funman300
dcbef721f2
Adds trade_gate_probe.py (read-only: /proc/<pid>/mem O_RDONLY + pread, slide proven
against the on-disk FNV prologue), extending gate_byte_probe.py to vtable slot
+0x270 exactly as the transfer-market analysis asked for.
Measured: IS_TRADING_ENABLED=1 (was 0 in the Python era), TRADE_PILE_SIZE=100
(was 0), watchListSize=50 (was 0), with four controls reading 1. So every
CardsDLL-supplied input that analysis named as a market blocker is now OPEN, which
the Rust host achieves by construction -- it emits userInfo.feature as {} so the
kill switch at 0x180174f19 never arms, and it already sends pileSizeClientData
keys 2 and 4.
This narrows the Actions-panel question to the exe-side UI script term, and rules
out ownership fields, the gate bytes, the cancel route and the state vocabularies
as candidates -- each on measured or PE-derived evidence rather than inference.
77 lines
2.5 KiB
Python
77 lines
2.5 KiB
Python
#!/usr/bin/env python3
|
|
"""Read the FIFA 17 TRADING gate byte out of the live client. READ-ONLY.
|
|
|
|
Extends tools/gate_byte_probe.py with vtable slot +0x270 (IS_TRADING_ENABLED,
|
|
displacement 0x1fd2e) plus the two pile-size dwords, which the transfer-market
|
|
analysis names as the market screen's CardsDLL-supplied inputs.
|
|
|
|
Opens /proc/<pid>/mem O_RDONLY and preads. Nothing here can write.
|
|
"""
|
|
import os, struct
|
|
|
|
pid = None
|
|
for d in os.listdir('/proc'):
|
|
if d.isdigit():
|
|
try:
|
|
if open('/proc/%s/comm' % d).read().strip() == 'FIFA17.exe':
|
|
pid = int(d)
|
|
break
|
|
except Exception:
|
|
pass
|
|
assert pid, "FIFA17.exe not running"
|
|
|
|
base = None
|
|
for ln in open('/proc/%d/maps' % pid):
|
|
if 'CardsDLL' in ln:
|
|
base = int(ln.split('-')[0], 16)
|
|
assert base, "CardsDLL not mapped (client has not reached Ultimate Team)"
|
|
slide = base - 0x180000000
|
|
|
|
fd = os.open('/proc/%d/mem' % pid, os.O_RDONLY)
|
|
|
|
|
|
def rd(va, n):
|
|
return os.pread(fd, n, va)
|
|
|
|
|
|
# Control: the FNV atom-hash prologue must match the on-disk PE before any other
|
|
# address is trusted.
|
|
pe = open('/mnt/games/FIFA 17/CardsDLL_Win64_retail.dll', 'rb').read()
|
|
|
|
|
|
def f(va):
|
|
return va - 0x180000000 - 0x1000 + 0x400
|
|
|
|
|
|
ok = pe[f(0x180180d00):f(0x180180d00) + 32] == rd(0x180180d00 + slide, 32)
|
|
print("pid=%d slide=%#x FNV control=%s" % (pid, slide, "MATCH" if ok else "MISMATCH"))
|
|
assert ok, "slide not proven; refusing to read further"
|
|
|
|
obj = struct.unpack('<Q', rd(0x1802e6398 + slide, 8))[0]
|
|
vt = struct.unpack('<Q', rd(obj, 8))[0]
|
|
print("model=%#x vtable(static)=%#x" % (obj, vt - slide))
|
|
|
|
SLOTS = [
|
|
(0x270, 'IS_TRADING_ENABLED '),
|
|
(0x2b0, 'IS_FRIENDLY_SEASON '),
|
|
(0x2c8, 'IS_DRAFT_MODE '),
|
|
(0x2e0, 'packOpeningAnimation '),
|
|
]
|
|
print("\n-- gate bytes decoded from their accessor stubs --")
|
|
for off, name in SLOTS:
|
|
slot = struct.unpack('<Q', rd(vt + off, 8))[0]
|
|
stub = rd(slot, 8)
|
|
if stub[:3] == b'\x0f\xb6\x81':
|
|
disp = struct.unpack('<I', stub[3:7])[0]
|
|
val = rd(obj + disp, 1)[0]
|
|
print(" slot +%#05x %s disp=%#x VALUE=%d" % (off, name, disp, val))
|
|
else:
|
|
print(" slot +%#05x %s NOT a movzx stub: %s" % (off, name, stub.hex()))
|
|
|
|
print("\n-- market screen inputs --")
|
|
for disp, name in [(0x1fd1c, 'TRADE_PILE_SIZE'), (0x1fd20, 'watchListSize '),
|
|
(0x1fd2e, 'tradingEnabled '), (0x1fd2f, 'storeEnabled ')]:
|
|
print(" model+%#x %s = %d" % (disp, name, rd(obj + disp, 1)[0]))
|
|
|
|
os.close(fd)
|