funman300
2fc335c37d
Two tools, both gated on positive controls because the previous pass produced a confidently wrong negative result. atom_mapper_emu.py interprets the atom -> field-id dispatch functions instead of pattern-scanning them. Its selftest encodes the two decoder traps that caused earlier mistakes - ModRM rm=5 with mod!=0 is [rbp+disp] rather than RIP-relative, and a constant may reach its use through a register - plus the live-verified controls that the item mapper maps atom 568 'players' to field id 1 and atom 11 'actives' to 0. The mandatory manager atom 424 control still fails as a coverage limit: only 2 of the 52 resolver callers are pure dispatch chains, so the tool refuses to support any absence claim about the squad mapper. The live probes enumerate the resident item map at owner+0x160c8, whose layout came from the lower_bound at 0x180119640: key = wire instance id at node+0x20, record at node+0x28, count at owner+0x160e8. probe_map2 reaches 22 nodes against a count field of 22, so the enumeration validates itself, and probe_hunt searches all writable memory with its own in-run positive control. Result: all four club staff are resident, both kit ids are absent everywhere, and a lookup miss returns the static sentinel 0x1802c2a28 whose +0x10 is NULL - which is exactly the KIT_SCAN symptom.
85 lines
2.9 KiB
Python
Executable File
85 lines
2.9 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Hunt for specific wire instance ids anywhere in the client's writable memory.
|
|
|
|
Answers whether a served item was materialised into a record at all, versus
|
|
materialised but not attached to a collection. A record is recognised by its
|
|
established layout: id at +0x08, resourceId at +0x18, cardtype at +0x4c.
|
|
|
|
Read-only. Never writes.
|
|
|
|
usage: probe_hunt.py PID id [id ...]
|
|
"""
|
|
import re, struct, sys
|
|
|
|
PID = int(sys.argv[1])
|
|
IDS = [int(a) for a in sys.argv[2:]]
|
|
if not IDS:
|
|
sys.exit("give at least one wire id")
|
|
mem = open(f"/proc/{PID}/mem", "rb", buffering=0)
|
|
|
|
regions = []
|
|
for ln in open(f"/proc/{PID}/maps"):
|
|
m = re.match(r"([0-9a-f]+)-([0-9a-f]+) (\S{4}) \S+ \S+ \S+\s*(.*)", ln)
|
|
if not m:
|
|
continue
|
|
lo, hi, perms, path = int(m.group(1), 16), int(m.group(2), 16), m.group(3), m.group(4).strip()
|
|
if "w" not in perms:
|
|
continue
|
|
if path.startswith("/") and not path.endswith(".dll") and not path.endswith(".exe"):
|
|
continue
|
|
regions.append((lo, hi, perms, path))
|
|
total = sum(hi - lo for lo, hi, _, _ in regions)
|
|
print(f" {len(regions)} writable regions, {total/2**20:.0f} MiB to scan")
|
|
|
|
needles = {struct.pack("<I", i): i for i in IDS}
|
|
hits = {i: [] for i in IDS}
|
|
CHUNK = 8 << 20
|
|
scanned = 0
|
|
for lo, hi, perms, path in regions:
|
|
a = lo
|
|
while a < hi:
|
|
n = min(CHUNK, hi - a)
|
|
try:
|
|
mem.seek(a)
|
|
data = mem.read(n)
|
|
except OSError:
|
|
a += n
|
|
continue
|
|
if not data:
|
|
a += n
|
|
continue
|
|
scanned += len(data)
|
|
for nd, wid in needles.items():
|
|
start = 0
|
|
while True:
|
|
j = data.find(nd, start)
|
|
if j < 0:
|
|
break
|
|
start = j + 1
|
|
va = a + j
|
|
# a record would place this id at +0x08
|
|
rec = va - 0x08
|
|
try:
|
|
mem.seek(rec)
|
|
r = mem.read(0x100)
|
|
except OSError:
|
|
continue
|
|
if len(r) < 0x100:
|
|
continue
|
|
ct = struct.unpack_from("<i", r, 0x4c)[0]
|
|
res = struct.unpack_from("<I", r, 0x18)[0]
|
|
sub = struct.unpack_from("<i", r, 0x50)[0]
|
|
cat = struct.unpack_from("<i", r, 0x60)[0]
|
|
looks = 0 <= ct <= 32 and res > 1000
|
|
hits[wid].append((va, rec, ct, sub, cat, res, looks))
|
|
a += n
|
|
print(f" scanned {scanned/2**20:.0f} MiB\n")
|
|
for wid in IDS:
|
|
hs = hits[wid]
|
|
recs = [h for h in hs if h[6]]
|
|
print(f" id {wid}: {len(hs)} raw occurrence(s), {len(recs)} record-shaped")
|
|
for va, rec, ct, sub, cat, res, _ in recs[:6]:
|
|
print(f" record {rec:#x}: cardtype={ct} subtype={sub} category={cat} resourceId={res}")
|
|
if not recs:
|
|
print(" NOT MATERIALISED as a record anywhere in writable memory")
|