funman300/OpenFUT-Bridge
1
0
Fork 0
Code Issues 4 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs: forcing reframes gate — endpoint config map [ctx+0x19c8] is EMPTY

Browse Source 
Forced nucleusConnectREST() via hook (safe, FIFA survived). It returned 0 and
sent nothing because it is actually an ENDPOINT-URL LOOKUP: ctx->vt[0x40]
(+0x5057670) looks up key 'nucleusConnectREST' in the config map [ctx+0x19c8],
which live memory confirms is EMPTY (buckets null, count 0). FIFA resolves zero
hostnames and never fetches config — its only channel is LSX. So the root gate is
that the online endpoint config was never loaded; the subsystem is dormant because
it has no server URLs. Next: find the map populator + its LSX channel.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
funman300
2026-07-02 18:42:45 -07:00
parent 404064f0bb
commit 105cca1cbe
1 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/connection-gate-findings.md
+35
View File
@@ -1006,3 +1006,38 @@ dynamic probing (the openfut-hook `probe` framework — 8 entry detours + a Virt
memory sampler — is reusable) to watch the controller Update's guard value live. Either way this
is confirmed to be the multi-month M2 frontier; pre-Blaze infrastructure is proven present, and
FIFA sits one activation away from the first Blaze dial. Weigh against [[project_direction_pivot]].
---
## FORCING EXPERIMENT (2026-07-02) — reframes the gate: the endpoint config map is EMPTY
Per the user's call, forced the connect via the hook: a background thread called
`nucleusConnectREST()` (FIFA23.exe+0x2861910) directly, 3x, once the ctx chain was valid.
FIFA SURVIVED (self-contained as predicted). Result: **returned 0x0, sent nothing** — no
GetAuthCode on the bridge, no hostname resolved, no Blaze dial.
**Why — and it corrects the dig-2 reading.** `nucleusConnectREST` is NOT a connect-sender.
Its inner call `ctx->vt[0x40]` (= FIFA23.exe+0x5057670) is a **map lookup**: it looks up the
string key `"nucleusConnectREST"` in the endpoint config map at `[ctx+0x19c8]` and returns the
value, al=1 if found / 0 if not. It returned **0 = key not found**. So `nucleusConnectREST` is
the *endpoint-URL accessor* for the Nucleus-connect REST endpoint; the string is a config KEY.
**Live memory confirms the map is EMPTY.** `[ctx+0x19c8]` → map object (e.g. 0xbae32f18):
vtable 0x147f79ab8, bucket ptr +0x10 = 0, end/count +0x20 = 0. No entries. So FIFA has **no
online endpoint URLs at all**.
**And FIFA never tries to load them:** the hook log shows FIFA resolves **zero hostnames**
(no getaddrinfo calls), connects nowhere except LSX, and makes no config fetch. Its only channel
is LSX (which we own). In a live setup the EA App/Origin client fetches the online config and
feeds the endpoint URLs to the SDK; anadius (offline DRM) never does, so the map stays empty.
**Reframed gate (root cause candidate).** Online can't start because the endpoint config map is
empty — not (only) because a subsystem is dormant; the subsystem is dormant *because it has no
server URLs*. This is more actionable: if we can populate `[ctx+0x19c8]` with endpoint entries
pointing at localhost/our bridge (via the LSX response that normally carries them, or by direct
memory construction), FIFA would have somewhere to connect — to us. Next: find the map's
POPULATOR (who inserts into [ctx+0x19c8]) and its data source/channel. 29 funcs reference
+0x19c8; the map object's own vtable is 0x147f79ab8. Candidates for the config loader:
+0x14153e010, +0x141603fc0, +0x146f5a400 (store sites). This needs the LSX-response→map mapping
or a decompiler. Live-memory + hook-call forcing (openfut-hook `probe`/force) is proven safe and
reusable. Weigh vs [[project_direction_pivot]].