conco/OpenMaidEngine
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

re(frida): write import-map.json (in-table matches; singletons set aside)

Browse Source 
248 module-resident core imports at the RVA 0x16f000 rebuilt IAT
(kernel32/user32/gdi32/winmm/advapi32/ole/oleaut/version/ntdll);
29 singletons set aside. Anchors confirmed: ReadFile/CreateFileA/
SetFilePointer + timeGetTime@0x16f3d4 (=DAT_0056f3d4). d3d9/shell32
etc. are heap-resolved (out of dump) — expected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
gamer147
2026-07-09 09:23:25 -04:00
parent c02e348bf3
commit fa7b48c4da
2 changed files with 53 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
tools/frida/test_map_imports.py
View File

@@ -58,12 +58,22 @@ def test_cluster_runs_groups_contiguous():
"cluster groups contiguous aligned runs, isolates singleton")
def test_select_table_matches_splits_runs_from_singletons():
from map_imports_full import select_table_matches
matches = [(0x100, 0, "a!f"), (0x104, 0, "b!g"), (0x108, 0, "c!h"), (0x200, 0, "d!i")]
runs = [(0x100, 3), (0x200, 1)]
table, singles = select_table_matches(matches, runs, min_run=3)
check(set(table) == {"0x100", "0x104", "0x108"} and set(singles) == {"0x200"},
"run members auto-apply; singleton set aside")
def main():
test_export_index_canonicalizes()
test_export_index_first_name_wins_and_skips_zero()
test_scan_matches_little_endian_aligned()
test_scan_ignores_unaligned()
test_cluster_runs_groups_contiguous()
test_select_table_matches_splits_runs_from_singletons()
print("FAILURES:", len(FAILS))
return 1 if FAILS else 0