feat(F-NSWINDOW-E5 r7): bind 3 CRT imports + IMUL/CPUID/RDTSC decode + security-cookie arithmetic (#29)

Cross the r6 wall (unbound IAT call @0x5392D4, insns=30) and run deeper into
__scrt_common_main CRT init.

native/i386_cpu.{c,h}: 3 more kernel32 shims — GetStartupInfoW (buffer-write
STARTUPINFOW, cb=0x44), GetSystemInfo (bounded-synthetic SYSTEM_INFO), and
GetProcAddress (→ synthetic in-image stub). IAT now binds 11 slots
(0x538000..0x538028). Synthetic monotonic TSC field + I386_TSC_STEP added.

native/i386_decode.{c,h} + byte-equal .hexa mirror (RUNEQ): new opcodes
IMUL_R_RM (0F AF), IMUL_R_RM_IMM (69 id / 6B ib), CPUID (0F A2), RDTSC (0F 31).
Interpreter: IMUL 32-bit signed (low→dst, CF/OF on int32 overflow); CPUID writes
a synthetic GenuineIntel feature set; RDTSC writes a synthetic monotonic edx:eax.

native/i386_cpu_test.c: hermetic prologue extended with the 3 binds + the
__security_init_cookie shape (load FILETIME entropy → xor → imul → store a
non-default cookie to a global slot) + cpuid + rdtsc. Run A advances insns
30→44, halt 0x5392D4→0x539318 (UNBOUND_IMPORT slot 0x53802C, bound=11,
last=GetProcAddress); cookie/cpuid/rdtsc all asserted. B/D sentinel 0F A2→0F A3
(bt, next decoder gap). __SHIM_TEST__ PASS, clang -Wall -Wextra -Wpedantic clean.

main/WinMain NOT reached — still CRT-init (import binding); the hermetic prologue
is a documented SHAPE, not the real binary, so there is no real `call main` yet.
own1: loading our own kernel32 imports; CPUID/RDTSC are plain CPU ops; the cookie
is our arithmetic over our buffers. No Wine, no protection. validated_manjeom=0.

Co-authored-by: dancinlife <mk55911@proton.me>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

CHANGELOG.md

@@ -6,6 +6,44 @@ All notable changes to `gamebox` are documented in this file.
 
 ### Added
 
+- feat(F-NSWINDOW-E5 r7): **CRT import 3개 추가 바인딩 + IMUL/CPUID/RDTSC 디코더
+  갭 종결 + `__security_init_cookie` 산술 실행** — r6 의 벽(미등록 IAT 호출
+  @`0x5392D4`, insns=30)을 **넘는다**. (1) `native/i386_cpu.{c,h}` 에 세 개의
+  kernel32 셰임 추가: `GetStartupInfoW(LPSTARTUPINFOW)`(1-arg ptr, push 된 포인터
+  `[esp]` 의 STARTUPINFOW 0x44B 를 0 으로 + `cb=0x44` 스탬프 — 버퍼-쓰기),
+  `GetSystemInfo(LPSYSTEM_INFO)`(1-arg ptr, **bounded-synthetic** SYSTEM_INFO
+  0x24B — dwPageSize=0x1000·nCPU=4·arch=INTEL, 나머지 0), `GetProcAddress(HMODULE,
+  LPCSTR)`(2-arg → **합성 in-image 스텁 주소** `base+0x1FF0`). IAT 등록 슬롯
+  `0x538000..0x538028` 로 11개(count=11). (2) `native/i386_decode.{c,h}` +
+  byte-equal `.hexa` 미러: enum `I386_OP_IMUL_R_RM`(57, `0F AF`)/`_IMM`(58, `69 id`/
+  `6B ib`)/`I386_OP_CPUID`(59, `0F A2`)/`I386_OP_RDTSC`(60, `0F 31`) + 디코드
+  분기 추가, op_name="imul"/"cpuid"/"rdtsc". 인터프리터: **IMUL** 은 32-bit signed
+  곱의 하위 32-bit 를 dst(ModR/M.reg)에, int32 오버플로면 CF=OF=1(SDM Vol.2);
+  **CPUID** 는 leaf(eax)별 **합성** 피처셋(leaf0 vendor "GenuineIntel"·max-leaf,
+  leaf1 family/feature) 을 eax/ebx/ecx/edx 에; **RDTSC** 는 `cpu->tsc += step` 합성
+  단조 카운터를 edx:eax 에 기록. CPUID/RDTSC 는 평범한 CPU 명령(보호 아님). (3)
+  **보안쿠키 산술**: hermetic 프롤로그가 FILETIME 엔트로피 로드 → `xor` →
+  `imul eax,eax,0x01000193`(신규 0x69 IMUL) → 글로벌 슬롯에 **비기본 쿠키** 저장 →
+  `cpuid`(GenuineIntel) → `rdtsc`. (4) hermetic 테스트(`native/i386_cpu_test.c`)
+  Run A 는 r6 체인 뒤에 `call GetStartupInfoW`(cb=0x44 검증) / `call GetSystemInfo`
+  (page=0x1000·nCPU=4 검증) / `push×2; call GetProcAddress` / 쿠키 `mov/xor/imul/mov`
+  (쿠키 == `(FT_lo^FT_hi)*0x01000193` 재유도 검증, ≠0) / `cpuid`(ebx="Genu"·
+  ecx="ntel" 검증) / `rdtsc`(edx:eax 합성 검증) / 미등록 `call` 을 이어 붙여 경계
+  통과를 증명: **insns 30→44, halt `0x5392D4`→`0x539318`**(reason=UNBOUND_IMPORT,
+  slot `0x53802C`), bound=11, last=GetProcAddress. B/D sentinel 은 `0F A2`(이제 실행됨)
+  → `0F A3`(BT, 다음 진짜 디코더 갭) 으로 교체. 측정 라인 `__SHIM__ PARTIAL
+  phase=e4_crt_security_cookie insns=44 bound=11 last=GetProcAddress
+  halt_va=0x539318 halt=unbound_import halt_op=call unbound_slot=0x53802C`,
+  `__SHIM_TEST__ PASS`(CI 게이트, Run A 18 checks 전부 green, 로컬 clang
+  `-Wall -Wextra -Wpedantic -std=c11` 청정). **own1**: 로더가 자기 프로세스의 **자기
+  import**(kernel32 OS API)를 네이티브 구현에 묶는 **로딩** — 우회 아님; CPUID/RDTSC
+  는 평범한 CPU 명령, 쿠키는 **자기 버퍼 위의 자기 산술**, 합성 SYSTEM_INFO/스텁은
+  정직 라벨. **`main`/`WinMain` 미도달**: 아직 CRT-init(import 바인딩) 단계이며
+  hermetic 프롤로그는 실제 바이너리가 아닌 문서화된 SHAPE 라 진짜 `call main` 은
+  없음 — 남은 CRT 단계(추가 import + `__scrt_common_main_seh` → user entry). `validated_manjeom`
+  은 여전히 **0**(로더 진척이지 렌더된 프레임 아님). 다음 r8: 미등록 slot `0x53802C`
+  바인딩 + `0F A3` BT 디코더 갭 + 실제 바이너리에서 `mainCRTStartup→main` 거리 측정.
+
 - feat(F-NSWINDOW-E5 r6): **CRT-security import 3개 추가 바인딩 + 0F B6/B7/BE/BF
   MOVZX/MOVSX 디코더 갭 종결 + 합성 TEB→PEB→ImageBase 체인** — r5 의 벽(미등록 IAT
   호출 @`0x5392A1`, insns=18)을 **넘는다**. (1) `native/i386_cpu.{c,h}` 에 세 개의

native/i386_cpu.c

@@ -109,6 +109,45 @@ uint32_t i386_shim_GetModuleHandleW(i386_cpu_t *cpu, const struct i386_image *im
     return img->base;                               // HMODULE == loaded image base
 }
 
+// GetStartupInfoW(LPSTARTUPINFOW lpStartupInfo) — WINAPI/stdcall, 1 ptr arg,
+// returns void. Buffer-writing: zeroes a STARTUPINFOW (0x44 bytes on x86) in
+// image memory at the pushed pointer ([esp]) and stamps cb = 0x44 at offset 0.
+// own1: a CRT-startup OS-API call filling the program's OWN buffer — loading.
+uint32_t i386_shim_GetStartupInfoW(i386_cpu_t *cpu, const struct i386_image *img) {
+    uint32_t psi;                                   // LPSTARTUPINFOW arg
+    if (!i386_mem_read32(img, cpu->gpr[I386_REG_ESP], &psi)) return 0;
+    for (uint32_t o = 0; o < 0x44u; o += 4) i386_mem_write32(img, psi + o, 0u);
+    i386_mem_write32(img, psi + 0x00u, 0x44u);      // cb = sizeof(STARTUPINFOW) (x86)
+    return 0;                                       // void → EAX irrelevant
+}
+
+// GetSystemInfo(LPSYSTEM_INFO lpSystemInfo) — WINAPI/stdcall, 1 ptr arg, void.
+// Buffer-writing: a BOUNDED-SYNTHETIC SYSTEM_INFO (0x24 bytes on x86) — a few
+// plausible fields (page size / processor count / type), the rest zeroed.
+// own1: native re-impl of the OS API filling the program's OWN buffer — loading.
+uint32_t i386_shim_GetSystemInfo(i386_cpu_t *cpu, const struct i386_image *img) {
+    uint32_t psi;                                   // LPSYSTEM_INFO arg
+    if (!i386_mem_read32(img, cpu->gpr[I386_REG_ESP], &psi)) return 0;
+    for (uint32_t o = 0; o < 0x24u; o += 4) i386_mem_write32(img, psi + o, 0u);
+    i386_mem_write32(img, psi + 0x00u, 0x00000000u);// wProcessorArchitecture = INTEL(0)
+    i386_mem_write32(img, psi + 0x04u, 0x00001000u);// dwPageSize = 4096
+    i386_mem_write32(img, psi + 0x14u, 0x00000004u);// dwNumberOfProcessors = 4 (synthetic)
+    i386_mem_write32(img, psi + 0x18u, 0x000006F0u);// dwProcessorType (synthetic)
+    return 0;                                       // void → EAX irrelevant
+}
+
+// GetProcAddress(HMODULE hModule, LPCSTR lpProcName) — WINAPI/stdcall, 2 args,
+// returns FARPROC. own1: the LOADER hands back a SYNTHETIC in-image stub address
+// (we never resolve to a real OS export here); a later round can bind it. Not a
+// bypass — this is import resolution, exactly what a loader does.
+uint32_t i386_shim_GetProcAddress(i386_cpu_t *cpu, const struct i386_image *img) {
+    uint32_t hmod = 0, pname = 0;
+    i386_mem_read32(img, cpu->gpr[I386_REG_ESP] + 0, &hmod);   // arg1 hModule
+    i386_mem_read32(img, cpu->gpr[I386_REG_ESP] + 4, &pname);  // arg2 lpProcName
+    (void)hmod; (void)pname;
+    return img->base + 0x1FF0u;                     // synthetic in-image stub addr
+}
+
 const i386_import_t *i386_iat_lookup(const i386_iat_t *iat, uint32_t slot_va) {
     if (!iat || !iat->imports) return NULL;
     for (uint32_t i = 0; i < iat->count; i++) {
@@ -614,6 +653,66 @@ void i386_cpu_run(i386_cpu_t *cpu, const i386_image_t *img,
                 cpu->gpr[(insn.modrm >> 3) & 7] = v;
                 break;
             }
+            // ── IMUL r32, r/m32[, imm] (E5 r7) — 0F AF · 69 /r id · 6B /r ib ─
+            // 32-bit signed multiply. Low 32 bits of the product → dst register
+            // (ModR/M.reg). CF=OF=1 if the full signed product does not fit in a
+            // sign-extended 32-bit result (per SDM Vol.2 IMUL); SF/ZF/AF/PF
+            // undefined (left unchanged). own1: a plain CPU multiply.
+            case I386_OP_IMUL_R_RM:
+            case I386_OP_IMUL_R_RM_IMM: {
+                int dst = (insn.modrm >> 3) & 7;
+                i386_halt_t why = I386_HALT_UNSUPPORTED;
+                uint32_t rm_v;
+                if (!rm_get32(cpu, img, &insn, &rm_v, &why)) {
+                    res->halt = why; res->halt_va = eip; res->halt_op = insn.op; return;
+                }
+                int64_t a = (insn.op == I386_OP_IMUL_R_RM_IMM)
+                          ? (int64_t)(int32_t)rm_v        // src1 = r/m32
+                          : (int64_t)(int32_t)cpu->gpr[dst];
+                int64_t b = (insn.op == I386_OP_IMUL_R_RM_IMM)
+                          ? (int64_t)(int32_t)insn.imm    // src2 = imm
+                          : (int64_t)(int32_t)rm_v;       // src2 = r/m32
+                int64_t prod = a * b;
+                uint32_t low = (uint32_t)prod;
+                cpu->gpr[dst] = low;
+                int ovf = (prod != (int64_t)(int32_t)low);
+                set_flag(&cpu->eflags, EFL_CF, ovf);
+                set_flag(&cpu->eflags, EFL_OF, ovf);
+                break;
+            }
+            // ── CPUID (E5 r7) — 0F A2 — SYNTHETIC CPU-identity / feature set ─
+            // Leaf in EAX selects the result. We return a plausible synthetic
+            // set (vendor "GenuineIntel" + a max-leaf for leaf 0; family/feature
+            // bits for leaf 1). own1: CPUID is a plain CPU instruction — the CRT
+            // probes it to pick code paths; NOT a protection mechanism.
+            case I386_OP_CPUID: {
+                uint32_t leaf = cpu->gpr[I386_REG_EAX];
+                if (leaf == 0) {
+                    cpu->gpr[I386_REG_EAX] = 0x00000016u;   // max basic leaf (synthetic)
+                    cpu->gpr[I386_REG_EBX] = 0x756E6547u;   // "Genu"
+                    cpu->gpr[I386_REG_EDX] = 0x49656E69u;   // "ineI"
+                    cpu->gpr[I386_REG_ECX] = 0x6C65746Eu;   // "ntel"  → "GenuineIntel"
+                } else if (leaf == 1) {
+                    cpu->gpr[I386_REG_EAX] = 0x000006F0u;   // family/model/stepping (synthetic)
+                    cpu->gpr[I386_REG_EBX] = 0x00000000u;
+                    cpu->gpr[I386_REG_ECX] = 0x00000201u;   // a couple ECX feature bits (synthetic)
+                    cpu->gpr[I386_REG_EDX] = 0x078BFBFFu;   // common base EDX feature bits (synthetic)
+                } else {
+                    cpu->gpr[I386_REG_EAX] = 0u; cpu->gpr[I386_REG_EBX] = 0u;
+                    cpu->gpr[I386_REG_ECX] = 0u; cpu->gpr[I386_REG_EDX] = 0u;
+                }
+                break;
+            }
+            // ── RDTSC (E5 r7) — 0F 31 — SYNTHETIC monotonic timestamp counter ─
+            // Each rdtsc advances cpu->tsc by a fixed step and returns the running
+            // 64-bit count in edx:eax. own1: a deterministic synthetic counter,
+            // NOT the host TSC and NOT a protection clock.
+            case I386_OP_RDTSC: {
+                cpu->tsc += I386_TSC_STEP;
+                cpu->gpr[I386_REG_EAX] = (uint32_t)cpu->tsc;
+                cpu->gpr[I386_REG_EDX] = (uint32_t)(cpu->tsc >> 32);
+                break;
+            }
             // ── E4 kernel32 boundary — indirect IAT call / jump ───────────
             case I386_OP_CALL_RM:               // FF /2 [..]
             case I386_OP_JMP_RM: {              // FF /4 [..]

native/i386_cpu.h

@@ -43,6 +43,19 @@
 //   address into a few-field synthetic TEB/PEB (teb_base; self@+0x18, PEB@+0x30,
 //   ImageBase@PEB+8) so the security-cookie / CRT-startup `fs:[..]` chain runs.
 //   own1: synthetic block, NOT the OS TEB and NOT a protection structure.
+//
+// Coverage (E5 r7 — security cookie + CPU-identity ops, deeper into CRT init):
+//   IMUL r32,r/m32 (0F AF) + IMUL r32,r/m32,imm (69 id / 6B ib) — 32-bit signed
+//   multiply, low result to dst, CF/OF set if it overflows int32 ·
+//   CPUID (0F A2) — writes a SYNTHETIC feature set (leaf 0 vendor "GenuineIntel"
+//   + max-leaf; leaf 1 family/feature bits) into eax/ebx/ecx/edx ·
+//   RDTSC (0F 31) — writes a SYNTHETIC monotonic counter (cpu->tsc += step) into
+//   edx:eax · three more kernel32 shims (GetStartupInfoW [buffer-write cb=0x44] /
+//   GetSystemInfo [bounded-synthetic SYSTEM_INFO] / GetProcAddress [→ synthetic
+//   in-image stub addr]). The prologue now runs the MSVC __security_init_cookie
+//   shape: load the FILETIME entropy, xor, imul-mix, and store a non-default
+//   cookie to a global slot. own1: CPUID/RDTSC are plain CPU instructions (no
+//   protection); the cookie is OUR arithmetic over OUR buffers; no Wine.
 
 #ifndef GAMEBOX_I386_CPU_H
 #define GAMEBOX_I386_CPU_H
@@ -100,8 +113,16 @@ struct i386_cpu {
     // and NOT a protection structure — just enough for the cookie math to run.
     // 0 → no TEB modeled (an fs: access then halts OOB honestly).
     uint32_t teb_base;
+    // ── E5 r7 SYNTHETIC timestamp counter (NOT the real CPU TSC) ─────────────
+    // RDTSC (0F 31) returns a deterministic monotonic value: each rdtsc adds
+    // I386_TSC_STEP and writes the running 64-bit count to edx:eax. own1: a
+    // plausible synthetic counter, NOT the host TSC and NOT a protection clock.
+    uint64_t tsc;
 };
 
+// Per-rdtsc increment for the synthetic timestamp counter (plausible, fixed).
+#define I386_TSC_STEP 0x000000178B4D159EULL
+
 // Native kernel32 shim — GetCurrentThreadId (WINAPI/stdcall, 0 args, → DWORD).
 // own1: returns a deterministic plausible thread id. This is the OS API
 // surface bound to a native impl (loading), not a protection bypass.
@@ -130,6 +151,18 @@ uint32_t i386_shim_IsProcessorFeaturePresent(i386_cpu_t *cpu, const struct i386_
 uint32_t i386_shim_InitializeSListHead(i386_cpu_t *cpu, const struct i386_image *img);
 uint32_t i386_shim_GetModuleHandleW(i386_cpu_t *cpu, const struct i386_image *img);
 
+// CRT-startup kernel32 shims (E5 r7). own1: native re-impls of the OS API
+// surface bound to the program's OWN imports — loading, not a bypass.
+//   GetStartupInfoW(LPSTARTUPINFOW)  — 1 ptr arg, void; zeroes a STARTUPINFOW
+//       and stamps cb = 0x44 (sizeof) at image memory at the pushed pointer.
+//   GetSystemInfo(LPSYSTEM_INFO)     — 1 ptr arg, void; writes a BOUNDED-
+//       SYNTHETIC SYSTEM_INFO (page size / processor count / arch) buffer.
+//   GetProcAddress(HMODULE,LPCSTR)   — 2 ptr/str args, returns a synthetic
+//       in-image stub address (the loader hands back its own thunk).
+uint32_t i386_shim_GetStartupInfoW(i386_cpu_t *cpu, const struct i386_image *img);
+uint32_t i386_shim_GetSystemInfo(i386_cpu_t *cpu, const struct i386_image *img);
+uint32_t i386_shim_GetProcAddress(i386_cpu_t *cpu, const struct i386_image *img);
+
 // Look up an IAT slot VA in the registry. Returns NULL if `iat` is NULL or
 // the slot is not bound (→ the caller halts UNBOUND_IMPORT honestly).
 const i386_import_t *i386_iat_lookup(const i386_iat_t *iat, uint32_t slot_va);