IGS Arcade 逆向系列（二）- 游戏文件恢复

def find_and_make_instrument(start_ea, end_ea):
    image_base = idaapi.get_imagebase()

    current_ea = start_ea
    found_count = 0

    while current_ea < end_ea:
        if current_ea == ida_idaapi.BADADDR:
            break
        address_flags = ida_bytes.get_flags(current_ea)

        if ida_bytes.is_code(address_flags):
            current_ea += ida_bytes.get_item_size(current_ea)
            continue
        else:
            ida_bytes.del_items(0x8052606, 0, 1)
            if ida_ua.can_decode(current_ea):
                print("Decode instruments at 0x{:X}".format(current_ea))
                insn_size = ida_ua.decode_insn(ida_ua.insn_t(), current_ea)
                ida_bytes.del_items(current_ea, 0, insn_size)
                offset = ida_ua.create_insn(current_ea)
                if offset > 0:
                    found_count += 1
                    if idc.get_func_flags(current_ea) != -1:
                        current_ea += offset
                        continue
                else:
                    print("Decode instruments failed at 0x{:X}".format(current_ea))
                    return
            else:
                print("Create instruments failed at 0x{:X}".format(current_ea))
                current_ea += 1
                continue

    print("Search finished, {} instruments created".format(found_count))

find_and_make_instrument(0x080480B4, 0x0808F000)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import json
import ida_funcs
import ida_name
import ida_bytes
import ida_xref
import ida_idaapi
import ida_ua
import ida_segment
import idautils
try:
    import ida_allins
    HAS_ALLINS = True
except ImportError:
    HAS_ALLINS = False

def find_target_function(xref_ea):
    insn = ida_ua.insn_t()
    if not ida_ua.decode_insn(insn, xref_ea):
        return None
    current_func = ida_funcs.get_func(xref_ea)

    search_ea = xref_ea
    
    while search_ea < current_func.end_ea:
        search_ea = ida_bytes.next_head(search_ea, ida_idaapi.BADADDR)
        if search_ea == ida_idaapi.BADADDR:
            break
            
        if not ida_ua.decode_insn(insn, search_ea):
            continue
            
        if insn.itype in [ida_allins.NN_call, ida_allins.NN_callfi, ida_allins.NN_callni]:
            target_ea = insn.ops[0].addr if insn.ops[0].type == ida_ua.o_near else None
            if target_ea:
                target_func_name = ida_name.get_name(target_ea)
                if target_func_name:
                    return target_func_name
                else:
                    func = ida_funcs.get_func(target_ea)
                    if func:
                        return ida_funcs.get_func_name(func.start_ea)
    return None

def get_string_xrefs_with_functions():
    """
    获取IDAPro中所有字符串及其交叉引用信息
    返回JSON格式数据，包含字符串地址、内容、长度和引用它的函数名
    """
    results = []

    # 初始化字符串列表
    strings = idautils.Strings()
    strings.setup()

    print("[+] 开始扫描字符串...")

    for i, string_item in enumerate(strings):
        # 获取字符串基本信息
        str_ea = string_item.ea
        str_length = string_item.length
        str_type = string_item.strtype

        # 获取字符串内容
        try:
            str_content = str(string_item)
        except:
            str_content = ""

        # 获取段信息
        seg = ida_segment.getseg(str_ea)
        if seg:
            seg_start = seg.start_ea
            seg_name = ida_segment.get_segm_name(seg)
            if not seg_name:
                seg_name = f"seg_{seg_start:08X}"
        else:
            seg_start = 0
            seg_name = "unknown"

        # 收集所有引用该字符串的地址
        xref_functions = []

        # 获取段信息
        seg = ida_segment.getseg(str_ea)
        if seg:
            seg_start = seg.start_ea
            seg_name = ida_segment.get_segm_name(seg)
            if not seg_name:
                seg_name = f"seg_{seg_start:08X}"
        else:
            seg_start = 0
            seg_name = "unknown"
        target_functions = []  # 存储目标函数名
        # 使用XrefsTo获取所有引用
        for xref in idautils.XrefsTo(str_ea):
            xref_ea = xref.frm

            # 获取引用地址所在的函数
            func = ida_funcs.get_func(xref_ea)
            if func:
                # 获取函数名
                func_name = ida_funcs.get_func_name(func.start_ea)
                if func_name and func_name not in xref_functions:
                    xref_functions.append(func_name)
                
                # 分析目标函数
                target_func = find_target_function(xref_ea)
                if target_func and target_func not in target_functions:
                    target_functions.append(target_func)
            # else:
            #     # 如果不在函数中，尝试获取该地址的名称
            #     name = ida_name.get_name(xref_ea)
            #     if name and name not in xref_functions:
            #         xref_functions.append(f"@{name}")
            #     else:
            #         # 如果没有名称，使用地址
            #         addr_name = f"addr_0x{xref_ea:X}"
            #         if addr_name not in xref_functions:
            #             xref_functions.append(addr_name)

        # 添加数据引用
        # for xref_ea in idautils.DataRefsTo(str_ea):
        #     func = ida_funcs.get_func(xref_ea)
        #     if func:
        #         func_name = ida_funcs.get_func_name(func.start_ea)
        #         if func_name and func_name not in xref_functions:
        #             xref_functions.append(func_name)
                
        #         # 分析目标函数
        #         target_func = find_target_function(xref_ea)
        #         if target_func and target_func not in target_functions:
        #             target_functions.append(target_func)
        #     else:
        #         name = ida_name.get_name(xref_ea)
        #         if name and name not in xref_functions:
        #             xref_functions.append(f"@{name}")
        #         else:
        #             addr_name = f"addr_0x{xref_ea:X}"
        #             if addr_name not in xref_functions:
        #                 xref_functions.append(addr_name)

        # 创建结果条目
        string_info = {
            "ea": str_ea,
            "str": str_content,
            "len": str_length,
            "seg_addr": seg_start,
            "seg_name": seg_name,
            "xrefs": xref_functions,
            "target_func_name": target_functions  # 新增字段
        }

        results.append(string_info)

        if (i + 1) % 100 == 0:
            print(f"[+] 已处理 {i + 1} 个字符串...")

    print(f"[+] 总共找到 {len(results)} 个字符串")
    return results


def main():
    # 获取并保存字符串信息
    strings_data = get_string_xrefs_with_functions()
    unique_data = []

    for i, string_info in enumerate(strings_data):
        duplicated = False
        if len(string_info['str']) > 10 and string_info['seg_name'] == '.rodata' and string_info['xrefs']:
            for j, string_info1 in enumerate(strings_data):
                if string_info1['str'] == string_info['str'] and string_info['ea'] != string_info1['ea']:
                    print(f"\n{i+1}. 重复内容地址: 0x{string_info['ea']:08X} 0x{string_info1['ea']:08X}  字符串: {repr(string_info1['str'])}")
                    duplicated = True
                    break
            if not duplicated:
                unique_data.append(string_info)
                
    with open("strings_with_xrefs.json", "w") as f:
        json.dump(unique_data, f, ensure_ascii=False, indent=2)
    print(f"\n[+] 分析完成! 总共发现 {len(unique_data)} 个字符串")

if __name__ == "__main__":
    main()

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import json
import ida_bytes
import ida_name
import ida_funcs
import ida_xref
import ida_kernwin
import ida_segment
import idautils
import ida_idaapi
try:
    import ida_allins
    HAS_ALLINS = True
except ImportError:
    HAS_ALLINS = False

def find_target_function(xref_ea):
    insn = ida_ua.insn_t()
    if not ida_ua.decode_insn(insn, xref_ea):
        return None
    current_func = ida_funcs.get_func(xref_ea)

    search_ea = xref_ea
    
    while search_ea < current_func.end_ea:
        search_ea = ida_bytes.next_head(search_ea, ida_idaapi.BADADDR)
        if search_ea == ida_idaapi.BADADDR:
            break
            
        if not ida_ua.decode_insn(insn, search_ea):
            continue
            
        if insn.itype in [ida_allins.NN_call, ida_allins.NN_callfi, ida_allins.NN_callni]:
            target_ea = insn.ops[0].addr if insn.ops[0].type == ida_ua.o_near else None
            if target_ea:
                target_func_name = ida_name.get_name(target_ea)
                if target_func_name:
                    return target_func_name, target_ea
                else:
                    func = ida_funcs.get_func(target_ea)
                    if func:
                        return ida_funcs.get_func_name(func.start_ea), func.start_ea
    return None, None
                    
def process_string_data(json_file_path):
    """
    从JSON文件读取字符串数据，在rodata段搜索字符串，
    跳转到第一个交叉引用的函数，并根据需要重命名函数
    
    参数:
        json_file_path: JSON文件路径
    """
    
    try:
        # 读取JSON文件
        with open(json_file_path, 'r', encoding='utf-8') as f:
            string_data_list = json.load(f)
        
        print(f"成功读取JSON文件，包含 {len(string_data_list)} 个字符串条目")
        
        # 获取.rodata段
        rodata_seg = None
        for seg in idautils.Segments():
            seg_name = ida_segment.get_segm_name(ida_segment.getseg(seg))
            if seg_name == ".rodata":
                rodata_seg = ida_segment.getseg(seg)
                break
        
        if not rodata_seg:
            print("错误：无法找到.rodata段")
            return
        
        print(f"找到.rodata段: 0x{rodata_seg.start_ea:X} - 0x{rodata_seg.end_ea:X}")
        
        # 处理每个字符串条目
        for idx, item in enumerate(string_data_list):
            # print(f"\n[{idx + 1}/{len(string_data_list)}] 处理字符串: '{item['str']}'")
            
            # 在rodata段搜索字符串
            string_to_search = item['str']
            found_ea = search_string_in_segment(string_to_search, rodata_seg)
            
            if found_ea == ida_idaapi.BADADDR:
                # print(f"  未在.rodata段找到字符串 '{string_to_search}'")
                continue
            
            # 获取字符串的交叉引用
            xrefs = get_xrefs_to_address(found_ea)
            
            if not xrefs:
                print(f"  字符串在 0x{found_ea:X} 没有交叉引用")
                continue
            
            print(f"  找到 {len(xrefs)} 个交叉引用")
            
            # 获取第一个交叉引用
            first_xref = xrefs[0]
            
            # 找到包含该交叉引用的函数
            func = ida_funcs.get_func(first_xref)
            if not func:
                print(f"  0x{first_xref:X} 不在任何函数中")
                continue

            target_func_name, target_func_ea = find_target_function(first_xref)
            if target_func_name:
                if target_func_name.startswith('sub_') and item['target_func_name']:
                    rename_function(target_func_ea, item['target_func_name'][0])
                

            func_ea = func.start_ea
            current_func_name = ida_funcs.get_func_name(func_ea)
            
            print(f"  目标函数地址: 0x{func_ea:X}")
            print(f"  当前函数名: {current_func_name}")
            
            # 检查函数是否有自定义名称
            if is_auto_generated_name(current_func_name):
                # 使用JSON中提供的xrefs第一项作为新的函数名
                if 'xrefs' in item and item['xrefs'] and len(item['xrefs']) > 0:
                    new_name = item['xrefs'][0]
                    if rename_function(func_ea, new_name):
                        print(f"  ✓ 函数重命名为: {new_name}")
                    else:
                        print(f"  ✗ 函数重命名失败")
                else:
                    print(f"  未提供xrefs信息，跳过重命名")
            else:
                print(f"  函数已有自定义名称，跳过重命名")
            
            # 跳转到函数
            ida_kernwin.jumpto(func_ea)
            print(f"  已跳转到函数 0x{func_ea:X}")
        
        print(f"\n处理完成！共处理了 {len(string_data_list)} 个字符串条目")
    
    except FileNotFoundError:
        print(f"错误：无法找到文件 {json_file_path}")
    except json.JSONDecodeError as e:
        print(f"错误：JSON文件格式错误 - {e}")
    except Exception as e:
        print(f"错误：处理过程中出现异常 - {e}")

def search_string_in_segment(target_string, segment):
    """
    在指定段中搜索字符串
    
    参数:
        target_string: 要搜索的字符串
        segment: 目标段
    
    返回:
        找到的地址，如果未找到则返回BADADDR
    """
    start_ea = segment.start_ea
    end_ea = segment.end_ea
    
    # 尝试搜索字符串
    found_ea = ida_bytes.find_string(
        target_string,
        start_ea,
        range_end=end_ea,
        flags=ida_bytes.BIN_SEARCH_FORWARD | ida_bytes.BIN_SEARCH_NOSHOW
    )
    
    # 如果在段范围内找到，返回地址
    if found_ea != ida_idaapi.BADADDR and start_ea <= found_ea < end_ea:
        return found_ea
    
    return ida_idaapi.BADADDR

def get_xrefs_to_address(ea):
    """
    获取指向指定地址的所有交叉引用
    
    参数:
        ea: 目标地址
    
    返回:
        交叉引用地址列表
    """
    xrefs = []
    
    # 获取数据引用
    for xref in idautils.DataRefsTo(ea):
        xrefs.append(xref)
    
    # 获取代码引用
    for xref in idautils.CodeRefsTo(ea, 0):
        xrefs.append(xref)
    
    return xrefs

def is_auto_generated_name(func_name):
    """
    检查函数名是否为自动生成的名称
    
    参数:
        func_name: 函数名
    
    返回:
        True 如果是自动生成的名称，False 否则
    """
    # IDA自动生成的函数名通常以sub_、loc_、unk_等开头
    auto_prefixes = ['sub_', 'loc_', 'unk_', 'nullsub_', 'j_']
    
    for prefix in auto_prefixes:
        if func_name.startswith(prefix):
            return True
    
    return False

def rename_function(func_ea, new_name):
    """
    重命名函数
    
    参数:
        func_ea: 函数地址
        new_name: 新函数名
    
    返回:
        True 如果重命名成功，False 否则
    """
    try:
        # 使用ida_name.set_name设置函数名
        result = ida_name.set_name(func_ea, new_name, ida_name.SN_CHECK)
        return result
    except Exception as e:
        print(f"重命名函数时出错: {e}")
        return False

def main():
    """
    主函数 - 提示用户选择JSON文件并开始处理
    """
    # 获取JSON文件路径
    json_file = ida_kernwin.ask_file(0, "*.json", "选择包含字符串数据的JSON文件")
    
    if json_file:
        print(f"开始处理文件: {json_file}")
        process_string_data(json_file)
    else:
        print("未选择文件，操作取消")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3

import os
import argparse

def main():
    parser = argparse.ArgumentParser(description='Recover game from IGS E2000 platform')
    parser.add_argument('head_file', type=str, help='head file to read')
    parser.add_argument('rc_dir', type=str, help='game parts dir to read')
    parser.add_argument('game_file', type=str, help='game file to write')
    args = parser.parse_args()

    rc_order = "213584769"
    rc_order_len = len(rc_order)
    block_num = 400
    ignore_count = 7
    step_type = 2

    head = open(args.head_file, 'rb').read()
    with open(args.game_file, 'wb') as game_fd:
        game_fd.write(head)
        for i in range(rc_order_len):
            rc_file_path = os.path.join(args.rc_dir, f"rc{rc_order[i]}.d")
            rc_data = open(rc_file_path, 'rb').read()
            rc_data_size = len(rc_data)
            write_size = rc_data_size - block_num * 1024
            print(f"rc{rc_order[i]}.d size: 0x{rc_data_size:08X}, write 0x{write_size:08X} bytes to game file, write block {int(write_size/1024)} skip block_num: {block_num}")

            # head = head + rc_data[0:write_size]

            if step_type == 2:
                block_num -= ignore_count
            else:
                block_num += ignore_count
            game_fd.write(rc_data[0:write_size])

if __name__ == "__main__":
    main()