DEFCON 2014 Writeup byhd

search.py

from struct import unpack

stack = []
base_addr = 0x605000
start_addr = 0x60e240

mem = open("hoge.bin").read()
dic = {}

def search_tree(addr, route):
    new_addr_l = unpack("<I", mem[addr-base_addr:addr-base_addr+4])[0]
    if (new_addr_l == 0) :
        val = unpack("<I", mem[addr-base_addr+16:addr-base_addr+20])[0]
        dic[val] = list(route)
    else :
        search_tree(new_addr_l, route+[0])
        new_addr_r = unpack("<I", mem[addr-base_addr+8:addr-base_addr+12])[0]
        search_tree(new_addr_r, route+[1])

    return 

search_tree(start_addr, []);

print dic