UHj=dZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ejjdee ej!j"ddlmZmZmZddlmZddlmZe ej!j4d Zed z Zdd Zdd Zdd ZddZ ddZ!ddZ"ddZ#ddZ$ddZ%ddZ&e'dk(re&yy)zDTrace the gated path after the nearest selectionBuffer[0x20] writer.) annotationsN)Path)Any)find_cns_strings read_sections va_to_offset)handler_for_opcode) trace_streamoutcp|js|Stj|jdS)Nutf-8encoding)existsjsonloads read_text)pathfallbacks ?/home/exedev/hwanse/tools/summarize_save_selector_gate_paths.py load_jsonrs* ;;= ::dnngn6 77c"|r t|dSdS)N)int)values r parse_hexrs"3ub>,,rcvt||}||dzt|kDrytjd||dS)Nzr?)r appendget)r$r%r4startrowsr5s r trace_startrD<s DC7E2>   GGFOWWW% +-GGN3"ww'89 #(: ;'',/'',/     Krct|}t||}g}|D]+jdxsi}t|jd}tjd}||R|dz} t |||| } | rt| djdnd} | rt |||| ng} | rt| djdnd} | rt |||| ng}|r|dni}t|jd}t |jd xsd d }t |||}td |Di}t|jd}|rt||||d zni}t |jdxsdddd }t |||}|r2t|xsd|xsddzd Dcgc]}t||||c}ng}tfd|Di}|jidjddjdd|jddjdd| d| d|d|jdd|jd d|jdd|jdd|jd d!|d"|jd|jd|jdd#d$|d%|d&|jd|jd|jd d' d(|jd)d*|jd+xsgd,d-.|Scc}w).NnearestLinearWriter writerVaHexfrontierReaderVaHexrr=r,r:0x00rc3JK|]}|jddk(s|yw)r:0x24NrA).0items r zbuild_rows..as!]$TXXk=RV\=\]s##r r- 0x00000000(c3K|]`}|jddk(rJ|jdjdk(r'|jdjdk(r|byw)leafPointerHex 0x00542ae8sourcetargetNrN)rOstreamchains rrQzbuild_rows..ks_ !::./<?JJx(EIIh,??JJx(EIIh,?? sA&A)rXrYnearestWriterVaHexfirstGateTracesecondGateTrace postGateTracedispatchStopVaHexdispatchStopOpcodeHexdispatchStopHandlerVaHexr;dispatchStopHandlerSectionhandlerSectiondispatchStopIsCodeHandler isCodeHandlerdispatchContextopcode24Boundary0x01zOpcode 0x24 is an action/state handler. It reads stream+1 as a mode, checks runtime globals 0x0059e34d/0x0059e33e and object state fields, writes context+0x58 in several branches, and only has a simple +4 advance in the statically detected path.r*02x) opcodeVaHexopcodeValueHexr;streamPlus1Hexmeaning nextDwordnextLowByteOpcodeHexnextLowByteHandlerVaHexnextLowByteHandlerSectionnextLowByteIsCodeHandlerfrontierLeafPointerHexrVfrontierLeafFieldRecords fieldRecords conclusiona\The nearest writer 0x005428bc does not linearly prove the frontier reader. It falls through two 0x11 gates with scalar branch targets 0x00000001/0x00000002, then reaches opcode 0x24 at 0x005428e4. Opcode 0x24 is a runtime action/state handler, so the bytes after 0x005428e4 are not proven linear bytecode by the simple stream tracer. The naive linear trace later reaches low byte 0xe8 at 0x005428f4, but its handler-table entry 0x00440c28 is in .data rather than code. The next proof step is decoding that action/state payload boundary and showing it selects leaf 0x00542ae8 before the 0x00542b0c reader.) rrrArrDrr nextr6ranger@)r$writer_chain_rows leaf_streamsr%r4rCnearest writer_va reader_va first_gate gate_trace second_gatesecond_gate_trace post_gatepost_gate_tracestopstop_va stop_opcode stop_handleropcode24 opcode24_va opcode24_nextopcode24_next_opcodeopcode24_next_handlerr&dispatch_context frontier_leafr[s @r build_rowsrMsS!HsH-G D"L ))128bgkk-89 eii(=>?   1 ]  hD JTi 1 1 12D EFZ^ P[KXw LacO`I/2667IJKfj LU+c8WiH[]&5r"2DHHW-.488K0:FR@ )#xE ]/]_ab W 56 P[ C7K!OLac "M$5$5j$A$Q\SUSV#WY[\ 23BV WW\W\T,A1E  Xw 3   %1    * eii)* eii)*  !'++m"<*  "599-B#C * j * 0 *  _*  '!2*  $TXXk%:*  '(@*  ),*:*:;K*L*  ()9)9/)J*  /*  '||G4"*,,z": ( ^ <"(m+*,-A#,F(G+@+D+D^+T-B-F-FGW-X,A,E,Eo,V!* < %m&7&78H&I=* > ' (9(9.(I(OR?* @ @C* * EL Z Kq sMcgd}|D]}|jd|dd|ddd|jdd d |jd d d |jd d|jdd|jdd|jdd|jdd d|jdxsijdd|jdxsijdd d|jdxsijdd|jdxsijdd|jdxsijdd|jd dd!d"g d#|jd$xsgfd%|jd&xsgfd'|jd(xsgffD]\}}|D]}|jd)|d*|jd+d,|jd-d.|jd/d.|jd0d.|jdd.|jd1xsd2d.|jd3xsd2d4|jd5xsd2d6|jgd7|jd8xsgD]u}|jd9xs|jd:xsd2}|jd;|jd-d.|jd/d4|jd<d*|d6 w|jdxsi}|jdd=d|jd>xsd2dd?|jd@xsijd/dA|jd@xsijd-d d|jdd|jdd|jdg|jddBj|S)CN)z# Save Selector Gate PathszGControl-flow boundary after the nearest `selectionBuffer[0x20]` writer.rz## rXz -> rYrz- nearest writer: `r\`z- frontier reader: `rHz- dispatch stop: `r`z ` opcode `raz ` handler `rbz` in rcz- frontier leaf candidate: `rtz- opcode 0x24 boundary: `rhrkr;z- next low-byte handler: `rpz` -> `rqrrz- conclusion: rwzW| segment | step | va | value | opcode | handler | branch target | fallthrough | stop |z8| --- | ---: | --- | --- | --- | --- | --- | --- | --- | first gater] second gater^ post gater_z| z | r9z | `r,z` | `r-r:r<-r=z` | r>z |)rz### Dispatch Contextrz| va | value | kind | target |z| --- | --- | --- | --- |rgr2r0z| `r/z### Opcode 0x24 Boundaryrnz- next dword: `roz` at ` )extendrAr@join)rClinesr5segmenttracerPrYboundarys rmarkdownrsT E ) #h-S]O 4 !#''*>"?!@ B"377+@#A"B! D )jQhIiHjjuvyv}v}YwZv[[`adahahiEaF`G H*3773K+L*MQ O'1C)D)J(O(OP](^'__jlolslsuGmHmNLNlSlSTblckdde f(#''2D*E*K)P)PQg)h(iioqtqxqxzLrMrSQSqXqXYrqsptty{~{B{BCU{V{\Z\zazab}z~y @SWW\23 4  e F  377#34: ; CGG$56<" = #''/28b 9 NGU    TXXf%5$6d488G;L:MUSWS[S[\fSgRhi-.eDHH^4L3MN!23:s;5J\A]Adad@eeixx -45R9    tuGG-.4" rDXXk*DdhhuoDF LL3txx01txx 7K6LDQUQYQYZ`QaPbbeflemmop q r77-.4"  &  LL # *s x||K8>BCCJOPPVX`XdXdepXqXwuwW|W|~EXFWGGH I(6L)M(NfU]UaUab{U|T}~CDLDPDPQlDmCn o    RS)T 99U rcgd}|D]}|jdtjt|j ddtjt|j ddddtjt|j d d d tjt|j d d d tjt|j ddtjt|j ddtjt|j ddtjt|j dd dtjt|j dd dtjt|j dxsij ddtjt|j dxsij dd dtjt|j dxsij ddtjt|j dxsij ddtjt|j dxsij d dd!tjt|j d"dd#d$g d%|j d&xsgfd'|j d(xsgfd)|j d*xsgffD]\}}|D]}|j d+tj|d,|j d-d.tjt|j d/d0tjt|j d1d0tjt|j d2d0tjt|j dd0tjt|j d3xsd4d0tjt|j d5xsd4d6tjt|j d7xsd4d8|j d9|j d:xsgD]}|j d;xs|j d<xsd4}|j d=tjt|j d/d0tjt|j d1d6tjt|j d>d,tjt|d8 |j dxsi}|j d?|j d@|j dAtjt|j dBxsd4dC|j dDtjt|j dExsij d1dFtjt|j dExsij d/dGtjt|j ddtjt|j ddtjt|j d dC dHj |S)IN)zLSave Selector Gate Pathszz!

Save Selector Gate Paths

zY

Control-flow boundary after the nearest selectionBuffer[0x20] writer.

z

rXz -> rYz

z
    z
  • nearest writer: r\z
    • z
  • frontier reader: rHz
  • dispatch stop: r`z opcode raz handler rbz in rcz
    • z#
  • frontier leaf candidate: rtz
  • opcode 0x24 boundary: rhrkr;z!
  • next low-byte handler: rpz -> rqrrz
  • rwz
zrr]rr^rr_zz
segmentstepvavalueopcodehandlerbranch targetfallthroughstop
z r9zr,zr-r:r<rr=zr>z

Dispatch Context

rgr2r0z
vavaluekindtarget
r/z
z

Opcode 0x24 Boundary

z

rnz

z

next dword: roz at z&; next low-byte handler: r)rhtmlescapestrrAr@r)rCpartsr5rrrPrYrs r html_pagersE E 6  4;;s3778#4567wt{{3swwW_O`Ka?b>cch i (SAU9V5W)X(YYe f)$++c#''BW:X6Y*Z)[[g h' C@S8T4U(V'WWlmqmxmxy|~A~E~EF]~^z_n`maawx|xCxCDGHKHOHOPjHkDlxmwnnyz~zEzEFIJMJQJQRnJoFpzqyrrw x1$++c#''JbBc>d2e1ffr s.t{{3HZ@[@a_a?f?fgt?u;v/w.xyOPTP[P[\_adahahi{a|aB@B`G`GHV`W\XPYOZZf g/ CI[A\Ab`b@g@gh~@=A1B0CCWX\XcXcdgilipipqCiDiJHJhOhOPihjdkXlWmmxy}yDyDEHJMJQJQRdJeJkikIpIpqLIMENyOxPPU V4;;s377<#89:;5 A  A  377#34: ; CGG$56<" = #''/28b 9  NGU   ;;w/0188F+,-!!%S'1B-C!D EF!!%S*1E-F!G HI!!%S+1F-G!H IJ!!%S.1I-J!K LM!!%S:K1L1SPS-T!U VW!!%S:L1M1TQT-U!V WX;;s488L+A+HS'IJKL     &  \ ]GG-.4" DXXk*DdhhuoDF LL![[TXXg->)?@AB![[TXXj-A)BCDE{{3txx'7#89:;{{3v;/01   77-.4" '( 45 s4;;s8<< +B+Ic'JKLDQR #DKKX\\+5N5TRT4Y4YZd4e0f$g#hi Ck)B)Hb(M(Mg(V$WXYZ,,0KKHLLI_<`8a,b+cd;;s8<<8Q+R'STUV++c(,,/J"KLMNd  T a6 n 99U rc|jdd|dz jtj|dddzd y) NT)parentsexist_oksave_selector_gate_paths.jsonF) ensure_asciiindentrrr)mkdir write_textrdumps)rCout_dirs r write_outputsrsC MM$M. ..:: 4eA6=;rctj}|jdttdz |jdtt |j }t|jjt|jdz gt|jdz g}t||jtdt|d|jd z y) Nz--exez Hwanse2.exe)typedefaultz --out-dirzsave_selector_writer_chain.jsonzsave_selector_leaf_streams.jsonzwrote z! save selector gate path rows -> r)argparseArgumentParser add_argumentrROOTOUT parse_argsrr$ read_bytesrrrprintr!)parserargsrCs rmainrs  $ $ &F dD=4HI  $<    D  $,,!BBBG$,,!BBBG D $ % F3t9+>t||Nm?m>n opr__main__)rrrrreturnr)rz str | Noner int | None)r$bytesr% list[dict]r&rrr) r$rr%rr4dict[int, str]r&rrdict) r$rr%rr4rrBrrr)r$rrzrr{rrr)rCrrr)rCrrrrNone)rr)(__doc__ __future__rrrrr"syspathlibrtypingrrinsertr__file__resolveparentprobe_exe_scene_tablesrrrsummarize_script_handler_tabler %summarize_save_selector_stream_tracesr rrrrrr(r6rDrrrrr__name__rrrsJ" 3tH~--/6678PP=> H~''* Ul8 -4&"Qh1h>B q zFr