Initial commit: RE tooling and docs for The I of the Dragon localization/HD

tools/disasm.py

@@ -0,0 +1,46 @@
+import struct, sys
+from capstone import *
+
+exe = r"F:\steam\steamapps\common\The I of the Dragon\TheIOfTheDragon.exe"
+data = open(exe, "rb").read()
+e_lfanew = struct.unpack_from("<I", data, 0x3C)[0]
+coff = e_lfanew + 4
+machine, nsec, tstamp, symptr, nsym, optsize, chars = struct.unpack_from("<HHIIIHH", data, coff)
+opt = coff + 20
+imagebase = struct.unpack_from("<I", data, opt+28)[0]
+sec_off = opt + optsize
+sections = []
+for i in range(nsec):
+    o = sec_off + i*40
+    name = data[o:o+8].rstrip(b"\x00").decode("latin1")
+    vsize, vaddr, rawsize, rawptr = struct.unpack_from("<IIII", data, o+8)
+    sections.append((name, vaddr, vsize, rawptr, rawsize))
+
+def va2off(va):
+    rva = va - imagebase
+    for name, sva, vs, rp, rs in sections:
+        if sva <= rva < sva+max(vs, rs):
+            return rp + (rva-sva)
+    return None
+
+md = Cs(CS_ARCH_X86, CS_MODE_32)
+md.detail = True
+
+def show(fileoff, n=60, before=6):
+    start = fileoff - before
+    # linear disasm from section start is messy; assume instruction boundary is ok-ish
+    code = data[start:start+ n*8]
+    # compute VA
+    rva = None
+    for name, sva, vs, rp, rs in sections:
+        if rp <= start < rp+rs:
+            rva = sva + (start-rp); base = imagebase
+    addr = imagebase + rva
+    print(f"### disasm at file {start:#x} VA {addr:#x}")
+    for ins in md.disasm(code, addr):
+        print(f"  {ins.address:08x}: {ins.mnemonic:8s} {ins.op_str}")
+
+import sys
+args = sys.argv[1:]
+for a in args:
+    show(int(a,16))