"""Read-only pinned-image VisitedStarsCache interface and ready-byte references."""
import bisect
import json
import re
import struct
from pathlib import Path
import pefile
image = Path(r'D:/SteamLibrary/steamapps/common/Elite Dangerous/Products/elite-dangerous-odyssey-64/EliteDangerous64.exe')
pe = pefile.PE(str(image), fast_load=True)
pe.parse_data_directories(directories=[pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXCEPTION']])
entries = sorted((e.struct.BeginAddress, e.struct.EndAddress, e.struct.UnwindData) for e in pe.DIRECTORY_ENTRY_EXCEPTION)
starts = [row[0] for row in entries]
def parent(at):
index = bisect.bisect_right(starts, at)-1
if index < 0 or not entries[index][0] <= at < entries[index][1]:
return None
row = entries[index]
for _ in range(16):
header = pe.get_data(row[2], 4)
if not header[0] >> 3 & 4:
return hex(row[0])
row = struct.unpack('<III', pe.get_data(row[2]+4+((header[2]+1)&~1)*2, 12))
return None
tables = {}
for address, count in [(0x52A5158,6),(0x52A5188,32),(0x52A5288,8)]:
tables[hex(address)] = {hex(i*8):hex(struct.unpack('<Q',pe.get_data(address+i*8,8))[0]-pe.OPTIONAL_HEADER.ImageBase) for i in range(count)}
references = []
for section in pe.sections:
if not section.Characteristics & 0x20000000:
continue
data = section.get_data()
for match in re.finditer(rb'\xc6[\x80-\x83\x85-\x87]\x08\x01\x00\x00[\x00\x01]',data):
at = section.VirtualAddress+match.start()
function = parent(at)
if function and 0x2500000 <= int(function,16) < 0x2700000:
references.append(dict(rva=hex(at),parent=function,bytes=match.group().hex(),value=match.group()[-1]))
output = dict(image=image.name,scope='Offline bytes and unwind references only; no game invocation',tables=tables,readyByteWrites=references)
path=Path('artifacts/galaxy-query-research/account-sources/visited-ready-evidence.json')
path.write_text(json.dumps(output,indent=2),encoding='utf-8')
print(json.dumps(output,indent=2))
"""Read-only pinned-image VisitedStarsCache interface and ready-byte references."""
import bisect
import json
import re
import struct
from pathlib import Path
import pefile
image = Path(r'D:/SteamLibrary/steamapps/common/Elite Dangerous/Products/elite-dangerous-odyssey-64/EliteDangerous64.exe')
pe = pefile.PE(str(image), fast_load=True)
pe.parse_data_directories(directories=[pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXCEPTION']])
entries = sorted((e.struct.BeginAddress, e.struct.EndAddress, e.struct.UnwindData) for e in pe.DIRECTORY_ENTRY_EXCEPTION)
starts = [row[0] for row in entries]
def parent(at):
index = bisect.bisect_right(starts, at)-1
if index < 0 or not entries[index][0] <= at < entries[index][1]:
return None
row = entries[index]
for _ in range(16):
header = pe.get_data(row[2], 4)
if not header[0] >> 3 & 4:
return hex(row[0])
row = struct.unpack('<III', pe.get_data(row[2]+4+((header[2]+1)&~1)*2, 12))
return None
tables = {}
for address, count in [(0x52A5158,6),(0x52A5188,32),(0x52A5288,8)]:
tables[hex(address)] = {hex(i*8):hex(struct.unpack('<Q',pe.get_data(address+i*8,8))[0]-pe.OPTIONAL_HEADER.ImageBase) for i in range(count)}
references = []
for section in pe.sections:
if not section.Characteristics & 0x20000000:
continue
data = section.get_data()
for match in re.finditer(rb'\xc6[\x80-\x83\x85-\x87]\x08\x01\x00\x00[\x00\x01]',data):
at = section.VirtualAddress+match.start()
function = parent(at)
if function and 0x2500000 <= int(function,16) < 0x2700000:
references.append(dict(rva=hex(at),parent=function,bytes=match.group().hex(),value=match.group()[-1]))
output = dict(image=image.name,scope='Offline bytes and unwind references only; no game invocation',tables=tables,readyByteWrites=references)
path=Path('artifacts/galaxy-query-research/account-sources/visited-ready-evidence.json')
path.write_text(json.dumps(output,indent=2),encoding='utf-8')
print(json.dumps(output,indent=2))
