"""Q6: loose ends. (a) _DAT_1801f66a0 -- the qword the deser uses to initialise {cardsubtypeid(+0x50), +0x54}. If +0x54 is the card LEVEL and no atom writes it, its pre-merge value is whatever this constant carries. (b) Does ANY writer of record+0x54 exist besides FUN_180141660's tail? Enumerate every function that references the level accessors and, more directly, look for the constant 0x4b/0x41 rating-tier ladder elsewhere. (c) FUN_18003b800 -- the CARD_TYPE getter whose value 0x12 gates the manager publisher. What is the enum? (d) FUN_1801a7dd0 / FUN_1801a78f0 -- how the publisher's wrapper gets its record pointer, to confirm wrapper+0x18 IS the 0x180 item record and not a copy. CONTROL: FUN_1801a7100 already visibly does param_1[3] = *(param_2+0x10), i.e. wrapper+0x18 = arg+0x10; if FUN_1801a7dd0 disagrees my offsets are off. """ import traceback try: print("=== (a) _DAT_1801f66a0 ===") q = qword(0x1801F66A0) print(" qword %#018x -> low dword %#x (+0x50 init) high dword %#x (+0x54 init)" % (q, q & 0xFFFFFFFF, q >> 32)) print() print("=== (b) other rating-tier ladders: functions comparing a byte to 0x4b ===") for lbl, a in (("FUN_180141660 tail", 0x180141660), ("FUN_1801a80c0 accessor", 0x1801A80C0)): print(" known: %s" % lbl) print(" callers of FUN_1800d8330 (family map), for context:") for frm, typ, fn, ent in xrefs_to(0x1800D8330): print(" %#x %-10s %s(%#x)" % (frm, typ, fn, ent)) print() print("=== (c) FUN_18003b800 CARD_TYPE getter ===") print(dec(0x18003B800)) print("=== FUN_18003b9d0 and FUN_18003cbf0 (manager publisher gates) ===") print(dec(0x18003B9D0)) print(dec(0x18003CBF0)) print("=== (d) wrapper construction ===") for a in (0x1801A7DD0, 0x1801A78F0, 0x1801A7100): s = dec(a) print("--- %#x len=%d" % (a, len(s))) print(s) except Exception: traceback.print_exc()