funman300/OpenFUT
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wip: checkpoint FIFA 17 SBC research for Windows migration

Browse Source
This commit is contained in:
funman300
2026-08-07 12:03:22 -07:00
parent 3d3239bab9
commit cc694774a3
47 changed files with 9105 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fifa17-recon/tools/ghidra_queries/q_md_draft_1.py
+26
View File
@@ -0,0 +1,26 @@
"""DIMENSION 4 q1: Enumerate the published UI surface (FUN_18006cc60), the
userInfo.feature restriction map (FUN_18013ec10), and locate every draft/tournament
string + its xrefs.
Hypothesis: the entry gate for Draft/Tournaments is EITHER a feature-restriction
sub-key we might send, OR a published-context name other than IS_DRAFT_MODE_ENABLED /
IS_TOURNAMENT_QUIT_ENABLED, OR script-layer (no server-reachable input).
Control: FUN_18006cc60 is the known publisher (transfer-market doc). If it decompiles
and its IS_* names resolve, the query mechanics work. Print lengths in full to avoid
the truncated-decompile absence trap.
"""
import traceback
try:
# 1. The publisher (authoritative slot->name table per the brief)
d = dec(0x18006cc60)
print("=== FUN_18006cc60 publisher len=%d ===" % len(d))
print(d)
# 2. The userInfo.feature restriction parser
d2 = dec(0x18013ec10)
print("\n=== FUN_18013ec10 userInfo/feature parser len=%d ===" % len(d2))
print(d2)
except Exception:
traceback.print_exc()
print("QUERY_DONE")
fifa17-recon/tools/ghidra_queries/q_md_draft_2.py
+50
View File
@@ -0,0 +1,50 @@
"""DIMENSION 4 q2: locate the draft/tournament entry decision.
Hypothesis: entry is gated in the script layer / a manager singleton with no server
writer, NOT by any server-reachable field. Test by (a) enumerating draft/tournament
script-event + manager literals and their xrefs, (b) reading the CompetitionManager
setters FUN_180101680/FUN_1801016c0 (the Seasons lead) and looking for draft/tourney
analogues, (c) finding who READS the draft gate byte model+0x1fd3d and tournament
+0x1fd3b.
Control: 'IS_DRAFT_MODE_ENABLED' literal must resolve and xref into FUN_18006cc60
(the known publisher). If it does, the string/xref mechanics work.
"""
import traceback
try:
def show_str_xrefs(lit, blocks=(".rdata",)):
hits = find_all(lit.encode() + b"\x00", blocks)
print("\n--- literal %r : %d hit(s) ---" % (lit, len(hits)))
for h in hits:
print(" @ %#x" % h)
for frm, typ, fn, ent in xrefs_to(h):
print(" xref from %#x %s in %s (%#x)" % (frm, typ, fn, ent))
# control
show_str_xrefs("IS_DRAFT_MODE_ENABLED")
# draft / tournament script + manager literals
for lit in ("NOSEASONS", "NODRAFT", "NOTOURNAMENT", "DRAFTSQUAD_ON",
"SINGLE_PLAYER", "DRAFT_TOKEN", "DraftMode", "Draft",
"CompetitionManager", "TournamentInfo", "TournamentManager",
"DraftManager", "OnlineDraft", "OfflineDraft"):
show_str_xrefs(lit)
# substring scan for any *draft*/*tournament* ascii literal in .rdata
print("\n=== .rdata literals containing 'raft' or 'ourna' ===")
for needle in (b"raft", b"ourna"):
seen = set()
for h in find_all(needle, (".rdata",)):
# back up to string start
p = h
while p > h - 64:
b = read_bytes(p - 1, 1)
if not b or b[0] == 0 or b[0] < 0x20 or b[0] > 0x7e:
break
p -= 1
s = rd_str(p, 96)
if s and s not in seen and (b"raft" in s.encode() or b"ourna" in s.encode()):
seen.add(s)
print(" %#x %r" % (p, s))
except Exception:
traceback.print_exc()
print("QUERY_DONE")
fifa17-recon/tools/ghidra_queries/q_md_draft_3.py
+41
View File
@@ -0,0 +1,41 @@
"""DIMENSION 4 q3: do the draft/tournament MODE-STATE literals have native gating
callers, or are they inert descriptor names driven from the script layer?
Hypothesis: like the Seasons CompetitionManager setters (FUN_180101680/1801016c0,
zero callers), the draft/tournament mode nodes are named descriptors with no native
entry-gate; entry is decided in the packed front-end. Test by reading the xref
callers of each mode-state literal and decompiling the first native caller of each.
Control: 'NOSEASONS' xref is known (FUN_180057330). Re-confirm the Seasons setters
have zero callers as the reference negative.
"""
import traceback
try:
def xr(a, label):
print("\n--- %s @ %#x ---" % (label, a))
xs = xrefs_to(a)
for frm, typ, fn, ent in xs:
print(" from %#x %s in %s (%#x)" % (frm, typ, fn, ent))
return xs
xr(0x1801fbb50, "fefifa::FUTDraftOfflineMode")
xr(0x1801fbbc8, "fefifa::FUTOnlineDraftMode")
xr(0x180209a70, "CentralDraftModeOffline")
xr(0x180209ae0, "CentralDraftModeOnline")
xr(0x1801ebca0, "draftentry")
xr(0x1801fbbe8, "fefifa::FUTOfflineTournament")
xr(0x1801fbc08, "fefifa::FUTOnlineTournament")
xr(0x180218f18, "FUT::TournamentInfo")
xr(0x18021f870, "DraftMode(0x18021f870)")
xr(0x1801fbbd9, "DraftMode(0x1801fbbd9)")
# Seasons CompetitionManager control: setters + singleton
print("\n=== CONTROL: Seasons CompetitionManager setters callers ===")
for a in (0x180101680, 0x1801016c0):
print("callers(%#x) = %s" % (a, callers(a)))
print("xrefs_to DAT_1802e6328 (CompetitionManager singleton):")
for frm, typ, fn, ent in xrefs_to(0x1802e6328):
print(" from %#x %s in %s (%#x)" % (frm, typ, fn, ent))
except Exception:
traceback.print_exc()
print("QUERY_DONE")
fifa17-recon/tools/ghidra_queries/q_md_draft_4.py
+20
View File
@@ -0,0 +1,20 @@
"""DIMENSION 4 q4: read the hub tile builder FUN_1800b2680 in full (references both
CentralDraftModeOffline and CentralDraftModeOnline), plus 'draftentry' FUN_180016190
and the mode-node factories FUN_18006b820/FUN_18006b960 (online/offline draft) and
FUN_18006baa0/FUN_18006bd20 (offline/online tournament).
Hypothesis: FUN_1800b2680 builds the draft/tournament/seasons hub tiles and either
(a) gates a tile on a server-reachable field, or (b) builds them unconditionally,
which would make the refusal script-layer. Print full length to avoid truncation.
"""
import traceback
try:
for a, lbl in [(0x1800b2680, "hub tile builder FUN_1800b2680"),
(0x180016190, "draftentry FUN_180016190")]:
d = dec(a)
print("=== %s len=%d ===" % (lbl, len(d)))
print(d)
print("\n")
except Exception:
traceback.print_exc()
print("QUERY_DONE")
fifa17-recon/tools/ghidra_queries/q_md_draft_5.py
+37
View File
@@ -0,0 +1,37 @@
"""DIMENSION 4 q5: map model vtable slots +0x2b0..+0x320 to their accessor
displacements, so slot +0x2d0 (the offline-draft-specific gate in FUN_1800b2680)
and slot +0x320 (cVar9) can be measured live.
Model vtable static = 0x18021c2a0 (from ground truth / card doc). For each slot read
the target function's first bytes; if it is the accessor stub 0f b6 81 <disp32> c3
(movzx eax,byte [rcx+disp]; ret) decode disp.
Control: slot +0x270 must decode to disp 0x1fd2e (IS_TRADING), slot +0x2c8 to 0x1fd3d
(IS_DRAFT_MODE_ENABLED) -- both established in the card-subsystem doc.
"""
import traceback
try:
VT = 0x18021c2a0
names = {0x270:"IS_TRADING(+0x1fd2e)", 0x280:"IS_STORE", 0x2b0:"FRIENDLY_SEASON(+0x1fd3a)",
0x2b8:"TOURNAMENT_QUIT(+0x1fd3b)", 0x2c0:"PROCESSING(+0x1fd3c)",
0x2c8:"DRAFT_MODE(+0x1fd3d)", 0x2d0:"?offline-draft gate?",
0x2d8:"STORY_MODE_REWARD", 0x2e0:"packAnim(+0x1fd45)",
0x2f0:"RETURNING_USER", 0x320:"cVar9(FUN_1800b2680)"}
for slot in range(0x2a0, 0x330, 8):
tgt = qword(VT + slot)
b = read_bytes(tgt, 8)
disp = None
if b[:3] == b"\x0f\xb6\x81": # movzx eax, byte [rcx+disp32]
import struct
disp = struct.unpack("<i", b[3:7])[0]
note = names.get(slot, "")
print("slot +%#05x -> %#012x stub=%s disp=%s %s" %
(slot, tgt, b.hex(), hex(disp) if disp is not None else "(not a byte-accessor)", note))
if disp is None:
# decompile non-trivial accessors (offline draft gate / cVar9 may compute)
if slot in (0x2d0, 0x320):
print(" --- dec slot +%#x target ---" % slot)
print(dec(tgt))
except Exception:
traceback.print_exc()
print("QUERY_DONE")
fifa17-recon/tools/ghidra_queries/q_md_draft_6.py
+38
View File
@@ -0,0 +1,38 @@
"""DIMENSION 4 q6: are the GOTO_* tile destinations consumed by native gate code or
only handed to the front-end script layer? And what do the draft/tournament mode-node
factories register?
Hypothesis: GOTO_DRAFT_ONLINE/OFFLINE/DISABLED and GOTO_*TOURNAMENT appear ONLY as
string VALUES passed to the UI property setter in FUN_1800b2680 (no native consumer),
i.e. the destination is dispatched by the packed front-end -> script layer.
Control: GOTO_DRAFT_DISABLED must appear in FUN_1800b2680 (we just read it there).
"""
import traceback
try:
def whereis(lit):
hits = find_all(lit.encode() + b"\x00", (".rdata",))
print("\n--- %r : %d literal hit(s) ---" % (lit, len(hits)))
for h in hits:
xs = xrefs_to(h)
if not xs:
print(" @%#x NO xref (string only referenced by offset math / not a lea target)" % h)
for frm, typ, fn, ent in xs:
print(" @%#x xref from %#x %s in %s (%#x)" % (h, frm, typ, fn, ent))
for s in ("GOTO_DRAFT_ONLINE", "GOTO_DRAFT_OFFLINE", "GOTO_DRAFT_DISABLED",
"GOTO_OFFLINE_TOURNAMENT", "GOTO_ONLINE_CHAMPIONS", "GOTO_OFFLINE_SEASON",
"GOTO_ONLINE_SEASON"):
whereis(s)
# the draft mode-node factories (reference fefifa::FUTOnlineDraftMode / OfflineMode)
for a, lbl in [(0x18006b820, "FUN_18006b820 (FUTOnlineDraftMode node)"),
(0x18006b960, "FUN_18006b960 (FUTDraftOfflineMode node)"),
(0x18006baa0, "FUN_18006baa0 (FUTOfflineTournament node)"),
(0x18006bd20, "FUN_18006bd20 (FUTOnlineTournament node)")]:
d = dec(a)
print("\n=== %s len=%d ===" % (lbl, len(d)))
print(d)
except Exception:
traceback.print_exc()
print("QUERY_DONE")
fifa17-recon/tools/ghidra_queries/q_md_draft_7.py
+29
View File
@@ -0,0 +1,29 @@
"""DIMENSION 4 q7 (Q2 rigor): trace the three draft settings atoms 0xf9/0xfa/0xff
through the settings deser FUN_18013c6d0 to struct fields, and through the applier
FUN_18011dc50 to gate bytes +0x1fd3d / +0x1fd3e. Also enumerate ALL native readers
of the two draft gate bytes to confirm the tile builder is the only consumer.
Control: applier must contain a write to +0x1fd2e gated on (field==1) (IS_TRADING,
established). Print applier + deser in full (lengths printed) to avoid truncation.
"""
import traceback
try:
d = dec(0x18011dc50)
print("=== applier FUN_18011dc50 len=%d ===" % len(d))
print(d)
d2 = dec(0x18013c6d0)
print("\n=== settings deser FUN_18013c6d0 len=%d ===" % len(d2))
print(d2)
# native readers of the two draft gate bytes: scan .text for movzx/cmp/mov disp32
import struct as _s
print("\n=== raw disp32 sites for 0x1fd3d and 0x1fd3e in .text ===")
for disp in (0x1fd3d, 0x1fd3e):
pat = _s.pack("<i", disp)
hits = find_all(pat, (".text",))
for h in hits:
fn = fname(h)
print(" disp %#x referenced @%#x in %s" % (disp, h, fn))
except Exception:
traceback.print_exc()
print("QUERY_DONE")
fifa17-recon/tools/ghidra_queries/q_md_draft_8.py
+12
View File
@@ -0,0 +1,12 @@
"""DIMENSION 4 q8: characterize FUN_1800b73e0, the extra direct reader of the
offline-draft byte model+0x1fd3e, to confirm it is not a second independent gate
(it reads the same byte that measures 1 live). Also who calls it."""
import traceback
try:
d = dec(0x1800b73e0)
print("=== FUN_1800b73e0 len=%d ===" % len(d))
print(d)
print("\ncallers(FUN_1800b73e0) =", callers(0x1800b73e0))
except Exception:
traceback.print_exc()
print("QUERY_DONE")
fifa17-recon/tools/ghidra_queries/q_md_feature_1.py
+37
View File
@@ -0,0 +1,37 @@
"""DIMENSION 1 Q1: enumerate the userInfo.feature restriction vocabulary IN FULL.
Hypothesis: FUN_18013ec10 (userInfo deser) handles atom 0x11c (feature) by entering a
nested object-parse loop that dispatches sub-keys (trade=0x330 known) each writing a byte
into the userInfo record. Enumerate EVERY sub-key and the offset each writes.
CONTROL: the known trade atom 0x330 MUST appear and map to +0x17c. If it does not, the
dispatch form assumed is wrong and the enumeration below is unreliable.
Method: print full decompile length + full text of FUN_18013ec10, then scan for the
feature atom 0x11c and identify the nested parser (a callee entered at that case), then
decompile that callee in full too.
"""
import re, traceback
UI_DESER = 0x18013ec10
try:
f = func(UI_DESER)
src = dec(UI_DESER, 300)
print("=== FUN_%08x body=%d insns decompile=%d chars ===" %
(UI_DESER, f.getBody().getNumAddresses() if f else -1, len(src)))
print(src)
print("\n=== callees of FUN_%08x ===" % UI_DESER)
for a, n in callees(UI_DESER):
print(" %#x %s" % (a, n))
# where does 0x11c (feature) / 0x330 (trade) appear textually?
print("\n=== atom mentions in the decompile ===")
for atom, name in ((0x11c, "feature"), (0x330, "trade"), (0x17c, "off+0x17c"),
(0x50, "off+0x50")):
for ln in src.splitlines():
if ("0x%x" % atom) in ln.replace("0X", "0x"):
print(" [%-10s] %s" % (name, ln.strip()))
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_feature_2.py
+51
View File
@@ -0,0 +1,51 @@
"""DIMENSION 1 Q2: trace what the feature.trade byte gates at massinfo END_OBJECT,
and hunt for ANY other feature-style END_OBJECT zeroing (mode restrictions beyond trade).
Findings so far (q_md_feature_1): userInfo deser FUN_18013ec10 feature-object (case 0x11c)
recognises EXACTLY ONE sub-key, trade 0x330, writing byte *(u8*)(param_1 + 0x29). param_1
is undefined4* so this is byte offset 0x29*4 = 0xa4. But prior notes / q_feature_trade say
the massinfo check reads +0x17c and zeroes +0x50. Resolve the offset, and enumerate every
`cmp byte [rec+X],0 ; jz ; mov ... [rec+Y],0` restriction site in the massinfo root.
CONTROL: the known trade zero-site 0x180174f19 (mov dword [rsi+0x50],0) MUST appear.
Method: decompile massinfo root FUN_180174630 in full; print it; then walk its instruction
listing for every `mov ...,0` guarded by a `cmp byte [reg+disp],0 ; jz`, printing disp/target.
"""
import re, traceback
MASSINFO = 0x180174630
try:
f = func(MASSINFO)
src = dec(MASSINFO, 300)
print("=== FUN_%08x massinfo root body=%d insns decompile=%d chars ===" %
(MASSINFO, f.getBody().getNumAddresses() if f else -1, len(src)))
print(src)
# walk raw instructions for the restriction pattern: cmp byte [r+d],0 ; jz ; mov [r+d2],imm
print("\n=== raw scan: cmp byte [reg+disp],0x0 sites in massinfo body ===")
it = f.getBody().getAddresses(True)
prev = []
for ad in it:
ins = listing.getInstructionAt(ad)
if ins is None:
continue
s = str(ins)
prev.append((int(ad.getOffset()), s))
if len(prev) > 8:
prev.pop(0)
# detect cmp of a byte ptr against 0
if s.startswith("CMP") and "byte ptr" in s.lower() and s.rstrip().endswith(",0x0"):
print(" --- window around %#x ---" % int(ad.getOffset()))
for a2, s2 in prev[-3:]:
print(" %#x %s" % (a2, s2))
# print next 5 insns
nxt = ins
for _ in range(5):
nxt = listing.getInstructionAt(nxt.getAddress().add(nxt.getLength()))
if nxt is None:
break
print(" %#x %s" % (int(nxt.getAddress().getOffset()), str(nxt)))
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_feature_3.py
+55
View File
@@ -0,0 +1,55 @@
"""DIMENSION 1 Q1/Q4 airtight check: is trade (0x330) or feature (0x11c) dispatched
ANYWHERE other than the userInfo deser FUN_18013ec10?
If a second function compares against 0x330 or 0x11c, there could be another feature-style
restriction map. Enumerate ALL comparison FORMS by scanning instruction operands for the
immediates 0x330 and 0x11c across .text, and report the containing function of each.
CONTROL: FUN_18013ec10 (0x18013ec10) MUST appear for both 0x330 and 0x11c (the known site).
If it does not, the operand-immediate scan is broken and results are unreliable.
"""
import traceback
TARGETS = {0x330: "trade", 0x11c: "feature"}
KNOWN = 0x18013ec10
try:
# scan every instruction in .text for a scalar operand equal to a target immediate
hits = {t: set() for t in TARGETS}
text = None
for b in mem.getBlocks():
if b.getName() == ".text" and b.isInitialized():
text = b
break
ins = listing.getInstructions(text.getStart(), True)
count = 0
while ins.hasNext():
i = ins.next()
count += 1
n = i.getNumOperands()
for op in range(n):
objs = i.getOpObjects(op)
for o in objs:
try:
v = o.getValue() if hasattr(o, "getValue") else None
except Exception:
v = None
if v is None:
continue
v = int(v) & 0xFFFFFFFF
if v in TARGETS:
f = fm.getFunctionContaining(i.getAddress())
hits[v].add((f.getName() if f else "?",
int(f.getEntryPoint().getOffset()) if f else 0))
print("scanned %d .text instructions" % count)
for t, name in TARGETS.items():
print("\n=== immediate 0x%x (%s) appears in these functions ===" % (t, name))
got_known = False
for fn, ent in sorted(hits[t], key=lambda x: x[1]):
mark = " <== KNOWN userInfo deser" if ent == KNOWN else ""
print(" %#x %s%s" % (ent, fn, mark))
if ent == KNOWN:
got_known = True
print(" CONTROL FUN_18013ec10 present: %s" % got_known)
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_gates_1.py
+40
View File
@@ -0,0 +1,40 @@
"""DIMENSION 2 Q1/Q2: the publisher, the applier, the settings deser, the ctor.
HYPOTHESIS: FUN_18006cc60 publishes IS_* names by reading model vtable slots; the
complete set is 10 names over a contiguous .rdata run 0x1801fc118..0x1801fc228.
FUN_18011dc50 is the applier (byte = field==1). FUN_18013c6d0 is the settings deser
that maps atoms -> struct fields. FUN_18014e320 is the settings-struct ctor.
CONTROL: FUN_18006cc60 must reference IS_TRADING_ENABLED and call the vt+0x270
accessor already proven (reads 0x1fd2e). If the decompile of the applier shows
`cmp [reg+0x28],1 / sete / mov [rdi+0x1fd2e]` we have the known trading writer as a
positive control that the field-index arithmetic is right.
"""
import traceback
try:
PUB = 0x18006cc60
APP = 0x18011dc50
DESER = 0x18013c6d0
CTOR = 0x18014e320
print("=" * 70)
print("PUBLISHER FUN_18006cc60 (len / decompile)")
print("=" * 70)
d = dec(PUB)
print("len:", len(d))
print(d)
print("=" * 70)
print(".rdata name run 0x1801fc118..0x1801fc250 (contiguous IS_* names)")
print("=" * 70)
p = 0x1801fc118
end = 0x1801fc260
while p < end:
s = rd_str(p)
if s:
print("%#x %r" % (p, s))
p += len(s) + 1
else:
p += 1
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_gates_2.py
+93
View File
@@ -0,0 +1,93 @@
"""DIMENSION 2 Q1/Q3: slot->disp resolution + READER search per gate byte.
HYPOTHESIS: each publisher slot is an accessor stub `0f b6 81 <disp32> c3`
(movzx eax,byte[rcx+disp]; ret) at model vtable 0x18021c2a0. For the refusing
modes (season/draft/tournament), the ONLY reader of the gate byte is the publisher
FUN_18006cc60, which hands the value to the script layer -- i.e. no native mode gate.
CONTROL: slot 0x270 must decode to disp 0x1fd2e (trading), already proven by two
prior docs. Reader scan must find FUN_18011dc50 (applier, WRITES 0x1fd2e) and
FUN_1801a7260 (TO_TRADE_PILE predicate, READS 0x1fd2e) among the disp-32 hits for
0x1fd2e -- both known, so if either is missing the scan form is wrong.
"""
import traceback
try:
MODEL_VT = 0x18021c2a0
slots = {
0x270: "IS_TRADING_ENABLED",
0x280: "IS_STORE_ENABLED",
0x2b0: "IS_FRIENDLY_SEASON_ENABLED",
0x2b8: "IS_TOURNAMENT_QUIT_ENABLED",
0x2c0: "IS_PROCESSING_STATE_ENABLED",
0x2c8: "IS_DRAFT_MODE_ENABLED",
0x2d8: "IS_STORY_MODE_REWARD_ENABLED",
0x2f0: "IS_RETURNING_USER_REWARDS_SCREEN_ENABLED",
}
print("=" * 70)
print("SLOT -> accessor -> displacement (model offset)")
print("=" * 70)
disp_by_name = {}
for slot in sorted(slots):
tgt = qword(MODEL_VT + slot)
stub = read_bytes(tgt, 8)
disp = None
# 0f b6 81 <disp32> c3 -> movzx eax, byte [rcx+disp32] ; ret
if stub[0:3] == b"\x0f\xb6\x81" and stub[7] == 0xc3:
disp = int.from_bytes(stub[3:7], "little")
# 8b 81 <disp32> c3 -> mov eax, [rcx+disp32] ; ret (int getter, 4-byte)
elif stub[0:2] == b"\x8b\x81" and stub[6] == 0xc3:
disp = int.from_bytes(stub[2:6], "little")
name = slots[slot]
disp_by_name[name] = disp
print("slot +%#05x %-42s -> %#011x stub=%s disp=%s"
% (slot, name, tgt, stub.hex(),
("%#x" % disp) if disp is not None else "??"))
print()
print("=" * 70)
print("READERS: .text hits for each displacement (raw disp32 LE, form-agnostic)")
print("catches movzx/mov/cmp/lea/setcc in every encoding")
print("=" * 70)
for name, disp in disp_by_name.items():
if disp is None:
continue
pat = disp.to_bytes(4, "little")
hits = find_all(pat, blocks=(".text",))
print("\n%-42s disp %#x (%d hit(s))" % (name, disp, len(hits)))
for h in hits:
f = fm.getFunctionContaining(addr(h))
fn = f.getName() if f else "?"
ent = int(f.getEntryPoint().getOffset()) if f else 0
ins = listing.getInstructionAt(addr(h - 3)) or listing.getInstructionAt(addr(h - 2)) or listing.getInstructionAt(addr(h))
print(" %#011x in %-16s (%#x) ins~ %s"
% (h, fn, ent, str(ins) if ins else "?"))
print()
print("=" * 70)
print("READERS via vtable slot call: .text scan for call [reg+slot] (ff /2 disp32)")
print("=" * 70)
# FF /2 with mod=10 (disp32): modrm 0x90..0x97 (rax..rdi), 0x94 needs SIB
call_modrm = [0x90, 0x91, 0x92, 0x93, 0x95, 0x96, 0x97]
for slot in sorted(slots):
pat_disp = slot.to_bytes(4, "little")
found = []
for mrm in call_modrm:
pat = bytes([0xff, mrm]) + pat_disp
for h in find_all(pat, blocks=(".text",)):
f = fm.getFunctionContaining(addr(h))
found.append((h, f.getName() if f else "?",
int(f.getEntryPoint().getOffset()) if f else 0))
# also REX.W/B variants (41 ff /2, 48/49 not valid for call reg-indirect but include 41)
for rex in (0x41,):
for mrm in [0x90, 0x91, 0x92, 0x93, 0x95, 0x96, 0x97]:
pat = bytes([rex, 0xff, mrm]) + pat_disp
for h in find_all(pat, blocks=(".text",)):
f = fm.getFunctionContaining(addr(h))
found.append((h, f.getName() if f else "?",
int(f.getEntryPoint().getOffset()) if f else 0))
print("\nslot +%#05x %-42s (%d call-site(s))" % (slot, slots[slot], len(found)))
for h, fn, ent in found:
print(" %#011x in %-16s (%#x)" % (h, fn, ent))
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_gates_3.py
+58
View File
@@ -0,0 +1,58 @@
"""DIMENSION 2 Q3/Q4: readers for the refusing modes + SBC/Objectives bytes.
HYPOTHESIS: for season/draft/tournament the gate byte is read only to be
republished to the script layer (publisher) or to gate an unrelated sub-panel, not
to open the mode from a server response. SBC/Objectives have settings fields
(0x1fd2c/0x1fd42/0x1fd28, 0x1fd44) but NO IS_* publisher name; find their readers.
CONTROL: the applier FUN_18011dc50 must contain `mov [rdi+0x1fd3a],al` (season)
preceded by a `cmp [reg+FIELD],1 / sete al`, giving the season struct field index;
we already know trading is field +0x28 -> byte 0x1fd2e, so that pairing in the same
decompile validates the field-index reading.
"""
import traceback
try:
print("=" * 70)
print("APPLIER FUN_18011dc50 (field -> byte, full)")
print("=" * 70)
d = dec(0x18011dc50)
print("len:", len(d))
print(d)
# readers to inspect: season 0x2b0 candidates (non-publisher), draft hub builder
for label, fa in [
("SEASON reader FUN_1800b0e20 (slot 0x2b0)", 0x1800b0e20),
("SEASON reader FUN_18011e3c0 (slot 0x2b0)", 0x18011e3c0),
("DRAFT hub-tile builder FUN_1800b2680 (slot 0x2c8)", 0x1800b2680),
]:
print("=" * 70)
print(label)
print("=" * 70)
d = dec(fa)
print("len:", len(d))
print(d[:6000])
print("=" * 70)
print("SBC / OBJECTIVES byte disp-scans (.text, form-agnostic)")
print("=" * 70)
for name, disp in [
("allowUntradeableForSquadBuildingSets", 0x1fd2c),
("squadBuildingSetsGracePeriodMinutes", 0x1fd28),
("allowGracePeriodForSquadBuildingSets", 0x1fd42),
("enableObjectives", 0x1fd44),
("packOpeningAnimationEnabled", 0x1fd45),
]:
pat = disp.to_bytes(4, "little")
hits = find_all(pat, blocks=(".text",))
print("\n%-40s disp %#x (%d hit(s))" % (name, disp, len(hits)))
for h in hits:
f = fm.getFunctionContaining(addr(h))
fn = f.getName() if f else "?"
ent = int(f.getEntryPoint().getOffset()) if f else 0
ins = (listing.getInstructionAt(addr(h - 3)) or
listing.getInstructionAt(addr(h - 2)) or
listing.getInstructionAt(addr(h)))
print(" %#011x in %-16s (%#x) ins~ %s"
% (h, fn, ent, str(ins) if ins else "?"))
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_gates_4.py
+77
View File
@@ -0,0 +1,77 @@
"""DIMENSION 2 Q3/Q4 finish: draft-tile gating in FUN_1800b2680; SBC/Objectives
accessor slots and whether any native code reads them.
HYPOTHESIS: IS_DRAFT_MODE_ENABLED (cVar7) gates whether the draft hub tile is drawn
/ enabled. SBC(0x1fd2c,0x1fd42) and Objectives(0x1fd44) have accessor stubs at some
model vtable slots but NO IS_* publisher name; either a vtable-slot caller reads
them or they are consumed only by their own accessor (i.e. no native mode gate).
CONTROL: draft accessor is model slot 0x2c8 (proven). Walking the vtable and
matching disp must reproduce 0x2c8->0x1fd3d and 0x270->0x1fd2e.
"""
import traceback
try:
MODEL_VT = 0x18021c2a0
# find slots for the SBC/objectives displacements by walking vtable
want = {0x1fd2c: "allowUntradeableForSBC", 0x1fd42: "allowGracePeriodForSBC",
0x1fd44: "enableObjectives", 0x1fd28: "sbcGracePeriodMinutes",
0x1fd3e: "offlineDraft(0x2d0?)", 0x1fd2e: "trading(ctl)",
0x1fd3d: "draft(ctl)"}
slot_for_disp = {}
print("=" * 70)
print("vtable walk: slot -> accessor disp (0x200..0x340)")
print("=" * 70)
for slot in range(0x200, 0x340, 8):
tgt = qword(MODEL_VT + slot)
if not (0x180000000 <= tgt < 0x181000000):
continue
stub = read_bytes(tgt, 8)
disp = None
if stub[0:3] == b"\x0f\xb6\x81" and stub[7] == 0xc3:
disp = int.from_bytes(stub[3:7], "little")
elif stub[0:2] == b"\x8b\x81" and stub[6] == 0xc3:
disp = int.from_bytes(stub[2:6], "little")
if disp in want:
slot_for_disp[disp] = slot
print("slot +%#05x -> %#011x disp %#x %s"
% (slot, tgt, disp, want[disp]))
# scan slot-callers for the objectives + SBC slots
print()
print("=" * 70)
print("slot-call readers for SBC/Objectives accessor slots")
print("=" * 70)
call_modrm = [0x90, 0x91, 0x92, 0x93, 0x95, 0x96, 0x97]
for disp in (0x1fd44, 0x1fd2c, 0x1fd42):
slot = slot_for_disp.get(disp)
if slot is None:
print("\ndisp %#x: no vtable slot found in range" % disp)
continue
pat_disp = slot.to_bytes(4, "little")
found = []
for pre in ([], [0x41]):
for mrm in call_modrm:
pat = bytes(pre + [0xff, mrm]) + pat_disp
for h in find_all(pat, blocks=(".text",)):
f = fm.getFunctionContaining(addr(h))
found.append((h, f.getName() if f else "?",
int(f.getEntryPoint().getOffset()) if f else 0))
print("\ndisp %#x slot +%#05x %-24s (%d call-site(s))"
% (disp, slot, want[disp], len(found)))
for h, fn, ent in found:
print(" %#011x in %-16s (%#x)" % (h, fn, ent))
# rest of the draft hub-tile builder: how cVar7/8/9 gate the tile
print()
print("=" * 70)
print("FUN_1800b2680 draft/tile gating region (search cVar / DRAFT in decompile)")
print("=" * 70)
d = dec(0x1800b2680)
lines = d.splitlines()
for i, ln in enumerate(lines):
if any(k in ln for k in ("cVar7", "cVar8", "cVar9", "DRAFT", "0x70", "0x60",
"DESTINATION", "GOTO_", "SBC", "OBJECTIVE", "case 0xc",
"caseD_")):
print("%4d: %s" % (i, ln.strip()))
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_gates_5.py
+16
View File
@@ -0,0 +1,16 @@
"""DIMENSION 2 Q2 finish: settings deser FUN_18013c6d0 atom -> struct field.
HYPOTHESIS: the deser matches each settings atom and stores into param_2[i], the
same struct the applier reads. Extract atom -> field index so each gate byte maps
to a concrete /settings flag atom.
CONTROL: trading must be atom 0x336 -> field index 10 (0x28), already proven in the
transfer-market doc. If that pair appears, the atom->field reading is right.
"""
import traceback
try:
d = dec(0x18013c6d0)
print("len:", len(d))
print(d)
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_sbc_1.py
+47
View File
@@ -0,0 +1,47 @@
"""DIMENSION 5 SBC/Objectives.
HYPOTHESIS Q1: enableSquadBuildingSetsFeature (atom 0x100) is READ as an input that
gates the SBC menu -- OR it is an OUTPUT name only ever emitted (like IS_TRADING_ENABLED
turned out to be). Decide by string xrefs: if the only lea to the literal is inside a
publisher (contiguous .rdata name run, straight-line stores), it is output-only.
CONTROL: enableObjectives -- known to have a settings-switch arm (CLEAR-only). Its
literal should be referenced somewhere that is NOT a publisher. And IS_TRADING_ENABLED
literal -> should resolve to the publisher FUN_18006cc60 (proven output name), the
NEGATIVE control for "publisher == output-only".
Q2: SBC set-list deser 0x180154990 + FUT/SBC_USE_STUBS string. What gates stub SBCs.
"""
import traceback
try:
def show_str_xrefs(label, needle):
print("\n=== %s : %r ===" % (label, needle))
hits = find_all(needle)
print(" string occurrences:", [hex(h) for h in hits])
for h in hits:
print(" literal @%#x = %r" % (h, rd_str(h, 60)))
# references land on the string addr itself for lea r8,[rip+..]
for a in (h, h - 4):
xs = xrefs_to(a)
if xs:
print(" xrefs_to(%#x):" % a)
for frm, typ, fn, ent in xs:
print(" from %#x %s in %s (%#x)" % (frm, typ, fn, ent))
show_str_xrefs("SBC feature flag", b"enableSquadBuildingSetsFeature\x00")
show_str_xrefs("Objectives flag (control)", b"enableObjectives\x00")
show_str_xrefs("Objectives-as-mgr flag", b"enableObjectivesAsManagerTasks\x00")
show_str_xrefs("IS_TRADING_ENABLED (output-name neg control)", b"IS_TRADING_ENABLED\x00")
# SBC_USE_STUBS -- brief says deser 0x180154990 checks FUT/SBC_USE_STUBS
for n in (b"SBC_USE_STUBS", b"USE_STUBS", b"FUT/SBC"):
print("\n=== search %r ===" % n)
for h in find_all(n):
print(" @%#x = %r" % (h, rd_str(h - 8, 80)))
print("\n=== dec 0x180154990 (SBC set-list deser per brief) ===")
d = dec(0x180154990)
print("LEN", len(d))
print(d)
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_sbc_2.py
+39
View File
@@ -0,0 +1,39 @@
"""DIMENSION 5 SBC/Objectives -- query 2.
Q1 established so far: enableSquadBuildingSetsFeature literal @0x180230eb8 has EXACTLY
ONE xref, a DATA ref from 0x1802d2f60. Test that 0x1802d2f60 is the atom-dictionary
slot for atom 0x100 (dict base 0x1802d2760 + 0x100*8 = 0x1802d2f60). If so, the flag
is a PURE dictionary entry: never read as a named input, never emitted -- so CardsDLL
does not gate SBC on it, and a Blaze-config delivery of it can only reach the packed
script layer, never CardsDLL.
Also:
- callers of 0x180154990 (the SBC stub loader) -> where the SBC menu/data path enters.
- FUN_180007c30/FUN_180007c40 -> is 'FUT/SBC_USE_STUBS' a client tunable (not server)?
- publisher FUN_18006cc60 full body -> is there ANY SBC/objectives enable name emitted?
- scan for any published string mentioning SBC / SQUAD_BUILD / CHALLENGE enable.
"""
import traceback
try:
dictbase = 0x1802d2760
for atom in (0x100, 0xfd, 0xfe):
slot = dictbase + atom * 8
ptr = qword(slot)
print("atom %#x -> dict slot %#x -> ptr %#x = %r"
% (atom, slot, ptr, rd_str(ptr, 50) if 0x180000000 <= ptr < 0x181000000 else "?"))
print("\n=== callers of 0x180154990 (SBC stub loader) ===")
for ent, nm in callers(0x180154990):
print(" %#x %s" % (ent, nm))
print("\n=== FUN_180007c30 (config store getter?) ===")
print(dec(0x180007c30)[:1500])
print("\n=== FUN_180007c40 (named-config lookup?) ===")
print(dec(0x180007c40)[:2500])
print("\n=== publisher FUN_18006cc60 full ===")
d = dec(0x18006cc60)
print("LEN", len(d))
print(d)
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_sbc_3.py
+41
View File
@@ -0,0 +1,41 @@
"""DIMENSION 5 SBC/Objectives -- query 3.
Find the SBC MENU gate. Established: no SBC gate byte in publisher; enableSquadBuilding
SetsFeature not read by CardsDLL. So is there ANY CardsDLL SBC gate/publish, or is it
script-layer?
- xrefs_to(0x180154990): how is the SBC stub loader dispatched (vtable slot?).
- broad string scan for SBC/squad-building surface + any xref that is a publisher emit
(lea in .text) vs pure dictionary (DATA in .data dict region 0x1802d2xxx).
- hub tile builder FUN_1800b2680: does it feature-gate SBC?
- squadBuildingSetsClientData atom 0x2cf: is there a massinfo parser arm? what does it set?
"""
import traceback
try:
print("=== xrefs_to(0x180154990) ===")
for frm, typ, fn, ent in xrefs_to(0x180154990):
print(" from %#x %s in %s (%#x)" % (frm, typ, fn, ent))
print("\n=== string surface: SBC / squad-building / challenge feature ===")
for n in (b"IS_SBC", b"SBC_ENABLED", b"SQUAD_BUILD", b"SquadBuildingSets",
b"squadBuildingSets", b"FUT_SBC", b"futsquadbuildingchallenge",
b"SquadBuildingChallenge", b"MANAGER_TASKS", b"IS_OBJECTIVE",
b"OBJECTIVES_ENABLED", b"managerquest", b"ManagerQuest"):
hits = find_all(n)
if not hits:
continue
for h in hits:
xs = xrefs_to(h)
# classify each xref: DATA in dict region vs code lea
tags = []
for frm, typ, fn, ent in xs:
where = "DICT" if 0x1802d2000 <= frm < 0x1802d4000 else ("CODE:%s(%#x)@%#x" % (fn, ent, frm))
tags.append("%s/%s" % (typ, where))
print(" %r @%#x xrefs=%s" % (rd_str(h, 48), h, tags or "NONE"))
print("\n=== hub tile builder FUN_1800b2680 (SBC feature gate?) ===")
d = dec(0x1800b2680)
print("LEN", len(d))
print(d[:6000])
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_sbc_4.py
+38
View File
@@ -0,0 +1,38 @@
"""DIMENSION 5 SBC/Objectives -- query 4.
- classify 0x180154990's 3 data xrefs (0x1802fceb8 vtable? 0x180277430 dispatch?
0x180226fc8 factory/name?). Read the .rdata name near 0x180226fc8 and the qwords
around each site.
- full 0x180154990: what does FUT/SBC_USE_STUBS==1 actually build? (print full)
- grep the hub tile builder text for SBC/CHALLENGE/SET/GOTO_ destinations + switch arms.
- check for a CompetitionManager-style SBC singleton or count writer.
"""
import traceback
try:
def ctx_qwords(a, before=4, after=6):
print(" qwords around %#x:" % a)
for i in range(-before, after):
p = a + i*8
v = qword(p)
nm = fname(v) if 0x180000000 <= v < 0x181000000 else ""
s = ""
if 0x180000000 <= v < 0x181000000:
st = rd_str(v, 40)
if st.isprintable() and len(st) > 2:
s = repr(st)
print(" [%#x] = %#x %s %s" % (p, v, nm, s))
for site in (0x1802fceb8, 0x180277430, 0x180226fc8):
print("\n=== xref site %#x ===" % site)
# what block
b = None
for blk in mem.getBlocks():
if blk.getStart().getOffset() <= site <= blk.getEnd().getOffset():
b = blk.getName()
print(" block:", b)
ctx_qwords(site)
print("\n=== full FUN_180154990 ===")
print(dec(0x180154990))
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_sbc_5.py
+37
View File
@@ -0,0 +1,37 @@
"""DIMENSION 5 -- query 5. Does CardsDLL have an SBC/objectives HUB TILE case or a
feature gate for them? Grep the full hub tile builder + look for GOTO_/DESTINATION
strings mentioning SBC/challenge/manager-task, and any 'enableSquadBuildingSets'-style
gate. Also enumerate the dispatch table around 0x180226fc0 (what handler group it is).
"""
import traceback
try:
d = dec(0x1800b2680)
import re
print("=== hub builder: lines mentioning SBC/CHALLENGE/TASK/GOTO_/DESTINATION/SQUAD_BUILD ===")
for ln in d.splitlines():
if re.search(r"SBC|CHALLENGE|MANAGER_TASK|MANAGERTASK|GOTO_|DESTINATION|SQUAD_BUILD|OBJECTIVE|QUEST", ln, re.I):
print(" " + ln.strip()[:140])
print("\n=== all quoted string literals in hub builder (tile destinations) ===")
seen = set()
for m in re.findall(r'"([^"]{2,60})"', d):
if m not in seen:
seen.add(m)
print(" ", m)
print("\n=== dispatch table @0x180226fc0 (handler group containing 0x180154990) ===")
for i in range(-6, 16):
p = 0x180226fc0 + i*8
v = qword(p)
nm = fname(v) if 0x180000000 <= v < 0x181000000 else ""
print(" [%#x] %#x %s" % (p, v, nm))
print("\n=== xrefs_to dispatch table base region (who indexes 0x180226fc0) ===")
for base in (0x180226fc0, 0x180226fb0, 0x180226fb8):
xs = xrefs_to(base)
if xs:
print(" refs to %#x:" % base)
for frm, typ, fn, ent in xs:
print(" %#x %s in %s(%#x)" % (frm, typ, fn, ent))
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_sbc_6.py
+42
View File
@@ -0,0 +1,42 @@
"""DIMENSION 5 -- query 6. The hub tile builder DOES compute enabled/disabled tile
destinations (GOTO_DRAFT_DISABLED, GOTO_MANAGER_QUEST_DISABLED). Find the SBC and
MANAGER-QUEST tile cases and the exact gate condition, and whether an ENABLED variant
destination exists (GOTO_MANAGER_QUEST / GOTO_SBC / GOTO_SQUAD_BUILDING...).
Map the gate-byte accessor vtable slots read at the top of FUN_1800b2680 to model
displacements (slot 0x2c8/0x2d0/0x320) by reading each stub's disp32.
"""
import traceback
try:
print("=== search enabled/disabled destination strings across binary ===")
for n in (b"GOTO_MANAGER_QUEST", b"GOTO_SBC", b"GOTO_SQUAD_BUILDING",
b"GOTO_SQUAD_BUILDING_SETS", b"MANAGER_QUEST", b"SQUAD_BUILDING_SETS",
b"GOTO_DRAFT"):
for h in find_all(n):
print(" %#x %r" % (h, rd_str(h, 60)))
# map model vtable slots to disp: read accessor stub bytes 0f b6 81 <disp32> c3
print("\n=== model gate-byte accessor slots (DAT_1802e6398 vtable static 0x18021c2a0) ===")
vtbase = 0x18021c2a0
for slot in (0x2c8, 0x2d0, 0x320, 0x2b0, 0x270, 0x2e0):
tgt = qword(vtbase + slot)
b = read_bytes(tgt, 8)
disp = None
if b[0:3] == bytes.fromhex("0fb681"):
disp = int.from_bytes(b[3:7], "little")
print(" slot +%#x -> %#x bytes=%s disp=%s"
% (slot, tgt, b.hex(), hex(disp) if disp is not None else "?"))
# Now dump the hub builder and print the SBC + manager-quest tile blocks with context
d = dec(0x1800b2680)
lines = d.splitlines()
print("\n=== hub builder around SBC tile image + 0x110 + 0x230 manager quest ===")
for i, ln in enumerate(lines):
if ("GameHub_SBS" in ln or "MANAGER_QUEST" in ln or "0x230" in ln
or "0x110" in ln or "DREAMSQUAD" in ln):
lo = max(0, i-14); hi = min(len(lines), i+4)
print(" --- ctx @line %d ---" % i)
for j in range(lo, hi):
print(" " + lines[j].strip()[:150])
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_sbc_7.py
+54
View File
@@ -0,0 +1,54 @@
"""DIMENSION 5 -- query 7. Nail the verdicts.
A) OBJECTIVES gate: cVar9 = model slot 0x320 = accessor FUN_18011c570 = disp 0x1fd44,
used to pick GOTO_MANAGER_QUEST vs GOTO_MANAGER_QUEST_DISABLED. Confirm the ONLY
consumers of that accessor (and of the draft accessors 0x2c8/0x2d0) so we can say
which gate byte drives which tile. CONTROL: trading accessor 0x270 (disp 0x1fd2e)
should be consumed by the TO_TRADE_PILE predicate, not the hub builder.
B) settings arm for enableObjectives (atom 0xfd=253) in the applier chain: is it
CLEAR-only? Decompile the settings deser 0x18013c6d0 and grep its arms near 0xfd/0xfe.
C) SBC: is there ANY CardsDLL reader of the SBC-config gate bytes as a MENU gate?
accessor stubs for disp 0x1fd2c/0x1fd28/0x1fd42 (SBC settings) -> their callers.
"""
import traceback
try:
def callers_of(a, tag):
print("\n=== callers of %#x (%s) ===" % (a, tag))
cs = callers(a)
if not cs:
print(" (none via getCallingFunctions)")
for ent, nm in cs:
print(" %#x %s" % (ent, nm))
callers_of(0x18011c570, "objectives accessor disp 0x1fd44 / slot 0x320")
callers_of(0x18011c4b0, "draft accessor disp 0x1fd3d / slot 0x2c8")
callers_of(0x18011c580, "offline-draft accessor disp 0x1fd3e / slot 0x2d0")
callers_of(0x18011c670, "trading accessor disp 0x1fd2e / slot 0x270 (CONTROL)")
# find accessor stubs for SBC settings disps by scanning .text for 0f b6 81 <disp>
print("\n=== find accessor stubs for SBC-config disps 0x1fd2c/0x1fd28/0x1fd42 ===")
for disp in (0x1fd2c, 0x1fd28, 0x1fd42):
pat = bytes.fromhex("0fb681") + disp.to_bytes(4, "little")
for h in find_all(pat, blocks=(".text",)):
f = func(h)
ent = int(f.getEntryPoint().getOffset()) if f else 0
print(" disp %#x stub @%#x in %#x" % (disp, h, ent))
if ent:
for cent, cnm in callers(ent):
print(" <- %#x %s" % (cent, cnm))
print("\n=== settings deser 0x18013c6d0 : arms near enableObjectives 0xfd/0xfe ===")
d = dec(0x18013c6d0)
print("LEN", len(d))
import re
lines = d.splitlines()
for i, ln in enumerate(lines):
if re.search(r"0xfd\b|0xfe\b|== 0xfd|253|254|0x70\)|\+ 0x70|field.*0x1c", ln):
lo=max(0,i-3); hi=min(len(lines),i+5)
print(" --- @%d ---" % i)
for j in range(lo,hi):
print(" "+lines[j].strip()[:140])
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_sbc_8.py
+19
View File
@@ -0,0 +1,19 @@
"""DIMENSION 5 -- query 8. Dump the DAT_1802e0f04 case 1 (SBC/SBS tile) and case 2
regions of FUN_1800b2680 in full, to confirm the SBS tile (GameHub_SBS.png) receives
only FG_PATH from CardsDLL and no DESTINATION / no SBC-specific enable gate.
Print raw line numbers so the case boundaries are unambiguous.
"""
import traceback
try:
d = dec(0x1800b2680)
lines = d.splitlines()
# find the SBS image line and print a wide window
for i, ln in enumerate(lines):
if "GameHub_SBS" in ln:
lo = max(0, i-30); hi = min(len(lines), i+60)
print("=== window %d..%d around GameHub_SBS ===" % (lo, hi))
for j in range(lo, hi):
print("%4d %s" % (j, lines[j].rstrip()[:150]))
break
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_seasons_1.py
+54
View File
@@ -0,0 +1,54 @@
"""DIMENSION 3 SEASONS q1.
HYPOTHESIS: the Seasons refusal is decided in the front-end SCRIPT layer, not in
CardsDLL. If so, the CardsDLL season loaders make no network call, only read a
u16 count, and the CompetitionManager mode setters have ZERO in-DLL callers
(driven from outside). Prove or refute by enumerating callers of the mode setters,
decompiling the loader chain, and tracing the NOSEASONS event.
CONTROL: for the "zero callers" claim, a control with KNOWN callers must be in the
same batch -- I use FUN_180057560 (LoadOfflineSeasons) itself, which per prior work
is reached from the RPC dispatch, so callers() must be NON-empty for it if the
mechanism is sound; if callers() returns [] for a function I know is called, the
query form is broken and no absence claim is valid.
"""
import traceback
try:
targets = {
"FUN_180101680 (CompMgr mode set A)": 0x180101680,
"FUN_1801016c0 (CompMgr mode set B)": 0x1801016c0,
"FUN_180057560 LoadOfflineSeasons": 0x180057560,
"FUN_1800576b0 LoadSeasons": 0x1800576b0,
"FUN_180057230 LoadCurrentOfflineSeason": 0x180057230,
"FUN_180057330 (NOSEASONS fire?)": 0x180057330,
}
for name, a in targets.items():
print("=" * 70)
print(name, hex(a))
try:
cs = callers(a)
except Exception as e:
cs = "ERR %r" % e
print(" callers:", cs)
# NOSEASONS literal
print("=" * 70)
print("NOSEASONS literal search")
for lit in (b"NOSEASONS\x00", b"NOSEASONS"):
hits = find_all(lit)
print(" ", lit, "->", [hex(h) for h in hits])
# xrefs to the reported literal addr
print(" xrefs to 0x1801f92c0:")
for x in xrefs_to(0x1801f92c0):
print(" ", hex(x[0]), x[1], x[2], hex(x[3]))
# CompetitionManager singleton
print("=" * 70)
print("DAT_1802e6328 (CompetitionManager singleton) xrefs:")
for x in xrefs_to(0x1802e6328):
print(" ", hex(x[0]), x[1], x[2], hex(x[3]))
sys.stdout.flush()
os._exit(0)
except Exception:
traceback.print_exc()
sys.stdout.flush()
os._exit(0)
fifa17-recon/tools/ghidra_queries/q_md_seasons_2.py
+42
View File
@@ -0,0 +1,42 @@
"""DIMENSION 3 SEASONS q2.
HYPOTHESIS: the season loaders / CompMgr mode setters are dispatched via a table
(RPC descriptor or vtable) rather than direct CALL, so callers()==[] is a
search-form artifact, NOT proof of script-layer. Also: the actual refusal is
count==0 -> fire NOSEASONS in FUN_180057330; establish where the count is read
and whether a server response could write it.
CONTROL: search for a KNOWN table-member function address as an 8-byte LE pointer
to prove find_all-pointer form works: I use FUN_180057560 vs a control that I
expect to appear in .data (the RPC descriptor). If NEITHER the target nor any
control pointer is found, the pointer-search form is broken.
"""
import traceback, struct
try:
def ptr_hits(a):
le = struct.pack("<Q", a)
return find_all(le, blocks=(".rdata", ".data", ".pdata"))
for name, a in [
("FUN_180101680 modeA", 0x180101680),
("FUN_1801016c0 modeB", 0x1801016c0),
("FUN_180057560 LoadOfflineSeasons", 0x180057560),
("FUN_1800576b0 LoadSeasons", 0x1800576b0),
("FUN_180057230 LoadCurOfflineSeason", 0x180057230),
("FUN_180057330 NOSEASONS", 0x180057330),
]:
hits = ptr_hits(a)
print("PTRHITS", name, hex(a), "->", [hex(h) for h in hits])
print("\n############ DECOMPILE FUN_180057330 (NOSEASONS fire) ############")
d = dec(0x180057330)
print("LEN", len(d)); print(d)
print("\n############ DECOMPILE FUN_180057560 (LoadOfflineSeasons) ############")
d = dec(0x180057560)
print("LEN", len(d)); print(d)
sys.stdout.flush()
os._exit(0)
except Exception:
traceback.print_exc()
sys.stdout.flush()
os._exit(0)
fifa17-recon/tools/ghidra_queries/q_md_seasons_3.py
+45
View File
@@ -0,0 +1,45 @@
"""DIMENSION 3 SEASONS q3.
GOAL: find WHO WRITES the model season-list vector (this+0x5c68, exposed via
vtable +0x898) and the current-season short at this+0x7138+0x96/+0x98. If the ONLY
writer is the /season SeasonList deserializer, then a server response CAN populate
it (server-reachable). If nothing writes it, or only a script-driven loader does,
the gate is upstream of any server response.
Also: identify the 0x1801f8xxx table (script-command dispatch?) and dump the
descriptor rows around the season callbacks; and dump the vtable region 0x180219ac0.
CONTROL: for the deser store-target question, decompile 0x1801683f0 (SeasonList
deser) AND 0x180167740 (element parser) IN FULL (print len) and look for a store
into a model offset vs a local response object.
"""
import traceback, struct
try:
# what references the season callback table cluster 0x1801f8a38..0x1801f8ab8?
print("### xrefs into the 0x1801f8xxx season-callback cluster ###")
for a in (0x1801f8a38, 0x1801f8a50, 0x1801f8a58, 0x1801f8ab0, 0x1801f8ab8):
print(" cluster", hex(a), "bytes:", read_bytes(a-8, 24).hex())
for x in xrefs_to(a):
print(" xref", hex(x[0]), x[1], x[2], hex(x[3]))
# dump the callback table region as pointers to see the row structure
print("\n### dump 0x1801f8a30..0x1801f8ac0 as qwords ###")
for off in range(0x1801f8a30, 0x1801f8ac0, 8):
v = qword(off)
print(" ", hex(off), hex(v), fname(v) if 0x180000000 <= v < 0x181000000 else "")
print("\n### dump vtable region 0x180219aa0..0x180219af0 ###")
for off in range(0x180219aa0, 0x180219af0, 8):
v = qword(off)
print(" ", hex(off), hex(v), fname(v) if 0x180000000 <= v < 0x181000000 else "")
# SeasonList deserializer + element parser: where do they store?
print("\n############ DECOMPILE 0x1801683f0 (SeasonList deser) ############")
d = dec(0x1801683f0); print("LEN", len(d)); print(d)
print("\n############ DECOMPILE 0x180167740 (season element parser) ############")
d = dec(0x180167740); print("LEN", len(d)); print(d)
sys.stdout.flush()
os._exit(0)
except Exception:
traceback.print_exc()
sys.stdout.flush()
os._exit(0)
fifa17-recon/tools/ghidra_queries/q_md_seasons_4.py
+70
View File
@@ -0,0 +1,70 @@
"""DIMENSION 3 SEASONS q4.
ESTABLISHED: SeasonList deser 0x1801683f0 clears+repopulates the model season-list
vector (model vtable +0x898). FUN_180057330 reads that vector; empty -> NOSEASONS.
NOW: (a) confirm +0x898 getter returns this+0x5c68 and +0x588 getter -> this+0x7138;
(b) find WHO ISSUES the GET /season (SEASONLIST) RPC and its callers -- is the
request reachable, or is it never issued; (c) find every writer of the count short
at this+0x7138+0x96/+0x98 via a disp32 scan (form-independent).
CONTROL for disp32 scan: also scan for a KNOWN-written model offset (0x1fd2e, the
trading gate byte, known to have exactly one writer FUN_18011dc50) -> must find >=1
hit, else the scan form is broken.
"""
import traceback, struct
try:
MODEL_VT = 0x18021c2a0
print("### model vtable getters ###")
for slot in (0x588, 0x898, 0x850):
t = qword(MODEL_VT + slot)
print("slot +%#x -> %#x %s" % (slot, t, fname(t)))
print(dec(t)[:600])
print("-" * 40)
def disp32_scan(off, label, blocks=(".text",)):
le = struct.pack("<i", off)
hits = find_all(le, blocks=blocks)
print("DISP32", label, hex(off), "->", len(hits), "hits")
for h in hits:
f = fm.getFunctionContaining(addr(h))
print(" ", hex(h), f.getName() if f else "?")
return hits
print("\n### disp32 scans (form-independent) ###")
disp32_scan(0x1fd2e, "CONTROL trading gate byte")
disp32_scan(0x5c68, "season list vector base")
disp32_scan(0x7138, "season sub-struct base")
# the +0x96 / +0x98 short lives INSIDE the +0x7138 struct; its writers deref a
# pointer to that struct then +0x96. Hard to disp32-scan directly; instead show
# readers/writers of the +0x7138 getter result are the callers of slot +0x588.
# SEASONLIST RPC: descriptor row 69, stride 0x30, base 0x1802caa28
print("\n### RPC descriptor row 69 (SEASONLIST) ###")
base = 0x1802caa28
row = base + 69 * 0x30
print("row addr", hex(row), "bytes:", read_bytes(row, 0x30).hex())
# first qword often a name ptr, look for a char* to 'season'
for o in range(0, 0x30, 8):
v = qword(row + o)
s = ""
if 0x180000000 <= v < 0x181000000:
try:
s = rd_str(v, 40)
except Exception:
s = ""
print(" +%#x %#x %r" % (o, v, s))
# find the 'ut/%s/season' or 'season' URL template and its xref (the issuer)
print("\n### 'season' url template search ###")
for lit in (b"ut/%s/season\x00", b"/season\x00", b"season\x00"):
hits = find_all(lit, blocks=(".rdata",))
print(" ", lit, "->", [hex(h) for h in hits][:8])
for h in hits[:4]:
for x in xrefs_to(h):
print(" xref", hex(x[0]), x[2], hex(x[3]))
sys.stdout.flush()
os._exit(0)
except Exception:
traceback.print_exc()
sys.stdout.flush()
os._exit(0)
fifa17-recon/tools/ghidra_queries/q_md_seasons_5.py
+39
View File
@@ -0,0 +1,39 @@
"""DIMENSION 3 SEASONS q5.
Q: is the GET /season (SEASONLIST) request reachable, and from where? Descriptor
row 69 handler is FUN_180124710. Get its callers and decompile it. Also decompile
the +0x7138 struct writer FUN_18011c2e0 and FUN_18011a830-area accessor to locate
the writer of the count short at +0x7138+0x96/+0x98. And decompile the three vtable
getter stubs (0x18011c150/+0x588, 0x18011b8a0/+0x898) via dec() on the address.
CONTROL: callers() proven working in q1 (returned [] for table-dispatched fns and
non-[] is expected for a normally-called fn); FUN_18011dc50 is a known
table/virtual-dispatched writer, use its caller set shape as sanity.
"""
import traceback
try:
for name, a in [
("FUN_180124710 SEASONLIST handler", 0x180124710),
("FUN_18011c2e0 (+0x7138 accessor)", 0x18011c2e0),
]:
print("=" * 60, name, hex(a))
print("callers:", callers(a))
d = dec(a); print("LEN", len(d)); print(d)
print("=" * 60, "getter stub +0x588 @0x18011c150")
print(dec(0x18011c150))
print("=" * 60, "getter stub +0x898 @0x18011b8a0")
print(dec(0x18011b8a0))
print("=" * 60, "accessor @0x18011a822 area (fn 0x18011a830?)")
print("fname 0x18011a822 ->", fname(0x18011a822))
print(dec(0x18011a822)[:1200])
# who calls the SeasonList RESPONSE deser's install? find xrefs to 0x180124710
print("=" * 60, "xrefs_to FUN_180124710")
for x in xrefs_to(0x180124710):
print(" ", hex(x[0]), x[1], x[2], hex(x[3]))
sys.stdout.flush()
os._exit(0)
except Exception:
traceback.print_exc()
sys.stdout.flush()
os._exit(0)
fifa17-recon/tools/ghidra_queries/q_md_seasons_6.py
+59
View File
@@ -0,0 +1,59 @@
"""DIMENSION 3 SEASONS q6.
Decode the non-function targets by raw bytes; find who consumes the +0x898 season
vector getter; find who ISSUES the SEASONLIST RPC (xrefs to descriptor row and the
RPC dispatch); find the writer of the +0x7138+0x96/+0x98 count short.
"""
import traceback, struct
try:
def show(a, n, label):
b = read_bytes(a, n)
print(label, hex(a), b.hex())
print("### decode getter/handler stubs ###")
show(0x18011b8a0, 12, "+0x898 getter") # expect lea rax,[rcx+0x5c68];ret
show(0x18011c150, 12, "+0x588 getter") # expect lea rax,[rcx+0x7138];ret
show(0x180124710, 48, "SEASONLIST handler")
# instructions via listing for the handler
print("\n### listing FUN_180124710 (SEASONLIST handler) ###")
a = addr(0x180124710)
for _ in range(24):
ins = listing.getInstructionAt(a)
if ins is None:
print(" (no instr at", a, ")"); break
print(" ", a, ins)
a = ins.getAddress().add(ins.getLength())
# who references the +0x898 getter stub -> all season-vector consumers
print("\n### xrefs_to +0x898 getter stub 0x18011b8a0 ###")
for x in xrefs_to(0x18011b8a0):
print(" ", hex(x[0]), x[1], x[2], hex(x[3]))
# who references the SEASONLIST descriptor row and its neighbours (RPC issue)
print("\n### xrefs_to descriptor row region ###")
for row in (0x1802cb718, 0x1802cb720, 0x1802cb738):
print(" row", hex(row))
for x in xrefs_to(row):
print(" ", hex(x[0]), x[1], x[2], hex(x[3]))
# xref to the URL-base pointer 0x18021e0d0 (ut/%s/season) -> the URL builder
print("\n### xrefs_to url base ptr 0x18021e0d0 and template 0x18021e598 ###")
for a2 in (0x18021e0d0, 0x18021e598):
for x in xrefs_to(a2):
print(" ", hex(a2), "<-", hex(x[0]), x[1], x[2], hex(x[3]))
# +0x7138 struct: FUN_1801129f0 (reset?) and who calls FUN_18011c2e0
print("\n### FUN_1801129f0 (season struct op) callers + decomp head ###")
print("callers:", callers(0x1801129f0))
print(dec(0x1801129f0)[:900])
print("\n### xrefs_to FUN_18011c2e0 (writes +0x7138 area) ###")
for x in xrefs_to(0x18011c2e0):
print(" ", hex(x[0]), x[1], x[2], hex(x[3]))
sys.stdout.flush()
os._exit(0)
except Exception:
traceback.print_exc()
sys.stdout.flush()
os._exit(0)
fifa17-recon/tools/ghidra_queries/q_md_seasons_7.py
+50
View File
@@ -0,0 +1,50 @@
"""DIMENSION 3 SEASONS q7.
(a) Is the +0x7138 season-struct writer (model vtable slot +0x990 = FUN_18011c2e0)
reached from the massinfo/settings RESPONSE path (a boot server lever), like the
settings applier at +0x988? Find call sites of slot +0x990.
(b) Does userInfo.feature parser FUN_18013ec10 have a season-related restriction key?
List its atom compares.
(c) Confirm FUN_1801683f0 is the FutSeasonList RESPONSE deser (RS4 name -> vtable +8).
(d) Does the massinfo body deser (FUN_180174xxx region) or its completion touch the
season vector / +0x7138 (i.e. can boot populate seasons)?
CONTROL: for the RS4 resolution, also resolve a KNOWN class RS4:FutSquadSave ->
must give 0x180171a60 (per class_deser docstring) as a passing control.
"""
import traceback, struct
try:
# (a) find call sites of model vtable slot +0x990 (0x990 disp on a call through rax/rcx)
# The applier +0x988 was called from 0x180173f0b and 0x18011e21a. Search .text for
# the byte pattern of a call [reg+0x990]: ff 90 90 09 00 00 (call [rax+0x990]) and
# ff 91 90 09 00 00 (call [rcx+0x990]) and other regs.
print("### call [reg+0x990] sites (season struct writer) ###")
for modrm in (0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97):
pat = bytes([0xff, modrm]) + struct.pack("<i", 0x990)
for h in find_all(pat, blocks=(".text",)):
f = fm.getFunctionContaining(addr(h))
print(" +0x990 call", hex(h), "in", f.getName() if f else "?", "modrm", hex(modrm))
print("### control: call [reg+0x988] sites (settings applier) ###")
for modrm in (0x90, 0x91, 0x92, 0x93):
pat = bytes([0xff, modrm]) + struct.pack("<i", 0x988)
for h in find_all(pat, blocks=(".text",)):
f = fm.getFunctionContaining(addr(h))
print(" +0x988 call", hex(h), "in", f.getName() if f else "?")
# (b) feature parser atom compares
print("\n### FUN_18013ec10 (userInfo.feature parser) decompile ###")
d = dec(0x18013ec10); print("LEN", len(d)); print(d)
# (c) RS4:FutSeasonList resolution + control
print("\n### RS4 resolution ###")
for cls in (b"RS4:FutSeasonListServerResponse", b"RS4:FutSquadSaveServerResponse"):
for a in find_all(cls, blocks=(".rdata",)):
print(" class", cls, "@", hex(a))
for x in xrefs_to(a):
fn = x[2]
print(" factory xref", hex(x[0]), fn, hex(x[3]))
sys.stdout.flush()
os._exit(0)
except Exception:
traceback.print_exc()
sys.stdout.flush()
os._exit(0)
fifa17-recon/tools/ghidra_queries/q_md_seasons_8.py
+47
View File
@@ -0,0 +1,47 @@
"""DIMENSION 3 SEASONS q8 (final): confirm the SeasonList deser is the SOLE populator
of the season-list vector by enumerating every call [reg+0x898] site; confirm
FUN_180174630 is the massinfo body handler; resolve atom names for the season keys.
"""
import traceback, struct
try:
print("### all call [reg+0x898] sites (season-vector consumers) ###")
for modrm in range(0x90, 0x98):
pat = bytes([0xff, modrm]) + struct.pack("<i", 0x898)
for h in find_all(pat, blocks=(".text",)):
f = fm.getFunctionContaining(addr(h))
print(" ", hex(h), "in", f.getName() if f else "?")
print("\n### FUN_180174630 identity: does it parse the massinfo body? head ###")
d = dec(0x180174630)
print("LEN", len(d))
# print the first 1500 chars to see the member dispatch + userInfo/settings/season calls
print(d[:1800])
print("\n### resolve atom names via fut_atoms.tsv ###")
import os as _os
tsv = "/home/alex/Documents/OpenFUT/fifa17-recon/docs/fut_atoms.tsv"
want = {0x2ad,0x354,0x35e,0x24b,0x27b,0xdd,0xdc,0x253,0x1b8,0x330,0x11c,0x2d4}
try:
with open(tsv) as f:
for line in f:
parts = line.rstrip("\n").split("\t")
if len(parts) >= 2:
try:
v = int(parts[0], 0)
except ValueError:
try:
v = int(parts[1], 0)
except (ValueError, IndexError):
continue
parts = [parts[1], parts[0]] + parts[2:]
if v in want:
print(" ", hex(v), parts[1] if len(parts) > 1 else parts)
except Exception as e:
print(" tsv err", e)
sys.stdout.flush()
os._exit(0)
except Exception:
traceback.print_exc()
sys.stdout.flush()
os._exit(0)
fifa17-recon/tools/ghidra_queries/q_md_seasons_9.py
+23
View File
@@ -0,0 +1,23 @@
"""q9: do FUN_18006ac20 / FUN_180105c90 / FUN_180057b00 WRITE (push/clear) the season
vector, or only READ it? Confirms the SeasonList deser is the sole populator.
Signature of a writer: assigns plVar[1] (size) or calls a push/grow (FUN_180166e00 /
FUN_180050a00) after the +0x898 getter. A reader only iterates *plVar..plVar[1].
"""
import traceback
try:
for a in (0x18006ac20, 0x180105c90, 0x180057b00):
d = dec(a)
# find the region around the +0x898 call
i = d.find("0x898")
seg = d[max(0,i-200):i+500] if i >= 0 else d[:600]
writes = ("166e00" in d) or ("180050a00" in d) or ("0512f0" in d and "[1] = " in d)
print("=" * 60, hex(a), "LEN", len(d))
print(" push(166e00)?", "180166e00" in d, " copy(50a00)?", "180050a00" in d,
" clear(512f0)?", "1800512f0" in d)
print(seg)
sys.stdout.flush()
os._exit(0)
except Exception:
traceback.print_exc()
sys.stdout.flush()
os._exit(0)
fifa17-recon/tools/ghidra_queries/q_md_v1_A.py
+64
View File
@@ -0,0 +1,64 @@
"""ADVERSARIAL VERIFY Dimension 1: userInfo.feature restriction vocabulary.
Attacks:
D1.1 feature loop recognises EXACTLY one sub-key (trade 0x330), all else value-SKIP.
D1.2 trade uses INT getter FUN_1801c79d0, writes +0xa4 only when ==1.
D1.3 massinfo root FUN_180174630: at END_OBJECT the SOLE `cmp byte[reg+disp],0` site
is +0x17c -> zero [reg+0x50]; nothing else zeroes a settings field from a feature byte.
Control: 0x330 MUST appear in the feature loop and map to +0xa4 (param_1+0x29). If the
massinfo case that calls the feature parser is not +0xd8, the +0x17c arithmetic is wrong.
"""
import traceback
try:
FEAT = 0x18013ec10
MASS = 0x180174630
src = dec(FEAT, 300)
print("=== FEATURE FUN_18013ec10 decompile=%d chars ===" % len(src))
print(src)
# enumerate every integer constant compared in the loop (dispatch forms)
print("\n=== raw instructions in feature parser: CMP/immediates + calls ===")
f = func(FEAT)
it = listing.getInstructions(f.getBody(), True)
cnt = 0
while it.hasNext():
ins = it.next()
m = ins.getMnemonicString()
s = str(ins)
if m in ("CMP", "SUB", "LEA") and ("0x330" in s or "0x11c" in s):
print(" %#x %s" % (ins.getAddress().getOffset(), s))
if m == "CALL":
print(" %#x %s" % (ins.getAddress().getOffset(), s))
cnt += 1
print(" (total insns=%d)" % cnt)
print("\n=== MASSINFO root FUN_180174630: scan for cmp byte[reg+disp],0x0 ===")
fm2 = func(MASS)
it = listing.getInstructions(fm2.getBody(), True)
hits = []
n = 0
prev = []
while it.hasNext():
ins = it.next()
n += 1
m = ins.getMnemonicString()
s = str(ins)
# cmp byte ptr [reg + disp], 0
if m == "CMP" and "byte ptr" in s and s.rstrip().endswith(",0x0"):
hits.append((ins.getAddress().getOffset(), s))
# any MOV of 0 into [reg+0x50]
if m == "MOV" and "dword ptr" in s and "0x50]" in s and s.rstrip().endswith(",0x0"):
print(" ZERO-WRITE %#x %s" % (ins.getAddress().getOffset(), s))
print(" cmp byte[reg+disp],0 sites: %d" % len(hits))
for a, s in hits:
print(" %#x %s" % (a, s))
print(" (massinfo total insns=%d)" % n)
# confirm which case calls the feature parser and at what struct offset
print("\n=== calls to FUN_18013ec10 (feature) from anywhere ===")
for frm, typ, fn, ent in xrefs_to(FEAT):
print(" %#x %s in %s" % (frm, typ, fn))
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_v1_B.py
+38
View File
@@ -0,0 +1,38 @@
"""ADVERSARIAL VERIFY Dimension 2: gate-byte writers + readers.
Attacks (priority = claims that change what we send):
D2.6 Objectives deser cases 0xfd/0xfe are CLEAR-ONLY (value==0 => field=0, no set).
-> action "DO NOT send enableObjectives:0". If it also SETs, action is wrong.
D2.5 Draft: FUN_1800b2680 reads slot 0x2c8 (0x1fd3d) / 0x2d0 (0x1fd3e) and gates the
tile GOTO_DRAFT_*; the byte ACTUALLY gates (a cmp/test on the model slot result).
D2.3 Seasons: FUN_1800b2680 season tiles drawn UNCONDITIONALLY (no cVar gate).
D2.2 Applier FUN_18011dc50 writes byte = (field==1); one MOV per byte.
D2.1 Publisher FUN_18006cc60 IS_* names.
Control: draft slot 0x2c8 must decode to disp 0x1fd3d via the accessor stub; if not the
whole slot->disp table is unreliable.
"""
import traceback
try:
PUB = 0x18006cc60
DESER = 0x18013c6d0
APPLY = 0x18011dc50
HUB = 0x1800b2680
SEASONPANEL = 0x1800b0e20
print("=== PUBLISHER FUN_18006cc60 ===")
print(dec(PUB, 240))
print("\n=== APPLIER FUN_18011dc50 ===")
print(dec(APPLY, 240))
print("\n=== HUB-TILE BUILDER FUN_1800b2680 ===")
print(dec(HUB, 300))
# deser: only print the arms for the mode atoms we care about
print("\n=== DESER FUN_18013c6d0 (full) ===")
ds = dec(DESER, 300)
print("len=%d" % len(ds))
print(ds)
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_v2_adv1.py
+52
View File
@@ -0,0 +1,52 @@
"""ADVERSARIAL verify of Seasons Findings 2 & 4 + getter offsets.
HYPOTHESIS UNDER ATTACK:
F2: model+0x5c68 season vector written ONLY by FUN_1801683f0 (/season deser).
F4: SEASONLIST descriptor @0x1802cb718 and URL 'ut/%s/season' @0x18021e598 have no code xref.
Getters: vtable+0x898 -> lea rax,[rcx+0x5c68]; vtable+0x588 -> lea rax,[rcx+0x7138].
CONTROL: resolve a KNOWN getter/xref form the same way (disp32 immediate scan) and
confirm the scanner actually finds multi-hit patterns (not silently zero).
"""
import traceback
try:
MODEL_VT=0x18021c2a0
# 1. getter slots
for slot in (0x898,0x588,0x988,0x990):
t=qword(MODEL_VT+slot)
print("vtable +%#x -> %#x %s" % (slot,t,fname(t)))
print(" dec head:", " | ".join(dec(t).splitlines()[:6]))
# 2. disp32 immediate scan in .text for 0x5c68 (le 4-byte) and 0x7138
for off_name,val in (("0x5c68",0x5c68),("0x7138",0x7138),("0x1fd3a",0x1fd3a)):
pat=val.to_bytes(4,'little')
hits=find_all(pat, blocks=(".text",))
print("\ndisp32 scan .text for %s (%s): %d hits" % (off_name, pat.hex(), len(hits)))
for h in hits[:12]:
f=func(h); print(" @%#x in %s" % (h, f.getName() if f else '?'))
# 3. call sites of [reg+0x898] -- scan .text for the modrm/disp32 forms of call [r+0x898]
# common encodings: FF 90 98 08 00 00 (call [rax+0x898]); reg varies in modrm middle bits.
print("\n--- call [reg+0x898] sites (FF /2 disp32 = 98 08 00 00) ---")
disp=(0x898).to_bytes(4,'little')
for pat_desc,pat in [("call [rax+d]",b"\xff\x90"+disp),("call [rcx+d]",b"\xff\x91"+disp),
("call [rdx+d]",b"\xff\x92"+disp),("call [rbx+d]",b"\xff\x93"+disp),
("call [rsi+d]",b"\xff\x96"+disp),("call [rdi+d]",b"\xff\x97"+disp),
("call [r8+d]",b"\x41\xff\x90"+disp),("call [r9+d]",b"\x41\xff\x91"+disp),
("call [r10+d]",b"\x41\xff\x92"+disp),("call [r11+d]",b"\x41\xff\x93"+disp)]:
hits=find_all(pat, blocks=(".text",))
for h in hits:
f=func(h); print(" %s @%#x in %s" % (pat_desc,h,f.getName() if f else '?'))
# 4. Finding 4: descriptor + url xrefs
print("\n--- F4: SEASONLIST descriptor / url xrefs ---")
print("xrefs_to(0x1802cb718):", xrefs_to(0x1802cb718))
print("xrefs_to(0x18021e598) url ut/%s/season:", xrefs_to(0x18021e598))
print("string @0x18021e598:", repr(rd_str(0x18021e598)))
# SEASONLIST literal locate
sl=find_all(b"SEASONLIST\x00")
print("SEASONLIST literal at:", [hex(x) for x in sl])
for a in sl:
print(" xrefs_to(%#x):"%a, xrefs_to(a))
# url literal locate
us=find_all(b"ut/%s/season\x00")
print("'ut/%s/season' literal at:", [hex(x) for x in us])
for a in us:
print(" xrefs_to(%#x):"%a, xrefs_to(a))
except Exception:
traceback.print_exc()
fifa17-recon/tools/ghidra_queries/q_md_v3_1.py
+45
View File
@@ -0,0 +1,45 @@
"""Adversarial verify Dimension 4/5 decompile claims.
Hypothesis under attack:
(A) FUN_1800b2680 case 0xc reads slot+0x2c8 -> GOTO_DRAFT_ONLINE/DISABLED;
case 0xd reads slot+0x2d0 AND +0x2c8 -> GOTO_DRAFT_OFFLINE/DISABLED;
cases 5/0xe (tournament) set GOTO_* UNCONDITIONALLY;
objectives block reads slot 0x320 -> GOTO_MANAGER_QUEST(_DISABLED).
(B) settings deser FUN_18013c6d0: 0xf9->[0x17]; 0xfa&0xff->[0x18]; 0xfd&0xfe->[0x1c].
(C) applier FUN_18011dc50: +0x1fd3d=[0x17]==1; +0x1fd3e=[0x18]==1; +0x1fd44=[0x1c]==1.
(D) feature FUN_18013ec10 arm 0x11c recognizes ONLY atom 0x330.
Control: settings 0x336 tradingEnabled -> [10]; applier +0x1fd2e=[10]==1 (known good).
Method: print full decompile length + context around each token so absence claims
are from FULL text, not truncation.
"""
import traceback
def ctx(txt, needles, before=2, after=6):
lines=txt.splitlines()
hits=set()
for i,l in enumerate(lines):
for n in needles:
if n in l:
for j in range(max(0,i-before), min(len(lines),i+after+1)):
hits.add(j)
for j in sorted(hits):
print(" %4d: %s"%(j,lines[j]))
try:
for ea,name,needles in [
(0x1800b2680,"FUN_1800b2680 (hub tile builder)",
["GOTO_DRAFT","GOTO_MANAGER_QUEST","GOTO_OFFLINE_TOURNAMENT","GOTO_ONLINE_CHAMPIONS",
"GOTO_OFFLINE_SEASON","GOTO_ONLINE_SEASON","0x2c8","0x2d0","0x320","0x2b8",
"SBS","GameHub_SBS","0xd0)","GOTO_SBC","GOTO_SQUAD"]),
(0x18013c6d0,"FUN_18013c6d0 (settings deser)",
["0xf9","0xfa","0xff","0xfd","0xfe","0x336","0x17]","0x18]","0x1c]","[10]","param_2[10]"]),
(0x18011dc50,"FUN_18011dc50 (applier)",None),
(0x18013ec10,"FUN_18013ec10 (feature/massinfo)",
["0x11c","0x330","0x336"]),
]:
c=dec(ea)
print("="*70)
print("%s len=%d"%(name,len(c)))
if needles is None:
print(c)
else:
ctx(c,needles)
except Exception:
traceback.print_exc()