XFEEDToolBox

"""Read only string references to the wallet parser in the pinned game image."""
import json,pathlib,re,sys,pefile,bisect
sys.stdout.reconfigure(encoding='utf8')
path=pathlib.Path(r'D:/SteamLibrary/steamapps/common/Elite Dangerous/Products/elite-dangerous-odyssey-64/EliteDangerous64.exe')
pe=pefile.PE(str(path),fast_load=True);data=path.read_bytes();targets={}
for term in [b'total_balance',b'/arcs/balance',b'arcsBalance',b'ArcsBalance',b'Arcs',b'ARX',b'GetBalance',b'WalletBalance']:
    found=[]
    for match in re.finditer(re.escape(term),data):
        rva=pe.get_rva_from_offset(match.start());found.append(hex(rva));targets[rva]=term.decode()
    print(term.decode(),found[:18])
text=next(s for s in pe.sections if s.Name.rstrip(b'\0')==b'.text');code=data[text.PointerToRawData:text.PointerToRawData+text.SizeOfRawData];refs=[]
for m in re.finditer(rb'[\x48\x4c]\x8d[\x05\x0d\x15\x1d\x25\x2d\x35\x3d](....)',code,re.S):
    rva=text.VirtualAddress+m.start();dest=rva+7+int.from_bytes(m.group(1),'little',signed=True)
    if dest in targets:refs.append({'rva':rva,'target':dest,'string':targets[dest]})
pe.parse_data_directories(directories=[pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXCEPTION']]);functions=sorted((e.struct.BeginAddress,e.struct.EndAddress) for e in pe.DIRECTORY_ENTRY_EXCEPTION);starts=[x[0] for x in functions]
for ref in refs:
    i=bisect.bisect_right(starts,ref['rva'])-1;ref['function']=functions[i][0] if i>=0 else None
out=pathlib.Path('artifacts/refit-0411-qa/wallet-xrefs.json');out.write_text(json.dumps(refs,indent=2),encoding='utf8');print(json.dumps(refs[:35]))