funman300
38 lines
1.5 KiB
Python
38 lines
1.5 KiB
Python
"""DIMENSION 1 Q1: enumerate the userInfo.feature restriction vocabulary IN FULL.
|
|
|
|
Hypothesis: FUN_18013ec10 (userInfo deser) handles atom 0x11c (feature) by entering a
|
|
nested object-parse loop that dispatches sub-keys (trade=0x330 known) each writing a byte
|
|
into the userInfo record. Enumerate EVERY sub-key and the offset each writes.
|
|
|
|
CONTROL: the known trade atom 0x330 MUST appear and map to +0x17c. If it does not, the
|
|
dispatch form assumed is wrong and the enumeration below is unreliable.
|
|
|
|
Method: print full decompile length + full text of FUN_18013ec10, then scan for the
|
|
feature atom 0x11c and identify the nested parser (a callee entered at that case), then
|
|
decompile that callee in full too.
|
|
"""
|
|
import re, traceback
|
|
|
|
UI_DESER = 0x18013ec10
|
|
|
|
try:
|
|
f = func(UI_DESER)
|
|
src = dec(UI_DESER, 300)
|
|
print("=== FUN_%08x body=%d insns decompile=%d chars ===" %
|
|
(UI_DESER, f.getBody().getNumAddresses() if f else -1, len(src)))
|
|
print(src)
|
|
|
|
print("\n=== callees of FUN_%08x ===" % UI_DESER)
|
|
for a, n in callees(UI_DESER):
|
|
print(" %#x %s" % (a, n))
|
|
|
|
# where does 0x11c (feature) / 0x330 (trade) appear textually?
|
|
print("\n=== atom mentions in the decompile ===")
|
|
for atom, name in ((0x11c, "feature"), (0x330, "trade"), (0x17c, "off+0x17c"),
|
|
(0x50, "off+0x50")):
|
|
for ln in src.splitlines():
|
|
if ("0x%x" % atom) in ln.replace("0X", "0x"):
|
|
print(" [%-10s] %s" % (name, ln.strip()))
|
|
except Exception:
|
|
traceback.print_exc()
|