diff --git a/fifa17-recon/tools/atom_mapper_emu.py b/fifa17-recon/tools/atom_mapper_emu.py
new file mode 100755
index 0000000..353a02b
--- /dev/null
+++ b/fifa17-recon/tools/atom_mapper_emu.py
@@ -0,0 +1,587 @@
+#!/usr/bin/env python3
+"""Interpret FIFA 17's atom -> field-id dispatch functions instead of pattern-scanning them.
+
+WHY THIS EXISTS
+---------------
+CardsDLL turns a JSON key into an "atom index" (a position in the string-pointer
+table at .data 0x1802d2760), then a per-response-family mapper converts that index
+into an internal field id with a chain of integer compares and jump tables.
+
+A previous attempt to recover each mapper's accepted atoms by scanning for
+`sub ecx,K` / `cmp ecx,L` / `ja` patterns produced a confidently wrong answer: it
+reported that no mapper accepts atom 424 (`manager`), while a live client plainly
+holds a resident manager record. Pattern scanning cannot see control flow, so it
+cannot tell which compares are actually reachable.
+
+This module executes the mappers instead. The modelled subset is exactly what these
+functions use: the resolver call, integer cmp/sub/add/dec, conditional and computed
+jumps, jump-table loads out of the image, lea, movsxd, and `mov eax,imm; ret`.
+Anything outside that subset raises Unsupported, so a wrong field id is never
+returned silently.
+
+TWO DECODER TRAPS THIS MODULE IS REQUIRED TO HANDLE
+---------------------------------------------------
+1. ModRM rm==5 with mod!=0 is [rbp+disp], NOT RIP-relative. Only mod==0 with rm==5
+   is RIP-relative. Treating all rm==5 as RIP-relative hides rbp-based DTO accesses.
+   Covered by test_rbp_relative_is_not_rip_relative.
+2. A constant frequently arrives in a register (`mov r8d,0x4` ... later stored), so
+   searching for an immediate-to-memory store misses it. The interpreter tracks
+   register values, so propagated constants are followed.
+   Covered by test_constant_propagated_through_register.
+
+Run `--selftest` to execute the positive controls. Negative results from this tool
+are only admissible when the selftest passes.
+"""
+from __future__ import annotations
+
+import argparse
+import bisect
+import struct
+import sys
+from pathlib import Path
+
+REGS = ("rax", "rcx", "rdx", "rbx", "rsp", "rbp", "rsi", "rdi",
+        "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15")
+
+ATOM_TABLE_BASE = 0x1802D2760      # validated against 6 known anchors, see anchors()
+ATOM_RESOLVER = 0x180180D00        # key string -> atom index, returns in eax
+ITEM_MAPPER = 0x18012FD40          # the DTO/item mapper: atom 568 'players' -> 1
+
+
+class Unsupported(Exception):
+    """The mapper used an instruction or address outside the modelled subset."""
+
+
+def s32(v: int) -> int:
+    v &= 0xFFFFFFFF
+    return v - 0x100000000 if v & 0x80000000 else v
+
+
+class Image:
+    """A parsed PE, with VA<->file mapping and .pdata function bounds."""
+
+    def __init__(self, path: Path):
+        self.buf = path.read_bytes()
+        b = self.buf
+        pe = struct.unpack_from("<I", b, 0x3C)[0]
+        if b[pe:pe + 4] != b"PE\0\0":
+            raise ValueError(f"{path} is not a PE image")
+        nsec = struct.unpack_from("<H", b, pe + 6)[0]
+        optsz = struct.unpack_from("<H", b, pe + 20)[0]
+        self.base = struct.unpack_from("<Q", b, pe + 24 + 24)[0]
+        self.sections = []
+        for i in range(nsec):
+            o = pe + 24 + optsz + 40 * i
+            name = b[o:o + 8].rstrip(b"\0").decode(errors="replace")
+            vsz, va, rsz, raw = struct.unpack_from("<IIII", b, o + 8)
+            self.sections.append((name, va, vsz, raw, rsz))
+        self._funcs = None
+
+    def va2off(self, va: int):
+        rva = va - self.base
+        for _name, sva, vsz, raw, rsz in self.sections:
+            if sva <= rva < sva + max(vsz, rsz):
+                off = raw + (rva - sva)
+                if off < len(self.buf):
+                    return off
+        return None
+
+    def rd8(self, va: int) -> int:
+        o = self.va2off(va)
+        if o is None:
+            raise Unsupported(f"unmapped byte read 0x{va:x}")
+        return self.buf[o]
+
+    def rd32(self, va: int) -> int:
+        o = self.va2off(va)
+        if o is None:
+            raise Unsupported(f"unmapped dword read 0x{va:x}")
+        return struct.unpack_from("<I", self.buf, o)[0]
+
+    def cstr(self, va: int, maxlen: int = 96):
+        o = self.va2off(va)
+        if o is None:
+            return None
+        end = self.buf.find(b"\0", o, o + maxlen)
+        if end < 0:
+            return None
+        try:
+            return self.buf[o:end].decode("ascii")
+        except UnicodeDecodeError:
+            return None
+
+    # ---- .pdata gives exact function bounds; never guess a prologue ----
+    def functions(self):
+        if self._funcs is None:
+            sec = next(s for s in self.sections if s[0] == ".pdata")
+            _n, _va, vsz, raw, _rsz = sec
+            out = []
+            for i in range(vsz // 12):
+                beg, end, _unw = struct.unpack_from("<III", self.buf, raw + 12 * i)
+                if beg or end:
+                    out.append((self.base + beg, self.base + end))
+            out.sort()
+            self._funcs = out
+        return self._funcs
+
+    def function_of(self, va: int):
+        fs = self.functions()
+        starts = [f[0] for f in fs]
+        i = bisect.bisect_right(starts, va) - 1
+        if i >= 0 and fs[i][0] <= va < fs[i][1]:
+            return fs[i]
+        return None
+
+    def atom(self, index: int):
+        ptr = struct.unpack_from("<Q", self.buf, self.va2off(ATOM_TABLE_BASE) + 8 * index)[0]
+        return self.cstr(ptr)
+
+    def atom_index(self, name: str):
+        off = self.va2off(ATOM_TABLE_BASE)
+        for i in range(4096):
+            ptr = struct.unpack_from("<Q", self.buf, off + 8 * i)[0]
+            if self.cstr(ptr) == name:
+                return i
+        return None
+
+
+class Mapper:
+    """Executes one dispatch function for a given atom index."""
+
+    def __init__(self, image: Image, resolver: int = ATOM_RESOLVER):
+        self.img = image
+        self.resolver = resolver
+
+    def _ea(self, k: int, rex: int, r: dict):
+        """Decode ModRM[+SIB][+disp].
+
+        Returns (nbytes, dst_reg, addr, src_reg). addr is an int, or the marker
+        ("rip", disp) which the caller resolves once it knows the instruction
+        length, or None for a register-form operand.
+
+        TRAP 1: rm==5 is RIP-relative ONLY when mod==0. With mod 1 or 2 it is
+        [rbp+disp] and must be resolved from rbp.
+        """
+        b = self.img.buf
+        modrm = b[k]
+        mod, rm = modrm >> 6, modrm & 7
+        dst = REGS[(((modrm >> 3) & 7) | ((rex & 4) << 1)) & 15]
+        n = 1
+        if mod == 3:
+            return n, dst, None, REGS[(rm | ((rex & 1) << 3)) & 15]
+        base_v = idx_v = disp = 0
+        if rm == 4:
+            sib = b[k + 1]
+            n += 1
+            scale = 1 << (sib >> 6)
+            ir = ((sib >> 3) & 7) | ((rex & 2) << 2)
+            br = (sib & 7) | ((rex & 1) << 3)
+            if (ir & 15) != 4:
+                idx_v = r[REGS[ir & 15]] * scale
+            if (sib & 7) == 5 and mod == 0:
+                disp = struct.unpack_from("<i", b, k + n)[0]
+                n += 4
+            else:
+                base_v = r[REGS[br & 15]]
+        elif rm == 5 and mod == 0:
+            disp = struct.unpack_from("<i", b, k + 1)[0]
+            return n + 4, dst, ("rip", disp), None
+        else:
+            base_v = r[REGS[(rm | ((rex & 1) << 3)) & 15]]
+        if mod == 1:
+            disp = struct.unpack_from("<b", b, k + n)[0]
+            n += 1
+        elif mod == 2:
+            disp = struct.unpack_from("<i", b, k + n)[0]
+            n += 4
+        return n, dst, (base_v + idx_v + disp) & 0xFFFFFFFFFFFFFFFF, None
+
+    @staticmethod
+    def _cond(cc: int, last) -> bool:
+        a, b = last
+        sa, sb = s32(a), s32(b)
+        ua, ub = a & 0xFFFFFFFF, b & 0xFFFFFFFF
+        if cc == 0x4: return sa == sb
+        if cc == 0x5: return sa != sb
+        if cc == 0xF: return sa > sb
+        if cc == 0xD: return sa >= sb
+        if cc == 0xC: return sa < sb
+        if cc == 0xE: return sa <= sb
+        if cc == 0x7: return ua > ub
+        if cc == 0x3: return ua >= ub
+        if cc == 0x2: return ua < ub
+        if cc == 0x6: return ua <= ub
+        if cc == 0x8: return sa < sb
+        if cc == 0x9: return sa >= sb
+        raise Unsupported(f"condition code 0x{cc:x}")
+
+    def run(self, start: int, atom: int, limit: int = 5000) -> int:
+        b = self.img.buf
+        r = {k: 0 for k in REGS}
+        last = (0, 0)
+        va = start
+        for _ in range(limit):
+            i0 = self.img.va2off(va)
+            if i0 is None:
+                raise Unsupported(f"pc unmapped 0x{va:x}")
+            j = i0
+            while b[j] in (0x66, 0x67, 0xF2, 0xF3):
+                j += 1
+            rex = 0
+            if 0x40 <= b[j] <= 0x4F:
+                rex = b[j]
+                j += 1
+            op = b[j]
+            pre = j - i0
+
+            if op == 0xC3:
+                return r["rax"] & 0xFFFFFFFF
+            if op == 0xCC:
+                raise Unsupported(f"int3 at 0x{va:x}: ran off the end of the function")
+            if op == 0xE8:
+                tgt = va + pre + 5 + struct.unpack_from("<i", b, j + 1)[0]
+                if tgt != self.resolver:
+                    raise Unsupported(f"call to non-resolver 0x{tgt:x} at 0x{va:x}")
+                r["rax"] = atom & 0xFFFFFFFF          # resolver returns the atom index
+                va += pre + 5
+                continue
+            if op == 0xE9:
+                va += pre + 5 + struct.unpack_from("<i", b, j + 1)[0]
+                continue
+            if op == 0xEB:
+                va += pre + 2 + struct.unpack_from("<b", b, j + 1)[0]
+                continue
+            if 0x70 <= op <= 0x7F:
+                nxt = va + pre + 2
+                rel = struct.unpack_from("<b", b, j + 1)[0]
+                va = nxt + rel if self._cond(op & 0xF, last) else nxt
+                continue
+            if op == 0x0F and 0x80 <= b[j + 1] <= 0x8F:
+                nxt = va + pre + 6
+                rel = struct.unpack_from("<i", b, j + 2)[0]
+                va = nxt + rel if self._cond(b[j + 1] & 0xF, last) else nxt
+                continue
+            if 0xB8 <= op <= 0xBF:
+                r[REGS[((op - 0xB8) | ((rex & 1) << 3)) & 15]] = struct.unpack_from("<I", b, j + 1)[0]
+                va += pre + 5
+                continue
+            if op in (0x05, 0x2D, 0x3D):
+                # accumulator short forms: add/sub/cmp eax, imm32
+                imm = struct.unpack_from("<i", b, j + 1)[0]
+                cur = r["rax"] & 0xFFFFFFFF
+                if op == 0x3D:
+                    last = (cur, imm & 0xFFFFFFFF)
+                elif op == 0x2D:
+                    r["rax"] = (cur - imm) & 0xFFFFFFFF
+                    last = (r["rax"], 0)
+                else:
+                    r["rax"] = (cur + imm) & 0xFFFFFFFF
+                    last = (r["rax"], 0)
+                va += pre + 5
+                continue
+            if op in (0x81, 0x83):
+                w = 4 if op == 0x81 else 1
+                modrm = b[j + 1]
+                if modrm >> 6 != 3:
+                    raise Unsupported(f"{op:02x} memory form at 0x{va:x}")
+                reg = REGS[((modrm & 7) | ((rex & 1) << 3)) & 15]
+                imm = struct.unpack_from("<i" if w == 4 else "<b", b, j + 2)[0]
+                ext = (modrm >> 3) & 7
+                cur = r[reg] & 0xFFFFFFFF
+                if ext == 7:
+                    last = (cur, imm & 0xFFFFFFFF)
+                elif ext == 5:
+                    r[reg] = (cur - imm) & 0xFFFFFFFF
+                    last = (r[reg], 0)
+                elif ext == 0:
+                    r[reg] = (cur + imm) & 0xFFFFFFFF
+                    last = (r[reg], 0)
+                else:
+                    raise Unsupported(f"{op:02x} /{ext} at 0x{va:x}")
+                va += pre + 2 + w
+                continue
+            if op == 0xFF and b[j + 1] >> 6 == 3:
+                ext = (b[j + 1] >> 3) & 7
+                reg = REGS[((b[j + 1] & 7) | ((rex & 1) << 3)) & 15]
+                if ext == 1:
+                    r[reg] = (r[reg] - 1) & 0xFFFFFFFF
+                    last = (r[reg], 0)
+                    va += pre + 2
+                    continue
+                if ext == 4:
+                    va = r[reg]
+                    continue
+                raise Unsupported(f"ff /{ext} at 0x{va:x}")
+            if op == 0x0F and b[j + 1] == 0xB6:
+                n, dst, addr, src = self._ea(j + 2, rex, r)
+                end = va + pre + 2 + n
+                if isinstance(addr, tuple):
+                    addr = end + addr[1]
+                r[dst] = self.img.rd8(addr) if addr is not None else r[src] & 0xFF
+                va = end
+                continue
+            if op in (0x8B, 0x8D):
+                n, dst, addr, src = self._ea(j + 1, rex, r)
+                end = va + pre + 1 + n
+                if isinstance(addr, tuple):
+                    addr = end + addr[1]
+                if op == 0x8D:
+                    if addr is None:
+                        raise Unsupported(f"lea with register operand at 0x{va:x}")
+                    r[dst] = addr
+                else:
+                    if addr is None:
+                        # register form: mov r32, r32 (e.g. 8b c8 = mov ecx,eax)
+                        r[dst] = r[src] if rex & 8 else r[src] & 0xFFFFFFFF
+                    else:
+                        r[dst] = self.img.rd32(addr)
+                va = end
+                continue
+            if op == 0x89:
+                modrm = b[j + 1]
+                if modrm >> 6 != 3:
+                    raise Unsupported(f"89 memory store at 0x{va:x}")
+                src = REGS[((((modrm >> 3) & 7) | ((rex & 4) << 1))) & 15]
+                dst = REGS[((modrm & 7) | ((rex & 1) << 3)) & 15]
+                r[dst] = r[src] if rex & 8 else r[src] & 0xFFFFFFFF
+                va += pre + 2
+                continue
+            if op == 0x63:
+                modrm = b[j + 1]
+                if modrm >> 6 != 3:
+                    raise Unsupported(f"63 memory form at 0x{va:x}")
+                src = REGS[((modrm & 7) | ((rex & 1) << 3)) & 15]
+                dst = REGS[((((modrm >> 3) & 7) | ((rex & 4) << 1))) & 15]
+                r[dst] = s32(r[src]) & 0xFFFFFFFFFFFFFFFF
+                va += pre + 2
+                continue
+            if op in (0x01, 0x03, 0x29, 0x2B, 0x39, 0x3B,
+                      0x09, 0x0B, 0x21, 0x23, 0x31, 0x33, 0x85):
+                modrm = b[j + 1]
+                if modrm >> 6 != 3:
+                    raise Unsupported(f"{op:02x} memory form at 0x{va:x}")
+                a = REGS[((modrm & 7) | ((rex & 1) << 3)) & 15]
+                c = REGS[((((modrm >> 3) & 7) | ((rex & 4) << 1))) & 15]
+                m = 0xFFFFFFFFFFFFFFFF if rex & 8 else 0xFFFFFFFF
+                if op == 0x01:
+                    r[a] = (r[a] + r[c]) & m
+                elif op == 0x03:
+                    r[c] = (r[c] + r[a]) & m
+                elif op == 0x29:
+                    r[a] = (r[a] - r[c]) & m
+                    last = (r[a] & 0xFFFFFFFF, 0)
+                elif op == 0x2B:
+                    r[c] = (r[c] - r[a]) & m
+                    last = (r[c] & 0xFFFFFFFF, 0)
+                elif op in (0x09, 0x0B, 0x21, 0x23, 0x31, 0x33):
+                    fn = {0x09: lambda x, y: x | y, 0x0B: lambda x, y: x | y,
+                          0x21: lambda x, y: x & y, 0x23: lambda x, y: x & y,
+                          0x31: lambda x, y: x ^ y, 0x33: lambda x, y: x ^ y}[op]
+                    if op in (0x09, 0x21, 0x31):
+                        r[a] = fn(r[a], r[c]) & m
+                        last = (r[a] & 0xFFFFFFFF, 0)
+                    else:
+                        r[c] = fn(r[c], r[a]) & m
+                        last = (r[c] & 0xFFFFFFFF, 0)
+                elif op == 0x85:
+                    last = ((r[a] & r[c]) & 0xFFFFFFFF, 0)
+                elif op == 0x39:
+                    last = (r[a] & 0xFFFFFFFF, r[c] & 0xFFFFFFFF)
+                else:
+                    last = (r[c] & 0xFFFFFFFF, r[a] & 0xFFFFFFFF)
+                va += pre + 2
+                continue
+            if op == 0x90:
+                va += pre + 1
+                continue
+            if op == 0x0F and b[j + 1] == 0x1F:
+                n, _d, _a, _s = self._ea(j + 2, rex, r)
+                va += pre + 2 + n
+                continue
+            raise Unsupported(f"opcode {op:02x} at 0x{va:x}")
+        raise Unsupported("instruction limit reached")
+
+
+def find_mappers(img: Image, resolver: int = ATOM_RESOLVER):
+    """Every function containing a direct call to the atom resolver."""
+    sec = next(s for s in img.sections if s[0] == ".text")
+    _n, tva, _vsz, traw, trsz = sec
+    out = {}
+    for i in range(traw, traw + trsz - 5):
+        if img.buf[i] != 0xE8:
+            continue
+        va = img.base + tva + (i - traw)
+        if va + 5 + struct.unpack_from("<i", img.buf, i + 1)[0] == resolver:
+            f = img.function_of(va)
+            if f:
+                out.setdefault(f[0], []).append(va)
+    return out
+
+
+# --------------------------------------------------------------------------
+# selftest: the two decoder traps plus the live-verified positive controls
+# --------------------------------------------------------------------------
+def test_atom_anchors(img: Image) -> list:
+    """The atom table base must reproduce known anchors, or every index is wrong."""
+    anchors = {11: "actives", 363: "itemData", 376: "kicktakers",
+               424: "manager", 568: "players", 718: "squadActives"}
+    fails = []
+    for idx, want in anchors.items():
+        got = img.atom(idx)
+        if got != want:
+            fails.append(f"atom[{idx}] = {got!r}, expected {want!r}")
+    return fails
+
+
+def test_rbp_relative_is_not_rip_relative(img: Image) -> list:
+    """TRAP 1. mod!=0 with rm==5 must resolve as [rbp+disp], not RIP-relative.
+
+    Encoding under test: 8b 4d 20 == mov ecx,[rbp+0x20] (mod=01, rm=101).
+    A decoder that treats rm==5 as RIP-relative computes a wildly different
+    address and silently reads the wrong memory.
+    """
+    m = Mapper(img)
+    r = {k: 0 for k in REGS}
+    r["rbp"] = 0x140000000
+    saved = img.buf
+    try:
+        img.buf = bytes.fromhex("8b4d20")
+        n, dst, addr, _src = m._ea(1, 0, r)
+    finally:
+        img.buf = saved
+    fails = []
+    if isinstance(addr, tuple):
+        fails.append("mod=01 rm=101 decoded as RIP-relative; must be [rbp+disp]")
+    elif addr != 0x140000020:
+        fails.append(f"[rbp+0x20] resolved to 0x{addr:x}, expected 0x140000020")
+    if dst != "rcx":
+        fails.append(f"destination decoded as {dst}, expected rcx")
+    if n != 2:
+        fails.append(f"modrm+disp8 consumed {n} bytes, expected 2")
+    return fails
+
+
+def test_constant_propagated_through_register(img: Image) -> list:
+    """TRAP 2. A constant reaching a use through a register must be followed.
+
+    Program: mov eax,0; mov r8d,4; mov eax,r8d; ret  -> must yield 4, which is
+    only observable if register values propagate. Scanning for an immediate
+    store would see nothing.
+    """
+    m = Mapper(img)
+    saved = img.buf
+    prog = bytes.fromhex("b800000000" "41b804000000" "4489c0" "c3")
+    try:
+        img.buf = prog
+        img_va2off = img.va2off
+        img.va2off = lambda va: va if 0 <= va < len(prog) else None
+        got = m.run(0, 0)
+    finally:
+        img.buf = saved
+        img.va2off = img_va2off
+    return [] if got == 4 else [f"register-propagated constant yielded {got}, expected 4"]
+
+
+def test_item_mapper_controls(img: Image) -> list:
+    """Live/disassembly-verified behaviour of the item mapper."""
+    m = Mapper(img)
+    fails = []
+    got = m.run(ITEM_MAPPER, 568)
+    if got != 1:
+        fails.append(f"item mapper atom 568 'players' -> {got}, expected 1")
+    got = m.run(ITEM_MAPPER, 11)
+    if got != 0:
+        fails.append(f"item mapper atom 11 'actives' -> {got}, expected 0")
+    return fails
+
+
+def test_manager_424_is_accepted_somewhere(img: Image) -> list:
+    """MANDATORY control. A live client holds a resident manager record, so some
+    mapper must map atom 424 to a non-zero field id. The previous pattern-scan
+    method failed exactly here, and any replacement must not."""
+    m = Mapper(img)
+    accepting = []
+    for start in find_mappers(img):
+        try:
+            if m.run(start, 424):
+                accepting.append(start)
+        except Unsupported:
+            continue
+    if not accepting:
+        return ["no mapper maps atom 424 'manager' to a non-zero field id, "
+                "which contradicts the live resident manager record"]
+    return []
+
+
+def selftest(img: Image) -> int:
+    checks = [
+        ("atom table anchors", test_atom_anchors),
+        ("trap 1: rbp-relative modrm", test_rbp_relative_is_not_rip_relative),
+        ("trap 2: constant via register", test_constant_propagated_through_register),
+        ("item mapper positive controls", test_item_mapper_controls),
+        ("mandatory: manager atom 424 accepted", test_manager_424_is_accepted_somewhere),
+    ]
+    bad = 0
+    for name, fn in checks:
+        try:
+            fails = fn(img)
+        except Exception as exc:                       # noqa: BLE001 - report, don't mask
+            fails = [f"raised {type(exc).__name__}: {exc}"]
+        if fails:
+            bad += 1
+            print(f"  FAIL  {name}")
+            for f in fails:
+                print(f"          {f}")
+        else:
+            print(f"  ok    {name}")
+    print("\n  ALL PASS" if not bad else f"\n  {bad} CHECK(S) FAILED - negative results are NOT admissible")
+    return 1 if bad else 0
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__,
+                                 formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("image", type=Path, help="CardsDLL_Win64_retail.dll")
+    ap.add_argument("--selftest", action="store_true")
+    ap.add_argument("--atom", type=int, action="append", default=[],
+                    help="atom index to resolve through every mapper")
+    ap.add_argument("--name", action="append", default=[],
+                    help="atom name to resolve through every mapper")
+    args = ap.parse_args()
+    img = Image(args.image)
+
+    if args.selftest:
+        return selftest(img)
+
+    atoms = list(args.atom)
+    for nm in args.name:
+        idx = img.atom_index(nm)
+        if idx is None:
+            print(f"  atom {nm!r} not found in the table")
+            return 2
+        atoms.append(idx)
+    if not atoms:
+        ap.error("give --atom/--name, or --selftest")
+
+    m = Mapper(img)
+    mappers = find_mappers(img)
+    print(f"  {len(mappers)} mapper function(s) found\n")
+    for a in atoms:
+        print(f"  === atom {a} ({img.atom(a)!r}) ===")
+        rows, unsup = [], 0
+        for start in sorted(mappers):
+            try:
+                fid = m.run(start, a)
+            except Unsupported:
+                unsup += 1
+                continue
+            if fid:
+                rows.append((start, fid))
+        for start, fid in rows:
+            print(f"    mapper 0x{start:x} -> field id {fid} (0x{fid:x})")
+        print(f"    {len(rows)} mapper(s) accept it; {unsup} not modelled\n")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/fifa17-recon/tools/live/probe_hunt.py b/fifa17-recon/tools/live/probe_hunt.py
new file mode 100755
index 0000000..7a365bf
--- /dev/null
+++ b/fifa17-recon/tools/live/probe_hunt.py
@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""Hunt for specific wire instance ids anywhere in the client's writable memory.
+
+Answers whether a served item was materialised into a record at all, versus
+materialised but not attached to a collection. A record is recognised by its
+established layout: id at +0x08, resourceId at +0x18, cardtype at +0x4c.
+
+Read-only. Never writes.
+
+usage: probe_hunt.py PID id [id ...]
+"""
+import re, struct, sys
+
+PID = int(sys.argv[1])
+IDS = [int(a) for a in sys.argv[2:]]
+if not IDS:
+    sys.exit("give at least one wire id")
+mem = open(f"/proc/{PID}/mem", "rb", buffering=0)
+
+regions = []
+for ln in open(f"/proc/{PID}/maps"):
+    m = re.match(r"([0-9a-f]+)-([0-9a-f]+) (\S{4}) \S+ \S+ \S+\s*(.*)", ln)
+    if not m:
+        continue
+    lo, hi, perms, path = int(m.group(1), 16), int(m.group(2), 16), m.group(3), m.group(4).strip()
+    if "w" not in perms:
+        continue
+    if path.startswith("/") and not path.endswith(".dll") and not path.endswith(".exe"):
+        continue
+    regions.append((lo, hi, perms, path))
+total = sum(hi - lo for lo, hi, _, _ in regions)
+print(f"  {len(regions)} writable regions, {total/2**20:.0f} MiB to scan")
+
+needles = {struct.pack("<I", i): i for i in IDS}
+hits = {i: [] for i in IDS}
+CHUNK = 8 << 20
+scanned = 0
+for lo, hi, perms, path in regions:
+    a = lo
+    while a < hi:
+        n = min(CHUNK, hi - a)
+        try:
+            mem.seek(a)
+            data = mem.read(n)
+        except OSError:
+            a += n
+            continue
+        if not data:
+            a += n
+            continue
+        scanned += len(data)
+        for nd, wid in needles.items():
+            start = 0
+            while True:
+                j = data.find(nd, start)
+                if j < 0:
+                    break
+                start = j + 1
+                va = a + j
+                # a record would place this id at +0x08
+                rec = va - 0x08
+                try:
+                    mem.seek(rec)
+                    r = mem.read(0x100)
+                except OSError:
+                    continue
+                if len(r) < 0x100:
+                    continue
+                ct = struct.unpack_from("<i", r, 0x4c)[0]
+                res = struct.unpack_from("<I", r, 0x18)[0]
+                sub = struct.unpack_from("<i", r, 0x50)[0]
+                cat = struct.unpack_from("<i", r, 0x60)[0]
+                looks = 0 <= ct <= 32 and res > 1000
+                hits[wid].append((va, rec, ct, sub, cat, res, looks))
+        a += n
+print(f"  scanned {scanned/2**20:.0f} MiB\n")
+for wid in IDS:
+    hs = hits[wid]
+    recs = [h for h in hs if h[6]]
+    print(f"  id {wid}: {len(hs)} raw occurrence(s), {len(recs)} record-shaped")
+    for va, rec, ct, sub, cat, res, _ in recs[:6]:
+        print(f"    record {rec:#x}: cardtype={ct} subtype={sub} category={cat} resourceId={res}")
+    if not recs:
+        print("    NOT MATERIALISED as a record anywhere in writable memory")
diff --git a/fifa17-recon/tools/live/probe_ids.py b/fifa17-recon/tools/live/probe_ids.py
new file mode 100755
index 0000000..d99b9d4
--- /dev/null
+++ b/fifa17-recon/tools/live/probe_ids.py
@@ -0,0 +1,92 @@
+#!/usr/bin/env python3
+"""Identify every resident record by its wire instance id.
+
+Record layout established from known wire values:
+  +0x08 id (wire instance)   +0x18 resourceId   +0x1c/+0x20 assetId
+  +0x38 discardValue         +0x4c cardtype     +0x50 cardsubtypeid
+  +0x5c itemState            +0x60 category     +0x94 teamid
+  +0xb4 rating               +0xba teamkittypetechid (u16)
+
+Walks the contiguous 0x180-stride pool around the manager slot record so records
+that are resident but not in any collection are still seen. Read-only.
+
+usage: probe_ids.py PID [expected_id ...]
+"""
+import re, struct, sys
+
+PID = int(sys.argv[1])
+WANT = {int(a) for a in sys.argv[2:]}
+mem = open(f"/proc/{PID}/mem", "rb", buffering=0)
+
+def rd(a, n):
+    mem.seek(a); return mem.read(n)
+def q(a):
+    return struct.unpack("<Q", rd(a, 8))[0]
+
+named = []
+for ln in open(f"/proc/{PID}/maps"):
+    m = re.match(r"([0-9a-f]+)-([0-9a-f]+) \S{4} \S+ \S+ \S+\s+(.+)", ln)
+    if m:
+        named.append((int(m.group(1), 16), m.group(3).strip()))
+named.sort()
+base = next(s for s, p in named if p.endswith("CardsDLL_Win64_retail.dll"))
+live = lambda s: base + (s - 0x180000000)
+if rd(live(0x180026fea), 5) != bytes.fromhex("ba75750000"):
+    sys.exit("SANITY FAILED")
+owner = q(live(0x1802e6398))
+mgr = owner + 0x1f9d8
+RECSZ = 0x180
+
+def dec(rec):
+    r = rd(rec, 0x180)
+    g = lambda o: struct.unpack_from("<i", r, o)[0]
+    return dict(id=struct.unpack_from("<I", r, 0x8)[0], res=struct.unpack_from("<I", r, 0x18)[0],
+                ct=g(0x4c), sub=g(0x50), st=g(0x5c), cat=g(0x60), team=g(0x94),
+                rating=struct.unpack_from("<I", r, 0xb4)[0],
+                kt=struct.unpack_from("<H", r, 0xba)[0])
+
+mgr_rec = q(mgr + 0xc0 + 0x10)
+print(f"  manager-slot record = {mgr_rec:#x}")
+anchor = mgr_rec if mgr_rec else q(q(mgr + 0xd8) + 0x10)
+
+# walk backwards to the start of the contiguous run, then forwards
+lo = anchor
+for _ in range(64):
+    prev = lo - RECSZ
+    try:
+        d = dec(prev)
+    except OSError:
+        break
+    if not (0 < d["ct"] < 64) or d["id"] == 0:
+        break
+    lo = prev
+
+print(f"  pool run starts at {lo:#x}\n")
+print(f"    {'idx':>3} {'addr':>12} {'id':>10} {'resource':>9} {'ct':>3} {'sub':>4} "
+      f"{'st':>3} {'cat':>4} {'team':>5} {'rate':>5} {'kt':>6}")
+found = {}
+k = 0
+addr = lo
+while k < 48:
+    try:
+        d = dec(addr)
+    except OSError:
+        break
+    if d["id"] == 0 and d["ct"] == 0:
+        break
+    tag = ""
+    if d["ct"] == 7:
+        tag = "  <== CARDTYPE 7"
+    if d["id"] in WANT:
+        tag += "  <== WANTED"
+        found[d["id"]] = addr
+    slot = " [manager slot]" if addr == mgr_rec else ""
+    print(f"    {k:>3} {addr:#12x} {d['id']:>10} {d['res']:>9} {d['ct']:>3} {d['sub']:>4} "
+          f"{d['st']:>3} {d['cat']:>4} {d['team']:>5} {d['rating']:>5} {d['kt']:>6}{tag}{slot}")
+    addr += RECSZ
+    k += 1
+
+if WANT:
+    print(f"\n  wanted ids: {sorted(WANT)}")
+    for w in sorted(WANT):
+        print(f"    {w}: {'FOUND at ' + hex(found[w]) if w in found else 'NOT RESIDENT'}")
diff --git a/fifa17-recon/tools/live/probe_layout2.py b/fifa17-recon/tools/live/probe_layout2.py
new file mode 100755
index 0000000..9aa50b8
--- /dev/null
+++ b/fifa17-recon/tools/live/probe_layout2.py
@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""Map FIFA 17 resident record offsets using UNIQUE wire values as ground truth.
+
+v2: identifies each record by its wire instance id (large, unique) and only
+accepts a field mapping when the value is distinctive (>= 16) and the same
+offset holds the right value for EVERY identified record. This avoids the v1
+failure where cardsubtypeid == 0 matched every zeroed field in the struct.
+
+Read-only. Never writes.
+
+usage: probe_layout2.py PID squad_active.json
+"""
+import re, struct, sys, json, collections
+
+PID = int(sys.argv[1])
+SQUAD = json.load(open(sys.argv[2]))
+mem = open(f"/proc/{PID}/mem", "rb", buffering=0)
+
+def rd(a, n):
+    mem.seek(a); return mem.read(n)
+def q(a):
+    return struct.unpack("<Q", rd(a, 8))[0]
+
+named = []
+for ln in open(f"/proc/{PID}/maps"):
+    m = re.match(r"([0-9a-f]+)-([0-9a-f]+) \S{4} \S+ \S+ \S+\s+(.+)", ln)
+    if m:
+        named.append((int(m.group(1), 16), m.group(3).strip()))
+named.sort()
+base = next(s for s, p in named if p.endswith("CardsDLL_Win64_retail.dll"))
+live = lambda s: base + (s - 0x180000000)
+if rd(live(0x180026fea), 5) != bytes.fromhex("ba75750000"):
+    sys.exit("SANITY FAILED")
+owner = q(live(0x1802e6398))
+mgr = owner + 0x1f9d8
+RECSZ = 0x180
+
+beg, end = q(mgr + 0xd8), q(mgr + 0xe0)
+recs = [r for r in (q(beg + k*24 + 0x10) for k in range((end - beg)//24)) if r]
+
+wire = {}
+for p in SQUAD["players"]:
+    it = p.get("itemData") or {}
+    if it.get("id"):
+        wire[it["id"]] = it
+
+# --- identify each record by its wire instance id ---
+ident = {}
+for rec in recs:
+    r = rd(rec, RECSZ)
+    for off in range(0, RECSZ - 4, 4):
+        v = struct.unpack_from("<I", r, off)[0]
+        if v in wire:
+            ident.setdefault(rec, (v, off))
+            break
+print(f"  resident player records: {len(recs)}, identified: {len(ident)}")
+id_offs = collections.Counter(o for _, o in ident.values())
+print(f"  wire-id offset candidates: {[(hex(o), c) for o, c in id_offs.most_common()]}")
+
+FIELDS = ("id", "resourceId", "assetId", "definitionId", "cardassetid", "rating",
+          "teamid", "nation", "leagueId", "contract", "fitness", "playStyle",
+          "discardValue", "cardsubtypeid", "owners", "rareflag")
+# --- for every offset, does it hold field F for every identified record? ---
+consistent = {}
+for off in range(0, RECSZ - 4, 4):
+    for f in FIELDS:
+        ok = 0; total = 0; distinct = set()
+        for rec, (wid, _) in ident.items():
+            it = wire[wid]
+            v = it.get(f)
+            if not isinstance(v, int) or v < 16:      # require distinctive values
+                continue
+            total += 1
+            got = struct.unpack_from("<I", rd(rec, RECSZ), off)[0]
+            if got == v:
+                ok += 1; distinct.add(v)
+        if total >= 5 and ok == total and len(distinct) >= 2:
+            consistent.setdefault(off, []).append((f, total, len(distinct)))
+
+print(f"\n  === offsets consistently holding a distinctive wire field ===")
+for off in sorted(consistent):
+    for f, total, nd in consistent[off]:
+        print(f"    +0x{off:<4x} {f:14s} (matched {total}/{total} records, {nd} distinct values)")
+
+# --- dump the manager and the three club staff for comparison ---
+print(f"\n  === cardtype-2 slot (manager) ===")
+h = q(mgr + 0xc0 + 0x10)
+if h:
+    r = rd(h, RECSZ)
+    for off in sorted(consistent):
+        f = consistent[off][0][0]
+        print(f"    +0x{off:<4x} {f:14s} = {struct.unpack_from('<I', r, off)[0]}")
+    for name, off, sz in (("cardtype", 0x4c, 4), ("cardsubtypeid", 0x50, 4),
+                          ("itemState", 0x5c, 4), ("category", 0x60, 4)):
+        print(f"    +0x{off:<4x} {name:14s} = {struct.unpack_from('<i', r, off)[0]}")
diff --git a/fifa17-recon/tools/live/probe_map2.py b/fifa17-recon/tools/live/probe_map2.py
new file mode 100755
index 0000000..d596f38
--- /dev/null
+++ b/fifa17-recon/tools/live/probe_map2.py
@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""Enumerate FIFA 17's resident item map authoritatively.
+
+Layout recovered from the lower_bound at 0x180119640:
+  owner+0x160c8  sentinel / end marker
+  owner+0x160d8  root
+  owner+0x160e8  count
+  node+0x00, node+0x08  children
+  node+0x20      key = wire instance id (qword)
+  node+0x28      the item record
+On miss the client returns the static sentinel 0x1802c2a28 whose +0x10 is NULL.
+
+Read-only. usage: probe_map2.py PID [id ...]
+"""
+import re, struct, sys, collections
+
+PID = int(sys.argv[1]); WANT = {int(a) for a in sys.argv[2:]}
+mem = open(f"/proc/{PID}/mem", "rb", buffering=0)
+def rd(a, n):
+    mem.seek(a); return mem.read(n)
+def q(a): return struct.unpack("<Q", rd(a, 8))[0]
+named = []
+for ln in open(f"/proc/{PID}/maps"):
+    m = re.match(r"([0-9a-f]+)-([0-9a-f]+) \S{4} \S+ \S+ \S+\s+(.+)", ln)
+    if m: named.append((int(m.group(1), 16), m.group(3).strip()))
+named.sort()
+base = next(s for s, p in named if p.endswith("CardsDLL_Win64_retail.dll"))
+if rd(base + (0x180026fea - 0x180000000), 5) != bytes.fromhex("ba75750000"):
+    sys.exit("SANITY FAILED")
+owner = q(base + (0x1802e6398 - 0x180000000))
+SENT, ROOT, COUNT = owner + 0x160c8, q(owner + 0x160d8), q(owner + 0x160e8) & 0xffffffff
+print(f"  owner={owner:#x} sentinel={SENT:#x} root={ROOT:#x} count={COUNT}")
+
+nodes, seen, stack = [], set(), [ROOT]
+while stack:
+    n = stack.pop()
+    if not n or n == SENT or n in seen or len(seen) > 5000:
+        continue
+    seen.add(n)
+    try:
+        h = rd(n, 0x30)
+    except OSError:
+        continue
+    if len(h) < 0x30:
+        continue
+    nodes.append(n)
+    stack.append(struct.unpack_from("<Q", h, 0)[0])
+    stack.append(struct.unpack_from("<Q", h, 8)[0])
+print(f"  nodes reached: {len(nodes)} (count field says {COUNT})\n")
+
+print(f"    {'key':>11} {'record':>12} {'id':>10} {'resource':>10} {'ct':>3} {'sub':>4} {'st':>4} {'cat':>4}")
+hist = collections.Counter(); found = {}
+rows = []
+for n in nodes:
+    key = q(n + 0x20)
+    rec = n + 0x28
+    try: r = rd(rec, 0x180)
+    except OSError: continue
+    if len(r) < 0x180: continue
+    g = lambda o: struct.unpack_from("<i", r, o)[0]
+    rid = struct.unpack_from("<I", r, 0x8)[0]
+    res = struct.unpack_from("<I", r, 0x18)[0]
+    ct, sub, st, cat = g(0x4c), g(0x50), g(0x5c), g(0x60)
+    hist[ct] += 1
+    if rid in WANT: found[rid] = rec
+    rows.append((key, rec, rid, res, ct, sub, st, cat))
+for key, rec, rid, res, ct, sub, st, cat in sorted(rows):
+    tag = "  <== CARDTYPE 7" if ct == 7 else ("  <== WANTED" if rid in WANT else "")
+    print(f"    {key:>11} {rec:#12x} {rid:>10} {res:>10} {ct:>3} {sub:>4} {st:>4} {cat:>4}{tag}")
+print(f"\n  cardtype histogram: {dict(sorted(hist.items()))}   total={sum(hist.values())}")
+for w in sorted(WANT):
+    print(f"    id {w}: {'RESIDENT' if w in found else 'ABSENT'}")