funman300
40 lines
1.6 KiB
Python
40 lines
1.6 KiB
Python
"""DIMENSION 3 SEASONS q5.
|
|
Q: is the GET /season (SEASONLIST) request reachable, and from where? Descriptor
|
|
row 69 handler is FUN_180124710. Get its callers and decompile it. Also decompile
|
|
the +0x7138 struct writer FUN_18011c2e0 and FUN_18011a830-area accessor to locate
|
|
the writer of the count short at +0x7138+0x96/+0x98. And decompile the three vtable
|
|
getter stubs (0x18011c150/+0x588, 0x18011b8a0/+0x898) via dec() on the address.
|
|
CONTROL: callers() proven working in q1 (returned [] for table-dispatched fns and
|
|
non-[] is expected for a normally-called fn); FUN_18011dc50 is a known
|
|
table/virtual-dispatched writer, use its caller set shape as sanity.
|
|
"""
|
|
import traceback
|
|
try:
|
|
for name, a in [
|
|
("FUN_180124710 SEASONLIST handler", 0x180124710),
|
|
("FUN_18011c2e0 (+0x7138 accessor)", 0x18011c2e0),
|
|
]:
|
|
print("=" * 60, name, hex(a))
|
|
print("callers:", callers(a))
|
|
d = dec(a); print("LEN", len(d)); print(d)
|
|
|
|
print("=" * 60, "getter stub +0x588 @0x18011c150")
|
|
print(dec(0x18011c150))
|
|
print("=" * 60, "getter stub +0x898 @0x18011b8a0")
|
|
print(dec(0x18011b8a0))
|
|
print("=" * 60, "accessor @0x18011a822 area (fn 0x18011a830?)")
|
|
print("fname 0x18011a822 ->", fname(0x18011a822))
|
|
print(dec(0x18011a822)[:1200])
|
|
|
|
# who calls the SeasonList RESPONSE deser's install? find xrefs to 0x180124710
|
|
print("=" * 60, "xrefs_to FUN_180124710")
|
|
for x in xrefs_to(0x180124710):
|
|
print(" ", hex(x[0]), x[1], x[2], hex(x[3]))
|
|
|
|
sys.stdout.flush()
|
|
os._exit(0)
|
|
except Exception:
|
|
traceback.print_exc()
|
|
sys.stdout.flush()
|
|
os._exit(0)
|