"""Q4 — is the atom ID the index into the alphabetical atom-name pointer table? Validate against the twelve KNOWN auctionInfo atoms. If all twelve agree on one base, the table is the atom dictionary and we can read the ID of any name. """ import struct KNOWN = { # atom id -> name, from the confirmed auctionInfo deserializer 0x57: "bidState", 0x65: "buyNowPrice", 0xC1: "currentBid", 0x116: "expires", 0x16B: "itemData", 0x2B6: "sellerEstablished", 0x2B7: "sellerName", 0x2E6: "startingBid", 0x2F4: "coinsProcessed", 0x331: "tradeId", 0x335: "tradeState", 0x380: "watched", } def str_addr(name): """Address of the exact NUL-terminated string `name`.""" for h in find_all(name.encode() + b"\x00", blocks=(".rdata", ".data")): return h return None def ptr_addr(sa): hits = find_all(struct.pack(" base 0x{base:x}") print() print(" base histogram:", {hex(b): n for b, n in sorted(bases.items(), key=lambda kv: -kv[1])}) if not bases: raise SystemExit("no bases resolved") BASE = max(bases, key=bases.get) print(f" CONSENSUS BASE = 0x{BASE:x} ({bases[BASE]}/{len(KNOWN)} atoms agree)") print() print("=" * 78) print("== read the atom id of every sold/counts-related name") print("=" * 78) for name in ("sold", "selling", "offered", "count", "maxAuctionsAllowed", "auctionSoldBid", "auctionSoldBuyNow", "auctionWonBid", "auctionWonBuyNow", "auctionLostOutbid", "auctionLostOutbidSelf", "auctionLostBidRejected", "credits", "coins", "tradeIdStr", "itemState", "offers", "bids", "watched", "expires"): sa = str_addr(name) pa = ptr_addr(sa) if sa else None if pa is None: print(f" {name:24s} ABSENT from the table") continue off = pa - BASE if off % 8: print(f" {name:24s} ptr=0x{pa:x} misaligned (off {off})") continue print(f" {name:24s} ptr=0x{pa:x} ATOM ID = 0x{off // 8:x} ({off // 8})")