XFEEDToolBox

"""Bounded original leaf switch disassembly; no running client access."""
import hashlib
import struct
from pathlib import Path
import pefile
from capstone import Cs, CS_ARCH_X86, CS_MODE_64

image=Path('artifacts/ship-model-reference/client-copy/EliteDangerous64.exe')
pe=pefile.PE(str(image),fast_load=True)
expected='6891f70a021fa9f3a0e00458c284f48d1226e68ae7fc02ad48081aed47857e93'
if hashlib.sha256(image.read_bytes()).hexdigest()!=expected:raise ValueError('Expected pinned source image')
out=Path('artifacts/galaxy-query-research/published-markers/mission-icon-switch.txt')
lines=[f'image_sha256={hashlib.sha256(image.read_bytes()).hexdigest()}']
dis=Cs(CS_ARCH_X86,CS_MODE_64)
for start,size in [(0x3B1C480,0x240),(0x3A4E940,0x80)]:
    lines.append(f'\nrange={start:x}+{size:x}')
    lines.extend(f'{i.address:x}: {i.bytes.hex():<24} {i.mnemonic} {i.op_str}' for i in dis.disasm(pe.get_data(start,size),start))
for marker_type in (4,45):
    target=struct.unpack('<I',pe.get_data(0x3A4EB28+marker_type*4,4))[0]
    leaf=pe.get_data(target,8)
    if leaf[:3]!=b'\x48\x8d\x05' or leaf[7]!=0xC3:raise ValueError('Unexpected icon leaf')
    string_rva=target+7+struct.unpack_from('<i',leaf,3)[0]
    name=pe.get_data(string_rva,128).split(b'\0',1)[0].decode('ascii')
    lines.append(f'markerType={marker_type} tableEntry={0x3A4EB28+marker_type*4:x} target={target:x} string={string_rva:x} name={name}')
out.write_text('\n'.join(lines)+'\n',encoding='utf-8')
print(out)