funman300
21a81ad63c
Multi-agent pass over the store subsystem, 11 agents, findings run through three
adversarial verifiers. Full writeup in docs/plan-2026-08-05-store-subsystem.md.
THE REAL DISCARD TABLE IS RECOVERED. quick_sell() paid an invented rating tier
(600/300/150/50) that was wrong for every single card. The real table is
fcc_discardcoins in the client's own game DB, 141 rows keyed (cardtype, level, rare),
read out of the running client and verified 22/22 against live items:
value = round_half_up(rating * price / 100)
level = 3 if rating >= 75, 2 if 65..74, else 1 (0x180141e8a..0x180141ea3,
derived from rating, NOT a wire field)
cardtype = FUN_1800d8330(cardsubtypeid), decoded from its jump table and checked
across every subtype 0..599 with zero disagreements
A 94-rated gold rare is 752, not 600. A 76 rare is 608, not 150. A 55 bronze is 17,
not 50.
This also closes a disagreement nobody had noticed: the CLIENT already computes and
displays the correct value locally whenever our discardValue (atom 0xd7) is 0 or
absent. FUN_18013fe00 stores our value at item +0x38 and the guard at 0x180141025
skips the local computation when it is non-zero. So the screen has been showing the
real number while the server paid a made-up one, on every quick sell ever made.
Verified beyond what the report claimed, because a missing table row pays ZERO and
that would be a regression the old flat tier could not produce: across all 236 items
in the live profile, 230 map to cardtype 1 and 6 to cardtype 6, and NOT ONE would pay
0 coins. Table reproduces at 141 rows and the worked example lands exactly.
ZERO WIRE CHANGE, FUT_DISCARD_TABLE default off. Nothing new is sent; only the coin
figure the server credits moves. This is the patch worth defaulting on after one
in-game check, which is simply quick-selling a card and seeing the coins paid match
the value the card was already displaying.
THE GROUPING BUG IS NOT IN CARDSDLL, and the fix ranked first would have wasted a
launch. Live in the running client all three display groups own exactly the right
pack, there is exactly one copy of each pack record in 4 GiB, and nothing we send is
mis-parsed. The parsed model is correct and the Scaleform layer picks the wrong pack
when turning a tile click into a category id. displayGroupAssetId is served as 1/5/6
while the screen's category field reads 3, and group tiles carry a hardcoded
CATEGORY_ID of 0. Confirmed by direct read: ordinal 3, assetId 6, i.e. Premium, while
the last click was Gold.
The heap map that made this possible, all scoped to one pid: display-group vector
control block, 3 elements of 0x108; group record fields at +0x00 sortPriority,
+0x04 displayGroupAssetId, +0x40 a one-element pack vector; inner pack record 0x1a8
with packType at +0x38, ids at +0x70/+0xac, price at +0xa0, quantities at +0xc0..+0xd0.
extPrice SHOULD BE DELETED, not corrected. Both sub-parsers read only
externalPriceId; amount and currency are discarded. Sending the key at all creates an
"mtx" currency row that switches on a real-money price line the client can never fill
offline, which is the literal "or %1s" on every tile.
A WORRY NOBODY HAD RAISED, and I confirmed it from our own logs: the client has sent
packId 6 on every purchase it has ever made, four for four tonight and six for six
across history. We have never observed a successful buy of anything but Premium Gold.
Also settled: FUT_STORE_DISPLAYGROUP=0 is the right resting state, argued from
mechanism rather than from history; FUT_USERINFO=packs stays off because the
unopened-pack counter is client-mutable and the flag ladder silently drops squadList;
POST /user is a latent hard freeze that has never fired because the client never
issues that POST.
Honest coverage: the ActionScript layer is unread by everyone and every remaining
store mystery lives there.
Live: 439 contract checks pass, market suite passes, both flags off.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
111 lines
4.3 KiB
Python
111 lines
4.3 KiB
Python
"""DIMENSION 4 (duplicates), pass 3.
|
|
|
|
Q2 is "what REQUEST does the duplicate flow emit". Request serializers in this
|
|
client do NOT use string literals for keys: they call FUN_180180cd0(<atom>) to
|
|
turn an atom id into its wire name (proved by the CreatePack request serializer
|
|
0x180162530, which serialises atoms 0x20b, 0x369, 0x36b, 0xc4 that way).
|
|
|
|
HYPOTHESIS: no serializer ever emits duplicateItemId (0xeb), duplicateItemIdList
|
|
(0xec), duplicateItemLoans (0xed) or itemLoans (0x16f); they are response-only.
|
|
|
|
METHOD / CONTROL: enumerate EVERY call site of FUN_180180cd0 from the reference
|
|
manager, disassemble backwards up to 12 instructions in the same function, and
|
|
record every immediate moved into ECX/RCX. Then assert the four control atoms
|
|
0x20b/0x369/0x36b/0xc4 ARE found (if the method cannot see known-present atoms it
|
|
cannot be trusted to prove absence). Immediate forms handled: MOV ECX,imm and
|
|
XOR ECX,ECX (zero) and LEA ECX,[imm]; anything unresolved is reported as UNKNOWN
|
|
so absence is never inferred from a silent miss.
|
|
|
|
Also: GetCardDuplicate script handler, and the owner of the item container.
|
|
"""
|
|
import traceback
|
|
|
|
OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/store/dup3_out.txt"
|
|
|
|
def w(fh, s=""):
|
|
fh.write(str(s) + "\n")
|
|
|
|
def dump(fh, a, label):
|
|
s = dec(a)
|
|
w(fh, "")
|
|
w(fh, "#" * 70)
|
|
w(fh, "# %s %#x len(src)=%d FULL" % (label, a, len(s)))
|
|
w(fh, "#" * 70)
|
|
w(fh, s)
|
|
|
|
try:
|
|
fh = open(OUT, "w")
|
|
|
|
# ---------------- A: atom serialisation census ----------------
|
|
w(fh, "=" * 70)
|
|
w(fh, "A. every call site of the atom->wire-name helper FUN_180180cd0")
|
|
w(fh, "=" * 70)
|
|
sites = [(frm, fn, ent) for frm, typ, fn, ent in xrefs_to(0x180180CD0)
|
|
if "CALL" in typ]
|
|
w(fh, "call sites: %d" % len(sites))
|
|
found = {}
|
|
unknown = []
|
|
for frm, fn, ent in sites:
|
|
ins = listing.getInstructionAt(addr(frm))
|
|
val = None
|
|
cur = ins
|
|
for _ in range(12):
|
|
if cur is None:
|
|
break
|
|
cur = cur.getPrevious()
|
|
if cur is None:
|
|
break
|
|
m = str(cur.getMnemonicString()).upper()
|
|
ops = str(cur)
|
|
if m == "MOV" and ops.upper().startswith("MOV ECX,"):
|
|
t = ops.split(",")[1].strip()
|
|
try:
|
|
val = int(t, 16) if t.startswith("0x") else int(t)
|
|
except ValueError:
|
|
val = ("RAW", t)
|
|
break
|
|
if m == "XOR" and "ECX,ECX" in ops.upper().replace(" ", ""):
|
|
val = 0
|
|
break
|
|
if m == "CALL":
|
|
break
|
|
if isinstance(val, int):
|
|
found.setdefault(val, []).append((frm, fn, ent))
|
|
else:
|
|
unknown.append((frm, fn, ent, val))
|
|
w(fh, "resolved distinct atoms: %d ; unresolved sites: %d" % (len(found), len(unknown)))
|
|
w(fh, "")
|
|
w(fh, "CONTROLS (must be present): 0x20b=%s 0x369=%s 0x36b=%s 0xc4=%s" % (
|
|
0x20B in found, 0x369 in found, 0x36B in found, 0xC4 in found))
|
|
w(fh, "TARGETS: 0xeb(duplicateItemId)=%s 0xec(duplicateItemIdList)=%s "
|
|
"0xed(duplicateItemLoans)=%s 0x16f(itemLoans)=%s 0x16d(itemId)=%s" % (
|
|
0xEB in found, 0xEC in found, 0xED in found, 0x16F in found, 0x16D in found))
|
|
for t in (0xEB, 0xEC, 0xED, 0x16F, 0x16D):
|
|
if t in found:
|
|
for frm, fn, ent in found[t]:
|
|
w(fh, " atom %#x serialised at %#x in %s @ %#x" % (t, frm, fn, ent))
|
|
w(fh, "")
|
|
w(fh, "-- all resolved atoms, sorted:")
|
|
w(fh, " ".join("%#x" % k for k in sorted(found)))
|
|
w(fh, "")
|
|
w(fh, "-- UNRESOLVED call sites (absence claims must exclude these):")
|
|
for frm, fn, ent, val in unknown:
|
|
w(fh, " %#x in %s @ %#x last=%r" % (frm, fn, ent, val))
|
|
|
|
# ---------------- B: script handler ----------------
|
|
dump(fh, 0x180039FB0, "GetCardDuplicate script handler")
|
|
dump(fh, 0x180039E10, "CONTROL: GetCardCategory script handler")
|
|
|
|
# ---------------- C: who owns the item container ----------------
|
|
w(fh, "")
|
|
w(fh, "=" * 70)
|
|
w(fh, "C. writers/readers of the singleton pointer DAT_1802e6398")
|
|
w(fh, "=" * 70)
|
|
for frm, typ, fn, ent in xrefs_to(0x1802E6398):
|
|
w(fh, " %#x %s in %s @ %#x" % (frm, typ, fn, ent))
|
|
|
|
fh.close()
|
|
print("WROTE", OUT)
|
|
except Exception:
|
|
traceback.print_exc()
|