JjBdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ejjdee ej!j"ddlmZddlmZe ej!j,dZed z Zd Zd Zeez Zd Zd ZdZgdZgdZ dddddddddgZ!d(dZ"d(dZ#d)dZ$d*dZ%d+dZ&d,dZ'd,dZ(d-dZ)d.d Z*d/d!Z+d0d"Z,d1d#Z-d1d$Z.d2d3d%Z/d4d&Z0e1d'k(re0yy)5zASummarize file-read candidates for opcode 0x24 mode1 source byte.) annotationsN)Path)Any) read_sections) parse_importsoutiYiHYiYiPYiZ)zreadfile-mode1-source-producerzruntime-file-io-tracezruntime-watchpoint-trace)zFReadFile destination/size covering opcode 0x24 mode1 source 0x0059e348zFruntime file-I/O trace proving a save/file read initializes 0x0059e348z8runtime watchpoint trace proving the 0x0059e348 producer Hwanse2.exez/ReadFile IAT call and destination argument scan)path descriptionzout/exe_imports.jsonzKERNEL32.ReadFile IAT addressz"out/runtime_trace_feasibility.jsonz)runtime file-I/O/watchpoint trace blockercd|dzdS)N0x08xvalues U/home/exedev/hwanse/tools/summarize_save_selector_opcode24_mode1_file_read_context.pyhex32r,s  "3' ((cd|dzdS)Nr02xrrs rhex8r0s  S! ""rc^tdt|D}|||d|d|dzfS)Nc32K|]}|ddk(s |yw)namez.textNr).0sections r ztext_section..5s[wSZ@Z7[s rawraw_size)nextr)exers r text_sectionr%4s;[-*<[[G C'*:M)MN NNrcX|jdxsgD]}t|jdxsdj|jk7rA|jdxsgD]:}|jd|k(s|jd*t|dccSy)Nimportsdll functionsriatVa)getstrlowerint)r'dll_name function_namer(functions r import_iat_var39s{{9%+. swwu~# $ * * ,0@ @  ,2 .H||F#}4g9N9Z8G,-- .. rcdtjd|z}g}|j|}|dk\r,|j||j||dz}|dk\r,|S)Ns(v8!  !s4y T&\T%9d6A:>NRV>V##D$ ;A>(v8!  Td6ld2 F]FGeO,7V+,6];&)&kD&8U6]d6l,(:R"# $D "A:-  rc |dzt|kDs||dk7rytjd||dzd}|t||zt||z|t|d|tz t|tz dzddd S) NrChr5rrr push imm32rL)rWr6rXrGLOBAL_BUFFER_BASE)r:rZr[rPs rdecode_push_imm32rdss qy3t9U t 3   dEAI 6q 9FGeO,7U?+6]--F%77:EF(  rc g}t|t|t|D]W}t|||}| t |||}|"t |d}t |cxkr tksDnG|j|Y|syt|dS)NrPc |dS)NrMrrows rz/find_global_destination_setup..s 3|+<rkey) rangeminrWr_rdr/GLOBAL_SCAN_STARTGLOBAL_SCAN_ENDr9max)r:startendr[ candidatesrZdecodedrPs rfind_global_destination_setuprus')Juc#s4y12')$w? ?'eW=G ? WX&'  9/ 9   g &'  z< ==rcg}t||dz }||kr||}|dk(r[|dz|krStjd||dzd}|dk\r+|j|t |t ||zdd|dz }j|d k(rV|d z|krNtjd ||dzd}|j|t |t ||zd d|d z }|dz }||kr|sy|dS)N jrrGrz push imm8)sizesizeHex sizeVaHexsizeInstructionrHrar5rbrC)rpr6rXr9rr)r:rq dest_indexr[rowsrZopcoders rfind_read_size_pushrs!!#D zB 'E * e T>eai*4&&sD%!)eai*4&&tT519=a@E KK <"7U?3#/   QJE   / * 0  8Orc~t|\}}t|ddxst}t||}g}|D]f}t d|dz }t ||||d} | 't ||t| d|d} | r-t| jdtrt| dnd} t| d} | duxr!| tcxkxr| t | d zknc} |jt|d|zt|| d | d | d | tz t| tz d kDrt| tz dznt| tz | | r| jdnd| r| jdnd| r| jdnd| | dd i|j!d||t#|fS)Nz KERNEL32.dllReadFiler`varMryrPrrNrOrQrKrrzr{r|rU) callVaHexreadFileIatVaHexdestinationSetupVaHexdestinationPushVaHexdestinationHexdestinationOffsetFromGlobalBase"destinationOffsetFromGlobalBaseHexreadSize readSizeHex readSizeVaHexreadSizeInstructioncoversMode1SourcerUc |dS)Nrrrgs rriz+scan_readfile_global_rows..s c+.rrj)r%r3READFILE_IAT_FALLBACKr?rprurr/ isinstancer, MODE1_SOURCEr9rrcrYrsortrW)r$r'textr: readfile_iatcall_positionsrcall_pos window_startdestry read_sizerP covers_mode1s rscan_readfile_global_rowsrsc"JD$ .*E^I^L#D,7N!#D" 1hm, ,T<4PT:V < "4s4 ;M7NPTUYPZ[)-*TXXf=Ms2SCV %Y] T(^$ T ! D,C#i2C)CC  tDzH45 %l 3%),%7$($5";//58J/J6../$638BT9TXb8b2cf112!26488I.D6:TXXk2BF488,=#>D!- $%7 8   : II.I/ s>2 22rct||\}}}|Dcgc]}|jds|}}|sdnd}idttdttdt t dttdttd t|d |d t|d t|d t|d|d|dddddtdtdtdttd|dScc}w)NraThe bounded ReadFile argument scan found global-buffer file reads only for offsets 0x11 and 0x12 of 0x0059e310. Both reads transfer one byte and therefore do not cover opcode 0x24 mode1 source 0x0059e348 (+0x38). This rules out the obvious file-read producer shape seen in the same global buffer function, but it is still a static argument-pattern scan rather than a full runtime watchpoint trace.z{At least one ReadFile destination covers 0x0059e348; inspect the file-read rows before treating mode1 source as unresolved.mode1SourceHexglobalBufferBaseHexmode1OffsetHexglobalScanRangeHexz..rreadFileCallCountglobalDestinationReadFileCountmode1FileReadCandidateCountmode1FileReadProducerFoundglobalDestinationReadFileRowsmode1FileReadCandidates proofFoundFopcode24Mode1FileReadProofFound"failedOpcode24Mode1FileReadGateIdsmissingEvidence evidenceRefsevidenceRefCountblocked)promotionStatus conclusion)rr,rrrcr MODE1_OFFSETrnrorWbool(FAILED_OPCODE24_MODE1_FILE_READ_GATE_IDS)OPCODE24_MODE1_FILE_READ_MISSING_EVIDENCE&OPCODE24_MODE1_FILE_READ_EVIDENCE_REFS)r$r'rrreadfile_call_countrh mode1_rowsrs r build_summaryrss.GW.U+L$+!%F#1D)E#FJF   K % - u%78  $|,  '8!9 :"U?=S! " C FG# $% ' Gs C5C5cddd|ddd|ddd|d dd |d dd |d dd|dd|dd|dd|ddd|ddd|ddd|ddddg}|jd|dD|jgd|jd|d D|jgd!|jd"|d#D|jgd$|d%D]E}|jd&|d'd(|d)d(|d*d(|d+d,|d-|d-nd.d/|d0d1|d2d3G|d%s|jd4|jdd5j|S)6Nz3# Save Selector Opcode 0x24 Mode1 File Read Contextr)z- mode1 source: `r`z- global buffer base: `rz"- mode1 offset from global base: `rz- global scan range: `rz- ReadFile IAT: `rz- ReadFile call count: rz$- global-destination ReadFile rows: rz- mode1 file-read candidates: rz- proofFound: `rz$- opcode24Mode1FileReadProofFound: `rz- promotion status: `rrz## Failed Gatesc3(K|] }d|d yw)- `rNrritems rr zmarkdown..sY43tfAYsr)r)z## Missing Evidencer)c3&K|] }d| yw)z- Nrrs rr zmarkdown..sD2dVDsr)r)z## Evidence Refsr)c38K|]}d|dd|dyw)rr z`: r Nrrrhs rr zmarkdown..s/  c&k]#c-012sr)r)z## Global ReadFile Destinationsr)zQ| call | destination setup | destination | offset | size | covers mode1 | setup |z,| --- | --- | --- | --- | ---: | --- | --- |rz| `rz` | `rrrz` | r-z | rz | `rUz` |z| - | - | - | - | - | - | - | )extendr9join)summarylinesrhs rmarkdownrsA= G$456a8 !'*?"@!AC ,W5E-F,GqI )=!> ?qA G$678: !'*=">!?@ .w7W/X.YZ (1N)O(PQ ',/02 .w7X/Y.ZZ[\ (9 :;1=    % E( LLY73W+XYY LL  LLD1B)CDD LL  LL>* LL67  #k"#5-D)E(FG$%&eC0T,U+VVZ"%j/"=s:3Gs&'(S1C-D,ES J   2 3 45 LL 99U rc "djd|dD}|sd}djd|dD}djd|d D}djd |d D}djgd tj|d dtj|ddtj|ddtj|ddtj|dd|dd|dd|ddtjt|ddtj|dd tj|d!d"|d#|d$|d%|d&S)'Nrc3BK|]}dtj|ddtj|ddtj|ddtj|dd|d|dnd d |d d tj|d dyw)zrzrrrzrNrz rzrUzhtmlescapers rr zhtml_page..8s   [[[!1234[[%?@[[%5!6789[[%I!JKLM"%j/"=s:3GH&'()[[%7!89:;  sBBrz"noner)c3NK|]}dtj|dyw)
  • z
    • Nrrs rr zhtml_page..Fs+  T[[&'|4#%rc3NK|]}dtj|dyw)z
  • 
    • Nrrs rr zhtml_page..Js+  t{{4 !'rrc3K|]9}dtj|ddtj|dd;yw)rr z : r rNrrs rr zhtml_page..NsE  T[[V-.i C DV8W7XX]^s?Ara Save Selector Opcode 0x24 Mode1 File Read Context

    Save Selector Opcode 0x24 Mode1 File Read Context

    • mode1 source: rz-
    • global buffer base: rz'
    • mode1 offset: rz,
    • global scan range: rz'
    • ReadFile IAT: rz(
    • ReadFile call count: rz.
    • global-destination ReadFile rows: rz(
    • mode1 file-read candidates: rz
    • proofFound: rz+
    • promotion status: rz

    rz

    Failed Gates

      z$

    Missing Evidence

      z!

    Evidence Refs

      z

    Global ReadFile Destinations

    z
    calldestination setupdestinationoffsetsizecovers mode1setup
    )rrrr-)rr failed_gatesmissing_evidence evidence_refss r html_pager7s 99 :;  D 377@ALww-.GG>*M! !  !  ;;w/?'@AB! C!! "&W5J-K!L M! N!  ;;w/?'@AB! C ! !% G4H,I JK! L!  ;;w/A'BCD! E!  $$789!!  :)!! "*11Q)R(S#! "T##! $$++H#I"J%! $K%! &S)>%?@A'! &B'! ( ${{73D+EFG)! (H)! , KK %&'-! ,(-! 0N1! 01! 45! 45! 8O9! 89! >?! >?! !rc|jdd|dz }|jtj|dddzd |9|jjdd|jt |d |S) NT)parentsexist_okz3save_selector_opcode24_mode1_file_read_context.jsonFrH) ensure_asciiindentrutf-8encoding)mkdir write_textjsondumpsparentr)rout_dirhtml_outjson_outs r write_outputsrvs MM$M.NNH  7q9D@dT:Ig.A Orctjt}|jdtt dz |jdtt dz |jdtt |jdtdd |j}|jj}|jjr/tj|jjd nt|j}t!||}t#||j$|j&}t)d |y)N)r z--exer )typedefaultz --importszexe_imports.jsonz --out-dirz --html-outzHOptional legacy HTML output path. JSON is the default retained artifact.)rrhelprrz*wrote opcode24 mode1 file-read context -> )argparseArgumentParser__doc__ add_argumentrROOTOUT parse_argsr$ read_bytesr'existsrloads read_textrrrrrprint)parserargsr$r'rrs rmainrs  $ $ 9F dD=4HI  $>P8PQ  $<   W     D ((   C <<    4<<))7);< 488 $ C)GWdllDMMBH 4 * r__main__)rr/returnr-)r$bytesrztuple[dict, bytes])r'dict[str, Any]r0r-r1r-rz int | None)r:rr;r/rz list[int])r:rrZr/r[r/rdict[str, Any] | None) r:rrqr/rrr/r[r/rr) r:rrqr/rr/r[r/rr)r$rr'rrz%tuple[int, list[dict[str, Any]], int])r$rr'rrr)rrrr-)N)rrrrrz Path | Nonerr)rNone)2r __future__rrrrr6syspathlibrtypingrr insertr-__file__resolverprobe_exe_scene_tablesrsummarize_exe_importsrrrrrcrrrnrorrrrrrr%r3r?r_rdrurrrrrrr__name__rrrrs:G" 3tH~--/66780/ H~''* Ul 00 ",( -) +\] #4ST 1Bmn*&)#O #L$ > @#3L F6r<~ 4 zFr