funman300/OpenFUT
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fifa17-recon: the /settings 42-flag gate, and why Seasons never asks

Browse Source 
ENDPOINT_MAP said this class reads one key, `configs`, and that was true and
useless. What it missed is what happens after each element closes: the client
feeds the STRING VALUE of `type` back through the atom hasher and switches on
the result, 42 arms wide. A flag is a row, not a key, and the client hashes our
string itself.

Followed it to the end. FUN_18011dc50 is the only writer of the IS_* UI gate
bytes inside FutDataManagerImpl, every line is `byte = (field == 1)`, and the
constructor never touches those bytes. So a flag nobody sends is a gate nobody
opens. friendlySeasonsEnabled and enableDraftMode have never been sent by
anything, which is a mechanism for Seasons refusing while making zero requests
to any of the four servers.

The store is the control that makes this readable: IS_STORE_ENABLED is the same
kind of byte and its screen works, because storeEnabled and friends already
ship through the Blaze config store. That list has no seasons or draft flag.

Ship the gates behind FUT_SETTINGS (off/keep/gates, default gates), and
re-assert the working store flags in the same array on purpose: once a
populated array makes the applier run, it writes EVERY gate byte, so omitting
them could switch off a screen that works today.

maximumTradePileSize=100 rides along as a positive control, because a boolean
that changes nothing cannot distinguish "the flag did not help" from "the array
never reached the consumer".

check_settings_flags.py asserts each shipped name against the atom table AND
the recovered switch, since a misnamed flag is silently inert and looks exactly
like a failed fix. enableSquadBuildingSetsFeature is the reason both checks are
needed: a real atom with no arm here.

Live: 439 contract checks pass, market unit suite passes.
Not yet tested in game.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
funman300
2026-08-05 12:11:20 -07:00
parent 9348b83374
commit 897259c8fb
18 changed files with 789 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fifa17-recon/tools/ghidra_queries/q_datamanager_ctor.py
+24
View File
@@ -0,0 +1,24 @@
"""FUT::FutDataManagerImpl constructor -> the settings defaults.
The settings struct sits at object+0x28 (FUN_18014e590 hands param_1+0x28 to the
deser), so field N of the flag table is at byte offset 0x28 + N*4:
0x50 tradingEnabled[10] 0x54 storeEnabled[0xb] <- CONTROL, works today
0x80 friendlySeasonsEnabled[0x16] <- Seasons
0x84 enableDraftMode[0x17] <- Draft
0x88 enableOffline/SinglePlayerDraftMode[0x18]
0x98 enableObjectives[0x1c] (settings can only CLEAR this one)
Print the whole constructor and the coverage numbers. Do NOT conclude "field X is
not initialised" from a partial read: this repo lost seven attempts to exactly
that mistake (the FutMoveCard retraction), so the char counts are printed and the
full text follows.
"""
VA = 0x18010CDC0
f = func(VA)
src = dec(VA)
print("FUT::FutDataManagerImpl ctor %#x" % VA)
print(" body bytes : %d" % f.getBody().getNumAddresses())
print(" decompile : %d chars (entire text printed below)" % len(src))
print("=" * 78)
print(src)
fifa17-recon/tools/ghidra_queries/q_gate_accessors.py
+43
View File
@@ -0,0 +1,43 @@
"""Decompile the gate accessors themselves.
The publisher calls virtuals on the object returned by the service locator:
+0x270 IS_TRADING_ENABLED +0x280 IS_STORE_ENABLED (CONTROL: works today)
+0x2b0 IS_FRIENDLY_SEASON_ENABLED +0x2b8 IS_TOURNAMENT_QUIT_ENABLED
+0x2c0 IS_PROCESSING_STATE_ENABLED +0x2c8 IS_DRAFT_MODE_ENABLED
+0x2d8 IS_STORY_MODE_REWARD_ENABLED +0x2f0 IS_RETURNING_USER_REWARDS_...
FutDataManagerImpl's ctor installs three vtables (multiple inheritance):
PTR_LAB_18021c2a0 at +0, PTR_FUN_18021cda8 at +8, PTR_LAB_18021cdb8 at +0x10.
The locator hands back one of the sub-objects, so try all three and keep whichever
resolves these slots to real functions. Reading the accessor settles what each
gate actually reads, which the field-offset arithmetic can only guess at.
"""
SLOTS = {0x270: "IS_TRADING_ENABLED", 0x280: "IS_STORE_ENABLED (CONTROL)",
0x2B0: "IS_FRIENDLY_SEASON_ENABLED", 0x2B8: "IS_TOURNAMENT_QUIT_ENABLED",
0x2C0: "IS_PROCESSING_STATE_ENABLED", 0x2C8: "IS_DRAFT_MODE_ENABLED",
0x2D8: "IS_STORY_MODE_REWARD_ENABLED", 0x2F0: "IS_RETURNING_USER_REWARDS"}
for vt in (0x18021C2A0, 0x18021CDA8, 0x18021CDB8):
print("#" * 78)
print("# vtable %#x" % vt)
print("#" * 78)
ok = 0
for off, name in sorted(SLOTS.items()):
try:
t = qword(vt + off)
except Exception as e:
print(" +%#05x %-34s <unreadable>" % (off, name))
continue
f = fm.getFunctionAt(addr(t)) if 0x180000000 <= t < 0x181000000 else None
print(" +%#05x %-34s -> %#x %s" % (off, name, t, f.getName() if f else "(not a function)"))
if f:
ok += 1
print(" resolved %d/%d" % (ok, len(SLOTS)))
if ok >= len(SLOTS) - 1:
print("\n -- accessor bodies --")
for off, name in sorted(SLOTS.items()):
t = qword(vt + off)
if fm.getFunctionAt(addr(t)):
print("\n === +%#05x %s ===" % (off, name))
print(dec(t))
print()
fifa17-recon/tools/ghidra_queries/q_gate_applier.py
+16
View File
@@ -0,0 +1,16 @@
"""FUN_18011dc50 is the ONLY writer of every gate byte. Read it in full.
This is the join between the /settings response and the IS_* UI keys, so it
answers both open questions at once: what each gate byte is copied from, and
whether anything gives it a value when the configs array is empty.
"""
VA = 0x18011DC50
f = func(VA)
src = dec(VA)
print("%#x body %d bytes / decompile %d chars (printed IN FULL)"
% (VA, f.getBody().getNumAddresses(), len(src)))
print("=" * 78)
print(src)
print("\n-- who calls the applier --")
for a, n in callers(VA):
print(" %#x %s" % (a, n))
fifa17-recon/tools/ghidra_queries/q_gate_bytes.py
+58
View File
@@ -0,0 +1,58 @@
"""The gate accessors are one-line getters Ghidra never turned into functions, so
read their bytes and decode by hand.
Expected shape for a bool getter: 0F B6 81 <disp32> C3 (movzx eax,byte [rcx+d])
or 8A 41 <disp8> C3 (mov al,[rcx+d]). The disp is the field offset inside
FutDataManagerImpl, which is what identifies which flag each IS_* key publishes.
CONTROL: +0x280 IS_STORE_ENABLED, whose screen is live-proven working while the
server sends an empty configs array. Its offset anchors the mapping and its
default is known-good by observation.
"""
TARGETS = [(0x270, "IS_TRADING_ENABLED", 0x18011C670),
(0x280, "IS_STORE_ENABLED (CONTROL)", 0x18011C600),
(0x2B0, "IS_FRIENDLY_SEASON_ENABLED", 0x18011C500),
(0x2B8, "IS_TOURNAMENT_QUIT_ENABLED", 0x18011C660),
(0x2C0, "IS_PROCESSING_STATE_ENABLED", 0x18011C5B0),
(0x2C8, "IS_DRAFT_MODE_ENABLED", 0x18011C4B0),
(0x2D8, "IS_STORY_MODE_REWARD_ENABLED", 0x18011C640),
(0x2F0, "IS_RETURNING_USER_REWARDS", 0x18011C5C0)]
def decode(b):
"""Return (field_offset, note) for the simple getter forms."""
if b[0:3] == b"\x0f\xb6\x81":
return int.from_bytes(b[3:7], "little"), "movzx eax,byte[rcx+d32]"
if b[0:3] == b"\x0f\xb6\x41":
return b[3], "movzx eax,byte[rcx+d8]"
if b[0:2] == b"\x8b\x81":
return int.from_bytes(b[2:6], "little"), "mov eax,[rcx+d32]"
if b[0:2] == b"\x8b\x41":
return b[2], "mov eax,[rcx+d8]"
if b[0:2] == b"\x8a\x41":
return b[2], "mov al,[rcx+d8]"
if b[0:2] == b"\x8a\x81":
return int.from_bytes(b[2:6], "little"), "mov al,[rcx+d32]"
return None, "UNRECOGNISED"
print("%-6s %-32s %-12s %-10s %s" % ("SLOT", "KEY", "ADDR", "FIELD@", "FORM / BYTES"))
print("-" * 110)
rows = []
for slot, name, va in TARGETS:
b = read_bytes(va, 12)
off, form = decode(b)
rows.append((slot, name, va, off))
print("+%#05x %-32s %#-12x %-10s %s | %s"
% (slot, name, va, hex(off) if off is not None else "?", form, b.hex()))
# Field offset -> flag-table index, anchored on the struct base used by the parser.
print("\nIf the flag struct starts at object+0x28, index = (offset-0x28)/4:")
for slot, name, va, off in rows:
if off is None:
continue
idx = (off - 0x28) / 4
print(" %-32s offset %#-6x -> field[%s]" % (name, off, idx if idx % 1 else int(idx)))
print("\n=== 0x18011c600 (the one Ghidra did define) ===")
print(dec(0x18011C600))
fifa17-recon/tools/ghidra_queries/q_gate_publisher.py
+12
View File
@@ -0,0 +1,12 @@
"""FUN_18006cc60 publishes IS_STORE_ENABLED, IS_FRIENDLY_SEASON_ENABLED and
IS_DRAFT_MODE_ENABLED from one place. Read it, and read what it reads from.
IS_STORE_ENABLED is the control: its screen works today under an empty configs
array, so whatever source it reads is one whose default does NOT block. If
Seasons and Draft read the same source the same way, then the empty array is not
their blocker and the hypothesis dies here.
"""
print(dec(0x18006CC60))
print("\n-- callees --")
for a, n in callees(0x18006CC60):
print(" %#x %s" % (a, n))
fifa17-recon/tools/ghidra_queries/q_gate_writers.py
+56
View File
@@ -0,0 +1,56 @@
"""What sets the gate bytes, and what are they born as?
The IS_* keys read single bytes in a contiguous block inside FutDataManagerImpl:
0x1fd2e tradingEnabled 0x1fd2f storeEnabled 0x1fd30 storeEnabled_JP
0x1fd3a friendlySeasons 0x1fd3b tournamentQuit 0x1fd3c processingState
0x1fd3d draftMode 0x1fd3f storyModeReward 0x1fd40 returningUserRewards
These are NOT the int fields the /settings parser fills, so something copies
across. Two questions, and the second is the one that decides whether an empty
configs array blocks Seasons:
(1) who WRITES these bytes (the applier, and the constructor default)
(2) what value does the constructor give them
CONTROL: 0x1fd2f storeEnabled. Its screen works today under an empty configs
array, so whatever the ctor gives it is a non-blocking default, and any other
byte born the same way is equally non-blocking.
"""
import re, struct
OFFS = {0x1FD2E: "tradingEnabled", 0x1FD2F: "storeEnabled (CONTROL)",
0x1FD30: "storeEnabled_JP", 0x1FD3A: "friendlySeasonsEnabled",
0x1FD3B: "tournamentQuitEnabled", 0x1FD3C: "processingStateEnabled",
0x1FD3D: "enableDraftMode", 0x1FD3F: "storyModeRewardEnabled",
0x1FD40: "returningUserRewardsScreenEnabled"}
print("#" * 78)
print("# (1) every function whose code embeds one of these offsets")
print("#" * 78)
for off, name in sorted(OFFS.items()):
pat = struct.pack("<I", off)
fns = {}
for h in find_all(pat, blocks=(".text",)):
f = fm.getFunctionContaining(addr(h))
key = int(f.getEntryPoint().getOffset()) if f else 0
fns.setdefault(key, []).append(h)
print("\n %#x %s" % (off, name))
for a, hs in sorted(fns.items()):
label = fname(a) if a else "(no function)"
print(" %-16s %s at %s" % (hex(a) if a else "-", label,
", ".join(hex(x) for x in hs)))
print("\n\n" + "#" * 78)
print("# (2) the FutDataManagerImpl ctor, every line touching this block")
print("#" * 78)
src = dec(0x18010CDC0)
print(" (ctor decompile is %d chars; ALL of it is scanned below)" % len(src))
hit = False
for i, line in enumerate(src.splitlines()):
if re.search(r"0x1fd[0-9a-f][0-9a-f]", line):
print(" %5d | %s" % (i, line.strip()))
hit = True
if not hit:
print(" NO line in the ctor mentions this block.")
print(" That is a POSITIVE finding only if the whole ctor was scanned, and it")
print(" was (see char count). It means the bytes are zero-initialised by the")
print(" allocator or set elsewhere -- resolve via the writers in (1).")
fifa17-recon/tools/ghidra_queries/q_settings.py
+33
View File
@@ -0,0 +1,33 @@
"""What does the /settings deserializer actually parse?
ENDPOINT_MAP claims FutGetSettingsServerResponse (0x18013c6d0) reads ONE key,
`configs` (0xa2), an array of {type(0x354), value(0x377)}. That is a narrow claim
about a class that is supposed to carry ~40 feature flags, and the atom table
holds flag names (enableDraftMode 0xf9, friendlySeasonsEnabled 0x133,
enableSquadBuildingSetsFeature 0x100) that have to be read by SOMETHING.
This asks the decompiler directly, and prints the coverage numbers so that any
"it does not parse X" conclusion can be checked against the whole function rather
than a truncated slice (the FutMoveCard retraction, 2026-08-04).
"""
import re
TARGETS = {
0x18013C6D0: "FutGetSettingsServerResponse deser (claimed: configs only)",
0x18013D1F0: "CONTROL: squad record parser (known multi-atom)",
}
for va, label in TARGETS.items():
f = func(va)
src = dec(va)
body = f.getBody().getNumAddresses() if f else -1
print("=" * 78)
print("%#x %s" % (va, label))
print(" ghidra name : %s" % (f.getName() if f else "?"))
print(" body bytes : %d" % body)
print(" decompile : %d chars <-- searches below cover ALL of it" % len(src))
print("-" * 78)
print(src)
print("-- callees --")
for a, n in callees(va):
print(" %#x %s" % (a, n))
fifa17-recon/tools/ghidra_queries/q_settings_ctor.py
+24
View File
@@ -0,0 +1,24 @@
"""The settings struct starts at object+0x28 (FUN_18014e590 passes param_1+0x28
to the deser). Two functions outside the locator name the service id 0xed84b11:
0x180117020 and 0x1801170b0. One of them should be the concrete class's
create/register, which reaches its constructor, which holds the defaults.
What matters is the value each gate field is born with, because the server has
always sent an empty configs array:
param_2[0xb] storeEnabled <- CONTROL, screen works => born true
param_2[0x16] friendlySeasonsEnabled <- Seasons
param_2[0x17] enableDraftMode <- Draft
param_2[0x18] enableOffline/SinglePlayerDraftMode
param_2[0x1c] enableObjectives(AsManagerTasks) <- only ever CLEARED, so its
default is the only value it can ever have unless we send 0
Field N sits at byte offset 0x28 + N*4.
"""
for va in (0x180117020, 0x1801170B0):
print("=" * 78)
print("%#x" % va)
print("=" * 78)
print(dec(va))
print("-- callees --")
for a, n in callees(va):
print(" %#x %s" % (a, n))
print()
fifa17-recon/tools/ghidra_queries/q_settings_defaults.py
+21
View File
@@ -0,0 +1,21 @@
"""Recover the settings-struct DEFAULTS.
Every IS_* gate key is read off one object via vtable accessors:
+0x270 IS_TRADING_ENABLED +0x280 IS_STORE_ENABLED (CONTROL: screen works today)
+0x2b0 IS_FRIENDLY_SEASON_ENABLED +0x2c8 IS_DRAFT_MODE_ENABLED
The server has always sent {"configs":[]}, so whatever those return today IS the
constructor default. IS_STORE_ENABLED's screen works, so its default is true;
the question is whether Seasons and Draft share that or default false.
Route: resolve the object -> its vtable -> decompile the four accessors to learn
which field each reads -> find the constructor and read the initialisers.
"""
print("=" * 78)
print("FUN_180009c80 -- resolves the object (also called by the settings deser)")
print("=" * 78)
print(dec(0x180009C80))
print("=" * 78)
print("FUN_1800d7170 -- the argument it is given")
print("=" * 78)
print(dec(0x1800D7170))
fifa17-recon/tools/ghidra_queries/q_settings_defaults2.py
+19
View File
@@ -0,0 +1,19 @@
"""The settings defaults, from the handler's own constructor.
FUN_18014e590 (the /settings body parser) writes the flag struct at object+0x28.
FUN_18014e2d0 sits in the same code region and is the sub-object constructor the
FutDataManagerImpl ctor invokes for that slot, so it should initialise those
fields. Byte offset of flag-table field N is 0x28 + N*4:
0x50 tradingEnabled[10] 0x54 storeEnabled[0xb] <- CONTROL, works today
0x80 friendlySeasonsEnabled[0x16] 0x84 enableDraftMode[0x17]
0x88 offline/singleplayer draft[0x18] 0x98 enableObjectives[0x1c]
"""
for va in (0x18014E2D0, 0x18014E590):
f = func(va)
src = dec(va)
print("=" * 78)
print("%#x body %d bytes / decompile %d chars (printed in full)"
% (va, f.getBody().getNumAddresses(), len(src)))
print("=" * 78)
print(src)
fifa17-recon/tools/ghidra_queries/q_settings_flags.py
+85
View File
@@ -0,0 +1,85 @@
"""Extract the whole /settings flag switch, and name every case.
MECHANISM (recovered 2026-08-05, q_settings.py). The body really is just
`configs` (0xa2) -> array of {type(0x354), value(0x377)}, so ENDPOINT_MAP's key
ladder was right. What it missed is what happens AFTER an element closes:
iVar2 = FUN_180180d00(type_string) <- the atom hasher, applied to the
STRING VALUE of `type`
switch (iVar2) { case 0x98: ... } <- ~40 arms, one per feature flag
So a flag is not a JSON key. It is a row: {"type":"coinEnabled","value":"1"},
and the client hashes "coinEnabled" itself. That is why the array being empty
leaves every flag at its C++ constructor default.
This prints every case with its atom name, its getter, and its destination field
so the response can be built without guessing.
"""
import re, os
# NOTE: queries are exec'd inside ghidra_env.py, so __file__ is the HARNESS, not
# this file. Relative-to-__file__ paths silently resolve one directory too high,
# and the resulting exception skips the harness's os._exit(0), which then hangs
# the JVM until the timeout kills it. Use an absolute path.
REPO = "/home/alex/Documents/OpenFUT/fifa17-recon"
ATOMS = {}
tsv = os.path.join(REPO, "docs", "fut_atoms.tsv")
for line in open(tsv):
p = line.rstrip("\n").split("\t")
if len(p) >= 3:
try:
ATOMS[int(p[1], 16)] = p[2]
except ValueError:
pass
GETTER = {
"FUN_1800d7af0": "int/bool",
"FUN_1800d7ad0": "short",
"FUN_1800d7b10": "?",
}
src = dec(0x18013C6D0)
f = func(0x18013C6D0)
print("decompile %d chars / body %d bytes -- full text searched" %
(len(src), f.getBody().getNumAddresses()))
# The switch arms live after the element loop closes. Walk line by line and keep
# the most recent case label so each arm's body can be attributed.
cur = None
arms = {}
for line in src.splitlines():
m = re.search(r"\bcase (0x[0-9a-f]+):", line)
if m:
cur = int(m.group(1), 16)
arms.setdefault(cur, [])
continue
m = re.search(r"if \(iVar2 == (0x[0-9a-f]+)\)", line)
if m:
cur = int(m.group(1), 16)
arms.setdefault(cur, [])
continue
if cur is not None and line.strip():
arms[cur].append(line.strip())
print("\n%-8s %-42s %-10s %s" % ("ATOM", "NAME", "GETTER", "DESTINATION"))
print("-" * 100)
unknown = []
for a in sorted(arms):
body = " ".join(arms[a])[:200]
g = next((GETTER.get(x, x) for x in GETTER if x in body), "")
dst = ""
m = re.search(r"param_2\[(0x[0-9a-f]+|\d+)\]", body)
if m:
dst = "param_2[%s]" % m.group(1)
m2 = re.search(r"\*\(undefined1 \*\)\(param_2 \+ (0x[0-9a-f]+|\d+)\)", body)
if m2:
dst = "byte param_2+%s" % m2.group(1)
if "(**(code **)" in body:
dst += " (vcall)"
name = ATOMS.get(a, "?? UNKNOWN ATOM")
if a not in ATOMS:
unknown.append(a)
print("%-8s %-42s %-10s %s" % (hex(a), name, g, dst))
print("\n%d switch arms; %d unnamed" % (len(arms), len(unknown)))
fifa17-recon/tools/ghidra_queries/q_settings_gate.py
+40
View File
@@ -0,0 +1,40 @@
"""Does a /settings flag gate the Seasons and Draft screens?
The hypothesis. Seasons refuses while making ZERO requests to any of the four
servers, so nothing on the wire can be wrong. A UI state key evaluated from a
client-side default explains that exactly. The settings deser writes
friendlySeasonsEnabled -> param_2[0x16] and enableDraftMode -> param_2[0x17], and
.rdata carries the UI keys IS_FRIENDLY_SEASON_ENABLED and IS_DRAFT_MODE_ENABLED.
This asks whether those two are the same value, and what it defaults to when the
configs array is empty (which is what the server has always sent).
A positive result is: the key's writer reads the settings field. A negative
result is: the writer reads something else, which kills the hypothesis cheaply.
CONTROL: IS_STORE_ENABLED, whose flag (storeEnabled -> param_2[0xb]) is attached
to a screen that is live-proven WORKING while we send an empty configs array, so
whatever it defaults to is a default that does NOT block.
"""
KEYS = ["IS_FRIENDLY_SEASON_ENABLED", "IS_DRAFT_MODE_ENABLED", "IS_STORE_ENABLED"]
for k in KEYS:
print("=" * 78)
print(k)
print("=" * 78)
hits = find_all(k.encode() + b"\x00")
if not hits:
print(" no string found -- check the literal")
continue
for h in hits:
print(" string @ %#x" % h)
xs = xrefs_to(h)
if not xs:
print(" NO XREFS (may be reached by table/pointer, not a direct lea)")
for frm, typ, fn, ent in xs:
print(" ref from %#x in %s (%#x)" % (frm, fn, ent))
print("\n\n" + "#" * 78)
print("# WHO CALLS THE SETTINGS DESER, and what object does it fill?")
print("#" * 78)
for a, n in callers(0x18013C6D0):
print(" %#x %s" % (a, n))
fifa17-recon/tools/ghidra_queries/q_settings_service.py
+32
View File
@@ -0,0 +1,32 @@
"""Find the concrete settings service class, so its constructor defaults can be read.
FUN_180009c80 resolves the object through a service locator keyed by 0x0ed84b11
(service) / 0x0ed84b12 (interface), so the vtable is not reachable by following
pointers statically. But the class that REGISTERS itself under 0x0ed84b11 must
name the constant too, and its registration sits next to its construction.
Also decompile the two callers of the settings deser: the GET /settings path
(0x18014e590) and the massinfo path (0x180174630), to see where the filled
struct is handed off, since the publisher reads the SERVICE, not the response.
"""
import struct
for cid in (0x0ED84B11, 0x0ED84B12):
pat = struct.pack("<I", cid)
print("=" * 78)
print("references to %#x" % cid)
print("=" * 78)
seen = {}
for h in find_all(pat, blocks=(".text", ".rdata", ".data")):
f = fm.getFunctionContaining(addr(h))
if f:
seen.setdefault(int(f.getEntryPoint().getOffset()), f.getName())
else:
print(" %#x (not in a function)" % h)
for a, n in sorted(seen.items()):
print(" %#x %s" % (a, n))
print("\n" + "=" * 78)
print("0x18014e590 -- GET /settings caller of the deser")
print("=" * 78)
print(dec(0x18014E590))
fifa17-recon/tools/ghidra_queries/q_settings_types.py
+28
View File
@@ -0,0 +1,28 @@
"""Resolve the two things the flag table cannot answer on its own.
1. The arms my line-attribution left blank (0xfa enableOfflineDraftMode,
0xfd enableObjectives, 0x1c0 maximumTradePileSize, 0x2f5) -- almost certainly
`case X: case Y:` fallthroughs, but "almost certainly" is how this repo has
been wrong before, so print the raw tail and read it.
2. The JSON TYPE `value` must have. `type` (0x354) goes through FUN_1801c7aa0 and
is used as a char*, so it is a string. `value` (0x377) goes through
FUN_1801c79d0 and is then converted by FUN_1800d7af0 / FUN_1800d7ad0. Whether
the wire wants "1" or 1 depends on which getter FUN_1801c79d0 is, and feeding
the wrong one at a scalar getter is the documented freeze at 0x1801c7f1a.
"""
src = dec(0x18013C6D0)
i = src.find("case 0x98")
print("=" * 78)
print("RAW SWITCH TAIL (from case 0x98 to end; %d of %d chars)" % (len(src) - i, len(src)))
print("=" * 78)
print(src[i:])
for va, why in ((0x1801C79D0, "getter used for `value` (0x377)"),
(0x1801C7AA0, "CONTROL: getter used for `type` (0x354), known string"),
(0x1800D7AF0, "converter applied to value -> int/bool"),
(0x1800D7AD0, "converter applied to value -> short")):
print("\n" + "=" * 78)
print("%#x %s" % (va, why))
print("=" * 78)
print(dec(va))