21 lines
1.6 KiB
JavaScript
21 lines
1.6 KiB
JavaScript
// Research only; assembly SHA256 c5e02e6e984f7e5577c78b995a8efeee2d06ee22e67d484ad5e859c8bf21e144.
|
|
// Reproduce only the protobuf allocation/empty repeated-field initialization
|
|
// at e3a53ba..e3a5415. Objects are isolated and never sent or synced to a module.
|
|
const m=Process.getModuleByName('GameAssembly.dll');
|
|
const make=new NativeFunction(m.base.add(0x3f629d0),'pointer',['pointer']);
|
|
const encode=new NativeFunction(m.base.add(0x1c8ca3a0),'pointer',['pointer','pointer']);
|
|
let done=false;
|
|
Interceptor.attach(m.base.add(0xdb5f860),{onLeave(){if(done)return;done=true;try{
|
|
const cls=m.base.add(0x988a200).readPointer(),listClass=m.base.add(0x9877108).readPointer();
|
|
if(cls.isNull()||listClass.isNull()||listClass.add(0xb7).readU8()===0)throw Error('Protobuf class prerequisite is not initialized');
|
|
const statics=listClass.add(0x88).readPointer();if(statics.isNull())throw Error('Repeated-field statics are missing');
|
|
const empty=statics.add(8).readPointer();if(empty.isNull())throw Error('Repeated-field empty array is missing');
|
|
const list=make(listClass);list.add(0x10).writePointer(empty);
|
|
const obj=make(cls);obj.add(0x10).writePointer(list);
|
|
for(const offset of [0x20,0x24,0x28]){
|
|
obj.add(offset).writeU32(1);const bytes=encode(obj,ptr(0));if(bytes.isNull())throw Error('No wire bytes');const n=bytes.add(0x18).readU32();if(n>64)throw Error('Isolated wire bound');const data=Array.from(new Uint8Array(bytes.add(0x20).readByteArray(n)));send({kind:'WIRE',offset,bytes:data});obj.add(offset).writeU32(0);
|
|
}
|
|
send({kind:'END'});
|
|
}catch(e){send({kind:'ERROR',error:String(e)});}}});
|
|
send({kind:'ATTACHED',scope:'isolated craft protobufs only'});
|