wip: checkpoint FIFA 17 SBC research for Windows migration

2026-08-07 12:03:22 -07:00
parent 3d3239bab9
commit cc694774a3
47 changed files with 9105 additions and 4 deletions
@@ -0,0 +1,55 @@
+"""DIMENSION 1 Q1/Q4 airtight check: is trade (0x330) or feature (0x11c) dispatched
+ANYWHERE other than the userInfo deser FUN_18013ec10?
+
+If a second function compares against 0x330 or 0x11c, there could be another feature-style
+restriction map. Enumerate ALL comparison FORMS by scanning instruction operands for the
+immediates 0x330 and 0x11c across .text, and report the containing function of each.
+
+CONTROL: FUN_18013ec10 (0x18013ec10) MUST appear for both 0x330 and 0x11c (the known site).
+If it does not, the operand-immediate scan is broken and results are unreliable.
+"""
+import traceback
+
+TARGETS = {0x330: "trade", 0x11c: "feature"}
+KNOWN = 0x18013ec10
+
+try:
+    # scan every instruction in .text for a scalar operand equal to a target immediate
+    hits = {t: set() for t in TARGETS}
+    text = None
+    for b in mem.getBlocks():
+        if b.getName() == ".text" and b.isInitialized():
+            text = b
+            break
+    ins = listing.getInstructions(text.getStart(), True)
+    count = 0
+    while ins.hasNext():
+        i = ins.next()
+        count += 1
+        n = i.getNumOperands()
+        for op in range(n):
+            objs = i.getOpObjects(op)
+            for o in objs:
+                try:
+                    v = o.getValue() if hasattr(o, "getValue") else None
+                except Exception:
+                    v = None
+                if v is None:
+                    continue
+                v = int(v) & 0xFFFFFFFF
+                if v in TARGETS:
+                    f = fm.getFunctionContaining(i.getAddress())
+                    hits[v].add((f.getName() if f else "?",
+                                 int(f.getEntryPoint().getOffset()) if f else 0))
+    print("scanned %d .text instructions" % count)
+    for t, name in TARGETS.items():
+        print("\n=== immediate 0x%x (%s) appears in these functions ===" % (t, name))
+        got_known = False
+        for fn, ent in sorted(hits[t], key=lambda x: x[1]):
+            mark = "  <== KNOWN userInfo deser" if ent == KNOWN else ""
+            print("  %#x  %s%s" % (ent, fn, mark))
+            if ent == KNOWN:
+                got_known = True
+        print("  CONTROL FUN_18013ec10 present: %s" % got_known)
+except Exception:
+    traceback.print_exc()