funman300
21a81ad63c
Multi-agent pass over the store subsystem, 11 agents, findings run through three
adversarial verifiers. Full writeup in docs/plan-2026-08-05-store-subsystem.md.
THE REAL DISCARD TABLE IS RECOVERED. quick_sell() paid an invented rating tier
(600/300/150/50) that was wrong for every single card. The real table is
fcc_discardcoins in the client's own game DB, 141 rows keyed (cardtype, level, rare),
read out of the running client and verified 22/22 against live items:
value = round_half_up(rating * price / 100)
level = 3 if rating >= 75, 2 if 65..74, else 1 (0x180141e8a..0x180141ea3,
derived from rating, NOT a wire field)
cardtype = FUN_1800d8330(cardsubtypeid), decoded from its jump table and checked
across every subtype 0..599 with zero disagreements
A 94-rated gold rare is 752, not 600. A 76 rare is 608, not 150. A 55 bronze is 17,
not 50.
This also closes a disagreement nobody had noticed: the CLIENT already computes and
displays the correct value locally whenever our discardValue (atom 0xd7) is 0 or
absent. FUN_18013fe00 stores our value at item +0x38 and the guard at 0x180141025
skips the local computation when it is non-zero. So the screen has been showing the
real number while the server paid a made-up one, on every quick sell ever made.
Verified beyond what the report claimed, because a missing table row pays ZERO and
that would be a regression the old flat tier could not produce: across all 236 items
in the live profile, 230 map to cardtype 1 and 6 to cardtype 6, and NOT ONE would pay
0 coins. Table reproduces at 141 rows and the worked example lands exactly.
ZERO WIRE CHANGE, FUT_DISCARD_TABLE default off. Nothing new is sent; only the coin
figure the server credits moves. This is the patch worth defaulting on after one
in-game check, which is simply quick-selling a card and seeing the coins paid match
the value the card was already displaying.
THE GROUPING BUG IS NOT IN CARDSDLL, and the fix ranked first would have wasted a
launch. Live in the running client all three display groups own exactly the right
pack, there is exactly one copy of each pack record in 4 GiB, and nothing we send is
mis-parsed. The parsed model is correct and the Scaleform layer picks the wrong pack
when turning a tile click into a category id. displayGroupAssetId is served as 1/5/6
while the screen's category field reads 3, and group tiles carry a hardcoded
CATEGORY_ID of 0. Confirmed by direct read: ordinal 3, assetId 6, i.e. Premium, while
the last click was Gold.
The heap map that made this possible, all scoped to one pid: display-group vector
control block, 3 elements of 0x108; group record fields at +0x00 sortPriority,
+0x04 displayGroupAssetId, +0x40 a one-element pack vector; inner pack record 0x1a8
with packType at +0x38, ids at +0x70/+0xac, price at +0xa0, quantities at +0xc0..+0xd0.
extPrice SHOULD BE DELETED, not corrected. Both sub-parsers read only
externalPriceId; amount and currency are discarded. Sending the key at all creates an
"mtx" currency row that switches on a real-money price line the client can never fill
offline, which is the literal "or %1s" on every tile.
A WORRY NOBODY HAD RAISED, and I confirmed it from our own logs: the client has sent
packId 6 on every purchase it has ever made, four for four tonight and six for six
across history. We have never observed a successful buy of anything but Premium Gold.
Also settled: FUT_STORE_DISPLAYGROUP=0 is the right resting state, argued from
mechanism rather than from history; FUT_USERINFO=packs stays off because the
unopened-pack counter is client-mutable and the flag ladder silently drops squadList;
POST /user is a latent hard freeze that has never fired because the client never
issues that POST.
Honest coverage: the ActionScript layer is unread by everyone and every remaining
store mystery lives there.
Live: 439 contract checks pass, market suite passes, both flags off.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
92 lines
3.9 KiB
Python
92 lines
3.9 KiB
Python
"""ADVERSARIAL VERIFY BATCH 3 (namespaced q_zver_* -- another agent is clobbering q_adv_*).
|
|
|
|
Targets:
|
|
T1 dim4: the four claimed duplicateItemIdList consumers really accept atom 0xec and
|
|
really run the identical fixup reading ONLY record qword0 and qword2.
|
|
0x180162880 CreatePack, 0x18013bd40 purchased/massinfo, 0x1801293d0 FutViewCards,
|
|
0x18013e7f0 IS-list.
|
|
Ladder decode (raw instructions, catches sub/dec ladders and reports switch bounds)
|
|
+ full decompile of each.
|
|
T2 dim4: FUN_18009bc40 branches on item+0x10 and suppresses PUT /item when set.
|
|
T3 dim5 claim 12: FUN_1801340e0 is a COPY CONSTRUCTOR of one 0x158 record, not a
|
|
vector-grow with element size 0x108. Full decompile + the tail of FUN_18013af30.
|
|
T4 dim5: pack element record offset rule (0x268 - N) and the 0x35d/0x2e3 nesting.
|
|
CONTROL for the ladder decoder: reproduced {0xeb,0xed,0x16d,0x16f} on 0x180138e10 and
|
|
{0x1f2,0x1f3,0x1f4,0x383} on 0x180142470 and {0x5d,0x1a5,0x2cd,0x2e5,0x36d} on
|
|
0x18014cc60 in batch 2 -- all three are sub/dec ladders, the SAME form as the targets.
|
|
"""
|
|
import traceback
|
|
|
|
|
|
def ladder(entry, note=""):
|
|
f = func(entry)
|
|
if f is None:
|
|
print("!! no function at %#x" % entry)
|
|
return
|
|
print("=" * 90)
|
|
print("### LADDER %#x %s body=%s" % (entry, note, f.getBody()))
|
|
acc = {}
|
|
hits = []
|
|
n = 0
|
|
it = listing.getInstructions(f.getBody(), True)
|
|
while it.hasNext():
|
|
ins = it.next(); n += 1
|
|
m = str(ins.getMnemonicString()).upper()
|
|
a = int(ins.getAddress().getOffset())
|
|
ops = [str(ins.getDefaultOperandRepresentation(i)) for i in range(ins.getNumOperands())]
|
|
def imm(i):
|
|
try:
|
|
sc = ins.getScalar(i)
|
|
return None if sc is None else int(sc.getUnsignedValue())
|
|
except Exception:
|
|
return None
|
|
if m in ("CMP", "SUB", "ADD") and len(ops) == 2:
|
|
v = imm(1)
|
|
if v is not None:
|
|
r = ops[0]
|
|
if m == "CMP":
|
|
hits.append((a, m, r, (acc.get(r, 0) + v) & 0xFFFFFFFF))
|
|
elif m == "SUB":
|
|
acc[r] = (acc.get(r, 0) + v) & 0xFFFFFFFF; hits.append((a, m, r, acc[r]))
|
|
else:
|
|
acc[r] = (acc.get(r, 0) - v) & 0xFFFFFFFF; hits.append((a, m, r, acc[r]))
|
|
elif m in ("DEC", "INC") and len(ops) == 1:
|
|
r = ops[0]
|
|
acc[r] = (acc.get(r, 0) + (1 if m == "DEC" else -1)) & 0xFFFFFFFF
|
|
hits.append((a, m, r, acc[r]))
|
|
elif m == "JMP" and ops and "[" in ops[0]:
|
|
hits.append((a, "SWITCHJMP", ops[0], 0))
|
|
elif m in ("MOV", "MOVZX", "MOVSX", "MOVSXD", "LEA", "XOR", "POP"):
|
|
if ops:
|
|
acc.pop(ops[0], None)
|
|
elif m == "CALL":
|
|
for r in ("EAX", "RAX", "ECX", "RCX", "EDX", "RDX", "R8D", "R9D", "R10D", "R11D"):
|
|
acc.pop(r, None)
|
|
print(" instructions: %d" % n)
|
|
for a, k, r, v in hits:
|
|
if k == "SWITCHJMP":
|
|
print(" %#x SWITCHJMP %s <<< JUMP TABLE, case labels NOT in this list" % (a, r))
|
|
else:
|
|
print(" %#x %-4s %-28s -> atom %#x (%d)" % (a, k, r, v, v))
|
|
|
|
|
|
try:
|
|
for a, t in [(0x180162880, "CreatePack deser"),
|
|
(0x18013bd40, "purchased/massinfo body"),
|
|
(0x1801293d0, "FutViewCards"),
|
|
(0x18013e7f0, "IS-list body")]:
|
|
ladder(a, t)
|
|
print()
|
|
for a, t in [(0x180162880, "CreatePack deser"),
|
|
(0x18013e7f0, "IS-list body"),
|
|
(0x18009bc40, "claimed loan-sign completion"),
|
|
(0x1801340e0, "claimed copy-ctor of 0x158 pack record")]:
|
|
s = dec(a)
|
|
print("=" * 100)
|
|
print("### DECOMPILE %s %#x len=%d" % (t, a, len(s)))
|
|
print("=" * 100)
|
|
print(s)
|
|
print("### END %#x len=%d PRINTED IN FULL" % (a, len(s)))
|
|
except Exception:
|
|
traceback.print_exc()
|