import utils def parse_wave_nodes(cfg,wave: int) -> list: return list(filter(lambda node: node["wave"] == wave,cfg["nodes"])) def parse_procaddr_calls(cfg,wave:int): res = [] wave_nodes:list[dict] = parse_wave_nodes(cfg,wave) for node in wave_nodes: if "syscalls" in node.keys(): for syscall in node["syscalls"]: if syscall["name"] == "KERNEL32.DLL!GetProcAddress": funcname = syscall["arguments"][-1].split("\"")[1] func_addr = syscall["return"] res.append({"name": funcname, "addr": func_addr}) return res def parse_syscalls(cfg,wave: int) -> list[dict[str, str]]: res: list[dict[str,str]] = [] wave_nodes:list[dict] = parse_wave_nodes(cfg,wave) no_repeat = [] for node in wave_nodes: if "syscalls" in node.keys(): for syscall in node["syscalls"]: if node["last_instr"] in no_repeat: continue adress = node["last_instr"] # call is at the end of the basic block name = syscall["name"] current_instruction = node["instructions"][-1]["mnemonic"] no_repeat.append(adress) res.append({"adress":adress,"name":name}) return res def parse_wave_entrypoint(cfg,wave: int) -> int: return int(parse_wave_nodes(cfg,wave)[0]["start"],16) def parse_bb_registers(cfg,wave:int,n_bb:int) -> dict[str,str]: return parse_wave_nodes(cfg,wave)[n_bb]["registers"]