fifa17-recon: the real quick-sell table, and the grouping bug is not in our layer
Multi-agent pass over the store subsystem, 11 agents, findings run through three
adversarial verifiers. Full writeup in docs/plan-2026-08-05-store-subsystem.md.
THE REAL DISCARD TABLE IS RECOVERED. quick_sell() paid an invented rating tier
(600/300/150/50) that was wrong for every single card. The real table is
fcc_discardcoins in the client's own game DB, 141 rows keyed (cardtype, level, rare),
read out of the running client and verified 22/22 against live items:
value = round_half_up(rating * price / 100)
level = 3 if rating >= 75, 2 if 65..74, else 1 (0x180141e8a..0x180141ea3,
derived from rating, NOT a wire field)
cardtype = FUN_1800d8330(cardsubtypeid), decoded from its jump table and checked
across every subtype 0..599 with zero disagreements
A 94-rated gold rare is 752, not 600. A 76 rare is 608, not 150. A 55 bronze is 17,
not 50.
This also closes a disagreement nobody had noticed: the CLIENT already computes and
displays the correct value locally whenever our discardValue (atom 0xd7) is 0 or
absent. FUN_18013fe00 stores our value at item +0x38 and the guard at 0x180141025
skips the local computation when it is non-zero. So the screen has been showing the
real number while the server paid a made-up one, on every quick sell ever made.
Verified beyond what the report claimed, because a missing table row pays ZERO and
that would be a regression the old flat tier could not produce: across all 236 items
in the live profile, 230 map to cardtype 1 and 6 to cardtype 6, and NOT ONE would pay
0 coins. Table reproduces at 141 rows and the worked example lands exactly.
ZERO WIRE CHANGE, FUT_DISCARD_TABLE default off. Nothing new is sent; only the coin
figure the server credits moves. This is the patch worth defaulting on after one
in-game check, which is simply quick-selling a card and seeing the coins paid match
the value the card was already displaying.
THE GROUPING BUG IS NOT IN CARDSDLL, and the fix ranked first would have wasted a
launch. Live in the running client all three display groups own exactly the right
pack, there is exactly one copy of each pack record in 4 GiB, and nothing we send is
mis-parsed. The parsed model is correct and the Scaleform layer picks the wrong pack
when turning a tile click into a category id. displayGroupAssetId is served as 1/5/6
while the screen's category field reads 3, and group tiles carry a hardcoded
CATEGORY_ID of 0. Confirmed by direct read: ordinal 3, assetId 6, i.e. Premium, while
the last click was Gold.
The heap map that made this possible, all scoped to one pid: display-group vector
control block, 3 elements of 0x108; group record fields at +0x00 sortPriority,
+0x04 displayGroupAssetId, +0x40 a one-element pack vector; inner pack record 0x1a8
with packType at +0x38, ids at +0x70/+0xac, price at +0xa0, quantities at +0xc0..+0xd0.
extPrice SHOULD BE DELETED, not corrected. Both sub-parsers read only
externalPriceId; amount and currency are discarded. Sending the key at all creates an
"mtx" currency row that switches on a real-money price line the client can never fill
offline, which is the literal "or %1s" on every tile.
A WORRY NOBODY HAD RAISED, and I confirmed it from our own logs: the client has sent
packId 6 on every purchase it has ever made, four for four tonight and six for six
across history. We have never observed a successful buy of anything but Premium Gold.
Also settled: FUT_STORE_DISPLAYGROUP=0 is the right resting state, argued from
mechanism rather than from history; FUT_USERINFO=packs stays off because the
unopened-pack counter is client-mutable and the flag ladder silently drops squadList;
POST /user is a latent hard freeze that has never fired because the client never
issues that POST.
Honest coverage: the ActionScript layer is unread by everyone and every remaining
store mystery lives there.
Live: 439 contract checks pass, market suite passes, both flags off.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
funman300
@@ -0,0 +1,164 @@
|
||||
"""D2 QUICK SELL, batch 2. Nail down the remaining unknowns from batch 1.
|
||||
|
||||
BATCH 1 ESTABLISHED (raw asm, 0x180141025..0x180141140 inside FUN_18013fe00):
|
||||
if ([RBP+0x198] == 0) // server discardValue, JA = unsigned
|
||||
price = SELECT [0x1802231e4] FROM "fcc_discardcoins"
|
||||
WHERE "cardtype" == [RBP+0x1ac]
|
||||
AND [0x180207848] == [RBP+0x1b4]
|
||||
AND "rare" == [RBP+0x1b8]
|
||||
v = (byte[RBP+0x214] * price) / 100, +1 if remainder >= 0x32
|
||||
[RBP+0x19c] = v
|
||||
|
||||
REMAINING QUESTIONS
|
||||
1. what are the strings at 0x1802231e4 and 0x180207848?
|
||||
2. EVERY instruction in FUN_18013fe00 that WRITES [RBP+0x1b4] (the second key,
|
||||
the decompiler shows no atom arm writing it, which would mean it is always
|
||||
the initialiser value; that must be checked on instructions, not on the
|
||||
decompiler's merged locals). Same for [RBP+0x198], [RBP+0x19c], [RBP+0x1ac],
|
||||
[RBP+0x214], [RBP+0x1b8]. CONTROL: [RBP+0x214] must show exactly one write
|
||||
from the atom-0x274 (rating) arm, which we already know exists.
|
||||
3. where do [RBP+0x198] and [RBP+0x19c] end up in the heap item object? print
|
||||
the tail copy-construct.
|
||||
4. Q2 ASSIGN-vs-ADD. resolve the three vtables that hold the discard triple
|
||||
(0x1802fb340.., 0x180270580.., 0x180220470..) and 0x1801f3100.., print every
|
||||
slot, then decompile the response-apply methods so the consumer of resp+0x28
|
||||
is read directly.
|
||||
5. the FUT manager singleton DAT_1802e6398: print vtable slots 0x9c0..0xa80 so
|
||||
the credit setter next to the item-remove slot 0xa30 / id-touch slot 0xa48 is
|
||||
visible, and decompile 0xa30 and any credit-looking neighbour.
|
||||
6. every function in the DLL that contains the immediate 0x326 (totalCredits)
|
||||
in any of the four dispatch forms, so all credit consumers are enumerated.
|
||||
CONTROL: the list must contain FUN_180127300 and FUN_1801279c0, both of which
|
||||
are already known to carry a `== 0x326` arm.
|
||||
|
||||
Nothing is truncated; len() printed for every decompile.
|
||||
"""
|
||||
import traceback, os
|
||||
|
||||
OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/store/qs/"
|
||||
os.makedirs(OUT, exist_ok=True)
|
||||
|
||||
|
||||
def dump(tag, va, path=None):
|
||||
try:
|
||||
src = dec(va)
|
||||
except Exception as e:
|
||||
src = "// decompile threw %r" % (e,)
|
||||
print("=" * 78)
|
||||
print("%s %#x fname=%s len(src)=%d (FULL)" % (tag, va, fname(va), len(src)))
|
||||
print("=" * 78)
|
||||
print(src)
|
||||
if path:
|
||||
open(OUT + path, "w").write(src)
|
||||
return src
|
||||
|
||||
|
||||
def insns(va):
|
||||
f = func(va)
|
||||
out = []
|
||||
if f is None:
|
||||
return out
|
||||
it = listing.getInstructions(f.getBody(), True)
|
||||
while it.hasNext():
|
||||
i = it.next()
|
||||
out.append((int(i.getAddress().getOffset()), str(i)))
|
||||
return out
|
||||
|
||||
|
||||
try:
|
||||
print("##### 1: the two unknown literals #####")
|
||||
for a in (0x1802231e4, 0x180207848, 0x180223208, 0x18022315c):
|
||||
print(" %#x -> %r" % (a, rd_str(a, 64)))
|
||||
|
||||
print("\n##### 2: every reference to the six stack slots in the ITEM deser #####")
|
||||
ins = insns(0x18013fe00)
|
||||
print(" instruction count in FUN_18013fe00 = %d" % len(ins))
|
||||
slots = ("0x198", "0x19c", "0x1ac", "0x1b0", "0x1b4", "0x1b8", "0x214", "0x1a0",
|
||||
"0x1a4", "0x1a8")
|
||||
for s in slots:
|
||||
pat = "RBP + " + s + "]"
|
||||
hits = [(a, t) for a, t in ins if pat in t]
|
||||
print(" --- [RBP + %s] : %d refs ---" % (s, len(hits)))
|
||||
for a, t in hits:
|
||||
print(" %#x %s" % (a, t))
|
||||
|
||||
print("\n##### 3: the tail of the ITEM deser (copy-construct into the heap item) #####")
|
||||
f = func(0x18013fe00)
|
||||
lo = int(f.getEntryPoint().getOffset())
|
||||
hi = int(f.getBody().getMaxAddress().getOffset())
|
||||
print(" function body %#x..%#x" % (lo, hi))
|
||||
for a, t in ins:
|
||||
if a >= 0x180141160:
|
||||
print(" %#x %s" % (a, t))
|
||||
|
||||
print("\n##### 4: the discard action vtables #####")
|
||||
for base in (0x1802fb300, 0x180270560, 0x180220450, 0x1801f3100):
|
||||
print(" --- vtable-ish dump at %#x ---" % base)
|
||||
for off, tgt, nm in vtable(base, 48):
|
||||
extra = ""
|
||||
if 0x180000000 <= tgt < 0x181000000:
|
||||
try:
|
||||
extra = repr(rd_str(tgt, 40))
|
||||
except Exception:
|
||||
extra = ""
|
||||
print(" +%#05x %#018x %-20s %s" % (off, tgt, nm, extra if not nm else ""))
|
||||
|
||||
print("\n##### 4b: response-apply candidates #####")
|
||||
# everything referenced next to the deser in those tables
|
||||
seen = set()
|
||||
for base in (0x1802fb300, 0x180270560, 0x180220450, 0x1801f3100):
|
||||
for off, tgt, nm in vtable(base, 48):
|
||||
if nm and tgt not in seen and fm.getFunctionAt(addr(tgt)):
|
||||
seen.add(tgt)
|
||||
print(" %d distinct functions in those tables" % len(seen))
|
||||
for t in sorted(seen):
|
||||
try:
|
||||
src = dec(t)
|
||||
except Exception as e:
|
||||
src = "// threw %r" % e
|
||||
if "0x28" in src or "0x326" in src or "credit" in src.lower():
|
||||
print("=" * 78)
|
||||
print("CANDIDATE %#x %s len=%d" % (t, fname(t), len(src)))
|
||||
print("=" * 78)
|
||||
print(src)
|
||||
|
||||
print("\n##### 5: FUT manager singleton vtable #####")
|
||||
try:
|
||||
mgr_vt_holder = 0x1802e6398
|
||||
print(" DAT_1802e6398 is a runtime pointer; using static xrefs instead")
|
||||
except Exception:
|
||||
pass
|
||||
# find the vtable by looking at who writes DAT_1802e6398
|
||||
for frm, typ, fn, ent in xrefs_to(0x1802e6398):
|
||||
print(" xref to DAT_1802e6398: %#x %s %s %#x" % (frm, typ, fn, ent))
|
||||
|
||||
print("\n##### 6: every function containing the 0x326 immediate #####")
|
||||
ATOM = 0x326
|
||||
found = {}
|
||||
it = fm.getFunctions(True)
|
||||
n = 0
|
||||
while it.hasNext():
|
||||
fn = it.next()
|
||||
n += 1
|
||||
try:
|
||||
body = listing.getInstructions(fn.getBody(), True)
|
||||
except Exception:
|
||||
continue
|
||||
hit = []
|
||||
prev = None
|
||||
while body.hasNext():
|
||||
i = body.next()
|
||||
t = str(i)
|
||||
if "0x326" in t:
|
||||
hit.append((int(i.getAddress().getOffset()), t))
|
||||
if hit:
|
||||
found[int(fn.getEntryPoint().getOffset())] = (fn.getName(), hit)
|
||||
print(" scanned %d functions; %d contain 0x326" % (n, len(found)))
|
||||
for e in sorted(found):
|
||||
nm, hit = found[e]
|
||||
print(" %#x %s" % (e, nm))
|
||||
for a, t in hit:
|
||||
print(" %#x %s" % (a, t))
|
||||
|
||||
except Exception:
|
||||
traceback.print_exc()
|
||||
Reference in New Issue
Block a user