tools: trace FIFA17 scenario start source chain
This commit is contained in:
funman300
+296
@@ -0,0 +1,296 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Trace FIFA17 ScenarioModeStart sources, scheduling, and publication.
|
||||
|
||||
The candidate profile samples the four statically recovered publisher clusters.
|
||||
The scheduler profile follows the exact mode-0 chain: FreeRoam event ``0x128``,
|
||||
its scheduler, the ScenarioManager start method, and the mode-0 publisher. The
|
||||
upstream profile traces all three literal ``0x128`` sources and the FreeRoam
|
||||
case they must reach.
|
||||
|
||||
Both generated GDB programs use at most four simultaneously enabled hardware
|
||||
execution breakpoints. They only read registers and client memory, log, and
|
||||
continue. They never call client functions, write client memory, emit events,
|
||||
or drive input.
|
||||
|
||||
scenario_mode_start_trace.py [pid] --profile candidates
|
||||
scenario_mode_start_trace.py [pid] --profile scheduler
|
||||
scenario_mode_start_trace.py [pid] --profile upstream
|
||||
scenario_mode_start_trace.py --selftest
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import os
|
||||
from pathlib import Path
|
||||
import shutil
|
||||
import sys
|
||||
|
||||
sys.path.insert(0, str(Path(__file__).resolve().parent))
|
||||
import match_advance_trace as advance
|
||||
import match_transition_trace as transition
|
||||
|
||||
CANDIDATE_A_RVA = 0x07AFDCC0
|
||||
CANDIDATE_B_RVA = 0x07B1BA90
|
||||
CANDIDATE_C_RVA = 0x07B1C190
|
||||
CANDIDATE_D_RVA = 0x07E0B200
|
||||
|
||||
FREE_ROAM_EVENT_128_CALLSITE_RVA = 0x07A92B0F
|
||||
SCENARIO_SCHEDULER_RVA = 0x07AC3A40
|
||||
SCENARIO_MANAGER_START_RVA = 0x07B1C2B0
|
||||
MODE_ZERO_PUBLISHER_RVA = 0x07B1C190
|
||||
EVENT_SOURCE_27F9_RVA = 0x07DBD16B
|
||||
EVENT_SOURCE_30_RVA = 0x07DCA4E5
|
||||
EVENT_SOURCE_280E_RVA = 0x07DD065F
|
||||
|
||||
|
||||
|
||||
def trace_addresses(fifa_base: int) -> dict[str, int]:
|
||||
return {
|
||||
"candidate_a": fifa_base + CANDIDATE_A_RVA,
|
||||
"candidate_b": fifa_base + CANDIDATE_B_RVA,
|
||||
"candidate_c": fifa_base + CANDIDATE_C_RVA,
|
||||
"candidate_d": fifa_base + CANDIDATE_D_RVA,
|
||||
"free_roam_event_128_callsite": fifa_base + FREE_ROAM_EVENT_128_CALLSITE_RVA,
|
||||
"scenario_scheduler": fifa_base + SCENARIO_SCHEDULER_RVA,
|
||||
"scenario_manager_start": fifa_base + SCENARIO_MANAGER_START_RVA,
|
||||
"mode_zero_publisher": fifa_base + MODE_ZERO_PUBLISHER_RVA,
|
||||
"event_source_27f9": fifa_base + EVENT_SOURCE_27F9_RVA,
|
||||
"event_source_30": fifa_base + EVENT_SOURCE_30_RVA,
|
||||
"event_source_280e": fifa_base + EVENT_SOURCE_280E_RVA,
|
||||
}
|
||||
|
||||
|
||||
def gdb_prelude(pid: int, output: str) -> str:
|
||||
if any(character in output for character in "\n\r"):
|
||||
raise ValueError("output path cannot contain a newline")
|
||||
return f"""set pagination off
|
||||
set confirm off
|
||||
set print thread-events off
|
||||
set breakpoint always-inserted on
|
||||
set logging file {output}
|
||||
set logging overwrite on
|
||||
set logging redirect off
|
||||
set logging enabled on
|
||||
handle SIGSEGV nostop noprint pass
|
||||
handle SIGILL nostop noprint pass
|
||||
handle SIGFPE nostop noprint pass
|
||||
handle SIGPIPE nostop noprint pass
|
||||
handle SIGALRM nostop noprint pass
|
||||
handle SIGUSR1 nostop noprint pass
|
||||
handle SIGUSR2 nostop noprint pass
|
||||
|
||||
attach {pid}
|
||||
"""
|
||||
|
||||
|
||||
def build_candidate_script(pid: int, fifa_base: int, output: str) -> str:
|
||||
address = trace_addresses(fifa_base)
|
||||
sections = [gdb_prelude(pid, output)]
|
||||
for label in ("a", "b", "c", "d"):
|
||||
sections.append(
|
||||
f"""hbreak *0x{address[f'candidate_{label}']:x}
|
||||
commands
|
||||
silent
|
||||
python import time; print("SCENARIOTRACE epoch_ns=%d mono_ns=%d CANDIDATE_{label.upper()}" % (time.time_ns(), time.monotonic_ns()), end=" ")
|
||||
printf "thread=%d rip=%p caller_return=%p object=%p vtable=%p edx=%#x r8=%p r9=%p field_40=%#x field_50=%#x field_b8=%#x\\n", $_thread, $pc, *(void**)$rsp, $rcx, *(void**)$rcx, $edx, $r8, $r9, *(unsigned char*)($rcx+0x40), *(unsigned int*)($rcx+0x50), *(unsigned int*)($rcx+0xb8)
|
||||
bt 16
|
||||
continue
|
||||
end
|
||||
|
||||
"""
|
||||
)
|
||||
sections.append(
|
||||
"printf \"SCENARIOTRACE ARMED profile=candidates "
|
||||
f"pid={pid} candidate_a=0x{address['candidate_a']:x} "
|
||||
f"candidate_b=0x{address['candidate_b']:x} "
|
||||
f"candidate_c=0x{address['candidate_c']:x} "
|
||||
f"candidate_d=0x{address['candidate_d']:x}\\n\"\ncontinue\n"
|
||||
)
|
||||
return "".join(sections)
|
||||
|
||||
|
||||
def build_scheduler_script(pid: int, fifa_base: int, output: str) -> str:
|
||||
address = trace_addresses(fifa_base)
|
||||
return (
|
||||
gdb_prelude(pid, output)
|
||||
+ f"""hbreak *0x{address['free_roam_event_128_callsite']:x}
|
||||
commands
|
||||
silent
|
||||
set $owner = $rbx
|
||||
python import time; print("SCENARIOTRACE epoch_ns=%d mono_ns=%d FREE_ROAM_EVENT_128" % (time.time_ns(), time.monotonic_ns()), end=" ")
|
||||
printf "thread=%d owner=%p event=%#x payload=%p mode=%d manager=%p caller_return=%p\\n", $_thread, $owner, $esi, $rdi, *(unsigned int*)($owner+0x124), *(void**)($owner+0x168), *(void**)$rsp
|
||||
bt 16
|
||||
continue
|
||||
end
|
||||
|
||||
hbreak *0x{address['scenario_scheduler']:x}
|
||||
commands
|
||||
silent
|
||||
set $owner = $rcx
|
||||
python import time; print("SCENARIOTRACE epoch_ns=%d mono_ns=%d SCENARIO_SCHEDULER" % (time.time_ns(), time.monotonic_ns()), end=" ")
|
||||
printf "thread=%d owner=%p event=%#x payload=%p mode=%d manager=%p caller_return=%p\\n", $_thread, $owner, $edx, $r8, *(unsigned int*)($owner+0x124), *(void**)($owner+0x168), *(void**)$rsp
|
||||
bt 16
|
||||
continue
|
||||
end
|
||||
|
||||
hbreak *0x{address['scenario_manager_start']:x}
|
||||
commands
|
||||
silent
|
||||
set $manager = $rcx
|
||||
python import time; print("SCENARIOTRACE epoch_ns=%d mono_ns=%d SCENARIO_MANAGER_START" % (time.time_ns(), time.monotonic_ns()), end=" ")
|
||||
printf "thread=%d manager=%p vtable=%p requested_countdown=%d scenario_mode=%d child=%p caller_return=%p\\n", $_thread, $manager, *(void**)$manager, $edx, *(unsigned int*)($manager+0x50), *(void**)($manager+0x8), *(void**)$rsp
|
||||
bt 16
|
||||
continue
|
||||
end
|
||||
|
||||
hbreak *0x{address['mode_zero_publisher']:x}
|
||||
commands
|
||||
silent
|
||||
python import time; print("SCENARIOTRACE epoch_ns=%d mono_ns=%d MODE_ZERO_PUBLISHER" % (time.time_ns(), time.monotonic_ns()), end=" ")
|
||||
printf "thread=%d object=%p vtable=%p requested_countdown=%d r8=%p r9=%p caller_return=%p\\n", $_thread, $rcx, *(void**)$rcx, $edx, $r8, $r9, *(void**)$rsp
|
||||
bt 20
|
||||
continue
|
||||
end
|
||||
|
||||
printf "SCENARIOTRACE ARMED profile=scheduler pid={pid} event_callsite=0x{address['free_roam_event_128_callsite']:x} scheduler=0x{address['scenario_scheduler']:x} manager_start=0x{address['scenario_manager_start']:x} mode_zero_publisher=0x{address['mode_zero_publisher']:x}\\n"
|
||||
continue
|
||||
"""
|
||||
)
|
||||
|
||||
|
||||
def build_upstream_script(pid: int, fifa_base: int, output: str) -> str:
|
||||
address = trace_addresses(fifa_base)
|
||||
sections = [gdb_prelude(pid, output)]
|
||||
for label, trigger in (("27f9", 0x27F9), ("30", 0x30), ("280e", 0x280E)):
|
||||
sections.append(
|
||||
f"""hbreak *0x{address[f'event_source_{label}']:x}
|
||||
commands
|
||||
silent
|
||||
set $gameplay = $rax
|
||||
set $listeners = 0
|
||||
set $listener0 = 0
|
||||
set $listener1 = 0
|
||||
set $listener2 = 0
|
||||
if $gameplay != 0
|
||||
set $listeners = *(void**)$gameplay
|
||||
if $listeners != 0
|
||||
set $listener0 = *(void**)$listeners
|
||||
set $listener1 = *(void**)($listeners+8)
|
||||
set $listener2 = *(void**)($listeners+16)
|
||||
end
|
||||
end
|
||||
python import time; print("SCENARIOTRACE epoch_ns=%d mono_ns=%d EVENT_128_SOURCE_{label.upper()}" % (time.time_ns(), time.monotonic_ns()), end=" ")
|
||||
printf "thread=%d trigger=%#x gameplay=%p listeners=%p entries=%p,%p,%p caller_return=%p\\n", $_thread, {trigger}, $gameplay, $listeners, $listener0, $listener1, $listener2, *(void**)$rsp
|
||||
bt 20
|
||||
continue
|
||||
end
|
||||
|
||||
"""
|
||||
)
|
||||
sections.append(
|
||||
f"""hbreak *0x{address['free_roam_event_128_callsite']:x}
|
||||
commands
|
||||
silent
|
||||
set $owner = $rbx
|
||||
python import time; print("SCENARIOTRACE epoch_ns=%d mono_ns=%d FREE_ROAM_EVENT_128" % (time.time_ns(), time.monotonic_ns()), end=" ")
|
||||
printf "thread=%d owner=%p event=%#x payload=%p mode=%d manager=%p caller_return=%p\\n", $_thread, $owner, $esi, $rdi, *(unsigned int*)($owner+0x124), *(void**)($owner+0x168), *(void**)$rsp
|
||||
bt 20
|
||||
continue
|
||||
end
|
||||
|
||||
printf "SCENARIOTRACE ARMED profile=upstream pid={pid} source_27f9=0x{address['event_source_27f9']:x} source_30=0x{address['event_source_30']:x} source_280e=0x{address['event_source_280e']:x} event_callsite=0x{address['free_roam_event_128_callsite']:x}\\n"
|
||||
continue
|
||||
"""
|
||||
)
|
||||
return "".join(sections)
|
||||
|
||||
|
||||
def selftest() -> None:
|
||||
address = trace_addresses(0x140000000)
|
||||
assert address["candidate_a"] == 0x147AFDCC0
|
||||
assert address["candidate_b"] == 0x147B1BA90
|
||||
assert address["candidate_c"] == 0x147B1C190
|
||||
assert address["candidate_d"] == 0x147E0B200
|
||||
assert address["free_roam_event_128_callsite"] == 0x147A92B0F
|
||||
assert address["scenario_scheduler"] == 0x147AC3A40
|
||||
assert address["scenario_manager_start"] == 0x147B1C2B0
|
||||
assert address["mode_zero_publisher"] == 0x147B1C190
|
||||
assert address["event_source_27f9"] == 0x147DBD16B
|
||||
assert address["event_source_30"] == 0x147DCA4E5
|
||||
assert address["event_source_280e"] == 0x147DD065F
|
||||
candidate_script = build_candidate_script(61470, 0x140000000, "/tmp/candidates.log")
|
||||
scheduler_script = build_scheduler_script(61470, 0x140000000, "/tmp/scheduler.log")
|
||||
upstream_script = build_upstream_script(61470, 0x140000000, "/tmp/upstream.log")
|
||||
assert candidate_script.count("hbreak *") == 4
|
||||
assert all(f"CANDIDATE_{label}" in candidate_script for label in "ABCD")
|
||||
assert scheduler_script.count("hbreak *") == 4
|
||||
assert "FREE_ROAM_EVENT_128" in scheduler_script
|
||||
assert "SCENARIO_SCHEDULER" in scheduler_script
|
||||
assert "SCENARIO_MANAGER_START" in scheduler_script
|
||||
assert "MODE_ZERO_PUBLISHER" in scheduler_script
|
||||
assert upstream_script.count("hbreak *") == 4
|
||||
assert "EVENT_128_SOURCE_27F9" in upstream_script
|
||||
assert "EVENT_128_SOURCE_30" in upstream_script
|
||||
assert "EVENT_128_SOURCE_280E" in upstream_script
|
||||
assert "FREE_ROAM_EVENT_128" in upstream_script
|
||||
assert "0x147ac9900" not in scheduler_script.lower()
|
||||
assert "CANDIDATE_B_GATE" not in scheduler_script
|
||||
assert "set *(" not in candidate_script
|
||||
assert "set *(" not in scheduler_script
|
||||
assert "set *(" not in upstream_script
|
||||
print("scenario_mode_start_trace selftest: PASS")
|
||||
|
||||
|
||||
def main() -> int:
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("pid", nargs="?", type=int)
|
||||
parser.add_argument(
|
||||
"--profile",
|
||||
choices=("candidates", "scheduler", "upstream"),
|
||||
default="candidates",
|
||||
)
|
||||
parser.add_argument("--output")
|
||||
parser.add_argument("--print-script", action="store_true")
|
||||
parser.add_argument("--selftest", action="store_true")
|
||||
args = parser.parse_args()
|
||||
if args.selftest:
|
||||
selftest()
|
||||
return 0
|
||||
|
||||
pid = args.pid or transition.find_pid()
|
||||
if not pid:
|
||||
print("FIFA17.exe not found", file=sys.stderr)
|
||||
return 2
|
||||
try:
|
||||
fifa_base, fifa_path = advance.module_mapping(pid, advance.FIFA_MODULE)
|
||||
advance.validate_file(
|
||||
fifa_path,
|
||||
advance.PINNED_FIFA_SHA256,
|
||||
advance.FIFA_MODULE,
|
||||
)
|
||||
output = args.output or f"/tmp/fifa17-scenario-{args.profile}-{pid}.log"
|
||||
if args.profile == "candidates":
|
||||
script = build_candidate_script(pid, fifa_base, output)
|
||||
elif args.profile == "scheduler":
|
||||
script = build_scheduler_script(pid, fifa_base, output)
|
||||
else:
|
||||
script = build_upstream_script(pid, fifa_base, output)
|
||||
except (OSError, RuntimeError, ValueError) as error:
|
||||
print(error, file=sys.stderr)
|
||||
return 2
|
||||
|
||||
if args.print_script:
|
||||
print(script, end="")
|
||||
return 0
|
||||
if not shutil.which("gdb"):
|
||||
print("gdb not found", file=sys.stderr)
|
||||
return 2
|
||||
script_path = f"/tmp/fifa17-scenario-{args.profile}-{pid}.gdb"
|
||||
with open(script_path, "w", encoding="utf-8") as handle:
|
||||
handle.write(script)
|
||||
os.execvp("gdb", ["gdb", "-q", "-nx", "-batch", "-x", script_path])
|
||||
return 127
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
Reference in New Issue
Block a user