
    UHj                        d Z ddlmZ ddlZddlZddlZddlmZ  ej                  d      Z	ddZ
ddZddZdd	Zdd
ZddZdddZy)zAHelpers for scanning direct x86 call instructions in Hwanse2.exe.    )annotationsN)PathzV^\s*([0-9a-fA-F]+):\s+(?:[0-9a-fA-F]{2}\s+)+\s*call\s+(0x[0-9a-fA-F]+|[0-9a-fA-F]{5,})c                    d| dS )N0x08x )values    -/home/exedev/hwanse/tools/exe_call_scanner.pyhex32r      s    c{    c                ,    t        fd| D              S )Nc              3  4   K   | ]  }|d    k(  s|  yw)nameNr   ).0sectionr   s     r
   	<genexpr>z#section_for_name.<locals>.<genexpr>   s     KG76?d3JKs   )next)sectionsr   s    `r
   section_for_namer      s    KxKKKr   c                L    | D ]  }|d   |cxk  r|d   |d   z   k  s|c S  ! y Nvaraw_sizer   )r   r   r   s      r
   section_for_var      s@     4=BD1D!DDN E r   c                :    | d   |cxk  xr | d   | d   z   k  S c S r   r   )r   r   s     r
   va_in_sectionr      s*    4=BD1D!DDDDDr   c                *   t        |d      }t        j                  dddddddt        |       gd	t        j                  t        j                  d	d
      }g }|j
                  j                         D ]  }t        j                  |      }|st        |j                  d      d      }t        ||      sC|j                  d      }t        |d      }	t        ||	      }
|
r|
d   dk7  rw|j                  |t        |      |	t        |	      dd        |S )N.textobjdumpz-Mintelz-Dz-bzpei-i386z-mi386Tignore)checkstdoutstderrtexterrors         r   objdump-direct-callcallVa	callVaHextargetVatargetVaHex
scanMethod)r   
subprocessrunstrPIPEr#   
splitlinesCALL_REmatchintgroupr   r   appendr   )exe_pathr   r%   resultcallsliner7   call_vatarget_text	target_vatarget_sections              r
   objdump_direct_callsrC   #   s
   Hg.D^^	ItT:tVS]SF E((* d#ekk!nb)T7+kk!nR(	')<!77!Bw! +/
 	& Lr   c           	     |   t        |d      }|d   }| |||d   z    }g }t        dt        dt        |      dz
              D ]x  }||   dk7  r|d   |z   }t	        j
                  d||d	z         d   }|d
z   |z   }	t        ||	      }
|
r|
d   dk7  rP|j                  |t        |      |	t        |	      dd       z |S )Nr   rawr   r         r   z<ir'      r   raw-rel32-fallbackr+   )	r   rangemaxlenstructunpack_fromr   r:   r   )exer   r%   	raw_startrE   r=   indexr?   relrA   rB   s              r
   raw_rel32_callsrS   D   s    Hg.DUI
iT*%55
6CEq#aSA./ u:t*u$  sEAI6q9aK#%	')<!77!Bw! +.
 	  Lr   c                    |	 t        ||      }|dfS t        | |      dfS # t        t        j                  t        f$ r Y .w xY w)Nr*   rI   )rC   OSErrorr1   SubprocessError
ValueErrorrS   )rO   r   r;   r=   s       r
   direct_text_callsrX   \   s[    	(8<E/// 3)+??? 33Z@ 		s   " AA)r	   r8   returnr3   )r   
list[dict]r   r3   rY   dict)r   rZ   r   r8   rY   zdict | None)r   r[   r   r8   rY   bool)r;   r   r   rZ   rY   rZ   )rO   bytesr   rZ   rY   rZ   )N)rO   r]   r   rZ   r;   zPath | NonerY   ztuple[list[dict], str])__doc__
__future__r   rerM   r1   pathlibr   compiler6   r   r   r   r   rC   rS   rX   r   r   r
   <module>rc      sS    G " 	    "**]
LEB0@r   