Katy sniffer offset finder x86.py

def AsByteStr(s, appendZero=True):
    return (" ".join("%02X" % x for x in map(ord, s))) + (" 00" if appendZero else "")

def GetClientBuild():
    ref = FindBinary(0, SEARCH_DOWN, AsByteStr("<Version>", False));
    if ref == BADADDR:
        raise BaseException("Can't find offset for "+name);
    verStr = GetString(ref, -1, ASCSTR_C);
    result = re.findall("(\d{5})", verStr);
    print(verStr)
    if len(result)==0:
        raise BaseException("Build not found in: " + verStr);
    return result[0];

def GetSendOffset():
    offs = FindBinary(0, SEARCH_DOWN, "55 8B EC 83 EC 14 53 56 8B F1 8D 8E 8C 00 00 00")
    if offs == BADADDR:
        raise BaseException("Can't find Send function")
    return offs

def GetRecvOffset():
    offs = FindBinary(0, SEARCH_DOWN, "55 8B EC FF 05 ?? ?? ?? ?? 56 8B 75 10")
    if offs == BADADDR:
        raise BaseException("Can't find Send function")
    return offs

def GetLocaleOffset():    
    str_offset = FindBinary(0, SEARCH_DOWN, AsByteStr("apft"), 0)
    if str_offset != BADADDR:
        next = DfirstB(str_offset)      # lea     rcx, aApft
        next = NextHead(next)           # call    sub_xxxxxxxxx
        next = NextHead(next)           # or      [rbp+var_40], 2
        next = NextHead(next)           # mov     [rbp+var_34], eax
        next = NextHead(next)           # call    GetLocaleName()
        if GetMnem(next) == "call":
            funcAddr = GetOperandValue(next, 0)
            if funcAddr > 0 and funcAddr < BADADDR:
                movOperand = FirstFuncFchunk(funcAddr)
                if GetMnem(movOperand) == "mov":
                    lang = GetOperandValue(movOperand, 1)
                    if lang > 0 and lang < BADADDR:
                        return lang
                    raise BaseException("Incorrect lang addr: %X" % lang)
                else:        
                    raise BaseException("Incorrect Instruction: " + GetMnem(next))
            else:
                raise BaseException("It's is not func addr: "+str(funcAddr))
        else:
            raise BaseException("Incorrect Instruction: " + GetMnem(next))
    else:
        raise BaseException("Can't find \"apft\"")

send = GetSendOffset()
recv = GetRecvOffset()
lang = GetLocaleOffset()

print("["+GetClientBuild()+"]")
print("send=0x%08X" % (send-0x400000))
print("recv=0x%08X" % (recv-0x400000))
print("lang=0x%08X" % (lang-0x400000))