"""DIMENSION 3 SEASONS q6. Decode the non-function targets by raw bytes; find who consumes the +0x898 season vector getter; find who ISSUES the SEASONLIST RPC (xrefs to descriptor row and the RPC dispatch); find the writer of the +0x7138+0x96/+0x98 count short. """ import traceback, struct try: def show(a, n, label): b = read_bytes(a, n) print(label, hex(a), b.hex()) print("### decode getter/handler stubs ###") show(0x18011b8a0, 12, "+0x898 getter") # expect lea rax,[rcx+0x5c68];ret show(0x18011c150, 12, "+0x588 getter") # expect lea rax,[rcx+0x7138];ret show(0x180124710, 48, "SEASONLIST handler") # instructions via listing for the handler print("\n### listing FUN_180124710 (SEASONLIST handler) ###") a = addr(0x180124710) for _ in range(24): ins = listing.getInstructionAt(a) if ins is None: print(" (no instr at", a, ")"); break print(" ", a, ins) a = ins.getAddress().add(ins.getLength()) # who references the +0x898 getter stub -> all season-vector consumers print("\n### xrefs_to +0x898 getter stub 0x18011b8a0 ###") for x in xrefs_to(0x18011b8a0): print(" ", hex(x[0]), x[1], x[2], hex(x[3])) # who references the SEASONLIST descriptor row and its neighbours (RPC issue) print("\n### xrefs_to descriptor row region ###") for row in (0x1802cb718, 0x1802cb720, 0x1802cb738): print(" row", hex(row)) for x in xrefs_to(row): print(" ", hex(x[0]), x[1], x[2], hex(x[3])) # xref to the URL-base pointer 0x18021e0d0 (ut/%s/season) -> the URL builder print("\n### xrefs_to url base ptr 0x18021e0d0 and template 0x18021e598 ###") for a2 in (0x18021e0d0, 0x18021e598): for x in xrefs_to(a2): print(" ", hex(a2), "<-", hex(x[0]), x[1], x[2], hex(x[3])) # +0x7138 struct: FUN_1801129f0 (reset?) and who calls FUN_18011c2e0 print("\n### FUN_1801129f0 (season struct op) callers + decomp head ###") print("callers:", callers(0x1801129f0)) print(dec(0x1801129f0)[:900]) print("\n### xrefs_to FUN_18011c2e0 (writes +0x7138 area) ###") for x in xrefs_to(0x18011c2e0): print(" ", hex(x[0]), x[1], x[2], hex(x[3])) sys.stdout.flush() os._exit(0) except Exception: traceback.print_exc() sys.stdout.flush() os._exit(0)