tools(fifa17): probe the manager-only chemistry slots to settle inferred vs proven

`card_identity_probe` reads the PLAYER slots (F_NATION 0x148, F_LEAGUE 0x154). A manager does not use those, so grading a manager with it reports nation=0 / leagueId=0 and reads like a server bug when it is only the wrong offsets. The manager layout, from the Ghidra reversal already recorded in fut_staff.py, is teamid rec+0x94, nation rec+0xde, leagueId rec+0xe0, talkrating rec+0xe2, negotiation rec+0xe3. The managercards merge (FUN_1801356c0) NEVER writes +0xde or +0xe0, which is exactly what makes them a clean test: whatever sits there came from our JSON and nowhere else. Read against the live client (pid 6580, 27 records in the CardsDb map): resource teamid nation league talkrating negot verdict 1000509 241 45 53 0 3 SERVER FIELDS LANDED So the manager's chemistry fields DO reach the record, and `negotiation=3` agrees with managercards row 1000509, i.e. the merge ran as well. That moves manager nation/league from INFERRED to PROVEN without a screenshot. Read-only: /proc/PID/mem is opened 'rb' and there is no write path.
2026-08-21 18:53:20 +00:00
parent 106cb83988
commit 8f98e6adda
1 changed files with 100 additions and 0 deletions
@@ -0,0 +1,100 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""Read back the MANAGER-ONLY chemistry slots the client resolved, and prove
+whether the server's `nation`/`leagueId` actually land in the record.
+
+READ-ONLY. /proc/PID/mem is opened 'rb'; there is no write path in this file.
+
+WHY THIS EXISTS
+---------------
+`card_identity_probe` reads the PLAYER slots (F_NATION = 0x148, F_LEAGUE =
+0x154). A manager does not use those, so grading a manager with that tool
+reports nation=0 / leagueId=0 and looks like a server bug when it is only the
+wrong offsets.
+
+`fifa17-recon/tools/fut_staff.py` records the manager layout from Ghidra:
+
+    rec+0x94  teamid          (read by the card view-model)
+    rec+0xde  nation          MANAGER-ONLY slot, u16
+    rec+0xe0  leagueId        MANAGER-ONLY slot, u16
+    rec+0xe2  talkrating      written by the managercards merge
+    rec+0xe3  negotiation     written by the managercards merge
+
+The merge (FUN_1801356c0) NEVER writes +0xde or +0xe0, so whatever sits there
+came from OUR JSON and nowhere else. That makes those two u16s a direct,
+unambiguous test of the server's manager chemistry fields: if they read back as
+the values we served, the wire contract is PROVEN rather than inferred; if they
+read zero, the client discarded them and manager chemistry cannot be rendering.
+
+Usage:  python3 manager_chem_probe.py            # grade every manager in the map
+"""
+import sys
+
+import watch_club_model as W
+import card_identity_probe as P
+
+MANAGER_CARDTYPE = 2  # FUN_1800d8330: cardsubtypeid 4 -> cardtype 2
+F_CARDTYPE = 0x4C
+F_RESOURCE = 0x18
+F_TEAMID = 0x94
+F_NATION_MGR = 0xDE
+F_LEAGUE_MGR = 0xE0
+F_TALKRATING = 0xE2
+F_NEGOTIATION = 0xE3
+REC_SIZE = 0x158
+
+
+def main():
+    pid = W.find_pid()
+    if pid is None:
+        print("FIFA17.exe is not running.")
+        return 1
+    base = W.dll_base(pid)
+    if base is None:
+        print("pid %d is up but %s is not mapped yet." % (pid, W.DLL))
+        return 1
+    mem = W.Mem(pid)
+    obj = mem.q(base + (W.G_CARDSDB - W.IMG_BASE))
+    if not obj:
+        print("CardsDb singleton is NULL (no FUT session loaded).")
+        return 1
+
+    ns = W.nodes(mem, obj) if hasattr(W, "nodes") else P.nodes(mem, obj)
+    print("pid=%d  CardsDb=%#x  walked=%d" % (pid, obj, len(ns)))
+    print()
+    print("%-10s %-8s %-8s %-8s %-10s %-10s %s"
+          % ("resource", "teamid", "nation", "league", "talkrating", "negot", "verdict"))
+
+    found = 0
+    for n in ns:
+        rec = n + 0x28
+        buf = mem.read(rec, REC_SIZE)
+        if not buf or len(buf) < REC_SIZE:
+            continue
+        if P.u8(buf, F_CARDTYPE) != MANAGER_CARDTYPE:
+            continue
+        found += 1
+        resource = P.u32(buf, F_RESOURCE)
+        teamid = P.u32(buf, F_TEAMID)
+        nation = P.u16(buf, F_NATION_MGR)
+        league = P.u16(buf, F_LEAGUE_MGR)
+        talk = P.u8(buf, F_TALKRATING)
+        negot = P.u8(buf, F_NEGOTIATION)
+        # +0xde and +0xe0 are never written by the merge, so a non-zero value
+        # can only have come from the server's JSON.
+        if nation and league:
+            verdict = "SERVER FIELDS LANDED"
+        elif nation or league:
+            verdict = "PARTIAL -- one slot empty"
+        else:
+            verdict = "EMPTY -- client kept nothing we sent"
+        print("%-10d %-8d %-8d %-8d %-10d %-10d %s"
+              % (resource, teamid, nation, league, talk, negot, verdict))
+
+    if not found:
+        print("(no manager record in the map -- the client has not been served one)")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())