares every register the
 engine resolved to a constant at the routine's return with Unicorn's value there.
 """
-import contextlib
+import sys
+from pathlib import Path
 
 from unicorn import UC_ARCH_X86, UC_MODE_16, Uc
 from unicorn import x86_const as U
 
-from differential import accepted, run_report
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+from scientific_method_engine.x86.reports import run_report  # noqa: E402
 
 SEGMENT = 0x1000
 STACK = {"ss": 0x2000, "sp": 0xFFF0}
@@ -47,18 +49,16 @@ def unicorn(data, registers, direction=None):
     return stopped.get("at"), {name: uc.reg_read(getattr(U, "UC_X86_REG_" + name.upper())) for name in names}
 
 
-def check(test, code, registers=None, direction=None, resolved=(), extended=None):
+def check(test, code, registers=None, direction=None, resolved=()):
     """Compare the engine's resolved registers with Unicorn's for one synthetic routine.
 
     Routines write any memory they read, because the engine starts with memory unknown and
     Unicorn with zeros. ``resolved`` names registers the engine must resolve.
-    ``extended`` states why the default backend may resolve more than the handwritten one here.
     """
     data = bytes.fromhex(code)
     registers = {**STACK, **(registers or {})}
     flags = {} if direction is None else {"flags": {"direction": direction}}
-    with accepted("extended", extended) if extended else contextlib.nullcontext():
-        result = run_report(data, configuration(data, registers, **flags), "trace")
+    result = run_report(data, configuration(data, registers, **flags), "trace")
     test.assertEqual(len(result["paths"]), 1, "the oracle compares one resolved path")
     path = result["paths"][0]
     test.assertTrue(path["returned"], path["stop"])

{scientific_method_engine-0.6.0 → scientific_method_engine-0.8.0}/tests/test_dispatch.py

@@ -5,7 +5,7 @@ import sys
 import unittest
 SRC = Path(__file__).resolve().parents[1] / "src"
 sys.path.insert(0, str(SRC))
-from differential import run_report
+from scientific_method_engine.x86.reports import run_report
 from scientific_method_engine.x86.image import Image
 from scientific_method_engine.x86.trace import walk, OVERLAP_REASON
 

{scientific_method_engine-0.6.0 → scientific_method_engine-0.8.0}/tests/test_effect_order.py

@@ -1,6 +1,5 @@
 """Synthetic path evidence; no original bytes or claims."""
 import unittest
-from differential import accepted
 from test_x86 import Code, report
 
 
@@ -73,8 +72,7 @@ class EffectOrderTests(unittest.TestCase):
         # A loop re-pushes the same return address into a stack slot another call overwrote.
         c = Code().emit("b9 02 00").label("top").branch("e8", "a").branch("e8", "b").emit("49").branch("75", "top").emit("c3")
         c.label("a").emit("c3").label("b").emit("c3")
-        with accepted("extended", "DEC flags from p-code resolve the loop exit; test_oracle checks the count"):
-            r = report(c, "effects", registers={"ss": 0x3000, "sp": 0xff00})
+        r = report(c, "effects", registers={"ss": 0x3000, "sp": 0xff00})
         self.assertTrue(any(p["returned"] for p in self.paths(r)))
         self.assertFalse([w for p in self.paths(r) for w in p["localRestorationWitnesses"]])