feat(F-NSWINDOW-E5 r9): IAT name-based autobind + CMPXCHG 0F B0/B1 decoder+executor + Run E test (#31)

(1) i386_iat_autobind(): walks IMAGE_IMPORT_DESCRIPTOR → INT → IMAGE_IMPORT_BY_NAME,
matches each import name against the shim registry by strcmp — no pre-knowledge of slot
VAs needed. Unknown names produce fn=NULL entries (honest; run loop halts
UNBOUND_IMPORT with name in last_import). Header: i386_shim_entry_t typedef + decl.

(2) pe_parse: adds import_dir_rva/import_dir_size to pe_image_t; reads DataDirectory[1]
for both PE32 (opt-header offset 104) and PE32+ (offset 120).

(3) CMPXCHG decoder: 0F B0 (cmpxchg r/m8,r8) and 0F B1 (cmpxchg r/m32,r32) added to
i386_decode.c (enum ordinals 65/66) and byte-equal i386_decode.hexa mirror (RUNEQ).
Executor: compare EAX/AL with r/m; equal → ZF=1, r/m←reg; not-equal → ZF=0,
EAX/AL←r/m (Intel SDM Vol.2). Adds rm_set8/mem_write8 helpers.

(4) Run E: synthetic in-memory PE import directory (base 0x540000), autobind call,
18-point assertion suite — total=3, bound=3, unbound=0; mini-run through
GetCurrentThreadId slot verifies end-to-end dispatch (EAX=0x1A2B, halt=ret);
CMPXCHG equal + not-equal path tests. Run A (25 checks) stays green.
B/D wall sentinel updated 0F B1 → 0F C1 C0 (XADD, r10 gap).

own1: standard PE import resolution = LOADING (not bypass); Intel SDM CMPXCHG;
validated_manjeom STAYS 0. r10 target: DX→Metal bridge (lib/loader/dx_d3d11.hexa).

Co-authored-by: dancinlife <mk55911@proton.me>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 3 people

CHANGELOG.md

@@ -6,6 +6,38 @@ All notable changes to `gamebox` are documented in this file.
 
 ### Added
 
+- feat(F-NSWINDOW-E5 r9): **IAT 이름 기반 자동 바인딩 + CMPXCHG 디코더·실행**
+  — r8 이 `INFO real_pe_path=structurally_ready needs:IAT_autobind_by_import_name`
+  으로 명시한 다음 과제를 완료한다. (1) **`i386_iat_autobind()`**
+  (`native/i386_cpu.c`): `IMAGE_IMPORT_DESCRIPTOR` → INT(OriginalFirstThunk) →
+  `IMAGE_IMPORT_BY_NAME`(+2 hint skip) 를 직접 파싱해 이름 문자열로 셰임 레지스트리와
+  `strcmp` 매칭 — **슬롯 VA 사전지식 없이** 어떤 i386 PE 의 IAT 도 바인딩 가능. 미등록
+  이름은 `fn=NULL`(정직; 런루프는 `HALT_UNBOUND_IMPORT` + `last_import` 에 이름 기록).
+  선언은 `native/i386_cpu.h`(`i386_shim_entry_t` typedef + 함수 선언, forward-decl
+  `const struct i386_image *`). (2) **Import Directory RVA 파싱** (`native/pe_parse.c`):
+  `pe_image_t` 에 `import_dir_rva`/`import_dir_size` 추가, DataDirectory[1] 을 PE32
+  (optional-header 오프셋 104) 와 PE32+(오프셋 120) 양쪽에서 읽음. (3) **CMPXCHG
+  디코더**: `0F B0`(`cmpxchg r/m8,r8`) + `0F B1`(`cmpxchg r/m32,r32`) 를 C 디코더
+  (`native/i386_decode.c`, enum ordinal 65·66) 와 byte-equal hexa 미러
+  (`native/i386_decode.hexa`) 양쪽에 추가(RUNEQ 규율). 인터프리터 실행부: EAX/AL 과
+  r/m 비교 → 같으면 ZF=1·r/m←reg, 다르면 ZF=0·EAX/AL←r/m(Intel SDM Vol.2). `rm_set8`
+  / `mem_write8` 보조 함수 추가. fn=NULL(autobind 미등록 슬롯)에 대한 IAT 디스패치
+  halt 처리도 업데이트(`last_import` 이름 보존). (4) **Run E 테스트**
+  (`native/i386_cpu_test.c`): 합성 in-memory PE import 디렉터리(base `0x540000`,
+  `0x1000B`): `IMAGE_IMPORT_DESCRIPTOR` 1개 + INT 3개 + `IMAGE_IMPORT_BY_NAME` 3개
+  (GetCurrentThreadId·GetTickCount·GetCommandLineW) 를 레이아웃하고 `i386_iat_autobind`
+  호출 → total=3·bound=3·unbound=0·슬롯 VA·fn·name 18-항목 전수 검증. GetCurrentThreadId
+  슬롯을 통한 미니런(`FF 15 [0x540100]` → `C3`) → `halt=ret, EAX=0x1A2B, imports_bound=1`.
+  CMPXCHG equal 패스(EAX=ECX=`0x12345678` → ZF=1·ECX 불변)와 not-equal 패스
+  (EAX=`0xAAAAAAAA`·ECX=`0xBBBBBBBB` → ZF=0·EAX=`0xBBBBBBBB`) 각 4개 CHECK. B/D
+  sentinel 은 `0F B1`(이제 CMPXCHG 로 실행됨) → `0F C1 C0`(XADD, r10 진짜 갭) 으로
+  교체. 측정 라인 `__SHIM__ PARTIAL phase=e4_iat_name_autobind names_resolved=3
+  unbound=0 dispatch_ok=1`, `__SHIM_TEST__ PASS`(CI 게이트 · Run A 25/B 4/C 5/D 3/E 18
+  checks 전부 green). **own1**: 표준 PE import 해석 = 자신의 import 를 네이티브 구현에
+  묶는 **로딩**(bypass 아님); 합성 PE 구조·Intel SDM CMPXCHG — Wine/보호 없음.
+  `validated_manjeom` 여전히 **0**. r10 목표: DX→Metal 브리지 라이브러리
+  (`lib/loader/dx_d3d11.hexa` 스캐폴드, 0 실 Metal 호출).
+
 - feat(F-NSWINDOW-E5 r8): **CRT→user-entry 핸드오프 도달(합성) + BT/BTS/BTR/BTC
   디코더 갭 종결 + 마지막 CRT import 2개 바인딩** — r7 의 벽(미등록 IAT 호출
   @`0x539318`, insns=44)을 **넘어 CRT-init 의 종착점인 `call WinMain`(CRT→user-entry

native/i386_cpu.c

@@ -207,6 +207,12 @@ static int mem_read16(const i386_image_t *img, uint32_t va, uint16_t *out) {
     *out = (uint16_t)((uint16_t)p[0] | ((uint16_t)p[1] << 8));
     return 1;
 }
+// Byte write (E5 r9 — for CMPXCHG r/m8,r8 write-back).
+static int mem_write8(const i386_image_t *img, uint32_t va, uint8_t val) {
+    if (va < img->base || (uint64_t)va + 1 > (uint64_t)img->base + img->size) return 0;
+    img->host[va - img->base] = val;
+    return 1;
+}
 
 // Compute the effective address for a memory-form ModR/M (mod != 3).
 // Supports the [reg+disp] / [disp32] forms the entry block uses; SIB is
@@ -248,6 +254,25 @@ static int rm_get8(const i386_cpu_t *cpu, const i386_image_t *img,
     return 1;
 }
 
+// Write an 8-bit value to the r/m operand. Register-direct: same byte-
+// register map as rm_get8 (rm<4 = low byte of gpr[rm]; rm>=4 = high byte
+// of gpr[rm-4] / ah/ch/dh/bh). (E5 r9 — for CMPXCHG r/m8,r8 write-back.)
+static int rm_set8(i386_cpu_t *cpu, const i386_image_t *img,
+                   const i386_insn_t *insn, uint8_t val, i386_halt_t *why) {
+    int mod = (insn->modrm >> 6) & 3;
+    if (mod == 3) {
+        int rm = insn->modrm & 7;
+        if (rm < 4) cpu->gpr[rm] = (cpu->gpr[rm] & ~(uint32_t)0xFFu) | (uint32_t)val;
+        else        cpu->gpr[rm - 4] = (cpu->gpr[rm - 4] & ~(uint32_t)0xFF00u)
+                                     | ((uint32_t)val << 8);
+        return 1;
+    }
+    uint32_t a;
+    if (!i386_ea(cpu, insn, &a)) { *why = I386_HALT_UNSUPPORTED; return 0; }
+    if (!mem_write8(img, a, val)) { *why = I386_HALT_OOB; return 0; }
+    return 1;
+}
+
 // Read a 16-bit r/m operand. Register-direct = low word of gpr[rm].
 static int rm_get16(const i386_cpu_t *cpu, const i386_image_t *img,
                     const i386_insn_t *insn, uint16_t *val, i386_halt_t *why) {
@@ -776,6 +801,65 @@ void i386_cpu_run(i386_cpu_t *cpu, const i386_image_t *img,
                 }
                 break;
             }
+            // ── CMPXCHG r/m32,r32 (E5 r9) — 0F B1 /r ─────────────────────────────
+            // Compare EAX with r/m32; if equal: ZF=1, r/m32←reg32; else ZF=0,
+            // EAX←r/m32. Flags set per alu_sub (CF/OF/AF/SF/ZF/PF). Intel SDM
+            // Vol.2 CMPXCHG. Plain lock-free CRT init primitive — no protection.
+            case I386_OP_CMPXCHG_RM_R: {
+                int reg = (insn.modrm >> 3) & 7;   // the "new value" source register
+                i386_halt_t why = I386_HALT_UNSUPPORTED;
+                uint32_t rm_v;
+                if (!rm_get32(cpu, img, &insn, &rm_v, &why)) {
+                    res->halt = why; res->halt_va = eip; res->halt_op = insn.op; return;
+                }
+                uint32_t eax_v = cpu->gpr[I386_REG_EAX];
+                (void)alu_sub(&cpu->eflags, eax_v, rm_v, 0); // flags per SDM CMP
+                if (eax_v == rm_v) {
+                    // ZF already set to 1 by alu_sub (result==0); write reg into r/m
+                    if (!rm_set32(cpu, img, &insn, cpu->gpr[reg], &why)) {
+                        res->halt = why; res->halt_va = eip; res->halt_op = insn.op; return;
+                    }
+                } else {
+                    // ZF already 0; EAX ← r/m32
+                    cpu->gpr[I386_REG_EAX] = rm_v;
+                }
+                break;
+            }
+            // ── CMPXCHG r/m8,r8 (E5 r9) — 0F B0 /r ──────────────────────────────
+            // Compare AL with r/m8; if equal: ZF=1, r/m8←reg8; else ZF=0, AL←r/m8.
+            // Flags set per 8-bit alu_sub semantics. Intel SDM Vol.2 CMPXCHG.
+            case I386_OP_CMPXCHG_RM8_R8: {
+                int reg = (insn.modrm >> 3) & 7;   // 8-bit "new value" source reg
+                i386_halt_t why = I386_HALT_UNSUPPORTED;
+                uint8_t rm_v8;
+                if (!rm_get8(cpu, img, &insn, &rm_v8, &why)) {
+                    res->halt = why; res->halt_va = eip; res->halt_op = insn.op; return;
+                }
+                uint8_t al = (uint8_t)(cpu->gpr[I386_REG_EAX] & 0xFFu);
+                // Compute 8-bit flags via 32-bit alu_sub (zero-extended operands),
+                // then fixup SF and PF for the 8-bit result width.
+                (void)alu_sub(&cpu->eflags, (uint32_t)al, (uint32_t)rm_v8, 0);
+                uint8_t r8 = (uint8_t)(al - rm_v8);
+                set_flag(&cpu->eflags, EFL_SF, (int)((r8 >> 7) & 1u)); // 8-bit sign
+                { int ones8 = 0;
+                  uint8_t pr = r8;
+                  for (int ii = 0; ii < 8; ii++) ones8 += (pr >> ii) & 1;
+                  set_flag(&cpu->eflags, EFL_PF, (ones8 & 1) == 0); }
+                if (al == rm_v8) {
+                    // Get reg8 value (same byte-reg map as rm_get8)
+                    uint8_t reg_v8;
+                    if (reg < 4) reg_v8 = (uint8_t)(cpu->gpr[reg] & 0xFFu);
+                    else         reg_v8 = (uint8_t)((cpu->gpr[reg - 4] >> 8) & 0xFFu);
+                    if (!rm_set8(cpu, img, &insn, reg_v8, &why)) {
+                        res->halt = why; res->halt_va = eip; res->halt_op = insn.op; return;
+                    }
+                } else {
+                    // AL ← r/m8
+                    cpu->gpr[I386_REG_EAX] = (cpu->gpr[I386_REG_EAX] & 0xFFFFFF00u)
+                                            | (uint32_t)rm_v8;
+                }
+                break;
+            }
             // ── E4 kernel32 boundary — indirect IAT call / jump ───────────
             case I386_OP_CALL_RM:               // FF /2 [..]
             case I386_OP_JMP_RM: {              // FF /4 [..]
@@ -790,12 +874,15 @@ void i386_cpu_run(i386_cpu_t *cpu, const i386_image_t *img,
                 }
                 uint32_t slot_va = (uint32_t)insn.disp;
                 const i386_import_t *imp = i386_iat_lookup(cpu->iat, slot_va);
-                if (!imp) {
-                    // Slot is an IAT thunk but no binding is registered — the
-                    // next kernel32 import to implement. own1: we never invent
-                    // the function; we stop and name the slot.
+                if (!imp || !imp->fn) {
+                    // Slot is an IAT thunk but no binding is registered (imp==NULL),
+                    // OR the import was found by name but has no shim (fn==NULL from
+                    // autobind for an unknown import). own1: we never invent the
+                    // function; we stop honestly and record the slot + name if known.
                     res->halt = I386_HALT_UNBOUND_IMPORT; res->halt_va = eip;
-                    res->halt_op = insn.op; res->import_slot = slot_va; return;
+                    res->halt_op = insn.op; res->import_slot = slot_va;
+                    if (imp && imp->name) res->last_import = imp->name; // name from autobind
+                    return;
                 }
                 // BIND: dispatch to the native shim, place the result in EAX
                 // (Win32 ABI), pop stdcall callee-popped args, and continue.
@@ -875,6 +962,102 @@ int i386_cpu_load_pe(const char *path, i386_image_t *out, uint32_t *entry_va) {
     return 0;
 }
 
+// ── IAT name-based autobind (E5 r9) ─────────────────────────────────────────
+// Walk the PE Import Directory in `img` at RVA `import_dir_rva` and match
+// each import name against the name-keyed registry. Writes entries to
+// bound_out[]; fn==NULL entries mark unresolved names (honest: the run loop
+// halts UNBOUND_IMPORT + records last_import=name for those). Returns total
+// imports seen; *bound_count_out = resolved (fn!=NULL); *unbound_count_out =
+// unresolved (fn==NULL). own1: standard PE import resolution over OUR sections
+// — binding our OWN imports to native impls is LOADING, not a bypass. No Wine.
+static const char *img_cstr(const i386_image_t *img, uint32_t va) {
+    // Return a pointer to a C string in the flat image at `va`, or NULL if OOB.
+    if (va < img->base || va >= img->base + img->size) return NULL;
+    return (const char *)(img->host + (va - img->base));
+}
+
+int i386_iat_autobind(
+    const struct i386_image *img,
+    uint32_t                 import_dir_rva,
+    const i386_shim_entry_t *registry,
+    uint32_t                 reg_count,
+    i386_import_t           *bound_out,
+    uint32_t                 max_bound,
+    uint32_t                *bound_count_out,
+    uint32_t                *unbound_count_out)
+{
+    uint32_t n_total = 0, n_bound = 0, n_unbound = 0;
+    if (!img || !img->host || import_dir_rva == 0) {
+        if (bound_count_out)   *bound_count_out   = 0;
+        if (unbound_count_out) *unbound_count_out = 0;
+        return 0;
+    }
+    uint32_t base     = img->base;
+    uint32_t desc_va  = base + import_dir_rva;
+
+    // Walk IMAGE_IMPORT_DESCRIPTOR array (20 bytes each, null-terminated).
+    for (;;) {
+        uint32_t orig_first_thunk, unused1, unused2, name_rva, first_thunk;
+        if (!i386_mem_read32(img, desc_va + 0,  &orig_first_thunk)) break;
+        if (!i386_mem_read32(img, desc_va + 4,  &unused1))          break;
+        if (!i386_mem_read32(img, desc_va + 8,  &unused2))          break;
+        if (!i386_mem_read32(img, desc_va + 12, &name_rva))         break;
+        if (!i386_mem_read32(img, desc_va + 16, &first_thunk))      break;
+        (void)unused1; (void)unused2;
+        // Null terminator: all-zero descriptor (valid entry always has name+thunk).
+        if (orig_first_thunk == 0 && name_rva == 0 && first_thunk == 0) break;
+
+        // Use OriginalFirstThunk (INT) when present, else FirstThunk (IAT).
+        // Both hold RVAs to IMAGE_IMPORT_BY_NAME pre-binding.
+        uint32_t int_va = base + (orig_first_thunk ? orig_first_thunk : first_thunk);
+        uint32_t iat_va = base + first_thunk;
+
+        // Walk INT in lockstep with IAT slots (4 bytes per entry for PE32).
+        for (uint32_t si = 0; ; si++) {
+            uint32_t int_entry;
+            if (!i386_mem_read32(img, int_va + si * 4, &int_entry)) break;
+            if (int_entry == 0) break; // null terminator
+
+            uint32_t slot_va = iat_va + si * 4;
+            const i386_shim_entry_t *found = NULL;
+            const char *imp_name = NULL;
+
+            if (int_entry & 0x80000000u) {
+                // Ordinal import (bit31=1) — not shimmed by name.
+                imp_name = "(ordinal)";
+            } else {
+                // Named import: IMAGE_IMPORT_BY_NAME at base+int_entry.
+                // Skip 2-byte Hint; name follows immediately.
+                uint32_t ibn_va = base + int_entry;
+                imp_name = img_cstr(img, ibn_va + 2);
+                if (imp_name) {
+                    for (uint32_t r = 0; r < reg_count; r++) {
+                        if (strcmp(imp_name, registry[r].name) == 0) {
+                            found = &registry[r];
+                            break;
+                        }
+                    }
+                }
+            }
+
+            if (n_total < max_bound) {
+                bound_out[n_total].slot_va   = slot_va;
+                bound_out[n_total].name      = found ? found->name
+                                             : (imp_name ? imp_name : "?");
+                bound_out[n_total].fn        = found ? found->fn  : NULL;
+                bound_out[n_total].arg_bytes = found ? found->arg_bytes : 0;
+            }
+            n_total++;
+            if (found) n_bound++;
+            else       n_unbound++;
+        }
+        desc_va += 20; // next descriptor
+    }
+    if (bound_count_out)   *bound_count_out   = n_bound;
+    if (unbound_count_out) *unbound_count_out = n_unbound;
+    return (int)n_total;
+}
+
 void i386_image_free(i386_image_t *img) {
     if (img && img->owns && img->host) {
         free(img->host);

native/i386_cpu.h

@@ -183,6 +183,38 @@ uint32_t i386_shim_SetUnhandledExceptionFilter(i386_cpu_t *cpu, const struct i38
 // the slot is not bound (→ the caller halts UNBOUND_IMPORT honestly).
 const i386_import_t *i386_iat_lookup(const i386_iat_t *iat, uint32_t slot_va);
 
+// ── E5 r9 — IAT name-based autobind ─────────────────────────────────────────
+// A name-keyed shim registry entry for i386_iat_autobind (r9). Matches
+// imported symbols by name (not by synthetic slot VA), so a real i386 PE's
+// IAT gets bound to native shims without hardcoded VAs.
+// own1: binding our OWN PE's imports to native impls is LOADING (what every
+// PE loader does), not a protection bypass. No Wine, no DRM.
+typedef struct {
+    const char         *name;       // imported symbol name (e.g. "GetCurrentThreadId")
+    i386_import_stub_fn fn;         // native shim
+    uint32_t            arg_bytes;  // stdcall callee-pop bytes (0 for 0-arg)
+} i386_shim_entry_t;
+
+// Walk the PE Import Directory in `img` at RVA `import_dir_rva`. For each
+// named import, look it up by name in `registry[0..reg_count)`. Write the
+// result into `bound_out[0..max_bound)`:
+//   fn != NULL → shim found (own import resolved)
+//   fn == NULL → name not in registry (honest; run loop halts UNBOUND_IMPORT
+//                and records last_import=name so the caller knows what's missing)
+// Ordinal imports (bit31=1 in the INT entry) produce fn=NULL entries with
+// name="(ordinal)". Returns total imports seen; *bound_count_out = resolved
+// count (fn!=NULL); *unbound_count_out = unresolved count (fn==NULL).
+// own1: standard PE import resolution over our OWN sections. No Wine.
+int i386_iat_autobind(
+    const struct i386_image *img,        // fwd — full def below; use struct ptr
+    uint32_t                 import_dir_rva,
+    const i386_shim_entry_t *registry,
+    uint32_t                 reg_count,
+    i386_import_t           *bound_out,
+    uint32_t                 max_bound,
+    uint32_t                *bound_count_out,
+    uint32_t                *unbound_count_out);
+
 // Flat memory image: a single contiguous host buffer covering the VA
 // window [base, base+size). VA→host is host + (va - base). Simple and
 // low-risk; the PE loader fills it section-by-section (see