import re, struct

exe = open("HAVOC_NOCD.EXE", "rb").read()

pe_off = struct.unpack_from('<I', exe, 0x3c)[0]
img_base = struct.unpack_from('<I', exe, pe_off + 52)[0]
print(f"ImageBase: 0x{img_base:08x}")

# The global byte tested before 'PUSH 6 -> corrupt error'
# Instruction at 0x020270: a0 25 54 47 00 = MOV AL, [0x00475425]
flag_va = 0x00475425
flag_needle = struct.pack('<I', flag_va)

print(f"\n=== All accesses to flag byte at VA=0x{flag_va:08x} ===")
for m in re.finditer(re.escape(flag_needle), exe[0x400:0x067000]):
    off = 0x400 + m.start()
    ctx = exe[max(0x400, off-4):off+6]
    print(f"  0x{off-4:06x}: {ctx.hex(' ')}")

# String VAs with correct ImageBase
rdata_vRVA = 0x079000
rdata_raw   = 0x067000

def rdata_va(fo):
    return img_base + rdata_vRVA + (fo - rdata_raw)

string_fos = {
    'MUSIC.FF':    0x06b27c,
    'INTRFACE.FF': 0x06b288,
    'OBJECTS.FF':  0x06b298,
    'SOUND.FF':    0x06b2a4,
    'BIGFILE.DAT': 0x06b3b8,
    'STRDATA.DAT': 0x06bee8,
    'WORLDS_rel':  0x06b2b0,
    'WORLDS_abs':  0x06b2b8,
    'HAVOCDAT':    0x06b3a8,
    'GAMIMAGE':    0x06b980,
}

print(f"\n=== String VAs and code references ===")
for label, fo in string_fos.items():
    va  = rdata_va(fo)
    needle = struct.pack('<I', va)
    refs = [0x400 + m.start() for m in re.finditer(re.escape(needle), exe[0x400:0x067000])]
    print(f"  {label:<15} VA=0x{va:08x}  refs={len(refs)}")
    for r in refs[:3]:
        ctx = exe[max(0x400,r-6):r+8]
        print(f"    0x{r:06x}: {ctx.hex(' ')}")