"""Recover the password embedded in HackThisSite App 10 (app10win.exe).

app10win.exe is a VB6 native-code program.  Its event dispatch table
(objdump address 0x404904) routes event 0x3B to the handler at 0x4049E0 -- an
event no control on the form ever fires ("mystery event").  That handler
builds a message box the hard way: every literal character is an immediate
`push 0xNN`, immediately converted into a one-character BSTR VARIANT by
rtcVarBstrFromAnsi (MSVBVM60.DLL ordinal 608, loaded into edi from the IAT
slot ds:0x40104c), and the whole batch is finally concatenated by
__vbaVarCat (IAT slot ds:0x401054) and handed to rtcMsgBox (MSVBVM60.DLL
ordinal 595, IAT slot ds:0x401018).

The run of immediates between the two IAT loads is 38 characters long, but it
is NOT a single string.  The handler contains no string literal at all -- its
only text immediate is the SEH frame pointer 0x4010C6 -- so both the body and
the caption of the box are built character by character.  The reference run of
the patched program shows

    MsgBox "The Password Is: HiddenSecrets", vbInformation, "Correct!"

so the first 30 immediates are the box body and the last 8 ("Correct!") are
its caption; only the 13 characters after the "The Password Is: " marker are
the password HTS wants.  Joining all 38 and stripping the marker yields the
tempting but wrong "HiddenSecretsCorrect!" (the site answers "invalid
password" for it).

Verified against: sha256 cb649beb0fd43fa83c534f58b7444c06b6fbce0db1e7322f2acb4ca9b039f300
"""

import re
import subprocess

EXE = "app10win.exe"
FUNC_START = 0x4049E0  # entry of the event 0x3B handler
FUNC_END = 0x405441    # its `ret`
RNT_FROM_ANSI = 0x40104C  # IAT slot -> MSVBVM60 ordinal 608 rtcVarBstrFromAnsi
VAR_CAT = 0x401054        # IAT slot -> __vbaVarCat
MSG_BOX = 0x401018        # IAT slot -> MSVBVM60 ordinal 595 rtcMsgBox
MARKER = "The Password Is: "
CAPTION = "Correct!"


def disassemble(path):
    """Return the objdump disassembly as a list of (address, mnemonic) pairs."""
    out = subprocess.run(
        ["objdump", "-d", "-M", "intel", path],
        capture_output=True,
        text=True,
        check=True,
    ).stdout
    insns = []
    for line in out.splitlines():
        m = re.match(r"\s*([0-9a-f]+):\t[0-9a-f ]+\t(\S.*)", line)
        if m:
            insns.append((int(m.group(1), 16), m.group(2).strip()))
    return insns


def find_message(insns):
    """Collect the immediate bytes pushed between the two IAT loads."""
    start = end = None
    for addr, text in insns:
        if not (FUNC_START <= addr <= FUNC_END):
            continue
        if start is None and re.search(r"mov\s+edi,DWORD PTR ds:0x%x" % RNT_FROM_ANSI, text):
            start = addr
        elif start is not None and re.search(r"mov\s+edi,DWORD PTR ds:0x%x" % VAR_CAT, text):
            end = addr
            break

    if start is None or end is None:
        raise SystemExit("character-building sequence not found")

    chars = []
    for addr, text in insns:
        if not (start < addr < end):
            continue
        m = re.fullmatch(r"push\s+0x([0-9a-f]+)", text)
        if m:
            chars.append(int(m.group(1), 16))
    return start, end, bytes(chars).decode("latin1")


def split_body_caption(chars):
    """Split the 38 embedded characters into message-box body and caption.

    Both halves are built by the same `push imm8` + rtcVarBstrFromAnsi chain;
    the boundary is the trailing literal caption ("Correct!"), so the body is
    everything before it.
    """
    if not chars.endswith(CAPTION):
        raise SystemExit("unexpected tail: %r" % chars[-len(CAPTION):])
    return chars[: -len(CAPTION)], CAPTION


def main():
    insns = disassemble(EXE)
    start, end, chars = find_message(insns)
    body, caption = split_body_caption(chars)
    print("char sequence   : 0x%x .. 0x%x" % (start, end))
    print("embedded chars  : %r" % chars)
    print("character count  : %d" % len(chars))
    print("msgbox caption  : %r" % caption)
    print("msgbox body     : %r" % body)
    if not body.startswith(MARKER):
        raise SystemExit("body does not start with the marker: %r" % body)
    print("password        : %s" % body[len(MARKER):])


if __name__ == "__main__":
    main()

import shutil

SRC = "app9/app9win.exe"
DST = "app9/app9win_patched.exe"

d = bytearray(open(SRC, "rb").read())


def patch(off, old, new):
    assert d[off:off + len(old)] == old, (hex(off), bytes(d[off:off + len(old)]))
    d[off:off + len(new)] = new
    print("patched file+%#06x: %r -> %r" % (off, old.decode("utf-16-le"), new.decode("utf-16-le")))


# 0x40522c/0x405238/0x405244 是 .text 里的字符串字面量数据，
# 文件偏移 = VA - 0x400000（.text RAW/VMA 都是 0x1000，所以两者相等）
patch(0x522C, "200".encode("utf-16-le"), "100".encode("utf-16-le"))
patch(0x5238, "600".encode("utf-16-le"), "500".encode("utf-16-le"))
patch(0x5244, "1100".encode("utf-16-le"), "1000".encode("utf-16-le"))

open(DST, "wb").write(bytes(d))
print("wrote", DST, len(d), "bytes")

"""Extract the rtcMidCharVar (Mid) index sequence used by HTS App 9's password builder."""
import re

ASM = "out/app9.asm"
LINE = re.compile(r"^\s*([0-9a-f]{6}):\t([0-9a-f ]+)\t(.*)$")

insns = []
for line in open(ASM, encoding="latin1"):
    m = LINE.match(line)
    if m:
        insns.append((int(m.group(1), 16), m.group(3).strip()))


def mid_indices(lo, hi):
    """For every 'call edi' (rtcMidCharVar) in [lo, hi], walk back to the nearest
    small 'push 0xNN' (the charset index) before hitting the previous call."""
    out = []
    for i, (addr, text) in enumerate(insns):
        if not (lo <= addr <= hi):
            continue
        if text.startswith("call") and text.endswith("edi"):
            for j in range(i - 1, -1, -1):
                _, t = insns[j]
                if t.startswith("call"):
                    break
                if t.startswith("push   0x") and "0x405" not in t:
                    v = int(t.split("0x")[1], 16)
                    if v < 0x100:
                        out.append(v)
                        break
    return out


def decode(idx):
    """1-based index into 'abcdefghijklmnopqrstuvwxyz'."""
    return "abcdefghijklmnopqrstuvwxyz"[idx - 1]


for lo, hi, name in ((0x405B9A, 0x405CE0, "label1"),
                     (0x405EAC, 0x4060ED, "label2"),
                     (0x40634D, 0x4064ED, "password")):
    idx = mid_indices(lo, hi)
    print(name, "indices:", " ".join(hex(v) for v in idx))
    print("      letters:", "".join(decode(v) for v in idx))

#!/usr/bin/env python3
"""Static recon script for app8win.exe (HTS Application Mission 8).

The sample is a Visual Basic 6 program compiled to native x86 code.  This
script parses the PE, lists MSVBVM60.DLL imports (name + ordinal), locates the
UTF-16 BSTR string literals VB6 stores in .text, and recovers the immediates
handed to the rtcMidCharVar calls (MSVBVM60.DLL ordinal 632, the runtime
implementation of VB6's Mid$()) inside the digit-check routine.

Run from the directory that holds app8/win/app8win.exe.
"""
import re
import struct

PATH = "app8/win/app8win.exe"
IMAGE_BASE = 0x400000
CHECK_FN = (0x406D40, 0x407740)  # the button/verification routine
RTC_MIDCHARVAR_IAT = 0x401040    # IAT slot, called as "call ebx"

def load():
    data = open(PATH, "rb").read()
    pe = struct.unpack_from("<I", data, 0x3C)[0]
    nsec = struct.unpack_from("<H", data, pe + 6)[0]
    opt_size = struct.unpack_from("<H", data, pe + 20)[0]
    secs = []
    for i in range(nsec):
        off = pe + 24 + opt_size + i * 40
        name = data[off:off + 8].rstrip(b"\0").decode()
        vsize, vaddr, rawsize, rawptr = struct.unpack_from("<IIII", data, off + 8)
        secs.append((name, vaddr, vsize, rawptr, rawsize))
    return data, pe, secs

def rva_of(secs, raw):
    for name, vaddr, vsize, rawptr, rawsize in secs:
        if rawptr <= raw < rawptr + rawsize:
            return vaddr + (raw - rawptr)
    raise ValueError(hex(raw))

def raw_of(secs, rva):
    for name, vaddr, vsize, rawptr, rawsize in secs:
        if vaddr <= rva < vaddr + max(vsize, rawsize):
            return rawptr + (rva - vaddr)
    raise ValueError(hex(rva))

def va_to_raw(secs, va):
    return raw_of(secs, va - IMAGE_BASE)

def imports(data, pe, opt_size):
    """Yield (dll, member, iat_va) for every import."""
    d = pe + 24
    imp_rva, imp_size = struct.unpack_from("<II", data, d + 96 + 8)
    i = 0
    while True:
        ent = raw_of(SECS, imp_rva) + i * 20
        oft, _ts, _fc, name_rva, first = struct.unpack_from("<IIIII", data, ent)
        if name_rva == 0:
            break
        noff = raw_of(SECS, name_rva)
        dll = data[noff:data.index(b"\0", noff)].decode()
        thunk_rva = oft or first
        j = 0
        while True:
            t = struct.unpack_from("<I", data, raw_of(SECS, thunk_rva + j * 4))[0]
            if t == 0:
                break
            if t & 0x80000000:  # by ordinal
                member = "ordinal %d" % (t & 0xFFFF)
            else:
                hint_rva = t & 0x7FFFFFFF
                hoff = raw_of(SECS, hint_rva)
                member = data[hoff + 2:data.index(b"\0", hoff + 2)].decode()
            yield dll, member, IMAGE_BASE + first + j * 4
            j += 1
        i += 1

def bstr(data, secs, va):
    """Read a VB6 string literal: dword length at va-4, UTF-16 data at va."""
    ln = struct.unpack_from("<I", data, va_to_raw(secs, va) - 4)[0]
    raw = va_to_raw(secs, va)
    return data[raw:raw + ln].decode("utf-16-le")

def mid_picks(data, secs):
    """Immediates of the 'push imm8 ; ... ; call ebx' sites where ebx holds the
    rtcMidCharVar (ordinal 632) import.  Returns [(call_va, imm, dest_ebp_offset)]
    in program order, together with the chain boundary (the VarCat concat block).
    """
    lo = va_to_raw(secs, CHECK_FN[0])
    hi = va_to_raw(secs, CHECK_FN[1])
    body = data[lo:hi]
    out = []
    # The compiler emits "lea eax,[ebp-..] ; push eax ; push <index>" at the head
    # of every Mid$() argument block, and the block ends in "call ebx" where ebx
    # was loaded from the rtcMidCharVar IAT slot.
    for m in re.finditer(b"\x50\x6a(.)", body):
        nxt = body.find(b"\xff\xd3", m.end())
        if nxt == -1 or nxt - m.end() > 0x60:
            continue
        if body.find(b"\x50\x6a", m.end()) not in (-1,) and body.find(b"\x50\x6a", m.end()) < nxt:
            continue
        out.append((CHECK_FN[0] + m.start(), m.group(1)[0]))
    return out

data, pe, SECS = load()
print("file %s: %d bytes, %d sections" % (PATH, len(data), len(SECS)))
for name, vaddr, vsize, rawptr, rawsize in SECS:
    print("  %-8s VA %#x vsize %#x raw %#x" % (name, vaddr, vsize, rawptr))
print("\nimports:")
for dll, member, iat in imports(data, pe, pe and 224):
    print("  %#x  %-14s %s" % (iat, dll, member))

LITERALS = {
    "keypad legend": 0x4055E0,
    "digit 1": 0x405608, "digit 2": 0x405610, "digit 3": 0x405618,
    "digit 4": 0x405620, "digit 5": 0x405628, "digit 6": 0x405630,
    "digit 7": 0x405638, "digit 8": 0x405640, "digit 9": 0x405648,
    "ok message": 0x405650, "ok title": 0x40569C, "separator": 0x405694,
    "label caption": 0x40557C,
}
print("\nBSTR literals:")
for what, va in LITERALS.items():
    print("  %#08x  %-14s %r" % (va, what, bstr(data, SECS, va)))

print("\nrtcMidCharVar (ordinal 632) call sites in the check routine:")
picks = mid_picks(data, SECS)
for va, idx in picks:
    print("  %#08x  push %d" % (va, idx))

# The routine builds two concatenations out of Mid$() picks: the first one is
# the value the user input is compared against, the second one feeds the
# "Correct! The Magic Number is: " message.  Split at the VarCat block.
CONCAT_START = 0x407088
chain1 = [i for va, i in picks if va < CONCAT_START]
chain2 = [i for va, i in picks if va > CONCAT_START]
print("\nMid$() picks compared against the input : %s" % chain1)
print("Mid$() picks used in the success message: %s" % chain2)

for src in ("123456789", "987654321"):
    def pick(seq):
        return "".join(src[n - 1] for n in seq)
    print("\nsource string %r" % src)
    print("  check value      %s" % pick(chain1))
    print("  success message  %s-%s" % (pick(chain2[:6]), pick(chain2[6:])))

#!/usr/bin/env python3
"""Recover the HTS Application 7 password from encrypted.enc.

app7win.exe reads the first 5 bytes of encrypted.enc, XORs each of them with a
32-bit key derived from the login input (key = sum of the signed input bytes,
the trailing newline included), accumulates the *full* 32-bit XOR results into
a checksum, and prints "The password is '%s'" only when that checksum equals
0xdca.  Reproducing the checksum lets us solve for the single key that passes
the gate; the same key turns encrypted.enc into the plaintext password.
"""
MASK = 0xffffffff
TARGET = 0xdca                       # cmp [checksum],0xdca in main
enc = open("encrypted.enc", "rb").read(5)


def checksum(key):
    """Windows build: sum of (byte ^ key) as full 32-bit values."""
    total = 0
    for b in enc:
        total = (total + (b ^ key)) & MASK
    return total


def transform(raw, key):
    """Per byte: repeat {buf = buf>>1 | ((buf&1)<<7)} key times, then += 3."""
    out = bytearray()
    for v in raw:
        for _ in range(key):
            v = (v >> 1) | (0x80 if v & 1 else 0)
        out.append((v + 3) & 0xff)
    return bytes(out)


def main():
    key = next(k for k in range(1 << 20) if checksum(k) == TARGET)
    print(f"checksum {TARGET:#x} reached with key = {key} ({key:#x})")
    raw = bytes((b ^ key) & 0xff for b in enc)
    print(f"encrypted.enc[:5] ^ key = {raw.hex()}")
    pw = transform(raw, key)
    print(f"plaintext password = {pw.decode()!r}")
    # any login whose signed-byte sum (newline included) equals key passes the gate
    print(f"login input needs signed-byte sum {key} (newline adds 10)")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Decrypt app6win.exe's self-decrypting .text stub and dump the hidden function.

The PE entry (via FUN_00401000) VirtualProtect()s the .text page to RW, then
XORs 0x33 dwords starting at VA 0x4010d3 with 0xbeefcabe before calling into it.
This script replays that XOR so the real main can be disassembled statically.
"""
import struct

PATH = "app6win.exe"
IMAGE_BASE = 0x400000
# columns: name, RVA, virtual size, raw pointer, raw size (from the PE section table)
SECTIONS = [
    (".text",  0x1000, 0x4ae6, 0x1000, 0x5000),
    (".rdata", 0x6000, 0x087e, 0x6000, 0x1000),
    (".data",  0x7000, 0x1e44, 0x7000, 0x1000),
]
DECRYPT_VA = 0x4010d3
XOR_KEY = 0xbeefcabe
N_DWORDS = 0x33


def va_to_offset(va):
    rva = va - IMAGE_BASE
    for _, rva0, vsize, rawptr, rawsize in SECTIONS:
        if rva0 <= rva < rva0 + max(vsize, rawsize):
            return rawptr + (rva - rva0)
    raise ValueError(f"VA {va:#x} not mapped")


def main():
    data = bytearray(open(PATH, "rb").read())
    off = va_to_offset(DECRYPT_VA)
    for i in range(N_DWORDS):
        p = off + i * 4
        val = struct.unpack_from("<I", data, p)[0]
        struct.pack_into("<I", data, p, val ^ XOR_KEY)
    open("app6_plain.exe", "wb").write(data)
    print(f"decrypted {N_DWORDS} dwords at VA {DECRYPT_VA:#x} (file off {off:#x})")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Recover the site password built by HackThisSite app4win.exe (VB6 native).

The exe is compiled to VB6 *native code*, so the password is not a plain
string constant.  Each character is turned into a BSTR by the runtime
``rtcVarBstrFromAnsi`` and the pieces are glued together by ``__vbaVarCat``.
The code that does this lives inside the button click handlers:

    mov  edi, ds:rtcVarBstrFromAnsi     ; 8b 3d 54 10 40 00
    ; (此处插入 Variant 槽位零初始化指令，把 push 0x50 与首次 call 隔开)
    push 0x50                           ; 'P'  (deliberately spaced away from
    ...                                 ;        the first call by the VB
    call edi                            ;        variant zero-initialisation)
    lea  ecx, [ebp-0x38]
    push 0x61                           ; 'a'
    push ecx
    call edi
    ; (其后为 's' 's' 'w' 'o' 'r' 'd' ... 各字符同模式的 lea/push/call 序列)

Both the button-click handler at 0x402AD0 and the one at 0x403170 build the
same message.  This script walks every ``rtcVarBstrFromAnsi`` chain and prints
the immediates in address order, which is exactly the string handed to the
message box.

usage: ./extract_app4_password.py <exe>
"""
import struct
import sys

RTC = bytes.fromhex('8b3d54104000')   # mov edi, ds:[0x401054]  rtcVarBstrFromAnsi
CAT = bytes.fromhex('8b3d5c104000')   # mov edi, ds:[0x40105c]  __vbaVarCat
CALL_EDI = bytes.fromhex('ffd7')      # call edi
DISPATCH = bytes.fromhex('816c2404')  # sub dword ptr [esp+4], imm32
JMP_REL = 0xe9


def text(data):
    """.text starts at VA 0x401000 / file offset 0x1000 (fixed for this exe)."""
    return data, 0x1000, 0x401000


def chains(data, base_file, base_va):
    """Yield (va, [chars]) for every rtcVarBstrFromAnsi character chain."""
    pos = 0
    while True:
        start = data.find(RTC, pos)
        if start < 0:
            break
        end = data.find(CAT, start)
        if end < 0:
            end = len(data)
        chain_start = start
        chars = []
        for _ in range(64):
            call = data.find(CALL_EDI, start, end)
            if call < 0:
                break
            # the character immediate sits just before the two pushes that
            # feed the call; scan back for a `push imm8` (6a XX)
            off = call
            while off > start:
                if data[off] == 0x6a:
                    val = data[off + 1]
                    if 0x20 <= val <= 0x7e:
                        chars.append((base_va + (off - base_file), val))
                    break
                off -= 1
            start = call + 2
        if chars:
            yield base_va + (chain_start - base_file), chars
        pos = end + 6


def dispatch(data, base_file, base_va):
    """Print the event-id -> handler switch that drives the buttons."""
    pos = 0
    out = []
    while True:
        i = data.find(DISPATCH, pos)
        if i < 0:
            break
        ev = struct.unpack_from('<I', data, i + 4)[0]
        if data[i + 8] == JMP_REL:
            rel = struct.unpack_from('<i', data, i + 9)[0]
            target = base_va + (i - base_file) + 13 + rel
            out.append((base_va + (i - base_file), ev, target))
        pos = i + 13
    return out


def main():
    path = sys.argv[1]
    data = open(path, 'rb').read()
    data, base_file, base_va = text(data)

    print(f'[*] {path}')
    print('[*] event dispatch  (event id -> handler)')
    for va, ev, target in dispatch(data, base_file, base_va):
        print(f'    {va:#08x}  id {ev:#04x}  ->  {target:#08x}')

    for va, chars in chains(data, base_file, base_va):
        s = ''.join(chr(v) for _, v in chars)
        print(f'\n[*] rtcVarBstrFromAnsi chain at {va:#08x}: {len(chars)} chars')
        for cva, val in chars:
            print(f'    {cva:#08x}  push {val:#04x}  {chr(val)!r}')
        print(f'    => {s!r}')


if __name__ == '__main__':
    main()

#!/usr/bin/env python3
"""Patch app4win.exe so the upper button's MouseMove jumps straight to the
click handler that builds the password.

The event dispatcher uses one shared stub per event id; the button events are:

    file off 0x247C   sub [esp+4], 0x33   jmp 0x402590   Form_Load / create
    file off 0x2489   sub [esp+4], 0x37   jmp 0x402750
    file off 0x2496   sub [esp+4], 0x37   jmp 0x402810   upper Button MouseMove
    file off 0x24A3   sub [esp+4], 0x3B   jmp 0x402910
    file off 0x24B0   sub [esp+4], 0x3B   jmp 0x4029D0   lower Button MouseMove
    file off 0x24BD   sub [esp+4], 0x37   jmp 0x402AD0   upper Button Click
    file off 0x24CA   sub [esp+4], 0x3B   jmp 0x403170   lower Button Click

Every time the pointer enters the upper button the MouseMove stub at 0x402810
disables that very button (EnableWindow(hwnd, FALSE)), so it can never be
clicked.  Redirecting its `jmp` (VA 0x40249E, file offset 0x249E) from
0x402810 to the real click handler 0x402AD0 makes the mouse simply "press" it
and the password message box pops up.

usage: ./patch_app4.py <in.exe> <out.exe>
"""
import shutil
import struct
import sys

JMP_FILE_OFF = 0x249E      # `e9 6d 03 00 00`  jmp 0x402810
JMP_END_VA = 0x4024A3      # end of the instruction; rel32 is relative to this
NEW_TARGET = 0x402AD0      # loc_402AD0: the upper button's click handler


def main():
    src, dst = sys.argv[1], sys.argv[2]
    shutil.copyfile(src, dst)
    with open(dst, 'r+b') as f:
        f.seek(JMP_FILE_OFF)
        old = f.read(5)
        assert old[0] == 0xE9, f'expected a jmp rel32, got {old.hex()}'
        rel = NEW_TARGET - JMP_END_VA
        f.seek(JMP_FILE_OFF)
        f.write(b'\xE9' + struct.pack('<i', rel))
    print(f'{src} -> {dst}')
    new = b'\xE9' + struct.pack('<i', rel)
    print(f'  {JMP_FILE_OFF:#06x}: jmp 0x402810  =>  jmp {NEW_TARGET:#x}  ({old.hex()} -> {new.hex()})')


if __name__ == '__main__':
    main()

#!/usr/bin/env python3
"""Rebuild run-time-built password strings from a Xojo/REALbasic native exe.

REALbasic never stores the level password as a plain string constant.  It
builds it one character at a time at run time:

    mov  ecx, 73h        ; 's'
    push ecx
    call StringDBCSChr   ; -> "s"
    ; 每个字符重复 mov/push/call 这三步
    call RuntimeAddString ; append to the message

so the password is invisible to `strings`.  This script finds the
`mov reg,imm32 ; push reg ; call rel32` idiom, groups call sites by call
target, and prints the immediate characters in address order for every
target fed printable bytes.  The really long runs are the built strings.

usage: ./rebuild_schr.py <exe> [min_run_len]
"""
import struct
import sys
from collections import defaultdict


def load(path):
    """Return (image_base, sections, overlay_file_offset, overlay_bytes)."""
    data = open(path, 'rb').read()
    e_lfanew = struct.unpack_from('<I', data, 0x3C)[0]
    assert data[e_lfanew:e_lfanew + 4] == b'PE\0\0'
    coff = e_lfanew + 4
    nsec = struct.unpack_from('<H', data, coff + 2)[0]
    opt_size = struct.unpack_from('<H', data, coff + 16)[0]
    opt = coff + 20
    magic = struct.unpack_from('<H', data, opt)[0]
    image_base = (struct.unpack_from('<I', data, opt + 28)[0] if magic == 0x10b
                  else struct.unpack_from('<Q', data, opt + 24)[0])
    sec = opt + opt_size
    sections = []
    end = 0
    for i in range(nsec):
        s = sec + i * 40
        name = data[s:s + 8].rstrip(b'\0').decode('latin1')
        vsize, va, rawsize, rawptr = struct.unpack_from('<IIII', data, s + 8)
        sections.append((name, image_base + va, vsize, rawptr, rawsize))
        end = max(end, rawptr + rawsize)
    # REALbasic appends its own object code + string table as a file overlay
    return image_base, sections, end, data[end:]


def char_chains(overlay, base_va, gap=0x120):
    # one chain element is ~0x9c bytes: mov imm32 + push + call SChr + setup +
    # call RuntimeAddString, so the SChr sites of one string sit ~150 bytes apart
    """Find `mov r32,imm ; push r32 ; call rel32` sites and chain their chars."""
    by_target = defaultdict(list)
    i = 0
    while True:
        i = overlay.find(b'\xe8', i)                 # call rel32
        if i < 0 or i + 5 > len(overlay):
            break
        if i >= 2 and 0x50 <= overlay[i - 1] <= 0x57:      # push eax..edi
            r = overlay[i - 1] - 0x50
            if i >= 7 and overlay[i - 6] == 0xB8 + r:      # mov reg, imm32
                val = struct.unpack_from('<I', overlay, i - 5)[0]
                if val <= 0xff:
                    rel = struct.unpack_from('<i', overlay, i + 1)[0]
                    by_target[i + 5 + rel].append((i - 6, val))
        i += 1

    # per-call-site thunks: every SChr call goes through its own stub, so the
    # chain must be rebuilt from *all* char sites in address order, not grouped
    # by call target.
    all_sites = sorted(s for sites in by_target.values() for s in sites)
    runs = []
    cur, prev = [], None
    for off, val in all_sites:
        if prev is not None and off - prev > gap:
            if cur:
                runs.append((0, cur))
            cur = []
        cur.append((off, val))
        prev = off
    if cur:
        runs.append((0, cur))
    return runs


def main():
    path = sys.argv[1]
    min_len = int(sys.argv[2]) if len(sys.argv) > 2 else 8
    image_base, sections, ov_off, overlay = load(path)
    base_va = 0x55E000                       # where REALbasic maps its overlay
    print(f'[*] {path}')
    print(f'[*] overlay at file 0x{ov_off:x}, {len(overlay)} bytes, mapped at 0x{base_va:x}')
    for target, run in sorted(char_chains(overlay, base_va), key=lambda r: -len(r[1])):
        if len(run) < min_len:
            continue
        s = ''.join(chr(v) for _, v in run)
        print(f'\n=== run of {len(run)} chars  ->  {s!r} ===')
        for off, val in run:
            print(f'    file {ov_off + off:#08x}  overlay+{off:#06x}  mov reg, {val:#04x}  {chr(val)!r}')


if __name__ == '__main__':
    main()