"""DIMENSION 2 batch 13 (last): find the reader of FutDiscardCardServerResponse totalCredits (obj+0x28), and confirm discardValue is a display field. HYPOTHESIS The DiscardCard class block 0x180126e00-0x180127a00 contains a small accessor that returns *(int*)(this+0x28); its callers are the coin consumers. If no such accessor exists, the response's totalCredits is read directly by a completion callback that this pass has not reached, and that is an honest gap. CONTROL: FutSquadListServerResponse -> 0x180172140. """ import traceback, os OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/packres" try: print("CONTROL FutSquadListServerResponse ->", [hex(a) for a, v, e in class_deser("FutSquadListServerResponse")]) print("=" * 78) print("SECTION 1 -- every function in 0x180126c00-0x180127a00") it = fm.getFunctions(addr(0x180126C00), True) while it.hasNext(): f = it.next() ep = int(f.getEntryPoint().getOffset()) if ep > 0x180127A00: break s = dec(ep) print("---- %#x %s len=%d ----" % (ep, f.getName(), len(s))) print(s if len(s) < 2500 else s[:2500] + "\n...TRUNC len=%d" % len(s)) if "0x28)" in s: print(" *** references +0x28 ***") print("=" * 78) print("SECTION 2 -- GetCardDetails Scaleform getter (does it expose discardValue?)") hits = find_all(b"GetCardDetails\x00") print(" lit hits:", [hex(h) for h in hits]) for h in hits: for r in xrefs_to(h): print(" ref %#x in %s %#x" % (r[0], r[2], r[3])) print("=" * 78) print("SECTION 3 -- xrefs to the fcc_discardcoins literal and its owner") for lit in (b"fcc_discardcoins\x00", b"discardValue\x00"): hs = find_all(lit) print(" %s -> %s" % (lit, [hex(x) for x in hs])) for h in hs: for r in xrefs_to(h): print(" ref %#x %s %s %#x" % (r[0], r[1], r[2], r[3])) except Exception: traceback.print_exc()