funman300
41 lines
1.3 KiB
Python
41 lines
1.3 KiB
Python
"""DIMENSION 2 Q1/Q2: the publisher, the applier, the settings deser, the ctor.
|
|
|
|
HYPOTHESIS: FUN_18006cc60 publishes IS_* names by reading model vtable slots; the
|
|
complete set is 10 names over a contiguous .rdata run 0x1801fc118..0x1801fc228.
|
|
FUN_18011dc50 is the applier (byte = field==1). FUN_18013c6d0 is the settings deser
|
|
that maps atoms -> struct fields. FUN_18014e320 is the settings-struct ctor.
|
|
|
|
CONTROL: FUN_18006cc60 must reference IS_TRADING_ENABLED and call the vt+0x270
|
|
accessor already proven (reads 0x1fd2e). If the decompile of the applier shows
|
|
`cmp [reg+0x28],1 / sete / mov [rdi+0x1fd2e]` we have the known trading writer as a
|
|
positive control that the field-index arithmetic is right.
|
|
"""
|
|
import traceback
|
|
try:
|
|
PUB = 0x18006cc60
|
|
APP = 0x18011dc50
|
|
DESER = 0x18013c6d0
|
|
CTOR = 0x18014e320
|
|
|
|
print("=" * 70)
|
|
print("PUBLISHER FUN_18006cc60 (len / decompile)")
|
|
print("=" * 70)
|
|
d = dec(PUB)
|
|
print("len:", len(d))
|
|
print(d)
|
|
|
|
print("=" * 70)
|
|
print(".rdata name run 0x1801fc118..0x1801fc250 (contiguous IS_* names)")
|
|
print("=" * 70)
|
|
p = 0x1801fc118
|
|
end = 0x1801fc260
|
|
while p < end:
|
|
s = rd_str(p)
|
|
if s:
|
|
print("%#x %r" % (p, s))
|
|
p += len(s) + 1
|
|
else:
|
|
p += 1
|
|
except Exception:
|
|
traceback.print_exc()
|