DragonHD
39 lines
1.3 KiB
Python
39 lines
1.3 KiB
Python
import struct
|
|
from capstone import *
|
|
from capstone.x86 import X86_OP_MEM, X86_REG_RIP
|
|
|
|
exe = r"F:\steam\steamapps\common\The I of the Dragon\TheIOfTheDragon.exe"
|
|
data = open(exe, "rb").read()
|
|
e = struct.unpack_from("<I", data, 0x3C)[0]
|
|
coff = e + 4
|
|
nsec = struct.unpack_from("<H", data, coff + 2)[0]
|
|
optsize = struct.unpack_from("<H", data, coff + 16)[0]
|
|
opt = coff + 20
|
|
imagebase = struct.unpack_from("<I", data, opt + 28)[0]
|
|
so = opt + optsize
|
|
secs = []
|
|
for i in range(nsec):
|
|
o = so + i * 40
|
|
nm = data[o:o+8].rstrip(b"\x00").decode("latin1")
|
|
vs, va, rs, rp = struct.unpack_from("<IIII", data, o + 8)
|
|
secs.append((nm, va, vs, rp, rs))
|
|
|
|
text = next(s for s in secs if s[0] == ".text")
|
|
name, tva, tvs, trp, trs = text
|
|
code = data[trp:trp+trs]
|
|
md = Cs(CS_ARCH_X86, CS_MODE_32)
|
|
md.detail = True
|
|
|
|
targets = {0x1c: "glyph[?]", 0x101c: "metrics", 0x181c: "usedflag"}
|
|
hits = {k: [] for k in targets}
|
|
for ins in md.disasm(code, imagebase + tva):
|
|
if ins.mnemonic == "ret" or ins.mnemonic.startswith("j"):
|
|
continue
|
|
for op in ins.operands:
|
|
if op.type == X86_OP_MEM and op.mem.disp in targets:
|
|
hits[op.mem.disp].append((ins.address, ins.mnemonic, ins.op_str))
|
|
for k, v in hits.items():
|
|
print("=== disp 0x%x (%s): %d refs ===" % (k, targets[k], len(v)))
|
|
for a, m, o in v[:40]:
|
|
print(" %08x: %s %s" % (a, m, o))
|