26 lines
1.1 KiB
Python
26 lines
1.1 KiB
Python
import struct
|
|
d=open('sots.exe','rb').read(); pe=struct.unpack_from('<I',d,0x3c)[0]
|
|
nsec=struct.unpack_from('<H',d,pe+6)[0]; optsz=struct.unpack_from('<H',d,pe+20)[0]
|
|
secs=[]
|
|
for i in range(nsec):
|
|
o=pe+24+optsz+i*40; vsz,va,rsz,rp=struct.unpack_from('<IIII',d,o+8); secs.append((va,vsz,rp))
|
|
def r2f(rva):
|
|
for va,vsz,rp in secs:
|
|
if va<=rva<va+max(vsz,1): return rp+(rva-va)
|
|
raise Exception(hex(rva))
|
|
irva=struct.unpack_from('<I',d,pe+0x80)[0]; o=r2f(irva)
|
|
want={0x9dd058,0x9dd094,0x9dd098,0x9dd05c,0x9dd034,0x9dd048,0x9dd200,0x9dd0a0,0x9dd0a4,0x9dd050,0x9dd054}
|
|
while True:
|
|
ilt,ts,fc,name,iat=struct.unpack_from('<IIIII',d,o)
|
|
if ilt==0 and iat==0: break
|
|
dll=d[r2f(name):r2f(name)+40].split(b'\0')[0].decode()
|
|
k=0
|
|
while True:
|
|
t=struct.unpack_from('<I',d,r2f((ilt or iat)+k*4))[0]
|
|
if t==0: break
|
|
addr=0x400000+iat+k*4
|
|
if addr in want:
|
|
nm='ord%d'%(t&0xffff) if t&0x80000000 else d[r2f(t)+2:r2f(t)+60].split(b'\0')[0].decode()
|
|
print('0x%08x %s!%s'%(addr,dll,nm))
|
|
k+=1
|
|
o+=20
|