arcattackandClaude Fable 5
8ed6184d65
The recovered system: fire channels = LBE4ControlsManager buttonGroups (0x40/0x45/0x46/0x47); default groups = the per-mech type-6 controls-map resource in BTL4.RES, installed by the T0 CreateStreamedMappings the port already called -- it needed only the TriggerState attribute (id 0x13 PINNED to the binary value; fireImpulse@0x31C is the binary's TriggerState) and an input feed. Keyboard/harness now push press/release edges into the button groups; the gBT*Trigger bypasses, per-type keyboard split and 1,0 pulse hack are retired -- weapons sharing a button fire TOGETHER (madcat Trigger = 4 weapons). Myomers @4b9550/@4b95b8 misattribution corrected (they are MechWeapon ConfigureMappables/ChooseButton). Verified 2-node: kill through the authentic chain (12 hits vs ~36 pre-groups). Config-mode session (regrouping UI) = the remaining stage, KB-scoped. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
24 lines
942 B
Python
24 lines
942 B
Python
import capstone, struct, sys
|
|
sys.stdout.reconfigure(encoding="utf-8", errors="replace")
|
|
data = open(r"C:/git/bt411/content/BTL4OPT.EXE","rb").read()
|
|
pe = struct.unpack_from("<I", data, 0x3c)[0]
|
|
nsec = struct.unpack_from("<H", data, pe+6)[0]
|
|
opt = pe+24; szopt = struct.unpack_from("<H", data, pe+20)[0]
|
|
sec0 = opt+szopt
|
|
imgbase = struct.unpack_from("<I", data, opt+28)[0]
|
|
secs=[]
|
|
for i in range(nsec):
|
|
off=sec0+i*40
|
|
name=data[off:off+8].rstrip(b"\0").decode()
|
|
vsz,va,rsz,ra=struct.unpack_from("<IIII",data,off+8)
|
|
secs.append((name,va,rsz,ra))
|
|
text=[s for s in secs if s[0]=="CODE"][0]
|
|
va0=imgbase+text[1]; ra0=text[3]
|
|
START=0x4a2400; END=0x4a2d48
|
|
code=data[ra0+(START-va0):ra0+(END-va0)]
|
|
md=capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32); md.detail=False
|
|
for ins in md.disasm(code, START):
|
|
s=f"{ins.mnemonic} {ins.op_str}"
|
|
if "esi" in s or "ebx" in s or "0x4a2d" in s:
|
|
print(f"{ins.address:08x}: {s}")
|