docs: Standardize American spelling and KASLD casing, refreshed samples

Standardize spelling to American (-ize) across the tool's output, comments, and
docs: the banner now reads "Kernel ASLR derandomization", matching the body
("not derandomized"); the kernel only ever emits the American spelling, so
parsers are unaffected. Standardize the project name as KASLD, with `kasld`
reserved for the command.

Rewrite the usage.md intro to lead with purpose (recover a running kernel's
layout via components feeding an inference engine) instead of internal
component mechanics. Regenerate every README/usage output sample from a vanilla
kernel.org x86_64 6.15.6 boot under kernel-default settings — added a
`x86_64-vanilla` build-kernel spec and a `stock` VM profile (unprivileged, no
sysctls weakened or hardened) to make those samples reproducible.

Author: bcoles

CONTRIBUTING.md

@@ -144,7 +144,7 @@ single-source covering** of the region (a whole RAM map: every E820 / device-tre
 extents, so it makes no positional claim: floor rules ignore it (they require
 `pos=base`), and the orchestrator routes it out of the cross-source merge into
 the engine's `coverings[]` so the map stays faithful and per-source. Only emit it
-from a source that reads the **whole** map — a partial map would synthesise false
+from a source that reads the **whole** map — a partial map would synthesize false
 gaps, which `tests/check-extent-callers` guards against.
 
 All helpers return `1` on emit, `0` on rejection (with a stderr
@@ -159,7 +159,7 @@ when you know exactly what's at the address — a kernel symbol
 (`nf_conntrack`), a device (`0000:00:14.0`).
 
 A component that detects KASLR being switched off (or unsupported, or having
-failed to randomise) emits scalar facts via `kasld_emit_scalar()` instead of an
+failed to randomize) emits scalar facts via `kasld_emit_scalar()` instead of an
 address; which facts, and how the engine consumes each, are documented in
 [docs/architecture.md → KASLR runtime states](docs/architecture.md#kaslr-runtime-states).
 
@@ -294,7 +294,7 @@ kasld_result_range(KASLD_TYPE_VIRT, REGION_INITRD,
 
 The `#ifdef` guard compiles the derivation out on arches where the
 direct-map projection is unsound at compile time — x86_64 with
-`CONFIG_RANDOMIZE_MEMORY` (direct-map base randomised), arm64 / riscv64
+`CONFIG_RANDOMIZE_MEMORY` (direct-map base randomized), arm64 / riscv64
 / s390 (text and direct map at independent runtime offsets). On those
 arches the macro is undefined, so forgetting the guard fails to compile
 rather than silently emitting a wrong observation. See
@@ -441,7 +441,7 @@ directly via the constants in `kasld/api.h`'s include chain):
 | `KERNEL_VIRT_TEXT_DEFAULT` | Default (non-randomized) kernel text base |
 | `KERNEL_VIRT_VAS_START`, `KERNEL_VIRT_VAS_END` | Kernel virtual address space bounds |
 | `KERNEL_VIRT_TEXT_MIN`, `KERNEL_VIRT_TEXT_MAX` | Plausible kernel text range (validation) |
-| `KASLR_VIRT_TEXT_MIN`, `KASLR_VIRT_TEXT_MAX` | KASLR randomisation window (slot counting) |
+| `KASLR_VIRT_TEXT_MIN`, `KASLR_VIRT_TEXT_MAX` | KASLR randomization window (slot counting) |
 | `KASLR_VIRT_TEXT_MIN_WIDE` | Conservative widened floor (admits non-default Kconfigs) |
 | `PAGE_OFFSET` | Direct-map base (compile-time default) |
 | `PHYS_OFFSET` | Physical RAM base address |

Makefile

@@ -14,7 +14,7 @@ CC = cc
 CFLAGS = -g -O2 -Wall -Wextra -pedantic
 
 # Diagnostics layer. Each flag is probed against $(CC) at make-time via
-# cc-option; flags the compiler doesn't recognise simply drop out instead
+# cc-option; flags the compiler doesn't recognize simply drop out instead
 # of generating per-file noise. This keeps the build portable across:
 #   - older gcc (pre-6 lacks -Wnull-dereference, -Wduplicated-cond,
 #     -Wrestrict; pre-7 lacks -Wduplicated-branches, -Walloca; pre-4.9

README.md

@@ -8,7 +8,7 @@
   <img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License: MIT"/>
 </p>
 
-KASLD derandomises the Linux kernel's virtual and physical memory layout
+KASLD derandomizes the Linux kernel's virtual and physical memory layout
 as an unprivileged local user. It recovers the kernel text base where a
 leak or side channel allows, and otherwise reduces it to the smallest set
 of placements the available evidence supports. On a fully-patched modern
@@ -61,22 +61,22 @@ can temporarily relax these settings (requires root).
 The default text mode prints an answer-first overview:
 
 ```
-KASLD 0.2.0  --  Kernel ASLR derandomisation
-Target: x86_64 / 6.12.38+deb13-amd64
+KASLD 0.2.1-dev  --  Kernel ASLR derandomization
+Target: x86_64 / 6.15.6
 
 Running 83 components (10 experimental skipped; use -x to enable)...
-[####################] 100%  83/83  10.5s
+[####################] 100%  83/83  5.3s
 
-  Virtual text base   0xffffffffa7a00000   slide +0x26a00000
-  Physical text base  not derandomized     ~9 bits
-                      0x0000000001000000 - 0x000000002eedbce0   (367 x 2.0 MiB)
+  Virtual image base  0xffffffff83800000   slide +0x2800000
+  Physical image base not derandomized     ~9 bits
+                      0x0000000001000000 - 0x000000003c20ca00   (473 x 2.0 MiB)
   Direct map base     >= 0xffff800000000000
 
   Coupling            virt and phys text are independent on this arch.
                       A phys leak does NOT reveal the virt text base.
 
 Leaks (1):
-  virt kernel text    0xffffffffa7a00000   (prefetch)
+  virt kernel text    0xffffffff83800000   (prefetch)
 
 [-v: detailed results, memory map, system info]  [-H: hardening assessment]
 ```

docs/architecture.md

@@ -198,7 +198,7 @@ Components communicate results to the orchestrator via tagged lines on stdout:
 | `pos` | `base` / `top` / `interior` / `extent` / `unknown` | What the address keys represent within the region. `base` requires `lo`, `top` requires `hi`, `interior` requires `sample`, `extent` requires both `lo` and `hi`. `unknown` requires at least one of the address keys. |
 | `conf` | `parsed` / `derived` / `inferred` / `heuristic` / `timing` / `brute` | How reliable the source is. Strict trust ordering — see [Confidence](../CONTRIBUTING.md#confidence). |
 | `lo` / `hi` | `0x`-prefixed hex | Inclusive extent bounds. Either may be absent. |
-| `sz` | `0x`-prefixed hex | Mutually exclusive with `hi`. Parser normalises to `hi = lo + sz - 1`. Rejected on overflow or `sz == 0`. |
+| `sz` | `0x`-prefixed hex | Mutually exclusive with `hi`. Parser normalizes to `hi = lo + sz - 1`. Rejected on overflow or `sz == 0`. |
 | `sample` | `0x`-prefixed hex | A representative interior point. |
 | `base_align` | `0x`-prefixed hex, power of two | Declared alignment of the extent base. Optional. |
 
@@ -240,7 +240,7 @@ cannot start there). A covering is therefore:
 
 - **Not corroboratable, never merged.** Two sources' maps must not be mixed: a
   runtime-offlined block is RAM in the boot E820 but a hole in a hotplug view, so
-  unioning would melt a real gap or synthesise a false one. Each map is
+  unioning would melt a real gap or synthesize a false one. Each map is
   independently complete for its own substrate.
 - **Routed out-of-band.** The orchestrator sends `pos=extent` records to a
   dedicated `coverings[]` store on the evidence set, **bypassing the merge**, and
@@ -268,7 +268,7 @@ derived records during the fixpoint loop after collecting all leaked results.
 Components that leak a physical address can convert it to a direct-map virtual
 address using `phys_to_directmap_virt(p)`, guarded by
 `#ifdef phys_to_directmap_virt` so the derivation is compiled out on arches where
-the projection is unsound (x86_64 `CONFIG_RANDOMIZE_MEMORY` randomises the
+the projection is unsound (x86_64 `CONFIG_RANDOMIZE_MEMORY` randomizes the
 direct-map base; arm64 / riscv64 / s390 keep text and direct map at independent
 runtime offsets). The component emits two records — one `PHYS`, one `VIRT` — both
 with the same `(region, name)`. The merge pass keeps them as separate records
@@ -308,12 +308,12 @@ Key rules for cross-region derivation:
   how a runtime vmsplit propagates on coupled architectures.
 - **`directmap_kaslr_disabled_pin`** (x86_64) — when `CONFIG_KASAN=y`
   (`SF_KASAN_ENABLED`) or KASLR is off (`SF_VIRT_KASLR_DISABLED`) the direct-map
-  randomisation is suppressed (`kaslr_memory_enabled() = kaslr_enabled() &&
+  randomization is suppressed (`kaslr_memory_enabled() = kaslr_enabled() &&
   !CONFIG_KASAN`), so `Q_PAGE_OFFSET` / `Q_VMALLOC_BASE` / `Q_VMEMMAP_BASE` are
   pinned to their compile-time L4/L5 defaults — the paging level from
   `SF_VIRT_ADDR_BITS` (cpuinfo, leak-free) or, when that is unavailable, a
   resolved `Q_VA_BITS` (e.g. from a direct-map leak). Kernel TEXT KASLR is
-  independent and stays randomised.
+  independent and stays randomized.
 
 ### Coupled vs decoupled architectures
 
@@ -329,7 +329,7 @@ compile-time `PAGE_OFFSET`, `PHYS_OFFSET`, and `TEXT_OFFSET` constants (with
 default).
 
 On **decoupled** architectures (x86_64, arm64, riscv64, s390), physical and
-virtual KASLR are randomised independently, so physical results cannot derive
+virtual KASLR are randomized independently, so physical results cannot derive
 virtual text directly. The summary prints a note when physical results exist that
 would have been derivable on a coupled system.
 
@@ -348,8 +348,8 @@ they have different implications for the inference engine:
 | State | Scalar fact(s) | Kernel position | Engine action |
 |---|---|---|---|
 | **Disabled** (user/build opt-out) | `SF_VIRT_KASLR_DISABLED` + `SF_PHYS_KASLR_DISABLED` | Compile-time default on each axis | `virt_kaslr_disabled_pin` pins `Q_VIRT_IMAGE_BASE` on arches that set `KASLR_DISABLED_PINS_VIRT_TEXT`; `phys_kaslr_disabled_pin` pins `Q_PHYS_IMAGE_BASE` on arches that set `KASLR_DISABLED_PINS_PHYS`; on x86_64 `directmap_kaslr_disabled_pin` also pins the direct-map bases |
-| **Direct map unrandomised** (x86_64 `CONFIG_KASAN`) | `SF_KASAN_ENABLED` | TEXT still randomised; `page_offset` / `vmalloc` / `vmemmap` at their L4/L5 defaults | `directmap_kaslr_disabled_pin` pins the three direct-map quantities — `kaslr_memory_enabled() = kaslr_enabled() && !CONFIG_KASAN`, so KASAN suppresses `RANDOMIZE_MEMORY` even when it is configured |
-| **Unsupported** (arch never had KASLR) | both `SF_*_KASLR_DISABLED` synthesised with origin `arch-no-kaslr` | Bootloader-determined | Inert for inference (these arches set neither pin flag); lights the renderer's "KASLR not supported" banner |
+| **Direct map unrandomized** (x86_64 `CONFIG_KASAN`) | `SF_KASAN_ENABLED` | TEXT still randomized; `page_offset` / `vmalloc` / `vmemmap` at their L4/L5 defaults | `directmap_kaslr_disabled_pin` pins the three direct-map quantities — `kaslr_memory_enabled() = kaslr_enabled() && !CONFIG_KASAN`, so KASAN suppresses `RANDOMIZE_MEMORY` even when it is configured |
+| **Unsupported** (arch never had KASLR) | both `SF_*_KASLR_DISABLED` synthesized with origin `arch-no-kaslr` | Bootloader-determined | Inert for inference (these arches set neither pin flag); lights the renderer's "KASLR not supported" banner |
 | **Randomization failed** (boot stub tried, no entropy) | `SF_VIRT_KASLR_RANDOMIZATION_FAILED` + `SF_PHYS_KASLR_RANDOMIZATION_FAILED` | Firmware-/boot-stub-deterministic, NOT the link-time default | Does not pin. Drives the hardening-report entropy downgrade, `efi_loader_kernel_pick` lowest-survivor disambiguation, and the `s390_text_no_random` upper bound |
 
 **Disabled.** KASLD treats the virtual and physical disable signals as
@@ -367,7 +367,7 @@ riscv64, loongarch64, s390), gated by a window-containment soundness check;
 that set `KASLR_DISABLED_PINS_PHYS` (currently x86_64 and loongarch64).
 
 **Unsupported.** "KASLR not supported" (compile-time `KASLR_SUPPORTED=0` — arm32,
-ppc64, riscv32, sparc) is synthesised by the orchestrator as both facts with
+ppc64, riscv32, sparc) is synthesized by the orchestrator as both facts with
 origin `arch-no-kaslr`, inert for inference, but lights the renderer's "KASLR not
 supported" banner.
 

docs/bypass-techniques.md

@@ -394,7 +394,7 @@ On architectures with tight entropy budgets — x86_64 and x86_32 (~500 slots,
 effective slot count by 3–8%. On arm64 (~33M slots) and s390 (~131K slots) the
 reduction is negligible.
 
-Weaknesses in randomisation can decrease entropy, further limiting the possible kernel
+Weaknesses in randomization can decrease entropy, further limiting the possible kernel
 locations in memory and making the kernel easier to locate.
 
 ### Randomization failure at boot

docs/diagrams/address-space-map.svg

@@ -98,7 +98,7 @@ ffffffff82276cb0 T commit_creds
 ### Inverse — known symbol → base
 
 Given any one known runtime symbol address (e.g. via a UAF read,
-infoleak, or side channel that returned a recognisable pointer),
+infoleak, or side channel that returned a recognizable pointer),
 derive the runtime text base. Useful when the leak points at a
 specific symbol rather than at `_text` itself.