XFEEDToolBox

"""Bounded static leads for the single original 5F05E6C provider."""
import hashlib,json,re,struct
from pathlib import Path
import pefile
from capstone import Cs,CS_ARCH_X86,CS_MODE_64
path=Path('artifacts/ship-model-reference/client-copy/EliteDangerous64.exe')
raw=path.read_bytes();assert hashlib.sha256(raw).hexdigest()=='6891f70a021fa9f3a0e00458c284f48d1226e68ae7fc02ad48081aed47857e93'
p=pefile.PE(data=raw,fast_load=True);base=p.OPTIONAL_HEADER.ImageBase;decoder=Cs(CS_ARCH_X86,CS_MODE_64)
out=Path('artifacts/galaxy-query-research/allegiance-definitions');out.mkdir(parents=True,exist_ok=True)
getters=[]
for section in p.sections:
    if not section.Characteristics&0x20000000:continue
    data=section.get_data();start=section.VirtualAddress
    for m in re.finditer(rb'\x8b\x05....\x89\x02\x48\x8b\xc2\xc3',data,re.S):
        rva=start+m.start();target=rva+6+struct.unpack_from('<i',m.group(),2)[0]
        if target==0x5F05E6C:getters.append(rva)
tables=[]
for getter in getters:
    for section in p.sections:
        if section.Characteristics&0x20000000:continue
        data=section.get_data();needle=struct.pack('<Q',base+getter);at=0
        while (at:=data.find(needle,at))>=0:
            rva=section.VirtualAddress+at;at+=8
            slots=[]
            for offset in range(-0x60,0x88,8):
                value=struct.unpack('<Q',p.get_data(rva+offset,8))[0]-base
                slots.append(dict(offset=hex(offset),value=hex(value)))
            tables.append(dict(getter=hex(getter),slotRva=hex(rva),nearbySlots=slots))
result=dict(runtimeNeutral=True,gameProcessAccess=False,gameCalls=0,imageSha256=hashlib.sha256(raw).hexdigest(),typeIdGlobal='0x5f05e6c',getters=[hex(r) for r in getters],tables=tables)
(out/'provider-leads.json').write_text(json.dumps(result,indent=2)+'\n',encoding='utf8');print(json.dumps(result,indent=2))