Add a bounded manual stack-scan in the GoOnline detour (FIFA-frame finder).
Result: zero FIFA23.exe frames, sp ~2.4KB below stack top => GoOnline runs on an
anadius worker thread (queued), not FIFA's thread. Three-way corroboration that
the gate is an async "online established" event anadius (offline-only) never
pushes; FIFA waits/retries. No handler-response flip can cross it. Documented in
connection-gate-findings.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Hook: force GetInternetConnectedState->connected (flags +0xCAB1A/+0xCAB1B) and
flip GoOnline to report "1" (+0xAF530) instead of "0" (+0xADE64).
- protossl-scan: add `read` mode (hex/ascii dump at addr|module+off).
- Finding: neither flip unblocks the game; it keeps retrying GoOnline every ~7s.
The FUT-online flow is event-driven -- the game waits for an async "online
established" event anadius (offline-only) never pushes. Documented in
connection-gate-findings.md. Next: trace FIFA-side flow (Ghidra) / anadius
event-send to inject the online event.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a read-only detour on anadius's GoOnline handler (anadius64.dll+0x2BB90).
Result: the game calls GoOnline during the "connecting" attempt and anadius
returns success, yet no Blaze connection follows. The gate is therefore
downstream of GoOnline -- the auth-token (GetAuthCode) and/or the "online
established" status callback. Recorded in connection-gate-findings.md.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Hook send/recv and WSASend/WSARecv, filtered to LSX/XML content, to read
the Ebisu-SDK <-> anadius conversation (challenge handshake, etc.).
- Hook getaddrinfo/GetAddrInfoW to log DNS lookups.
- Log connect() return value + WSA error; add accept/close diagnostics on
the local listeners.
- Serialize log writes behind a mutex so concurrent threads don't corrupt
each other's lines.
Used to establish that the online/offline decision is made via in-process
detoured calls, not socket traffic (no GetAuthCode/GoOnline on the wire).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add the reverse-engineering work for FIFA 23 online integration:
- tools/protossl-scan: read-only memory scanner that confirms the
DirtySDK/ProtoSSL transport, cross-references strings to code
(xref/xref-str), and disassembles the enclosing function (disasm).
Located _ProtoSSLSendPacket at FIFA23.exe+0xEFA530 (plaintext TLS
record assembler) via the "_ProtoSSLSendPacket" debug string xref.
- openfut-hook: version.dll proxy (forwards all 17 real exports) that
injects into FIFA 23 and installs an inline detour on
_ProtoSSLSendPacket, plus connect/DNS (getaddrinfo) capture and local
LSX/redirect listeners. Logs to C:\openfut\hook.log.
- CLAUDE.md: bridge project context + the gate-sequence task roadmap.
Findings so far: with the anadius offline emulator the game never
attempts the online Blaze connection (local auth gate), so capture of
live Blaze frames is blocked pending an online-session fake.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
funman300