"""ADVERSARIAL VERIFICATION BATCH 2. Everything printed IN FULL with len(src). No truncation, no absence claimed from a partial print. H8 dim4 f5: auctionInfo record deser 0x18013e410 has exactly 12 atoms + tradeId identity lookup via model vt+0xa00. H9 dim4 f7: shared IS-list body 0x18013e7f0, credits -> model vt+0x5b8. H10 dim4 f6: tradeState table walk FUN_180166bd0 (table 0x180229e40) and bidState ladder FUN_180166380 -- two DIFFERENT dispatch forms, read separately. H11 dim4 f8: FUN_1801844c0 status map, FUN_180165050 461 override. H12 dim4 f9: FUN_1800377c0 IS_MAX_AUCTIONS + FUN_180163770 GetAuctionCount deser. CONTROL for the publisher form: FUN_18000d550 TRADE_PILE_SIZE. H13 dim4 f11: deser VAs for FutISWatchList / FutGetAuctionCount / FutISStart via RS4 name -> abs64 ptr -> installed vtable -> slot +0x08, with FutISSearch and FutGetTradePile as the CONTROL pair (must come back 0x180163420 / 0x180170810). """ import traceback, struct def full(tag, va): try: s = dec(va) print("\n----- %s %#x len=%d -----" % (tag, va, len(s))) print(s) except Exception: traceback.print_exc() try: for tag, va in [("auctionInfo record deser", 0x18013e410), ("shared IS-list body", 0x18013e7f0), ("tradeState decoder", 0x180166bd0), ("bidState decoder", 0x180166380), ("status mapper", 0x1801844c0), ("ISOfferTrade 461 override", 0x180165050), ("IS_MAX_AUCTIONS publisher", 0x1800377c0), ("TRADE_PILE_SIZE publisher CONTROL", 0x18000d550), ("GetAuctionCount deser", 0x180163770), ("ISWatchList deser", 0x180166240), ("ISSearch deser CONTROL", 0x180163420), ("GetTradePile deser CONTROL", 0x180170810)]: full(tag, va) print("\n### tradeState table at 0x180229e40") a = 0x180229e40 for i in range(10): p = qword(a + i * 16); v = dword(a + i * 16 + 8) if p == 0: print(" [%d] NULL terminator, value=%d" % (i, v)); break print(" [%d] %#x %r = %d" % (i, p, rd_str(p), v if v < 0x80000000 else v - (1 << 32))) print("\n### H13 RS4 name -> installed vtable -> slot+0x08") for nm, expect in [(b"RS4:FutISSearchServerResponse\x00", 0x180163420), (b"RS4:FutGetTradePileServerResponse\x00", 0x180170810), (b"RS4:FutISWatchListServerResponse\x00", None), (b"RS4:FutGetAuctionCountServerResponse\x00", None), (b"RS4:FutISStartServerResponse\x00", None), (b"RS4:FutGetSuggestedPricingServerResponse\x00", None), (b"RS4:FutRelistAllServerResponse\x00", None), (b"RS4:FutISWatchTradeServerResponse\x00", None), (b"RS4:FutISRemoveTradeServerResponse\x00", None), (b"RS4:FutISRemoveWatchServerResponse\x00", None), (b"RS4:FutISViewTradeServerResponse\x00", None), (b"RS4:FutISOfferTradeServerResponse\x00", None)]: locs = find_all(nm, blocks=(".rdata", ".data")) print("\n %s -> %s" % (nm.decode().rstrip("\x00"), [hex(x) for x in locs])) for L in locs: xs = xrefs_to(L) print(" xrefs: %s" % [(hex(a), t, f) for a, t, f, _ in xs]) for a, t, f, ent in xs: if ent: s = dec(ent) # find the vtable it installs: look for PTR_ / &DAT_ assignment import re m = re.findall(r"(?:PTR_[A-Za-z_0-9]*_|DAT_|&)([0-9a-fA-F]{9})", s) print(" fn %s @%#x len=%d installs %s" % (f, ent, len(s), set(m))) for cand in set(m): try: vt = int(cand, 16) if 0x180200000 <= vt < 0x180290000: slot = qword(vt + 8) print(" vtable %#x slot+0x08 = %#x (expect %s)" % (vt, slot, hex(expect) if expect else "?")) except Exception: pass except Exception: traceback.print_exc()