funman300
21a81ad63c
Multi-agent pass over the store subsystem, 11 agents, findings run through three
adversarial verifiers. Full writeup in docs/plan-2026-08-05-store-subsystem.md.
THE REAL DISCARD TABLE IS RECOVERED. quick_sell() paid an invented rating tier
(600/300/150/50) that was wrong for every single card. The real table is
fcc_discardcoins in the client's own game DB, 141 rows keyed (cardtype, level, rare),
read out of the running client and verified 22/22 against live items:
value = round_half_up(rating * price / 100)
level = 3 if rating >= 75, 2 if 65..74, else 1 (0x180141e8a..0x180141ea3,
derived from rating, NOT a wire field)
cardtype = FUN_1800d8330(cardsubtypeid), decoded from its jump table and checked
across every subtype 0..599 with zero disagreements
A 94-rated gold rare is 752, not 600. A 76 rare is 608, not 150. A 55 bronze is 17,
not 50.
This also closes a disagreement nobody had noticed: the CLIENT already computes and
displays the correct value locally whenever our discardValue (atom 0xd7) is 0 or
absent. FUN_18013fe00 stores our value at item +0x38 and the guard at 0x180141025
skips the local computation when it is non-zero. So the screen has been showing the
real number while the server paid a made-up one, on every quick sell ever made.
Verified beyond what the report claimed, because a missing table row pays ZERO and
that would be a regression the old flat tier could not produce: across all 236 items
in the live profile, 230 map to cardtype 1 and 6 to cardtype 6, and NOT ONE would pay
0 coins. Table reproduces at 141 rows and the worked example lands exactly.
ZERO WIRE CHANGE, FUT_DISCARD_TABLE default off. Nothing new is sent; only the coin
figure the server credits moves. This is the patch worth defaulting on after one
in-game check, which is simply quick-selling a card and seeing the coins paid match
the value the card was already displaying.
THE GROUPING BUG IS NOT IN CARDSDLL, and the fix ranked first would have wasted a
launch. Live in the running client all three display groups own exactly the right
pack, there is exactly one copy of each pack record in 4 GiB, and nothing we send is
mis-parsed. The parsed model is correct and the Scaleform layer picks the wrong pack
when turning a tile click into a category id. displayGroupAssetId is served as 1/5/6
while the screen's category field reads 3, and group tiles carry a hardcoded
CATEGORY_ID of 0. Confirmed by direct read: ordinal 3, assetId 6, i.e. Premium, while
the last click was Gold.
The heap map that made this possible, all scoped to one pid: display-group vector
control block, 3 elements of 0x108; group record fields at +0x00 sortPriority,
+0x04 displayGroupAssetId, +0x40 a one-element pack vector; inner pack record 0x1a8
with packType at +0x38, ids at +0x70/+0xac, price at +0xa0, quantities at +0xc0..+0xd0.
extPrice SHOULD BE DELETED, not corrected. Both sub-parsers read only
externalPriceId; amount and currency are discarded. Sending the key at all creates an
"mtx" currency row that switches on a real-money price line the client can never fill
offline, which is the literal "or %1s" on every tile.
A WORRY NOBODY HAD RAISED, and I confirmed it from our own logs: the client has sent
packId 6 on every purchase it has ever made, four for four tonight and six for six
across history. We have never observed a successful buy of anything but Premium Gold.
Also settled: FUT_STORE_DISPLAYGROUP=0 is the right resting state, argued from
mechanism rather than from history; FUT_USERINFO=packs stays off because the
unopened-pack counter is client-mutable and the flag ladder silently drops squadList;
POST /user is a latent hard freeze that has never fired because the client never
issues that POST.
Honest coverage: the ActionScript layer is unread by everyone and every remaining
store mystery lives there.
Live: 439 contract checks pass, market suite passes, both flags off.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
163 lines
7.4 KiB
Python
163 lines
7.4 KiB
Python
"""D2 QUICK SELL ECONOMY, batch 1.
|
|
|
|
HYPOTHESIS (from an earlier agent's decompile of the shared ITEM element deser
|
|
FUN_18013fe00, scratchpad/packres/d4_item_deser.txt lines 779-801): the client
|
|
computes a card's quick-sell value LOCALLY, from a game-database table called
|
|
"fcc_discardcoins", ONLY when the server-sent discardValue (atom 0xd7) is zero:
|
|
|
|
if ((int)local_150 == 0) { // discardValue not sent / 0
|
|
q = select "price" from "fcc_discardcoins"
|
|
where cardtype = local_13c // = f(cardsubtypeid)
|
|
and level = local_138._4_4_
|
|
and <DAT_18022315c> = uStack_130 & 0xffffffff // = rareflag
|
|
p = q.row0["price"]
|
|
v = (rating * p) / 100, round half up at remainder > 0x31
|
|
local_150.hi = v
|
|
}
|
|
|
|
QUESTIONS THIS BATCH ANSWERS
|
|
A. what is the string at DAT_18022315c (the third query key)?
|
|
B. where does "level" (local_138._4_4_) come from? no JSON atom in the switch
|
|
writes it, so read the RAW INSTRUCTIONS, not the decompiler's locals.
|
|
C. what is FUN_1800d8330 (cardsubtypeid -> cardtype)?
|
|
D. what are the db-query wrapper functions 0x1801a0020 / 0x18019fd10 /
|
|
0x18019fd40 / 0x1801a0280 / 0x1801a0000 / 0x18019ff00 / 0x18019ffc0 /
|
|
0x18019fea0 / 0x1801a00a0 / 0x1801a0080 / 0x18019fe40 / 0x18019fe10,
|
|
i.e. confirm this really is a SELECT col FROM table WHERE k=v chain, and
|
|
find the underlying dbdata entry point so the table can be located live.
|
|
E. Q2: FutDiscardCardServerResponse deser 0x180127300 stores totalCredits at
|
|
resp+0x28. WHO reads resp+0x28, and does it ASSIGN or ACCUMULATE?
|
|
F. Q3: bulk discard. FUN_180126f40 builds a body {"itemId":[...]} (atom 0x16d).
|
|
which action/route uses it? print its callers and their callers.
|
|
|
|
CONTROLS
|
|
* class_deser is known-broken in rebuilt projects, so classes are resolved with
|
|
find_all(b"RS4:" + name). CONTROL: RS4:FutSquadSaveServerResponse must be
|
|
found exactly once at 0x18022c618 (measured on disk this session). If that
|
|
fails the whole batch is suspect.
|
|
* CONTROL for the atom-arm search: the ITEM deser must contain an arm for atom
|
|
0x274 (rating) AND one for 0xd7 (discardValue); both are switch-case labels,
|
|
the same syntactic form as anything else searched for here.
|
|
|
|
Everything is printed in full with len() stated. Nothing is truncated.
|
|
"""
|
|
import traceback, os
|
|
|
|
OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/store/qs/"
|
|
os.makedirs(OUT, exist_ok=True)
|
|
|
|
|
|
def dump(tag, va, path=None):
|
|
try:
|
|
src = dec(va)
|
|
except Exception as e:
|
|
src = "// decompile threw %r" % (e,)
|
|
print("=" * 78)
|
|
print("%s %#x fname=%s len(src)=%d (FULL, NOT TRUNCATED)"
|
|
% (tag, va, fname(va), len(src)))
|
|
print("=" * 78)
|
|
print(src)
|
|
if path:
|
|
open(OUT + path, "w").write("// %s %#x len=%d\n%s" % (tag, va, len(src), src))
|
|
return src
|
|
|
|
|
|
def disasm(lo, hi, tag):
|
|
print("-" * 78)
|
|
print("ASM %s %#x..%#x" % (tag, lo, hi))
|
|
print("-" * 78)
|
|
a = addr(lo)
|
|
while int(a.getOffset()) < hi:
|
|
ins = listing.getInstructionAt(a)
|
|
if ins is None:
|
|
a = a.add(1)
|
|
continue
|
|
print("%#x %s" % (int(a.getOffset()), str(ins)))
|
|
a = ins.getAddress().add(ins.getLength())
|
|
|
|
|
|
try:
|
|
print("##### CONTROL 0: RS4 literal lookup #####")
|
|
for nm in ("FutSquadSaveServerResponse", "FutDiscardCardServerResponse",
|
|
"FutDiscardCardByResServerResponse", "FutDiscardACardServerResponse"):
|
|
h = find_all(b"RS4:" + nm.encode() + b"\x00")
|
|
print(" RS4:%-40s hits=%s" % (nm, [hex(x) for x in h]))
|
|
|
|
print("\n##### A: strings used by the discardcoins query #####")
|
|
for nm, a in (("DAT_18022315c", 0x18022315c), ("fcc_discardcoins_lit", 0x1802231f0),
|
|
("DAT_1801eeeb0", 0x1801eeeb0), ("DAT_1802ef590", 0x1802ef590)):
|
|
try:
|
|
print(" %-22s %#x -> %r bytes=%s"
|
|
% (nm, a, rd_str(a, 64), read_bytes(a, 24).hex()))
|
|
except Exception as e:
|
|
print(" %-22s %#x -> ERR %r" % (nm, a, e))
|
|
# neighbourhood of the literal pool so column names are visible
|
|
try:
|
|
blob = read_bytes(0x180223100, 0x200)
|
|
print(" literal pool 0x180223100..0x180223300:")
|
|
for piece in blob.split(b"\x00"):
|
|
if len(piece) >= 3:
|
|
print(" %r" % piece)
|
|
except Exception as e:
|
|
print(" pool ERR %r" % e)
|
|
try:
|
|
print(" _DAT_1801f66a0 16 bytes = %s" % read_bytes(0x1801f66a0, 16).hex())
|
|
except Exception as e:
|
|
print(" _DAT_1801f66a0 ERR %r" % e)
|
|
|
|
print("\n##### B: raw instructions of the discardcoins block in the ITEM deser #####")
|
|
# the query build sits after atom dispatch; xref to the literal pins it
|
|
for frm, typ, fn, ent in xrefs_to(0x1802231f0):
|
|
print(" xref to fcc_discardcoins literal: from %#x %s in %s (%#x)"
|
|
% (frm, typ, fn, ent))
|
|
disasm(0x180140f80, 0x1801411e0, "item deser: discardcoins query build")
|
|
|
|
print("\n##### B2: every write to the two stack slots feeding cardtype/level #####")
|
|
print(" (searching the whole ITEM deser for MOV [RBP+..] style stores is noisy;")
|
|
print(" instead: full decompile is dumped to disk, and the asm above is authoritative)")
|
|
dump("ITEM element deser FUN_18013fe00", 0x18013fe00, "qs_item_deser.txt")
|
|
|
|
print("\n##### C: cardsubtypeid -> cardtype #####")
|
|
dump("FUN_1800d8330 cardsubtype->cardtype", 0x1800d8330, "qs_d8330.txt")
|
|
dump("FUN_1800d84e0", 0x1800d84e0, "qs_d84e0.txt")
|
|
|
|
print("\n##### D: the db query wrapper chain #####")
|
|
for a in (0x1801a0020, 0x18019fd10, 0x18019fd40, 0x1801a0280, 0x1801a0000,
|
|
0x18019ff00, 0x18019ffc0, 0x18019fea0, 0x1801a00a0, 0x1801a0080,
|
|
0x18019fe40, 0x18019fe10):
|
|
dump("dbquery %#x" % a, a, "qs_db_%x.txt" % a)
|
|
|
|
print("\n##### E: discard response consumers #####")
|
|
dump("FutDiscardCard deser FUN_180127300", 0x180127300, "qs_discard_deser.txt")
|
|
dump("FUN_1800d7af0 (int conv used on totalCredits)", 0x1800d7af0, "qs_d7af0.txt")
|
|
print(" --- callers of the discard deser / its owning class ---")
|
|
for frm, typ, fn, ent in xrefs_to(0x180127300):
|
|
print(" xref %#x %s %s %#x" % (frm, typ, fn, ent))
|
|
# the singleton FUN_18011a830 vtable: slot 0xa30 removes an item; find the
|
|
# credits setter near it
|
|
dump("singleton getter FUN_18011a830", 0x18011a830, "qs_singleton.txt")
|
|
|
|
print("\n##### F: bulk discard #####")
|
|
dump("bulk discard body builder FUN_180126f40", 0x180126f40, "qs_bulkbody.txt")
|
|
dump("single discard url builder FUN_180127570", 0x180127570, "qs_urlbuild.txt")
|
|
for a in (0x180126f40, 0x180127570):
|
|
print(" --- xrefs to %#x ---" % a)
|
|
for frm, typ, fn, ent in xrefs_to(a):
|
|
print(" %#x %s %s %#x" % (frm, typ, fn, ent))
|
|
if ent:
|
|
for f2, t2, n2, e2 in xrefs_to(ent):
|
|
print(" ^ %#x %s %s %#x" % (f2, t2, n2, e2))
|
|
|
|
print("\n##### F2: action table rows for the three discard actions #####")
|
|
for nm, rowa in (("DiscardCard", 0x1802cb230), ("DiscardCardByRes", 0x1802cb260),
|
|
("DiscardACard", 0x1802cb290)):
|
|
try:
|
|
print(" %s row %#x bytes=%s" % (nm, rowa, read_bytes(rowa, 0x30).hex()))
|
|
except Exception as e:
|
|
print(" %s ERR %r" % (nm, e))
|
|
for frm, typ, fn, ent in xrefs_to(rowa):
|
|
print(" xref %#x %s %s %#x" % (frm, typ, fn, ent))
|
|
|
|
except Exception:
|
|
traceback.print_exc()
|