XFEEDToolBox

"""Bounded original renderer vtable address references; pinned offline PE only."""
import argparse,bisect,json,re,struct
from pathlib import Path
import pefile
pe=pefile.PE('artifacts/ship-model-reference/client-copy/EliteDangerous64.exe',fast_load=True)
parser=argparse.ArgumentParser(description=__doc__)
parser.add_argument('--minimum',type=lambda value:int(value,0),default=0x551f280)
parser.add_argument('--maximum',type=lambda value:int(value,0),default=0x551f550)
parser.add_argument('--output',type=Path,default=Path('artifacts/galaxy-query-research/palette-resources/physical-vtable-refs.json'))
args=parser.parse_args()
pe.parse_data_directories(directories=[pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXCEPTION']])
entries=sorted((e.struct.BeginAddress,e.struct.EndAddress) for e in pe.DIRECTORY_ENTRY_EXCEPTION)
starts=[x[0] for x in entries];rows=[]
for section in pe.sections:
    if not section.Characteristics&0x20000000:continue
    data=section.get_data()
    for match in re.finditer(rb'[\x40-\x4f]?[\x8d\x8b][\x05\x0d\x15\x1d\x25\x2d\x35\x3d]....',data,re.S):
        rva=section.VirtualAddress+match.start();target=rva+len(match.group())+struct.unpack_from('<i',match.group(),len(match.group())-4)[0]
        if not args.minimum<=target<args.maximum:continue
        index=bisect.bisect_right(starts,rva)-1
        rows.append(dict(rva=hex(rva),target=hex(target),parent=hex(starts[index]) if index>=0 and rva<entries[index][1] else None))
args.output.write_text(json.dumps(rows,indent=2)+'\n')
print(json.dumps(rows,indent=2))