wip: checkpoint FIFA 17 SBC research for Windows migration

2026-08-07 12:03:22 -07:00
parent 3d3239bab9
commit cc694774a3
47 changed files with 9105 additions and 4 deletions
@@ -0,0 +1,42 @@
+"""DIMENSION 3 SEASONS q2.
+HYPOTHESIS: the season loaders / CompMgr mode setters are dispatched via a table
+(RPC descriptor or vtable) rather than direct CALL, so callers()==[] is a
+search-form artifact, NOT proof of script-layer. Also: the actual refusal is
+count==0 -> fire NOSEASONS in FUN_180057330; establish where the count is read
+and whether a server response could write it.
+CONTROL: search for a KNOWN table-member function address as an 8-byte LE pointer
+to prove find_all-pointer form works: I use FUN_180057560 vs a control that I
+expect to appear in .data (the RPC descriptor). If NEITHER the target nor any
+control pointer is found, the pointer-search form is broken.
+"""
+import traceback, struct
+try:
+    def ptr_hits(a):
+        le = struct.pack("<Q", a)
+        return find_all(le, blocks=(".rdata", ".data", ".pdata"))
+
+    for name, a in [
+        ("FUN_180101680 modeA", 0x180101680),
+        ("FUN_1801016c0 modeB", 0x1801016c0),
+        ("FUN_180057560 LoadOfflineSeasons", 0x180057560),
+        ("FUN_1800576b0 LoadSeasons", 0x1800576b0),
+        ("FUN_180057230 LoadCurOfflineSeason", 0x180057230),
+        ("FUN_180057330 NOSEASONS", 0x180057330),
+    ]:
+        hits = ptr_hits(a)
+        print("PTRHITS", name, hex(a), "->", [hex(h) for h in hits])
+
+    print("\n############ DECOMPILE FUN_180057330 (NOSEASONS fire) ############")
+    d = dec(0x180057330)
+    print("LEN", len(d)); print(d)
+
+    print("\n############ DECOMPILE FUN_180057560 (LoadOfflineSeasons) ############")
+    d = dec(0x180057560)
+    print("LEN", len(d)); print(d)
+
+    sys.stdout.flush()
+    os._exit(0)
+except Exception:
+    traceback.print_exc()
+    sys.stdout.flush()
+    os._exit(0)