@ecopoesis/homebridge-dmx 0.1.0

package/tools/ghidra/dump-authenticate.py

@@ -0,0 +1,71 @@
+# Decompile HWM's XHL_DasNetDevice::authenticate() and the LSAG_ALL handshake
+# builder (LSAG_ALL is inline in code at 0x1001f233b). This is the 0x47/0x48
+# TCP-auth handshake our send_dmx is failing (0x48 reply status 100 vs 0).
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-auth')
+try: os.makedirs(OUT)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+rm = prog.getReferenceManager()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface(); decomp.openProgram(prog)
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def decompile(f):
+    r = decomp.decompileFunction(f, 240, monitor)
+    return r.getDecompiledFunction().getC() if r.decompileCompleted() else '(decompile failed)\n'
+
+seen = set()
+summary = open(os.path.join(OUT, 'SUMMARY.txt'), 'w')
+
+def dump(f, tag, with_callees=False):
+    if f is None: return
+    ep = str(f.getEntryPoint())
+    if ep in seen: return
+    seen.add(ep)
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:70]
+    callees = sorted(set(f.getCalledFunctions(monitor)),
+                     key=lambda x: str(x.getEntryPoint()))
+    with open(os.path.join(OUT, '%s_%s_%s.txt' % (tag, ep, safe)), 'w') as o:
+        o.write('==== %s @ %s (%d bytes) ====\n' %
+                (f.getName(True), ep, f.getBody().getNumAddresses()))
+        o.write('callees:\n')
+        for c in callees:
+            o.write('  %s @ %s\n' % (c.getName(True), c.getEntryPoint()))
+        o.write('\ncallers:\n')
+        for c in sorted(set(f.getCallingFunctions(monitor)), key=lambda x: str(x.getEntryPoint())):
+            o.write('  %s @ %s\n' % (c.getName(True), c.getEntryPoint()))
+        o.write('\n' + decompile(f))
+    summary.write('  %s : %s @ %s  (%d callees)\n' % (tag, f.getName(True), ep, len(callees)))
+    if with_callees:
+        for c in callees:
+            nm = c.getName(True)
+            if nm.startswith('_') or 'std::' in nm or 'operator' in nm: continue
+            dump(c, tag + '_callee', False)
+
+# 1. the LSAG_ALL builder — function containing the inline "LSAG_ALL" bytes
+f = fm.getFunctionContaining(addr(0x1001f233b))
+summary.write('=== LSAG_ALL inline @ 0x1001f233b ===\n')
+dump(f, '1_lsag_builder', with_callees=True)
+
+# 2. XHL_DasNetDevice::authenticate() — xref the assert string at 0x1007ffeef
+summary.write('\n=== authenticate() (string xref 0x1007ffeef) ===\n')
+for r in rm.getReferencesTo(addr(0x1007ffeef)):
+    dump(fm.getFunctionContaining(r.getFromAddress()), '2_authenticate', with_callees=True)
+
+# 3. "Configuring Capsens Security" string xref @ 0x1007b84b4
+summary.write('\n=== Capsens Security (0x1007b84b4) ===\n')
+for r in rm.getReferencesTo(addr(0x1007b84b4)):
+    dump(fm.getFunctionContaining(r.getFromAddress()), '3_capsens', with_callees=True)
+
+summary.write('\n=== total: %d ===\n' % len(seen))
+summary.close()
+print('dump-authenticate: %d functions -> %s' % (len(seen), OUT))

package/tools/ghidra/dump-block-cipher.py

@@ -0,0 +1,88 @@
+# Dump the actual block cipher (AES?) under CBC and CFB modes.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out16')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 360, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+ROOTS = {
+    'CFB_block_FUN_1003f4690':  0x1003f4690,
+    'CBC_block_FUN_1003f5980':  0x1003f5980,
+    'CFB_helper_FUN_1003f4660': 0x1003f4660,
+    'preencrypt_FUN_100107a30': 0x100107a30,
+}
+
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+
+for label, fp in ROOTS.items():
+    f = fm.getFunctionAt(addr(fp)) or fm.getFunctionContaining(addr(fp))
+    if f is None:
+        summary.write('  %s 0x%x  (no fn)\n' % (label, fp))
+        continue
+    summary.write('  %-30s = %s @ %s  size=%d  callees=%d\n' %
+                  (label, f.getName(True), f.getEntryPoint(),
+                   f.getBody().getNumAddresses(),
+                   len(set(f.getCalledFunctions(monitor)))))
+    if f.getEntryPoint() in seen: continue
+    seen.add(f.getEntryPoint())
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+    with open(os.path.join(OUT_DIR, '%s_%s_%s.txt' %
+                            (label, f.getEntryPoint(), safe)), 'w') as o:
+        dump(f, o)
+
+# Walk into each block cipher to depth 1
+for fp in (0x1003f4690, 0x1003f5980):
+    f = fm.getFunctionAt(addr(fp))
+    if f is None: continue
+    summary.write('\n=== depth-1 callees of 0x%x ===\n' % fp)
+    for c in sorted(f.getCalledFunctions(monitor), key=lambda f: f.getEntryPoint()):
+        summary.write('  %s @ %s (size %d)\n' %
+                      (c.getName(True), c.getEntryPoint(),
+                       c.getBody().getNumAddresses()))
+        if c.getEntryPoint() in seen: continue
+        seen.add(c.getEntryPoint())
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', c.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, 'depth1_0x%x_%s_%s.txt' %
+                                (fp, c.getEntryPoint(), safe)), 'w') as o:
+            dump(c, o)
+
+summary.write('\n=== total: %d ===\n' % len(seen))
+summary.close()
+print('dump-block-cipher: %d functions dumped to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/dump-cipher.py

@@ -0,0 +1,106 @@
+# Dump the actual cipher function chain.
+#
+# From FUN_1001a9d50 (the "send DMX" virtual method):
+#   FUN_1001eeac0 = builds 576-byte AES frame (the ENCRYPT function)
+#   FUN_1001b0340 = XHL_UdpSocket::send (verify it routes to sendto)
+#   FUN_100333f40 = sequence-number bookkeeping (param_1 -> &seqnum_out)
+#   FUN_100333ae0 = pre-encrypt setup (maybe IV refresh)
+#
+# Also dump callers of FUN_1001eeac0 (the encrypt) and all its callees:
+# AES tables and round logic live in there.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out7')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('signature: %s\n' % func.getPrototypeString(True, True))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+# Functions to dump (label -> address)
+ROOTS = {
+    'sendDmx_FUN_1001a9d50':       0x1001a9d50,  # outer; for context
+    'encrypt_FUN_1001eeac0':       0x1001eeac0,  # THE ENCRYPT FUNCTION
+    'udpsend_FUN_1001b0340':       0x1001b0340,  # UDP send wrapper
+    'pre_FUN_100333ae0':           0x100333ae0,
+    'getseqno_FUN_100333f40':      0x100333f40,
+    'getip_FUN_1001b1780':         0x1001b1780,  # gets IP from socket?
+    'unknown_FUN_1006a70a0':       0x1006a70a0,  # ??? (mutex variant)
+    'unknown_FUN_1006a6f70':       0x1006a6f70,  # ??? (mutex variant)
+    'unknown_FUN_10060b8e0':       0x10060b8e0,  # mutex lock?
+    'unknown_FUN_10060b980':       0x10060b980,  # mutex unlock?
+}
+
+# Also: recursively descend into encrypt to depth 1 — its callees are the
+# round logic / sbox lookups.
+ENCRYPT_ADDR = 0x1001eeac0
+
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+summary.write('Cipher dump — chain rooted at FUN_1001a9d50\n\n')
+
+for label, fp in ROOTS.items():
+    f = fm.getFunctionAt(addr(fp)) or fm.getFunctionContaining(addr(fp))
+    if f is None:
+        summary.write('  %s 0x%x  (no function)\n' % (label, fp))
+        continue
+    summary.write('  %s = %s @ %s (size %d, callees=%d)\n' %
+                  (label, f.getName(True), f.getEntryPoint(),
+                   f.getBody().getNumAddresses(),
+                   len(set(f.getCalledFunctions(monitor)))))
+    if f.getEntryPoint() in seen: continue
+    seen.add(f.getEntryPoint())
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+    with open(os.path.join(OUT_DIR, '%s_%s_%s.txt' %
+                            (label, f.getEntryPoint(), safe)), 'w') as o:
+        dump(f, o)
+
+# Descend into encrypt fn's callees (depth 1)
+enc = fm.getFunctionAt(addr(ENCRYPT_ADDR))
+if enc:
+    summary.write('\n=== encrypt fn callees (depth 1) ===\n')
+    for c in sorted(enc.getCalledFunctions(monitor), key=lambda f: f.getEntryPoint()):
+        summary.write('  callee: %s @ %s (size %d)\n' %
+                      (c.getName(True), c.getEntryPoint(),
+                       c.getBody().getNumAddresses()))
+        if c.getEntryPoint() in seen: continue
+        seen.add(c.getEntryPoint())
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', c.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, 'enccallee_%s_%s.txt' %
+                                (c.getEntryPoint(), safe)), 'w') as o:
+            dump(c, o)
+
+summary.write('\n=== total dumped: %d ===\n' % len(seen))
+summary.close()
+print('dump-cipher: %d functions dumped to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/dump-ctor-chain.py

@@ -0,0 +1,107 @@
+# Walk the constructor chain to find where the 8-word cipher state is
+# initialized.  Top-level: FUN_100178f10 (Stick3CryptDmxUniverse::ctor)
+# delegates the heavy lifting to FUN_1001a9a00 (base-class ctor).
+#
+# Targets:
+#   FUN_1001a9a00   base constructor (sets up sub-objects incl. cipher)
+#   FUN_100178bb0   caller of Stick3 ctor (one level UP — who creates these?)
+#   FUN_100105770   AesOStream constructor
+#   the s_XHL_Stick3ANet... string is at 0x1007ff054 — dump bytes too
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out10')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+mem = prog.getMemory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+ROOTS = {
+    'base_ctor_FUN_1001a9a00':           0x1001a9a00,
+    'caller_of_Stick3_ctor_100178bb0':   0x100178bb0,
+    'AesOStream_ctor_100105770':         0x100105770,
+}
+
+seen = set()
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+
+# Read and print the source-tag string at 0x1007ff054
+summary.write('=== Source-tag string at 0x1007ff054 ===\n')
+try:
+    sb = []
+    a = addr(0x1007ff054)
+    for i in range(120):
+        b = mem.getByte(a.add(i)) & 0xff
+        if b == 0: break
+        sb.append(chr(b))
+    summary.write('  ' + repr(''.join(sb)) + '\n\n')
+except Exception as e:
+    summary.write('  (read failed: %s)\n' % e)
+
+for label, fp in ROOTS.items():
+    f = fm.getFunctionAt(addr(fp)) or fm.getFunctionContaining(addr(fp))
+    if f is None:
+        summary.write('  %s 0x%x  (no fn)\n' % (label, fp))
+        continue
+    summary.write('  %s = %s @ %s  size=%d\n' %
+                  (label, f.getName(True), f.getEntryPoint(),
+                   f.getBody().getNumAddresses()))
+    if f.getEntryPoint() in seen: continue
+    seen.add(f.getEntryPoint())
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+    with open(os.path.join(OUT_DIR, '%s_%s_%s.txt' %
+                            (label, f.getEntryPoint(), safe)), 'w') as o:
+        dump(f, o)
+
+# Also descend one hop into base ctor
+base_ctor = fm.getFunctionAt(addr(0x1001a9a00))
+if base_ctor:
+    summary.write('\n=== base ctor depth-1 callees ===\n')
+    for c in sorted(base_ctor.getCalledFunctions(monitor), key=lambda f: f.getEntryPoint()):
+        summary.write('  callee: %s @ %s (size %d)\n' %
+                      (c.getName(True), c.getEntryPoint(),
+                       c.getBody().getNumAddresses()))
+        if c.getEntryPoint() in seen: continue
+        seen.add(c.getEntryPoint())
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', c.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, 'basector_d1_%s_%s.txt' %
+                                (c.getEntryPoint(), safe)), 'w') as o:
+            dump(c, o)
+
+summary.write('\n=== total dumped: %d ===\n' % len(seen))
+summary.close()
+print('dump-ctor-chain: %d functions dumped to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/dump-curve.py

@@ -0,0 +1,112 @@
+# Dump the EC curve constants + remaining KDF primitives.
+# KDF (FUN_100107650): key = X(priv*staticPt) XOR X(priv*stickPub)
+#   priv generated by FUN_1004032b0 (random mod n, n at DAT_100cf5c10)
+#   scalarmult = FUN_1003ff3c0, prime p at DAT_100cf5bf0, gen G at DAT_100cf5c30
+# @category Stick
+
+import os, re, struct
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-curve')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+mem = prog.getMemory()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def rd(a, n):
+    buf = bytearray(n)
+    try:
+        mem.getBytes(addr(a), buf)
+    except Exception as e:
+        return None
+    return bytes(buf)
+
+def hexdump(label, a, n, out):
+    b = rd(a, n)
+    out.write('\n== %s @ 0x%x (%d bytes) ==\n' % (label, a, n))
+    if b is None:
+        out.write('  (unreadable)\n'); return
+    for i in range(0, n, 16):
+        row = b[i:i+16]
+        hx = ' '.join('%02x' % x for x in row)
+        out.write('  +%03x  %-47s\n' % (i, hx))
+    # also as little-endian 256-bit ints, 32B at a time
+    for i in range(0, n - 31, 32):
+        words = struct.unpack('<4Q', b[i:i+32])
+        be = (words[3] << 192) | (words[2] << 128) | (words[1] << 64) | words[0]
+        out.write('  [%03x] LE-as-256bit = 0x%064x\n' % (i, be))
+
+def decompile(func):
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        return res.getDecompiledFunction().getC()
+    return '(decompile failed: %s)\n' % res.getErrorMessage()
+
+def dump_fn(fp, label, out):
+    f = fm.getFunctionAt(addr(fp)) or fm.getFunctionContaining(addr(fp))
+    if f is None:
+        out.write('\n==== %s 0x%x : NO FUNCTION ====\n' % (label, fp)); return
+    out.write('\n==== %s : %s @ %s (%d bytes) ====\n' %
+              (label, f.getName(True), f.getEntryPoint(),
+               f.getBody().getNumAddresses()))
+    callees = sorted(set('%s@%s' % (c.getName(True), c.getEntryPoint())
+                         for c in f.getCalledFunctions(monitor)))
+    out.write('callees: %s\n' % ', '.join(callees))
+    out.write(decompile(f))
+
+# ---- 1. constants ----
+const = open(os.path.join(OUT_DIR, 'CONSTANTS.txt'), 'w')
+# wide region covering prime, order, generator, a/b coefficients
+hexdump('region_cf5b00', 0x100cf5b00, 0x300, const)
+hexdump('DAT_100cf5bf0_prime?',   0x100cf5bf0, 0x20, const)
+hexdump('DAT_100cf5c10_order_lo', 0x100cf5c10, 0x20, const)
+hexdump('DAT_100cf5c30_generator',0x100cf5c30, 0x40, const)
+hexdump('decoded_secret_cf8d11',  0x100cf8d11, 0x21, const)
+hexdump('obfuscated_src_7b0490',  0x1007b0490, 0x21, const)
+const.close()
+
+# ---- 2. EC primitives + static-point builder ----
+prim = open(os.path.join(OUT_DIR, 'PRIMITIVES.txt'), 'w')
+for fp, label in [
+    (0x100402560, 'EC_op_402560'),
+    (0x100404fc0, 'EC_op_404fc0'),
+    (0x1003ffc40, 'EC_pt_add_3ffc40'),
+    (0x100400fd0, 'EC_pt_dbl_400fd0'),
+    (0x1004061d0, 'EC_reduce_4061d0'),
+    (0x100401c50, 'EC_op_401c50'),
+    (0x100402ab0, 'static_point_builder_402ab0'),
+    (0x1003f4530, 'cfb_key_install_3f4530'),
+]:
+    dump_fn(fp, label, prim)
+prim.close()
+
+# ---- 3. cipher vtable slots (vptr value 0x10095F838) ----
+vt = open(os.path.join(OUT_DIR, 'VTABLE.txt'), 'w')
+VTBL = 0x10095F838
+vt.write('cipher secondary vtable @ 0x%x\n' % VTBL)
+slots = {}
+for off in range(0, 0x60, 8):
+    b = rd(VTBL + off, 8)
+    if b is None:
+        vt.write('  +0x%02x : (unreadable)\n' % off); continue
+    ptr = struct.unpack('<Q', b)[0]
+    slots[off] = ptr
+    f = fm.getFunctionAt(addr(ptr)) if ptr else None
+    vt.write('  +0x%02x : 0x%x  %s\n' % (off, ptr, f.getName(True) if f else ''))
+for off, label in [(0x20, 'vt20_net_exchange'),
+                   (0x28, 'vt28_state_getter'),
+                   (0x38, 'vt38_static_getter')]:
+    ptr = slots.get(off)
+    if ptr:
+        dump_fn(ptr, label, vt)
+vt.close()
+
+print('dump-curve: done -> %s' % OUT_DIR)

package/tools/ghidra/dump-encompassing.py

@@ -0,0 +1,146 @@
+# Walk one more level up the constructor chain — find the device-level
+# factory that calls FUN_100179050 (caller of the Stick3CryptDmxUniverse
+# factory FUN_100178bb0) and dump constructors that touch offset +0x1618
+# (where the cipher object lives).
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out11')
+try: os.makedirs(OUT_DIR)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+mem = prog.getMemory()
+ref_mgr = prog.getReferenceManager()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+
+def dump(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees: out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers: out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 240, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+# Read C string at addr
+def cstr(a, maxlen=200):
+    out = []
+    for i in range(maxlen):
+        try:
+            b = mem.getByte(a.add(i)) & 0xff
+        except Exception:
+            break
+        if b == 0: break
+        out.append(chr(b))
+    return ''.join(out)
+
+
+# All 26 vtables containing FUN_100108200 at slot vt[3] (= site = vt_base+0x18)
+# So: vt_base = site - 0x18 = vptr - 0x00 (vptr is at vt_base+8 conceptually,
+# but the way we labelled in fixup output, vptr = vt_base+8... let me recompute.
+#
+# Convention: vtable struct layout:
+#     site(typeinfo_ptr) @ X         ← typeinfo rebase row
+#     vt[0] @ X + 0x08
+#     vt[1] @ X + 0x10
+#     vt[2] @ X + 0x18
+#     vt[3] @ X + 0x20
+#
+# So a row "rebase  FUN_100108200" at addr Y means Y stores the encrypt fn.
+# If vt[3], then Y = X + 0x20, so X (typeinfo_ptr addr) = Y - 0x20.
+# Slot 0 (vptr) is at X + 0x08 = Y - 0x18.
+
+# This was wrong before; the relationship is:
+#   if Y = vtable_struct_base + 0x20 (slot 3), and vptr is at +0x08,
+#   then vptr = Y - 0x18
+
+ENCRYPT_SLOT_ADDRS = [
+    0x100851F50, 0x100A1F168, 0x100A239D0, 0x100A23A70, 0x100B289E0,
+    0x100B2EDC8, 0x100B2EE68, 0x100B35D48, 0x100B3C0F8, 0x100B3C198,
+    0x100B95940, 0x100B959E0, 0x100B9D7A8, 0x100BA25A8, 0x100BA2648,
+    0x100BA9008, 0x100BB0E18, 0x100BB0EB8, 0x100BB7E00, 0x100BBCBC8,
+    0x100BBCC68, 0x100BC1920, 0x100BC7D48, 0x100BC7DE8, 0x100C14170,
+    0x100C14260,
+]
+
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+seen = set()
+
+# For each, read the typeinfo_ptr (at slot_addr - 0x20), then the name string
+# referenced from that typeinfo struct (at typeinfo_addr + 0x08).
+# Since chained fixups aren't materialized, we have to find the typeinfo via
+# Ghidra refs.  Try: getReferencesFrom(typeinfo_ptr_field).
+summary.write('=== 26 vtables sharing FUN_100108200 as vt[3] ===\n')
+for slot3 in ENCRYPT_SLOT_ADDRS:
+    typeinfo_field = slot3 - 0x20
+    vptr           = slot3 - 0x18
+    summary.write('\n  slot[3] @ 0x%x   vptr=0x%x   typeinfo_ptr_field=0x%x\n' %
+                  (slot3, vptr, typeinfo_field))
+    # Look at outgoing refs from the typeinfo_field — Ghidra applies refs
+    # from chained-fixup rebases for SOME of these.
+    refs = list(ref_mgr.getReferencesFrom(addr(typeinfo_field)))
+    for r in refs:
+        ta = r.getToAddress()
+        summary.write('     -> %s\n' % ta)
+        # Then refs FROM typeinfo addr's name-ptr field (+8) give the name string
+        name_ptr_field = ta.add(8)
+        for r2 in ref_mgr.getReferencesFrom(name_ptr_field):
+            nstr = cstr(r2.getToAddress(), 200)
+            summary.write('        name @ %s : %r\n' % (r2.getToAddress(), nstr))
+    # Code refs to vptr = the constructor that uses this vtable
+    code_callers = set()
+    for r in ref_mgr.getReferencesTo(addr(vptr)):
+        f = fm.getFunctionContaining(r.getFromAddress())
+        if f is not None:
+            code_callers.add(f.getEntryPoint())
+    summary.write('     code refs to vptr from %d fn(s):\n' % len(code_callers))
+    for ep in sorted(code_callers):
+        f = fm.getFunctionAt(ep)
+        summary.write('       %s @ %s (size %d)\n' %
+                      (f.getName(True), f.getEntryPoint(),
+                       f.getBody().getNumAddresses()))
+        if ep in seen: continue
+        seen.add(ep)
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+        with open(os.path.join(OUT_DIR, 'ctor_vt0x%x_%s_%s.txt' %
+                                (vptr, f.getEntryPoint(), safe)), 'w') as o:
+            dump(f, o)
+
+# Also: dump FUN_100179050 (caller of Stick3 factory)
+for fp in [0x100179050]:
+    f = fm.getFunctionAt(addr(fp))
+    if f is None: continue
+    if f.getEntryPoint() in seen: continue
+    seen.add(f.getEntryPoint())
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+    with open(os.path.join(OUT_DIR, 'caller_%s_%s.txt' %
+                            (f.getEntryPoint(), safe)), 'w') as o:
+        dump(f, o)
+
+summary.write('\n=== total dumped: %d ===\n' % len(seen))
+summary.close()
+print('dump-encompassing: %d functions dumped to %s' % (len(seen), OUT_DIR))