schema-diff.py

"""
Command line tool to diff client opcode schemas generated by the IDA script and remap opcodes from one binary to another.
"""

import json
import sys

import requests
import CppHeaderParser

#### config/settings/garbage

fucked_distance = 0xffffffff
max_size_diff = 10

#### end config shit

if len(sys.argv) != 3:
	print('missing args: [old exe schema] [new exe schema]')
	sys.exit(1)

with open(sys.argv[1]) as f:
	old_schema = json.load(f)

with open(sys.argv[2]) as f:
	new_schema = json.load(f)

# print revs
print('old client rev: %s' % old_schema['clean_rev'])
print('new client rev: %s' % new_schema['clean_rev'])

# fetch name hinting file for old rev
if old_schema['ipcs_file']:
	print('have ipcs_file in client schema, downloading symbols: %s' % old_schema['ipcs_file'])
	ipcs_data = requests.get(old_schema['ipcs_file'])

	if ipcs_data.status_code == 200:
		header = CppHeaderParser.CppHeader(ipcs_data.text, argType="string")

opcodes_found = []

# newlines for the autism
print()

def get_opcode_by_val(enum_name, opcode):
	for enum in header.enums:
		if enum['name'] == enum_name:
			# find enum value
			for val in enum['values']:
				if val['value'] == opcode:
					return val['name']

	return "Unknown"

def find_close_numeric(objs, dest, getter):
	closest = fucked_distance
	closest_obj = None

	for obj in objs:
		val = getter(obj)

		num = abs(val - dest)

		if num < closest:
			closest = num
			closest_obj = obj

	return (closest, closest_obj)

def find_in(objs, expr):
	for obj in objs:
		if expr(obj):
			return obj

	return None

def get_opcodes_str(opcodes):
	return ', '.join([hex(o) for o in opcodes])

def add_match_case(cases, case):
	# check if case already exists

	for c in cases:
		if c['rel_ea'] == case['rel_ea']:
			return

	cases.append(case)

for k, case in enumerate(old_schema['cases']):
	old_opcodes = case['opcodes']
	print('finding opcode(s): %s' % get_opcodes_str(old_opcodes))

	matched_handlers = []

	# see if we can get a match for the relative ea first
	dist, dist_match = find_close_numeric(new_schema['cases'], case['rel_ea'], lambda obj : obj['rel_ea'])

	if dist == fucked_distance:
		print('  got fucked distance, what?')
		continue

	order_match = new_schema['cases'][k]

	size_diff = abs(dist_match['size'] - case['size'])
	#print('  os: %d ns: %d d: %d' % (dist_match['size'], case['size'], size_diff))

	# see if the rva matches for the cases found by the distance and order
	if dist_match['rel_ea'] == order_match['rel_ea'] and size_diff < max_size_diff:

		print('  got order match, size diff: %d < %d' % (size_diff, max_size_diff))

		# check if calls count match in found match & og code
		if len(case['func']['calls']) == len(order_match['func']['calls']):
			print('  has nested callcount match')
			
		add_match_case(matched_handlers, order_match)


	matched = len(matched_handlers)
	if matched == 1:
		# holy shit
		opcodes_found.append((old_opcodes, matched_handlers[0]['opcodes']))
	elif matched > 1:
		print('  found %d matching handlers' % matched)


	#break

# dump found shit
print()

for k, v in enumerate(opcodes_found):
	old, new = v
	print('branch %d' % k)

	old = ', '.join(['%s (%s)' % (hex(o), get_opcode_by_val('ServerZoneIpcType', o)) for o in old])

	print(' - old: %s' % old)
	print(' - new: %s' % get_opcodes_str(new))

print('found %d/%d opcode branches!' % (len(opcodes_found), len(old_schema['cases'])))