import ctypes
import struct

PROCESS_ALL_ACCESS = 0x1F0FFF
kernel32 = ctypes.windll.kernel32
h_proc = kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, 43084)

def rpm(addr, size):
    buf = ctypes.create_string_buffer(size)
    bytes_read = ctypes.c_size_t(0)
    if kernel32.ReadProcessMemory(h_proc, ctypes.c_void_p(addr), buf, size, ctypes.byref(bytes_read)):
        return buf.raw
    return None

mod_base = 0x7FF6AFC20000

# String addresses:
targets = {
    "Minimap_Visibility": 0x7ff6b2da9200,
    "Minimap Visibility": 0x7ff6b2da92e8,
    "FogOfWar": 0x7ff6b2dad670,
    "Minimap Walkability": 0x7ff6b2da9768,
}

# Scan .text for RIP-relative references (lea r??, [rip + disp])
# disp = target_addr - (instr_addr + 7)
text_start = mod_base + 0x1000
text_size = 0x2E85000

print("Scanning .text for string references...")
chunk_size = 4 * 1024 * 1024
curr = text_start
end = text_start + text_size

while curr < end:
    read_len = min(chunk_size, end - curr)
    data = rpm(curr, read_len)
    if not data:
        curr += chunk_size
        continue
    
    for name, target in targets.items():
        # Search for lea r??, [rip + disp]
        # In x64: 48 8d ?? [disp32]
        # disp32 = target - (curr + i + 7)
        for i in range(len(data) - 7):
            if data[i] in (0x48, 0x4c) and data[i+1] == 0x8d:
                disp = struct.unpack("<i", data[i+3:i+7])[0]
                instr_next = curr + i + 7
                if instr_next + disp == target:
                    instr_addr = curr + i
                    print(f"[{name}] referenced at {hex(instr_addr)} (RVA: +{hex(instr_addr - mod_base)})")
                    # Read 64 bytes around instr_addr
                    win = rpm(instr_addr - 16, 64)
                    print(f"   Hex: {win.hex() if win else 'none'}")
    curr += read_len - 32

kernel32.CloseHandle(h_proc)