tool(fifa17-recon): live native-RE toolkit (disasm, xref, immediate-store, vtable)

Read-only probes for resolving FIFA17 code paths against a running client
without Ghidra, per the live-disassembly method (/proc/<pid>/mem + objdump).
All open /proc/<pid>/mem 'rb' only.

  ldis.py           image-VA disassembler/hexdump for CardsDLL and FIFA17.exe;
                    recomputes the module base from the NAMED PE-header mapping
                    every run, because Wine maps PE sections anonymously and the
                    mapping that merely CONTAINS an address is not the module.
  xref.py           references to an image VA: call/jmp rel32, rip-relative lea,
                    and absolute pointer slots. An absolute-only hit means the
                    function is virtual and reachable solely via its vtable.
  immstore.py       immediate stores (C7 /0) of a constant to a struct offset.
                    Only an immediate store can INTRODUCE a constant; a register
                    store merely propagates one. Zero hits is a real result: it
                    proves the constant arrives from a call, not a literal.
  classify_calls.py splits call sites of a constant-returning stub into STORE
                    (can assign) vs compare (predicate). Turned 81 call sites of
                    the 130000 provider into 17 assignments.
  vtab.py           dumps a vtable as image VAs and looks for sibling vtables
                    holding a different function in the same slot, which is how
                    a type/mode dispatch shows up.
  scan_mt.py        match-team records by the invariant header (11,7,0,0,76).
                    Never filters on +0x18: that word is a per-session handle
                    (-1 on 2026-08-24, 0x54001/0x54000 on 2026-08-25) and
                    filtering on it previously produced a false negative.

Workflow note: dump .text once and cache the objdump output, then query the
cached listing; a full CardsDLL .text linear disassembly is ~563k lines and
re-disassembling per question is wasteful.

fifa17-recon/tools/immstore.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""Find IMMEDIATE stores of a constant to a struct offset, in a live module.
+
+    immstore.py <imm_dec> [disp_hex|any] [--exe]
+
+Only `C7 /0` (mov dword [reg+disp], imm32) can INTRODUCE a constant into a
+field; `89 /r` merely propagates one. Emits image VAs so they can be fed to
+ldis.py. Read-only.
+"""
+import glob
+import os
+import re
+import struct
+import sys
+
+CARDS_IMG = 0x180000000
+EXE_IMG = 0x140000000
+
+
+def pid():
+    for d in glob.glob("/proc/[0-9]*"):
+        try:
+            if open(os.path.join(d, "comm")).read().strip() == "FIFA17.exe":
+                return int(os.path.basename(d))
+        except OSError:
+            pass
+    raise SystemExit("FIFA17.exe not running")
+
+
+P = pid()
+
+
+def module_base(n):
+    for l in open(f"/proc/{P}/maps"):
+        if n.lower() in l.lower():
+            return int(l.split("-")[0], 16)
+    raise SystemExit(f"{n} not mapped")
+
+
+def text_spans(base):
+    out = []
+    started = False
+    for l in open(f"/proc/{P}/maps"):
+        m = re.match(r"([0-9a-f]+)-([0-9a-f]+)\s+(\S{4})\s+\S+\s+\S+\s+\S+\s*(.*)", l)
+        if not m:
+            continue
+        lo, hi, perms, path = int(m.group(1), 16), int(m.group(2), 16), m.group(3), m.group(4)
+        if lo == base:
+            started = True
+            continue
+        if started:
+            if not path.strip() and "x" in perms:
+                out.append((lo, hi))
+            elif out:
+                break
+    return out
+
+
+args = [a for a in sys.argv[1:] if a != "--exe"]
+exe = "--exe" in sys.argv
+imm = int(args[0], 0)
+want_disp = None if len(args) < 2 or args[1] == "any" else int(args[1], 16)
+img = EXE_IMG if exe else CARDS_IMG
+base = module_base("FIFA17.exe" if exe else "CardsDLL")
+
+mem = open(f"/proc/{P}/mem", "rb", 0)
+immb = struct.pack("<i", imm)
+hits = 0
+for lo, hi in text_spans(base):
+    mem.seek(lo)
+    buf = mem.read(hi - lo)
+    img_lo = img + (lo - base)
+    i = buf.find(b"\xc7", 0)
+    while i >= 0:
+        modrm = buf[i + 1] if i + 1 < len(buf) else 0
+        if (modrm & 0x38) == 0:  # /0
+            mod, rm = modrm >> 6, modrm & 7
+            if mod == 1 and i + 7 <= len(buf):          # disp8
+                disp, ib = buf[i + 2], i + 3
+                sz = 7
+            elif mod == 2 and i + 10 <= len(buf):       # disp32
+                disp, ib = struct.unpack_from("<i", buf, i + 2)[0], i + 6
+                sz = 10
+            elif mod == 0 and rm not in (4, 5) and i + 6 <= len(buf):
+                disp, ib = 0, i + 2
+                sz = 6
+            else:
+                disp = None
+            if disp is not None and buf[ib:ib + 4] == immb:
+                if want_disp is None or disp == want_disp:
+                    print(f"    image 0x{img_lo+i:x}  mov dword [reg+0x{disp:x}], {imm}  ({sz}B)")
+                    hits += 1
+        i = buf.find(b"\xc7", i + 1)
+print(f"  {hits} immediate store(s) of {imm}"
+      + (f" at +0x{want_disp:x}" if want_disp is not None else ""))