- Hook: force GetInternetConnectedState->connected (flags +0xCAB1A/+0xCAB1B) and
flip GoOnline to report "1" (+0xAF530) instead of "0" (+0xADE64).
- protossl-scan: add `read` mode (hex/ascii dump at addr|module+off).
- Finding: neither flip unblocks the game; it keeps retrying GoOnline every ~7s.
The FUT-online flow is event-driven -- the game waits for an async "online
established" event anadius (offline-only) never pushes. Documented in
connection-gate-findings.md. Next: trace FIFA-side flow (Ghidra) / anadius
event-send to inject the online event.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Read-only M1 investigation results appended to connection-gate-findings.md:
- Confirmed ProtoSSLConnect is never reached on the "connecting" abort (gate is
upstream/in-process) via the existing connect/DNS hooks.
- Mapped the surface: redirector host table (gosredirector.* per env), the
redirector request config (X-BLAZE-ERRORCODE, Authorization:, <errorCode>),
and the enum-name serialization tables (ONLINE_ACCESS, ONLINE_STATUS_EVENT).
- Key answer: the online-connect path requires a Nucleus auth token (the
redirector request carries an Authorization header) => TWO gates (state +
token), not a single boolean flip.
- The exact connection-state function is behind C++ vtable indirection; pinning
it needs Ghidra. protossl-scan stays the live-process bridge.
protossl-scan: add `callers` mode (find call/jmp sites to a function) and
restrict xref/callers scans to the app modules (FIFA23.exe/anadius64.dll) for
speed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add `module+0xoffset` addressing (e.g. `anadius64.dll+0x2BB90`) to the
disasm and xref commands. Offsets are stable across launches while the
base is ASLR'd, so this resolves the module's current base in the running
process instead of requiring a stale absolute address each session.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add the reverse-engineering work for FIFA 23 online integration:
- tools/protossl-scan: read-only memory scanner that confirms the
DirtySDK/ProtoSSL transport, cross-references strings to code
(xref/xref-str), and disassembles the enclosing function (disasm).
Located _ProtoSSLSendPacket at FIFA23.exe+0xEFA530 (plaintext TLS
record assembler) via the "_ProtoSSLSendPacket" debug string xref.
- openfut-hook: version.dll proxy (forwards all 17 real exports) that
injects into FIFA 23 and installs an inline detour on
_ProtoSSLSendPacket, plus connect/DNS (getaddrinfo) capture and local
LSX/redirect listeners. Logs to C:\openfut\hook.log.
- CLAUDE.md: bridge project context + the gate-sequence task roadmap.
Findings so far: with the anadius offline emulator the game never
attempts the online Blaze connection (local auth gate), so capture of
live Blaze frames is blocked pending an online-session fake.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
funman300