"""DIMENSION 3 SEASONS q3. GOAL: find WHO WRITES the model season-list vector (this+0x5c68, exposed via vtable +0x898) and the current-season short at this+0x7138+0x96/+0x98. If the ONLY writer is the /season SeasonList deserializer, then a server response CAN populate it (server-reachable). If nothing writes it, or only a script-driven loader does, the gate is upstream of any server response. Also: identify the 0x1801f8xxx table (script-command dispatch?) and dump the descriptor rows around the season callbacks; and dump the vtable region 0x180219ac0. CONTROL: for the deser store-target question, decompile 0x1801683f0 (SeasonList deser) AND 0x180167740 (element parser) IN FULL (print len) and look for a store into a model offset vs a local response object. """ import traceback, struct try: # what references the season callback table cluster 0x1801f8a38..0x1801f8ab8? print("### xrefs into the 0x1801f8xxx season-callback cluster ###") for a in (0x1801f8a38, 0x1801f8a50, 0x1801f8a58, 0x1801f8ab0, 0x1801f8ab8): print(" cluster", hex(a), "bytes:", read_bytes(a-8, 24).hex()) for x in xrefs_to(a): print(" xref", hex(x[0]), x[1], x[2], hex(x[3])) # dump the callback table region as pointers to see the row structure print("\n### dump 0x1801f8a30..0x1801f8ac0 as qwords ###") for off in range(0x1801f8a30, 0x1801f8ac0, 8): v = qword(off) print(" ", hex(off), hex(v), fname(v) if 0x180000000 <= v < 0x181000000 else "") print("\n### dump vtable region 0x180219aa0..0x180219af0 ###") for off in range(0x180219aa0, 0x180219af0, 8): v = qword(off) print(" ", hex(off), hex(v), fname(v) if 0x180000000 <= v < 0x181000000 else "") # SeasonList deserializer + element parser: where do they store? print("\n############ DECOMPILE 0x1801683f0 (SeasonList deser) ############") d = dec(0x1801683f0); print("LEN", len(d)); print(d) print("\n############ DECOMPILE 0x180167740 (season element parser) ############") d = dec(0x180167740); print("LEN", len(d)); print(d) sys.stdout.flush() os._exit(0) except Exception: traceback.print_exc() sys.stdout.flush() os._exit(0)