JjE dZddlmZddlZddlZddlZddlZddlmZddl m Z m Z m Z m Z ddlmZeej#j$dZedz Zd d d d d ddddZhdZidej1ddej1ddej1ddej1ddej1ddej1ddej1dd ej1dd!ej1d"d#ej1d$d%ej1d&d'ej1d(d)ej1d*d+ej1d,d-ej1d,d.ej1d,d/ej1d0d1ej1d2iZdBd3ZdCd4ZdDd5ZdEd6ZdFd7ZdGd8ZdHd9Z dEd:Z!dId;Z"dJdKd<Z#dLd=Z$dLd>Z%edfdMd?Z&dNd@Z'e(dAk(re'yy)OzHSummarize original EXE save-file path construction and loader API usage.) annotationsN)Path)c_string offset_to_va read_sections va_to_offset) parse_importsoutzsavedat wildcard for slot scanz-SaveData fallback directory for wildcard scanzsavedat0 base for current slotz,SaveData fallback directory for current slotzsavedat0 base for explicit slotz-SaveData fallback directory for explicit slotzregistry SavePath value writerzregistry SavePath value reader)iHiHiHi$HiHHihHieJieJ> ReadFilelstrcatAlstrcpyA FindClose WriteFile CloseHandle CreateFileA RegCloseKey RegOpenKeyExAFindFirstFileARegSetValueExARegQueryValueExAi3B558bec83ec24535657i73B 6848b148006800b35500ff1500045a00iO3B a207b35500if3B e8d8320000i3B e817050000i4B ff151c045a00i04Bi\4Bix4B ff1568045a00i4B a0da764500i4B 8a0ddb764500i4B a330de5900i8B558bec83ec0c535657i9B ff15e8035a00i;9Bi_9Bi0B ff15f8035a00ifB ff1558035a00cd|dS)N0x08x)values @/home/exedev/hwanse/tools/summarize_runtime_save_path_context.pyhex_var,Bs c{ cV|D]$}|d}||dz}||cxkr|ksn|dcSy)Nrawraw_sizenamer))sectionsoffsetsectionstartends r+section_for_offsetr7FsE#gj)) F S 6? " # r-c\t||}|tt|d||||zS)Nz is not in a loaded raw section)r ValueErrorr,)exer2vasizer3s r+bytes_atr=Os; (B 'F ~F2J<'FGHH v &&r-c Bg}tjD]\}}t|||t|}||k7r8t t |d|j d|j |jt ||j dd|S)Nz : expected z, got  )vaHexbytes)EXPECTED_BYTESitemsr=lenr9r,hexappend)r:r2rowsr;expectedactuals r+verify_expected_bytesrJVs D&,,.E H#xS]; X r |;x||~6FfVZZ\N[\ \ fRj6::c?CD E Kr-ctjd|}g}d} |j||}|dkr |St||}t ||}|$|"|j t ||d|dd|dz}^)Ng1 KK#BZ&')#c^ q r-ci}|jdxsgD]M}|jdd}|jdxsgD]!}|jd}|si|d|i||<#O|S)Nimportsdll functionsr1get)rXrGrYdll_namefunctionr1s r+ import_lookupr`vs~ D{{9%+;775"% ,2 ;H<<'D::%:T  ;; Kr-ctd|D}||d|d|dz}tjd|}g}d} |j||}|dkr |S|d|z} d} | } |dk\r||dz |dk(rd } |d|zdz } n|dk\r||dz |d k(r d } |d|zdz } t || } |j t | | d |d z})Nc32K|]}|ddk(s |yw)r1z.textNr)).0r4s r+ ziat_uses..sNG76?g3MN r/r0rLrzraw-iat-immediates call-indirects%z jmp-indirect)r@kindr )nextrOrPrQrrFr,) r:r2iat_vatextr/rRrGrTrU opcode_offsetrh start_offsetstart_vas r+iat_usesros NxN ND d5kDK$z*:: ;C [[v &F D F hhvv& 7  KU c) "$ !8C!Gc*k9"D;,q0L AX#cAg, ;!D;,q0L,7 fX.=>q r-c g}tjD]r\}}t||}|tdt |dt ||}t |||}|jt |d|d||t||dt|S)Nz save string z is not mappedr'rM)r@rNrkmeaningdirectRefCount directRefs) TARGET_STRING_VASrCrr9r,rrVrFrD)r:r2rGr;rqr3rkrSs r+save_path_stringsrus D(..0 Gh+ >|F2J<~FG GV$sHb1 #%fS\!2""%d)"    Kr-c <t|}g}ttD]w}|j|}|st |||d}|Dcgc] }|ddk(s |} }|j |d|t |dt|t| | dy|Scc}w)NiatVarhrgrY)rYr1iatVaHexuseCount callCount callSites)r`sortedINTERESTING_APISr]rorFr,rD) r:r2rXlookuprGr1itemusesuse call_sitess r+ api_summaryrs 7 #F D'( zz$ XtG}5%)LcS[O-KcL L E{"4=1I _'    KMs  BBcj t|}||nttdz }t||}t |||}|Dcic]}|d| c} ddddddd dd dd d d ddg}ddddddddddddddddg}dddgd |Dcgc]}|d! c}d"d#d$d%d&|d' }d(d)d*d+d,gd-d.} d/t d0|Dt d1|Dt d2|D|d3|d4t ||d5d6d6d/d6d7 } | |||| |t fd8|Dt fd9|d:Dd; jd c} vd? jd@ijd=gD chc]} | d> c} vdAt||dBdCdDdEdF Scc}wcc}wcc} wcc} w)GN Hwanse2.exer1 0x00423404 0x004576d80x00000x0072) callVaHex targetVaHex saveOffsetHexsizeHex 0x00423430 0x004577500x0288 0x0042345c 0x0059db600x02fa0x0200zwildcard slot scan path 0x00423041 0x0048b0c0 0x0048b0e0 0x0055b420zFindFirstFileA at 0x004230ebzScheck whether any savedat?.dat exists under registry SavePath or SaveData\ fallback)r1 functionVaHexfilenameStringVaHexdirectoryStringVaHexoutputBufferVaHex apiEvidencepurposezexplicit slot path 0x00423319 0x0048b148 0x0048b168 0x0055b318z>lstrcpyA/lstrcatA build path; open helper called at 0x004233cfzKbuild SaveData\savedatN.dat for the slot argument and feed the loader/saver 0x004238eb 0x004233cf) 0x00423917 0x0042393b 0x0042395fr 0x00423478 0x004234a3 0x004234b1 0x004234ba 0x0059de30) ropenHelperVaHexopenHelperCallVaHexcreateFileCallSitesreadFileCallSitescloseHandleCallVaHexselectorGroupLoadVaHexselectorSlotLoadVaHexselectedPointerStoreVaHexselectedPointerGlobalVaHex readBlocksz savedat0.dat 0x00423337 0x0042334fz"filename[7] = slot_argument + 0x31)z savedat1.datz savedat2.datz savedat3.datz...z savedat9.dat) baseStringcopyBaseStringVaHexslotCharPatchVaHexslotCharOffsetformulaexpectedRuntimeNamesTc32K|]}|ddk(s dyw)rkz SaveData\r Nr)rcrows r+rdz build_summary..s+`#CKS_D_A+`rec3JK|]}|djdsdyw)rksavedatr N) startswithrs r+rdz build_summary..s"&aSs6{?U?UV_?`q&as##c32K|]}|ddk(s dyw)rkSavePathr Nr)rs r+rdz build_summary..s*]3v;R\C\1*]rerrrF) staticSavePathKnownsaveDataDirectoryStringCountslotFilenameStringCountregistrySavePathStringCountloadRoutineVaHexrreadFileCallCountInLoaderselectorStoreVaHex"runtimeInputMenuReachabilityProvencapturedSelector20SavePresent'syntheticSelectorProbeRemainsDiagnosticpromotionAllowedc3K|]<}|djdijdgDchc]}|d c}v>ycc}ww)rr r{r@Nr\)rcrsite api_by_names r+rdz build_summary..sP*K {z[]?^?b?bcnpr?s$ttT']$tt*$ts-A  AA c3K|]9}|jdijdgDchc]}|d c}v;ycc}ww)rr{r@Nr\)rcr;rrs r+rdz build_summary..sK0PR1S1W1WXceg1hitG}ii0is*A AAr 0x004230ebrr{r@ 0x004266fdr)readFileHasLoaderCallscreateFileHasOpenHelperCallsfindFirstFileHasWildcardCallregistrySavePathReadPresentz2static-save-path-known-runtime-route-proof-missingzThe EXE has a concrete SaveData\savedatN.dat path builder and the selector loader reads three blocks before storing 0x0059de30, but no captured gameplay save or runtime input path currently proves selector 2:0 for map1_01a -> map2_02d.zA controlled diagnostic can place a backup-restored synthetic or captured savedatN.dat under SaveData and try to drive the original load menu, but a synthetic file must remain excluded from route promotion.)statusdetail nextProbe) summarystringsapis pathBuildersslotFilenamePatchloader apiChecksverifiedInstructionBytes conclusion) rr ROOTrursumrDallr]rJ) r:rXr2rrr read_calls path_buildersr slot_patchrrrs @r+ build_summaryrsvS!H ,g-}@T2UGX.G sHg .D/343v;#4K"F^fgs F! F& F+= F0c|d}ddddddd|ddd d |d d d |d d d|dd d|ddd|dddddddg}|dD],}|jd|dd|dd|dd|dd .|jgd!|d"D]8}|jd#|d$d%|d&d|d'd|d(d|d)d|d*d :|d+}|jdd,dd-|d.d d/|d0d d1|d2d d3|d4d d5d6j|d7d dd8dd9|d:d&d d;|d:d<d=|d:d>d d?|d:d@dA|d:dBd ddCdDg|d:dED],}|jd|dFd|dGd|dHd|dIdJ .|jgdK|dLD]z}d6jdM|dNddODxsdP}t|dNdOkDr|dQt|dNdOz dRz }|jd|dSdT|d$d|dUd|dVd|d ||jgdW|dXj D]\}}|jdY|dZ|d d[j|j d[zS)\Nrz# Runtime Save Path ContextrZz0Original EXE save path and save-loader evidence.z ## Conclusionz - status: `rr`z- static save path known: `rz+- runtime input menu reachability proven: `rz- promotion allowed: `rz - detail: rz- next probe: rz## Save Path Stringsz,| string VA | text | direct refs | meaning || --- | --- | ---: | --- |rz| `r@z` | `rkz` | rrz | rqz |)rZz## Path BuildersrZzE| name | function | filename | directory | output buffer | evidence |z%| --- | --- | --- | --- | --- | --- |r| r1z | `rrrrrrz## Slot Filename Patchz- base string: `rz - copy: `rz - patch: `rz - formula: `rz- expected names: `z, rz ## Loaderz - function: `rz- open helper: `rz` via `rz- selected pointer store: `rz` -> `rz/| ReadFile call | target | save offset | size |z| --- | --- | --- | --- |rrrrrz` |)rZz## API Call SitesrZz(| API | IAT | calls | first call sites |rrc3.K|] }d|ddyw)rr@Nr))rcrs r+rdzmarkdown..{sQ4Ad7m_A.Qsr{ -z, ... (+)rY!rxrz)rZz ## API ChecksrZr- z: ` )rFextendjoinrDrCrstrip)rslinesrpatchsiteskeyr*s r+markdownr-sR A% :  gl+H56a8 %a(=&>%?qA 5a8\6]5^^_` #5!6 7q9 W\*8456 .{;<=  6$# E&y!  #g,uS[Mc:J6K5LCPST]P^O__a b   LL ~&  V T#o"6!7uSAV=W?q Awx01BCDGGT\L]^sLtKuuv w)'(*; )argparseArgumentParser__doc__ add_argumentrrOUT parse_argsr: read_bytesr rr*r'r(print)parserargsr:rXrr)s r+mainr:s  $ $ 9F dD=4HI  $<   O     D ((   CDHH%GC)GWdllDMMBH /z :;r-__main__)r*intreturnstr)r2 list[dict]r3r<r=z str | None) r:rAr2r?r;r<r<r<r=rA)r:rAr2r?r=r?)r:rAr2r?r*r<r=r?)rXdictr=zdict[str, dict])r:rAr2r?rjr<r=r?)r:rAr2r?rXr@r=r?)N)r:rArXz dict | Noner=r@)rr@r=r>)rr@r'rr(z Path | Noner=r)r=None))r2 __future__rr0rr%rOpathlibrprobe_exe_scene_tablesrrrrsummarize_exe_importsr __file__resolverrr4rtr}rAfromhexrBr,r7r=rJrVr`rorurrrrr*r:__name__r)r-r+rJs[N" VV/ H~''* Ul1?0>1?00   23 @A l+ l+   l+   n-  n- n- n- l+ n- l+ 23 n- n-  n-!" n-#$ n-%,',2*,eP\,~(V25d <$ zFr-