Initial commit: RE tooling and docs for The I of the Dragon localization/HD

2026-09-20 09:57:07 +08:00
commit caf7376019
26 changed files with 1624 additions and 0 deletions
@@ -0,0 +1,38 @@
+import struct
+from capstone import *
+from capstone.x86 import X86_OP_MEM, X86_REG_RIP
+
+exe = r"F:\steam\steamapps\common\The I of the Dragon\TheIOfTheDragon.exe"
+data = open(exe, "rb").read()
+e = struct.unpack_from("<I", data, 0x3C)[0]
+coff = e + 4
+nsec = struct.unpack_from("<H", data, coff + 2)[0]
+optsize = struct.unpack_from("<H", data, coff + 16)[0]
+opt = coff + 20
+imagebase = struct.unpack_from("<I", data, opt + 28)[0]
+so = opt + optsize
+secs = []
+for i in range(nsec):
+    o = so + i * 40
+    nm = data[o:o+8].rstrip(b"\x00").decode("latin1")
+    vs, va, rs, rp = struct.unpack_from("<IIII", data, o + 8)
+    secs.append((nm, va, vs, rp, rs))
+
+text = next(s for s in secs if s[0] == ".text")
+name, tva, tvs, trp, trs = text
+code = data[trp:trp+trs]
+md = Cs(CS_ARCH_X86, CS_MODE_32)
+md.detail = True
+
+targets = {0x1c: "glyph[?]", 0x101c: "metrics", 0x181c: "usedflag"}
+hits = {k: [] for k in targets}
+for ins in md.disasm(code, imagebase + tva):
+    if ins.mnemonic == "ret" or ins.mnemonic.startswith("j"):
+        continue
+    for op in ins.operands:
+        if op.type == X86_OP_MEM and op.mem.disp in targets:
+            hits[op.mem.disp].append((ins.address, ins.mnemonic, ins.op_str))
+for k, v in hits.items():
+    print("=== disp 0x%x (%s): %d refs ===" % (k, targets[k], len(v)))
+    for a, m, o in v[:40]:
+        print("  %08x: %s %s" % (a, m, o))