funman300
40 lines
1.6 KiB
Python
40 lines
1.6 KiB
Python
"""DIMENSION 5 SBC/Objectives -- query 2.
|
|
|
|
Q1 established so far: enableSquadBuildingSetsFeature literal @0x180230eb8 has EXACTLY
|
|
ONE xref, a DATA ref from 0x1802d2f60. Test that 0x1802d2f60 is the atom-dictionary
|
|
slot for atom 0x100 (dict base 0x1802d2760 + 0x100*8 = 0x1802d2f60). If so, the flag
|
|
is a PURE dictionary entry: never read as a named input, never emitted -- so CardsDLL
|
|
does not gate SBC on it, and a Blaze-config delivery of it can only reach the packed
|
|
script layer, never CardsDLL.
|
|
|
|
Also:
|
|
- callers of 0x180154990 (the SBC stub loader) -> where the SBC menu/data path enters.
|
|
- FUN_180007c30/FUN_180007c40 -> is 'FUT/SBC_USE_STUBS' a client tunable (not server)?
|
|
- publisher FUN_18006cc60 full body -> is there ANY SBC/objectives enable name emitted?
|
|
- scan for any published string mentioning SBC / SQUAD_BUILD / CHALLENGE enable.
|
|
"""
|
|
import traceback
|
|
try:
|
|
dictbase = 0x1802d2760
|
|
for atom in (0x100, 0xfd, 0xfe):
|
|
slot = dictbase + atom * 8
|
|
ptr = qword(slot)
|
|
print("atom %#x -> dict slot %#x -> ptr %#x = %r"
|
|
% (atom, slot, ptr, rd_str(ptr, 50) if 0x180000000 <= ptr < 0x181000000 else "?"))
|
|
|
|
print("\n=== callers of 0x180154990 (SBC stub loader) ===")
|
|
for ent, nm in callers(0x180154990):
|
|
print(" %#x %s" % (ent, nm))
|
|
|
|
print("\n=== FUN_180007c30 (config store getter?) ===")
|
|
print(dec(0x180007c30)[:1500])
|
|
print("\n=== FUN_180007c40 (named-config lookup?) ===")
|
|
print(dec(0x180007c40)[:2500])
|
|
|
|
print("\n=== publisher FUN_18006cc60 full ===")
|
|
d = dec(0x18006cc60)
|
|
print("LEN", len(d))
|
|
print(d)
|
|
except Exception:
|
|
traceback.print_exc()
|