funman300
2fc335c37d
Two tools, both gated on positive controls because the previous pass produced a confidently wrong negative result. atom_mapper_emu.py interprets the atom -> field-id dispatch functions instead of pattern-scanning them. Its selftest encodes the two decoder traps that caused earlier mistakes - ModRM rm=5 with mod!=0 is [rbp+disp] rather than RIP-relative, and a constant may reach its use through a register - plus the live-verified controls that the item mapper maps atom 568 'players' to field id 1 and atom 11 'actives' to 0. The mandatory manager atom 424 control still fails as a coverage limit: only 2 of the 52 resolver callers are pure dispatch chains, so the tool refuses to support any absence claim about the squad mapper. The live probes enumerate the resident item map at owner+0x160c8, whose layout came from the lower_bound at 0x180119640: key = wire instance id at node+0x20, record at node+0x28, count at owner+0x160e8. probe_map2 reaches 22 nodes against a count field of 22, so the enumeration validates itself, and probe_hunt searches all writable memory with its own in-run positive control. Result: all four club staff are resident, both kit ids are absent everywhere, and a lookup miss returns the static sentinel 0x1802c2a28 whose +0x10 is NULL - which is exactly the KIT_SCAN symptom.
93 lines
3.0 KiB
Python
Executable File
93 lines
3.0 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Identify every resident record by its wire instance id.
|
|
|
|
Record layout established from known wire values:
|
|
+0x08 id (wire instance) +0x18 resourceId +0x1c/+0x20 assetId
|
|
+0x38 discardValue +0x4c cardtype +0x50 cardsubtypeid
|
|
+0x5c itemState +0x60 category +0x94 teamid
|
|
+0xb4 rating +0xba teamkittypetechid (u16)
|
|
|
|
Walks the contiguous 0x180-stride pool around the manager slot record so records
|
|
that are resident but not in any collection are still seen. Read-only.
|
|
|
|
usage: probe_ids.py PID [expected_id ...]
|
|
"""
|
|
import re, struct, sys
|
|
|
|
PID = int(sys.argv[1])
|
|
WANT = {int(a) for a in sys.argv[2:]}
|
|
mem = open(f"/proc/{PID}/mem", "rb", buffering=0)
|
|
|
|
def rd(a, n):
|
|
mem.seek(a); return mem.read(n)
|
|
def q(a):
|
|
return struct.unpack("<Q", rd(a, 8))[0]
|
|
|
|
named = []
|
|
for ln in open(f"/proc/{PID}/maps"):
|
|
m = re.match(r"([0-9a-f]+)-([0-9a-f]+) \S{4} \S+ \S+ \S+\s+(.+)", ln)
|
|
if m:
|
|
named.append((int(m.group(1), 16), m.group(3).strip()))
|
|
named.sort()
|
|
base = next(s for s, p in named if p.endswith("CardsDLL_Win64_retail.dll"))
|
|
live = lambda s: base + (s - 0x180000000)
|
|
if rd(live(0x180026fea), 5) != bytes.fromhex("ba75750000"):
|
|
sys.exit("SANITY FAILED")
|
|
owner = q(live(0x1802e6398))
|
|
mgr = owner + 0x1f9d8
|
|
RECSZ = 0x180
|
|
|
|
def dec(rec):
|
|
r = rd(rec, 0x180)
|
|
g = lambda o: struct.unpack_from("<i", r, o)[0]
|
|
return dict(id=struct.unpack_from("<I", r, 0x8)[0], res=struct.unpack_from("<I", r, 0x18)[0],
|
|
ct=g(0x4c), sub=g(0x50), st=g(0x5c), cat=g(0x60), team=g(0x94),
|
|
rating=struct.unpack_from("<I", r, 0xb4)[0],
|
|
kt=struct.unpack_from("<H", r, 0xba)[0])
|
|
|
|
mgr_rec = q(mgr + 0xc0 + 0x10)
|
|
print(f" manager-slot record = {mgr_rec:#x}")
|
|
anchor = mgr_rec if mgr_rec else q(q(mgr + 0xd8) + 0x10)
|
|
|
|
# walk backwards to the start of the contiguous run, then forwards
|
|
lo = anchor
|
|
for _ in range(64):
|
|
prev = lo - RECSZ
|
|
try:
|
|
d = dec(prev)
|
|
except OSError:
|
|
break
|
|
if not (0 < d["ct"] < 64) or d["id"] == 0:
|
|
break
|
|
lo = prev
|
|
|
|
print(f" pool run starts at {lo:#x}\n")
|
|
print(f" {'idx':>3} {'addr':>12} {'id':>10} {'resource':>9} {'ct':>3} {'sub':>4} "
|
|
f"{'st':>3} {'cat':>4} {'team':>5} {'rate':>5} {'kt':>6}")
|
|
found = {}
|
|
k = 0
|
|
addr = lo
|
|
while k < 48:
|
|
try:
|
|
d = dec(addr)
|
|
except OSError:
|
|
break
|
|
if d["id"] == 0 and d["ct"] == 0:
|
|
break
|
|
tag = ""
|
|
if d["ct"] == 7:
|
|
tag = " <== CARDTYPE 7"
|
|
if d["id"] in WANT:
|
|
tag += " <== WANTED"
|
|
found[d["id"]] = addr
|
|
slot = " [manager slot]" if addr == mgr_rec else ""
|
|
print(f" {k:>3} {addr:#12x} {d['id']:>10} {d['res']:>9} {d['ct']:>3} {d['sub']:>4} "
|
|
f"{d['st']:>3} {d['cat']:>4} {d['team']:>5} {d['rating']:>5} {d['kt']:>6}{tag}{slot}")
|
|
addr += RECSZ
|
|
k += 1
|
|
|
|
if WANT:
|
|
print(f"\n wanted ids: {sorted(WANT)}")
|
|
for w in sorted(WANT):
|
|
print(f" {w}: {'FOUND at ' + hex(found[w]) if w in found else 'NOT RESIDENT'}")
|