XFE Git
XFE Studio Git
Git 首页 全局搜索
XFE 主站 文档 NuGet

XFEEDToolBox

【WinUI】XFE精英危险工具箱

公开
关注 0 Fork 0 Star 0
UTF-8
"""Bounded static leads for original galaxy boolean-option consumers, no game execution."""
import bisect,json,struct
from pathlib import Path
import pefile
from capstone import Cs,CS_ARCH_X86,CS_MODE_64

image=Path('artifacts/ship-model-reference/client-copy/EliteDangerous64.exe')
p=pefile.PE(str(image),fast_load=True)
p.parse_data_directories(directories=[pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXCEPTION']])
entries=sorted((e.struct.BeginAddress,e.struct.EndAddress,e.struct.UnwindData) for e in p.DIRECTORY_ENTRY_EXCEPTION)
starts=[e[0] for e in entries]
def parent(rva):
    i=bisect.bisect_right(starts,rva)-1
    if i<0 or not entries[i][0]<=rva<entries[i][1]:return None
    row=entries[i]
    for _ in range(16):
        h=p.get_data(row[2],4)
        if not h[0]>>3&4:return row[0]
        row=struct.unpack('<III',p.get_data(row[2]+4+((h[2]+1)&~1)*2,12))
    raise ValueError('Invalid unwind chain')
start=0x3A00000;end=0x3C90000;data=p.get_data(start,end-start)
decoder=Cs(CS_ARCH_X86,CS_MODE_64);rows=[]
for setting in [3]:
    needle=b'\xba'+struct.pack('<I',setting);cursor=0
    while (cursor:=data.find(needle,cursor))>=0:
        rva=start+cursor;cursor+=len(needle)
        instructions=list(decoder.disasm(p.get_data(rva,128),rva))[:25]
        if any(i.mnemonic=='call' and '+ 0x1f0]' in i.op_str for i in instructions):
            owner=parent(rva)
            rows.append(dict(setting=setting,rva=hex(rva),parent=hex(owner) if owner else None,
                instructions=[dict(rva=hex(i.address),instruction=i.mnemonic+' '+i.op_str) for i in instructions]))
out=Path('artifacts/galaxy-query-research/constellations/option-consumer-leads.json')
out.write_text(json.dumps(dict(scope='Static candidate windows only; data flow still requires manual confirmation',range=[hex(start),hex(end)],rows=rows),indent=2),encoding='utf-8')
print(json.dumps(dict(leads=len(rows),functions=sorted(set(r['parent'] for r in rows if r['parent'])))))