34 lines
No EOL
1,012 B
Python
34 lines
No EOL
1,012 B
Python
from pathlib import Path
|
|
|
|
|
|
def u16(data, off):
|
|
return data[off] | (data[off + 1] << 8)
|
|
|
|
|
|
def u32(data, off):
|
|
return u16(data, off) | (u16(data, off + 2) << 16)
|
|
|
|
|
|
def main():
|
|
data = Path(r'd:\Ghidra\Crusader\REGRET.EXE').read_bytes()
|
|
ne_off = u32(data, 0x3C)
|
|
seg_table_off = ne_off + u16(data, ne_off + 0x22)
|
|
align_shift = u16(data, ne_off + 0x32)
|
|
seg_index = ((0x13F8 - 0x1000) // 8) + 1
|
|
seg_entry_off = seg_table_off + (seg_index - 1) * 8
|
|
seg_base = u16(data, seg_entry_off) << align_shift
|
|
seg_len = u16(data, seg_entry_off + 2) or 0x10000
|
|
reloc_off = seg_base + seg_len
|
|
reloc_count = u16(data, reloc_off)
|
|
|
|
print(f'segment 13F8 base=0x{seg_base:X} reloc=0x{reloc_off:X} count={reloc_count}')
|
|
pos = reloc_off + 2
|
|
for _ in range(reloc_count):
|
|
src = u16(data, pos + 2)
|
|
if 0x20DD <= src <= 0x2157:
|
|
print(f'rec@0x{pos:X} src=0x{src:04X} bytes={data[pos:pos+8].hex(" ")}')
|
|
pos += 8
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main() |