This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=11724

BySc, posted Wed Jul 17, 2019 12:32 pm (49354)

---

I want to extract protobins from binar file I have IDA script for older version of the Diablo 3.exe but I need newer version of the script. Is there any way to extract proto files with QuickBMS ?

This code work with older version of the exe file but not work wit new version I added new version of the file.
Link for file: https://drive.google.com/open?id=1vUrIqdcZ7aKVlTaRVAko5-OrBDQNMNQw

Code:

#include 
 
static ReadPushOperand( xref, filter )
{
    do
    {
        auto disasm;
        disasm = GetDisasm( xref );
 
        if ( strstr( disasm, "push" ) > -1 && strstr( substr(disasm, 4, -1), filter ) > -1 )
        {
            break;
        }
       
        xref = PrevHead( xref, PrevFunction( xref ) );
    } while ( 1 );
 
    return GetOperandValue( xref, 0 );
}
 
static ReadSize( xref )
{
    return ReadPushOperand( xref, "h" );
}
 
static ReadAddr( xref )
{
    return ReadPushOperand( xref, "offset" );
}
 
static DumpProtoBins( funcOffset )
{
    auto xref, count, i, file;
    xref = RfirstB( funcOffset );
 
    do
    {
        auto size, addr;
 
        size = ReadSize( xref );
        addr = ReadAddr( xref );
 
        file = fopen(form("protobin%u.protobin", count), "wb");
 
        Message( "file: %s size: 0xX addr: 0xX\n",form("protobin%u.protobin", count), size, addr );
        count  ;
        for(i = 0; i < size;   i)
        {
            fputc(Byte(addr   i), file);
        }
        fclose(file);
    } while ( (xref = RnextB( funcOffset, xref )) != -1 );
}
 
static main()
{
  auto x;
 
   // DescriptorPool::InternalAddGeneratedFile
   // Find function with string:
   // CHECK failed: generated_database_->Add(encoded_file_descriptor, size): 
   //old search
   //x = FindBinary(0, SEARCH_DOWN, "55 8B EC 6A FF 68 ? ? ? ? 64 A1 00 00 00 00 50 83 EC ? A1 ? ? ? ? 33 C5 ? 8D 45 F4 64 A3 00 00 00 00 C7 45 C4 00 00 00 00 E8 ? ? ? ?");
   
   x = FindBinary(0, SEARCH_DOWN, "55 8B EC 6A FF 68 E9 CF E1 3C 64 A1 00 00 00 00 50 83 EC 34 A1 90 2B F9 3C 33 C5 89 45 F0 56 50");
 
  if ( x == BADADDR )
  {
    Message("Can't find DescriptorPool::InternalAddGeneratedFile, aborting...\n");
    return -1;
  }
 
  Message("%X\n", x);
  DumpProtoBins(x);
}