fifa17-recon: the consumables panel asks 41 times a session and we answer with players
Round 3, 10 agents. The headline is measured, not inferred: GET club/stats/consumables
is requested 41 times per session by the real client (ProtoHttp), and _club_stat_set()
answers it with the PLAYER stat set. The panel reads 14 consumables* names that we
have never sent, so it is told '205 players' when it asked how many contracts the club
owns, and it has nothing to show.
That also explains why last round's 126-item consumable shelf was never requested. It
serves type=contract|training|healing|development and an UNTYPED /club with no
team=/league=, and all 9 of the client's untyped requests this session carry team=. The
only +126 item(s) line in the whole log came from one of our own probes.
Vocabulary recovered: the 14 consumables* rows plus badgeDBid 0x2e, kitsHome 0x29,
kitsAway 0x2a, leagueLogos 0x2f, trophiesSeasonOnline 0x38.
Other measured surfaces the client asks for and we fob off: GET /settings 11x answered
with an empty config array (a 40-flag feature gate, the biggest untouched lever in the
project), leaderboards/options 5x with {}, user/accountinfo 4x with {}.
club/stats/staff is a DIFFERENT class (FutStaffBonus); the staff counts come from the
Stats2 store, which is why the staff screen worked while we answered {}.
Refuted: ENDPOINT_MAP's claim that objectives have no route. FUN_180151610 builds
<base>/objective/%d/reward and FUN_180147780 builds .../complete.
New modules only. utas_server.py is deliberately untouched: whether to wire the counts
depends on a free observation the human can make on the client that is already running,
and spending a restart before that is what this round exists to avoid.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUT92pz6RWKih9dSr8ZpxW
This commit is contained in:
funman300
@@ -0,0 +1,219 @@
|
||||
#!/usr/bin/env python3
|
||||
"""READ-ONLY checker for the club/stats vocabulary change.
|
||||
|
||||
Nothing here mutates a save, opens a pack, or writes an item. It issues GETs
|
||||
only, and every GET it issues is one the client already issues by itself.
|
||||
|
||||
Run it BEFORE the integrator lands the consumables rows (it will report the
|
||||
14 rows missing, which is the current, wrong state) and AFTER (it should report
|
||||
all clear). It is deliberately NOT part of test_fut_contract.py /
|
||||
test_card_families.py -- those two have fixed baselines (439 / 414) that must
|
||||
not move.
|
||||
|
||||
python3 check_club_stat_vocab.py [--host 127.0.0.1:8099]
|
||||
|
||||
WHAT IT CHECKS, and why each check exists
|
||||
-----------------------------------------
|
||||
1. SPELLING. The 14 consumables* type strings and all 40 vocabulary names are
|
||||
asserted against docs/fut_atoms.tsv. An unrecognised `type` string is not an
|
||||
error on the client: FUN_18012fd40 returns stat id 0 and the row lands in a
|
||||
bucket nothing reads. A typo therefore fails SILENTLY to zero and looks
|
||||
exactly like "the hypothesis was wrong". This is the highest-risk detail in
|
||||
the whole change, so it is checked first and off the atom table, not off a
|
||||
transcription.
|
||||
2. THE THREE DEAD ATOMS. consumablesContract 0xa6 / consumablesTraining 0xa7 /
|
||||
consumablesFitness 0xa8 are real atom names with NO arm in FUN_18012fd40.
|
||||
Sending them proves nothing and lands in bucket 0 under stat id 0. Assert we
|
||||
never send them.
|
||||
3. PURELY ADDITIVE. Every global `type` the server sends today must still be
|
||||
sent, with the same value, after the change. The player/manager/coach panels
|
||||
are live-proven and ride on those rows.
|
||||
4. SHAPE. All four keys in every element (element-local vars are not reset
|
||||
between elements, so a missing key silently inherits the previous element's
|
||||
value), every value an int, contextId 1 for the global bucket.
|
||||
5. THE COUNTS ARE REACHABLE AT ALL. If FUT_CONSUMABLES is armed, the 14 rows
|
||||
must sum to the size of the shelf the server would actually serve. All
|
||||
fourteen at zero while the shelf is armed is the specific failure this whole
|
||||
round is trying to avoid: the club STORE holds no consumables (the shelf is a
|
||||
GET-time overlay), so counting the store alone yields fourteen zeros and an
|
||||
uninterpretable live test.
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
import urllib.request
|
||||
|
||||
HERE = os.path.dirname(os.path.abspath(__file__))
|
||||
DOCS = os.path.join(os.path.dirname(HERE), "docs")
|
||||
sys.path.insert(0, HERE)
|
||||
|
||||
# stat id -> atom id, for the fourteen rows the CONSUMABLES panel (FUN_180043b90
|
||||
# case 6) reads out of bucket 0. Both columns are cross-checked below: the name
|
||||
# against docs/fut_atoms.tsv, the stat id against fut_club_stats.VOCAB.
|
||||
CONSUMABLE_ATOMS = {
|
||||
0x3C: 0xA5, 0x41: 0xAF, 0x42: 0xA9, 0x43: 0xB3, 0x44: 0xAB,
|
||||
0x45: 0xB2, 0x46: 0xB5, 0x47: 0xAA, 0x48: 0xAD, 0x49: 0xB4,
|
||||
0x4A: 0xAC, 0x4B: 0xB0, 0x4C: 0xB1, 0x4D: 0xAE,
|
||||
}
|
||||
|
||||
# Real atom names with no arm in FUN_18012fd40 -> stat id 0 -> dropped.
|
||||
DEAD_NAMES = ("consumablesContract", "consumablesTraining", "consumablesFitness")
|
||||
|
||||
PASS, FAIL = [], []
|
||||
|
||||
|
||||
def ok(msg):
|
||||
PASS.append(msg)
|
||||
|
||||
|
||||
def bad(msg):
|
||||
FAIL.append(msg)
|
||||
|
||||
|
||||
def load_atoms():
|
||||
path = os.path.join(DOCS, "fut_atoms.tsv")
|
||||
atoms = {}
|
||||
with open(path, encoding="utf8", errors="replace") as fh:
|
||||
for line in fh:
|
||||
p = line.rstrip("\n").split("\t")
|
||||
if len(p) >= 3:
|
||||
atoms[p[2]] = int(p[1], 16)
|
||||
return atoms
|
||||
|
||||
|
||||
def get(base, path):
|
||||
url = "http://%s/ut/game/fifa17%s" % (base, path)
|
||||
with urllib.request.urlopen(url, timeout=20) as r:
|
||||
return json.loads(r.read().decode() or "{}")
|
||||
|
||||
|
||||
def main():
|
||||
ap = argparse.ArgumentParser()
|
||||
ap.add_argument("--host", default="127.0.0.1:8099")
|
||||
args = ap.parse_args()
|
||||
|
||||
import fut_club_stats as fcs
|
||||
|
||||
# ---- 1 / 2 spelling, off the atom table ------------------------------
|
||||
atoms = load_atoms()
|
||||
for sid, atom in sorted(CONSUMABLE_ATOMS.items()):
|
||||
name = fcs.VOCAB.get(sid)
|
||||
if name is None:
|
||||
bad("VOCAB has no name for stat id 0x%02x" % sid)
|
||||
elif atoms.get(name) != atom:
|
||||
bad("0x%02x %r: atom %s, expected %s"
|
||||
% (sid, name, hex(atoms.get(name) or 0), hex(atom)))
|
||||
else:
|
||||
ok("0x%02x %-42s atom %s" % (sid, name, hex(atom)))
|
||||
unknown = [n for n in fcs.VOCAB.values() if n not in atoms]
|
||||
if unknown:
|
||||
bad("VOCAB names absent from fut_atoms.tsv: %s" % unknown)
|
||||
else:
|
||||
ok("all %d vocabulary names resolve in fut_atoms.tsv" % len(fcs.VOCAB))
|
||||
if "leaguelogos" in fcs.VOCAB.values():
|
||||
bad("lowercase leaguelogos (0x18d) is NOT in the map; use leagueLogos (0x18e)")
|
||||
else:
|
||||
ok("leagueLogos capitalisation correct")
|
||||
|
||||
# ---- live bodies ------------------------------------------------------
|
||||
try:
|
||||
bodies = {m: get(args.host, "/club/stats/" + m)
|
||||
for m in ("year", "consumables", "country/14", "league/13")}
|
||||
except Exception as exc: # noqa: BLE001
|
||||
print("cannot reach the server at %s: %s" % (args.host, exc))
|
||||
return 2
|
||||
|
||||
for mode, body in bodies.items():
|
||||
rows = body.get("stat", [])
|
||||
if not rows:
|
||||
bad("%s: empty stat body" % mode)
|
||||
continue
|
||||
glob = [r for r in rows if r.get("contextId") == 1]
|
||||
|
||||
# ---- 4 shape ----------------------------------------------------
|
||||
wrong_keys = [r for r in rows
|
||||
if set(r) != {"contextId", "contextValue", "type", "typeValue"}]
|
||||
wrong_type = [r for r in rows
|
||||
if not isinstance(r.get("typeValue"), int)
|
||||
or not isinstance(r.get("contextValue"), int)]
|
||||
if wrong_keys:
|
||||
bad("%s: %d elements do not carry all four keys" % (mode, len(wrong_keys)))
|
||||
elif wrong_type:
|
||||
bad("%s: %d elements carry a non-int value" % (mode, len(wrong_type)))
|
||||
else:
|
||||
ok("%-12s %3d rows, all four keys, all ints" % (mode, len(rows)))
|
||||
|
||||
if rows[0].get("type") != "players":
|
||||
bad("%s: first row is %r, not players -- club_stats_route logs "
|
||||
"stats[0]['typeValue'] as the player count" % (mode, rows[0].get("type")))
|
||||
|
||||
# ---- 2 dead atoms ------------------------------------------------
|
||||
sent = {r["type"] for r in glob}
|
||||
for n in DEAD_NAMES:
|
||||
if n in sent:
|
||||
bad("%s: sends dead atom %s (no arm in FUN_18012fd40)" % (mode, n))
|
||||
|
||||
# ---- the fourteen -------------------------------------------------
|
||||
want = {fcs.VOCAB[s] for s in CONSUMABLE_ATOMS}
|
||||
miss = sorted(want - sent)
|
||||
if miss:
|
||||
bad("%s: %d of the 14 consumables rows MISSING: %s"
|
||||
% (mode, len(miss), ", ".join(miss)))
|
||||
else:
|
||||
ok("%-12s carries all 14 consumables rows" % mode)
|
||||
|
||||
# ---- 3 purely additive ----------------------------------------------
|
||||
ref = {r["type"]: r["typeValue"]
|
||||
for r in bodies["year"]["stat"] if r.get("contextId") == 1}
|
||||
for mode in ("consumables", "country/14", "league/13"):
|
||||
cur = {r["type"]: r["typeValue"]
|
||||
for r in bodies[mode]["stat"] if r.get("contextId") == 1}
|
||||
drift = {k: (v, cur.get(k)) for k, v in ref.items() if cur.get(k) != v}
|
||||
if drift:
|
||||
bad("%s: global rows disagree with year: %s" % (mode, drift))
|
||||
if not any("disagree with year" in f for f in FAIL):
|
||||
ok("the global bucket is identical across all four modes")
|
||||
|
||||
for k in ("players", "playersGold", "playersSilver", "playersBronze",
|
||||
"rarePlayers", "staff"):
|
||||
if k not in ref:
|
||||
bad("live-proven row %r is no longer being sent" % k)
|
||||
|
||||
# ---- 5 the counts are reachable at all -------------------------------
|
||||
total = ref.get("consumables")
|
||||
if total is None:
|
||||
ok("(consumables total not sent yet -- pre-change state)")
|
||||
else:
|
||||
leaves = sum(ref.get(fcs.VOCAB[s], 0)
|
||||
for s in CONSUMABLE_ATOMS if s != 0x3C)
|
||||
if total != leaves:
|
||||
bad("consumables total %d != sum of the 13 leaves %d" % (total, leaves))
|
||||
else:
|
||||
ok("consumables total %d == sum of the leaves" % total)
|
||||
try:
|
||||
import fut_consumables as fc
|
||||
shelf = len(fc.starter_consumables(fc.CONSUMABLE_ID_BASE))
|
||||
except Exception: # noqa: BLE001
|
||||
shelf = None
|
||||
if shelf and total == 0:
|
||||
bad("all 14 rows are ZERO while fut_consumables would serve %d items. "
|
||||
"The shelf is a GET-time OVERLAY and is NOT in the club STORE, so "
|
||||
"counting STORE.items() alone yields fourteen zeros -- see "
|
||||
"_staff_overlay_counts() for the pattern the staff rows already use."
|
||||
% shelf)
|
||||
elif shelf and total != shelf:
|
||||
bad("consumables total %d != shelf size %d" % (total, shelf))
|
||||
elif shelf:
|
||||
ok("consumables total matches the %d-item shelf" % shelf)
|
||||
|
||||
print("\n".join(" ok " + m for m in PASS))
|
||||
if FAIL:
|
||||
print("\n".join(" FAIL " + m for m in FAIL))
|
||||
print("\n%d ok, %d failed" % (len(PASS), len(FAIL)))
|
||||
return 1 if FAIL else 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,515 @@
|
||||
#!/usr/bin/env python3
|
||||
# -*- coding: utf-8 -*-
|
||||
"""The MY CLUB stat vocabulary, censused from CardsDLL, and the body per mode.
|
||||
|
||||
HANDOVER MODULE -- nothing here is wired in. `utas_server.club_stats_route` is
|
||||
owned by the integrate agent; this file is the spec in executable form. Import it
|
||||
and call `stats_body()` / `staff_bonus_body()`, or lift the tables.
|
||||
|
||||
=============================================================================
|
||||
1. THE VOCABULARY IS COMPLETE, AND IT IS AN ATOM TABLE, NOT A STRING TABLE
|
||||
=============================================================================
|
||||
`FUN_18012fd40` (1732 chars, decompiled and read END TO END -- every arm below is
|
||||
transcribed from it, none elided) is the whole map. It does NOT compare strings:
|
||||
|
||||
iVar1 = FUN_180180d00(<the 0x30-byte `type` buffer>); // atom lookup
|
||||
switch (iVar1) { ... } // 40 arms
|
||||
return 0; // default
|
||||
|
||||
So the accepted vocabulary is exactly 40 ATOM IDS, and their spellings are the
|
||||
atom names in docs/fut_atoms.tsv -- which is why a census is possible at all and
|
||||
why "a filtered scan" is not needed: the function IS the census. Anything else
|
||||
(including the real atoms `consumablesContract` 0xa6, `consumablesTraining` 0xa7,
|
||||
`consumablesFitness` 0xa8 and the lowercase `leaguelogos` 0x18d, all of which
|
||||
exist in the atom table and all of which are ABSENT from the switch) returns 0
|
||||
and lands in bucket key 0, which no reader ever looks up. Unknown strings are
|
||||
therefore inert, not fatal.
|
||||
|
||||
Coverage statement, per the standing rule about absences: the claim "these 40 and
|
||||
no others" is a claim about a 1732-char function that was decompiled in full and
|
||||
whose default arm is `return 0`. It is not an inference from a grep.
|
||||
|
||||
=============================================================================
|
||||
2. STORAGE, AND WHY EVERY BODY MUST BE COMPLETE
|
||||
=============================================================================
|
||||
Deserializer 0x180130150 (7870 chars, read in full) writes
|
||||
`store[contextValue][statId] = typeValue` where store = CardsDb + 0x1F8B0.
|
||||
|
||||
* contextId (0xb6) is ONLY a guard: `if (contextId == 1 || contextId-5 < 5)`
|
||||
-> contextValue is forced to 0. contextId 3 is used below purely because it
|
||||
is outside that range and so preserves contextValue.
|
||||
* the storage key is contextValue ALONE. Nation 14, league 14 and team 14 share
|
||||
one bucket. One kind of context per response, never two.
|
||||
* element-local variables are cleared ONCE before the array loop, never inside
|
||||
it. Omit a key in element N and it silently inherits element N-1's value.
|
||||
EMIT ALL FOUR KEYS IN EVERY ELEMENT.
|
||||
* `type` is copied with FUN_180008120(buf, s, 0x30) -- a 48-byte buffer. The
|
||||
longest name we use is 40 chars. Fits.
|
||||
|
||||
THE WIPE IS REAL AND IT IS NOT IN THE DESERIALIZER. That is why one investigator
|
||||
read the deserializer, found no clear, and reported "no wipe". The clear is in the
|
||||
RESPONSE FACTORY, `FUN_18012f6d0`:
|
||||
|
||||
store = CardsDb->vt[0x7f0]();
|
||||
FUN_180116240(store+0x30, *(store+0x48)); // destroy the whole outer tree
|
||||
store+0x38 = store+0x40 = store+0x38; // head = root = sentinel
|
||||
store+0x48 = 0; store+0x50 = 0; store+0x58 = 0;
|
||||
... then allocate "RS4:FutStickerBookStats2ServerResponse"
|
||||
|
||||
So EVERY Stats2 response erases the entire map before parsing. The map only ever
|
||||
holds ONE mode's rows. `FUN_18012f680` is a second, standalone clear of the same
|
||||
tree (session teardown).
|
||||
|
||||
AND THE ORDER IS DECIDED, MEASURED IN /tmp/utas_server.log: every MY CLUB entry
|
||||
is `year` then `consumables`, in that order, 45 and 42 times this session. The
|
||||
panels are therefore ALWAYS reading whatever we returned on `consumables`. A
|
||||
consumables body that carries only consumable rows would blank the players,
|
||||
staff, kits and badges rows of the very same tab strip. Hence: one union body,
|
||||
served on every tab-strip mode.
|
||||
|
||||
(`FUN_18012fa90` also caches: if store+0x78/0x7c/0x80 already equal the requested
|
||||
mode/arg1/arg2, no HTTP request is made at all. Re-entering the SAME screen twice
|
||||
in a row is served from the map that is already there.)
|
||||
|
||||
=============================================================================
|
||||
3. WHO READS WHAT. Five consumers, and that is all five.
|
||||
=============================================================================
|
||||
Census method: byte-scan of .text for `call [reg+0x7f8]` / `[reg+0x800]` over all
|
||||
16 registers (with and without REX). Exactly five functions contain such a call:
|
||||
|
||||
FUN_180043b90 the club-stats data provider; switch on store+0x78 (the MODE)
|
||||
FUN_180094ce0 the MY CLUB eight-row summary panel
|
||||
FUN_180095360 the MY CLUB CONSUMABLES tab (7 rows + NUM_COLLECTED)
|
||||
FUN_180096670 the MY CLUB tab builder (staff tab, consumables tab, tiles)
|
||||
FUN_180097c70 the MY CLUB tile-detail panel
|
||||
|
||||
Call graph: FUN_180095660 -> FUN_180096670 -> {FUN_180095360, FUN_180097c70 ->
|
||||
FUN_180094ce0}. FUN_180043b90 has no in-image caller (it is registered).
|
||||
|
||||
CRUCIAL, AND IT CORRECTS THE RECORD: the four MY CLUB panels do NOT switch on the
|
||||
mode. They read the store unconditionally. Only FUN_180043b90 switches. So the
|
||||
mode decides which of ITS cases runs, but the MY CLUB screen renders from
|
||||
whatever the last response left behind, regardless of mode. This is why the union
|
||||
body works and why "the client never asks for /club/stats/club" is survivable.
|
||||
|
||||
=============================================================================
|
||||
4. THE CORRECTION THAT MATTERS MOST THIS ROUND
|
||||
=============================================================================
|
||||
REBUILD_RESEARCH S19 states: "Case 6 reads ids 0x3d CONTRACTS, 0x3e TRAINING and
|
||||
0x40 FITNESS, which are exactly the three ids the type-string map cannot produce.
|
||||
The consumables view is unsettable from this endpoint by construction."
|
||||
|
||||
THAT IS WRONG, and it is the reason the consumables tab is empty. 0x3d/0x3e/0x40
|
||||
are read by case 5 (newcards), not case 6. Case 6 (consumables) reads:
|
||||
|
||||
0x43 0x46 0x42 0x44 0x41 0x4b 0x4c 0x45 0x47 0x48 0x49 0x4d 0x4a 0x3c
|
||||
|
||||
FOURTEEN ids, and EVERY ONE OF THEM IS IN THE TYPE MAP. The consumables panel is
|
||||
fully settable from /club/stats/consumables. The same fourteen (minus 0x48) drive
|
||||
the MY CLUB consumables tab FUN_180095360. We have simply never sent one of them:
|
||||
the body we serve on `consumables` today is the PLAYER stat set.
|
||||
|
||||
Three ids in the vocabulary are read by nobody: 0x29 kitsHome and 0x2a kitsAway
|
||||
are read only by case 5, 0x2f leagueLogos only by case 5. Three ids are read but
|
||||
CANNOT be set: 0x3d, 0x3e, 0x40 (no atom maps to them) -- case 5 only.
|
||||
|
||||
=============================================================================
|
||||
5. THE STAFF BONUS ENDPOINT IS A SECOND, DISJOINT VOCABULARY
|
||||
=============================================================================
|
||||
GET club/stats/staff is FutStaffBonus, deserializer 0x18012b730 (2243 chars, read
|
||||
in full), shape {"bonus":[{"type":str,"value":int}]}. It does NOT touch the Stats2
|
||||
map (so it cannot wipe it), and it does NOT go through FUN_18012fd40. It calls
|
||||
|
||||
store = CardsDb->vt[0x938]() // == CardsDb + 0x5AF0, a flat struct
|
||||
FUN_18012b370(store, typeString, byteValue)
|
||||
|
||||
and FUN_18012b370 is a 22-arm atom switch writing ONE BYTE each at store+0x30 ..
|
||||
store+0x45. Value path: INT getter 0x1801c79d0 -> FUN_1800d7b50, which clamps to
|
||||
0..255 and returns 0 for anything <= 0. `type` goes into a 0x20 buffer; the
|
||||
longest name in the vocabulary is 14 chars.
|
||||
|
||||
Those 22 bytes are the PERCENTAGES on the MY CLUB -> STAFF tab (FUN_180096670
|
||||
case 8, customData 0x14): every row is published with LEFT_PERCENT/RIGHT_PERCENT
|
||||
set to 1. The five COUNTS on the same tab come from the Stats2 store instead
|
||||
(ids 0xb..0xf), so the staff tab needs BOTH endpoints answered.
|
||||
|
||||
=============================================================================
|
||||
6. WHAT IS INFERRED RATHER THAN PROVEN
|
||||
=============================================================================
|
||||
FUN_180094ce0 iterates a vector at model+0x140 (stride 0x40): dword 0 is a
|
||||
category code, dword +8 is the contextValue it looks up. Codes 1..7 and 9 do the
|
||||
six per-context reads (0x28, 0x2d, 4, 3, 2, 5); code 8 reads stadia globally, 10
|
||||
balls, 0x10 the six trophy ids, 0x12 the five staff ids. That +8 value is
|
||||
INFERRED to be a nation id: FUN_180043b90 case 2 performs the identical six reads
|
||||
on rows whose id it fetches as "NATION_ID", and FUN_180097c70 (this function's
|
||||
caller) does the same. The vector's producer was not located, so this is a strong
|
||||
structural inference, not a proof. See LIVE_TESTS at the bottom.
|
||||
"""
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# THE VOCABULARY. statId -> the JSON `type` string (== the atom name).
|
||||
# Transcribed arm by arm from FUN_18012fd40. 40 entries, complete.
|
||||
# --------------------------------------------------------------------------
|
||||
VOCAB = {
|
||||
0x01: "players", # atom 0x238
|
||||
0x02: "playersBronze", # atom 0x239
|
||||
0x03: "playersSilver", # atom 0x23b
|
||||
0x04: "playersGold", # atom 0x23a
|
||||
0x05: "rarePlayers", # atom 0x272
|
||||
0x0A: "staff", # atom 0x2dc
|
||||
0x0B: "staffManager", # atom 0x2dd
|
||||
0x0C: "staffHeadCoach", # atom 0x2de
|
||||
0x0D: "staffGKCoach", # atom 0x2e0 <- NOTE 0x2e0, not 0x2df
|
||||
0x0E: "staffPhysio", # atom 0x2e1
|
||||
0x0F: "staffFitnessCoach", # atom 0x2df <- the pair is transposed
|
||||
0x14: "stadia", # atom 0x2d7
|
||||
0x1E: "balls", # atom 0x04f
|
||||
0x28: "kits", # atom 0x17c
|
||||
0x29: "kitsHome", # atom 0x17d
|
||||
0x2A: "kitsAway", # atom 0x17e
|
||||
0x2D: "badges", # atom 0x04b
|
||||
0x2E: "badgeDBid", # atom 0x04a
|
||||
0x2F: "leagueLogos", # atom 0x18e (NOT 0x18d `leaguelogos`)
|
||||
0x32: "trophies", # atom 0x340
|
||||
0x33: "trophiesOffline", # atom 0x343
|
||||
0x34: "trophiesOnline", # atom 0x344
|
||||
0x35: "trophiesFeaturedOffline", # atom 0x341
|
||||
0x36: "trophiesFeaturedOnline", # atom 0x342
|
||||
0x37: "trophiesSeasonOffline", # atom 0x345
|
||||
0x38: "trophiesSeasonOnline", # atom 0x346
|
||||
0x3C: "consumables", # atom 0x0a5
|
||||
0x41: "consumablesHealing", # atom 0x0af
|
||||
0x42: "consumablesContractPlayer", # atom 0x0a9
|
||||
0x43: "consumablesTrainingPlayer", # atom 0x0b3
|
||||
0x44: "consumablesFitnessPlayer", # atom 0x0ab
|
||||
0x45: "consumablesPosition", # atom 0x0b2
|
||||
0x46: "consumablesTrainingGk", # atom 0x0b5
|
||||
0x47: "consumablesContractManager", # atom 0x0aa
|
||||
0x48: "consumablesFormationManager", # atom 0x0ad
|
||||
0x49: "consumablesTrainingManager", # atom 0x0b4
|
||||
0x4A: "consumablesFitnessTeam", # atom 0x0ac
|
||||
0x4B: "consumablesTrainingPlayerPlayStyle", # atom 0x0b0
|
||||
0x4C: "consumablesTrainingGkPlayStyle", # atom 0x0b1
|
||||
0x4D: "consumablesTrainingManagerLeagueModifier", # atom 0x0ae
|
||||
}
|
||||
|
||||
# Read by a consumer but produced by NO atom -- unsettable from this endpoint.
|
||||
UNSETTABLE = {0x3D: "CONTRACTS (case 5)", 0x3E: "TRAINING (case 5)",
|
||||
0x40: "FITNESS (case 5)"}
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# WHO READS WHICH ID. (id, reader, on-screen row)
|
||||
# --------------------------------------------------------------------------
|
||||
# FUN_180043b90 case 1 "club" global 1,0x1e,0x28,0x14,0x0a,0x32
|
||||
# FUN_180043b90 case 2 "year" global 0x1e,0x14,0xb,0xc,0xe,0xd,0xf,
|
||||
# 0x33,0x34,0x35,0x36,0x37,0x38
|
||||
# + per NATION_ID 2,3,4 (PLAYERS = their sum),5,
|
||||
# 0x28,0x2d
|
||||
# FUN_180043b90 case 3 "country/id" per LEAGUE_ID 2,3,4,5,0x28,0x2d
|
||||
# FUN_180043b90 case 4 "league/id" per TEAM_ID 1,0x28,0x2e
|
||||
# FUN_180043b90 case 5 "newcards" global 1,0x0a,0x14,0x1e,0x28,0x2f,0xb,
|
||||
# 0xc,0xf,0xd,0xe,0x2d,0x29,0x2a,
|
||||
# 0x3c,[0x3d,0x3e,0x40],0x41
|
||||
# FUN_180043b90 case 6 "consumables" global 0x43,0x46,0x42,0x44,0x41,0x4b,
|
||||
# 0x4c,0x45,0x47,0x48,0x49,0x4d,
|
||||
# 0x4a,0x3c
|
||||
# FUN_180094ce0 summary per tile id 0x28,0x2d,4,3,2,5 ; global 0x14,0x1e,
|
||||
# 0x33..0x38, 0xb..0xf
|
||||
# FUN_180095360 consumables tab global 0x46+0x43, 0x47+0x42, 0x4a+0x44, 0x41,
|
||||
# 0x4c+0x4b, 0x4d, 0x49+0x45, 0x3c
|
||||
# FUN_180096670 staff tab global 0xb,0xc,0xf,0xd,0xe (+ the bonus bytes)
|
||||
# FUN_180097c70 tile detail global 0x14,0x33..0x38,0xb..0xf,0x1e ;
|
||||
# per id 2,3,4,0x28,0x2d,5
|
||||
|
||||
MODE_READS = {
|
||||
"club": {"global": (0x01, 0x1E, 0x28, 0x14, 0x0A, 0x32), "context": None},
|
||||
"year": {"global": (0x1E, 0x14, 0x0B, 0x0C, 0x0E, 0x0D, 0x0F,
|
||||
0x33, 0x34, 0x35, 0x36, 0x37, 0x38),
|
||||
"context": ("nation", (0x02, 0x03, 0x04, 0x05, 0x28, 0x2D))},
|
||||
"country": {"global": (), "context": ("leagueId", (0x02, 0x03, 0x04, 0x05,
|
||||
0x28, 0x2D))},
|
||||
"league": {"global": (), "context": ("teamid", (0x01, 0x28, 0x2E))},
|
||||
"newcards": {"global": (0x01, 0x0A, 0x14, 0x1E, 0x28, 0x2F, 0x0B, 0x0C,
|
||||
0x0F, 0x0D, 0x0E, 0x2D, 0x29, 0x2A, 0x3C, 0x41),
|
||||
"context": None},
|
||||
"consumables": {"global": (0x43, 0x46, 0x42, 0x44, 0x41, 0x4B, 0x4C, 0x45,
|
||||
0x47, 0x48, 0x49, 0x4D, 0x4A, 0x3C), "context": None},
|
||||
}
|
||||
|
||||
# The tab-strip modes: all four render the SAME MY CLUB screen, whose panels read
|
||||
# the store unconditionally. They get the identical union body.
|
||||
TAB_STRIP_MODES = ("", "year", "consumables", "club", "newcards")
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# THE STAFF-BONUS VOCABULARY. atom name -> (store byte offset, screen row)
|
||||
# Transcribed arm by arm from FUN_18012b370 (22 arms), rows from FUN_180096670
|
||||
# case 8. Group codes are the staff-group table at 0x180203310, stride 0x18.
|
||||
# --------------------------------------------------------------------------
|
||||
STAFF_BONUS = {
|
||||
# manager group (code 2, count id 0x0b)
|
||||
"contract": (0x30, "FUT_CONTRACTS"),
|
||||
"managerTalk": (0x31, None), # parsed, no reader found in case 8
|
||||
# fitness-coach group (code 4, count id 0x0f)
|
||||
"fitness": (0x32, "FUT_FITNESS"),
|
||||
# physio group (code 5, count id 0x0e)
|
||||
"physioHead": (0x33, "FUT_MC_HEAD"),
|
||||
"physioShoudler": (0x34, "FUT_MC_UPPERBODY"), # sic, EA's spelling
|
||||
"physioArm": (0x35, "FUT_MC_ARM"),
|
||||
"physioBack": (0x36, "FUT_MC_BACK"),
|
||||
"physioHip": (0x37, "FUT_MC_KNEE"),
|
||||
"physioLeg": (0x38, "FUT_MC_LEG"),
|
||||
"physioFoot": (0x39, "FUT_MC_FOOT"),
|
||||
# GK-coach group (code 10, count id 0x0d)
|
||||
"gkDiving": (0x3A, "FUT_MC_DIVING"),
|
||||
"gkHandling": (0x3B, "FUT_MC_HANDLING"),
|
||||
"gkKicking": (0x3C, "FUT_MC_KICKING"),
|
||||
"gkReflexes": (0x3D, "FUT_MC_REFLEXES"),
|
||||
"gkOneOnOne": (0x3E, "FUT_MC_ACCELERATION"), # label/name disagree; EA's
|
||||
"gkPositioning": (0x3F, "FUT_MC_POSITIONING"),
|
||||
# head-coach group (code 3, count id 0x0c)
|
||||
"pace": (0x40, "FUT_MC_PACE"),
|
||||
"shooting": (0x41, "FUT_MC_SHOOTING"),
|
||||
"passing": (0x42, "FUT_MC_PASSING"),
|
||||
"dribbling": (0x43, "FUT_MC_DRIBBLING"),
|
||||
"defending": (0x44, "FUT_MC_DEFENDING"),
|
||||
"heading": (0x45, "FUT_MC_HEADING"),
|
||||
}
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# consumable card `kind` (fut_consumables.SUBTYPES) -> stat id.
|
||||
# --------------------------------------------------------------------------
|
||||
CONSUMABLE_KIND_STAT = {
|
||||
"player_contract": 0x42,
|
||||
"manager_contract": 0x47,
|
||||
"healing": 0x41,
|
||||
"player_fitness": 0x44,
|
||||
"squad_fitness": 0x4A,
|
||||
"gk_training": 0x46,
|
||||
"player_training": 0x43,
|
||||
"position_mod": 0x45,
|
||||
"player_playstyle": 0x4B,
|
||||
"gk_playstyle": 0x4C,
|
||||
"manager_league": 0x4D,
|
||||
"manager_formation_mod": 0x48,
|
||||
"formation_mod": 0x48,
|
||||
# DEAD_ZONE subtypes are never shipped and are counted nowhere.
|
||||
}
|
||||
|
||||
# cardsubtypeid -> staff stat id (the merge's own families, see CARD_SYSTEM.md).
|
||||
STAFF_SUBTYPE_STAT = {4: 0x0B, 5: 0x0C, 6: 0x0D, 7: 0x0E, 8: 0x0F}
|
||||
|
||||
PLAYER_SUBTYPES = (0, 1, 2, 3)
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# THE TWO UI GROUP TABLES, for reference. Both are (code, label, extra) triples
|
||||
# at stride 0x18, and both are indexed by the switch in FUN_180096670.
|
||||
#
|
||||
# consumables tab, table at 0x180203260, switch case 0xb:
|
||||
# code 0x00 FUT_MYCLUB_CONSUMABLES_TRAINING_EARNED "training"
|
||||
# code 0x01 FUT_MYCLUB_CONSUMABLES_CONTRACT_EARNED "contracts"
|
||||
# code 0x04 FUT_MYCLUB_CONSUMABLES_FITNESS_EARNED "fitness"
|
||||
# code 0x03 FUT_MYCLUB_CONSUMABLES_HEALING_EARNED "healing"
|
||||
# code 0x17 FUT_MYCLUB_CONSUMABLES_PLAYSTYLE_EARNED "playStyle"
|
||||
# code 0x18 FUT_MYCLUB_CONSUMABLES_MANAGER_LEAGUE_EARNED "managerLeagueModifier"
|
||||
# code 0x11 FUT_MYCLUB_CONSUMABLES_TACTIC_TRAINING_EARNED "position"
|
||||
#
|
||||
# staff tab, table at 0x180203310, switch case 8:
|
||||
# code 0x02 FUT_MYCLUB_MANAGERS count 0x0b bonus row FUT_CONTRACTS
|
||||
# code 0x03 FUT_MYCLUB_HEADCOACHES count 0x0c 6 attribute bonus rows
|
||||
# code 0x04 FUT_MYCLUB_FITNESS count 0x0f bonus row FUT_FITNESS
|
||||
# code 0x0a FUT_MYCLUB_GKCOACHES count 0x0d 6 GK bonus rows
|
||||
# code 0x05 FUT_MYCLUB_PHYSIO count 0x0e 7 body-part bonus rows
|
||||
#
|
||||
# THOSE GROUP NAMES ARE NOT ?type= VALUES. The club query taxonomy is a separate
|
||||
# 30-arm atom switch, FUN_18012ec50, and it reads:
|
||||
# 0 any, 1 player, 2 manager, 3 headcoach, 4 fitnesscoach, 5 physio,
|
||||
# 6 development, 7 custom, 8 unlocks, 9 gkcoach, 10 staff, 11 badge, 12 kit,
|
||||
# 13 stadium, 14 ball, 15 equippables, 16 leaguelogos, 17 offlinetrophy,
|
||||
# 18 onlinetrophy, 19 featuredofflinetrophy, 20 featuredonlinetrophy,
|
||||
# 21 allofflinetrophy, 22 allonlinetrophy, 23 healing, 24 contract,
|
||||
# 25 training, 26 misc, 27 playerdefender, 28 playermidfielder,
|
||||
# 29 playerforward.
|
||||
# So last round's type=contract / training / healing / development arms were
|
||||
# CORRECTLY NAMED. The empty consumables tab is not a naming bug on that route.
|
||||
# --------------------------------------------------------------------------
|
||||
|
||||
|
||||
def _row(ctx_id, ctx_val, stat_id, value):
|
||||
"""One stat element. All four keys, always -- see the note about element-local
|
||||
variables not being reset between elements."""
|
||||
return {"contextId": int(ctx_id), "contextValue": int(ctx_val),
|
||||
"type": VOCAB[stat_id], "typeValue": int(value)}
|
||||
|
||||
|
||||
def global_counts(items, staff_counts=None):
|
||||
"""{statId: value} for the global bucket, from the items the club holds.
|
||||
|
||||
`items` is the club item list (utas_server STORE.items() shape).
|
||||
`staff_counts` optionally overrides the staff tally with the synthetic
|
||||
overlay's counts, keyed by cardsubtypeid 4..8.
|
||||
"""
|
||||
try:
|
||||
import fut_consumables
|
||||
except Exception:
|
||||
fut_consumables = None
|
||||
|
||||
players = [i for i in items if i.get("cardsubtypeid", 0) in PLAYER_SUBTYPES]
|
||||
rating = lambda i: i.get("rating") or 0
|
||||
c = {
|
||||
0x01: len(players),
|
||||
0x04: len([i for i in players if rating(i) >= 75]),
|
||||
0x03: len([i for i in players if 65 <= rating(i) < 75]),
|
||||
0x02: len([i for i in players if 0 < rating(i) < 65]),
|
||||
0x05: len([i for i in players if i.get("rareflag")]),
|
||||
}
|
||||
|
||||
# staff, per family
|
||||
staff = dict(staff_counts) if staff_counts else {}
|
||||
if not staff:
|
||||
for i in items:
|
||||
st = i.get("cardsubtypeid", 0)
|
||||
if st in STAFF_SUBTYPE_STAT:
|
||||
staff[st] = staff.get(st, 0) + 1
|
||||
for st, sid in STAFF_SUBTYPE_STAT.items():
|
||||
c[sid] = staff.get(st, 0)
|
||||
c[0x0A] = sum(c[s] for s in STAFF_SUBTYPE_STAT.values())
|
||||
|
||||
# consumables, per family
|
||||
for sid in (0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49,
|
||||
0x4A, 0x4B, 0x4C, 0x4D):
|
||||
c[sid] = 0
|
||||
total_cons = 0
|
||||
if fut_consumables is not None:
|
||||
for i in items:
|
||||
rec = fut_consumables.BY_SUBTYPE.get(i.get("cardsubtypeid", 0))
|
||||
if rec is None:
|
||||
continue
|
||||
total_cons += 1
|
||||
sid = CONSUMABLE_KIND_STAT.get(rec["kind"])
|
||||
if sid:
|
||||
c[sid] = c.get(sid, 0) + 1
|
||||
c[0x3C] = total_cons
|
||||
|
||||
# club items. Honest zeros unless the club really holds them; cardtype 9 has
|
||||
# no merge arm, so we cannot classify these from the item record and the club
|
||||
# holds none today. Every one of these is READ by some panel, so it must be
|
||||
# present or the panel keeps the previous screen's number.
|
||||
for sid in (0x14, 0x1E, 0x28, 0x29, 0x2A, 0x2D, 0x2E, 0x2F,
|
||||
0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38):
|
||||
c.setdefault(sid, 0)
|
||||
return c
|
||||
|
||||
|
||||
def context_rows(items, kind):
|
||||
"""Per-context rows for one screen. `kind` is "", "country" or "league"."""
|
||||
field = {"": "nation", "country": "leagueId", "league": "teamid"}.get(kind)
|
||||
if not field:
|
||||
return [], 0
|
||||
players = [i for i in items if i.get("cardsubtypeid", 0) in PLAYER_SUBTYPES]
|
||||
rating = lambda i: i.get("rating") or 0
|
||||
ctxs = sorted({i.get(field) for i in players if i.get(field) is not None})
|
||||
rows = []
|
||||
for ctx in ctxs:
|
||||
sel = [i for i in players if i.get(field) == ctx]
|
||||
if field == "teamid":
|
||||
# case 4 reads 1, 0x28, 0x2e. FUN_180043b90 publishes 0x2e raw as
|
||||
# BADGES_AVAILABLE; the tab builder FUN_180096670 publishes the same
|
||||
# id as `(uint)(iVar6 != 0)` -- a HAS-A-BADGE boolean. Any non-zero
|
||||
# therefore reads as 1 on one screen and as itself on the other.
|
||||
vals = [(0x01, len(sel)), (0x28, 0), (0x2E, 0)]
|
||||
else:
|
||||
# cases 2 and 3 COMPUTE players as gold+silver+bronze and never read
|
||||
# id 1. The tier counts are mandatory, not decoration.
|
||||
vals = [(0x04, len([i for i in sel if rating(i) >= 75])),
|
||||
(0x03, len([i for i in sel if 65 <= rating(i) < 75])),
|
||||
(0x02, len([i for i in sel if 0 < rating(i) < 65])),
|
||||
(0x05, len([i for i in sel if i.get("rareflag")])),
|
||||
(0x28, 0), (0x2D, 0)]
|
||||
rows += [_row(3, ctx, sid, v) for sid, v in vals]
|
||||
return rows, len(ctxs)
|
||||
|
||||
|
||||
def stats_body(mode, items, staff_counts=None):
|
||||
"""The FutStickerBookStats2 body for GET ut/%s/club/stats/<mode>.
|
||||
|
||||
`mode` is the URL tail: "", "year", "consumables", "club", "newcards",
|
||||
"country/<id>", "league/<id>". The id in the URL says WHICH SCREEN, never
|
||||
which bucket: country/<n> renders a list of LEAGUES and league/<n> a list of
|
||||
TEAMS, and the reader looks each row up by that row's own id.
|
||||
"""
|
||||
parts = (mode or "").split("/")
|
||||
head = parts[0]
|
||||
glob = global_counts(items, staff_counts)
|
||||
stats = [_row(1, 0, sid, val) for sid, val in sorted(glob.items())]
|
||||
if len(parts) >= 2 and parts[1].isdigit() and head in ("country", "league"):
|
||||
ctx, _n = context_rows(items, head)
|
||||
else:
|
||||
ctx, _n = context_rows(items, "")
|
||||
return {"stat": stats + ctx}
|
||||
|
||||
|
||||
def staff_bonus_body(bonuses):
|
||||
"""The FutStaffBonus body for GET ut/%s/club/stats/staff.
|
||||
|
||||
`bonuses` is {atom name: 0..255}. Names not in STAFF_BONUS are dropped rather
|
||||
than sent: an unknown name is inert (FUN_18012b370 falls through) but sending
|
||||
one proves nothing and widens the surface. An empty dict yields {"bonus":[]},
|
||||
which is a different thing from today's {} -- see the live test.
|
||||
"""
|
||||
out = []
|
||||
for name, val in bonuses.items():
|
||||
if name not in STAFF_BONUS:
|
||||
continue
|
||||
v = int(val)
|
||||
out.append({"type": name, "value": max(0, min(255, v))})
|
||||
return {"bonus": out}
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------
|
||||
# LIVE TESTS (a human fires these; nothing here mutates a save)
|
||||
# --------------------------------------------------------------------------
|
||||
# T1 CONSUMABLES TAB. Serve the union body on every tab-strip mode, then open
|
||||
# MY CLUB -> CONSUMABLES.
|
||||
# positive: the seven rows read TRAINING 42, CONTRACT 13, FITNESS 6,
|
||||
# HEALING 21, PLAYSTYLE 24, MANAGER LEAGUE 0, TACTIC TRAINING 20,
|
||||
# and the header count reads 126 (with the 126-item shelf armed).
|
||||
# negative: all seven still 0 -> the tab is not reading the Stats2 store at
|
||||
# all and FUN_180095360 is not the renderer. That is interpretable
|
||||
# and it kills the whole approach, which is why it is worth firing.
|
||||
#
|
||||
# T2 NATION KEYING (settles the one inference in this file). With the union
|
||||
# body live, read FUT_MYCLUB_PLAYERS_EMPLOYED on the MY CLUB summary.
|
||||
# positive: 205 (the sum over all 29 nation buckets).
|
||||
# negative: 0 while the ENGLAND -> Premier League row still reads 17 -> the
|
||||
# tile vector at model+0x140 is NOT keyed by nation id, and the
|
||||
# producer of that vector has to be found. Also interpretable.
|
||||
#
|
||||
# T3 STAFF BONUS. Answer club/stats/staff with staff_bonus_body({"pace": 7,
|
||||
# "contract": 3}) and open MY CLUB -> STAFF.
|
||||
# positive: the head-coach group shows PACE 7% and the manager group shows
|
||||
# CONTRACTS 3%.
|
||||
# negative: both read 0% -> the bytes at CardsDb+0x5AF0+0x40/+0x30 are not
|
||||
# what the tab renders, and the 22-name table is wrong about its
|
||||
# consumer (it is not wrong about the parser).
|
||||
# Two distinct values on two distinct groups on purpose: one number could be
|
||||
# a coincidence, two in the right places cannot.
|
||||
|
||||
if __name__ == "__main__":
|
||||
import json
|
||||
import os
|
||||
import sys
|
||||
here = os.path.dirname(os.path.abspath(__file__))
|
||||
sys.path.insert(0, here)
|
||||
prof = json.load(open(os.path.join(here, "fifa17_profile.json")))
|
||||
items = prof["items"]
|
||||
print("club: %d items" % len(items))
|
||||
for m in ("year", "consumables", "country/14", "league/13"):
|
||||
b = stats_body(m, items)
|
||||
g = [r for r in b["stat"] if r["contextId"] == 1]
|
||||
c = [r for r in b["stat"] if r["contextId"] == 3]
|
||||
print(" %-12s %3d rows (%d global, %d context)"
|
||||
% (m, len(b["stat"]), len(g), len(c)))
|
||||
print("\nglobal bucket, non-zero rows:")
|
||||
for r in stats_body("year", items)["stat"]:
|
||||
if r["contextId"] == 1 and r["typeValue"]:
|
||||
print(" %-42s %d" % (r["type"], r["typeValue"]))
|
||||
@@ -0,0 +1,27 @@
|
||||
# Census query: (a) how the client consumes /settings configs (feature-flag gate),
|
||||
# (b) the closed set of club/stats/%s kinds, (c) which URL suffix templates have
|
||||
# live xrefs and from where.
|
||||
import re
|
||||
|
||||
def find_str(s):
|
||||
hits = find_all(s.encode() + b"\x00", blocks=(".rdata", ".data", ".text"))
|
||||
return hits
|
||||
|
||||
TARGETS = [
|
||||
"/stats/%s", "/stats/%s/%d", "/stats/staff", "/consumables/%s", "/counts",
|
||||
"configs", "storeEnabled", "tradingEnabled", "enableSquadBuildingSetsFeature",
|
||||
"enableObjectives", "enableDraftMode", "friendlySeasonsEnabled",
|
||||
"/squadBuildingSets", "/sets", "/objective/", "/totw", "/loan/players",
|
||||
"/tutorialpopups", "/storymode/progress",
|
||||
]
|
||||
|
||||
for t in TARGETS:
|
||||
hits = find_str(t)
|
||||
print("=== %-34s %d string hit(s)" % (repr(t), len(hits)))
|
||||
for h in hits[:4]:
|
||||
xs = xrefs_to(h)
|
||||
print(" @%#x xrefs=%d" % (h, len(xs)))
|
||||
for (fr, ty, fn, en) in xs[:8]:
|
||||
print(" %#x %-12s %s @%#x" % (fr, ty, fn, en))
|
||||
print()
|
||||
print("#" * 70)
|
||||
@@ -0,0 +1,13 @@
|
||||
# Decompile the URL builders + the settings config consumer.
|
||||
TARGETS = {
|
||||
"FUN_18012f4f0 club /stats/%s builder": 0x18012f4f0,
|
||||
"FUN_1801308c0 /consumables/%s builder": 0x1801308c0,
|
||||
"FutGetSettings deser 0x18013c6d0": 0x18013c6d0,
|
||||
"0x18012b083 /stats/staff caller": 0x18012b083,
|
||||
}
|
||||
for name, a in TARGETS.items():
|
||||
c = dec(a)
|
||||
print("=" * 78)
|
||||
print("### %s (len %d)" % (name, len(c)))
|
||||
print(c[:14000])
|
||||
print()
|
||||
@@ -0,0 +1,23 @@
|
||||
import re
|
||||
c = dec(0x18013c6d0)
|
||||
open("/tmp/gf_unserved_settings.c", "w").write(c)
|
||||
print("settings deser len", len(c))
|
||||
cases = re.findall(r"case (0x[0-9a-f]+):|if \(iVar2 == (0x[0-9a-f]+)\)", c)
|
||||
ids = sorted({int(a or b, 16) for a, b in cases})
|
||||
print("switch atoms (%d):" % len(ids), " ".join(hex(i) for i in ids))
|
||||
|
||||
for a, nm in ((0x18012b083, "/stats/staff caller"),
|
||||
(0x180163583, "/counts caller"),
|
||||
(0x18016fa33, "/squadBuildingSets caller"),
|
||||
(0x18017a980, "/sets caller"),
|
||||
(0x180151610, "/objective/ caller A"),
|
||||
(0x180147780, "/objective/ caller B"),
|
||||
(0x18016ef23, "/totw caller"),
|
||||
(0x18014dda3, "/loan/players caller"),
|
||||
(0x18016d813, "/tutorialpopups caller"),
|
||||
(0x18016f5f3, "/storymode/progress caller")):
|
||||
d = dec(a)
|
||||
open("/tmp/gf_unserved_%x.c" % a, "w").write(d)
|
||||
print("\n" + "=" * 70)
|
||||
print("### %s @%#x (len %d)" % (nm, a, len(d)))
|
||||
print(d[:3500])
|
||||
@@ -0,0 +1,25 @@
|
||||
import re
|
||||
# 1. consumables panel provider: which type ids does mode 6 read?
|
||||
c = dec(0x180043b90)
|
||||
open("/tmp/gf_prov.c", "w").write(c)
|
||||
print("### FUN_180043b90 provider len", len(c))
|
||||
i = c.find("case 6")
|
||||
print("--- case-6 region ---")
|
||||
print(c[i-200:i+3000] if i > 0 else "case 6 NOT FOUND; switch text:\n" + "\n".join(
|
||||
l for l in c.splitlines() if "case" in l or "switch" in l))
|
||||
|
||||
# 2. who calls the /consumables/%s builder, /sets, /squadBuildingSets
|
||||
for nm, a in (("/consumables/%s builder FUN_1801308c0", 0x1801308c0),
|
||||
("/sets builder FUN_18017a980", 0x18017a980)):
|
||||
print("\n### callers of %s" % nm)
|
||||
for (fr, ty, fn, en) in xrefs_to(a):
|
||||
print(" %#x %-12s %s @%#x" % (fr, ty, fn, en))
|
||||
|
||||
# 3. the base URL used with those builders: decompile one caller each
|
||||
print("\n### FUN_1801308c0 caller decompile")
|
||||
xs = xrefs_to(0x1801308c0)
|
||||
for (fr, ty, fn, en) in xs[:2]:
|
||||
if en:
|
||||
d = dec(en)
|
||||
print("--- %s @%#x len %d ---" % (fn, en, len(d)))
|
||||
print(d[:5000])
|
||||
@@ -0,0 +1,40 @@
|
||||
# Pin the BASE template each suffix builder composes onto, by walking the vtable the
|
||||
# builder sits in and reading the sibling slot that returns the base string.
|
||||
BASES = ["ut/%s/sbs", "ut/%s/draft/mode", "ut/%s/club", "ut/%s/item", "ut/%s",
|
||||
"ut/%s/champion", "ut/%s/leaderboards", "ut/%s/season", "ut/%s/tournament",
|
||||
"ut/%s/auctionhouse", "ut/%s/trade", "ut/%s/tradePile", "ut/%s/marketdata",
|
||||
"ut/%s/purchased", "ut/%s/user", "ut/%s/squad", "ut/%s/squad/mode"]
|
||||
for b in BASES:
|
||||
hits = find_all(b.encode() + b"\x00", blocks=(".rdata", ".data", ".text"))
|
||||
print("=== %-22s %s" % (b, [hex(h) for h in hits]))
|
||||
for h in hits:
|
||||
for (fr, ty, fn, en) in xrefs_to(h):
|
||||
print(" ref %#x %-10s %s @%#x" % (fr, ty, fn, en))
|
||||
|
||||
# Builders whose base we still need. Print the vtable that holds each.
|
||||
BUILDERS = {"objective/reward FUN_180151610": 0x180151610,
|
||||
"objective/complete FUN_180147780": 0x180147780,
|
||||
"sets FUN_18017a980": 0x18017a980,
|
||||
"consumables FUN_1801308c0": 0x1801308c0,
|
||||
"clubstats FUN_18012f4f0": 0x18012f4f0}
|
||||
for nm, a in BUILDERS.items():
|
||||
print("\n### vtable slots holding %s" % nm)
|
||||
for h in find_all(a.to_bytes(8, "little"), blocks=(".rdata", ".data")):
|
||||
print(" vt entry @%#x" % h)
|
||||
for k in range(-6, 7):
|
||||
try:
|
||||
q = qword(h + k * 8)
|
||||
except Exception:
|
||||
continue
|
||||
tag = ""
|
||||
if 0x180000000 <= q < 0x181000000:
|
||||
try:
|
||||
s = rd_str(q, 60)
|
||||
if s and all(32 <= ord(c) < 127 for c in s) and len(s) > 2:
|
||||
tag = " STR %r" % s
|
||||
except Exception:
|
||||
pass
|
||||
f = fm.getFunctionAt(addr(q))
|
||||
if f is not None and not tag:
|
||||
tag = " FN %s" % f.getName()
|
||||
print(" [%+2d] %#018x%s" % (k, q, tag))
|
||||
@@ -0,0 +1,67 @@
|
||||
# VERIFICATION pass for the "unserved screens" census. Re-derives, independently:
|
||||
# 1. FUN_180043b90 (claimed club-stats panel provider) -- FULL decompile, length,
|
||||
# brace balance, every switch arm, and case-6's row list.
|
||||
# 2. FUN_180094ce0 (the LIVE-PROVEN eight-row staff panel) -- to check that both
|
||||
# panels obtain their data object the same way, which is the only thing that
|
||||
# licenses "the JSON we send reaches those tiles".
|
||||
# 3. FUN_18012fd40 -- atom -> type-id map, specifically the consumable arms.
|
||||
# 4. FUN_18013c6d0 -- settings deser: length, brace balance, distinct atoms,
|
||||
# which getter reads `value`, and whether 0x100 appears.
|
||||
# 5. FUN_18012f4f0 -- the club/stats URL builder's closed mode set.
|
||||
import re
|
||||
|
||||
def report(name, a):
|
||||
c = dec(a)
|
||||
bal = c.count("{") - c.count("}")
|
||||
print("=== %s @%#x len=%d braces_balanced=%s ends=%r" %
|
||||
(name, a, len(c), bal == 0, c.rstrip()[-40:]))
|
||||
return c
|
||||
|
||||
print("#" * 72)
|
||||
print("# 1. FUN_180043b90")
|
||||
c = report("FUN_180043b90", 0x180043b90)
|
||||
open("/tmp/ver_43b90.c", "w").write(c)
|
||||
cases = re.findall(r"^\s*(case \w+|default):", c, re.M)
|
||||
print("switch arms seen:", cases)
|
||||
# every string literal passed as the row name, in order, with the typeid before it
|
||||
rows = re.findall(r'0x800\)\)\(\w+,([0-9a-fx]+)\);|"(CARDS_NO_[A-Z_]+)",(\w+)\)', c)
|
||||
print("--- case 6 region ---")
|
||||
i = c.find("case 6:")
|
||||
j = c.find("case 7:", i)
|
||||
if j == -1:
|
||||
j = len(c)
|
||||
seg = c[i:j] if i != -1 else "(no case 6)"
|
||||
print("case6 segment len", len(seg))
|
||||
for m in re.finditer(r'0x800\)\)\((\w+),([0-9a-fx]+)\)|"(CARDS_NO_[A-Z_]+)"', seg):
|
||||
print(" ", m.group(0))
|
||||
# where does the data object come from?
|
||||
print("--- data-object acquisition (first 30 lines) ---")
|
||||
print("\n".join(c.splitlines()[:32]))
|
||||
|
||||
print("#" * 72)
|
||||
print("# 2. FUN_180094ce0 (live-proven staff panel, for comparison)")
|
||||
c2 = report("FUN_180094ce0", 0x180094ce0)
|
||||
open("/tmp/ver_94ce0.c", "w").write(c2)
|
||||
print("\n".join(c2.splitlines()[:34]))
|
||||
|
||||
print("#" * 72)
|
||||
print("# 3. FUN_18012fd40 atom -> typeid")
|
||||
c3 = report("FUN_18012fd40", 0x18012fd40)
|
||||
open("/tmp/ver_12fd40.c", "w").write(c3)
|
||||
print(c3)
|
||||
|
||||
print("#" * 72)
|
||||
print("# 4. FUN_18013c6d0 settings deser")
|
||||
c4 = report("FUN_18013c6d0", 0x18013c6d0)
|
||||
open("/tmp/ver_13c6d0.c", "w").write(c4)
|
||||
atoms = sorted(set(int(x, 16) for x in re.findall(r"case 0x([0-9a-f]+):", c4)))
|
||||
print("distinct case atoms: %d" % len(atoms), [hex(a) for a in atoms])
|
||||
print("0x100 present:", 0x100 in atoms)
|
||||
print("getter callsites:", sorted(set(re.findall(r"FUN_1801c7[0-9a-f]{3}", c4))))
|
||||
for pat in ("0xa2", "0x354", "0x377"):
|
||||
print(" %s occurrences: %d" % (pat, c4.count(pat)))
|
||||
|
||||
print("#" * 72)
|
||||
print("# 5. FUN_18012f4f0 club/stats URL builder")
|
||||
c5 = report("FUN_18012f4f0", 0x18012f4f0)
|
||||
print(c5)
|
||||
@@ -0,0 +1,41 @@
|
||||
# VERIFICATION pass 2: the objective URL builders (RANK 9), the /consumables/%s
|
||||
# builder (RANK 10), and the xref counts behind the sbs/draft suffix claims.
|
||||
import re
|
||||
|
||||
def show(name, a):
|
||||
c = dec(a)
|
||||
bal = c.count("{") - c.count("}")
|
||||
print("=== %s @%#x len=%d balanced=%s" % (name, a, len(c), bal == 0))
|
||||
print(c)
|
||||
return c
|
||||
|
||||
for nm, a in (("FUN_180151610", 0x180151610), ("FUN_180147780", 0x180147780),
|
||||
("FUN_1801308c0", 0x1801308c0)):
|
||||
show(nm, a)
|
||||
|
||||
print("#" * 72)
|
||||
print("# xrefs to each suffix string")
|
||||
for s in ["/sets", "/sets/tag", "/setId/%d/challenges", "/squadBuildingSets",
|
||||
"/challenge/%d", "/challenge/%d/squad", "/consumables/%s", "/objective/",
|
||||
"/loan/players", "/stats/staff", "/choices/player", "/%d/draft/choose",
|
||||
"ut/%s/sbs", "ut/%s/draft/mode"]:
|
||||
hits = find_all(s.encode() + b"\x00", blocks=(".rdata", ".data", ".text"))
|
||||
for h in hits:
|
||||
xs = xrefs_to(h)
|
||||
txt = ", ".join("%s@%#x" % (fn, en) for (_, _, fn, en) in xs)
|
||||
print(" %-24s @%#x xrefs=%d %s" % (s, h, len(xs), txt))
|
||||
|
||||
print("#" * 72)
|
||||
print("# .rdata neighbourhood of the two objective vtables (identity check)")
|
||||
for vt in (0x1801fc080, 0x180206090):
|
||||
print("-- vtable %#x" % vt)
|
||||
for i in range(8):
|
||||
try:
|
||||
q = qword(vt + i * 8)
|
||||
except Exception:
|
||||
break
|
||||
f = fm.getFunctionAt(addr(q)) if 0x180000000 <= q < 0x181000000 else None
|
||||
print(" +%02x %#018x %s" % (i * 8, q, f.getName() if f else ""))
|
||||
# ascii that follows
|
||||
b = read_bytes(vt + 64, 160)
|
||||
print(" trailing bytes:", re.findall(rb"[ -~]{4,}", b))
|
||||
@@ -0,0 +1,31 @@
|
||||
# VERIFICATION pass 3: resolve the address discrepancies in the suffix-string
|
||||
# census and get the FROM address / ref type of each single-xref claim.
|
||||
addrs = [0x1802262c0, 0x18022dd08, 0x180226700, 0x1802264e0, 0x18022e6d4,
|
||||
0x180226ec0, 0x18022e908, 0x180227300, 0x1802270e0, 0x18022bd88,
|
||||
0x180221728, 0x180225840, 0x18021e508, 0x18021e820, 0x180222320,
|
||||
0x1802252c8, 0x1802254c0, 0x180225638]
|
||||
print("== what string actually lives at each address ==")
|
||||
for a in addrs:
|
||||
try:
|
||||
print(" %#x %r" % (a, rd_str(a, 60)))
|
||||
except Exception as e:
|
||||
print(" %#x ERR %s" % (a, e))
|
||||
|
||||
print()
|
||||
print("== from-address + reftype for the 'single xref' strings ==")
|
||||
for s in ["/squadBuildingSets", "/loan/players", "/stats/staff", "ut/%s/sbs",
|
||||
"ut/%s/draft/mode", "/sets", "/setId/%d/challenges", "/challenge/%d",
|
||||
"/challenge/%d/squad", "/sets/tag", "/consumables/%s"]:
|
||||
for h in find_all(s.encode() + b"\x00", blocks=(".rdata", ".data", ".text")):
|
||||
for (fr, ty, fn, en) in xrefs_to(h):
|
||||
blk = mem.getBlock(addr(fr))
|
||||
print(" %-22s str@%#x from %#x [%s] %s fn=%s" %
|
||||
(s, h, fr, blk.getName() if blk else "?", ty, fn))
|
||||
|
||||
print()
|
||||
print("== vtable block around 0x1801f5968 (RANK 10 adjacency claim) ==")
|
||||
for off in range(-5, 4):
|
||||
a = 0x1801f5968 + off * 8
|
||||
q = qword(a)
|
||||
f = fm.getFunctionAt(addr(q)) if 0x180000000 <= q < 0x181000000 else None
|
||||
print(" %#x %#018x %s" % (a, q, f.getName() if f else ""))
|
||||
Reference in New Issue
Block a user