UHj+dZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ejjdee ej!j"ddlmZmZmZddlmZmZe ej!j2dZed z Zdd Zdd Zdd Zddd ZddZ ddZ!ddZ"ddZ#ddZ$ddZ%e&dk(re%yy)zJSummarize the opcode 0x24 payload boundary after the current route writer.) annotationsN)Path)Any)find_cns_strings read_sections va_to_offset)handler_for_opcodesection_name_for_vaoutcp|js|Stj|jdS)Nutf-8encoding)existsjsonloads read_text)pathfallbacks E/home/exedev/hwanse/tools/summarize_save_selector_opcode24_payload.py load_jsonrs* ;;= ::dnngn6 77c"|r t|dSdS)N)int)values r parse_hexrs"3ub>,,rcvt||}||dzt|kDrytjd||dS)Nzrow_at..Usq4VQRSYQZ^eQejklpjquzkU}~@D~EHIJTHU~UkUAdG4Vs 66 6x targetVaHexipairscalar)r)r updategetr<r next) r%r&stringsr'rowopcodehandlerr0rs @@rrow_atr`;s S(B 'EbX(-(9bs $t C }"F  T\F h7GJJ"&6#,'&{{>:!(-=!> ' O <c8R3"(E2G F H  J F ")3ut4VX4V0V(VWX'YZH !%-M J 2+% UV^$=F  JF Jrc t|}t||}g}|D]Gjdxsi}t|jd}tjd}||R|dz }t ||dzdD cgc]} t |||| } } | D cgc]} | jddk(r| } } | D cgc]N} t| jd r2t| jd |kDr| jd d ur| P} } | D cgc]O} t| jd r3t| jd |kDr| jd d k(r| Q}} |j idjddjdd|jdd|jdd|jddjddtfd| Dddjddjddd|ddd|dzdd| dt| d t| d!t|d"d#J|Scc} wcc} wcc} wcc} w)$Nopcode24Boundary opcodeVaHexdispatchStopVaHexrPr r@rOr1rLTrKz.datasourcerN opcode24VaHexopcode24ValueHexopcodeValueHexopcode24HandlerVaHexrCdispatchStopValueHexc3K|]9}|jdjdk(s'|jd;yw)r1rdr>NrZ)rRitemgates rrTzbuild_rows..s7t$'ARVZV^V^_rVsAs*%ts (AAdispatchStopHandlerVaHexdispatchStopHandlerSectionwindowStartHexr.r/ windowEndHexL windowRowspointerRowCountcodeLowByteCountAfterBoundarydataLowByteCountAfterBoundary conclusionaOpcode 0x24 at 0x005428e4 advances by +4 only in the statically visible handler path, but the following region contains self/pointer-table values such as 0x005428e8 and 0x0054294c. A naive low-byte trace through those dwords reaches 0xe8 at 0x005428f4, whose handler-table entry is .data, not code. Treat the region after 0x005428e4 as unresolved payload/table data until the opcode 0x24 runtime mode is decoded.) rrrZrranger`r4r[r")r% gate_pathsr&r\rowsboundary opcode_vastop_va window_startr' window_rowsrn pointer_rowscode_low_bytes_after_boundarydata_low_bytes_after_boundaryros @r build_rowsr^s S!HsH-G D3 88./52hll=9: DHH%89:    4' L'D.!<  3'2 .  ) xx9,   )) '*+ $((7:K0Ly0X/0D8 ) %) )) '*+ $((7:K0Ly0X01W< ) %)  dhhx( dhhx(  X\\-8   -= >  #HLL$@  *=!>   #Dt+t%  '1K(L  )$((3O*P  <"45  b4 45  + s<0! " ,S1N-O# $ ,S1N-O% & ;)  33 h K[  ) ) sI*!I/AI4AI9cpgd}|D]}|jd|jdd|jddd|jdd |jd d |jd d d|jdd |jdd |jdd|jdd|jdd|jdd|jdd|jddddg |jdxsgD]}djd |jd!xsgDxsd"}|jd#xs|jdxsd"}|jd$|jd%d&|jd'd(|jd)d*|d+|jd,xsd"d&|jd-xsd"d.|jd/xsd"d*|d0|jdd1j|S)2N)z## Save Selector Opcode 0x24 PayloadzSPayload/table evidence for the opcode 0x24 boundary after the current route writer.rz## rfz -> rNrz- opcode 0x24: `rgz ` value `rhz ` handler `rj`z- naive stop: `rdrkrpz` in rqz- pointer rows in window: rvz&- code-like low bytes after boundary: rwz(- data low-byte entries after boundary: rxz- conclusion: ryzE| va | value | kind | target | low byte | handler | refs to this va |z+| --- | --- | --- | --- | --- | --- | --- |ru, c3fK|])}|jdd|jd+ywr0:r1NrmrRrefs rrTzmarkdown../jC 231SWWW5E4FGj/1r7-rVz| `r1z` | `r>z` | r@z | z | `rIrJz` rKz | )extendrZjoinr4)r|linesr]rnr7rNs rmarkdownrs E  #''(#$D):(; < sww78 #''J\B]A^^ijmjqjqsIkJjKKL Mcgg&9:;9SWWMcEdDeepqtqxqxzTrUqVV[\_\c\cd@\A[B C(1B)C(D E4SWW=\5]4^ _6sww?^7_6` aSWW\23 4  S 9  GGL)/R D99jSWS[S[\bScSigijjqnqDXXm,I0BIcF LLdhhw'(dhhz.B-C4QWHXGYY\($txx 5<=>HH23:s;2dhhG^>_>fcf=ggjkojpprt    R-. 99U rc\gd}|D]}|jdtjt|j ddtjt|j ddddtjt|j d d tjt|j d d tjt|j d ddtjt|j dd tjt|j dd tjt|j ddtjt|j dd d|j ddd|j ddd|j dddtjt|j ddddg |j d xsgD]}d!j d"|j d#xsgDxsd$}|j d%xs|j dxsd$}|j d&tjt|j d'd(tjt|j d)d*tjt|j d+d,tjt|d-tjt|j d.xsd$d(tjt|j d/xsd$d0tjt|j d1xsd$d,tj|d2|j d3d4j |S)5N)zUSave Selector Opcode 0x24 Payloadzz*

Save Selector Opcode 0x24 Payload

zZ

Payload/table evidence for the opcode 0x24 boundary after the current route writer.

z

rfz -> rNz

z
    z
  • opcode 0x24: rgz value rhz handler rjz
    • z
  • naive stop: rdrkrpz in rqz
    • z
  • pointer rows in window: rvz(
  • code-like low bytes after boundary: rwz*
  • data low-byte entries after boundary: rxz
  • ryz
zrurc3fK|])}|jdd|jd+ywrrmrs rrTzhtml_page..rrr7rrVzz
vavaluekindtargetlow bytehandlerrefs to this va
r1zr>zr@z zrIrJz rKz
r)rhtmlescapestrrZrr4)r|partsr]rnr7rNs r html_pagers E ) 4;;s3778#4567wt{{3swwW_O`Ka?b>cch i %dkk#cggo6N2O&P%QQefjfqfqruvyv}v}QwRsSgTfUUklplwlwx{||C|CDZ|[x\l]k^^j k$T[[SWW=P5Q1R%S$TThimitituxy|zAzABXzYvZj[i\\rsws~s~BCFCJCJKeCfgshriituyu@u@ADEHELELMiEjAkultmmr s*3773D+E*Fe L6sww?^7_6``e f8A`9a8bbg h4;;s377<#89:;5 A  c  GGL)/R D99jSWS[S[\bScSigijjqnqDXXm,I0BIcF LL![[TXXg->)?@AB![[TXXj-A)BCDE{{3txx'7#89:;{{3v;/01![[TXXl-C-Js)KLMN![[TXX6K-L-SPS)TUVV^_c_j_jknosowowyPpQpXUXlY`Z_[[{{4()*    '(7)8 99U rc|jdd|dz jtj|dddzd y) NT)parentsexist_ok#save_selector_opcode24_payload.jsonF) ensure_asciiindentrrr)mkdir write_textrdumps)r|out_dirs r write_outputsrsD MM$M. 44@@ 4eA6=Arctj}|jdttdz |jdtt |j }t|jjt|jdz g}t||jtdt|d|jdz y) Nz--exez Hwanse2.exe)typedefaultz --out-dirzsave_selector_gate_paths.jsonzwrote z opcode 0x24 payload rows -> r)argparseArgumentParser add_argumentrROOTOUT parse_argsrr% read_bytesrrrprintr")parserargsr|s rmainrs  $ $ &F dD=4HI  $<    D  $,,!@@"E D$ % F3t9+:4<rsP" 3tH~--/6678PPR H~''* Ul8 -4& F8vB#L s zFr