funman300/OpenFUT-Bridge
1
0
Fork 0
Code Issues 4 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Initial commit: OpenFUT Bridge

Browse Source 
FIFA 23 reverse-engineering proxy and integration scaffold.

- Catch-all HTTP proxy that captures all incoming FIFA 23 traffic
- Known-route mapper (speculative FUT paths → Core API calls)
- Placeholder JSON responses for unmapped endpoints
- Admin endpoints: GET /_bridge/captures, GET /_bridge/unknown
- Capture persistence to captures/*.json for RE analysis
- 4 unit tests passing

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
funman300
2026-06-25 15:09:47 -07:00
commit a826e5f7d3
19 changed files with 2897 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/endpoint-map.md
+64
View File
@@ -0,0 +1,64 @@
# FUT → OpenFUT Core Endpoint Map
This document maps confirmed or suspected FIFA 23 FUT API endpoints to their OpenFUT Core equivalents.
## Legend
- ✅ Confirmed + implemented
- 🟡 Suspected — implemented with placeholder
- ❌ Unknown — not yet mapped
---
## Auth
| FUT Endpoint | Core Endpoint | Status | Notes |
|---|---|---|---|
| `POST /ut/auth` | `POST /auth/local` | 🟡 | EA OAuth flow → local profile creation |
## Profile / Club
| FUT Endpoint | Core Endpoint | Status | Notes |
|---|---|---|---|
| `GET /ut/game/fut/user/settings` | `GET /profile` | 🟡 | |
| `GET /ut/game/fut/usermassinfo` | `GET /club` | 🟡 | EA bulk endpoint |
## Squad
| FUT Endpoint | Core Endpoint | Status | Notes |
|---|---|---|---|
| `GET /ut/game/fut/squad/active` | `GET /squad` | 🟡 | |
| `PUT /ut/game/fut/squad/active` | `POST /squad` | ❌ | |
## Packs
| FUT Endpoint | Core Endpoint | Status | Notes |
|---|---|---|---|
| `GET /ut/game/fut/store/packdetails` | `GET /packs` | 🟡 | |
| `POST /ut/game/fut/pack/buy` | `POST /packs/open/:id` | ❌ | |
## Transfer Market
| FUT Endpoint | Core Endpoint | Status | Notes |
|---|---|---|---|
| `GET /ut/game/fut/transfermarket` | `GET /market` | 🟡 | |
| `DELETE /ut/game/fut/trade/:id` | `POST /market/sell` | ❌ | |
## Matches / Seasons
| FUT Endpoint | Core Endpoint | Status | Notes |
|---|---|---|---|
| Unknown | `POST /matches/result` | ❌ | Needs capture |
## Objectives
| FUT Endpoint | Core Endpoint | Status | Notes |
|---|---|---|---|
| Unknown | `GET /objectives` | ❌ | Needs capture |
## SBCs
| FUT Endpoint | Core Endpoint | Status | Notes |
|---|---|---|---|
| Unknown | `GET /sbc` | ❌ | Needs capture |
| Unknown | `POST /sbc/submit` | ❌ | Needs capture |
docs/reverse-engineering.md
+85
View File
@@ -0,0 +1,85 @@
# Reverse Engineering Notes — FIFA 23 FUT API
This document tracks what is known and unknown about EA's FUT API as used by FIFA 23.
---
## Status
🔴 Very early — almost nothing confirmed. All mappings in `src/mapper.rs` are speculative.
---
## Known / Suspected Endpoints
These are guesses based on:
- Common FUT API patterns from public research
- Observations from older FIFA titles
- Community reverse-engineering work
| Method | Path | Purpose | Status |
|---|---|---|---|
| `POST` | `/ut/auth` | Authentication / session | Suspected |
| `GET` | `/ut/game/fut/user/settings` | User settings | Suspected |
| `GET` | `/ut/game/fut/usermassinfo` | Club + profile bulk | Suspected |
| `GET` | `/ut/game/fut/squad/active` | Active squad | Suspected |
| `GET` | `/ut/game/fut/store/packdetails` | Pack store | Suspected |
| `GET` | `/ut/game/fut/transfermarket` | Transfer market | Suspected |
---
## Unknown Endpoints
Run `GET /_bridge/unknown` after a game session to see what new routes appeared.
Each entry represents a real FIFA 23 request that hasn't been mapped yet.
---
## Request Format Notes
### Auth
EA FUT auth appears to use a multi-step token flow:
1. EA account auth (OAuth2-style)
2. FUT-specific auth with a "nucleus ID"
3. Session token issued
For offline purposes, OpenFUT Bridge returns a static token that satisfies the client.
### Headers
Common headers seen in FUT traffic:
- `X-UT-SID` — session token
- `X-UT-PHISHING-TOKEN` — anti-CSRF token
- `Content-Type: application/json`
- `X-HTTP-Method-Override` — EA sometimes uses POST + this header instead of DELETE/PUT
---
## Tools
- [mitmproxy](https://mitmproxy.org/) — HTTPS interception
- [Fiddler](https://www.telerik.com/fiddler) — Windows-friendly proxy
- Wireshark — low-level packet capture
- OpenFUT Bridge `captures/` folder — automatic request logging
---
## Resources
- Previous FIFA FUT API research: search GitHub for "fifa-ut-api", "easfc", "futapi"
- ea.com documentation: none public
- Community wikis: FUT Trading community resources
---
## TODO
- [ ] Capture a real FIFA 23 session via mitmproxy
- [ ] Document the auth flow completely
- [ ] Map the squad endpoints
- [ ] Map the pack opening endpoints
- [ ] Map the objectives endpoints
- [ ] Map the SBC endpoints
- [ ] Map the transfer market endpoints
- [ ] Identify which endpoints are critical vs optional
docs/setup-notes.md
+92
View File
@@ -0,0 +1,92 @@
# Proxy Setup Notes
Research notes for routing FIFA 23 traffic through OpenFUT Bridge.
---
## Goal
Intercept all FUT API calls from FIFA 23 so the Bridge can:
1. Log every request for reverse engineering
2. Route known endpoints to OpenFUT Core
3. Return placeholder responses for the rest
---
## PC (FIFA 23 via EA App / Steam)
### Option A: Windows hosts file
Redirect `utas.fut.ea.com` and related domains to localhost.
```
# C:\Windows\System32\drivers\etc\hosts
127.0.0.1 utas.fut.ea.com
127.0.0.1 utas2.fut.ea.com
127.0.0.1 ea.com
```
The Bridge must listen on port 443 (HTTPS) or 80 (HTTP).
FIFA 23 expects HTTPS — you'll need a self-signed cert and need to trust it.
### Option B: mitmproxy
1. Install mitmproxy
2. Set Windows system proxy to 127.0.0.1:8080
3. Configure mitmproxy to forward FUT traffic to Bridge
```bash
mitmproxy --mode transparent \
--listen-host 127.0.0.1 \
--listen-port 8080
```
⚠️ FIFA 23 may use certificate pinning — this is unconfirmed. If pinning is active, the hosts file approach or a traffic-level redirect may be needed instead.
---
## RPCS3 (PS3 emulator)
RPCS3 has built-in network settings:
1. Open RPCS3 → Configuration → Network
2. Set DNS to point to your OpenFUT Bridge IP
3. Configure `PSN Status` to `RPCN` or custom
4. The Bridge intercepts DNS and HTTP/HTTPS traffic
Research needed: RPCS3 FIFA 23 title ID and specific network behavior.
---
## Certificate Handling
EA's FUT API uses HTTPS. Options:
1. **Self-signed cert** — generate with `openssl` and add to system trust store
2. **HTTP downgrade** — if the client accepts HTTP (unlikely for production)
3. **Traffic-level redirect** — use iptables/nftables to redirect port 443 traffic
4. **No cert** — if FIFA 23 PC doesn't verify certs (to be tested)
### Generating a self-signed cert
```bash
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes \
-subj "/CN=utas.fut.ea.com"
```
---
## Status
🔴 Not tested yet. All of the above is research / theoretical.
The first step is to capture real FIFA 23 traffic with mitmproxy and document actual endpoints.
---
## Next Steps
1. Set up mitmproxy on a FIFA 23 PC
2. Start FIFA 23 and navigate to FUT mode
3. Export the mitmproxy capture
4. Add real endpoints to `docs/endpoint-map.md`
5. Add mappings to `src/mapper.rs`