DragonHD
45 lines
1.4 KiB
Python
45 lines
1.4 KiB
Python
import struct, sys
|
|
|
|
exe = r"F:\steam\steamapps\common\The I of the Dragon\TheIOfTheDragon.exe"
|
|
data = open(exe, "rb").read()
|
|
e = struct.unpack_from("<I", data, 0x3C)[0]
|
|
coff = e + 4
|
|
nsec = struct.unpack_from("<H", data, coff + 2)[0]
|
|
optsize = struct.unpack_from("<H", data, coff + 16)[0]
|
|
opt = coff + 20
|
|
imagebase = struct.unpack_from("<I", data, opt + 28)[0]
|
|
so = opt + optsize
|
|
secs = []
|
|
for i in range(nsec):
|
|
o = so + i * 40
|
|
nm = data[o:o+8].rstrip(b"\x00").decode("latin1")
|
|
vs, va, rs, rp = struct.unpack_from("<IIII", data, o + 8)
|
|
secs.append((nm, va, vs, rp, rs))
|
|
|
|
def va2off(va):
|
|
rva = va - imagebase
|
|
for nm, sva, vs, rp, rs in secs:
|
|
if sva <= rva < sva + max(vs, rs):
|
|
return rp + (rva - sva)
|
|
return None
|
|
|
|
def find_xrefs(target):
|
|
res = []
|
|
for nm, sva, vs, rp, rs in secs:
|
|
if nm != ".text":
|
|
continue
|
|
blob = data[rp:rp+rs]
|
|
for i in range(len(blob)-5):
|
|
if blob[i] == 0xE8 or blob[i] == 0xE9:
|
|
rel = struct.unpack_from("<i", blob, i+1)[0]
|
|
addr = imagebase + sva + i
|
|
if addr + 5 + rel == target:
|
|
res.append((addr, "call" if blob[i] == 0xE8 else "jmp"))
|
|
return res
|
|
|
|
for t in [int(x, 16) for x in sys.argv[1:]]:
|
|
r = find_xrefs(t)
|
|
print("=== xrefs to %08x : %d ===" % (t, len(r)))
|
|
for a, k in r:
|
|
print(" %08x %s" % (a, k))
|