Andoryuuta

ImHex Pattern Optimization Tips

Coming from a background of 010editor binary templates, these are a few optimization tips that I wish I knew from the beginning. These are mentioned in the ImHex docs, but are quite easy to miss if you are just skimming.

Fixed/Static-size Struct Optimization (`[[static]]` == `<optimize=true|false>`)

The [[static]] attribute in ImHex is similar to the <optimize=true|false> attribute in 010 Editor. However, there are a few key differences:

Opt-in vs Opt-out

Getting RE Engine file extension/versions

There is a single function in RE engine that is called with the file extension (UTF16 string), and version (int):

Finding the function

Dump game with x64dbg+scylla, open with IDA Pro/Ghidra/Binja/Radare/whatever and let the auto analysis finish.
Search for a common file type string (e.g. motlist) as UTF16:

Bad DTI inheritance (MHW 15.20.00)

These are all classes which have inherited from a DTI class, but which don't implement their own DTI (+don't override the ::GetDTI virtual method)

DTI name	index	vftable address
CoprocessorObject	0	0x14353a950
CoprocessorObject	1	0x143586060
MtArray	0	0x142f0cff8
MtArray	1	0x142f172a0

Rust Pain Points

A personal list of pain-points, rough edges, ambiguities, etc observed while trying to work on Rust projects (+adject tooling, cargo, crates.io, rust-analyzer, etc). This list is for personal reference, of personal experiences, not for "dunking" on the language or for flame wars. Multiple things in this list might be entirely incorrect / just undocumented.

`-` vs `_` in crate names

The most common pattern for crate names is to use hypens. However, hypens are not valid identifiers in Rust. As such, these get implicitly converted to underscores. If you have a crate named foobar-rs, all references to that package in Rust code will need to use foobar_rs.

At some point in the past, this was an explicit implementation detail, requiring the syntax: extern crate "foobar-rs" as foobar_rs;

	#!/usr/bin/env python3
	import socket
	import ssl
	import time
	from unittest.mock import patch

	def send_truncated_ssl_handshake(target_host='localhost', target_port=9560, truncate_to=None):
	# Get original socket.send before any patching occurs
	original_send = socket.socket.send

	use rquickjs::{Context, Function, Module, Runtime};

	// When this is called from JS, rquickjs will seamlessly handle the conversion from JS values/objects -> rust types.
	// If the types aren't correct, it will throw an exception.
	fn some_rust_fn(cb: Function, arg1: i32, arg2: i32) {
	println!("Rust: some_rust_fn - called with ({arg1}, {arg2})");

	// Call the callback - rquickjs will seamlessly handle the call in the opposite direction as well.
	let result: i32 = cb.call((arg1, arg2)).unwrap();
	println!("Rust: some_rust_fn - JS callback result: {result}");

	scn.21
	pfb.18
	user.3
	uvar.3
	exprgraph.5
	scb.1
	scl.1
	stl.3
	slqg.1
	svx.1

	Class:MHiAIObject, Hash:0x5E6E97F0
	Class:MHiAreaObject, Hash:0x13F84021
	Class:MHiArrayObject, Hash:0x4A2F57B0
	Class:MHiColladaObject, Hash:0x74A65A09
	Class:MHiCollisionObject, Hash:0x3CD665F2
	Class:MHiDevelopObject, Hash:0x3E226FCE
	Class:MHiEffectObject, Hash:0x6773BC46
	Class:MHiGUIObject, Hash:0x3FAF421
	Class:MHiGlobalObject, Hash:0x6787E98A
	Class:MHiInstancingObject, Hash:0x3EA6B848

	import struct
	import os
	from pprint import pprint

	# Terribly slow way of reading null-terminated strings. :)
	def readcstr(f):
	return ''.join(iter(lambda: f.read(1).decode('ascii'), '\x00'))

	#with open('fa2271e63a2ba277.rps', 'rb') as f:
	with open('0x1e157d10.sedbres', 'rb') as f: