import struct, sys, io, r2pipe
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')

data = open('HAVOC_NOCD.EXE','rb').read()
FO2VA = lambda fo: fo + 0x400C00
VA2FO = lambda va: va - 0x400C00

r2 = r2pipe.open("Z:/Development/devl/Havoc/HAVOC_NOCD.EXE",
                 ["-e", "bin.relocs.apply=true"])

# String at FO 0x6B2D4 = VA 0x46BED4: "DRIVE\0\0\0"
# String at FO 0x6B2DC = VA 0x46BEDC: "D:\"
# String at FO 0x6B2E0 = VA 0x46BEE0: "HAVOC"
drive_va = 0x46bed4
havoc_va = 0x46bee0
dcolon_va = 0x46bedc

print("=== Callers that push DRIVE VA 0x46BED4 or D:\\ VA 0x46BEDC ===")
for target in [drive_va, havoc_va, dcolon_va]:
    for fo in range(0x400, 0x67000):
        if data[fo] == 0x68:
            imm = struct.unpack_from('<I', data, fo+1)[0]
            if imm == target:
                print("  PUSH 0x%08x at FO 0x%05x VA 0x%08x" % (target, fo, FO2VA(fo)))

# Also search for the string "HAVOC" as a MOV target (could be hard-coded path)
print()

# Show the full data block at 0x6B270-0x6B320
print("=== Data at 0x46BE70-0x46BF40 (file list area) ===")
start = VA2FO(0x46be70)
for fo2 in range(start, start + 0xD0, 16):
    chunk = data[fo2:fo2+16]
    hex_part = ' '.join('%02x' % b for b in chunk)
    asc_part = ''.join(chr(b) if 32 <= b < 127 else '.' for b in chunk)
    print("VA 0x%08x: %-47s  %s" % (FO2VA(fo2), hex_part, asc_part))

print()
# Now find what code READS HAVOC.INI DRIVE key
print("=== Callers of SETUP/DRIVE/D:\\ area ===")
setup_va = None
# Find "SETUP" string
pos = data.find(b'SETUP\x00')
while pos != -1:
    print("  'SETUP' at FO 0x%05x VA 0x%08x" % (pos, FO2VA(pos)))
    pos = data.find(b'SETUP\x00', pos+1)

r2.quit()