#!/usr/bin/env python3 import argparse import macresources import sys import struct import string OKCHARS = string.ascii_letters + string.digits + "_%" def addr(seg): return 0x100000 * seg parser = argparse.ArgumentParser() parser.add_argument("src", help="rdump file") parser.add_argument("dest", help="binary dest (may also create .txt file)") args = parser.parse_args() with open(args.src, "rb") as f: d = f.read() if f.name.endswith(".rdump"): resources = list(macresources.parse_rez_code(d, original_file=f.name)) else: resources = list(macresources.parse_file(d)) resources = [r for r in resources if r.type == b"CODE" and r.id >= 0] resources.sort(key=lambda r: r.id) if not resources or resources[0].id != 0: sys.exit("CODE 0 not found in %s" % args.src) jt_resource, *other_resources = resources jump_table = {} # a5_ofs: (segnum, seg_ofs) (jt_size, a5_offset_of_jt) = struct.unpack_from(">LL", jt_resource, 8) thirtytwo = False for jt_ofs in range(16, 16 + jt_size, 8): if jt_resource[jt_ofs : jt_ofs + 8] == b"\x00\x00\xff\xff\x00\x00\x00\x00": thirtytwo = True continue if thirtytwo: segnum, be_a9f0, ofs = struct.unpack_from(">HHL", jt_resource, jt_ofs) if be_a9f0 != 0xA9F0: raise ValueError("32-bit jt") jump_table[jt_ofs - 16 + a5_offset_of_jt + 2] = (segnum, ofs) else: ofs, be_3f3c, segnum, be_a9f0 = struct.unpack_from(">HHHH", jt_resource, jt_ofs) if be_3f3c != 0x3F3C or be_a9f0 != 0xA9F0: raise ValueError("16-bit jt") jump_table[jt_ofs - 16 + a5_offset_of_jt + 2] = (segnum, ofs) # From https://github.com/elliotnunn/mps/blob/master/stacktrace.go def macsbug_syms(blob): bigmv = memoryview(blob) for i in range(0, len(blob) - 2, 2): try: mv = bigmv[i:] # RTS or JMP(A0) if mv[:2] == b"\x4e\x75" or mv[:2] == b"\x4e\xd0": j = i + 2 # RTD # elif mv[:3] == b"\x4e\x74\x00": j = i + 4 # Not the end of a procedure else: continue mv = bigmv[j:] # "Old style" MacsBug symbol format # Haven't done the MacApp format if 0x20 <= mv[0] & 0x7F <= 0x7F and 0x20 <= mv[1] <= 0x7F: k = j + 1 ln = 8 # Apple Compiler symbol elif mv[0] == 0x80 and mv[1] != 0: k = j + 2 ln = mv[1] # Apple Compiler symbol elif 0x81 <= mv[0] <= 0x9F: k = j + 1 ln = mv[0] & 0x7F # No MacsBug string else: continue s = bytes(bigmv[k : k + ln]) # Sanitise the string if is_mxbg_str(s): yield i, k, s.decode("ascii") except IndexError: pass def is_mxbg_str(s): for c in s: if not ((ord("a") <= c <= ord("z")) or (ord("A") <= c <= ord("Z")) or (ord("0") <= c <= ord("9")) or c in (ord(" "), ord("%"), ord("_"))): return False return True def unpack_relocs(blob): # blob = memoryview(blob) while True: if blob[:2] == b"\x00\x00": break elif blob[0] == 0 and blob[1] & 0x80: yield ((blob[1] << 25) + (blob[2] << 17) + (blob[3] << 9) + (blob[4] << 1)) & 0xFFFFFFFF blob = blob[5:] elif blob[0] & 0x80: yield ((blob[0] << 9) + (blob[1] << 1)) & 0xFFFF blob = blob[2:] else: yield blob[0] << 1 blob = blob[1:] with open(args.dest + ".py", "w") as idascript: # Find MacsBug symbols namedict = {} for r in other_resources: targets = set(ofs for seg, ofs in jump_table.values() if seg == r.id) for rtsoffset, stringoffset, name in macsbug_syms(r): print(f"idaapi.make_ascii_string({addr(r.id)+stringoffset:#X}, {(len(name)+2)&~1}, ASCSTR_C)", file=idascript) print(f"set_cmt({addr(r.id)+stringoffset:#X}, 'MacsBug symbol', 0)", file=idascript) for funcoffset in reversed(range(0, rtsoffset, 2)): inst = bytes(r[funcoffset : funcoffset + 2]) if inst in (b"\x4E\x75", b"\x4E\x74", b"\x4E\xD0"): break # encountered a func-end if funcoffset in targets or inst == b"NV": namedict[addr(r.id) + funcoffset] = name break interseg_calls = {} for r in other_resources: # 32-bit segment if r[:2] == b"\xFF\xFF": a5relocs, pcrelocs = struct.unpack_from(">LxxxxL", r, 0x14) ofs = 0 for reloc in unpack_relocs(r[a5relocs:]): ofs = (ofs + reloc) & 0xFFFFFFFF # reloc can be negative! (a5offset,) = struct.unpack_from(">L", r, ofs) # Instead of hacking IDA to treat xxxx(A5) as a function address, # just stuff the actual function address in the JMP target if a5offset in jump_table: target_seg, target_seg_offset = jump_table[a5offset] target_addr = addr(target_seg) + target_seg_offset struct.pack_into(">L", r, ofs, target_addr) ofs = 0 for reloc in unpack_relocs(r[pcrelocs:]): ofs = (ofs + reloc) & 0xFFFFFFFF # reloc can be negative! (target_addr,) = struct.unpack_from(">L", r, ofs) target_addr += addr(r.id) struct.pack_into(">L", r, ofs, target_addr) # 16-bit segment else: for i in range(0, len(r) - 3, 2): if r[i : i + 2] in (b"\x4e\xad", b"\x48\x6d") or (r[i] == 0x41 and r[i + 1] & 0xF8 == 0xE8): (targ,) = struct.unpack_from(">h", r, i + 2) if targ > 0: interseg_calls.setdefault(targ, []).append(addr(r.id) + i) # Make some neat names for the segments... segnames = {} for r in other_resources: if r.name: segnames[r.id] = "".join(c for c in r.name if c in (string.ascii_letters + string.digits)) else: segnames[r.id] = f"seg_{r.id:X}" for a5_ofs, (segnum, ofs) in jump_table.items(): bigboy_ofs = addr(segnum) + ofs cool_name = f"{segnames[segnum]}$" if bigboy_ofs in namedict: cool_name += namedict[bigboy_ofs] del namedict[bigboy_ofs] else: cool_name += f"{bigboy_ofs:X}" print(f'MakeFunction(0x{bigboy_ofs:X}); MakeName(0x{bigboy_ofs:X}, "{cool_name}")', file=idascript) for caller in interseg_calls.get(a5_ofs, []): print(f'MakeCode(0x{caller:X}); op_man(0x{caller:X}, 0, "{cool_name}")', file=idascript) for bigboy_ofs, name in sorted(namedict.items()): cool_name = f"{segnames[bigboy_ofs >> 20]}${name}" print(f'MakeFunction(0x{bigboy_ofs:X}); MakeName(0x{bigboy_ofs:X}, "{cool_name}")', file=idascript) bigboy = bytearray() for r in other_resources: bigboy.extend(bytes(addr(r.id) - len(bigboy))) bigboy.extend(r) with open(args.dest, "wb") as f: f.write(bigboy)