@ecopoesis/homebridge-dmx 0.1.0

package/tools/ghidra/dump-stick3-vtable.py

@@ -0,0 +1,182 @@
+# Dump every Stick3CryptDmxUniverse vtable slot function + every caller of
+# XHL_UdpSocket::send. Finds the actual DMX encrypt routine.
+#
+# Vtable sites (from dyld_info -fixups, typeinfo @ 0x100970DC0):
+#   Primary:    0x100962BE0  (slot[0] @ +0x08, primary virtuals)
+#   Sub1:       0x100962CC0  (5 methods, secondary base #1)
+#   Sub2:       0x100962CE8  (5 methods, secondary base #2)
+#   Sub3:       0x100962D28  (5 methods, secondary base #3)
+#   Sub4:       0x100962D60  (5 methods, secondary base #4)
+#   Sub5:       0x100962DA0  (last group, also has VTT entries)
+#
+# UdpSocket sends are FUN_100677060 (sendUnicast?) and FUN_100677330
+# (sendBroadcast or send-to-many?). 26 + 6 callers.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out6')
+try:
+    os.makedirs(OUT_DIR)
+except OSError:
+    pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+mem = prog.getMemory()
+ref_mgr = prog.getReferenceManager()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a):
+    return af.getDefaultAddressSpace().getAddress(a)
+
+
+def dump_function(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('signature: %s\n' % func.getPrototypeString(True, True))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees:
+        out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers:
+        out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 180, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+# Hardcoded vtable slot function addresses extracted from dyld_info -fixups
+VTABLE_SLOTS = {
+    'Stick3CryptDmxUniverse_PRIMARY': [
+        # primary @ 0x100962BE0; slot 0 is the byte just after typeinfo_ptr.
+        # (Itanium: slot 0 typically = D0/D1 destructors, slots 2+ = virtuals.)
+        (0, 0x1001818E0),
+        (1, 0x100181A30),
+        (2, 0x1001AA240),
+        (3, 0x1005EF5D0),
+        (4, 0x100181FC0),
+        (5, 0x100181BB0),
+        (6, 0x1001AA410),
+        (7, 0x1005EF0E0),
+        (8, 0x1005EF0F0),
+        (9, 0x1005EF250),
+        (10, 0x100181CB0),
+        (11, 0x1005EF2A0),
+        (12, 0x1001C0340),
+        (13, 0x1005EF4A0),
+        (14, 0x1001AA2B0),
+        (15, 0x1001AA110),
+        (16, 0x1005EF700),
+        (17, 0x100181FB0),
+        (18, 0x100334140),
+        (19, 0x1005EF800),
+        (20, 0x1005EF8F0),
+        (21, 0x1003342B0),
+        (22, 0x1001A9D50),
+        (23, 0x100181BC0),
+    ],
+    'Stick3CryptDmxUniverse_SUB1_at_0x100962CC0': [
+        (0, 0x1001A9F00),
+        (1, 0x100181910),
+        (2, 0x100181A60),
+    ],
+    'Stick3CryptDmxUniverse_SUB2_at_0x100962CE8': [
+        (0, 0x100181CA0),
+        (1, 0x100181940),
+        (2, 0x100181AA0),
+        (3, 0x1005F0510),
+        (4, 0x1005F0520),
+    ],
+    'Stick3CryptDmxUniverse_SUB3_at_0x100962D28': [
+        (0, 0x100181970),
+        (1, 0x100181AE0),
+        (2, 0x1001C0410),
+        (3, 0x1001C0540),
+        (4, 0x100421210),
+    ],
+    'Stick3CryptDmxUniverse_SUB4_at_0x100962D60': [
+        (0, 0x1001819B0),
+        (1, 0x100181B20),
+        (2, 0x100334300),
+    ],
+    'Stick3CryptDmxUniverse_SUB5_at_0x100962DA0': [
+        (0, 0x1001819F0),
+        (1, 0x100181B60),
+        (2, 0x10062E1A0),
+        (3, 0x10062E2A0),
+    ],
+}
+
+# UdpSocket send functions — every caller is a candidate
+UDP_SEND_FNS = {
+    'XHL_UdpSocket_sendA_FUN_100677060': 0x100677060,
+    'XHL_UdpSocket_sendB_FUN_100677330': 0x100677330,
+}
+
+summary = open(os.path.join(OUT_DIR, 'SUMMARY.txt'), 'w')
+summary.write('Stick3 vtable + UDP-send callers — ESA2 HardwareManager\n\n')
+
+seen = set()
+
+# --- Dump vtable slots ---
+for label, slots in VTABLE_SLOTS.items():
+    summary.write('\n=== %s ===\n' % label)
+    for slot_idx, fp in slots:
+        fa = addr(fp)
+        f = fm.getFunctionAt(fa) or fm.getFunctionContaining(fa)
+        if f is None:
+            summary.write('  vt[%d] @ 0x%x  (no fn)\n' % (slot_idx, fp))
+            continue
+        summary.write('  vt[%d] @ 0x%x = %s @ %s (size %d)\n' %
+                      (slot_idx, fp, f.getName(True),
+                       f.getEntryPoint(), f.getBody().getNumAddresses()))
+        if f.getEntryPoint() in seen:
+            continue
+        seen.add(f.getEntryPoint())
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+        path = os.path.join(OUT_DIR, '%s_vt%02d_%s_%s.txt' %
+                            (label, slot_idx, f.getEntryPoint(), safe))
+        with open(path, 'w') as o:
+            dump_function(f, o)
+
+# --- Dump every caller of UdpSocket::send ---
+for label, fp in UDP_SEND_FNS.items():
+    summary.write('\n=== Callers of %s @ 0x%x ===\n' % (label, fp))
+    fn = fm.getFunctionAt(addr(fp))
+    if fn is None:
+        summary.write('  (function not found)\n')
+        continue
+    callers = sorted(set(f.getEntryPoint() for f in fn.getCallingFunctions(monitor)))
+    for ep in callers:
+        f = fm.getFunctionAt(ep)
+        summary.write('  %s @ %s  (size %d)\n' %
+                      (f.getName(True), f.getEntryPoint(),
+                       f.getBody().getNumAddresses()))
+        if f.getEntryPoint() in seen:
+            continue
+        seen.add(f.getEntryPoint())
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+        path = os.path.join(OUT_DIR, 'udpcaller_%s_%s.txt' %
+                            (f.getEntryPoint(), safe))
+        with open(path, 'w') as o:
+            dump_function(f, o)
+
+summary.write('\n=== total functions dumped: %d ===\n' % len(seen))
+summary.close()
+print('dump-stick3-vtable: dumped %d functions to %s' % (len(seen), OUT_DIR))

package/tools/ghidra/dump-swxref.py

@@ -0,0 +1,27 @@
+# xref the "software" cstring (0x1007e4f83) — the function that assigns it to
+# a device also assigns the adjacent auth key.
+# @category Stick
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+OUT = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-swxref')
+try: os.makedirs(OUT)
+except OSError: pass
+prog = currentProgram; fm = prog.getFunctionManager(); af = prog.getAddressFactory()
+rm = prog.getReferenceManager(); monitor = ConsoleTaskMonitor()
+decomp = DecompInterface(); decomp.openProgram(prog)
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+def dec(f):
+    r = decomp.decompileFunction(f, 240, monitor)
+    return r.getDecompiledFunction().getC() if r.decompileCompleted() else '(fail)\n'
+seen=set()
+for target in [0x1007e4f83]:
+    for r in rm.getReferencesTo(addr(target)):
+        f = fm.getFunctionContaining(r.getFromAddress())
+        if f is None or str(f.getEntryPoint()) in seen: continue
+        seen.add(str(f.getEntryPoint()))
+        safe = re.sub(r'[^A-Za-z0-9._-]','_',f.getName(True))[:70]
+        with open(os.path.join(OUT,'xref_%s_%s.txt'%(f.getEntryPoint(),safe)),'w') as o:
+            o.write('==== %s @ %s (from %s) ====\n'%(f.getName(True),f.getEntryPoint(),r.getFromAddress()))
+            o.write(dec(f))
+print('dump-swxref: %d functions -> %s'%(len(seen),OUT))

package/tools/ghidra/dump-vt-key-getter.py

@@ -0,0 +1,170 @@
+# Identify the vtable+0xe8 entry (AES-256 key getter) for the Stick3 device
+# class, plus the sibling crypto functions FUN_1001bb3a0 and FUN_1001bb860
+# which also use the same key path -- so we can correlate.
+#
+# Strategy: pyghidra has the binary indexed, so dump the function pointer
+# in the device's __const vtable at slot +0xe8. Stick3ANet typeinfo at
+# 0x100970160 -- vtable_top should be at typeinfo - 0x10 or via __const xref.
+#
+# Also: dump FUN_1001bb3a0 (sibling that also uses vt+0xe8 then aes_install)
+# and FUN_1001bb860 (sibling crypto fn).
+#
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+
+OUT = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out-vt-key')
+try: os.makedirs(OUT)
+except OSError: pass
+
+prog = currentProgram
+fm = prog.getFunctionManager()
+af = prog.getAddressFactory()
+mem = prog.getMemory()
+listing = prog.getListing()
+monitor = ConsoleTaskMonitor()
+decomp = DecompInterface(); decomp.openProgram(prog)
+def addr(a): return af.getDefaultAddressSpace().getAddress(a)
+
+def decompile(f):
+    r = decomp.decompileFunction(f, 240, monitor)
+    return r.getDecompiledFunction().getC() if r.decompileCompleted() else '(decompile failed)\n'
+
+def dump_fn(ep, label):
+    a = addr(ep)
+    f = fm.getFunctionAt(a) or fm.getFunctionContaining(a)
+    if not f:
+        return
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:80]
+    fname = os.path.join(OUT, '%s_%s_%s.txt' % (label, f.getEntryPoint(), safe))
+    with open(fname, 'w') as o:
+        o.write('==== %s @ %s (%d bytes) ====\n' %
+                (f.getName(True), f.getEntryPoint(), f.getBody().getNumAddresses()))
+        callees = sorted(set('%s @ %s' % (c.getName(True), c.getEntryPoint())
+                             for c in f.getCalledFunctions(monitor)))
+        callers = sorted(set('%s @ %s' % (c.getName(True), c.getEntryPoint())
+                             for c in f.getCallingFunctions(monitor)))
+        o.write('-- callees (%d) --\n  ' % len(callees) + '\n  '.join(callees) + '\n')
+        o.write('\n-- callers (%d) --\n  ' % len(callers) + '\n  '.join(callers) + '\n\n')
+        o.write('-- decompilation --\n')
+        o.write(decompile(f))
+
+# Sibling crypto functions also using AES key install.
+SIBLINGS = [
+    (0x1001bb3a0, 'sibling_bb3a0'),     # also calls FUN_1003f5740
+    (0x1001bb860, 'sibling_bb860'),     # vt+0xe8 user
+    (0x100353b20, 'sibling_353b20'),    # another decrypt user
+    (0x100594ba0, 'sibling_594ba0'),
+    (0x100595a40, 'sibling_595a40'),
+    (0x1001bc0a0, 'unencrypted_011c'),  # the non-encrypted path -- shows what data layout the encrypted version equals
+    (0x1001f89f0, 'register_pending'),  # used in handler
+    (0x100195b20, 'extract_reply'),     # used in handler
+]
+
+for ep, label in SIBLINGS:
+    dump_fn(ep, label)
+
+# Find the function called at offset 0x1001bbee5 -- the indirect vt[+0xe8] call.
+# Walk references FROM that instruction to find the resolved target (if Ghidra
+# resolved it via dyld_info / objc / pointer-authentication). If not resolved,
+# we'll have to find the device class vtable by another means.
+ins_addr = addr(0x1001bbee5)
+print('--- references at 0x1001bbee5 ---')
+rm = prog.getReferenceManager()
+for r in rm.getReferencesFrom(ins_addr):
+    print('  ', r.getReferenceType(), r.getToAddress())
+
+# Find Stick3ANet typeinfo @ 0x100970160 and the vtable preceding it.
+ti_addr = addr(0x100970160)
+print('\n--- references TO Stick3ANet typeinfo @ 0x100970160 ---')
+for r in rm.getReferencesTo(ti_addr):
+    print('  ', r.getFromAddress(), r.getReferenceType())
+
+# Also dump the bytes around the typeinfo -- the vtable is just before it (in
+# Itanium ABI, vtable layout = [offset-to-top][typeinfo*][vfn0][vfn1]...).
+print('\n--- bytes near typeinfo 0x100970160 (vtable + typeinfo) ---')
+buf = bytearray(0x800)
+try:
+    base = addr(0x10096fa00)
+    mem.getBytes(base, buf)
+    # interpret as 8-byte LE pointers; show first 256
+    for i in range(0, len(buf), 8):
+        v = int.from_bytes(buf[i:i+8], 'little')
+        if 0x100000000 <= v < 0x110000000:
+            print('  +0x%04x : 0x%016x' % (i, v))
+except Exception as e:
+    print('  err:', e)
+
+# Search the entire binary's __DATA segments for any pointer = 0x100970160
+# (typeinfo of Stick3ANet) -- the location 8 bytes BEFORE that hit is the
+# vtable start; +0xe8 + 0x10 = slot.
+print('\n--- searching for pointer 0x100970160 in __DATA ---')
+target_bytes = (0x100970160).to_bytes(8, 'little')
+for block in mem.getBlocks():
+    if not block.isInitialized(): continue
+    if block.isExecute(): continue        # data only
+    start = block.getStart().getOffset()
+    size = block.getSize()
+    if size > 64*1024*1024: continue
+    bb = bytearray(size)
+    try:
+        block.getBytes(block.getStart(), bb)
+    except Exception:
+        continue
+    i = 0
+    while True:
+        idx = bb.find(target_bytes, i)
+        if idx == -1: break
+        ptr_addr = start + idx
+        # In Itanium ABI, this offset = vtable + 0x8 (the typeinfo pointer slot).
+        # So vtable starts at ptr_addr - 0x8 (the offset-to-top slot before it).
+        # Slot index N is at vtable + 0x10 + N*8.
+        # vfn at offset +0xe8 in vptr-space  =  raw addr ptr_addr + 0x8 + 0xe8
+        # because vptr = vtable + 0x10, and slot at +0xe8 in vptr-space
+        # is at vtable + 0x10 + 0xe8 = ptr_addr - 0x8 + 0x10 + 0xe8 = ptr_addr + 0xf0.
+        slot_addr = ptr_addr + 0xf0
+        try:
+            slot_buf = bytearray(8)
+            mem.getBytes(addr(slot_addr), slot_buf)
+            slot_val = int.from_bytes(slot_buf, 'little')
+            print('  typeinfo* found at 0x%x  -> vt[+0xe8] = 0x%016x  (fn @ 0x%016x)'
+                  % (ptr_addr, slot_val, slot_val))
+            # Dump that function.
+            f = fm.getFunctionAt(addr(slot_val)) or fm.getFunctionContaining(addr(slot_val))
+            if f:
+                dump_fn(slot_val, 'stick3anet_vt_e8')
+        except Exception as e:
+            print('  err reading slot at 0x%x: %s' % (slot_addr, e))
+        i = idx + 1
+
+# Also try Stick3A typeinfo
+print('\n--- searching for pointer 0x100C820F0 (Stick3A typeinfo) ---')
+target2 = (0x100C820F0).to_bytes(8, 'little')
+for block in mem.getBlocks():
+    if not block.isInitialized() or block.isExecute(): continue
+    size = block.getSize()
+    if size > 64*1024*1024: continue
+    bb = bytearray(size)
+    try: block.getBytes(block.getStart(), bb)
+    except: continue
+    i = 0
+    start = block.getStart().getOffset()
+    while True:
+        idx = bb.find(target2, i)
+        if idx == -1: break
+        ptr_addr = start + idx
+        slot_addr = ptr_addr + 0xf0
+        try:
+            slot_buf = bytearray(8); mem.getBytes(addr(slot_addr), slot_buf)
+            slot_val = int.from_bytes(slot_buf, 'little')
+            print('  Stick3A typeinfo @ 0x%x -> vt[+0xe8] = 0x%016x' % (ptr_addr, slot_val))
+            f = fm.getFunctionAt(addr(slot_val)) or fm.getFunctionContaining(addr(slot_val))
+            if f:
+                dump_fn(slot_val, 'stick3a_vt_e8')
+        except Exception as e:
+            print('  err: %s' % e)
+        i = idx + 1
+
+print('dump-vt-key-getter: done -> %s' % OUT)

package/tools/ghidra/find-cipher.py

@@ -0,0 +1,210 @@
+# Locate the real DMX cipher path in the symbolized ESA2 HardwareManager.
+#
+# What we know from dump-anchors:
+#   - DmxUniversePage::sendDmx (worker fn dispatched via QtConcurrent::run) calls
+#         (*((**(this+0x48))[2]))((this+0x48)+0x10, this+0x58)
+#     i.e. a virtual on an object held at DmxUniversePage::m_field_0x48,
+#     passing the 488-byte raw DMX buffer at this+0x58.
+#   - receiveDmx calls slot +0x18 of the same vtable.
+#   - That object's class is one of the RTTI-anchored ones (CryptDmxUniverse,
+#     AesOStream, ...) — only RTTI strings exist (no symbolized methods).
+#
+# Plan:
+#   1. Find every RTTI typeinfo-name string that contains "CryptDmxUniverse"
+#      or "AesOStream"/"AesIStream"/"Dmx" (broader net).
+#   2. For each, walk xrefs back to the corresponding __ZTV* (vtable) — the
+#      vtable is a sequence of function pointers and its 2nd qword points to
+#      the typeinfo. So for each xref site that looks like a vtable, list the
+#      function pointers at +0x10, +0x18, +0x20, +0x28 and dump those functions.
+#   3. Also: cross-ref _sendto (0x1006ed9c6) callers — the encrypt+send fn
+#      should appear among them. Dump every caller.
+#   4. Print everything to tools/ghidra/out2/.
+
+# @category Stick
+
+import os, re
+from ghidra.app.decompiler import DecompInterface
+from ghidra.util.task import ConsoleTaskMonitor
+from ghidra.program.model.symbol import RefType
+
+OUT_DIR = os.path.join(os.path.dirname(getSourceFile().getAbsolutePath()), 'out2')
+try:
+    os.makedirs(OUT_DIR)
+except OSError:
+    pass
+
+prog = currentProgram
+fm   = prog.getFunctionManager()
+st   = prog.getSymbolTable()
+af   = prog.getAddressFactory()
+mem  = prog.getMemory()
+listing = prog.getListing()
+ref_mgr = prog.getReferenceManager()
+monitor = ConsoleTaskMonitor()
+
+decomp = DecompInterface()
+decomp.openProgram(prog)
+
+
+def addr(a):
+    return af.getDefaultAddressSpace().getAddress(a)
+
+
+def get_ptr(a):
+    """Read an 8-byte LE pointer from address a."""
+    try:
+        return mem.getLong(a) & 0xFFFFFFFFFFFFFFFF
+    except Exception:
+        return None
+
+
+def dump_function_brief(func, out):
+    out.write('  FUNC %s @ %s  (size %d)\n' % (func.getName(True),
+              func.getEntryPoint(), func.getBody().getNumAddresses()))
+
+
+def dump_function_full(func, out):
+    out.write('==== %s @ %s ====\n' % (func.getName(True), func.getEntryPoint()))
+    out.write('signature: %s\n' % func.getPrototypeString(True, True))
+    out.write('size: %d body bytes\n' % func.getBody().getNumAddresses())
+    callees = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCalledFunctions(monitor)))
+    out.write('\n-- callees (%d) --\n' % len(callees))
+    for c in callees:
+        out.write('  ' + c + '\n')
+    callers = sorted(set('%s @ %s' % (f.getName(True), f.getEntryPoint())
+                         for f in func.getCallingFunctions(monitor)))
+    out.write('\n-- callers (%d) --\n' % len(callers))
+    for c in callers:
+        out.write('  ' + c + '\n')
+    out.write('\n-- decompilation --\n')
+    res = decomp.decompileFunction(func, 120, monitor)
+    if res.decompileCompleted():
+        out.write(res.getDecompiledFunction().getC())
+    else:
+        out.write('(decompilation failed: %s)\n' % res.getErrorMessage())
+    out.write('\n')
+
+
+# ---------------------------------------------------------------------------
+# 1. Find RTTI typeinfo-name strings for DMX/Crypto classes
+# ---------------------------------------------------------------------------
+target_class_substrings = [
+    'CryptDmxUniverse', 'AesOStream', 'AesIStream',
+    'DasEccAesCryptography', 'DasDhRsaCryptography',
+    'DasEccStreamCryptography', 'DasCryptography',
+    'DmxUniverse',  # base class candidates
+]
+
+rtti_strings = []  # list of (substring, name, address)
+for sym in st.getAllSymbols(False):
+    name = sym.getName(True)
+    if '__ZTS' in name or 'typeinfo-name' in name:
+        for sub in target_class_substrings:
+            if sub in name:
+                rtti_strings.append((sub, name, sym.getAddress()))
+                break
+    elif '__ZTI' in name or 'typeinfo' in name:
+        for sub in target_class_substrings:
+            if sub in name:
+                rtti_strings.append((sub, name, sym.getAddress()))
+                break
+    elif '__ZTV' in name or 'vtable' in name:
+        for sub in target_class_substrings:
+            if sub in name:
+                rtti_strings.append((sub, name, sym.getAddress()))
+                break
+
+# ---------------------------------------------------------------------------
+# 2. Dump summary, vtable layouts, and full decomps of every vtable slot fn
+# ---------------------------------------------------------------------------
+summary_path = os.path.join(OUT_DIR, 'SUMMARY.txt')
+seen_funcs = set()
+out_summary = open(summary_path, 'w')
+out_summary.write('Cipher-anchor search — ESA2 HardwareManager (2024-03-21)\n\n')
+
+out_summary.write('=== RTTI/vtable symbols for DMX/Crypto classes ===\n')
+for sub, name, a in rtti_strings:
+    out_summary.write('  [%s] %s @ %s\n' % (sub, name, a))
+out_summary.write('\n')
+
+# For every vtable symbol (__ZTV*), the layout is:
+#     [+0x00] offset-to-top (signed 64)
+#     [+0x08] typeinfo pointer
+#     [+0x10] virtual fn 0
+#     [+0x18] virtual fn 1
+#     [+0x20] virtual fn 2
+#     ...
+# We saw sendDmx do ((vt+0x10))(...)  — that's the *second function pointer*
+# in the vtable structure if you measure from the typeinfo pointer; actually
+# *((vptr)[2])(...) at C-source level. In the Ghidra decomp it's the value
+# obtained as **((vptr+0x10) cast to ptr-to-ptr), which means vtable[+0x10]
+# IS the first function-pointer slot (Itanium ABI: vptr points at the first
+# fn slot, NOT the typeinfo header). So:
+#     - The address Ghidra calls "vtable @ X" is the START of the structure
+#       (offset-to-top); typical layout above.
+#     - "vptr" stored in objects = X + 0x10
+#     - vt[0] = mem[X+0x10],  vt[1] = mem[X+0x18], ...
+# We dump fn pointers at offsets +0x10 through +0x80 (16 slots) of any vtable.
+
+vtable_syms = [(s, n, a) for (s, n, a) in rtti_strings if '__ZTV' in n or 'vtable' in n]
+out_summary.write('=== Vtable layouts (first 16 fn slots) ===\n')
+for sub, name, a in vtable_syms:
+    out_summary.write('\n--- %s @ %s ---\n' % (name, a))
+    base = int(a.getOffset())
+    # Skip first two qwords (offset-to-top, typeinfo); slots start at +0x10
+    for slot in range(0, 16):
+        slot_addr = addr(base + 0x10 + slot * 8)
+        fp = get_ptr(slot_addr)
+        if fp is None:
+            out_summary.write('  +0x%02x: <unmapped>\n' % (0x10 + slot * 8))
+            continue
+        if fp == 0:
+            out_summary.write('  +0x%02x: NULL — stop\n' % (0x10 + slot * 8))
+            break
+        fa = addr(fp)
+        f = fm.getFunctionAt(fa) or fm.getFunctionContaining(fa)
+        if f is None:
+            out_summary.write('  +0x%02x: 0x%x  (no function)\n' %
+                              (0x10 + slot * 8, fp))
+            continue
+        out_summary.write('  +0x%02x: %s @ %s\n' %
+                          (0x10 + slot * 8, f.getName(True), f.getEntryPoint()))
+        if f.getEntryPoint() in seen_funcs:
+            continue
+        seen_funcs.add(f.getEntryPoint())
+        safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+        path = os.path.join(OUT_DIR, 'vt_%s_+%02x_%s.txt' %
+                            (re.sub(r'[^A-Za-z0-9._-]', '_', name)[:60],
+                             0x10 + slot * 8, safe))
+        with open(path, 'w') as o:
+            dump_function_full(f, o)
+
+# ---------------------------------------------------------------------------
+# 3. Cross-reference _sendto callers — the encrypt+send fn must be among them
+# ---------------------------------------------------------------------------
+out_summary.write('\n=== Callers of _sendto (0x1006ed9c6) ===\n')
+sendto_addr = addr(0x1006ed9c6)
+sendto_fn = fm.getFunctionAt(sendto_addr)
+sendto_callers = set()
+if sendto_fn is not None:
+    for ref in ref_mgr.getReferencesTo(sendto_addr):
+        from_addr = ref.getFromAddress()
+        caller = fm.getFunctionContaining(from_addr)
+        if caller is not None:
+            sendto_callers.add(caller.getEntryPoint())
+
+for ep in sorted(sendto_callers):
+    f = fm.getFunctionAt(ep)
+    out_summary.write('  %s @ %s\n' % (f.getName(True), f.getEntryPoint()))
+    if ep in seen_funcs:
+        continue
+    seen_funcs.add(ep)
+    safe = re.sub(r'[^A-Za-z0-9._-]', '_', f.getName(True))[:120]
+    path = os.path.join(OUT_DIR, 'sendto_caller_%s_%s.txt' % (f.getEntryPoint(), safe))
+    with open(path, 'w') as o:
+        dump_function_full(f, o)
+
+out_summary.close()
+print('find-cipher: dumped %d functions to %s' % (len(seen_funcs), OUT_DIR))
+print('find-cipher: summary at %s' % summary_path)