"""DIMENSION 1 Q1/Q4 airtight check: is trade (0x330) or feature (0x11c) dispatched ANYWHERE other than the userInfo deser FUN_18013ec10? If a second function compares against 0x330 or 0x11c, there could be another feature-style restriction map. Enumerate ALL comparison FORMS by scanning instruction operands for the immediates 0x330 and 0x11c across .text, and report the containing function of each. CONTROL: FUN_18013ec10 (0x18013ec10) MUST appear for both 0x330 and 0x11c (the known site). If it does not, the operand-immediate scan is broken and results are unreliable. """ import traceback TARGETS = {0x330: "trade", 0x11c: "feature"} KNOWN = 0x18013ec10 try: # scan every instruction in .text for a scalar operand equal to a target immediate hits = {t: set() for t in TARGETS} text = None for b in mem.getBlocks(): if b.getName() == ".text" and b.isInitialized(): text = b break ins = listing.getInstructions(text.getStart(), True) count = 0 while ins.hasNext(): i = ins.next() count += 1 n = i.getNumOperands() for op in range(n): objs = i.getOpObjects(op) for o in objs: try: v = o.getValue() if hasattr(o, "getValue") else None except Exception: v = None if v is None: continue v = int(v) & 0xFFFFFFFF if v in TARGETS: f = fm.getFunctionContaining(i.getAddress()) hits[v].add((f.getName() if f else "?", int(f.getEntryPoint().getOffset()) if f else 0)) print("scanned %d .text instructions" % count) for t, name in TARGETS.items(): print("\n=== immediate 0x%x (%s) appears in these functions ===" % (t, name)) got_known = False for fn, ent in sorted(hits[t], key=lambda x: x[1]): mark = " <== KNOWN userInfo deser" if ent == KNOWN else "" print(" %#x %s%s" % (ent, fn, mark)) if ent == KNOWN: got_known = True print(" CONTROL FUN_18013ec10 present: %s" % got_known) except Exception: traceback.print_exc()