docs+tools: measure the FIFA 17 market gate bytes in the live client

Adds trade_gate_probe.py (read-only: /proc/<pid>/mem O_RDONLY + pread, slide proven against the on-disk FNV prologue), extending gate_byte_probe.py to vtable slot +0x270 exactly as the transfer-market analysis asked for. Measured: IS_TRADING_ENABLED=1 (was 0 in the Python era), TRADE_PILE_SIZE=100 (was 0), watchListSize=50 (was 0), with four controls reading 1. So every CardsDLL-supplied input that analysis named as a market blocker is now OPEN, which the Rust host achieves by construction -- it emits userInfo.feature as {} so the kill switch at 0x180174f19 never arms, and it already sends pileSizeClientData keys 2 and 4. This narrows the Actions-panel question to the exe-side UI script term, and rules out ownership fields, the gate bytes, the cancel route and the state vocabularies as candidates -- each on measured or PE-derived evidence rather than inference.
2026-08-17 19:09:03 +00:00
parent 772f8a615a
commit dcbef721f2
2 changed files with 125 additions and 0 deletions
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""Read the FIFA 17 TRADING gate byte out of the live client. READ-ONLY.
+
+Extends tools/gate_byte_probe.py with vtable slot +0x270 (IS_TRADING_ENABLED,
+displacement 0x1fd2e) plus the two pile-size dwords, which the transfer-market
+analysis names as the market screen's CardsDLL-supplied inputs.
+
+Opens /proc/<pid>/mem O_RDONLY and preads. Nothing here can write.
+"""
+import os, struct
+
+pid = None
+for d in os.listdir('/proc'):
+    if d.isdigit():
+        try:
+            if open('/proc/%s/comm' % d).read().strip() == 'FIFA17.exe':
+                pid = int(d)
+                break
+        except Exception:
+            pass
+assert pid, "FIFA17.exe not running"
+
+base = None
+for ln in open('/proc/%d/maps' % pid):
+    if 'CardsDLL' in ln:
+        base = int(ln.split('-')[0], 16)
+assert base, "CardsDLL not mapped (client has not reached Ultimate Team)"
+slide = base - 0x180000000
+
+fd = os.open('/proc/%d/mem' % pid, os.O_RDONLY)
+
+
+def rd(va, n):
+    return os.pread(fd, n, va)
+
+
+# Control: the FNV atom-hash prologue must match the on-disk PE before any other
+# address is trusted.
+pe = open('/mnt/games/FIFA 17/CardsDLL_Win64_retail.dll', 'rb').read()
+
+
+def f(va):
+    return va - 0x180000000 - 0x1000 + 0x400
+
+
+ok = pe[f(0x180180d00):f(0x180180d00) + 32] == rd(0x180180d00 + slide, 32)
+print("pid=%d slide=%#x FNV control=%s" % (pid, slide, "MATCH" if ok else "MISMATCH"))
+assert ok, "slide not proven; refusing to read further"
+
+obj = struct.unpack('<Q', rd(0x1802e6398 + slide, 8))[0]
+vt = struct.unpack('<Q', rd(obj, 8))[0]
+print("model=%#x vtable(static)=%#x" % (obj, vt - slide))
+
+SLOTS = [
+    (0x270, 'IS_TRADING_ENABLED   '),
+    (0x2b0, 'IS_FRIENDLY_SEASON   '),
+    (0x2c8, 'IS_DRAFT_MODE        '),
+    (0x2e0, 'packOpeningAnimation '),
+]
+print("\n-- gate bytes decoded from their accessor stubs --")
+for off, name in SLOTS:
+    slot = struct.unpack('<Q', rd(vt + off, 8))[0]
+    stub = rd(slot, 8)
+    if stub[:3] == b'\x0f\xb6\x81':
+        disp = struct.unpack('<I', stub[3:7])[0]
+        val = rd(obj + disp, 1)[0]
+        print("  slot +%#05x  %s disp=%#x  VALUE=%d" % (off, name, disp, val))
+    else:
+        print("  slot +%#05x  %s NOT a movzx stub: %s" % (off, name, stub.hex()))
+
+print("\n-- market screen inputs --")
+for disp, name in [(0x1fd1c, 'TRADE_PILE_SIZE'), (0x1fd20, 'watchListSize  '),
+                   (0x1fd2e, 'tradingEnabled '), (0x1fd2f, 'storeEnabled   ')]:
+    print("  model+%#x  %s = %d" % (disp, name, rd(obj + disp, 1)[0]))
+
+os.close(fd)