lr --[ paciasp ]--> signed lr --[ autiasp ]--> lr
                    \_______________________/
                           packwatch
        ------------------------------------------------
             aarch64 pointer authentication inspection

what
----
packwatch scans linux aarch64 executables and shared objects for pointer
authentication instructions. it reports return signing, authenticated
indirect control flow, and unusual signing/authentication combinations.

why
---
compiler flags describe a build policy, while elf properties describe
declared features. packwatch checks the instruction words in executable
load segments and reports that evidence separately from the property bits.

notes
-----
pointer authentication derives a code from a pointer, a secret key, and a
modifier. ia/ib are instruction-address keys; da/db are data-address keys.
paciasp signs x30, the link register, with ia and the current stack pointer.
autiasp authenticates it with the same inputs after the stack is restored.
pacibsp/autibsp use ib, while retaa and retab combine authentication with
return. braa/brab authenticate indirect branches; blraa/blrab also set lr.
the decoder includes their zero-modifier forms and pointer stripping.

gnu aarch64 feature notes carry separate bti and pac bits. a set bit does
not establish that every function uses the feature. ordinary br and blr
counts describe the instructions present, without assigning a security
rating to them.

internals
---------
the elf loader bounds-checks headers, segments, sections, notes, and symbol
tables before scanning executable pt_load ranges. section headers are
optional. when available, allocated data sections and $x/$d mapping symbols
keep known data out of the instruction scan.

function discovery combines stt_func symbols, the entry point, and direct
bl targets. aliases share one address; zero-sized symbols and candidates
receive ranges ending at the next known start or the segment boundary.
the first eight instructions, up to a branch, form the prologue window.
authentication immediately before ret and combined authenticated returns
provide the matching return evidence.

the percentages apply to discovered functions. stripped files can lose
function boundaries and code/data markers, so data may resemble code and
some functions remain undiscovered. these pattern checks do not prove
coverage of every control-flow path. unusual or inconsistent sequences
describe observations, not exploitability.

process mode reads file-backed executable mappings through process_vm_readv,
with a read-only proc mem fallback for mappings such as execute-only pages.
backing-file identity and pt_load offsets determine load bias; reports keep
elf addresses, file offsets, and runtime addresses separate. access follows
kernel permissions, and the snapshot can race with changes in the target.

references
----------
    https://developer.arm.com/documentation/ddi0602/latest/
    https://github.com/ARM-software/abi-aa