//----------------------------------------------------------------------------- // Function: loc_ptr() // Author : D // Website : http://www.cinnamonpirate.com/ // Info : A routine to scan for text pointers within a file. It is most // effective on 32-bit pointers. Accuracy with 24-bit pointers or // lower is considerably reduced. // You will need to dump the script, then page throught it for // garbage text. Pointers that were mismatched should manually be // fixed in your pointer list. // // Input : filename as string // text_start as integer // text_end as integer // string_pre as string // Returns : locations of pointers as array // Output : fputs a file of pointer offsets, one per line //----------------------------------------------------------------------------- // Sample str_term: // = chr(0xa) . chr(0x0); // This specifies whatever immediately preceeds the beginning of a new string. // // text_start is the beginning of the region of text to scan // text_end is the end of the region of text to scan // A sample call to this function using Fengshen Ying Jie Zhuan that // yields an error rate of 6:329 // $pointers = loc_ptr("fsyjc.bin", 0x10d4d8, 0x1107f3, chr(0xff)); function loc_ptr($filename, $text_start, $text_end, $str_term) { // Make sure the input is all valid if(count($text_start) != count($text_end)) die("loc_ptr() error: start and end arrays must be equal size!\n"); if(!file_exists($filename)) die("loc_ptr() error: file does not exist\n"); if($text_end > filesize($filename)) die("loc_ptr() error: end offset is larger than input file\n"); if($text_start > $text_end) die("loc_ptr() error: bank start exceeds bank end\n"); // Dump the file to RAM, it's faster than fseeking $fd = fopen($filename, "rb"); $fddump = fread($fd, filesize($filename)); fclose($fd); $i=0; print "Locating string pointers ...\n"; // Scan through the text block and begin looking up pointers while ($text_start < $text_end) { // Try to find the pointer to the current string offset $tmp = strpos($fddump, calc_ptr($text_start)); // If there's a match, store the offset and print a notice if($tmp === FALSE) { $text_start++; $strings[$i] = strpos($fddump, calc_ptr($text_start)); } else { $strings[$i] = $tmp; } print " Found at 0x". dechex($strings[$i]) . "...\n"; // Scan for the next string's start point and loop $text_start = strpos($fddump, $str_term, $text_start) + strlen($str_term); $i++; } // Write the pointers found to a file // If you don't like 'pointers.txt', rename the file here $fo = fopen("pointers.txt", "w"); for ($i=0; $i 0xffffff) // die("calc_ptr() error: value exceeds 24-bit capacity\n"); // $ptr = substr(pack("V", $ptr), 0, 3); // This example adds 0x4100000 to the address for Win32 RAM location // $ptr = pack("V", $ptr + 0x4100000); // This should be a string, not an integer return($ptr); } //-----------------------------------------------------------------------------