# offderiv — empirical validation results

Measured against the 15 shipped etaHEN offset tables
(`Source Code/bootstrapper/Byepervisor/include/offsets/*.h`), 13 symbols each.

## 1. Can one firmware's table be derived from another's? No.

Hold-one-out, nearest neighbour by firmware version: **exact table match 0/15**
(1_00<-1_01: 3 wrong; 1_05<-1_02: 10 wrong; 2_00<-2_20: 6 wrong; 2_50<-2_30: 6 wrong).

Copying a table from any other firmware never reproduces the target exactly.
Cross-firmware offset reuse is a dead shortcut: kernel-region bases are stable
per family, but patched/sysent offsets are build-specific.

## 2. What IS predictable: 7 exact invariants + 2 constants

Hold with zero exceptions across all 15 shipped tables:

    KERNEL_SYM_DMPML4I    == KERNEL_SYM_DMPDPI    - 4
    KERNEL_SYM_DMPML4I    == KERNEL_SYM_PML4PML4I + 676
    KERNEL_SYM_DMPML4I    == KERNEL_SYM_PMAP_STORE + 648
    KERNEL_SYM_DMPDPI     == KERNEL_SYM_PML4PML4I + 680
    KERNEL_SYM_DMPDPI     == KERNEL_SYM_PMAP_STORE + 652
    KERNEL_SYM_PML4PML4I  == KERNEL_SYM_PMAP_STORE - 28
    KERNEL_PATCH_HAS_MMAP_SELF_CAPABILITY == KERNEL_PATCH_IS_ALLOWED_TO_MMAP_SELF - 16
    KERNEL_SYM_CODE_CAVE          == 278528   (every firmware)
    KERNEL_SYM_GADGET_JMP_PTR_RSI == 270336   (every firmware)

## 3. Symbol predictability classes (over 15 tables)

| class | symbols | distinct values |
|---|---|---|
| INVARIANT | CODE_CAVE, GADGET_JMP_PTR_RSI | 1 |
| LINKED PAIR | HAS_MMAP_SELF_CAPABILITY ↔ IS_ALLOWED_TO_MMAP_SELF | 13, always 16 apart |
| FAMILY-CLUSTERED | DMPML4I, DMPDPI, PML4PML4I, PMAP_STORE, DATA_CAVE | 2-3 |
| BUILD-SPECIFIC | PS4_SYSENT, PPR_SYSENT, SYS_GETGID, MMAP_SELF_CALL_IS_LOADABLE | 6-15 |

## 4. The validator (`validate_offsets.py`)

    $ ./validate_offsets.py                 # all shipped tables
    15/15 tables passed all invariants          (exit 0)

    $ ./validate_offsets.py corrupted.h         # DMPML4I shifted by 0x20
    [FAIL] 1_00_corrupt.h  (9 invariant checks)
      VIOLATION KERNEL_SYM_DMPML4I=0x4adf560 != KERNEL_SYM_DMPDPI=0x4adf544 + -4
      VIOLATION KERNEL_SYM_DMPML4I=0x4adf560 != KERNEL_SYM_PML4PML4I=0x4adf29c + 676
      VIOLATION KERNEL_SYM_DMPML4I=0x4adf560 != KERNEL_SYM_PMAP_STORE=0x4adf2b8 + 648
    0/15 tables passed                              (exit 1)

One wrong symbol trips 3 of the 9 checks. A candidate table that passes is
internally consistent with every table etaHEN has ever shipped; one that fails
is provably wrong before it boots on anyone's console.