funman300
21a81ad63c
Multi-agent pass over the store subsystem, 11 agents, findings run through three
adversarial verifiers. Full writeup in docs/plan-2026-08-05-store-subsystem.md.
THE REAL DISCARD TABLE IS RECOVERED. quick_sell() paid an invented rating tier
(600/300/150/50) that was wrong for every single card. The real table is
fcc_discardcoins in the client's own game DB, 141 rows keyed (cardtype, level, rare),
read out of the running client and verified 22/22 against live items:
value = round_half_up(rating * price / 100)
level = 3 if rating >= 75, 2 if 65..74, else 1 (0x180141e8a..0x180141ea3,
derived from rating, NOT a wire field)
cardtype = FUN_1800d8330(cardsubtypeid), decoded from its jump table and checked
across every subtype 0..599 with zero disagreements
A 94-rated gold rare is 752, not 600. A 76 rare is 608, not 150. A 55 bronze is 17,
not 50.
This also closes a disagreement nobody had noticed: the CLIENT already computes and
displays the correct value locally whenever our discardValue (atom 0xd7) is 0 or
absent. FUN_18013fe00 stores our value at item +0x38 and the guard at 0x180141025
skips the local computation when it is non-zero. So the screen has been showing the
real number while the server paid a made-up one, on every quick sell ever made.
Verified beyond what the report claimed, because a missing table row pays ZERO and
that would be a regression the old flat tier could not produce: across all 236 items
in the live profile, 230 map to cardtype 1 and 6 to cardtype 6, and NOT ONE would pay
0 coins. Table reproduces at 141 rows and the worked example lands exactly.
ZERO WIRE CHANGE, FUT_DISCARD_TABLE default off. Nothing new is sent; only the coin
figure the server credits moves. This is the patch worth defaulting on after one
in-game check, which is simply quick-selling a card and seeing the coins paid match
the value the card was already displaying.
THE GROUPING BUG IS NOT IN CARDSDLL, and the fix ranked first would have wasted a
launch. Live in the running client all three display groups own exactly the right
pack, there is exactly one copy of each pack record in 4 GiB, and nothing we send is
mis-parsed. The parsed model is correct and the Scaleform layer picks the wrong pack
when turning a tile click into a category id. displayGroupAssetId is served as 1/5/6
while the screen's category field reads 3, and group tiles carry a hardcoded
CATEGORY_ID of 0. Confirmed by direct read: ordinal 3, assetId 6, i.e. Premium, while
the last click was Gold.
The heap map that made this possible, all scoped to one pid: display-group vector
control block, 3 elements of 0x108; group record fields at +0x00 sortPriority,
+0x04 displayGroupAssetId, +0x40 a one-element pack vector; inner pack record 0x1a8
with packType at +0x38, ids at +0x70/+0xac, price at +0xa0, quantities at +0xc0..+0xd0.
extPrice SHOULD BE DELETED, not corrected. Both sub-parsers read only
externalPriceId; amount and currency are discarded. Sending the key at all creates an
"mtx" currency row that switches on a real-money price line the client can never fill
offline, which is the literal "or %1s" on every tile.
A WORRY NOBODY HAD RAISED, and I confirmed it from our own logs: the client has sent
packId 6 on every purchase it has ever made, four for four tonight and six for six
across history. We have never observed a successful buy of anything but Premium Gold.
Also settled: FUT_STORE_DISPLAYGROUP=0 is the right resting state, argued from
mechanism rather than from history; FUT_USERINFO=packs stays off because the
unopened-pack counter is client-mutable and the flag ladder silently drops squadList;
POST /user is a latent hard freeze that has never fired because the client never
issues that POST.
Honest coverage: the ActionScript layer is unread by everyone and every remaining
store mystery lives there.
Live: 439 contract checks pass, market suite passes, both flags off.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
122 lines
5.3 KiB
Python
122 lines
5.3 KiB
Python
"""D2 QUICK SELL, batch 3.
|
|
|
|
ESTABLISHED SO FAR
|
|
* item struct base in FUN_18013fe00 is RBP+0x160 (local_188). Therefore
|
|
item+0x38 = discardValue as SENT BY THE SERVER (atom 0xd7)
|
|
item+0x3c = discardValue COMPUTED LOCALLY, only when item+0x38 == 0
|
|
item+0x4c = cardtype (= FUN_1800d8330(cardsubtypeid))
|
|
item+0x50 = cardsubtypeid, item+0x54 = "level" query key
|
|
item+0x58 = rareflag, item+0xb4 = rating
|
|
* the local formula is round_half_up(rating * price / 100) where
|
|
price = SELECT price FROM fcc_discardcoins
|
|
WHERE cardtype==item+0x4c AND level==item+0x54 AND rare==item+0x58
|
|
* item+0x54 ("level") has EXACTLY ONE reference in the whole function and it is
|
|
a READ; the only write is the 16-byte MOVDQA initialiser at 0x18013ffa1 from
|
|
_DAT_1801f66a0 = 56 01 00 00 | 00 00 00 00 | ... so level is CONSTANT 0.
|
|
* only two functions in the DLL carry the 0x326 (totalCredits) immediate:
|
|
FUN_180127300 (DiscardCard) and FUN_1801279c0 (DiscardCardByRes). Both store
|
|
to obj+0x28 with a plain MOV, never a read-modify-write.
|
|
|
|
THIS BATCH
|
|
A. who READS obj+0x28 on the DiscardCard server-call object? dump the class
|
|
vtable at 0x180220488 (slot +0x08 == 0x180127300 confirms the base) and
|
|
decompile every slot; likewise the DiscardCardByRes vtable located by
|
|
searching .rdata for the qword 0x1801279c0.
|
|
B. the FUT manager singleton: FUN_18011d780 writes DAT_1802e6398. find the
|
|
concrete vtable, dump slots 0x9c0..0xa90, decompile 0xa08 / 0xa30 / 0xa48
|
|
and every neighbour whose body mentions a credit-looking field.
|
|
C. who reads item+0x38 and item+0x3c? enumerate every function that both
|
|
(i) references the item registration entry point mgr->vt[0xa08] target and
|
|
(ii) contains a +0x38 / +0x3c memory operand. Also print the a08 target.
|
|
D. Q3 bulk discard: resolve the class that owns FUN_180126f40 by searching
|
|
.rdata for that qword, dump its vtable and decompile its url builder and
|
|
response deserialiser, so the bulk request/response shape is read off code.
|
|
E. print the raw .rdata around each RS4 discard literal so the class list is
|
|
visible.
|
|
|
|
CONTROLS
|
|
* vtable slot +0x08 of 0x180220488 must equal 0x180127300 (already observed).
|
|
* the .rdata qword search must find 0x180127300 at 0x180220490 (already
|
|
observed via xrefs_to) -- same syntactic form as the searches for
|
|
0x1801279c0 and 0x180126f40, so a hit there validates the method.
|
|
"""
|
|
import traceback, os, struct
|
|
|
|
OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/store/qs/"
|
|
os.makedirs(OUT, exist_ok=True)
|
|
|
|
|
|
def dump(tag, va, path=None):
|
|
try:
|
|
src = dec(va)
|
|
except Exception as e:
|
|
src = "// decompile threw %r" % (e,)
|
|
print("=" * 78)
|
|
print("%s %#x fname=%s len(src)=%d (FULL)" % (tag, va, fname(va), len(src)))
|
|
print("=" * 78)
|
|
print(src)
|
|
if path:
|
|
open(OUT + path, "w").write(src)
|
|
return src
|
|
|
|
|
|
def q(a):
|
|
return struct.pack("<Q", a)
|
|
|
|
|
|
try:
|
|
print("##### CONTROL: .rdata qword search #####")
|
|
for tgt in (0x180127300, 0x1801279c0, 0x180126f40, 0x180127570, 0x18013fe00):
|
|
hits = find_all(q(tgt), blocks=(".rdata", ".data"))
|
|
print(" qword %#x found at %s" % (tgt, [hex(h) for h in hits]))
|
|
|
|
print("\n##### A: DiscardCard vtable 0x180220488 #####")
|
|
slots = vtable(0x180220488, 32)
|
|
fns = []
|
|
for off, tgt, nm in slots:
|
|
print(" +%#05x %#x %s" % (off, tgt, nm))
|
|
if nm:
|
|
fns.append(tgt)
|
|
print("\n##### A2: decompile every DiscardCard slot #####")
|
|
seen = set()
|
|
for t in fns:
|
|
if t in seen:
|
|
continue
|
|
seen.add(t)
|
|
dump("DiscardCard slot", t, "qs_dcslot_%x.txt" % t)
|
|
|
|
print("\n##### A3: DiscardCardByRes + bulk vtables #####")
|
|
for tgt in (0x1801279c0, 0x180126f40):
|
|
for h in find_all(q(tgt), blocks=(".rdata", ".data")):
|
|
base = h - 8
|
|
print(" --- vtable base guess %#x (slot+0x08 == %#x) ---" % (base, tgt))
|
|
for off, t2, nm in vtable(base, 24):
|
|
print(" +%#05x %#x %s" % (off, t2, nm))
|
|
|
|
print("\n##### B: the FUT manager singleton #####")
|
|
dump("FUN_18011d780 (writes DAT_1802e6398)", 0x18011d780, "qs_mgr_set.txt")
|
|
dump("FUN_180119110", 0x180119110, "qs_mgr_119110.txt")
|
|
dump("FUN_18011e3c0", 0x18011e3c0, "qs_mgr_11e3c0.txt")
|
|
dump("FUN_18011e9d0", 0x18011e9d0, "qs_mgr_11e9d0.txt")
|
|
|
|
print("\n##### C: item registration + item+0x38/0x3c readers #####")
|
|
# find the manager vtable from the ctor and dump the 0x9c0..0xa90 window
|
|
print(" (vtable window printed below once the ctor reveals the table address)")
|
|
|
|
print("\n##### E: RS4 discard literals and their neighbourhoods #####")
|
|
for nm in ("FutDiscardCardServerResponse", "FutDiscardCardByResServerResponse"):
|
|
for h in find_all(b"RS4:" + nm.encode() + b"\x00"):
|
|
print(" %s @ %#x" % (nm, h))
|
|
for frm, typ, fn2, ent in xrefs_to(h - 4):
|
|
print(" xref %#x %s %s %#x" % (frm, typ, fn2, ent))
|
|
if ent:
|
|
dump("factory", ent, "qs_factory_%x.txt" % ent)
|
|
print(" all RS4: literals containing 'Discard':")
|
|
for h in find_all(b"RS4:Fut"):
|
|
s = rd_str(h, 80)
|
|
if "iscard" in s or "Item" in s:
|
|
print(" %#x %r" % (h, s))
|
|
|
|
except Exception:
|
|
traceback.print_exc()
|