Update GaCy-GO

tools/find_pe_rip_references.py

@@ -0,0 +1,26 @@
+"""Read-only references to one explicit AMD64 PE RIP-relative data slot."""
+import argparse
+import re
+import struct
+from pathlib import Path
+
+p=argparse.ArgumentParser(description=__doc__)
+p.add_argument('--binary',type=Path,required=True)
+p.add_argument('--target',type=lambda x:int(x,0),required=True)
+a=p.parse_args()
+b=a.binary.read_bytes()
+pe=struct.unpack_from('<I',b,0x3c)[0]
+if b[:2]!=b'MZ' or b[pe:pe+4]!=b'PE\0\0' or struct.unpack_from('<H',b,pe+4)[0]!=0x8664:raise ValueError('Expected AMD64 PE')
+n=struct.unpack_from('<H',b,pe+6)[0];optional=struct.unpack_from('<H',b,pe+20)[0]
+pattern=re.compile(rb'[\x48\x4c][\x8b\x8d][\x05\x0d\x15\x1d\x25\x2d\x35\x3d].{4}',re.S)
+results=[]
+for i in range(n):
+ off=pe+24+optional+i*40
+ virtual,rva,size,raw=struct.unpack_from('<IIII',b,off+8)
+ flags=struct.unpack_from('<I',b,off+36)[0]
+ if not flags&0x20000000:continue
+ for m in pattern.finditer(b[raw:raw+size]):
+  address=rva+m.start()
+  if address+7+struct.unpack_from('<i',m[0],3)[0]==a.target:results.append(address)
+print('\n'.join(hex(x) for x in results[:128]))
+print('references',len(results))