funman300
43 lines
1.7 KiB
Python
43 lines
1.7 KiB
Python
"""DIMENSION 3 SEASONS q2.
|
|
HYPOTHESIS: the season loaders / CompMgr mode setters are dispatched via a table
|
|
(RPC descriptor or vtable) rather than direct CALL, so callers()==[] is a
|
|
search-form artifact, NOT proof of script-layer. Also: the actual refusal is
|
|
count==0 -> fire NOSEASONS in FUN_180057330; establish where the count is read
|
|
and whether a server response could write it.
|
|
CONTROL: search for a KNOWN table-member function address as an 8-byte LE pointer
|
|
to prove find_all-pointer form works: I use FUN_180057560 vs a control that I
|
|
expect to appear in .data (the RPC descriptor). If NEITHER the target nor any
|
|
control pointer is found, the pointer-search form is broken.
|
|
"""
|
|
import traceback, struct
|
|
try:
|
|
def ptr_hits(a):
|
|
le = struct.pack("<Q", a)
|
|
return find_all(le, blocks=(".rdata", ".data", ".pdata"))
|
|
|
|
for name, a in [
|
|
("FUN_180101680 modeA", 0x180101680),
|
|
("FUN_1801016c0 modeB", 0x1801016c0),
|
|
("FUN_180057560 LoadOfflineSeasons", 0x180057560),
|
|
("FUN_1800576b0 LoadSeasons", 0x1800576b0),
|
|
("FUN_180057230 LoadCurOfflineSeason", 0x180057230),
|
|
("FUN_180057330 NOSEASONS", 0x180057330),
|
|
]:
|
|
hits = ptr_hits(a)
|
|
print("PTRHITS", name, hex(a), "->", [hex(h) for h in hits])
|
|
|
|
print("\n############ DECOMPILE FUN_180057330 (NOSEASONS fire) ############")
|
|
d = dec(0x180057330)
|
|
print("LEN", len(d)); print(d)
|
|
|
|
print("\n############ DECOMPILE FUN_180057560 (LoadOfflineSeasons) ############")
|
|
d = dec(0x180057560)
|
|
print("LEN", len(d)); print(d)
|
|
|
|
sys.stdout.flush()
|
|
os._exit(0)
|
|
except Exception:
|
|
traceback.print_exc()
|
|
sys.stdout.flush()
|
|
os._exit(0)
|