import r2pipe, sys, io
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')

r2 = r2pipe.open("Z:/Development/devl/Havoc/HAVOC_NOCD.EXE",
                 ["-e", "bin.relocs.apply=true"])

print("=== 0x464DF1 (heap init) ===")
print(r2.cmd("pd 60 @ 0x464df1"))

print("\n=== 0x464E77 (alloc helper) ===")
print(r2.cmd("pd 60 @ 0x464e77"))

print("\n=== callers of 0x464DF1 (search all CALL rel32) ===")
# search for e8 bytes that target 0x464df1
hits = r2.cmd("/x e8")
# Use r2 search for the exact call bytes
rel = (0x464df1 - 5) & 0xFFFFFFFF  # call displacement = target - (callsite+5)
# search for call targeting 0x464df1: e8 XX XX XX XX where XX = rel32
print(r2.cmd("/ \\xe8\\xf1"))   # rough search prefix
# Better: use radare2's cross-reference after deeper analysis
r2.cmd("aaaa")   # deeper analysis
print("\nxrefs to 0x464df1 (after deeper analysis):")
print(r2.cmd("axt @ 0x464df1"))
print("xrefs to 0x464e77:")
print(r2.cmd("axt @ 0x464e77"))
print("xrefs to 0x4633d1:")
print(r2.cmd("axt @ 0x4633d1"))

r2.quit()