// pe_multitool tours the static-analysis side of winpwn: checksec, section
// entropy, IAT/EAT navigation with forwarder resolution, and the native ROP
// gadget scanner. Run from: workspace/demos/pe_multitool -> go run .
package main

import (
	"fmt"
	"log"
	"winpwn"
)
//const target = "../../../../Users/lee/Desktop/win_sems/Seminar/2019_Winter_WinPwn/200108/Lab1/simple_rop.exe"
const target = "../../../../Windows/SysWOW64/kernel32.dll"

func main() {
	pe, err := winpwn.OpenPE(target)
	if err != nil {
		log.Fatalf("OpenPE: %v", err)
	}
	defer pe.Close()

	// --- native ROP gadget scan, no rp++/Ropper required ---
	rop, err := winpwn.NewROP(target)
	if err != nil {
		log.Fatalf("NewROP: %v", err)
	}
	defer rop.Close()

	fmt.Println("--- gadgets ---")
	if g, err := rop.Search("pop ecx ; ret"); err == nil {
		fmt.Printf("pop ecx ; ret: 0x%X (%d candidates)\n", g[0].Address, len(g))
		if lines, err := rop.Disassemble(g[0].Address, 2); err == nil {
			fmt.Printf("  verified: %v\n", lines)
		}
	}

	if g, err := rop.Search("pop eax ; ret"); err == nil {
		fmt.Printf("pop eax ; ret: 0x%X (%d candidates)\n", g[0].Address, len(g))
		if lines, err := rop.Disassemble(g[0].Address, 2); err == nil {
			fmt.Printf("  verified: %v\n", lines)
		}
	}

	if g, err := rop.Search("mov dword ptr [ecx], eax ; mov eax, esi ; pop esi ; pop ebp ; ret"); err == nil {
		fmt.Printf("mov dword ptr [ecx], eax ; mov eax, esi ; pop esi ; pop ebp ; ret: 0x%X (%d candidates)\n", g[0].Address, len(g))
		if lines, err := rop.Disassemble(g[0].Address, 2); err == nil {
			fmt.Printf("  verified: %v\n", lines)
		}
	}
	
	if g, err := rop.SearchRegex(`^pop r\w+ ; pop r\w+ ; ret$`); err == nil {
		fmt.Printf("pop r.. ; pop r.. ; ret: %d candidates, first at 0x%X\n", len(g), g[0].Address)
	}

}