funman300
56 lines
2.2 KiB
Python
56 lines
2.2 KiB
Python
"""DIMENSION 1 Q1/Q4 airtight check: is trade (0x330) or feature (0x11c) dispatched
|
|
ANYWHERE other than the userInfo deser FUN_18013ec10?
|
|
|
|
If a second function compares against 0x330 or 0x11c, there could be another feature-style
|
|
restriction map. Enumerate ALL comparison FORMS by scanning instruction operands for the
|
|
immediates 0x330 and 0x11c across .text, and report the containing function of each.
|
|
|
|
CONTROL: FUN_18013ec10 (0x18013ec10) MUST appear for both 0x330 and 0x11c (the known site).
|
|
If it does not, the operand-immediate scan is broken and results are unreliable.
|
|
"""
|
|
import traceback
|
|
|
|
TARGETS = {0x330: "trade", 0x11c: "feature"}
|
|
KNOWN = 0x18013ec10
|
|
|
|
try:
|
|
# scan every instruction in .text for a scalar operand equal to a target immediate
|
|
hits = {t: set() for t in TARGETS}
|
|
text = None
|
|
for b in mem.getBlocks():
|
|
if b.getName() == ".text" and b.isInitialized():
|
|
text = b
|
|
break
|
|
ins = listing.getInstructions(text.getStart(), True)
|
|
count = 0
|
|
while ins.hasNext():
|
|
i = ins.next()
|
|
count += 1
|
|
n = i.getNumOperands()
|
|
for op in range(n):
|
|
objs = i.getOpObjects(op)
|
|
for o in objs:
|
|
try:
|
|
v = o.getValue() if hasattr(o, "getValue") else None
|
|
except Exception:
|
|
v = None
|
|
if v is None:
|
|
continue
|
|
v = int(v) & 0xFFFFFFFF
|
|
if v in TARGETS:
|
|
f = fm.getFunctionContaining(i.getAddress())
|
|
hits[v].add((f.getName() if f else "?",
|
|
int(f.getEntryPoint().getOffset()) if f else 0))
|
|
print("scanned %d .text instructions" % count)
|
|
for t, name in TARGETS.items():
|
|
print("\n=== immediate 0x%x (%s) appears in these functions ===" % (t, name))
|
|
got_known = False
|
|
for fn, ent in sorted(hits[t], key=lambda x: x[1]):
|
|
mark = " <== KNOWN userInfo deser" if ent == KNOWN else ""
|
|
print(" %#x %s%s" % (ent, fn, mark))
|
|
if ent == KNOWN:
|
|
got_known = True
|
|
print(" CONTROL FUN_18013ec10 present: %s" % got_known)
|
|
except Exception:
|
|
traceback.print_exc()
|