"""FALSIFIER for "tradingEnabled defaults to 0 while storeEnabled defaults to 1": find the massinfo/settings response object's constructor and read the immediates it writes at +0x50 (tradingEnabled, applier p[10]) and +0x54/+0x58 (storeEnabled / storeEnabled_JP, applier p[0xb]/p[0xc]). CONTROL: live model+0x1fd2f and +0x1fd30 read 1 and +0x1fd2e reads 0 with configs:[] on the wire, and the applier is the sole writer of all three -- so the ctor MUST show 1,1 at +0x54/+0x58 and 0 (or absent) at +0x50 or my chain is wrong. Also: every caller of FUN_18011f380 (the trade-pile slot-vector resize). """ import traceback try: print("=== callers of FUN_18011f380 (trade-pile vector resize) ===") for frm, typ, fn, ent in xrefs_to(0x18011f380): print(" %#x %-22s %s ent=%#x" % (frm, typ, fn, ent)) print("\n=== descriptor vtable 0x18022d000 ===") for off, t, n in vtable(0x18022d000, 12): print(" +%#05x -> %#x %s" % (off, t, n)) print("\n=== xrefs to descriptor vtable 0x18022d000 ===") for frm, typ, fn, ent in xrefs_to(0x18022d000): print(" %#x %-14s %s ent=%#x" % (frm, typ, fn, ent)) print("\n=== find the ctor: functions writing an immediate to [reg+0x50] near [reg+0x54] ===") print(dec(0x180174580)) except Exception: traceback.print_exc()