wip: checkpoint FIFA 17 SBC research for Windows migration

fifa17-recon/tools/ghidra_queries/q_md_gates_1.py

@@ -0,0 +1,40 @@
+"""DIMENSION 2 Q1/Q2: the publisher, the applier, the settings deser, the ctor.
+
+HYPOTHESIS: FUN_18006cc60 publishes IS_* names by reading model vtable slots; the
+complete set is 10 names over a contiguous .rdata run 0x1801fc118..0x1801fc228.
+FUN_18011dc50 is the applier (byte = field==1). FUN_18013c6d0 is the settings deser
+that maps atoms -> struct fields. FUN_18014e320 is the settings-struct ctor.
+
+CONTROL: FUN_18006cc60 must reference IS_TRADING_ENABLED and call the vt+0x270
+accessor already proven (reads 0x1fd2e). If the decompile of the applier shows
+`cmp [reg+0x28],1 / sete / mov [rdi+0x1fd2e]` we have the known trading writer as a
+positive control that the field-index arithmetic is right.
+"""
+import traceback
+try:
+    PUB = 0x18006cc60
+    APP = 0x18011dc50
+    DESER = 0x18013c6d0
+    CTOR = 0x18014e320
+
+    print("=" * 70)
+    print("PUBLISHER FUN_18006cc60 (len / decompile)")
+    print("=" * 70)
+    d = dec(PUB)
+    print("len:", len(d))
+    print(d)
+
+    print("=" * 70)
+    print(".rdata name run 0x1801fc118..0x1801fc250 (contiguous IS_* names)")
+    print("=" * 70)
+    p = 0x1801fc118
+    end = 0x1801fc260
+    while p < end:
+        s = rd_str(p)
+        if s:
+            print("%#x  %r" % (p, s))
+            p += len(s) + 1
+        else:
+            p += 1
+except Exception:
+    traceback.print_exc()