From 105cca1cbebbb4454c68c40baeb5e8a13b28d982 Mon Sep 17 00:00:00 2001 From: funman300 Date: Thu, 2 Jul 2026 18:42:45 -0700 Subject: [PATCH] =?UTF-8?q?docs:=20forcing=20reframes=20gate=20=E2=80=94?= =?UTF-8?q?=20endpoint=20config=20map=20[ctx+0x19c8]=20is=20EMPTY?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Forced nucleusConnectREST() via hook (safe, FIFA survived). It returned 0 and sent nothing because it is actually an ENDPOINT-URL LOOKUP: ctx->vt[0x40] (+0x5057670) looks up key 'nucleusConnectREST' in the config map [ctx+0x19c8], which live memory confirms is EMPTY (buckets null, count 0). FIFA resolves zero hostnames and never fetches config — its only channel is LSX. So the root gate is that the online endpoint config was never loaded; the subsystem is dormant because it has no server URLs. Next: find the map populator + its LSX channel. Co-Authored-By: Claude Fable 5 --- docs/connection-gate-findings.md | 35 ++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/docs/connection-gate-findings.md b/docs/connection-gate-findings.md index 1557da4..f3b998b 100644 --- a/docs/connection-gate-findings.md +++ b/docs/connection-gate-findings.md @@ -1006,3 +1006,38 @@ dynamic probing (the openfut-hook `probe` framework — 8 entry detours + a Virt memory sampler — is reusable) to watch the controller Update's guard value live. Either way this is confirmed to be the multi-month M2 frontier; pre-Blaze infrastructure is proven present, and FIFA sits one activation away from the first Blaze dial. Weigh against [[project_direction_pivot]]. + +--- + +## FORCING EXPERIMENT (2026-07-02) — reframes the gate: the endpoint config map is EMPTY + +Per the user's call, forced the connect via the hook: a background thread called +`nucleusConnectREST()` (FIFA23.exe+0x2861910) directly, 3x, once the ctx chain was valid. +FIFA SURVIVED (self-contained as predicted). Result: **returned 0x0, sent nothing** — no +GetAuthCode on the bridge, no hostname resolved, no Blaze dial. + +**Why — and it corrects the dig-2 reading.** `nucleusConnectREST` is NOT a connect-sender. +Its inner call `ctx->vt[0x40]` (= FIFA23.exe+0x5057670) is a **map lookup**: it looks up the +string key `"nucleusConnectREST"` in the endpoint config map at `[ctx+0x19c8]` and returns the +value, al=1 if found / 0 if not. It returned **0 = key not found**. So `nucleusConnectREST` is +the *endpoint-URL accessor* for the Nucleus-connect REST endpoint; the string is a config KEY. + +**Live memory confirms the map is EMPTY.** `[ctx+0x19c8]` → map object (e.g. 0xbae32f18): +vtable 0x147f79ab8, bucket ptr +0x10 = 0, end/count +0x20 = 0. No entries. So FIFA has **no +online endpoint URLs at all**. + +**And FIFA never tries to load them:** the hook log shows FIFA resolves **zero hostnames** +(no getaddrinfo calls), connects nowhere except LSX, and makes no config fetch. Its only channel +is LSX (which we own). In a live setup the EA App/Origin client fetches the online config and +feeds the endpoint URLs to the SDK; anadius (offline DRM) never does, so the map stays empty. + +**Reframed gate (root cause candidate).** Online can't start because the endpoint config map is +empty — not (only) because a subsystem is dormant; the subsystem is dormant *because it has no +server URLs*. This is more actionable: if we can populate `[ctx+0x19c8]` with endpoint entries +pointing at localhost/our bridge (via the LSX response that normally carries them, or by direct +memory construction), FIFA would have somewhere to connect — to us. Next: find the map's +POPULATOR (who inserts into [ctx+0x19c8]) and its data source/channel. 29 funcs reference ++0x19c8; the map object's own vtable is 0x147f79ab8. Candidates for the config loader: ++0x14153e010, +0x141603fc0, +0x146f5a400 (store sites). This needs the LSX-response→map mapping +or a decompiler. Live-memory + hook-call forcing (openfut-hook `probe`/force) is proven safe and +reusable. Weigh vs [[project_direction_pivot]].