funman300
60 lines
2.3 KiB
Python
60 lines
2.3 KiB
Python
"""DIMENSION 3 SEASONS q6.
|
|
Decode the non-function targets by raw bytes; find who consumes the +0x898 season
|
|
vector getter; find who ISSUES the SEASONLIST RPC (xrefs to descriptor row and the
|
|
RPC dispatch); find the writer of the +0x7138+0x96/+0x98 count short.
|
|
"""
|
|
import traceback, struct
|
|
try:
|
|
def show(a, n, label):
|
|
b = read_bytes(a, n)
|
|
print(label, hex(a), b.hex())
|
|
|
|
print("### decode getter/handler stubs ###")
|
|
show(0x18011b8a0, 12, "+0x898 getter") # expect lea rax,[rcx+0x5c68];ret
|
|
show(0x18011c150, 12, "+0x588 getter") # expect lea rax,[rcx+0x7138];ret
|
|
show(0x180124710, 48, "SEASONLIST handler")
|
|
|
|
# instructions via listing for the handler
|
|
print("\n### listing FUN_180124710 (SEASONLIST handler) ###")
|
|
a = addr(0x180124710)
|
|
for _ in range(24):
|
|
ins = listing.getInstructionAt(a)
|
|
if ins is None:
|
|
print(" (no instr at", a, ")"); break
|
|
print(" ", a, ins)
|
|
a = ins.getAddress().add(ins.getLength())
|
|
|
|
# who references the +0x898 getter stub -> all season-vector consumers
|
|
print("\n### xrefs_to +0x898 getter stub 0x18011b8a0 ###")
|
|
for x in xrefs_to(0x18011b8a0):
|
|
print(" ", hex(x[0]), x[1], x[2], hex(x[3]))
|
|
|
|
# who references the SEASONLIST descriptor row and its neighbours (RPC issue)
|
|
print("\n### xrefs_to descriptor row region ###")
|
|
for row in (0x1802cb718, 0x1802cb720, 0x1802cb738):
|
|
print(" row", hex(row))
|
|
for x in xrefs_to(row):
|
|
print(" ", hex(x[0]), x[1], x[2], hex(x[3]))
|
|
|
|
# xref to the URL-base pointer 0x18021e0d0 (ut/%s/season) -> the URL builder
|
|
print("\n### xrefs_to url base ptr 0x18021e0d0 and template 0x18021e598 ###")
|
|
for a2 in (0x18021e0d0, 0x18021e598):
|
|
for x in xrefs_to(a2):
|
|
print(" ", hex(a2), "<-", hex(x[0]), x[1], x[2], hex(x[3]))
|
|
|
|
# +0x7138 struct: FUN_1801129f0 (reset?) and who calls FUN_18011c2e0
|
|
print("\n### FUN_1801129f0 (season struct op) callers + decomp head ###")
|
|
print("callers:", callers(0x1801129f0))
|
|
print(dec(0x1801129f0)[:900])
|
|
|
|
print("\n### xrefs_to FUN_18011c2e0 (writes +0x7138 area) ###")
|
|
for x in xrefs_to(0x18011c2e0):
|
|
print(" ", hex(x[0]), x[1], x[2], hex(x[3]))
|
|
|
|
sys.stdout.flush()
|
|
os._exit(0)
|
|
except Exception:
|
|
traceback.print_exc()
|
|
sys.stdout.flush()
|
|
os._exit(0)
|