This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import x86instructions | |
| import re | |
| def tryint(str, h=10): | |
| if str == "": | |
| return 0; | |
| return int(str, h); | |
| pass | |
| class x86Operand: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| void DumpHandlers(DWORD_PTR baseAddr) | |
| { | |
| int getPtrOffset = 0x257D58; // x86 21463 | |
| typedef DWORD*(*GetPtr)(); | |
| typedef BOOL(__cdecl *CheckOpcode)(WORD); | |
| DWORD* ptrTable = GetPtr(baseAddr + getPtrOffset)(); | |
| DWORD v7 = *ptrTable; | |
| for (const auto& element : opcodeList) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #pragma once | |
| #include <map> | |
| std::map<int, char*> opcodeList = { | |
| { 0x2533, "SMSG_ABORT_NEW_WORLD" }, | |
| { 0x25D2, "SMSG_ACCOUNT_CRITERIA_UPDATE" }, | |
| { 0x26CA, "SMSG_ACCOUNT_DATA_TIMES" }, | |
| { 0x2549, "SMSG_ACCOUNT_MOUNT_UPDATE" }, | |
| { 0x254A, "SMSG_ACCOUNT_TOYS_UPDATE" }, | |
| { 0x26A0, "SMSG_ACHIEVEMENT_DELETED" }, |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import x86instructions | |
| import re | |
| x86Registers = { | |
| # 8 bit | |
| "AL":(8), "CL":(8), "DL":(8), "BL":(8), | |
| "AH":(8), "CH":(8), "DH":(8), "BH":(8), | |
| # 16 bit | |
| "AX":(16),"CX":(16),"DX":(16),"BX":(16), |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import os, re, sys; | |
| import unicodedata | |
| from BeautifulSoup import BeautifulSoup | |
| #reload(sys) | |
| #sys.setdefaultencoding('utf8') | |
| #reload(sys) | |
| #print(sys.getdefaultencoding()) | |
| class HtParser(): |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import db, sys, re, os | |
| immSizes = { "b":8,"w":16,"d":32,"q":64 }; | |
| x86Registers = { | |
| # 8 bit | |
| "AL":(8), "CL":(8), "DL":(8), "BL":(8), | |
| "AH":(8), "CH":(8), "DH":(8), "BH":(8), | |
| # 16 bit | |
| "AX":(16),"CX":(16),"DX":(16),"BX":(16), |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| list = [ | |
| [ "AAA", "37", "", "", False, True, "ASCII Adjust After Addition", "ASCII adjust AL after addition." ], | |
| [ "AAD", "D5 0A", "", "", False, True, "ASCII Adjust AX Before Division", "ASCII adjust AX before division." ], | |
| [ "AAD", "D5 ib", "imm8", "I", False, True, "ASCII Adjust AX Before Division", "Adjust AX before division to number base imm8." ], | |
| [ "AAM", "D4 0A", "", "", False, True, "ASCII Adjust AX After Multiply", "ASCII adjust AX after multiply." ], | |
| [ "AAM", "D4 ib", "imm8", "I", False, True, "ASCII Adjust AX After Multiply", "Adjust AX after multiply to number base imm8." ], | |
| [ "AAS", "3F", "", "", False, True, "ASCII Adjust AL After Subtraction", "ASCII adjust AL after subtraction." ], | |
| [ "ADC", "14 ib", "AL, imm8", "FI", True, True, "Add with Carry", "Add with carry imm8 to AL." ], | |
| [ "ADC", "15 iw", "AX, imm16", "FI", True, True, "Add with Carry", "Add with carry imm16 to AX." ], | |
| [ "ADC", "15 id", "EAX, imm32", "FI", True, True, "Add with Carry", "Add with carry imm32 to EAX." ], |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CMSG opcode handlers | |
| > Opcode: 0x36E2 => Handler: 0x00623FAE CMSG_SUSPEND_COMMS_ACK | |
| > Opcode: 0x36E4 => Handler: 0x0060F2B6 CMSG_AUTH_CONTINUED_SESSION | |
| > Opcode: 0x36E5 => Handler: 0x00623FAE CMSG_PING | |
| > Opcode: 0x36E6 => Handler: 0x006118A7 CMSG_LOG_DISCONNECT | |
| > Opcode: 0x36E7 => Handler: 0x006118A7 CMSG_SUSPEND_TOKEN_RESPONSE | |
| > Opcode: 0x36E8 => Handler: 0x006F81AE CMSG_ENABLE_NAGLE | |
| > Opcode: 0x36E9 => Handler: 0x006118A7 CMSG_QUEUED_MESSAGES_END | |
| > Opcode: 0x36EA => Handler: 0x0060F9E2 CMSG_LOG_STREAMING_ERROR | |
| > Opcode: 0x36EB => Handler: 0x0060F48F CMSG_PROTOCOL_MISMATCH |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| opcode_list = [ | |
| (0x357B, "CMSG_ACCEPT_GUILD_INVITE"), | |
| (0x3463, "CMSG_ACCEPT_LEVEL_GRANT"), | |
| (0x30D8, "CMSG_ACCEPT_TRADE"), | |
| (0x3560, "CMSG_ACCEPT_WARGAME_INVITE"), | |
| (0x341F, "CMSG_ACTIVATE_TAXI"), | |
| (0x3555, "CMSG_ADDON_LIST"), | |
| (0x35E5, "CMSG_ADD_BATTLENET_FRIEND"), | |
| (0x365E, "CMSG_ADD_FRIEND"), | |
| (0x3662, "CMSG_ADD_IGNORE"), |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Yanitta offset's finder | |
| import re | |
| def AsByteStr(s, appendZero=True): | |
| return (" ".join("%02X" % x for x in map(ord, s))) + (" 00" if appendZero else "") | |
| def GetClientBuild(): | |
| ref = FindBinary(0, SEARCH_DOWN, AsByteStr("<Version>", False)); | |
| if ref == BADADDR: | |
| raise BaseException("Can't find offset for "+name); |