funman300
21a81ad63c
Multi-agent pass over the store subsystem, 11 agents, findings run through three
adversarial verifiers. Full writeup in docs/plan-2026-08-05-store-subsystem.md.
THE REAL DISCARD TABLE IS RECOVERED. quick_sell() paid an invented rating tier
(600/300/150/50) that was wrong for every single card. The real table is
fcc_discardcoins in the client's own game DB, 141 rows keyed (cardtype, level, rare),
read out of the running client and verified 22/22 against live items:
value = round_half_up(rating * price / 100)
level = 3 if rating >= 75, 2 if 65..74, else 1 (0x180141e8a..0x180141ea3,
derived from rating, NOT a wire field)
cardtype = FUN_1800d8330(cardsubtypeid), decoded from its jump table and checked
across every subtype 0..599 with zero disagreements
A 94-rated gold rare is 752, not 600. A 76 rare is 608, not 150. A 55 bronze is 17,
not 50.
This also closes a disagreement nobody had noticed: the CLIENT already computes and
displays the correct value locally whenever our discardValue (atom 0xd7) is 0 or
absent. FUN_18013fe00 stores our value at item +0x38 and the guard at 0x180141025
skips the local computation when it is non-zero. So the screen has been showing the
real number while the server paid a made-up one, on every quick sell ever made.
Verified beyond what the report claimed, because a missing table row pays ZERO and
that would be a regression the old flat tier could not produce: across all 236 items
in the live profile, 230 map to cardtype 1 and 6 to cardtype 6, and NOT ONE would pay
0 coins. Table reproduces at 141 rows and the worked example lands exactly.
ZERO WIRE CHANGE, FUT_DISCARD_TABLE default off. Nothing new is sent; only the coin
figure the server credits moves. This is the patch worth defaulting on after one
in-game check, which is simply quick-selling a card and seeing the coins paid match
the value the card was already displaying.
THE GROUPING BUG IS NOT IN CARDSDLL, and the fix ranked first would have wasted a
launch. Live in the running client all three display groups own exactly the right
pack, there is exactly one copy of each pack record in 4 GiB, and nothing we send is
mis-parsed. The parsed model is correct and the Scaleform layer picks the wrong pack
when turning a tile click into a category id. displayGroupAssetId is served as 1/5/6
while the screen's category field reads 3, and group tiles carry a hardcoded
CATEGORY_ID of 0. Confirmed by direct read: ordinal 3, assetId 6, i.e. Premium, while
the last click was Gold.
The heap map that made this possible, all scoped to one pid: display-group vector
control block, 3 elements of 0x108; group record fields at +0x00 sortPriority,
+0x04 displayGroupAssetId, +0x40 a one-element pack vector; inner pack record 0x1a8
with packType at +0x38, ids at +0x70/+0xac, price at +0xa0, quantities at +0xc0..+0xd0.
extPrice SHOULD BE DELETED, not corrected. Both sub-parsers read only
externalPriceId; amount and currency are discarded. Sending the key at all creates an
"mtx" currency row that switches on a real-money price line the client can never fill
offline, which is the literal "or %1s" on every tile.
A WORRY NOBODY HAD RAISED, and I confirmed it from our own logs: the client has sent
packId 6 on every purchase it has ever made, four for four tonight and six for six
across history. We have never observed a successful buy of anything but Premium Gold.
Also settled: FUT_STORE_DISPLAYGROUP=0 is the right resting state, argued from
mechanism rather than from history; FUT_USERINFO=packs stays off because the
unopened-pack counter is client-mutable and the flag ladder silently drops squadList;
POST /user is a latent hard freeze that has never fired because the client never
issues that POST.
Honest coverage: the ActionScript layer is unread by everyone and every remaining
store mystery lives there.
Live: 439 contract checks pass, market suite passes, both flags off.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
90 lines
3.5 KiB
Python
90 lines
3.5 KiB
Python
"""DIMENSION 4 (duplicates), pass 5: EXHAUSTIVE census of readers of the item
|
|
model's duplicate field (item+0x10).
|
|
|
|
WHY EXHAUSTIVE. Pass 2 found the field surfaced as the Scaleform bool
|
|
HAS_DUPLICATE at two sites. A bounded search cannot prove that is the only
|
|
consumer, and this project has been bitten four times by absence claims from
|
|
narrow searches. So: decompile EVERY function in the binary and match text.
|
|
|
|
MATCHERS (deliberately two independent ones, plus a control):
|
|
M1 "nested +0x10" regex: the idiom every known site uses, an item pointer
|
|
loaded out of a 0x18-byte list node at node+0x10, then dereferenced at
|
|
+0x10. e.g. *(longlong *)(*(longlong *)(lVar10 + 0x10) + 0x10)
|
|
M2 "item-shaped struct" heuristic: a function that mentions at least THREE of
|
|
the known item offsets (+0x18 resourceId, +0x50 cardsubtype, +0x5c state,
|
|
+0x8c timesWon, +0x90 loans) AND also mentions "+ 0x10".
|
|
CONTROL: the three sites already known by hand MUST appear --
|
|
0x180162880 / 0x18013bd40 / 0x1801293d0 / 0x18013e7f0 (writers) and
|
|
0x180043880 / 0x180094220 (readers). If any is missed, the matcher is
|
|
broken and no absence conclusion may be drawn from this pass.
|
|
|
|
Output is written incrementally so a timeout still leaves usable results.
|
|
"""
|
|
import re, traceback, time
|
|
|
|
OUT = "/tmp/claude-1000/-home-alex-Documents-OpenFUT/8e521ca1-ca3e-4138-bb96-df1744dd1d30/scratchpad/store/dup5_out.txt"
|
|
|
|
M1 = re.compile(r"\*\(longlong \*\)\(\*\(longlong \*\)\([^;\n]{0,80}?\) \+ 0x10\)")
|
|
ITEMOFF = ("+ 0x18)", "+ 0x50)", "+ 0x5c)", "+ 0x8c)", "+ 0x90)")
|
|
CONTROLS = [0x180162880, 0x18013BD40, 0x1801293D0, 0x18013E7F0, 0x180043880, 0x180094220]
|
|
|
|
try:
|
|
fh = open(OUT, "w")
|
|
t0 = time.time()
|
|
funcs = []
|
|
it = fm.getFunctions(True)
|
|
while it.hasNext():
|
|
f = it.next()
|
|
funcs.append(f)
|
|
fh.write("total functions: %d\n" % len(funcs))
|
|
fh.flush()
|
|
|
|
m1_hits = []
|
|
m2_hits = []
|
|
n = 0
|
|
for f in funcs:
|
|
n += 1
|
|
ent = int(f.getEntryPoint().getOffset())
|
|
try:
|
|
s = dec(ent, timeout=25)
|
|
except Exception:
|
|
fh.write("DECOMPILE-ERROR %#x\n" % ent)
|
|
continue
|
|
if s.startswith("// decompile failed") or s.startswith("// no function"):
|
|
fh.write("DECOMPILE-FAILED %#x\n" % ent)
|
|
continue
|
|
ms = M1.findall(s)
|
|
if ms:
|
|
m1_hits.append((ent, f.getName(), ms))
|
|
k = sum(1 for o in ITEMOFF if o in s)
|
|
if k >= 3 and "+ 0x10" in s:
|
|
m2_hits.append((ent, f.getName(), k))
|
|
if n % 500 == 0:
|
|
fh.write("... %d/%d %.0fs m1=%d m2=%d\n" % (n, len(funcs), time.time() - t0,
|
|
len(m1_hits), len(m2_hits)))
|
|
fh.flush()
|
|
|
|
fh.write("\nSWEPT %d functions in %.0fs\n" % (n, time.time() - t0))
|
|
|
|
fh.write("\n=== CONTROL CHECK ===\n")
|
|
m1set = set(a for a, _, _ in m1_hits)
|
|
m2set = set(a for a, _, _ in m2_hits)
|
|
for c in CONTROLS:
|
|
fh.write(" %#x M1=%s M2=%s\n" % (c, c in m1set, c in m2set))
|
|
|
|
fh.write("\n=== M1 hits (nested +0x10 idiom): %d functions ===\n" % len(m1_hits))
|
|
for ent, nm, ms in m1_hits:
|
|
fh.write(" %#x %s : %d match(es)\n" % (ent, nm, len(ms)))
|
|
for m in ms[:12]:
|
|
fh.write(" %s\n" % m)
|
|
|
|
fh.write("\n=== M2 hits (item-shaped struct, >=3 known item offsets + 0x10): %d ===\n"
|
|
% len(m2_hits))
|
|
for ent, nm, k in m2_hits:
|
|
fh.write(" %#x %s (%d/5 offsets)\n" % (ent, nm, k))
|
|
|
|
fh.close()
|
|
print("WROTE", OUT)
|
|
except Exception:
|
|
traceback.print_exc()
|