funman300
2fc335c37d
Two tools, both gated on positive controls because the previous pass produced a confidently wrong negative result. atom_mapper_emu.py interprets the atom -> field-id dispatch functions instead of pattern-scanning them. Its selftest encodes the two decoder traps that caused earlier mistakes - ModRM rm=5 with mod!=0 is [rbp+disp] rather than RIP-relative, and a constant may reach its use through a register - plus the live-verified controls that the item mapper maps atom 568 'players' to field id 1 and atom 11 'actives' to 0. The mandatory manager atom 424 control still fails as a coverage limit: only 2 of the 52 resolver callers are pure dispatch chains, so the tool refuses to support any absence claim about the squad mapper. The live probes enumerate the resident item map at owner+0x160c8, whose layout came from the lower_bound at 0x180119640: key = wire instance id at node+0x20, record at node+0x28, count at owner+0x160e8. probe_map2 reaches 22 nodes against a count field of 22, so the enumeration validates itself, and probe_hunt searches all writable memory with its own in-run positive control. Result: all four club staff are resident, both kit ids are absent everywhere, and a lookup miss returns the static sentinel 0x1802c2a28 whose +0x10 is NULL - which is exactly the KIT_SCAN symptom.
73 lines
2.8 KiB
Python
Executable File
73 lines
2.8 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Enumerate FIFA 17's resident item map authoritatively.
|
|
|
|
Layout recovered from the lower_bound at 0x180119640:
|
|
owner+0x160c8 sentinel / end marker
|
|
owner+0x160d8 root
|
|
owner+0x160e8 count
|
|
node+0x00, node+0x08 children
|
|
node+0x20 key = wire instance id (qword)
|
|
node+0x28 the item record
|
|
On miss the client returns the static sentinel 0x1802c2a28 whose +0x10 is NULL.
|
|
|
|
Read-only. usage: probe_map2.py PID [id ...]
|
|
"""
|
|
import re, struct, sys, collections
|
|
|
|
PID = int(sys.argv[1]); WANT = {int(a) for a in sys.argv[2:]}
|
|
mem = open(f"/proc/{PID}/mem", "rb", buffering=0)
|
|
def rd(a, n):
|
|
mem.seek(a); return mem.read(n)
|
|
def q(a): return struct.unpack("<Q", rd(a, 8))[0]
|
|
named = []
|
|
for ln in open(f"/proc/{PID}/maps"):
|
|
m = re.match(r"([0-9a-f]+)-([0-9a-f]+) \S{4} \S+ \S+ \S+\s+(.+)", ln)
|
|
if m: named.append((int(m.group(1), 16), m.group(3).strip()))
|
|
named.sort()
|
|
base = next(s for s, p in named if p.endswith("CardsDLL_Win64_retail.dll"))
|
|
if rd(base + (0x180026fea - 0x180000000), 5) != bytes.fromhex("ba75750000"):
|
|
sys.exit("SANITY FAILED")
|
|
owner = q(base + (0x1802e6398 - 0x180000000))
|
|
SENT, ROOT, COUNT = owner + 0x160c8, q(owner + 0x160d8), q(owner + 0x160e8) & 0xffffffff
|
|
print(f" owner={owner:#x} sentinel={SENT:#x} root={ROOT:#x} count={COUNT}")
|
|
|
|
nodes, seen, stack = [], set(), [ROOT]
|
|
while stack:
|
|
n = stack.pop()
|
|
if not n or n == SENT or n in seen or len(seen) > 5000:
|
|
continue
|
|
seen.add(n)
|
|
try:
|
|
h = rd(n, 0x30)
|
|
except OSError:
|
|
continue
|
|
if len(h) < 0x30:
|
|
continue
|
|
nodes.append(n)
|
|
stack.append(struct.unpack_from("<Q", h, 0)[0])
|
|
stack.append(struct.unpack_from("<Q", h, 8)[0])
|
|
print(f" nodes reached: {len(nodes)} (count field says {COUNT})\n")
|
|
|
|
print(f" {'key':>11} {'record':>12} {'id':>10} {'resource':>10} {'ct':>3} {'sub':>4} {'st':>4} {'cat':>4}")
|
|
hist = collections.Counter(); found = {}
|
|
rows = []
|
|
for n in nodes:
|
|
key = q(n + 0x20)
|
|
rec = n + 0x28
|
|
try: r = rd(rec, 0x180)
|
|
except OSError: continue
|
|
if len(r) < 0x180: continue
|
|
g = lambda o: struct.unpack_from("<i", r, o)[0]
|
|
rid = struct.unpack_from("<I", r, 0x8)[0]
|
|
res = struct.unpack_from("<I", r, 0x18)[0]
|
|
ct, sub, st, cat = g(0x4c), g(0x50), g(0x5c), g(0x60)
|
|
hist[ct] += 1
|
|
if rid in WANT: found[rid] = rec
|
|
rows.append((key, rec, rid, res, ct, sub, st, cat))
|
|
for key, rec, rid, res, ct, sub, st, cat in sorted(rows):
|
|
tag = " <== CARDTYPE 7" if ct == 7 else (" <== WANTED" if rid in WANT else "")
|
|
print(f" {key:>11} {rec:#12x} {rid:>10} {res:>10} {ct:>3} {sub:>4} {st:>4} {cat:>4}{tag}")
|
|
print(f"\n cardtype histogram: {dict(sorted(hist.items()))} total={sum(hist.values())}")
|
|
for w in sorted(WANT):
|
|
print(f" id {w}: {'RESIDENT' if w in found else 'ABSENT'}")
|