import dnfile, struct pe = dnfile.dnPE("tuning.exe") net = pe.net data = bytes(pe.__data__) def rva2off(rva): for s in pe.sections: vs=max(s.Misc_VirtualSize,s.SizeOfRawData) if s.VirtualAddress<=rva>24; i=(tok&0xffffff) if t==0x0A and i-1>2; ilstart=off+1 else: # fat header 12 bytes codesize=struct.unpack_from("2 else None raw=il[p:p+sz]; p+=sz if kind=="tok": tok=int.from_bytes(raw,'little'); print(f" {p0:04x}: {nm} {resolve(tok)}") elif kind=="us": tok=int.from_bytes(raw,'little'); print(f" {p0:04x}: {nm} {us(tok)}") elif kind=="br": disp=int.from_bytes(raw,'little',signed=True); print(f" {p0:04x}: {nm} -> {p+disp:04x}") else: val=int.from_bytes(raw,'little',signed=(nm in('ldc.i4','ldc.i4.s'))); print(f" {p0:04x}: {nm} {val} (0x{val&0xffffffff:x})") import sys for nm,rva in [("btnRead_U_Freq_Click",0x5f330),("btnCal_U_Freq_Click",0x5f53c), ("num_U_DigFreq_ValueChanged",0x5f160)]: disasm(rva,nm)