
    UHjY                    *   d Z ddlmZ ddlZddlZddlZddlmZ ej                  j                  d e
 ee      j                         j                               ddlmZmZ ddZddZddZ	 	 	 	 	 	 	 	 	 	 	 	 dd	Zdd
ZddZedk(  r e        yy)zAFind pointers to executable virtual addresses across PE sections.    )annotationsN)Path)offset_to_varead_sectionsc                    t        | d      S )Nr   )int)texts    3/home/exedev/hwanse/tools/probe_exe_pointer_refs.py	parse_intr      s    tQ<    c                N    | D ]   }|d   }||d   z   }||cxk  r	|k  s|c S  " y )Nrawraw_size )sectionsoffsetsectionstartends        r
   section_for_offsetr      sE     gj))F S N !
 r   c                    t        j                  d|      }g }d}	 | j                  ||      }|dk  r	 |S |dz   }t        ||      }|/||d   |vr9t	        ||      }	|	H|j                  |d   ||	|d       a)N<Ir      namer   
fileOffsetrefVavalue)structpackfindr   r   append)
datar   r   section_namesneedlerefssearchhitr   ref_vas
             r
   find_value_refsr*      s    [[u%FDF
ii'7$ K# q$Xs3?$)Mh,>"6?!		
 r   c           	     &   g }|D ]  }||d   |vr|d   }|d   |d   z   }| || }	t        dt        |	      dz
  d      D ]L  }
t        j                  d|	|
      d   }||cxk  r|k  sn +|j	                  |d   ||
z   |d   |
z   |d	       N  |S )
Nr   r   r   r         r   var   )rangelenr   unpack_fromr"   )r#   r   r   r   r$   r&   r   	raw_startraw_endr   indexr   s               r
   find_range_refsr5   8   s     D $)MEN	%.7:#669W%1c#hlA. 	E&&tS%8;EU)c)KK&v"+e"3$T]U2"			$ Kr   c                R    t        d| d   dd| d   dd| d   d	d
| d   d       y )Nz  r   7z va=0xr   08xz file=0xr   06xz -> 0xr   )print)refs    r
   	print_refr<   U   sJ    	
S^AfS\#$6 7l#C(s7|C.@	Br   c            
        t        j                  t              } | j                  dt        t	        d             | j                  dt
        dg        | j                  dd	d
t
               | j                  ddd       | j                  dt        d       | j                         }|j                  j                         }t        |      }|j                  dk(  rd n#t        |j                  j                  d            }|j                  D ]  }t        ||||      }t!        d|ddt#        |       d       |d |j$                   D ]  }t'        |        t#        |      |j$                  kD  set!        dt#        |      |j$                  z
   d        |j(                  rt+        |||j(                  d   |j(                  d   |      }t!        d|j(                  d   dd|j(                  d   ddt#        |       d       |d |j$                   D ]  }t'        |        t#        |      |j$                  kD  r&t!        dt#        |      |j$                  z
   d       y y y )N)descriptionz--exezHwanse2.exe)typedefaultz--valuer"   )r?   actionr@   z--range   )STARTEND)nargsmetavarr?   z
--sectionsz.text,.rdata,.dataz/comma-separated section names to scan, or 'all')r@   helpz--limit   all,0xr8   z: z ref(s)z  ... z morer   r   zrange 0xz..0x)argparseArgumentParser__doc__add_argumentr   r   r   
parse_argsexe
read_bytesr   r   setsplitr   r*   r:   r0   limitr<   r/   r5   )parserargsr#   r   r$   r   r&   r;   s           r
   mainrX   \   s+   $$9F
dD4GH
		(BO
	4D9U
$>  
 	S9D88 DT"H MMU2DDMM<O<OPS<T8UM :tXumD5+RD	{'23$**% 	CcN	t9tzz!F3t9tzz12%89: zztXtzz!}djjm][As+4

1c/B"SYKwWX$**% 	CcN	t9tzz!F3t9tzz12%89 " r   __main__)r	   strreturnr   )r   
list[dict]r   r   r[   zdict | None)
r#   bytesr   r\   r   r   r$   set[str] | Noner[   r\   )r#   r]   r   r\   r   r   r   r   r$   r^   r[   r\   )r;   dictr[   None)r[   r`   )rN   
__future__r   rL   r   syspathlibr   pathinsertrZ   __file__resolveparentprobe_exe_scene_tablesr   r   r   r   r*   r5   r<   rX   __name__r   r   r
   <module>rk      s    G "   
  3tH~--/667 8 >8
  
	
 # ::D zF r   