UHj2,dZddlmZddlZddlZddlZddlZddlZddlm Z ejjde e e jjddlmZmZmZe e jj(dZedz ZdZd Zd Zd d d ddZddZd dZd!dZd"dZd#dZd$dZ d% d&dZ!d'dZ"d(dZ#d)dZ$d*dZ%d*dZ&efd+dZ'd,dZ(e)dk(re(yy)-zLFind raw event/object VM stream candidates for branch-state writer handlers.) annotationsN)Path)find_cns_strings read_sections va_to_offsetoutiGiAiͶAzobject/stat comparison groupzparty/object condition groupzsix-slot object condition groupz#list selection initialization group)%&'1cd|dS)N0x08x)values R/home/exedev/hwanse/tools/summarize_event_object_branch_state_stream_candidates.pyhex32rs c{ cL|D]}|d|cxkr|d|dzks|cS!y)Nvaraw_sizer)sectionsrsections rsection_for_var"s@ 4=B D1D!D DN E rcL|D]}|d|cxkr|d|dzks|cS!y)Nrawrrroffsetrs rsection_for_offsetr )s@ 5>V Jgenwz7J&J JN K rcd|dks|dzt|kDrytjd||dS)NrrrrLr"zEraw 0x40-index byte pair in data; possible event/object command startmediumz0raw byte overlap in data; unproven command startr06x02x)vaHex fileOffsetHexindexHex handlerLabel offsetMod4precedingByteHexfollowingByteHexalignedDwordVaHexalignedDwordHexalignedDwordPointercurrentDwordHexcurrentDwordPointerpointerRefCountclassification confidence)r*r(r$r/rBRANCH_STATE_HANDLER_INDEXESrJ)r'rrindexr aligned_off aligned_value current_value preceding followingaligned_pointercurrent_pointerrarbs rclassify_candidaterlls x (BFQJ'K#C5M#C0M#)A:FQJ4I#)A:C#8FQJdIFSF_nS(MBeiOFSF_nS(MBeiO zQ?O d f 4 4` K rwQfS\*s $4U;qj4=4Ib30t4=4Ib30t"=;#G#L1M3@3L5/RV.3@3L5/RV.HJ,S(BG!D\](  rct|}t||}g}|D]}|ddvr |d}||||dz}tD]l}td|g}d} |j || } | dkr+| dz} || z} t ||| |} |d| d<t |||| | d <|j| [|jd i} i}|D]>} | j| d ddz| | d <|j| d ddz|| d <@dttttttddt|| |d|dS)Nr,>.data.rdatarr@rrr nearbyCnsc|d|dfS)NrVrTr)rows rzbuild_summary..sS_c'l$Cr)r@rVrbzRraw .data/.rdata byte pairs that could dispatch branch-state event/object handlerszLstream byte0 must be 0x40; stream byte1 indexes dword [byte1*4 + 0x0047f1d8])dispatcherVaHexdispatchCallVaHexhandlerTableVaHex dispatchRulea#Raw 0x40-index byte pairs exist for branch-state writer handlers, but many are embedded in pointers or operands. This report separates byte overlap from command-start evidence; none of these rows alone proves that selector root 2:0 executes a branch-state writer before the current frontier.)scopeeventObjectDispatchercandidateCountcandidateCountsByIndexcandidateCountsByConfidence conclusion candidates)rrrcbytesrDrlrAr8sortgetrEVENT_DISPATCHER_VAEVENT_DISPATCH_CALL_VAEVENT_HANDLER_TABLE_VAr$)r'rr9rr raw_startrrdpatternrHrIrrsby_index by_confidences r build_summaryrsS!HsH-GJ' 6?"5 5 EN )Y)<<=1 'ET5M*GFhhw/7q"S(hF!(I#23'6#RK !!#& ' '$OOCODHMW$,LLZ!$Dq$HZ!+8+<+!&'=!>j " j/"*'4 J!! rcddddd|dddd|dd dd |dd dd |d d|ddddg }|dD]j}djd|jdxsgDxsd}|jd|dd|dd|dd|dd|dd|d d!|d"l|jdd#j|S)$Nz-# Event/Object Branch State Stream Candidatesz`Raw `0x40 xx` byte-pair candidates for event/object VM handlers that write `primaryBranchState`.z- dispatcher: `rzru`z- dispatch call: `rvz- handler table: `rwz- candidates: r{r~zI| va | index | confidence | classification | aligned dword | nearby CNS |z%| --- | --- | --- | --- | --- | --- |rz, c3&K|] }|d ywr,Nr.0items r zmarkdown..sLV Lsrq-z| `rTz` | `rVz` rWz | rbraz | `r\z` | z | )joinrr8)summarylinesrscnss rmarkdownrsH7 j '"9:;LMNaP W%<=>QRSSTU W%<=>QRSSTU !1234   S/ E|$ iiL1E1KLLSPS #g,uS_$5RN8K7LCPST`PaObbe#$%T#.?*@)AcU" N   LL 99U rcBg}|dD]}djd|jdxsgDxsd}|jdtj|ddtj|d d tj|d d tj|d d tj|ddtj|jdxsdd|ddjddddddddddddd d!d"d#d$tj|d%d&d'tj|d%d(d)tj|d%d*d+d,tj|d-d.d/d0d1j|d2d3d4d1gS)5Nrz
c3LK|]}tj|dywr)htmlescapers rrzhtml_page..s[$++d6l3[s"$rqrzrTzrVz
rWz rbrazr\zz rzzzz zF z< Event/Object Branch State Stream Candidatesz zzz6

Event/Object Branch State Stream Candidates

z

Dispatcher: rzruz, call rvz, table rwz .

z

r~z

z z rz
vaindexconfidenceclassificationaligned dwordnearby CNS
zz)rrr8rr)rr=rsrs r html_pagers D|$  kk[ @T@ZXZ[[b_b  S\234S_56k$++cR`NaBbAcd;;s<0123;;s#34567SWW->%?%F3GHI%      99"PFhTW)&@ !$++g6M.NO`.a"b!cdkk'*A"BCV"WXYZ{{7+B#CDW#XYZZf h  GL12348 X BGGDM?"23 3 rc|jdd|dz jtj|dddzd y) NT)parentsexist_ok0event_object_branch_state_stream_candidates.jsonF),:) ensure_ascii separatorsrzutf-8)encoding)mkdir write_textjsondumps)rout_dirs r write_outputsr sD MM$M. AAMM 7:FMNrcvtjt}|jdtt dz |jdtt |j}t|jj}t||jtd|jdz y)N) descriptionz--exez Hwanse2.exe)typedefaultz --out-dirz5wrote event/object branch-state stream candidates -> r)argparseArgumentParser__doc__ add_argumentrROOTOUT parse_argsrr' read_bytesrrprint)parserargsrs rmainrs  $ $ 9F dD=4HI  $<    DDHH//12G'4<<( A$,,RDCDBE FGr__main__)rintreturnstr)r list[dict]rrr dict | None)rrrrrr)r'rrrr int | None)rrrrrr)r'rrrrrrr)) r'rrrr9zdict[int, str]rrr:rrr)r'rrrrErrr) r'rrrrrrdrrdict)r'rrr)rrrr)rrrrrNone)rr)*r __future__rrrrr%syspathlibrpathinsertr__file__resolveparentprobe_exe_scene_tablesrrrrrrrrrrcrrr r(r*r/rArJrlrrrrr__name__rrrrs<R" 3tH~--/6678PP H~''* Ul# # ( ( + /  4 3K        6 %P-`4(V25G zFr