tools(fifa17): resolve the itemState comparator live — it is CASE-SENSITIVE

The plan recorded this as "almost certainly unresolvable statically", because `FUN_180008190` is only a forwarding stub through a slot the host fills at runtime: `mov rax,[DAT_1802ddfd8]; mov r9,[rax+0x248]; jmp r9`. It IS resolvable — just not from disk. Read read-only out of the running client (pid 6580): the slot forwards through two FIFA17.exe thunks into msvcr120.dll+0x3c330, whose body is strncmp (`test r8,r8` count, `test al,al` NUL stop, `cmp al,[rcx+rdx]`, then MSVC's 0x8080../0xfefe.. NUL-detect fast path). No `or ..,0x20`, no folding table: the compare is raw bytes. So the casing in the table at 0x180229cc0 is a CONTRACT. A mis-cased token does not degrade gracefully — FUN_180166660 returns 0xffffffff, the record keeps 0 = invalid, and the item fails the squad builder. This confirms what fut::item_state already emits; it was previously true by convention and is now true by measurement. The probe follows the chain and attributes each hop to its module, which needs care under Wine: PE sections are mapped anonymously, so a module is identified by the nearest preceding named mapping rather than the containing one.
2026-08-21 20:54:29 +00:00
parent 43aa114bcd
commit beb505b0fa
3 changed files with 206 additions and 6 deletions
@@ -553,15 +553,42 @@ depend on it (`FUN_180108c00` carries the same mapping independently), but the
 dispatch table that reaches it was not identified, and trophies are a whole
 unimplemented family.

-**Case sensitivity of the `itemState` string match.** Almost certainly
-unresolvable statically: `FUN_180008190` is a single indirect call through
-`DAT_1802ddfd8 + 0x248`, a runtime-populated service pointer. Send the exact
-casing from the table and do not experiment on the live save.
+**Case sensitivity of the `itemState` string match. RESOLVED 2026-08-21 —
+CASE-SENSITIVE.** It was expected to be unresolvable statically, because
+`FUN_180008190` is nothing but a forwarding stub through a runtime-populated
+slot:
+
+```
+mov rax, [DAT_1802ddfd8]    ; service object, handed to CardsDLL by the host
+mov r9,  [rax + 0x248]
+jmp r9
+```
+
+Resolved read-only against the running client (pid 6580) with
+`fifa17-recon/tools/service_ptr_probe.py`, which follows the chain and
+attributes each hop to a module (Wine maps PE sections anonymously, so the
+module comes from the nearest preceding named mapping):
+
+```
+*(service + 0x248) = 0x146d1c020   FIFA17.exe+0x20f9020   e9 …   jmp rel32
+                   → 0x145e27fe0   FIFA17.exe+0x1204fe0   ff 25  jmp [rip+…]
+                   → 0x6ffffd11c330 msvcr120.dll+0x3c330  function body
+```
+
+The body is `strncmp`: `sub rdx,rcx` / `test r8,r8` (count) / `test al,al`
+(NUL stop) / `cmp al,[rcx+rdx]`, then MSVC's 8-byte fast path with the
+`0x8080808080808080` and `0xfefefefefefefeff` NUL-detect constants. There is no
+`or ..,0x20` and no folding table anywhere in the body, so the compare is raw
+bytes.
+
+CONSEQUENCE: a mis-cased token does not degrade, it matches nothing —
+`FUN_180166660` returns `0xffffffff`, the record keeps `0` = `invalid`, and the
+item fails the squad builder's `state == 1 || state == 2` test. The casing in
+the table at `0x180229cc0` is a contract. Send it verbatim; do not experiment on
+the live save.

 ### Needs a live probe (read-only, no launch)

-**Resolve `DAT_1802ddfd8 + 0x248`** in the running process and identify the string
-comparator. That answers the casing question without a launch.

 **Re-read `+0x30` after a refetch** to decide between "monotonic clock" and
 "sequence counter". Low value; nothing we send reaches it.