funman300
6baa673252
RETRACTION FIRST. The previous commit added itemType to club items on the theory
that it gated ingestion, because player/staff sent it and were resident while
kit/badge/stadium omitted it and were not. Relaunched the client with itemType on
all three: ?type=kit answered total=2 emitted=2, and still no cardtype-7 record.
The correlation was an artefact of the control. Measured read-only over
/proc/PID/mem with full coverage (3605 MiB, nothing skipped): the "resident"
players and staff were all SQUAD members, which arrive via userMassInfo. Players
that appear in /club?type=player but NOT in userMassInfo are not resident either -
0 records for 6 of 6 sampled, 5 with no byte match at all, out of 1966 served.
Residency tracks the ROUTE. /club?type= responses never enter the persistent card
collection, and no value of itemType changes that. itemType is kept as wire
fidelity (every real EA item carries it) and relabelled; its doc no longer claims
to fix anything. The diagnostic KIT_PROBE is removed - it could only have tested
shape hypotheses that this result makes moot.
RECOVERED from the unpacked CardsDLL, no archive extraction, no instrumentation:
Packed kit id, both directions present and agreeing:
id = (teamid << 14) | (year ? (year-1800) << 5 : 0) | kittype
so a kit is addressed by the triple (teamid, year, kittype).
FUN_180033770 answers ONLY for team 130000 - 0x1800d8ab0 is literally
`mov $0x1fbd0,%eax ; ret`. Every other team id falls through to the engine's
catalogue kits, which are the lockable ones.
sub_180033430 writes the tile: NAME = "HOME_SIDE"/"AWAY_SIDE", TYPE = the
localised Kit_type_0 / Kit_type_1 / Kit_type_historical, and LOCKED (always
value 0, never 1). If the queried triple matches NEITHER active triple it
writes NOTHING - which is exactly why one tile rendered "undefined". A missing
write, not a bad string. There is no Kit_type_2.
FUN_1800d73d0 selector 2/3 does `setne dil ; add $0x65,%edi` then compares
itemState: active home = 101, active away = 102, derived arithmetically and
independent of the enum table. year at +0xba is movzbl - a byte INDEX.
Above all of it: FUT_GET_MATCH_KITS_DP (0x7565) handler FUN_1800be6a0 gates on
`cmpb $0x1,0x152(%r14)` and returns early otherwise. KITS_AVAILABLE IS
ctx+0x152. Constructor zeroes it; the only setter is case index 6 (message
0x757a) of the jump table at 0x1800c00d4. Live value is 0, so no kit list is
ever built. 0x757a has no name in CardsDLL and that is bounded, not sloppy: the
registration run ends at 0x7575 with the epilogue immediately after, and 70
other ids resolve from the same table as the positive control.
Tables (audit_fifa17_kits.py, full-table counts): category 2/3/5 -> engine kit
type 0/1/2 with 0 counterexamples against 54/166/145 discriminating keys; the id
band is NOT home/away (band 63 holds 740 home AND 88 third).
Vault: "Kit Selector Data Path.md". cargo test 429 passed 0 failed across the two
crates; clippy -D warnings clean; fmt clean.
78 lines
2.6 KiB
Python
Executable File
78 lines
2.6 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Recover the kit caption/localisation vocabulary from the UNPACKED CardsDLL.
|
|
|
|
Why CardsDLL and not FIFA17.exe: CardsDLL is not packed, so a MISS here is
|
|
meaningful. FIFA17.exe is Denuvo-packed and only partially readable -- a hit
|
|
there is useful, a miss proves nothing. Every run therefore prints a positive
|
|
control first; if the control fails, the run is void and no negative may be
|
|
quoted from it.
|
|
|
|
Usage: python3 cardsdll_kit_strings.py [path-to-CardsDLL]
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import re
|
|
import sys
|
|
|
|
DEFAULT = os.path.expanduser(
|
|
"~/.cache/openfut-investigation/bin/CardsDLL_Win64_retail.dll"
|
|
)
|
|
|
|
# Strings that MUST be present. If any is missing the search is broken.
|
|
CONTROLS = [b"activeHomeKit", b"cardsubtypeid", b"resourceId", b"activeAwayKit"]
|
|
|
|
# The kit caption vocabulary this project has referred to, plus neighbours worth
|
|
# knowing about either way.
|
|
PROBES = [
|
|
b"FUT_UC_KITS", b"TeamName_Abbr15_", b"TeamName_Abbr15", b"TeamName_",
|
|
b"FUT_UC_", b"StadiumName_", b"Badge", b"Stadium",
|
|
b"activeBadge", b"activeBall", b"activeStadium",
|
|
b"kit", b"Kit", b"KIT",
|
|
b"home", b"Home", b"HOME", b"away", b"Away", b"AWAY",
|
|
b"locked", b"Locked", b"LOCKED", b"unlock",
|
|
b"category", b"year", b"teamid", b"teamId",
|
|
b"DataProvider", b"itemData", b"itemType", b"itemState",
|
|
]
|
|
|
|
|
|
def ascii_strings(data, minlen=4):
|
|
for m in re.finditer(rb"[ -~]{%d,}" % minlen, data):
|
|
yield m.start(), m.group()
|
|
|
|
|
|
def main():
|
|
path = sys.argv[1] if len(sys.argv) > 1 else DEFAULT
|
|
data = open(path, "rb").read()
|
|
print(f"{os.path.basename(path)} {len(data)} bytes")
|
|
|
|
print("\n-- positive control (a miss voids every negative below) --")
|
|
ok = True
|
|
for c in CONTROLS:
|
|
n = data.count(c)
|
|
print(f" {c.decode():16s} {n}")
|
|
if n == 0:
|
|
ok = False
|
|
if not ok:
|
|
print(" CONTROL FAILED — do not quote negatives from this run.")
|
|
return 1
|
|
|
|
print("\n-- probe counts --")
|
|
for p in PROBES:
|
|
print(f" {p.decode():18s} {data.count(p)}")
|
|
|
|
# Whole-string table: every standalone string containing kit-ish substrings.
|
|
print("\n-- standalone strings matching kit/team/caption vocabulary --")
|
|
pat = re.compile(rb"(?i)(kit|teamname|abbr|stadiumname|fut_uc|locked|unlock)")
|
|
seen = set()
|
|
for off, s in ascii_strings(data, 5):
|
|
if pat.search(s) and s not in seen:
|
|
seen.add(s)
|
|
print(f" @{off:#08x} {s.decode('latin1')[:110]}")
|
|
print(f" ({len(seen)} distinct)")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|