35 lines
1.2 KiB
Python
35 lines
1.2 KiB
Python
|
from pathlib import Path
|
||
|
|
|
||
|
|
|
||
|
|
def u16(data, off):
|
||
|
|
return data[off] | (data[off + 1] << 8)
|
||
|
|
|
||
|
|
|
||
|
|
def set_bytes(buf, off, blob):
|
||
|
|
buf[off:off+len(blob)] = blob
|
||
|
|
|
||
|
|
|
||
|
|
def set_u16(buf, off, value):
|
||
|
|
buf[off] = value & 0xFF
|
||
|
|
buf[off+1] = (value >> 8) & 0xFF
|
||
|
|
|
||
|
|
|
||
|
|
data = bytearray(Path(r'd:\Ghidra\Crusader\REGRET.EXE').read_bytes())
|
||
|
|
code = bytes.fromhex('55 8b ec 56 57 53 06 a1 2c 71 8b 16 2e 71 0b c2 74 4e c4 5e 06 83 eb 36 26 8b 47 02 d1 e0 d1 e0 c4 1e 30 44 01 c3 26 8b 37 26 8b 7f 02 8b c6 0b c7 74 2d c4 5e 06 26 ff b7 e3 00 26 ff b7 e1 00 26 ff b7 dc 00 26 ff b7 da 00 26 ff b7 d8 00 26 ff b7 d6 00 57 56 52 50 9a f5 02 e0 13 83 c4 14 ff 76 0c ff 76 0a ff 76 08 ff 76 06 9a 8b 03 f0 13 83 c4 08 07 5b 5f 5e 5d cb')
|
||
|
|
set_bytes(data, 0xD2840, code)
|
||
|
|
patches = {
|
||
|
|
0xD2C94: bytes.fromhex('03 00 fb 10 80 00 40 20'),
|
||
|
|
0xD2E0C: bytes.fromhex('03 00 99 20 7d 00 f5 02'),
|
||
|
|
}
|
||
|
|
for off, blob in patches.items():
|
||
|
|
set_bytes(data, off, blob)
|
||
|
|
for rec_off in [0xD2C94,0xD2E0C,0xD2E14,0xD2E1C]:
|
||
|
|
rec = data[rec_off:rec_off+8]
|
||
|
|
src = u16(rec, 2)
|
||
|
|
segidx = rec[4]
|
||
|
|
target_off = u16(rec, 6)
|
||
|
|
selector = 0x1000 + ((segidx - 1) << 3)
|
||
|
|
op_off = 0xD0800 + src
|
||
|
|
set_u16(data, op_off, target_off)
|
||
|
|
set_u16(data, op_off+2, selector)
|
||
|
|
print(data[0xD2840:0xD28DD].hex(' '))
|