M1 COMPLETE: gate named = GetInternetConnectedState @ anadius64.dll+0x27790

Found without Ghidra, via anadius's LSX command-registration table (handler list
is offset-by-one from the names; verified by +0x27060 = GetProfile). The gate is
GetInternetConnectedState @ anadius64.dll+0x27790: its LSX "connected" attribute
= (byte[+0xCAB1B]||byte[+0xCAB1A]) ? str(+0xAF530) : str(+0xADE64); both flags
default 0 -> reports offline. That is why the client aborts at "connecting".

M1 answers: (1) ProtoSSLConnect not reached (gate upstream); (2) connection-state
function named; (3) single actionable gate (token already provided by anadius
FakeAuth / GoOnline passes). M2 (next session) = make GetInternetConnectedState
report connected, then watch for the real Blaze connect.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/connection-gate-findings.md

@@ -142,3 +142,54 @@ Name the downstream gate. Two complementary routes:
   strings in `FIFA23.exe` to find the FUT online-flow code that issues `GoOnline`
   then waits for the token/status, and decompile it. FIFA isn't ASLR'd, so Ghidra
   addresses (image base `0x140000000`) map 1:1 to our recorded offsets.
+
+---
+
+## M1 COMPLETE — the gate is `GetInternetConnectedState`
+
+Found without Ghidra, by reading anadius's LSX **command-registration** function
+(`anadius64.dll+0x14C0`), which lists every command-name → handler inline. NB the
+`lea rax,[handler]` is **offset by one** from the `lea rdx,[name]` in that listing
+(verified empirically: `+0x27060` decompiles to `GetProfile` — it builds a
+`GetProfileResponse` for persona "fun"). Corrected handler map:
+
+| anadius LSX command | handler (anadius64.dll + …) |
+|---|---|
+| GetProfile | 0x27060 |
+| **GetInternetConnectedState** | **0x27790** |
+| GoOnline | 0x2BB90 |
+| GetAuthCode | 0x2BBC0 |
+
+### The gate, named: `GetInternetConnectedState` @ `anadius64.dll+0x27790`
+It serializes an LSX `InternetConnectedState` response with a `connected`
+attribute whose value is:
+
+```
+connected = (byte[+0xCAB1B] != 0 || byte[+0xCAB1A] != 0) ? str(+0xAF530)
+                                                          : str(+0xADE64)
+```
+
+Both flag bytes **default to 0**, so it reports the offline value (`+0xADE64`).
+That is precisely why the client sits at "connecting to the EA Servers" and falls
+back offline.
+
+### Answers to the three M1 points
+1. **ProtoSSLConnect reached on the abort? NO — gate upstream.** Confirmed.
+2. **The connection-state function:** `GetInternetConnectedState` @
+   `anadius64.dll+0x27790`. Decision = the two-flag branch above.
+3. **Gate count: ONE actionable gate.** The auth token is already satisfied —
+   `GoOnline` (`+0x2BB90`) is called during the attempt and returns success, and
+   anadius provides a fake auth code; the blocker is purely the connection-state.
+   So M2 = make `GetInternetConnectedState` report **connected** (then the game
+   proceeds with its existing token).
+
+### M2 directions (do NOT do this session)
+- Check whether the flags at `+0xCAB1A` / `+0xCAB1B` are settable via anadius
+  config / a hidden option (cheapest flip).
+- Else out-detour `GetInternetConnectedState` in our `version.dll` to force the
+  `+0xAF530` ("connected") path.
+- Then watch for the client to attempt the real Blaze connect (our `connect`
+  redirect + ProtoSSL hook capture the first plaintext — milestone M3).
+- `TODO/CONFIRM`: exact text of the offline/connected value strings
+  (`+0xADE64` / `+0xAF530`); whether any secondary check gates the attempt after
+  the state flips.