funman300
21a81ad63c
Multi-agent pass over the store subsystem, 11 agents, findings run through three
adversarial verifiers. Full writeup in docs/plan-2026-08-05-store-subsystem.md.
THE REAL DISCARD TABLE IS RECOVERED. quick_sell() paid an invented rating tier
(600/300/150/50) that was wrong for every single card. The real table is
fcc_discardcoins in the client's own game DB, 141 rows keyed (cardtype, level, rare),
read out of the running client and verified 22/22 against live items:
value = round_half_up(rating * price / 100)
level = 3 if rating >= 75, 2 if 65..74, else 1 (0x180141e8a..0x180141ea3,
derived from rating, NOT a wire field)
cardtype = FUN_1800d8330(cardsubtypeid), decoded from its jump table and checked
across every subtype 0..599 with zero disagreements
A 94-rated gold rare is 752, not 600. A 76 rare is 608, not 150. A 55 bronze is 17,
not 50.
This also closes a disagreement nobody had noticed: the CLIENT already computes and
displays the correct value locally whenever our discardValue (atom 0xd7) is 0 or
absent. FUN_18013fe00 stores our value at item +0x38 and the guard at 0x180141025
skips the local computation when it is non-zero. So the screen has been showing the
real number while the server paid a made-up one, on every quick sell ever made.
Verified beyond what the report claimed, because a missing table row pays ZERO and
that would be a regression the old flat tier could not produce: across all 236 items
in the live profile, 230 map to cardtype 1 and 6 to cardtype 6, and NOT ONE would pay
0 coins. Table reproduces at 141 rows and the worked example lands exactly.
ZERO WIRE CHANGE, FUT_DISCARD_TABLE default off. Nothing new is sent; only the coin
figure the server credits moves. This is the patch worth defaulting on after one
in-game check, which is simply quick-selling a card and seeing the coins paid match
the value the card was already displaying.
THE GROUPING BUG IS NOT IN CARDSDLL, and the fix ranked first would have wasted a
launch. Live in the running client all three display groups own exactly the right
pack, there is exactly one copy of each pack record in 4 GiB, and nothing we send is
mis-parsed. The parsed model is correct and the Scaleform layer picks the wrong pack
when turning a tile click into a category id. displayGroupAssetId is served as 1/5/6
while the screen's category field reads 3, and group tiles carry a hardcoded
CATEGORY_ID of 0. Confirmed by direct read: ordinal 3, assetId 6, i.e. Premium, while
the last click was Gold.
The heap map that made this possible, all scoped to one pid: display-group vector
control block, 3 elements of 0x108; group record fields at +0x00 sortPriority,
+0x04 displayGroupAssetId, +0x40 a one-element pack vector; inner pack record 0x1a8
with packType at +0x38, ids at +0x70/+0xac, price at +0xa0, quantities at +0xc0..+0xd0.
extPrice SHOULD BE DELETED, not corrected. Both sub-parsers read only
externalPriceId; amount and currency are discarded. Sending the key at all creates an
"mtx" currency row that switches on a real-money price line the client can never fill
offline, which is the literal "or %1s" on every tile.
A WORRY NOBODY HAD RAISED, and I confirmed it from our own logs: the client has sent
packId 6 on every purchase it has ever made, four for four tonight and six for six
across history. We have never observed a successful buy of anything but Premium Gold.
Also settled: FUT_STORE_DISPLAYGROUP=0 is the right resting state, argued from
mechanism rather than from history; FUT_USERINFO=packs stays off because the
unopened-pack counter is client-mutable and the flag ladder silently drops squadList;
POST /user is a latent hard freeze that has never fired because the client never
issues that POST.
Honest coverage: the ActionScript layer is unread by everyone and every remaining
store mystery lives there.
Live: 439 contract checks pass, market suite passes, both flags off.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
85 lines
3.7 KiB
Python
85 lines
3.7 KiB
Python
"""ADVERSARIAL Q1.
|
|
|
|
HYPOTHESIS UNDER ATTACK (dim1 claim 3): "FUN_1800150d0 ... finds-or-creates a group by
|
|
an exact string compare on displayGroup.value", i.e. wire-record +0x00 holds
|
|
displayGroup.value.
|
|
|
|
WHY IT IS NOT PROVEN: live we serve description == displayGroup.value == the SAME
|
|
STRING for all three packs ("Bronze Pack"/"Gold Pack"/"Premium Gold"), so the live
|
|
group caption cannot distinguish displayGroup.value (atom 0xd9->0x377) from
|
|
description (atom 0xd1). If the key is actually `description`, recommendation #2
|
|
(serve displayGroup.value="gold") silently does nothing.
|
|
|
|
METHOD: decompile the 0x158 wire-record element deserializer 0x18013af30 IN FULL,
|
|
print len(src), and enumerate the atom dispatch. Explicitly search the raw
|
|
disassembly of the function for EVERY syntactic dispatch form the brief warns about:
|
|
== imm, != imm, switch case labels (jump table), and sub/dec ladders.
|
|
CONTROL: atom 0x20f (packType) is known-present (live pack model +0x38 = "BRONZE"),
|
|
so whatever form finds packType must also be applied to 0xd1/0xd9/0xda/0x2cb.
|
|
The control uses the SAME method (raw immediate scan over the same instruction
|
|
range), not a different one.
|
|
"""
|
|
import sys, traceback, re
|
|
OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/store/adv/q1_out.txt"
|
|
try:
|
|
fh = open(OUT, "w")
|
|
def P(*a):
|
|
s = " ".join(str(x) for x in a)
|
|
print(s); fh.write(s + "\n")
|
|
|
|
ATOMS = {0x23:"assetId",0xd1:"description",0xd9:"displayGroup",0xda:"displayGroupAssetId",
|
|
0xdb:"displayGroupUseDefaultImage",0x15c:"id",0x20f:"packType",0x250:"priority",
|
|
0x2cb:"sortPriority",0x377:"value",0x36a:"useDefaultImage",0x260:"purchase"}
|
|
|
|
for target in (0x18013af30,):
|
|
f = func(target)
|
|
P("=== FUNCTION %s @ %#x body=%s ===" % (f.getName(), int(f.getEntryPoint().getOffset()), f.getBody()))
|
|
src = dec(target, 300)
|
|
P("len(src) =", len(src))
|
|
P("---- FULL DECOMPILE BEGIN ----")
|
|
P(src)
|
|
P("---- FULL DECOMPILE END ----")
|
|
|
|
# raw instruction scan of the whole function body for every atom immediate
|
|
P()
|
|
P("=== RAW INSTRUCTION SCAN over FUN_18013af30 body: all forms ===")
|
|
f = func(0x18013af30)
|
|
body = f.getBody()
|
|
it = listing.getInstructions(body, True)
|
|
ins = []
|
|
while it.hasNext():
|
|
i = it.next()
|
|
ins.append((int(i.getAddress().getOffset()), str(i.getMnemonicString()), str(i)))
|
|
P("instruction count:", len(ins))
|
|
# collect all immediates appearing anywhere in the text form
|
|
found = {}
|
|
for a, mn, txt in ins:
|
|
for m in re.finditer(r'0x([0-9a-fA-F]+)', txt):
|
|
v = int(m.group(1), 16)
|
|
if v in ATOMS:
|
|
found.setdefault(v, []).append((a, mn, txt))
|
|
for v in sorted(ATOMS):
|
|
lst = found.get(v, [])
|
|
P("atom %#05x %-28s hits=%d" % (v, ATOMS[v], len(lst)))
|
|
for a, mn, txt in lst:
|
|
P(" %#x %s" % (a, txt))
|
|
# dispatch-form census: CMP/SUB/DEC ladders on the atom register
|
|
P()
|
|
P("=== dispatch-form census (CMP/SUB/DEC/SWITCH inside the function) ===")
|
|
forms = {"CMP":0,"SUB":0,"DEC":0,"JMP":0,"SWITCH":0}
|
|
for a, mn, txt in ins:
|
|
if mn in forms: forms[mn]+=1
|
|
if mn == "JMP" and "[" in txt: forms["SWITCH"]+=1
|
|
P(forms)
|
|
P("all CMP with a small immediate (candidate atom compares):")
|
|
for a, mn, txt in ins:
|
|
if mn in ("CMP","SUB","DEC","ADD") :
|
|
m = re.search(r'0x([0-9a-fA-F]{1,4})\s*$', txt)
|
|
if m:
|
|
v=int(m.group(1),16)
|
|
if 0x10 <= v <= 0x400:
|
|
P(" %#x %-8s %s -> imm %#x %s" % (a, mn, txt, v, ATOMS.get(v,"")))
|
|
fh.close()
|
|
except Exception:
|
|
traceback.print_exc()
|