funman300
21a81ad63c
Multi-agent pass over the store subsystem, 11 agents, findings run through three
adversarial verifiers. Full writeup in docs/plan-2026-08-05-store-subsystem.md.
THE REAL DISCARD TABLE IS RECOVERED. quick_sell() paid an invented rating tier
(600/300/150/50) that was wrong for every single card. The real table is
fcc_discardcoins in the client's own game DB, 141 rows keyed (cardtype, level, rare),
read out of the running client and verified 22/22 against live items:
value = round_half_up(rating * price / 100)
level = 3 if rating >= 75, 2 if 65..74, else 1 (0x180141e8a..0x180141ea3,
derived from rating, NOT a wire field)
cardtype = FUN_1800d8330(cardsubtypeid), decoded from its jump table and checked
across every subtype 0..599 with zero disagreements
A 94-rated gold rare is 752, not 600. A 76 rare is 608, not 150. A 55 bronze is 17,
not 50.
This also closes a disagreement nobody had noticed: the CLIENT already computes and
displays the correct value locally whenever our discardValue (atom 0xd7) is 0 or
absent. FUN_18013fe00 stores our value at item +0x38 and the guard at 0x180141025
skips the local computation when it is non-zero. So the screen has been showing the
real number while the server paid a made-up one, on every quick sell ever made.
Verified beyond what the report claimed, because a missing table row pays ZERO and
that would be a regression the old flat tier could not produce: across all 236 items
in the live profile, 230 map to cardtype 1 and 6 to cardtype 6, and NOT ONE would pay
0 coins. Table reproduces at 141 rows and the worked example lands exactly.
ZERO WIRE CHANGE, FUT_DISCARD_TABLE default off. Nothing new is sent; only the coin
figure the server credits moves. This is the patch worth defaulting on after one
in-game check, which is simply quick-selling a card and seeing the coins paid match
the value the card was already displaying.
THE GROUPING BUG IS NOT IN CARDSDLL, and the fix ranked first would have wasted a
launch. Live in the running client all three display groups own exactly the right
pack, there is exactly one copy of each pack record in 4 GiB, and nothing we send is
mis-parsed. The parsed model is correct and the Scaleform layer picks the wrong pack
when turning a tile click into a category id. displayGroupAssetId is served as 1/5/6
while the screen's category field reads 3, and group tiles carry a hardcoded
CATEGORY_ID of 0. Confirmed by direct read: ordinal 3, assetId 6, i.e. Premium, while
the last click was Gold.
The heap map that made this possible, all scoped to one pid: display-group vector
control block, 3 elements of 0x108; group record fields at +0x00 sortPriority,
+0x04 displayGroupAssetId, +0x40 a one-element pack vector; inner pack record 0x1a8
with packType at +0x38, ids at +0x70/+0xac, price at +0xa0, quantities at +0xc0..+0xd0.
extPrice SHOULD BE DELETED, not corrected. Both sub-parsers read only
externalPriceId; amount and currency are discarded. Sending the key at all creates an
"mtx" currency row that switches on a real-money price line the client can never fill
offline, which is the literal "or %1s" on every tile.
A WORRY NOBODY HAD RAISED, and I confirmed it from our own logs: the client has sent
packId 6 on every purchase it has ever made, four for four tonight and six for six
across history. We have never observed a successful buy of anything but Premium Gold.
Also settled: FUT_STORE_DISPLAYGROUP=0 is the right resting state, argued from
mechanism rather than from history; FUT_USERINFO=packs stays off because the
unopened-pack counter is client-mutable and the flag ladder silently drops squadList;
POST /user is a latent hard freeze that has never fired because the client never
issues that POST.
Honest coverage: the ActionScript layer is unread by everyone and every remaining
store mystery lives there.
Live: 439 contract checks pass, market suite passes, both flags off.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
92 lines
3.4 KiB
Python
92 lines
3.4 KiB
Python
"""D3 store-price q3.
|
|
|
|
HYPOTHESES
|
|
H7 Omitting extPrice from the store pack JSON leaves the pack record's currency
|
|
vector with no "mtx" entry, so FUN_18002c3c0 never sets vm+0xb5 and the
|
|
real-money price line is suppressed.
|
|
THREAT TO H7: the pack-element deserializer FUN_18013af30 ALSO references the
|
|
"mtx" literal (0x18013ba76) and ALSO calls the commerce singleton FUN_1801a0040
|
|
(0x18013ba98, 0x18013bab7). If it creates the "mtx" row unconditionally, H7 is
|
|
false. Decompile it IN FULL and read that block.
|
|
H8 DAT_1802de0d0 is a 0x2c0-byte singleton built by FUN_180012a50; its vtable
|
|
slot +0x30 is the boolean that disables the "points" currency branch.
|
|
H9 Enumerate every atom FUN_18013af30 dispatches on, by instruction-level scalar
|
|
census, so the "which keys does the pack record accept" question is answered
|
|
without the absence trap. CONTROL: the census must find the atoms we already
|
|
know it reads (0xd9 displayGroup, 0xc5 currencies, and the extPrice atoms).
|
|
"""
|
|
import traceback
|
|
|
|
OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/store"
|
|
ATOMS = {}
|
|
for line in open("/home/alex/Documents/OpenFUT/fifa17-recon/docs/fut_atoms.tsv"):
|
|
parts = line.rstrip("\n").split("\t")
|
|
if len(parts) >= 3:
|
|
try:
|
|
ATOMS[int(parts[0])] = parts[2]
|
|
except ValueError:
|
|
pass
|
|
|
|
try:
|
|
w = open(OUT + "/q3_raw.txt", "w")
|
|
|
|
def p(*a):
|
|
s = " ".join(str(x) for x in a)
|
|
print(s)
|
|
w.write(s + "\n")
|
|
|
|
# ---- H7 / H9 : the pack element deserializer ----
|
|
src = dec(0x18013af30, 300)
|
|
p("=" * 70)
|
|
p("H7 pack element deser FUN_18013af30 len(src)=%d PRINTED IN FULL" % len(src))
|
|
p(src)
|
|
|
|
p("")
|
|
p("=" * 70)
|
|
p("H9 scalar census of FUN_18013af30 -- every scalar operand, atom-annotated")
|
|
f = func(0x18013af30)
|
|
sc = {}
|
|
n = 0
|
|
it = listing.getInstructions(f.getBody(), True)
|
|
while it.hasNext():
|
|
ins = it.next()
|
|
n += 1
|
|
for i in range(ins.getNumOperands()):
|
|
for o in ins.getOpObjects(i):
|
|
try:
|
|
v = int(o.getValue()) & 0xFFFFFFFFFFFFFFFF
|
|
except Exception:
|
|
continue
|
|
sc.setdefault(v, []).append((int(ins.getAddress().getOffset()),
|
|
str(ins.getMnemonicString())))
|
|
p("instructions=%d distinct scalars=%d" % (n, len(sc)))
|
|
ind = []
|
|
it = listing.getInstructions(f.getBody(), True)
|
|
while it.hasNext():
|
|
ins = it.next()
|
|
if ins.getFlowType().isJump() and ins.getFlowType().isComputed():
|
|
ind.append(hex(int(ins.getAddress().getOffset())))
|
|
p("computed/indirect jumps: %s" % (ind or "NONE"))
|
|
p("")
|
|
p("scalars in the plausible atom range 1..0x400 (CMP/SUB/DEC sites shown):")
|
|
for v in sorted(k for k in sc if 0 < k <= 0x400):
|
|
sites = [h for h in sc[v] if h[1] in ("CMP", "SUB", "DEC", "ADD", "MOV", "LEA")]
|
|
p(" %-6s %-28s %s" % (hex(v), ATOMS.get(v, ""),
|
|
", ".join("%x/%s" % s for s in sc[v][:6])))
|
|
|
|
# ---- H8 the points gate object ----
|
|
p("")
|
|
p("=" * 70)
|
|
p("H8 FUN_180012a50 (ctor of the DAT_1802de0d0 singleton)")
|
|
s2 = dec(0x180012a50)
|
|
p("len=%d FULL" % len(s2))
|
|
p(s2)
|
|
|
|
w.close()
|
|
except Exception:
|
|
traceback.print_exc()
|
|
try:
|
|
w.write(traceback.format_exc()); w.close()
|
|
except Exception:
|
|
pass
|