"""The raw `call [reg+0x270]` scan over-matched: most hits are a DIFFERENT class (they pass a 0x38*0x17 buffer). The FutDataManagerImpl instance is always obtained via FUN_1800d7170() -> FUN_180009c80(&obj, ...). So the true readers of the trading gate are functions that call FUN_180009c80 AND contain call [reg+0x270] with no arg. CONTROL: FUN_1801a7260 (TO_TRADE_PILE) and FUN_18006cc60 (the publisher) must both survive the refinement; the squad functions FUN_180194b60 etc must all drop out. Also: polarity of FUN_1801a7260 via its callers / the action-id table. """ import traceback, struct try: tstart = None for b in mem.getBlocks(): if b.getName() == ".text": tstart = int(b.getStart().getOffset()) tb = read_bytes(tstart, int(b.getEnd().getOffset()) - tstart + 1) getters = {} for g, gname in [(0x180009c80, "FUN_180009c80 mgr-getter"), (0x1800d7170, "FUN_1800d7170")]: s = set() for frm, typ, fn, ent in xrefs_to(g): if ent: s.add(ent) getters[gname] = s print("%s: %d callers" % (gname, len(s))) mgr = getters["FUN_180009c80 mgr-getter"] print("\n=== vt+0x270 call sites whose function ALSO calls the mgr getter ===") d = struct.pack("