"""ADVERSARIAL BATCH 1. HYPOTHESES UNDER TEST (all from another agent, assumed WRONG until reproduced): H1 FUN_1800d8330 maps cardsubtypeid -> cardtype and returns 9 for exactly {0x1e,0x1f,0x91..0x96,0xe7..0xe9,0xec}; and returns 7 for 9,10,11. H2 FUN_180119bd0 arms: 9 -> KITS, 10 -> Stadium, 0xb -> Badge, else "". H3 FUN_1801a8640 == *(u32*)(*(u64*)(param_1+0x18)+0x50) i.e. cardsubtypeid. H4 FUN_1800f6c40 calls vtable+0x498 only when item+0x4c == 7, args (item+0x50, item+0x94, item+0x20); and sets IS_KIT_%d when item+0x50==9. H5 FUN_180141660 tail writes item+0x54 = level(rating@+0xb4): 3 if >=0x4b, else 2 - (rating < 0x41). <-- CONTRADICTS the live-map "+0x54 = itemType". CONTROL: FUN_1800d8330 must decompile non-empty and its case labels must be recoverable; it is a jump table, which is the form that DEFEATED an earlier scan. Every decompile is written to disk IN FULL with its length printed, so no claim here can rest on a truncated body. Output: /tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/cards/adv/ """ import traceback, os OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/cards/adv" try: os.makedirs(OUT, exist_ok=True) TARGETS = { "FUN_1800d8330": 0x1800d8330, "FUN_180119bd0": 0x180119bd0, "FUN_1801a8640": 0x1801a8640, "FUN_1800f6c40": 0x1800f6c40, "FUN_180141660": 0x180141660, "FUN_1801a8570": 0x1801a8570, "FUN_1801a8560": 0x1801a8560, "FUN_1801a8800": 0x1801a8800, "FUN_1801a8040": 0x1801a8040, "FUN_180136480": 0x180136480, } for name, a in TARGETS.items(): src = dec(a) p = os.path.join(OUT, name + ".c") open(p, "w").write(src) print("WROTE %-16s len=%6d -> %s" % (name, len(src), p)) print() print("=== small functions printed IN FULL ===") for name in ("FUN_1800d8330", "FUN_1801a8640", "FUN_1801a8570", "FUN_1801a8560", "FUN_1801a8800", "FUN_1801a8040", "FUN_180119bd0"): src = open(os.path.join(OUT, name + ".c")).read() print("\n----------8<---------- %s (len=%d) ----------" % (name, len(src))) print(src) print() print("=== CONTROL: case labels of FUN_1800d8330 via the listing ===") f = func(0x1800d8330) print("entry 0x%x body %s" % (int(f.getEntryPoint().getOffset()), f.getBody())) it = listing.getInstructions(f.getBody(), True) n = 0 while it.hasNext(): ins = it.next() n += 1 print("instruction count: %d" % n) # enumerate caseD_ labels inside the body st = prog.getSymbolTable() labs = [] rng = f.getBody() for sym in st.getAllSymbols(True): a2 = sym.getAddress() if a2 is not None and rng.contains(a2) and str(sym.getName()).startswith("caseD_"): labs.append((str(sym.getName()), int(a2.getOffset()))) print("caseD_ labels in FUN_1800d8330: %d -> %s" % (len(labs), sorted(set(l[0] for l in labs)))) except Exception: traceback.print_exc()