feat: add ProtoSSL RE tooling and FIFA 23 in-process hook
Add the reverse-engineering work for FIFA 23 online integration: - tools/protossl-scan: read-only memory scanner that confirms the DirtySDK/ProtoSSL transport, cross-references strings to code (xref/xref-str), and disassembles the enclosing function (disasm). Located _ProtoSSLSendPacket at FIFA23.exe+0xEFA530 (plaintext TLS record assembler) via the "_ProtoSSLSendPacket" debug string xref. - openfut-hook: version.dll proxy (forwards all 17 real exports) that injects into FIFA 23 and installs an inline detour on _ProtoSSLSendPacket, plus connect/DNS (getaddrinfo) capture and local LSX/redirect listeners. Logs to C:\openfut\hook.log. - CLAUDE.md: bridge project context + the gate-sequence task roadmap. Findings so far: with the anadius offline emulator the game never attempts the online Blaze connection (local auth gate), so capture of live Blaze frames is blocked pending an online-session fake. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
funman300
Generated
+336
@@ -0,0 +1,336 @@
|
||||
# This file is automatically @generated by Cargo.
|
||||
# It is not intended for manual editing.
|
||||
version = 4
|
||||
|
||||
[[package]]
|
||||
name = "bitflags"
|
||||
version = "1.3.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
|
||||
|
||||
[[package]]
|
||||
name = "cc"
|
||||
version = "1.2.65"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
|
||||
dependencies = [
|
||||
"find-msvc-tools",
|
||||
"shlex",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "cfg-if"
|
||||
version = "1.0.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
|
||||
|
||||
[[package]]
|
||||
name = "find-msvc-tools"
|
||||
version = "0.1.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
|
||||
|
||||
[[package]]
|
||||
name = "generic-array"
|
||||
version = "0.14.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
|
||||
dependencies = [
|
||||
"typenum",
|
||||
"version_check",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "libc"
|
||||
version = "0.2.186"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
|
||||
|
||||
[[package]]
|
||||
name = "libudis86-sys"
|
||||
version = "0.2.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "139bbf9ddb1bfc90c1ac64dd2923d9c957cd433cee7315c018125d72ab08a6b0"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "mach2"
|
||||
version = "0.4.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d640282b302c0bb0a2a8e0233ead9035e3bed871f0b7e81fe4a1ec829765db44"
|
||||
dependencies = [
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "mmap-fixed-fixed"
|
||||
version = "0.1.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0681853891801e4763dc252e843672faf32bcfee27a0aa3b19733902af450acc"
|
||||
dependencies = [
|
||||
"libc",
|
||||
"winapi",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "once_cell"
|
||||
version = "1.21.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
|
||||
|
||||
[[package]]
|
||||
name = "openfut-hook"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"retour",
|
||||
"windows",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "proc-macro2"
|
||||
version = "1.0.106"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
|
||||
dependencies = [
|
||||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "quote"
|
||||
version = "1.0.46"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "region"
|
||||
version = "3.0.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e6b6ebd13bc009aef9cd476c1310d49ac354d36e240cf1bd753290f3dc7199a7"
|
||||
dependencies = [
|
||||
"bitflags",
|
||||
"libc",
|
||||
"mach2",
|
||||
"windows-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "retour"
|
||||
version = "0.3.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a9af44d40e2400b44d491bfaf8eae111b09f23ac4de6e92728e79d93e699c527"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"generic-array",
|
||||
"libc",
|
||||
"libudis86-sys",
|
||||
"mmap-fixed-fixed",
|
||||
"once_cell",
|
||||
"region",
|
||||
"slice-pool2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "shlex"
|
||||
version = "2.0.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
|
||||
|
||||
[[package]]
|
||||
name = "slice-pool2"
|
||||
version = "0.4.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7a3d689654af89bdfeba29a914ab6ac0236d382eb3b764f7454dde052f2821f8"
|
||||
|
||||
[[package]]
|
||||
name = "syn"
|
||||
version = "2.0.118"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "typenum"
|
||||
version = "1.20.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
|
||||
|
||||
[[package]]
|
||||
name = "unicode-ident"
|
||||
version = "1.0.24"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
|
||||
|
||||
[[package]]
|
||||
name = "version_check"
|
||||
version = "0.9.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
|
||||
|
||||
[[package]]
|
||||
name = "winapi"
|
||||
version = "0.3.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
|
||||
dependencies = [
|
||||
"winapi-i686-pc-windows-gnu",
|
||||
"winapi-x86_64-pc-windows-gnu",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "winapi-i686-pc-windows-gnu"
|
||||
version = "0.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
|
||||
|
||||
[[package]]
|
||||
name = "winapi-x86_64-pc-windows-gnu"
|
||||
version = "0.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
|
||||
|
||||
[[package]]
|
||||
name = "windows"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dd04d41d93c4992d421894c18c8b43496aa748dd4c081bac0dc93eb0489272b6"
|
||||
dependencies = [
|
||||
"windows-core",
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-core"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99"
|
||||
dependencies = [
|
||||
"windows-implement",
|
||||
"windows-interface",
|
||||
"windows-result",
|
||||
"windows-strings",
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-implement"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2bbd5b46c938e506ecbce286b6628a02171d56153ba733b6c741fc627ec9579b"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-interface"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "053c4c462dc91d3b1504c6fe5a726dd15e216ba718e84a0e46a88fbe5ded3515"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-result"
|
||||
version = "0.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
|
||||
dependencies = [
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-strings"
|
||||
version = "0.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
|
||||
dependencies = [
|
||||
"windows-result",
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-sys"
|
||||
version = "0.52.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
|
||||
dependencies = [
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-targets"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
|
||||
dependencies = [
|
||||
"windows_aarch64_gnullvm",
|
||||
"windows_aarch64_msvc",
|
||||
"windows_i686_gnu",
|
||||
"windows_i686_gnullvm",
|
||||
"windows_i686_msvc",
|
||||
"windows_x86_64_gnu",
|
||||
"windows_x86_64_gnullvm",
|
||||
"windows_x86_64_msvc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows_aarch64_gnullvm"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
|
||||
|
||||
[[package]]
|
||||
name = "windows_aarch64_msvc"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
|
||||
|
||||
[[package]]
|
||||
name = "windows_i686_gnu"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
|
||||
|
||||
[[package]]
|
||||
name = "windows_i686_gnullvm"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
|
||||
|
||||
[[package]]
|
||||
name = "windows_i686_msvc"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_gnu"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_gnullvm"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_msvc"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
|
||||
@@ -0,0 +1,30 @@
|
||||
[package]
|
||||
name = "openfut-hook"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
description = "FIFA 23 version.dll proxy + ProtoSSL plaintext capture hook"
|
||||
|
||||
[lib]
|
||||
# Output is `version.dll` (the proxy/sideload name FIFA 23 loads).
|
||||
name = "version"
|
||||
crate-type = ["cdylib"]
|
||||
|
||||
[dependencies]
|
||||
# Inline-hooking library (installs the detour on _ProtoSSLSendPacket).
|
||||
retour = "0.3"
|
||||
|
||||
# Win32 bindings for the loader/threading/module APIs the hook needs.
|
||||
windows = { version = "0.58", features = [
|
||||
"Win32_Foundation",
|
||||
"Win32_Security",
|
||||
"Win32_Networking_WinSock",
|
||||
"Win32_System_LibraryLoader",
|
||||
"Win32_System_ProcessStatus",
|
||||
"Win32_System_Threading",
|
||||
"Win32_System_SystemInformation",
|
||||
"Win32_System_SystemServices",
|
||||
] }
|
||||
|
||||
# Own workspace root so Cargo doesn't attach this to the openfut-bridge package
|
||||
# in the parent directory.
|
||||
[workspace]
|
||||
@@ -0,0 +1,612 @@
|
||||
//! openfut-hook — FIFA 23 `version.dll` proxy + ProtoSSL plaintext capture.
|
||||
//!
|
||||
//! This DLL is built as `version.dll` and dropped next to `FIFA23.exe`. The
|
||||
//! game loads it (DLL search-order / sideload), at which point we:
|
||||
//!
|
||||
//! 1. (Task 2) Forward every real `version.dll` export to the genuine system
|
||||
//! DLL, so the game keeps working. We prove load with a log line.
|
||||
//! 2. (Task 3) Pattern-scan FIFA23.exe for `_ProtoSSLSendPacket` (the DirtySDK
|
||||
//! TLS record assembler we located at FIFA23.exe+0xEFA530) and install an
|
||||
//! inline detour. At its entry the record payload is still PLAINTEXT, so we
|
||||
//! log the content type + the source buffers, then call the original.
|
||||
//!
|
||||
//! Everything is written to `C:\openfut\hook.log` with timestamps, in stages,
|
||||
//! so the log alone tells us how far initialization got.
|
||||
//!
|
||||
//! Clean-room: this is generic proxy/loader/hook scaffolding plus a byte
|
||||
//! pattern derived from observing the binary the user owns. No EA source.
|
||||
|
||||
use core::ffi::c_void;
|
||||
use std::sync::atomic::{AtomicUsize, Ordering};
|
||||
use std::sync::Mutex;
|
||||
|
||||
use retour::RawDetour;
|
||||
use windows::core::{PCSTR, PCWSTR};
|
||||
use windows::Win32::Foundation::{BOOL, HMODULE};
|
||||
use windows::Win32::Networking::WinSock::{WSAGetLastError, AF_INET, SOCKADDR, SOCKADDR_IN};
|
||||
use windows::Win32::System::LibraryLoader::{
|
||||
DisableThreadLibraryCalls, GetModuleHandleW, GetProcAddress, LoadLibraryW,
|
||||
};
|
||||
use windows::Win32::System::ProcessStatus::{GetModuleInformation, MODULEINFO};
|
||||
use windows::Win32::System::SystemInformation::GetLocalTime;
|
||||
use windows::Win32::System::SystemServices::DLL_PROCESS_ATTACH;
|
||||
use windows::Win32::System::Threading::{
|
||||
CreateThread, GetCurrentProcess, Sleep, THREAD_CREATION_FLAGS,
|
||||
};
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Task 2: version.dll export forwarding
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Resolved addresses of the real system `version.dll` exports. Each proxy stub
|
||||
/// below tail-jumps to its slot. AtomicUsize (not `static mut`) keeps this sound
|
||||
/// and lets the naked stubs read the raw pointer via a simple memory load.
|
||||
static REAL: [AtomicUsize; 17] = [const { AtomicUsize::new(0) }; 17];
|
||||
|
||||
/// The 17 exports a real `version.dll` provides, in the SAME order as the proxy
|
||||
/// stubs' indices below.
|
||||
const EXPORTS: [&str; 17] = [
|
||||
"GetFileVersionInfoA",
|
||||
"GetFileVersionInfoByHandle",
|
||||
"GetFileVersionInfoExA",
|
||||
"GetFileVersionInfoExW",
|
||||
"GetFileVersionInfoSizeA",
|
||||
"GetFileVersionInfoSizeExA",
|
||||
"GetFileVersionInfoSizeExW",
|
||||
"GetFileVersionInfoSizeW",
|
||||
"GetFileVersionInfoW",
|
||||
"VerFindFileA",
|
||||
"VerFindFileW",
|
||||
"VerInstallFileA",
|
||||
"VerInstallFileW",
|
||||
"VerLanguageNameA",
|
||||
"VerLanguageNameW",
|
||||
"VerQueryValueA",
|
||||
"VerQueryValueW",
|
||||
];
|
||||
|
||||
/// Generate an exported, naked proxy stub that tail-jumps to `REAL[idx]`.
|
||||
/// A tail `jmp` leaves every register/stack arg untouched, so it forwards any
|
||||
/// signature correctly regardless of how many arguments the real function takes.
|
||||
macro_rules! proxy_stub {
|
||||
($idx:literal, $name:ident) => {
|
||||
#[no_mangle]
|
||||
#[unsafe(naked)]
|
||||
pub unsafe extern "system" fn $name() {
|
||||
core::arch::naked_asm!(
|
||||
"jmp qword ptr [rip + {base} + {off}]",
|
||||
base = sym REAL,
|
||||
off = const $idx * 8,
|
||||
);
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
proxy_stub!(0, GetFileVersionInfoA);
|
||||
proxy_stub!(1, GetFileVersionInfoByHandle);
|
||||
proxy_stub!(2, GetFileVersionInfoExA);
|
||||
proxy_stub!(3, GetFileVersionInfoExW);
|
||||
proxy_stub!(4, GetFileVersionInfoSizeA);
|
||||
proxy_stub!(5, GetFileVersionInfoSizeExA);
|
||||
proxy_stub!(6, GetFileVersionInfoSizeExW);
|
||||
proxy_stub!(7, GetFileVersionInfoSizeW);
|
||||
proxy_stub!(8, GetFileVersionInfoW);
|
||||
proxy_stub!(9, VerFindFileA);
|
||||
proxy_stub!(10, VerFindFileW);
|
||||
proxy_stub!(11, VerInstallFileA);
|
||||
proxy_stub!(12, VerInstallFileW);
|
||||
proxy_stub!(13, VerLanguageNameA);
|
||||
proxy_stub!(14, VerLanguageNameW);
|
||||
proxy_stub!(15, VerQueryValueA);
|
||||
proxy_stub!(16, VerQueryValueW);
|
||||
|
||||
/// Load the genuine `version.dll` by full path (so we don't re-load ourselves)
|
||||
/// and fill `REAL[]` with each export's address. Done synchronously in DllMain
|
||||
/// so the slots are ready before the game calls any version function.
|
||||
unsafe fn resolve_exports() {
|
||||
let path = wide("C:\\Windows\\System32\\version.dll");
|
||||
let module = match LoadLibraryW(PCWSTR(path.as_ptr())) {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
log(&format!("FATAL: could not load real version.dll: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
let mut missing = 0;
|
||||
for (i, name) in EXPORTS.iter().enumerate() {
|
||||
let cname = std::ffi::CString::new(*name).unwrap();
|
||||
let addr = GetProcAddress(module, PCSTR(cname.as_ptr() as *const u8))
|
||||
.map(|f| f as usize)
|
||||
.unwrap_or(0);
|
||||
REAL[i].store(addr, Ordering::SeqCst);
|
||||
if addr == 0 {
|
||||
missing += 1;
|
||||
log(&format!("warn: real version.dll missing export {name}"));
|
||||
}
|
||||
}
|
||||
log(&format!("forwarded {} version.dll exports", 17 - missing));
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Task 3: the _ProtoSSLSendPacket detour
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Trampoline to the original `_ProtoSSLSendPacket`, stored after we hook.
|
||||
static ORIG: AtomicUsize = AtomicUsize::new(0);
|
||||
|
||||
/// Signature derived from the disassembly (Windows x64 ABI):
|
||||
/// `_ProtoSSLSendPacket(pState, contentType, bufA, lenA, bufB, lenB) -> i32`.
|
||||
type SendPacket =
|
||||
unsafe extern "system" fn(*mut c_void, u32, *const u8, i32, *const u8, i32) -> i32;
|
||||
|
||||
/// Byte pattern for the `_ProtoSSLSendPacket` prologue. The four `0x00` bytes at
|
||||
/// the masked positions are the stack-cookie `mov rax,[rip+disp32]` displacement
|
||||
/// (position-dependent), so they're wildcarded via `MASK`.
|
||||
const PATTERN: [u8; 36] = [
|
||||
0x40, 0x53, 0x55, 0x56, 0x57, 0x41, 0x54, 0x41, 0x55, 0x41, 0x57, 0x48, 0x81, 0xEC, 0xB0,
|
||||
0x00, 0x00, 0x00, 0x48, 0x8B, 0x05, 0x00, 0x00, 0x00, 0x00, 0x48, 0x33, 0xC4, 0x48, 0x89,
|
||||
0x84, 0x24, 0xA0, 0x00, 0x00, 0x00,
|
||||
];
|
||||
/// `false` = wildcard byte (don't compare). Indices 21..=24 are the disp32.
|
||||
const MASK: [bool; 36] = {
|
||||
let mut m = [true; 36];
|
||||
m[21] = false;
|
||||
m[22] = false;
|
||||
m[23] = false;
|
||||
m[24] = false;
|
||||
m
|
||||
};
|
||||
|
||||
/// Our detour. At entry the record payload is still plaintext, so we log the
|
||||
/// content type and source buffers, then forward to the original unchanged.
|
||||
unsafe extern "system" fn hooked(
|
||||
p_state: *mut c_void,
|
||||
content_type: u32,
|
||||
buf_a: *const u8,
|
||||
len_a: i32,
|
||||
buf_b: *const u8,
|
||||
len_b: i32,
|
||||
) -> i32 {
|
||||
log_frame(content_type as u8, buf_a, len_a, buf_b, len_b);
|
||||
|
||||
let orig = ORIG.load(Ordering::SeqCst);
|
||||
if orig != 0 {
|
||||
let orig: SendPacket = core::mem::transmute(orig);
|
||||
orig(p_state, content_type, buf_a, len_a, buf_b, len_b)
|
||||
} else {
|
||||
// Should never happen (we store ORIG before the game can call us), but
|
||||
// never crash the game if it does.
|
||||
0
|
||||
}
|
||||
}
|
||||
|
||||
/// Background init: pattern-scan FIFA23.exe for the function, then detour it.
|
||||
/// Retries for a while in case the image isn't fully paged in at load.
|
||||
unsafe extern "system" fn init_thread(_: *mut c_void) -> u32 {
|
||||
// Connection capture first. Listen on the LSX port (gate 1, so the launcher
|
||||
// bootstrap succeeds) and on the redirect port (for external TLS/Blaze).
|
||||
start_listener(LSX_PORT, "LSX");
|
||||
start_listener(LOCAL_PORT, "BLZ");
|
||||
hook_dns();
|
||||
hook_connect();
|
||||
|
||||
// Then the plaintext-capture detour on _ProtoSSLSendPacket.
|
||||
for _ in 0..60 {
|
||||
if let Some(addr) = find_send_packet() {
|
||||
install_hook(addr);
|
||||
return 0;
|
||||
}
|
||||
Sleep(1000);
|
||||
}
|
||||
log("ERROR: _ProtoSSLSendPacket pattern not found after 60s");
|
||||
0
|
||||
}
|
||||
|
||||
/// Scan the FIFA23.exe image for the `_ProtoSSLSendPacket` prologue pattern.
|
||||
unsafe fn find_send_packet() -> Option<usize> {
|
||||
let module = GetModuleHandleW(PCWSTR::null()).ok()?; // null => the EXE itself
|
||||
let base = module.0 as usize;
|
||||
|
||||
let mut info = MODULEINFO::default();
|
||||
GetModuleInformation(
|
||||
GetCurrentProcess(),
|
||||
module,
|
||||
&mut info,
|
||||
core::mem::size_of::<MODULEINFO>() as u32,
|
||||
)
|
||||
.ok()?;
|
||||
let size = info.SizeOfImage as usize;
|
||||
let hay = core::slice::from_raw_parts(base as *const u8, size);
|
||||
|
||||
let plen = PATTERN.len();
|
||||
if hay.len() < plen {
|
||||
return None;
|
||||
}
|
||||
for i in 0..=hay.len() - plen {
|
||||
// Cheap first-byte gate before the full compare.
|
||||
if hay[i] != PATTERN[0] {
|
||||
continue;
|
||||
}
|
||||
let mut ok = true;
|
||||
for j in 1..plen {
|
||||
if MASK[j] && hay[i + j] != PATTERN[j] {
|
||||
ok = false;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if ok {
|
||||
return Some(base + i);
|
||||
}
|
||||
}
|
||||
None
|
||||
}
|
||||
|
||||
/// Install the inline detour on the resolved function address.
|
||||
unsafe fn install_hook(addr: usize) {
|
||||
let detour = match RawDetour::new(addr as *const (), hooked as *const ()) {
|
||||
Ok(d) => d,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: could not create detour: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
if let Err(e) = detour.enable() {
|
||||
log(&format!("ERROR: could not enable detour: {e:?}"));
|
||||
return;
|
||||
}
|
||||
// Leak the detour so it lives forever (dropping it would un-hook), and
|
||||
// publish its trampoline so `hooked` can call the original.
|
||||
let detour: &'static RawDetour = Box::leak(Box::new(detour));
|
||||
ORIG.store(detour.trampoline() as *const () as usize, Ordering::SeqCst);
|
||||
log(&format!(
|
||||
"hook installed: _ProtoSSLSendPacket @ 0x{addr:X} (FIFA23.exe+0x{:X})",
|
||||
addr - module_base(),
|
||||
));
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Connection capture: log every connect() and redirect external attempts to a
|
||||
// local listener, so the client's TCP succeeds and it starts sending TLS.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Local port our in-DLL listener binds; redirected connections land here.
|
||||
const LOCAL_PORT: u16 = 7777;
|
||||
|
||||
/// The EA launcher LSX port. The game connects here for launcher↔game bootstrap
|
||||
/// (gate 1). We listen so the connect succeeds and we can see the LSX protocol.
|
||||
const LSX_PORT: u16 = 3216;
|
||||
|
||||
/// Trampoline to the original ws2_32 `connect`.
|
||||
static ORIG_CONNECT: AtomicUsize = AtomicUsize::new(0);
|
||||
|
||||
type ConnectFn = unsafe extern "system" fn(usize, *const SOCKADDR, i32) -> i32;
|
||||
|
||||
/// Our `connect` detour: log the real destination, and for any non-loopback
|
||||
/// IPv4 target, rewrite it to 127.0.0.1:LOCAL_PORT before calling the original.
|
||||
unsafe extern "system" fn hooked_connect(s: usize, name: *const SOCKADDR, namelen: i32) -> i32 {
|
||||
let orig: ConnectFn = core::mem::transmute(ORIG_CONNECT.load(Ordering::SeqCst));
|
||||
|
||||
if !name.is_null() && (*name).sa_family == AF_INET {
|
||||
let sin = name as *const SOCKADDR_IN;
|
||||
let port = u16::from_be((*sin).sin_port);
|
||||
let octets = (*sin).sin_addr.S_un.S_addr.to_ne_bytes();
|
||||
let is_loopback = octets[0] == 127;
|
||||
let dst = format!("{}.{}.{}.{}:{}", octets[0], octets[1], octets[2], octets[3], port);
|
||||
|
||||
if !is_loopback {
|
||||
// Build a fresh 127.0.0.1:LOCAL_PORT address and connect there.
|
||||
let mut local: SOCKADDR_IN = core::mem::zeroed();
|
||||
local.sin_family = AF_INET;
|
||||
local.sin_port = LOCAL_PORT.to_be();
|
||||
local.sin_addr.S_un.S_addr = u32::from_ne_bytes([127, 0, 0, 1]);
|
||||
let ret = orig(
|
||||
s,
|
||||
&local as *const SOCKADDR_IN as *const SOCKADDR,
|
||||
core::mem::size_of::<SOCKADDR_IN>() as i32,
|
||||
);
|
||||
let err = if ret != 0 { WSAGetLastError().0 } else { 0 };
|
||||
log(&format!("CONNECT -> {dst} [redirected->7777] ret={ret} err={err}"));
|
||||
return ret;
|
||||
} else {
|
||||
let ret = orig(s, name, namelen);
|
||||
let err = if ret != 0 { WSAGetLastError().0 } else { 0 };
|
||||
log(&format!("CONNECT -> {dst} ret={ret} err={err}"));
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
|
||||
orig(s, name, namelen)
|
||||
}
|
||||
|
||||
// --- DNS logging: what hostnames does the client try to resolve? ----------
|
||||
|
||||
static ORIG_GAIW: AtomicUsize = AtomicUsize::new(0);
|
||||
static ORIG_GAI: AtomicUsize = AtomicUsize::new(0);
|
||||
|
||||
type GaiWFn = unsafe extern "system" fn(PCWSTR, PCWSTR, *const c_void, *mut *mut c_void) -> i32;
|
||||
type GaiFn = unsafe extern "system" fn(PCSTR, PCSTR, *const c_void, *mut *mut c_void) -> i32;
|
||||
|
||||
unsafe extern "system" fn hooked_gaiw(
|
||||
node: PCWSTR,
|
||||
svc: PCWSTR,
|
||||
hints: *const c_void,
|
||||
res: *mut *mut c_void,
|
||||
) -> i32 {
|
||||
let name = if node.is_null() {
|
||||
"<null>".to_string()
|
||||
} else {
|
||||
node.to_string().unwrap_or_else(|_| "<?>".into())
|
||||
};
|
||||
let orig: GaiWFn = core::mem::transmute(ORIG_GAIW.load(Ordering::SeqCst));
|
||||
let ret = orig(node, svc, hints, res);
|
||||
log(&format!("DNS GetAddrInfoW(\"{name}\") ret={ret}"));
|
||||
ret
|
||||
}
|
||||
|
||||
unsafe extern "system" fn hooked_gai(
|
||||
node: PCSTR,
|
||||
svc: PCSTR,
|
||||
hints: *const c_void,
|
||||
res: *mut *mut c_void,
|
||||
) -> i32 {
|
||||
let name = if node.is_null() {
|
||||
"<null>".to_string()
|
||||
} else {
|
||||
node.to_string().unwrap_or_else(|_| "<?>".into())
|
||||
};
|
||||
let orig: GaiFn = core::mem::transmute(ORIG_GAI.load(Ordering::SeqCst));
|
||||
let ret = orig(node, svc, hints, res);
|
||||
log(&format!("DNS getaddrinfo(\"{name}\") ret={ret}"));
|
||||
ret
|
||||
}
|
||||
|
||||
/// Generic: resolve `name` in `module`, install a detour to `detour`, store the
|
||||
/// trampoline in `slot`.
|
||||
unsafe fn install_detour(
|
||||
module: HMODULE,
|
||||
name: &[u8],
|
||||
detour: *const (),
|
||||
slot: &AtomicUsize,
|
||||
label: &str,
|
||||
) {
|
||||
let addr = match GetProcAddress(module, PCSTR(name.as_ptr())) {
|
||||
Some(f) => f as usize,
|
||||
None => {
|
||||
log(&format!("ERROR: {label} not found"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
let d = match RawDetour::new(addr as *const (), detour) {
|
||||
Ok(d) => d,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: {label} detour create: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
if d.enable().is_err() {
|
||||
log(&format!("ERROR: {label} detour enable failed"));
|
||||
return;
|
||||
}
|
||||
let d: &'static RawDetour = Box::leak(Box::new(d));
|
||||
slot.store(d.trampoline() as *const () as usize, Ordering::SeqCst);
|
||||
log(&format!("{label} hook installed"));
|
||||
}
|
||||
|
||||
/// Detour the DNS resolvers so we see every hostname lookup.
|
||||
unsafe fn hook_dns() {
|
||||
let ws2 = match LoadLibraryW(PCWSTR(wide("ws2_32.dll").as_ptr())) {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: load ws2_32 for DNS: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
install_detour(ws2, b"GetAddrInfoW\0", hooked_gaiw as *const (), &ORIG_GAIW, "GetAddrInfoW");
|
||||
install_detour(ws2, b"getaddrinfo\0", hooked_gai as *const (), &ORIG_GAI, "getaddrinfo");
|
||||
}
|
||||
|
||||
/// Resolve and detour ws2_32 `connect`.
|
||||
unsafe fn hook_connect() {
|
||||
let ws2 = match LoadLibraryW(PCWSTR(wide("ws2_32.dll").as_ptr())) {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: could not load ws2_32.dll: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
let addr = match GetProcAddress(ws2, PCSTR(b"connect\0".as_ptr())) {
|
||||
Some(f) => f as usize,
|
||||
None => {
|
||||
log("ERROR: connect not found in ws2_32.dll");
|
||||
return;
|
||||
}
|
||||
};
|
||||
let detour = match RawDetour::new(addr as *const (), hooked_connect as *const ()) {
|
||||
Ok(d) => d,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: could not create connect detour: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
if let Err(e) = detour.enable() {
|
||||
log(&format!("ERROR: could not enable connect detour: {e:?}"));
|
||||
return;
|
||||
}
|
||||
let detour: &'static RawDetour = Box::leak(Box::new(detour));
|
||||
ORIG_CONNECT.store(detour.trampoline() as *const () as usize, Ordering::SeqCst);
|
||||
log("connect hook installed (external IPv4 -> 127.0.0.1:7777)");
|
||||
}
|
||||
|
||||
/// Spawn a TCP listener on `127.0.0.1:port`, tagging logged traffic with `tag`.
|
||||
/// Accepts connections and logs what the client sends — as readable text (for
|
||||
/// the text-based LSX protocol) plus a hex prefix (for binary TLS/Blaze).
|
||||
fn start_listener(port: u16, tag: &'static str) {
|
||||
std::thread::spawn(move || {
|
||||
let listener = match std::net::TcpListener::bind(("127.0.0.1", port)) {
|
||||
Ok(l) => l,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: listener[{tag}] bind {port} failed: {e}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
let bound = listener
|
||||
.local_addr()
|
||||
.map(|a| a.to_string())
|
||||
.unwrap_or_default();
|
||||
log(&format!("listener[{tag}] up, bound {bound}, accepting"));
|
||||
|
||||
// Explicit accept loop so accept errors are visible (not swallowed).
|
||||
loop {
|
||||
match listener.accept() {
|
||||
Ok((stream, peer)) => {
|
||||
log(&format!("ACCEPT[{tag}] from {peer}"));
|
||||
std::thread::spawn(move || handle_conn(stream, tag, peer.to_string()));
|
||||
}
|
||||
Err(e) => {
|
||||
log(&format!("ACCEPT[{tag}] error: {e}"));
|
||||
std::thread::sleep(std::time::Duration::from_millis(250));
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
fn handle_conn(mut stream: std::net::TcpStream, tag: &'static str, peer: String) {
|
||||
use std::io::Read;
|
||||
let mut buf = [0u8; 2048];
|
||||
let mut total = 0usize;
|
||||
loop {
|
||||
match stream.read(&mut buf) {
|
||||
Ok(0) | Err(_) => break,
|
||||
Ok(n) => {
|
||||
total += n;
|
||||
let ascii = ascii_render(&buf[..n.min(400)]);
|
||||
let hexp = hex(&buf[..n.min(24)]);
|
||||
log(&format!("RECV[{tag}] {n}B | hex: {hexp} | text: {ascii}"));
|
||||
}
|
||||
}
|
||||
}
|
||||
log(&format!("CLOSE[{tag}] from {peer} after {total}B total"));
|
||||
}
|
||||
|
||||
/// Render bytes as printable ASCII (non-printable -> '.'), for text protocols.
|
||||
fn ascii_render(bytes: &[u8]) -> String {
|
||||
bytes
|
||||
.iter()
|
||||
.map(|&b| {
|
||||
if (0x20..=0x7e).contains(&b) || b == b'\n' || b == b'\r' || b == b'\t' {
|
||||
b as char
|
||||
} else {
|
||||
'.'
|
||||
}
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Logging
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
fn log_frame(content_type: u8, buf_a: *const u8, len_a: i32, buf_b: *const u8, len_b: i32) {
|
||||
let label = match content_type {
|
||||
0x14 => "ccs",
|
||||
0x15 => "alert",
|
||||
0x16 => "handshake",
|
||||
0x17 => "appdata",
|
||||
_ => "?",
|
||||
};
|
||||
let mut line = format!("SEND type=0x{content_type:02X}({label}) lenA={len_a} lenB={len_b}");
|
||||
if !buf_a.is_null() && len_a > 0 {
|
||||
let n = (len_a as usize).min(48);
|
||||
let bytes = unsafe { core::slice::from_raw_parts(buf_a, n) };
|
||||
line.push_str(&format!(" | A: {}", hex(bytes)));
|
||||
}
|
||||
if !buf_b.is_null() && len_b > 0 {
|
||||
let n = (len_b as usize).min(16);
|
||||
let bytes = unsafe { core::slice::from_raw_parts(buf_b, n) };
|
||||
line.push_str(&format!(" | B: {}", hex(bytes)));
|
||||
}
|
||||
log(&line);
|
||||
}
|
||||
|
||||
fn hex(bytes: &[u8]) -> String {
|
||||
bytes
|
||||
.iter()
|
||||
.map(|b| format!("{b:02X}"))
|
||||
.collect::<Vec<_>>()
|
||||
.join(" ")
|
||||
}
|
||||
|
||||
/// Serializes log writes so concurrent threads don't corrupt each other's lines.
|
||||
static LOG_LOCK: Mutex<()> = Mutex::new(());
|
||||
|
||||
/// Append a timestamped line to `C:\openfut\hook.log`.
|
||||
fn log(msg: &str) {
|
||||
use std::io::Write;
|
||||
let _guard = LOG_LOCK.lock();
|
||||
let _ = std::fs::create_dir_all("C:\\openfut");
|
||||
if let Ok(mut f) = std::fs::OpenOptions::new()
|
||||
.create(true)
|
||||
.append(true)
|
||||
.open("C:\\openfut\\hook.log")
|
||||
{
|
||||
let _ = writeln!(f, "[{}] {}", now(), msg);
|
||||
}
|
||||
}
|
||||
|
||||
fn now() -> String {
|
||||
let st = unsafe { GetLocalTime() };
|
||||
format!(
|
||||
"{:04}-{:02}-{:02} {:02}:{:02}:{:02}",
|
||||
st.wYear, st.wMonth, st.wDay, st.wHour, st.wMinute, st.wSecond
|
||||
)
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Helpers + entry point
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
fn wide(s: &str) -> Vec<u16> {
|
||||
s.encode_utf16().chain(std::iter::once(0)).collect()
|
||||
}
|
||||
|
||||
/// FIFA23.exe base address (the main module), for pretty logging.
|
||||
fn module_base() -> usize {
|
||||
unsafe {
|
||||
GetModuleHandleW(PCWSTR::null())
|
||||
.map(|h| h.0 as usize)
|
||||
.unwrap_or(0)
|
||||
}
|
||||
}
|
||||
|
||||
#[no_mangle]
|
||||
pub extern "system" fn DllMain(module: HMODULE, reason: u32, _reserved: *mut c_void) -> BOOL {
|
||||
if reason == DLL_PROCESS_ATTACH {
|
||||
unsafe {
|
||||
let _ = DisableThreadLibraryCalls(module);
|
||||
|
||||
let host = std::env::current_exe()
|
||||
.map(|p| p.display().to_string())
|
||||
.unwrap_or_default();
|
||||
log(&format!(
|
||||
"openfut-hook loaded | pid {} | host {host}",
|
||||
std::process::id()
|
||||
));
|
||||
|
||||
// Forward exports synchronously (must be ready before any call)...
|
||||
resolve_exports();
|
||||
|
||||
// ...then do the pattern scan + hook on a background thread (never
|
||||
// do real work directly in DllMain — loader lock).
|
||||
let _ = CreateThread(
|
||||
None,
|
||||
0,
|
||||
Some(init_thread),
|
||||
None,
|
||||
THREAD_CREATION_FLAGS(0),
|
||||
None,
|
||||
);
|
||||
}
|
||||
}
|
||||
BOOL(1)
|
||||
}
|
||||
Reference in New Issue
Block a user