842 lines
40 KiB
Python
842 lines
40 KiB
Python
#!/usr/bin/env python3
|
|
"""Opt-in bounded private XTest keyboard and optional relative-look experiment. Not a launcher or gameplay proof."""
|
|
import argparse
|
|
import ctypes as C
|
|
import hashlib
|
|
import json
|
|
import multiprocessing
|
|
import math
|
|
import os
|
|
from pathlib import Path
|
|
import re
|
|
import signal
|
|
import stat
|
|
import subprocess
|
|
import sys
|
|
import time
|
|
|
|
import headless_display_probe as display
|
|
|
|
|
|
NOTIFY = None
|
|
|
|
|
|
def notify(value):
|
|
if NOTIFY is not None:
|
|
NOTIFY.send(value)
|
|
|
|
|
|
class Refused(ValueError):
|
|
pass
|
|
|
|
|
|
class KeyStateBusy(Refused):
|
|
pass
|
|
|
|
|
|
def option(args, name):
|
|
if args.count(name) != 1:
|
|
raise Refused('Missing or repeated native option: ' + name)
|
|
index = args.index(name)
|
|
if index + 1 >= len(args):
|
|
raise Refused('Missing native option value')
|
|
return args[index + 1]
|
|
|
|
|
|
def game_arguments(owner, args):
|
|
native = display.process(owner['pid'])
|
|
if display.identity(native) != owner['process']:
|
|
raise Refused('Game process changed')
|
|
if option(native['args'], '-errOrdinaryInputObserve') != args.nonce:
|
|
raise Refused('Native observer nonce mismatch')
|
|
if getattr(args, 'enable_private_look_proof', False) and option(native['args'], '-errOrdinaryLookObserve') != args.nonce:
|
|
raise Refused('Native look observer nonce mismatch')
|
|
if option(native['args'], '-errOrdinaryScenario') not in ('core', 'chat'):
|
|
raise Refused('Not an ordinary successor scenario')
|
|
if option(native['args'], '-profile') != 'Z:' + str(args.profile):
|
|
raise Refused('Native profile mismatch')
|
|
|
|
|
|
NUMBER = r'[-+]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][-+]?\d+)?'
|
|
VECTOR = r'<\s*(' + NUMBER + r')\s*,\s*(' + NUMBER + r')\s*,\s*(' + NUMBER + r')\s*>'
|
|
LOOK_HEADER = re.compile(r'ERR LOOK OBSERVE: run=([A-Za-z0-9]{1,32}) sample=(\d+) real=(\d+) (.+)$')
|
|
LOOK_SAMPLE = re.compile('SAMPLE direction=' + VECTOR + ' camera=' + VECTOR + ' body=' + VECTOR + ' bodyForward=' + VECTOR + ' turn=' + VECTOR)
|
|
INPUT_SAMPLE = re.compile('SAMPLE origin=' + VECTOR + ' forward=(' + NUMBER + ') input=' + VECTOR + ' velocity=' + VECTOR + r' inventory=(0|1|true|false)')
|
|
|
|
|
|
def parse_look_record(line, nonce):
|
|
"""Strict live handshake parser; final qualification independently reparses logs."""
|
|
if 'ERR LOOK OBSERVE:' not in line:
|
|
return None
|
|
match = LOOK_HEADER.search(line)
|
|
if not match or match[1] != nonce or len(line) > 2048:
|
|
raise Refused('Malformed or foreign look observation')
|
|
sample, real, detail = int(match[2]), int(match[3]), match[4]
|
|
if not 0 <= sample <= 450 or not 0 <= real <= 2147483647:
|
|
raise Refused('Look observation bounds invalid')
|
|
record = {'sample': sample, 'real_ms': real, 'raw': line}
|
|
if detail == 'BASIS native-player-camera-world-transform':
|
|
return {**record, 'kind': 'basis'}
|
|
if re.fullmatch(r'CANCELLED [a-z-]+', detail):
|
|
return {**record, 'kind': 'cancelled', 'reason': detail.split(' ', 1)[1]}
|
|
values = LOOK_SAMPLE.fullmatch(detail)
|
|
if not values:
|
|
raise Refused('Malformed native look sample')
|
|
numbers = [float(value) for value in values.groups()]
|
|
if not all(math.isfinite(value) for value in numbers):
|
|
raise Refused('Nonfinite native look sample')
|
|
result = {**record, 'kind': 'sample'}
|
|
for index, name in enumerate(('direction', 'camera', 'body', 'bodyForward', 'turn')):
|
|
result[name] = numbers[index*3:index*3+3]
|
|
for name in ('direction', 'bodyForward'):
|
|
length = math.sqrt(sum(value*value for value in result[name]))
|
|
if not .95 <= length <= 1.05 or math.hypot(result[name][0], result[name][2]) <= .1:
|
|
raise Refused('Native look direction is degenerate or not normalized')
|
|
return result
|
|
|
|
|
|
def parse_stationary_sample(sample, real, detail):
|
|
match = INPUT_SAMPLE.fullmatch(detail)
|
|
if not match:
|
|
raise Refused('Malformed input sample during look observation')
|
|
values = [float(value) for value in match.groups()[:-1]]
|
|
if not all(math.isfinite(value) for value in values):
|
|
raise Refused('Nonfinite input sample during look observation')
|
|
return {'sample': sample, 'real_ms': real, 'origin': values[:3], 'forward': values[3],
|
|
'input': values[4:7], 'velocity': values[7:10], 'inventory': match.groups()[-1] in ('1', 'true')}
|
|
|
|
|
|
def yaw(direction):
|
|
return math.degrees(math.atan2(direction[0], direction[2]))
|
|
|
|
|
|
def yaw_delta(first, second):
|
|
return (yaw(second) - yaw(first) + 180) % 360 - 180
|
|
|
|
|
|
class RelativeMouse:
|
|
def __init__(self, query, keyboard, owner):
|
|
self.query, self.keyboard, self.owner = query, keyboard, owner
|
|
self.xt = keyboard.xt
|
|
self.xt.XTestFakeRelativeMotionEvent.restype = C.c_int
|
|
self.xt.XTestFakeRelativeMotionEvent.argtypes = [C.c_void_p, C.c_int, C.c_int, C.c_ulong]
|
|
query.x.XQueryPointer.restype = C.c_int
|
|
query.x.XQueryPointer.argtypes = [C.c_void_p, C.c_ulong, C.POINTER(C.c_ulong), C.POINTER(C.c_ulong),
|
|
C.POINTER(C.c_int), C.POINTER(C.c_int), C.POINTER(C.c_int), C.POINTER(C.c_int), C.POINTER(C.c_uint)]
|
|
|
|
def pointer(self):
|
|
root, child = C.c_ulong(), C.c_ulong()
|
|
rx, ry, wx, wy = C.c_int(), C.c_int(), C.c_int(), C.c_int()
|
|
mask = C.c_uint()
|
|
if not self.query.x.XQueryPointer(self.query.d, self.owner['window'], C.byref(root), C.byref(child),
|
|
C.byref(rx), C.byref(ry), C.byref(wx), C.byref(wy), C.byref(mask)):
|
|
raise Refused('Private pointer is unavailable or on another screen')
|
|
return {'root': root.value, 'child': child.value, 'root_x': rx.value, 'root_y': ry.value, 'mask': mask.value}
|
|
|
|
def validate_pointer(self, target, dx, dy):
|
|
position = self.pointer()
|
|
geometry = target['geometry']; left, top, right, bottom = target['focused_clipped_bounds']
|
|
if position['root'] != geometry['root'] or position['mask'] != 0:
|
|
raise Refused('Private pointer root or button/modifier state invalid')
|
|
for x, y in ((position['root_x'], position['root_y']), (position['root_x']+dx, position['root_y']+dy)):
|
|
if not left <= x < right or not top <= y < bottom:
|
|
raise Refused('Relative pointer step leaves owned clipped bounds')
|
|
child = position['child']
|
|
if child and self.query.server_pid(child) != self.owner['pid']:
|
|
raise Refused('Pointer child belongs to a foreign native client')
|
|
|
|
def move(self, dx, dy, guard):
|
|
if type(dx) is not int or dx not in (-24, 24) or dy != 0 or type(dy) is not int:
|
|
raise Refused('Unsupported relative look step')
|
|
target = guard.check()
|
|
self.keyboard.require_idle()
|
|
self.validate_pointer(target, dx, dy)
|
|
# Recheck process/focus after the pointer roundtrip, with no focus changes.
|
|
target = guard.check()
|
|
self.validate_pointer(target, dx, dy)
|
|
if not self.xt.XTestFakeRelativeMotionEvent(self.query.d, dx, dy, 0):
|
|
raise Refused('Native relative motion request failed')
|
|
self.query.x.XFlush(self.query.d)
|
|
|
|
|
|
def perform_look(guard, keyboard, observer, mouse, report, clock=time.monotonic, sleep=time.sleep):
|
|
proof = {'requested': True, 'completed': False, 'started_monotonic': clock(),
|
|
'finished_monotonic': None, 'baseline_samples': [], 'response_sample': None,
|
|
'return_sample': None, 'motions': []}
|
|
report['look_proof'] = proof
|
|
deadline = proof['started_monotonic'] + 4
|
|
notify({'kind': 'look-pending'})
|
|
ready_sample = observer.ready_sample
|
|
baseline = None
|
|
|
|
def current():
|
|
if clock() >= deadline:
|
|
raise Refused('Native look proof exceeded four seconds')
|
|
observer.fresh(); guard.check(); keyboard.require_idle()
|
|
if observer.events != ['READY'] or any(r['kind'] == 'cancelled' for r in observer.look_records):
|
|
raise Refused('Native look context ended or inventory changed')
|
|
if sum(r['kind'] == 'basis' for r in observer.look_records) != 1:
|
|
return []
|
|
poses = [r for r in observer.look_records if r['kind'] == 'sample' and r['sample'] >= ready_sample]
|
|
inputs = {r['sample']: r for r in observer.input_samples}
|
|
joined = []
|
|
for pose in poses:
|
|
sample = inputs.get(pose['sample'])
|
|
if sample is None:
|
|
continue
|
|
if sample['real_ms'] != pose['real_ms'] or math.dist(sample['origin'], pose['body']) > .01:
|
|
raise Refused('Native look/input body or clock mismatch')
|
|
ready_input = inputs.get(ready_sample)
|
|
if ready_input is None:
|
|
raise Refused('Missing native READY body sample')
|
|
origin = ready_input['origin']
|
|
if (sample['inventory'] or abs(sample['forward']) > .01 or
|
|
math.sqrt(sum(x*x for x in sample['input'])) > .01 or
|
|
math.sqrt(sum(x*x for x in sample['velocity'])) > .05 or
|
|
math.dist(pose['body'], origin) > .05):
|
|
raise Refused('Player moved before look proof completed')
|
|
joined.append(pose)
|
|
for previous, following in zip(joined, joined[1:]):
|
|
if following['sample'] != previous['sample'] + 1 or not 0 < following['real_ms'] - previous['real_ms'] <= 500:
|
|
raise Refused('Native look sampling gap or repeated clock')
|
|
if joined and observer.input_samples[-1]['real_ms'] - joined[-1]['real_ms'] > 500:
|
|
raise Refused('Native look pose is stale relative to input')
|
|
return joined
|
|
|
|
def wait(predicate):
|
|
while clock() < deadline:
|
|
poses = current()
|
|
if poses and predicate(poses):
|
|
return poses[-1]
|
|
sleep(.025)
|
|
raise Refused('Native view rotation acknowledgement missing')
|
|
|
|
def motion(dx, after):
|
|
poses = current()
|
|
if not poses:
|
|
raise Refused('Native look sample unavailable before motion')
|
|
watermark = poses[-1]['sample']
|
|
report['input_attempted'] = True
|
|
mouse.move(dx, 0, guard)
|
|
proof['motions'].append({'dx': dx, 'dy': 0, 'monotonic': clock(),
|
|
'after_sample': after['sample'], 'after_real_ms': after['real_ms']})
|
|
report['input_sent'] = True
|
|
return watermark
|
|
|
|
try:
|
|
def stable(poses):
|
|
return len(poses) >= 2 and poses[-1]['sample'] == poses[-2]['sample']+1 and abs(yaw_delta(poses[-2]['direction'], poses[-1]['direction'])) <= .1
|
|
wait(stable)
|
|
poses = current()
|
|
if not stable(poses):
|
|
raise Refused('Initial native view no longer stable')
|
|
baseline = poses[-1]
|
|
proof['baseline_samples'] = [poses[-2]['sample'], baseline['sample']]
|
|
outbound_after = motion(24, baseline)
|
|
response = wait(lambda p: p[-1]['sample'] > outbound_after and .25 <= abs(yaw_delta(baseline['direction'], p[-1]['direction'])) <= 30)
|
|
proof['response_sample'] = response['sample']
|
|
displacement = abs(yaw_delta(baseline['direction'], response['direction']))
|
|
return_after = motion(-24, response)
|
|
returned = wait(lambda p: p[-1]['sample'] > return_after and abs(yaw_delta(baseline['direction'], p[-1]['direction'])) <= .35 and abs(yaw_delta(baseline['direction'], p[-1]['direction'])) < displacement/2)
|
|
proof['return_sample'] = returned['sample']
|
|
current()
|
|
if clock() >= deadline:
|
|
raise Refused('Native look proof exceeded four seconds')
|
|
proof['completed'] = True
|
|
finally:
|
|
proof['finished_monotonic'] = clock()
|
|
notify({'kind': 'look-finished'})
|
|
|
|
|
|
class Observer:
|
|
"""Only records appended after this exact owned console was opened count."""
|
|
pattern = re.compile(r'ERR INPUT OBSERVE: run=([A-Za-z0-9]{1,32}) sample=(\d+) real=(\d+) world=(\d+(?:\.\d+)?) (.+)$')
|
|
|
|
def __init__(self, path, nonce, clock=time.monotonic, enable_look=False):
|
|
self.path, self.nonce, self.clock = path, nonce, clock
|
|
self.fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
|
|
info = os.fstat(self.fd)
|
|
if not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid():
|
|
os.close(self.fd)
|
|
raise Refused('Console is not a regular same-user file')
|
|
self.identity = info.st_dev, info.st_ino
|
|
self.start_offset = os.lseek(self.fd, 0, os.SEEK_END)
|
|
self.offset = self.start_offset
|
|
self.pending = b''
|
|
self.sample = self.real = self.world = -1
|
|
self.last_sample_at = None
|
|
self.events = []
|
|
self.raw = []
|
|
self.bytes = 0
|
|
self.terminal = False
|
|
self.enable_look = enable_look
|
|
self.look_records = []; self.input_samples = []; self.ready_sample = None
|
|
|
|
def close(self):
|
|
os.close(self.fd)
|
|
|
|
def poll(self):
|
|
info = self.path.lstat()
|
|
if (info.st_dev, info.st_ino) != self.identity or not stat.S_ISREG(info.st_mode) or info.st_size < self.offset:
|
|
raise Refused('Console replaced or truncated')
|
|
data = os.read(self.fd, 65536)
|
|
self.offset += len(data); self.bytes += len(data)
|
|
if self.bytes > 8 * 1024 * 1024:
|
|
raise Refused('Console observation byte budget exceeded')
|
|
self.pending += data
|
|
if len(self.pending) > 131072:
|
|
raise Refused('Console line budget exceeded')
|
|
lines = self.pending.split(b'\n'); self.pending = lines.pop()
|
|
for raw in lines:
|
|
line = raw.decode('utf-8', 'strict').rstrip('\r')
|
|
if self.enable_look and 'ERR LOOK OBSERVE:' in line:
|
|
record = parse_look_record(line, self.nonce)
|
|
if len(self.look_records) >= 453:
|
|
raise Refused('Native look record bound exceeded')
|
|
if self.look_records and (record['sample'] < self.look_records[-1]['sample'] or record['real_ms'] < self.look_records[-1]['real_ms']):
|
|
raise Refused('Native look records reversed')
|
|
if any(r['kind'] == 'cancelled' for r in self.look_records):
|
|
raise Refused('Native look records after cancellation')
|
|
if record['kind'] == 'basis' and (self.look_records or record['sample'] != 1):
|
|
raise Refused('Repeated or misplaced native look basis')
|
|
if record['kind'] == 'sample' and not self.look_records:
|
|
raise Refused('Missing native look basis')
|
|
if record['kind'] == 'sample' and any(r['kind'] == 'sample' and r['sample'] == record['sample'] for r in self.look_records):
|
|
raise Refused('Duplicate native look sample')
|
|
self.look_records.append(record)
|
|
continue
|
|
if 'ERR INPUT OBSERVE: run=' + self.nonce + ' ' not in line:
|
|
continue
|
|
match = self.pattern.search(line)
|
|
if not match or match[1] != self.nonce:
|
|
raise Refused('Malformed matching observer record')
|
|
sample, real, world = int(match[2]), int(match[3]), float(match[4])
|
|
if not math.isfinite(world) or real > 2147483647:
|
|
raise Refused('Invalid native observer clock')
|
|
if sample < self.sample or real < self.real or world < self.world:
|
|
raise Refused('Native observer clock/sample reversed')
|
|
if sample > 450 or len(self.raw) >= 512:
|
|
raise Refused('Native observer record budget exceeded')
|
|
detail = match[5]
|
|
if detail.startswith('SAMPLE '):
|
|
if sample <= self.sample:
|
|
raise Refused('Repeated native sample')
|
|
self.last_sample_at = self.clock()
|
|
if self.enable_look:
|
|
self.input_samples.append(parse_stationary_sample(sample, real, detail))
|
|
self.sample, self.real, self.world = sample, real, world
|
|
self.raw.append(line)
|
|
if detail == 'READY':
|
|
if self.events or self.last_sample_at is None:
|
|
raise Refused('Repeated or unbound READY')
|
|
self.events.append('READY')
|
|
self.ready_sample = sample
|
|
elif detail in ('INVENTORY_OPEN', 'INVENTORY_CLOSED'):
|
|
expected = ['READY'] if detail == 'INVENTORY_OPEN' else ['READY', 'INVENTORY_OPEN']
|
|
if self.events != expected:
|
|
raise Refused('Unexpected native inventory transition')
|
|
self.events.append(detail)
|
|
elif detail.startswith(('CANCELLED ', 'FINISHED ')):
|
|
self.terminal = True
|
|
if self.terminal:
|
|
raise Refused('Native observer ended')
|
|
|
|
def fresh(self):
|
|
self.poll()
|
|
if self.last_sample_at is None or self.clock() - self.last_sample_at > 1:
|
|
raise Refused('Native observer samples are stale')
|
|
|
|
|
|
class Keyboard:
|
|
"""Only W/Tab key events on the pre-existing explicit owned connection."""
|
|
def __init__(self, query):
|
|
self.query = query
|
|
self.xt = C.CDLL('libXtst.so.6')
|
|
self.xt.XTestQueryExtension.restype = C.c_int
|
|
self.xt.XTestQueryExtension.argtypes = [C.c_void_p] + [C.POINTER(C.c_int)] * 4
|
|
self.xt.XTestFakeKeyEvent.restype = C.c_int
|
|
self.xt.XTestFakeKeyEvent.argtypes = [C.c_void_p, C.c_uint, C.c_int, C.c_ulong]
|
|
for name, restype, argtypes in (
|
|
('XKeysymToKeycode', C.c_ubyte, [C.c_void_p, C.c_ulong]),
|
|
('XKeycodeToKeysym', C.c_ulong, [C.c_void_p, C.c_ubyte, C.c_int]),
|
|
('XQueryKeymap', C.c_int, [C.c_void_p, C.POINTER(C.c_char)]),
|
|
('XFlush', C.c_int, [C.c_void_p])):
|
|
fn = getattr(query.x, name); fn.restype = restype; fn.argtypes = argtypes
|
|
values = [C.c_int() for _ in range(4)]
|
|
if not self.xt.XTestQueryExtension(query.d, *(C.byref(v) for v in values)):
|
|
raise Refused('Private XTest extension unavailable')
|
|
self.codes = {}
|
|
for key, keysym in (('W', 0x77), ('Tab', 0xff09)):
|
|
code = int(query.x.XKeysymToKeycode(query.d, keysym))
|
|
if not 8 <= code <= 255 or query.x.XKeycodeToKeysym(query.d, code, 0) != keysym:
|
|
raise Refused('Default unmodified key mapping unavailable')
|
|
self.codes[key] = code
|
|
if len(set(self.codes.values())) != 2:
|
|
raise Refused('Ambiguous key mapping')
|
|
|
|
def require_idle(self):
|
|
state = C.create_string_buffer(32)
|
|
if not self.query.x.XQueryKeymap(self.query.d, state):
|
|
raise Refused('Native private keyboard state query failed')
|
|
if any(state.raw):
|
|
raise KeyStateBusy('A private keyboard key is still held')
|
|
|
|
def send(self, key, down):
|
|
if key not in self.codes or type(down) is not bool:
|
|
raise Refused('Unsupported input event')
|
|
if not self.xt.XTestFakeKeyEvent(self.query.d, self.codes[key], int(down), 0):
|
|
raise Refused('Native XTest key request failed')
|
|
self.query.x.XFlush(self.query.d)
|
|
|
|
|
|
class Guard:
|
|
def __init__(self, args, bound, query, owner):
|
|
self.args, self.bound, self.query, self.owner = args, bound, query, owner
|
|
|
|
def check(self):
|
|
if display.binding(self.args.host_display, self.args.prefix) != self.bound:
|
|
raise Refused('Original display binding changed')
|
|
# A new per-check read budget, still bounded by the experiment deadline.
|
|
self.query.query_budget = 128
|
|
current = {'window': self.owner['window'], 'pid': self.query.prop(self.owner['window'], '_NET_WM_PID'),
|
|
'server_pid': self.query.server_pid(self.owner['window'])}
|
|
verified = display.owned_window(current, self.bound, self.args.prefix, self.args.game_executable)
|
|
if verified is None or verified['process'] != self.owner['process'] or verified['pid'] != self.owner['pid']:
|
|
raise Refused('Original game window or process changed')
|
|
game_arguments(verified, self.args)
|
|
target = display.input_target(self.query, verified)
|
|
if target.get('verified') is not True:
|
|
raise Refused('Owned existing focus/mapping unavailable: ' + target.get('reason', 'unknown'))
|
|
if display.binding(self.args.host_display, self.args.prefix) != self.bound:
|
|
raise Refused('Display binding changed during target check')
|
|
return target
|
|
|
|
|
|
def confirm_release(guard, keyboard, report, key, clock=time.monotonic, sleep=time.sleep):
|
|
"""Bounded read-only state polling; never sends/retries an input event."""
|
|
start = clock(); deadline = start + .35
|
|
observation = {'key': key, 'start': start, 'attempts': 0, 'confirmed': False}
|
|
report.setdefault('release_observations', []).append(observation)
|
|
try:
|
|
while True:
|
|
guard.check()
|
|
if clock() >= deadline:
|
|
raise Refused('Private key release state did not settle within 350ms')
|
|
observation['attempts'] += 1
|
|
try:
|
|
keyboard.require_idle()
|
|
if clock() >= deadline:
|
|
raise Refused('Private key release state query exceeded 350ms bound')
|
|
observation['confirmed'] = True
|
|
return
|
|
except KeyStateBusy as error:
|
|
observation['last_busy_error'] = str(error)
|
|
remaining = deadline - clock()
|
|
if remaining <= 0:
|
|
raise Refused('Private key release state did not settle within 350ms') from error
|
|
sleep(min(.025, remaining))
|
|
finally:
|
|
observation['end'] = clock()
|
|
|
|
|
|
def sequence(guard, keyboard, observer, report, clock=time.monotonic, sleep=time.sleep, mouse=None):
|
|
deadline = clock() + 70
|
|
held = None
|
|
report.update(events=[], paired_release_errors=[], sequence_completed=False)
|
|
|
|
def check(native=True):
|
|
if clock() >= deadline:
|
|
raise Refused('Input sequence deadline exceeded')
|
|
if native:
|
|
observer.fresh()
|
|
return guard.check()
|
|
|
|
def wait_for(event, seconds):
|
|
end = min(deadline, clock() + seconds)
|
|
while clock() < end:
|
|
observer.poll()
|
|
guard.check()
|
|
if event in observer.events:
|
|
observer.fresh()
|
|
return
|
|
sleep(0.05)
|
|
raise Refused('Native transition timeout: ' + event)
|
|
|
|
def key(key, down):
|
|
nonlocal held
|
|
check()
|
|
if down:
|
|
keyboard.require_idle()
|
|
# Mark uncertain commit before the FFI call, so an exception also releases.
|
|
held = key
|
|
notify({'kind': 'press-pending', 'key': key})
|
|
report['input_attempted'] = True
|
|
keyboard.send(key, down)
|
|
report['events'].append({'key': key, 'down': down, 'monotonic': clock()})
|
|
report['input_sent'] = True
|
|
if not down:
|
|
confirm_release(guard, keyboard, report, key, clock, sleep)
|
|
held = None
|
|
notify({'kind': 'release-confirmed', 'key': key})
|
|
|
|
def pulse(key_name, duration):
|
|
key(key_name, True)
|
|
end = clock() + duration
|
|
while clock() < end:
|
|
sleep(min(0.05, end - clock()))
|
|
# The key-up path performs a full fresh guard immediately before
|
|
# sending. Avoid duplicating that guard once the hold has elapsed.
|
|
if clock() < end:
|
|
check()
|
|
key(key_name, False)
|
|
|
|
try:
|
|
wait_for('READY', 45)
|
|
deadline = clock() + 12
|
|
if observer.events != ['READY']:
|
|
raise Refused('Inventory was already changed before input')
|
|
if mouse is not None:
|
|
perform_look(guard, keyboard, observer, mouse, report, clock, sleep)
|
|
deadline = clock() + 12
|
|
pulse('W', 0.30)
|
|
check()
|
|
pulse('Tab', 0.05)
|
|
wait_for('INVENTORY_OPEN', 4)
|
|
open_until = clock() + 3.0
|
|
while clock() < open_until:
|
|
sleep(min(.05, open_until - clock()))
|
|
check()
|
|
if observer.events != ['READY', 'INVENTORY_OPEN']:
|
|
raise Refused('Inventory closed before the observed open interval')
|
|
pulse('Tab', 0.05)
|
|
wait_for('INVENTORY_CLOSED', 4)
|
|
check()
|
|
keyboard.require_idle()
|
|
report['sequence_completed'] = True
|
|
finally:
|
|
if held is not None:
|
|
try:
|
|
# Release needs live display/window/focus authority, but not a live
|
|
# observer; cancellation must not suppress an otherwise safe key-up.
|
|
guard.check()
|
|
keyboard.send(held, False)
|
|
confirm_release(guard, keyboard, report, held, clock, sleep)
|
|
notify({'kind': 'release-confirmed', 'key': held})
|
|
report['events'].append({'key': held, 'down': False, 'finally': True, 'monotonic': clock()})
|
|
except (OSError, ValueError) as error:
|
|
report['paired_release_errors'].append(str(error))
|
|
report['unconfirmed_held_key'] = held if report['paired_release_errors'] else None
|
|
report['all_attempted_presses_released'] = not report.get('unconfirmed_held_key')
|
|
|
|
|
|
def arguments(argv=None):
|
|
p = argparse.ArgumentParser(description=__doc__)
|
|
p.add_argument('--enable-private-keyboard-proof', action='store_true', required=True)
|
|
p.add_argument('--enable-private-look-proof', action='store_true')
|
|
for name in ('prefix', 'game-executable', 'profile', 'report'):
|
|
p.add_argument('--' + name, type=Path, required=True)
|
|
p.add_argument('--console', type=Path, help='Existing exact session; omit only in wrapper mode')
|
|
p.add_argument('--host-display', required=True)
|
|
p.add_argument('--nonce', required=True)
|
|
p.add_argument('command', nargs=argparse.REMAINDER)
|
|
return p.parse_args(argv)
|
|
|
|
|
|
def wrapper_command(args):
|
|
command = args.command[1:] if args.command[:1] == ['--'] else args.command
|
|
if not command:
|
|
if args.console is None:
|
|
raise Refused('Sidecar requires an exact existing console')
|
|
return []
|
|
if args.console is not None:
|
|
raise Refused('Wrapper discovers a new session; do not supply console')
|
|
if (len(command) < 3 or Path(command[0]).resolve() != Path(sys.executable).resolve() or
|
|
Path(command[1]) != Path(display.__file__).resolve()):
|
|
raise Refused('Only the unchanged sibling read-only display wrapper is allowed')
|
|
wrapped = display.parse_args(command[2:])
|
|
if (wrapped.query_worker or wrapped.prefix != args.prefix or wrapped.profile != args.profile or
|
|
wrapped.game_executable != args.game_executable or wrapped.host_display != args.host_display or
|
|
wrapped.report == args.report):
|
|
raise Refused('Read-only wrapper context differs')
|
|
display.validate_paths(wrapped)
|
|
native = wrapped.command[1:] if wrapped.command[:1] == ['--'] else wrapped.command
|
|
proton = Path.home() / '.local/share/Steam/steamapps/common/Proton - Experimental/proton'
|
|
if len(native) < 3 or native[:3] != [str(proton), 'run', str(args.game_executable)]:
|
|
raise Refused('Expected exact installed Proton/game command')
|
|
if (option(native, '-errOrdinaryInputObserve') != args.nonce or
|
|
option(native, '-profile') != 'Z:' + str(args.profile) or
|
|
option(native, '-errOrdinaryScenario') not in ('core', 'chat')):
|
|
raise Refused('Wrapped native observer context differs')
|
|
if args.enable_private_look_proof and option(native, '-errOrdinaryLookObserve') != args.nonce:
|
|
raise Refused('Wrapped native look observer context differs')
|
|
return command
|
|
|
|
|
|
def sessions(profile):
|
|
folder = profile / 'logs'
|
|
if not folder.exists():
|
|
return set()
|
|
if folder.is_symlink() or not folder.is_dir():
|
|
raise Refused('Invalid private native logs directory')
|
|
return {path for path in folder.iterdir() if re.fullmatch(r'logs_\d{4}-\d{2}-\d{2}_\d{2}-\d{2}-\d{2}', path.name)}
|
|
|
|
|
|
def console_path(args):
|
|
path = args.console
|
|
if (path != path.resolve() or path.name != 'console.log' or
|
|
path.parent.parent != args.profile / 'logs' or
|
|
not re.fullmatch(r'logs_\d{4}-\d{2}-\d{2}_\d{2}-\d{2}-\d{2}', path.parent.name)):
|
|
raise Refused('Expected exact canonical native session console')
|
|
|
|
|
|
def main(argv=None):
|
|
args = arguments(argv)
|
|
args.observe_seconds = 25; args.query_worker = False
|
|
display.validate_paths(args)
|
|
if not re.fullmatch(r'[A-Za-z0-9]{1,32}', args.nonce):
|
|
raise Refused('Invalid observer nonce')
|
|
command = wrapper_command(args)
|
|
if args.console is not None:
|
|
console_path(args)
|
|
bound = display.binding(args.host_display, args.prefix)
|
|
report = {'schema': 1, 'kind': 'headless-private-keyboard-experiment', 'input_sent': False,
|
|
'look_requested': args.enable_private_look_proof,
|
|
'sequence_completed': False, 'release_qualified': False, 'gameplay_qualified': False,
|
|
'hard_supervision': NOTIFY is not None, 'nonce': args.nonce, 'binding': bound, 'command': command, 'report': str(args.report), 'input_attempted': False,
|
|
'helper_sha256': hashlib.sha256(Path(__file__).read_bytes()).hexdigest(),
|
|
'ownership_helper_sha256': hashlib.sha256(Path(display.__file__).read_bytes()).hexdigest(),
|
|
'prefix': str(args.prefix), 'profile': str(args.profile), 'game_executable': str(args.game_executable)}
|
|
fd = os.open(args.report, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
|
|
info = os.fstat(fd)
|
|
notify({'kind': 'report', 'path': str(args.report), 'device': info.st_dev, 'inode': info.st_ino,
|
|
'metadata': report})
|
|
query = observer = child = None
|
|
before_sessions = sessions(args.profile) if command else set()
|
|
deadline = time.monotonic() + 180
|
|
previous = {}
|
|
def interrupted(signum, frame):
|
|
if report.get('sequence_completed') and fd is None and child is not None:
|
|
if child.poll() is None:
|
|
child.send_signal(signum)
|
|
return
|
|
raise Refused('Input experiment interrupted by signal ' + str(signum))
|
|
try:
|
|
for signum in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
|
|
previous[signum] = signal.signal(signum, interrupted)
|
|
if command:
|
|
child = subprocess.Popen(command) # inherit the existing private process group
|
|
notify({'kind': 'child', 'identity': display.identity(display.process(child.pid)), 'command': command})
|
|
while time.monotonic() < deadline:
|
|
if child.poll() is not None:
|
|
raise Refused('Read-only wrapper exited before native session')
|
|
if display.binding(args.host_display, args.prefix) != bound:
|
|
raise Refused('Display binding changed during startup')
|
|
new = sessions(args.profile) - before_sessions
|
|
if len(new) > 1:
|
|
raise Refused('Ambiguous new native sessions')
|
|
if new:
|
|
candidate = next(iter(new)) / 'console.log'
|
|
if candidate.exists():
|
|
args.console = candidate; console_path(args); break
|
|
time.sleep(.1)
|
|
if args.console is None:
|
|
raise Refused('New native console deadline exceeded')
|
|
report['console'] = str(args.console)
|
|
observer = Observer(args.console, args.nonce, enable_look=args.enable_private_look_proof)
|
|
query = display.X11(bound['display'])
|
|
while time.monotonic() < deadline:
|
|
if child is not None and child.poll() is not None:
|
|
raise Refused('Read-only wrapper exited during startup')
|
|
observer.poll()
|
|
if display.binding(args.host_display, args.prefix) != bound:
|
|
raise Refused('Display binding changed during window startup')
|
|
query.query_budget = display.MAX_WINDOWS
|
|
owners = [owner for window in query.windows()
|
|
if (owner := display.owned_window(window, bound, args.prefix, args.game_executable))]
|
|
eligible = [owner for owner in owners[:16] if display.input_target(query, owner).get('verified') is True]
|
|
exact = [owner for owner in eligible if query.focus()[0] == owner['window']]
|
|
selected = exact or eligible
|
|
if len(selected) == 1:
|
|
break
|
|
if len(selected) > 1:
|
|
raise Refused('Ambiguous mapped focused owned game windows')
|
|
time.sleep(.1)
|
|
else:
|
|
raise Refused('Mapped owned game window deadline exceeded')
|
|
owner = selected[0]
|
|
report['owner'] = {key: owner[key] for key in ('window', 'pid', 'server_pid', 'process')}
|
|
guard = Guard(args, bound, query, owner)
|
|
guard.check()
|
|
keyboard = Keyboard(query)
|
|
keyboard.require_idle()
|
|
mouse = RelativeMouse(query, keyboard, owner) if args.enable_private_look_proof else None
|
|
sequence(guard, keyboard, observer, report, mouse=mouse)
|
|
except (OSError, ValueError, UnicodeError, subprocess.SubprocessError) as error:
|
|
report['error'] = str(error)
|
|
finally:
|
|
report['whole_process_group_cleanup_verified'] = False # outer runner owns it
|
|
if observer:
|
|
report['observer'] = {'inode': observer.identity, 'start_offset': observer.start_offset,
|
|
'end_offset': observer.offset, 'records': observer.raw, 'events': observer.events}
|
|
if args.enable_private_look_proof:
|
|
report['look_observation'] = observer.look_records
|
|
observer.close()
|
|
if query:
|
|
query.close()
|
|
with os.fdopen(fd, 'w') as stream:
|
|
fd = None
|
|
json.dump(report, stream, indent=2); stream.write('\n'); stream.flush(); os.fsync(stream.fileno())
|
|
notify({'kind': 'proof-finished', 'successful': report['sequence_completed'] and not report.get('error')})
|
|
child_code = 0
|
|
try:
|
|
if child is not None:
|
|
if report.get('error'):
|
|
child.terminate()
|
|
child_code = child.wait(timeout=max(.1, deadline - time.monotonic()) if not report.get('error') else 5)
|
|
except subprocess.TimeoutExpired:
|
|
child.terminate()
|
|
try:
|
|
child.wait(timeout=5)
|
|
except subprocess.TimeoutExpired:
|
|
child.kill(); child.wait(timeout=2)
|
|
child_code = 1
|
|
finally:
|
|
for signum, handler in previous.items():
|
|
signal.signal(signum, handler)
|
|
return 0 if report['sequence_completed'] and not report.get('error') and child_code == 0 else 1
|
|
|
|
|
|
def worker_entry(argv, pipe):
|
|
global NOTIFY
|
|
NOTIFY = pipe
|
|
try:
|
|
code = main(argv)
|
|
finally:
|
|
pipe.close()
|
|
raise SystemExit(code)
|
|
|
|
|
|
def stop_exact_child(record, read=display.process, kill=os.kill):
|
|
if record is None:
|
|
return False
|
|
try:
|
|
current = read(record['identity']['pid'])
|
|
if (display.identity(current) != record['identity'] or current['args'] != record['command'] or
|
|
current['uid'] != os.getuid()):
|
|
return False
|
|
# Only the exact display wrapper created by our worker; no group signalling.
|
|
kill(current['pid'], signal.SIGTERM)
|
|
return True
|
|
except (OSError, ValueError, KeyError):
|
|
return False
|
|
|
|
|
|
def supervision_failure(record, key, reason):
|
|
"""Amend only the exact exclusive report created by our now-stopped worker."""
|
|
if record is None:
|
|
return
|
|
fd = os.open(record['path'], os.O_RDWR | os.O_NOFOLLOW)
|
|
try:
|
|
info = os.fstat(fd)
|
|
if (info.st_dev, info.st_ino) != (record['device'], record['inode']) or info.st_uid != os.getuid() or not stat.S_ISREG(info.st_mode):
|
|
raise Refused('Worker report changed before timeout recording')
|
|
raw = os.read(fd, 2 * 1024 * 1024)
|
|
try:
|
|
report = json.loads(raw) if raw else dict(record['metadata'])
|
|
except (ValueError, UnicodeError):
|
|
report = dict(record['metadata'])
|
|
# Keep the worker's actual refusal; supervisor lifecycle is separate evidence.
|
|
key = key or report.get('unconfirmed_held_key')
|
|
report.setdefault('error', reason)
|
|
report.update(supervision_failed=True, supervision_error=reason, sequence_completed=False,
|
|
all_attempted_presses_released=key is None and report.get('all_attempted_presses_released', True),
|
|
unconfirmed_held_key=key)
|
|
if key is not None:
|
|
report['input_attempted'] = True
|
|
report.setdefault('paired_release_errors', []).append('Supervisor could not confirm paired key release')
|
|
payload = (json.dumps(report, indent=2) + '\n').encode()
|
|
os.lseek(fd, 0, os.SEEK_SET); os.write(fd, payload); os.ftruncate(fd, len(payload)); os.fsync(fd)
|
|
finally:
|
|
os.close(fd)
|
|
|
|
|
|
def supervise(argv=None):
|
|
# Fork before loading Xlib or opening any display. The worker owns the one
|
|
# connection. Parent never opens a second connection or retries an event.
|
|
context = multiprocessing.get_context('fork')
|
|
parent, child_pipe = context.Pipe(duplex=False)
|
|
child = context.Process(target=worker_entry, args=(argv, child_pipe))
|
|
previous = {}; received = []
|
|
def forward(signum, frame):
|
|
received.append(signum)
|
|
if child.pid and child.is_alive():
|
|
os.kill(child.pid, signum)
|
|
for signum in (signal.SIGINT, signal.SIGTERM, signal.SIGHUP):
|
|
previous[signum] = signal.signal(signum, forward)
|
|
look_at = None; held_at = None; held_key = None; owned_child = None; report_record = None; proof_finished = False; expired = False
|
|
deadline = time.monotonic() + 190
|
|
try:
|
|
child.start(); child_pipe.close()
|
|
while child.is_alive():
|
|
if parent.poll(.05):
|
|
try:
|
|
event = parent.recv()
|
|
except EOFError:
|
|
event = None
|
|
if event and event['kind'] == 'look-pending':
|
|
look_at = time.monotonic()
|
|
elif event and event['kind'] == 'look-finished':
|
|
look_at = None
|
|
elif event and event['kind'] == 'press-pending':
|
|
held_at = time.monotonic(); held_key = event['key']
|
|
elif event and event['kind'] == 'release-confirmed':
|
|
held_at = None; held_key = None
|
|
elif event and event['kind'] == 'child':
|
|
owned_child = event
|
|
elif event and event['kind'] == 'report':
|
|
report_record = event
|
|
elif event and event['kind'] == 'proof-finished':
|
|
proof_finished = event['successful']
|
|
now = time.monotonic()
|
|
if received or now >= deadline or (held_at is not None and now - held_at > 1.5) or (look_at is not None and now - look_at > 4):
|
|
expired = True
|
|
child.terminate() # asks worker finally to release if still provable
|
|
child.join(1)
|
|
stop_exact_child(owned_child)
|
|
if child.is_alive():
|
|
child.kill(); child.join(2)
|
|
# Drain release acknowledgements emitted during cooperative finally.
|
|
while parent.poll():
|
|
try:
|
|
last = parent.recv()
|
|
except EOFError:
|
|
break
|
|
if last['kind'] == 'release-confirmed':
|
|
held_key = None
|
|
elif last['kind'] == 'report':
|
|
report_record = last
|
|
elif last['kind'] == 'proof-finished':
|
|
proof_finished = last['successful']
|
|
if not (received and proof_finished and held_key is None):
|
|
supervision_failure(report_record, held_key, 'Private input worker timed out or was interrupted')
|
|
break
|
|
child.join(2)
|
|
if child.exitcode != 0 and not expired:
|
|
stop_exact_child(owned_child)
|
|
if not (received and proof_finished and held_key is None):
|
|
supervision_failure(report_record, held_key, 'Private input worker exited unsuccessfully')
|
|
return 1 if expired or child.exitcode != 0 else 0
|
|
finally:
|
|
if child.pid and child.is_alive():
|
|
child.terminate(); child.join(1)
|
|
stop_exact_child(owned_child)
|
|
if child.is_alive():
|
|
child.kill(); child.join(2)
|
|
parent.close()
|
|
for signum, handler in previous.items():
|
|
signal.signal(signum, handler)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
raise SystemExit(supervise())
|