arcattackandClaude Fable 5
a652ddcdbc
Binary ctor @0x4a26a7-0x4a26ef: mech+0x768/76c/770 <- raw record words 0x26/0x27/0x28 (UpdatePositionDiffrence / UpdateTurnVelocityDiffrence / UpdateTurnDegreeDiffrence x pi/180 [const @0x4a2d44]). Read at RAW record offsets -- the Mech__ModelResource struct is layout-skewed (field98 gave -1.5 where the record holds 0.3; audit filed as task #4, also explains the old forwardCycleRate "floor 25" hack). Sender triggers now use the authored constants: pos-deadband type 0, quat-Y delta + yaw-rate delta + stopped-turn edge type 4 (binary @0x4aad35/@0x4aac2b/@0x4aac6c). Verified 2-node: madcat streams 0.3/0.045/3deg, type-4 spam gone, walking replicant clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
40 lines
1.7 KiB
Python
40 lines
1.7 KiB
Python
import capstone, struct, sys
|
|
sys.stdout.reconfigure(encoding="utf-8", errors="replace")
|
|
data = open("../content/BTL4OPT.EXE","rb").read()
|
|
# established mapping (from dis_4b2980.py usage): file offset = VA - 0x400000 - 0xc00 adjustments;
|
|
# use the section table: .text typically RVA 0x1000, raw 0x400/0x600. Recover from PE header.
|
|
pe = struct.unpack_from("<I", data, 0x3c)[0]
|
|
nsec = struct.unpack_from("<H", data, pe+6)[0]
|
|
opt = pe+24; szopt = struct.unpack_from("<H", data, pe+20)[0]
|
|
sec0 = opt+szopt
|
|
imgbase = struct.unpack_from("<I", data, opt+28)[0]
|
|
secs=[]
|
|
for i in range(nsec):
|
|
off=sec0+i*40
|
|
name=data[off:off+8].rstrip(b"\0").decode()
|
|
vsz,va,rsz,ra=struct.unpack_from("<IIII",data,off+8)
|
|
secs.append((name,va,rsz,ra))
|
|
text=[s for s in secs if s[0]=="CODE"][0]
|
|
va0=imgbase+text[1]; ra0=text[3]; n=text[2]
|
|
md=capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32)
|
|
md.detail=True
|
|
code=data[ra0:ra0+n]
|
|
hits=[]
|
|
# quick byte-pattern prescan for disp32 0x768/0x76c/0x770 little-endian
|
|
import re
|
|
for target,label in [(0x768,"0x768"),(0x76c,"0x76c"),(0x770,"0x770")]:
|
|
pat=struct.pack("<I",target)
|
|
for m in re.finditer(re.escape(pat),code):
|
|
start=max(0,m.start()-8)
|
|
for ins in md.disasm(code[start:m.start()+12], va0+start):
|
|
if ins.op_str and label in ins.op_str and ("ptr [" in ins.op_str):
|
|
# writes: mov [reg+disp], src OR fstp
|
|
if ins.mnemonic in ("mov","fstp","fst") and ins.op_str.index("[")<ins.op_str.index(","):
|
|
hits.append((ins.address,f"{ins.mnemonic} {ins.op_str}"))
|
|
elif ins.mnemonic in ("fld","fcomp","fcom","mov") :
|
|
pass
|
|
seen=set()
|
|
for a,t in sorted(hits):
|
|
if (a,t) not in seen:
|
|
seen.add((a,t)); print(f"0x{a:x}: {t}")
|