XLj7 dZddlmZddlZddlZddlZddlmZmZddl m Z ddl m Z ddl mZmZmZddlmZmZmZe ej-j.d Zed z Zed z Zed z Zd ZdZdddddddddZdddddddZiddd d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAZ dJdBZ!dKdCZ"dLdDZ#dMdEZ$dNdFZ%dOdGZ&dPdHZ'e(dIk(re'yy)QaScan x86 absolute references into the status-comment backing block. The short status-window comment selector is read through object+0xa8+0, with object+0xa8 bound to 0x004576d8. Prior reports proved the consumer but left the writer for backing offset +0 unresolved. This pass performs a narrow static scan over .text for absolute memory operands that point anywhere inside the 0x004576d8 backing block, then classifies likely reads/writes. ) annotationsN)Counter defaultdict)Path)Any) find_functionfunction_rangeshx) offset_to_va read_sections va_to_offsetz Hwanse2.exeoutwebivErzmov-al-from-moffs8zmov-eax-from-moffs32zmov-r8-from-memzmov-r32-from-memz cmp-r8-memz cmp-r32-memz cmp-mem-r8z cmp-mem-r32)89:;zmov-moffs8-from-alzmov-moffs32-from-eaxzmov-mem-from-r8zmov-mem-from-r32z mov-mem8-imm8zmov-mem32-imm32)z add-mem-r8z add-mem-r32z or-mem-r8 z or-mem-r32z adc-mem-r8z adc-mem-r32z sbb-mem-r8z sbb-mem-r32 z and-mem-r8!z and-mem-r32(z sub-mem-r8)z sub-mem-r320z xor-mem-r81z xor-mem-r32zgrp1-mem8-imm8zgrp1-mem32-imm32zgrp1-mem32-imm8z inc-dec-mem8z grp5-mem32)cVtj|ddSt|dS)NT)quote)htmlescapestr)values 1tools/build_status_comment_backing_writer_scan.pyhr9Is% ;;U]r$ GGE $ GGc\|D]}|jd|k(s|cStd|)Nnamezmissing section )get RuntimeError)sectionsr<sections r8section_by_namerAMs< ;;v $ &N )$0 11r:c.|dk\r:||dz }|tvrdt||dz ddS|tvrdt||dz ddS|dk\rK||dz dk(r@||dz }|tvrddt|z|dz ddS|tvrddt|z|dz ddS|dk\r||dz }||dz }|d zd k(rr|tvrdt||dz d |d dd S|tvrdt||dz d |d dd S|tvr.|dz dz}d}|dvr|dvrd}nd}|t||dz d |d |ddS|dk\rl||dz dvrb||dz }||dz }|d zd k(rJt||}|ddk7r6|dz |d<d||dz d dt |j ddz|d<|SdddddS) z@Classify a possible instruction whose disp32 begins at file_pos.rreadhigh)classificationmnemonicinstructionFileOffset confidencewritefz prefix66-r0x02x)rErFrGmodrmHexrH>r/r0>rJrPrLzindirect-control-read read-writemedium)rErFrGrOgroupRegrH>rKrE unclassifiedrGprefix-rFr2Nlow)READ_OPS WRITE_OPSRMW_OPS classify_atr6r=)exefile_posopmodrmregrEbases r8r_r_Ts1} A  >"($RL)1A$   ?")%bM)1A$  1}X\*d2 A  >"('(2,6)1A$   ?")')B-7)1A$  1} A HqL! DLT !X~&, ( -5\"$U3K 0"( Y&- )" -5\"$U3K 0"( W}zQ&!'%#*=% # B 7 # 3"%c*cAg&>XsUWxAX"Y"]"]^a"b "((637H5C/Ri 68 Kr:cJ tj}t|}t||}t t }|D]}||dj |g}t|jdD]y\}}td|D |j ||ddt|t t fddDt|Dchc] }|d s |d c}d {|jd g}|Dcgc] }|d d vs |} }|Dcgc] }|ddkDs |} }ttt t|t|t| t|t| t| dkDdd } ddd| || ||dScc}wcc}wcc}w)Nroc t|ddS)Nrr")rv)items r8zbuild..ss4PQ7TVGWr:)keyc3&K|] }|d yw)rEN.0rows r8 zbuild..s?3-.?srrpc3BK|]}j|dyw)rN)r=)rkindcountss r8rzbuild..s%^dfjjq&9%^s)rIrSrs)rorprefCountclassificationCountswriteLikeCountr0x00rE>rIrSrzNo direct absolute write to backing offset +0 was found. The exact selector byte still appears to be supplied through a VM/object base path rather than a simple x86 absolute store.) backingBlockVaHexbackingBlockSizeBytesabsoluteTextRefCountreferencedOffsetCountwriteLikeOffsetCountoffset0RefCountoffset0WriteLikeCountoffset0WriterProvendecisionrz)hwanse-status-comment-backing-writer-scanz1tools/build_status_comment_backing_writer_scan.py)versionrsourcesummaryoffsetSummarieswriterOffsetSummaries offset0Refsrefs)EXE read_bytesr rrlistr~sorteditemsrlendictsumr=r ryrx) r`r?r by_offsetroffset_summaries offset_hexr offset0_refsoffset0_write_likewriter_offsetsrrs @r8buildrs .. CS!H S( #D1z z Nr9)rkvs r8rzrender_html.. s: Aq ? !vZ!v]Cs-/c3K|]s}dt|ddt|ddt|ddt|ddt|ddtd j|d d d d uy w)rorpr rr, rNr r9joinrs r8rzrender_html..s   [!"#$s<()*+Z!"#%&'()+,-./3{+BQ/0123   sA9A;rc3K|]a}dt|ddt|ddt|ddt|ddtdj|d d cy w) rrorrprrrrrrrNrrs r8rzrender_html..s   [!"#$s<()*+%&'()+,-./3{+,-./   A'A)rc3K|]a}dt|ddt|ddt|ddt|ddt|dd t|d d cy w) zrqzrrrsrrErrFrruzNrrs r8rzrender_html..$s   s:'()s-./01s?+,-.%&'()Z!"#s<()*+   rru9 Status Comment Backing Writer Scan

Status Comment Backing Writer Scan

0x004576d8 상태창 문구 backing block 전체에 대한 .text 절대주소 read/write 스캔입니다.

결론: rz
z

Writer-Like Offsets

z
offsetaddresswrite-like refsclassificationsfunctions

Offset +0 References

z
refinstructionfunctionclassmnemoniccontext

All Referenced Offsets

z&
offsetaddressrefswrite-likeclassesfunctions
)rrr9)datascards offset_rows writer_rows offset0_rowss r8 render_htmlrs  YA GGGGI E '' )*  K'' /0  K77  &  L(6)*!J-(8'9:WLMXLYYKLXKYYLMXLYYO* *r:cPtjdtjdt}tdz j t j |dddtd z j t|d|d }td |d d |ddy)NT)exist_okz'status_comment_backing_writer_scan.jsonF),:) ensure_ascii separatorszutf-8)encodingz'status_comment_backing_writer_scan.htmlrz/wrote status comment backing writer scan (refs=rz, offset0_write=r)) OUTmkdirWEBr write_textjsondumpsrprint)rrs r8mainr\sIItIIItI 7D 44@@ 4e CA 44@@DA YA  )*++;A>Urs# ,TTLL H~''* ] Ul Ul                   , -  +  ,    ,    -   ,  -  ,  -  ,  -  ,  -     ! " # $  ' .H2Wt"J2jQh& zFr: