import r2pipe, sys, io, struct
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')

BINARIES = [
    ("HAVOC_NOCD.EXE", "patched"),
    ("HAVOC.EXE",      "original"),
]

for fname, label in BINARIES:
    print("\n" + "="*60)
    print("  %s  [%s]" % (fname, label))
    print("="*60)
    try:
        r2 = r2pipe.open("Z:/Development/devl/Havoc/" + fname,
                         ["-e", "bin.relocs.apply=true"])

        # Binary info
        info = r2.cmd("ij").strip()[:80]
        print("Binary: %s..." % info[:120])

        # Check value at 0x480964 (heap handle in .data)
        v = r2.cmd("p4 @ 0x480964").strip()
        print("\n[0x480964] (heap handle, raw bytes): %s" % v)

        # Entry point
        ep = r2.cmd("ie~[2]").strip()
        print("Entry point VA: %s" % ep)

        # Disassemble entry point
        print("\n--- Entry point ---")
        print(r2.cmd("pd 20 @ entry0"))

        # Disassemble 0x464DCA (first non-trivial call in startup)
        print("\n--- 0x464DCA (CRT startup call) ---")
        print(r2.cmd("pd 30 @ 0x464DCA"))

        # Disassemble 0x465BD3 (global ctor runner candidate)
        print("\n--- 0x465BD3 ---")
        print(r2.cmd("pd 30 @ 0x465BD3"))

        # Search for writes to 0x480964
        print("\n--- xrefs to 0x480964 ---")
        print(r2.cmd("axt @ 0x480964"))

        r2.quit()
    except Exception as e:
        print("ERROR: %s" % e)