Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 funman300
|
d4bab06826 |
@@ -1,190 +0,0 @@
|
||||
# OpenFUT Bridge — Claude Code project context
|
||||
|
||||
Read this first. It's the standing context for every task in this project. Each
|
||||
working session will give you ONE bounded task plus a verification clause; this
|
||||
file is the background that stays true across all of them.
|
||||
|
||||
## What this project is
|
||||
|
||||
OpenFUT is an **offline FIFA 23 FUT (Ultimate Team) emulator** for single-player
|
||||
game preservation. EA permanently shut down FIFA 23's online servers in October
|
||||
2025, which removed FUT. This project lets a legitimately-owned copy run FUT
|
||||
against a **local emulated backend** instead of EA's (dead) servers.
|
||||
|
||||
It has two repos:
|
||||
- **OpenFUT Core** — the game-independent FUT economy backend (already largely built).
|
||||
- **OpenFUT Bridge** — the FIFA 23 integration / reverse-engineering layer (this work).
|
||||
|
||||
## Hard constraints (do not violate)
|
||||
|
||||
- **Clean-room only.** Everything is derived from observing the running client's
|
||||
own behaviour. NEVER use, reference, or reproduce leaked EA source code (e.g.
|
||||
the 2021 FIFA 21 / Blaze leak). If a task seems to need it, stop and say so.
|
||||
Clean-room provenance is the legal foundation of the whole project.
|
||||
- **Mark uncertainty, don't invent.** Several things are genuinely unconfirmed:
|
||||
the Fire2 packet framing, ProtoSSL non-blocking return values, and FIFA 23's
|
||||
Blaze component/command IDs. When you don't know a value, leave a clearly
|
||||
labelled `TODO/CONFIRM` rather than guessing a confident-looking number.
|
||||
- **Verify against the client.** The dead servers mean responses are *synthesized
|
||||
and tested against the live offline client*, never captured from EA. The client
|
||||
is the oracle: a gate is "done" when the client advances to the next command.
|
||||
|
||||
## Architecture
|
||||
|
||||
```
|
||||
FIFA 23 client (offline, native Windows)
|
||||
| ProtoSSLConnect / ProtoSSLSend / ProtoSSLRecv (in-process)
|
||||
openfut_hook.dll — fakes the connection, captures requests, injects responses
|
||||
| plain localhost TCP, length-prefixed frames (no TLS)
|
||||
blaze_brain (Rust) — decodes requests, crafts Blaze responses <-- iteration surface
|
||||
|
|
||||
OpenFUT Core — supplies real FUT economy data for the FUT gates
|
||||
```
|
||||
|
||||
Why in-process (not a localhost TLS server): FIFA 23's ProtoSSL uses modern TLS
|
||||
with cert pinning, so a fake server gets its cert rejected. Hooking ABOVE the
|
||||
crypto (ProtoSSLSend/Recv take/return plaintext) sidesteps TLS entirely.
|
||||
|
||||
## The entry sequence (the gates to reach FUT)
|
||||
|
||||
The client runs these in order; each must be satisfied before the next fires:
|
||||
|
||||
1. **LSX** (port 3216, plaintext loopback) — launcher→game bootstrap.
|
||||
2. **Blaze redirector** — returns a server host/port.
|
||||
3. **Blaze preauth** (UTIL) — config / component list.
|
||||
4. **Blaze login** (AUTHENTICATION) — persona, session key, UID.
|
||||
5. **Blaze postauth** (UTIL) — telemetry/ticker; "fully online".
|
||||
6. **FUT entry check** — FIFA-specific eligibility/entitlement wall.
|
||||
7. **FUT hub load** — club/squad over REST; hand off to OpenFUT Core.
|
||||
|
||||
Gates 2–5 are largely static/replayable (the client validates little). Gates 6–7
|
||||
need internally-consistent data and connect to OpenFUT Core.
|
||||
|
||||
## Environment
|
||||
|
||||
- Native Windows boot (chosen for predictable PE/hooking behaviour over Proton).
|
||||
- FIFA 23, with EA Anticheat in its offline/neutralized state. Do NOT assume a
|
||||
task is safe to hook unless EAAC is confirmed neutralized.
|
||||
- Rust is the primary language. Hook = `cdylib`, Windows target. Brain = portable.
|
||||
- Self-hosted Gitea (git.aleshym.co, org Quaternions). Self-hosted CI runner.
|
||||
|
||||
## How to work here
|
||||
|
||||
- One rung at a time. Don't run ahead into a gate that depends on an unconfirmed
|
||||
earlier answer.
|
||||
- When decoding a frame, work from REAL captured bytes the user pastes in — not
|
||||
from a guessed layout. Ask for the bytes if they're not provided.
|
||||
- End each change with how the user verifies it on the client.
|
||||
|
||||
|
||||
# OpenFUT Bridge — Task prompts (run in order)
|
||||
|
||||
Each task is its own Claude Code session. Paste the task, attach the named
|
||||
starting file(s), and don't move to the next until the verification clause passes.
|
||||
The project CLAUDE.md is assumed to be in context.
|
||||
|
||||
---
|
||||
|
||||
## TASK 1 — Confirm the transport (read-only memory scan)
|
||||
|
||||
**Goal:** prove whether FIFA 23 uses EA DirtySDK / ProtoSSL before we build any
|
||||
hook around it. Read-only; no hooking, patching, or injection.
|
||||
|
||||
**Do this:**
|
||||
Write a standalone Windows console program in Rust (target
|
||||
`x86_64-pc-windows-msvc` or `-gnu`) that:
|
||||
1. Finds the running FIFA 23 process by name (and accepts a PID argument).
|
||||
2. Enumerates its modules and committed memory regions (e.g. `EnumProcessModules`
|
||||
/ `VirtualQueryEx`), readable regions only.
|
||||
3. Reads memory with `ReadProcessMemory` in chunks (with small overlap so a
|
||||
marker spanning a chunk boundary is still found).
|
||||
4. Searches for these ASCII markers and prints each hit with its absolute address:
|
||||
`protossl:`, `ProtoSSLSend`, `ProtoSSLRecv`, `ProtoSSLConnect`,
|
||||
`gosredirector`, `DirtySDK`, `blaze`.
|
||||
5. Prints a summary: which markers were found, and a clear verdict line
|
||||
("ProtoSSL present" vs "no ProtoSSL markers found").
|
||||
|
||||
Keep it dependency-light (the `windows` crate is fine). Comment it for a Rust
|
||||
beginner. It must only read.
|
||||
|
||||
**Verification:** with FIFA 23 running and sitting at the main menu, the program
|
||||
prints whether the ProtoSSL markers are present. If `protossl:` and the
|
||||
send/recv strings appear, the transport is confirmed and we proceed. If nothing
|
||||
appears after the menu has loaded, STOP — we rethink the transport, don't build
|
||||
the hook.
|
||||
|
||||
**Note:** reach the main menu before scanning; the networking code/strings may
|
||||
not be paged in at the title screen.
|
||||
|
||||
---
|
||||
|
||||
## TASK 2 — Loadable DLL shell (prove we can get code in)
|
||||
|
||||
**Goal:** a `version.dll` proxy that loads into FIFA 23 and runs our code, before
|
||||
any hook logic exists. This isolates "can we inject at all" from "is the hook
|
||||
correct".
|
||||
|
||||
**Do this:**
|
||||
Create a Rust `cdylib` (Windows target) that:
|
||||
1. Exports the functions a real `version.dll` exports, forwarding each to the
|
||||
system `version.dll` (proxy/sideload pattern). List the needed exports and
|
||||
implement the forwarding.
|
||||
2. In `DllMain`, on `DLL_PROCESS_ATTACH`, spawns a thread (NOT work in DllMain
|
||||
itself — loader lock) that writes a line to a log file in a known path, e.g.
|
||||
`C:\openfut\hook.log`, with a timestamp.
|
||||
3. Provide the `Cargo.toml` (`crate-type = ["cdylib"]`) and the exact build
|
||||
command.
|
||||
|
||||
Clean-room: this is generic proxy/loader scaffolding, nothing EA-derived.
|
||||
|
||||
**Verification:** drop the built DLL next to the FIFA 23 executable, launch the
|
||||
game, and confirm `hook.log` gets the timestamped line. Game still reaches the
|
||||
menu normally. If it crashes or the line never appears, fix the proxy/forwarding
|
||||
before continuing.
|
||||
|
||||
**Caution:** confirm EAAC is in its offline/neutralized state before loading the
|
||||
DLL. Do not load it into an anticheat-active session.
|
||||
|
||||
---
|
||||
|
||||
## TASK 3 — One landing hook on ProtoSSLSend
|
||||
|
||||
**Goal:** prove we can hook a ProtoSSL function and see real outbound frames.
|
||||
Just one function, and it calls the original (passive observation).
|
||||
|
||||
**Do this:**
|
||||
Extend the Task 2 DLL:
|
||||
1. Add the `retour` crate. Resolve the `ProtoSSLSend` address — first pass: use
|
||||
the absolute address Task 1 reported, converted to a module-relative offset
|
||||
plus the live module base. (We'll switch to a byte-pattern scan later for
|
||||
patch-resilience; leave a TODO for that.)
|
||||
2. Install a `retour` inline detour on `ProtoSSLSend` with signature
|
||||
`extern "C" fn(*mut c_void, *const u8, i32) -> i32` (x64 = one calling
|
||||
convention; `extern "C"` is correct).
|
||||
3. In the detour: log `length` and the first ~32 bytes of the buffer as hex,
|
||||
then CALL THE ORIGINAL and return its result (do not block or alter traffic
|
||||
yet).
|
||||
|
||||
Mark the ProtoSSL return-value conventions and the eventual pattern-scan as
|
||||
`TODO/CONFIRM` per the project rules.
|
||||
|
||||
**Verification:** launch the game, attempt to go online / load FUT, and confirm
|
||||
`hook.log` shows ProtoSSLSend calls with non-trivial byte dumps — these are the
|
||||
client's real outbound Blaze frames (still TLS-bound on the wire, but plaintext
|
||||
here, which is the whole point). Seeing real frames = hooking works, and we now
|
||||
have actual bytes to decode in later tasks. Paste a few of those captured frames
|
||||
into the next session.
|
||||
|
||||
---
|
||||
|
||||
## What to attach to each task
|
||||
|
||||
- Task 1: nothing (fresh program), or the Linux `protossl_scan.rs` as a logic
|
||||
reference to port.
|
||||
- Task 2: nothing, or your existing `version.dll` proxy shell if you have one.
|
||||
- Task 3: the Task 2 DLL, plus the `openfut_hook_sketch.rs` as the structural
|
||||
reference, plus the address Task 1 reported.
|
||||
|
||||
Once Task 3 yields real captured frames, later tasks (the brain handlers per
|
||||
gate) should always include the actual pasted bytes — decoding real frames is far
|
||||
more reliable than guessing the Fire2 layout.
|
||||
@@ -1,125 +0,0 @@
|
||||
# Connection-gate findings (clean-room)
|
||||
|
||||
**Status:** observed behaviour only — derived from running the client and reading
|
||||
the repack's own files. No EA source used. Unconfirmed values are marked
|
||||
`TODO/CONFIRM` rather than guessed.
|
||||
|
||||
## Components (observed)
|
||||
|
||||
| Component | Role |
|
||||
|---|---|
|
||||
| `FIFA23.exe` | Game. Statically links EA's **Ebisu SDK** (online) and **DirtySDK/ProtoSSL** (transport). Loads at fixed base `0x140000000` — no ASLR seen across launches. |
|
||||
| `_ProtoSSLSendPacket` @ `FIFA23.exe+0xEFA530` | DirtySDK TLS record assembler — plaintext in, encrypts in place. Already located + hooked. |
|
||||
| `anadius64.dll` | anadius EA-app/Origin **LSX server** emulator (ASLR'd). Provides offline DRM / entitlements / persona so the game *launches*; deliberately keeps it **offline**. |
|
||||
| `FakeEAACLauncher` | Anti-cheat bypass only. Irrelevant to the online gate. |
|
||||
|
||||
## Observed online-startup flow
|
||||
|
||||
1. Ebisu SDK opens LSX socket(s) to anadius; a **challenge/response handshake**
|
||||
completes — captured XML: `<Challenge>` / `<ChallengeResponse>` /
|
||||
`<ChallengeAccepted>`, `sender="EALS"`, `ContentId 16115019`.
|
||||
2. River/PIN telemetry `<session type=boot>` is emitted.
|
||||
3. **No further socket traffic.** Clicking Ultimate Team → "connecting to the EA
|
||||
Servers…" → **zero** network attempts (no Blaze DNS, no `connect`, nothing on
|
||||
`send`/`recv`/`WSASend`/`WSARecv`) → falls back to offline.
|
||||
|
||||
## Conclusion: the decision is upstream and in-process
|
||||
|
||||
- The online/offline verdict is delivered through anadius's **in-process
|
||||
detoured Ebisu calls**, not socket messages. (No `GetAuthCode`/`GoOnline`/
|
||||
entitlement query appears on any socket, sync or async.)
|
||||
- The game therefore **never reaches DirtySDK/ProtoSSL for Blaze** — it aborts
|
||||
before any `ProtoSSLConnect(gosredirector…)`. The gate is an **Ebisu-SDK
|
||||
connection-state / online-session check upstream of the transport.**
|
||||
- `ONLINE_ACCESS` is a `Blaze::Nucleus::EntitlementType` (enum value `1`).
|
||||
anadius's `GoOnline` LSX handler (`anadius64.dll+0x2BB90`) is a success stub;
|
||||
`anadius64.dll+0xB6B1` is a large entitlement/profile builder that *does*
|
||||
reference `ONLINE_ACCESS`. Reverse-engineering that entitlement-status logic
|
||||
is the **wrong fight** (see strategy).
|
||||
|
||||
## Strategy (decided)
|
||||
|
||||
Do **not** make anadius report "online." anadius exists to keep the game
|
||||
offline, and it can't be removed without breaking launch/DRM. Instead:
|
||||
|
||||
> Let the game run its **real** online flow and answer that flow ourselves via
|
||||
> the hook + brain. Target the Ebisu connection-state check the FUT-entry path
|
||||
> polls; make the game *pass* it so it issues the real `ProtoSSLConnect` to the
|
||||
> Blaze redirector → our redirect + ProtoSSL hook capture the real frames.
|
||||
|
||||
This deletes the "reverse-engineer anadius's entitlement logic" problem.
|
||||
|
||||
## Next RE step (converges with the ProtoSSL hook)
|
||||
|
||||
1. Locate and **read-only hook `ProtoSSLConnect`** (same DirtySDK module and
|
||||
technique that found `_ProtoSSLSendPacket`). Confirms the game never
|
||||
initiates the Blaze connection (pins the gate strictly upstream) and gives us
|
||||
the exact symbol that will flip from "never called" to "called" on success.
|
||||
2. Locate the Ebisu **connection-state getter** the FUT-entry / "connecting" UI
|
||||
polls. Candidate string anchors (observed): `ONLINE_STATUS_EVENT`,
|
||||
`GoOnline` result handling, the "connecting to the EA Servers" UI trigger.
|
||||
3. Determine the minimal intervention to make that getter report **connected**
|
||||
(out-hook it in our `version.dll`, winning over anadius's detour) so the game
|
||||
proceeds to `ProtoSSLConnect`.
|
||||
- `TODO/CONFIRM`: whether out-hooking the getter is sufficient, or secondary
|
||||
checks (auth-token presence) also gate the attempt.
|
||||
|
||||
---
|
||||
|
||||
## M1 results (read-only investigation)
|
||||
|
||||
Method: `protossl-scan` (xref / disasm / callers, app-module-restricted) against
|
||||
the live client, plus the existing `connect`/DNS/LSX hooks. Observed behaviour
|
||||
only — no EA source.
|
||||
|
||||
### Point 1 — is `ProtoSSLConnect` reached on the "connecting" abort? **NO — gate is upstream. CONFIRMED.**
|
||||
- The existing `connect` / `GetAddrInfoW` / `getaddrinfo` hooks show the client
|
||||
makes **zero** network attempts during the "connecting to the EA Servers"
|
||||
abort: no DNS for any `gosredirector.*` host, no `connect` to any external
|
||||
address.
|
||||
- The DirtySDK/ProtoSSL transport is therefore never reached — the abort is
|
||||
entirely upstream and in-process.
|
||||
- `ProtoSSLConnect` has no debug string and sits behind the DirtySDK API, so an
|
||||
explicit hook on it isn't needed to prove this; the behavioural evidence is
|
||||
conclusive. `TODO/CONFIRM`: locate `ProtoSSLConnect` by signature later, as a
|
||||
positive M2 trip-wire (it should fire once we flip the gate).
|
||||
|
||||
### Surface mapped (clean-room)
|
||||
- **Redirector host table** (`FIFA23.exe` .rdata, pointer table @ `+0x83FC858`):
|
||||
`spring18.gosredirector.{sdev,stest,scert}.ea.com` + production
|
||||
`spring18.gosredirector.ea.com`.
|
||||
- **Redirector request/response config** (same region): `X-BLAZE-ERRORCODE`,
|
||||
**`Authorization:`**, `<errorCode>` — the redirector request carries an
|
||||
**Authorization header (a Nucleus token)**.
|
||||
- **Enum-name tables** (serialization only, NOT decision code): `ONLINE_ACCESS`
|
||||
(`Blaze::Nucleus::EntitlementType` = 1), `ONLINE_STATUS_EVENT`, … These are
|
||||
reflection tables keyed by enum *value*; string-xref of them is a dead end for
|
||||
the decision (the decision compares values, not strings).
|
||||
|
||||
### Point 2 — name the connection-state function: **PARTIAL.**
|
||||
- The exact connection-state decision is behind heavy C++ vtable indirection
|
||||
(the redirector config's two code pointers resolved to a virtual-dispatch
|
||||
thunk @ `FIFA23.exe+0x27BD4C0` and a `ret 0` stub @ `+0x4F3CBC0`). The
|
||||
memory-scan toolkit (string / pattern / xref / callers) cannot efficiently
|
||||
navigate this.
|
||||
- **Pinning the exact function needs a static disassembler with decompilation
|
||||
(Ghidra / IDA) on `FIFA23.exe`.** `protossl-scan` remains the bridge to the
|
||||
live process (mapping static addresses to the ASLR'd runtime, confirming hits,
|
||||
installing hooks).
|
||||
- `TODO/CONFIRM`: name the connection-state getter by module+offset via Ghidra.
|
||||
|
||||
### Point 3 — gate count: **TWO gates (state + token). Evidence-backed.**
|
||||
- The online-connect path **reads/requires an auth (Nucleus) token**: the
|
||||
redirector request carries an `Authorization:` header, and the SDK surface has
|
||||
`GetAuthCode` / `FakeAuth` / `<GameToken>`. So it is **not** a single
|
||||
connection-state boolean flip — even with the state forced "online", the client
|
||||
needs a valid token to build the redirector request.
|
||||
- **Conclusion for M2: plan for two gates** — (a) the connection-state decision,
|
||||
and (b) supplying an auth token the client accepts.
|
||||
- `TODO/CONFIRM` the exact abort point (no-token vs state-says-offline vs both) —
|
||||
needs Ghidra-level control-flow tracing.
|
||||
|
||||
### Recommendation
|
||||
Load `FIFA23.exe` into **Ghidra** to (a) name the connection-state getter
|
||||
precisely and (b) confirm the gate mechanism, then return to `protossl-scan` +
|
||||
the hook to map those addresses onto the live process and install the M2 hook.
|
||||
@@ -1,91 +0,0 @@
|
||||
# OpenFUT Bridge roadmap — from here to "Squad Battles loads"
|
||||
|
||||
Two **first-class** outcomes (not one goal + a consolation prize):
|
||||
|
||||
- **A. Full playable AI FUT** — the emulator build (M1–M7). Realistically a
|
||||
multi-month, expert-level reverse-engineering effort.
|
||||
- **B. Clean-room spec deliverable** — a documented map of the auth / Blaze /
|
||||
ProtoSSL / Fire2 surface (transport, gates, framing, decision points). Produced
|
||||
incrementally as the findings from M1–M5; **finishable and valuable on its
|
||||
own**, and the foundation any future emulator needs.
|
||||
|
||||
Every milestone's "done" is a **client-observable** result. Unconfirmed
|
||||
dependencies are flagged.
|
||||
|
||||
## Done so far
|
||||
|
||||
- In-process `version.dll` hook (injects, forwards all 17 real exports).
|
||||
- Transport confirmed: DirtySDK/ProtoSSL. `_ProtoSSLSendPacket` @
|
||||
`FIFA23.exe+0xEFA530` hooked (plaintext-capture ready).
|
||||
- `connect` / DNS / LSX (`send`/`recv` + `WSASend`/`WSARecv`) capture; mutexed log.
|
||||
- Gate identified: **upstream Ebisu connection-state, in-process** (see
|
||||
`connection-gate-findings.md`).
|
||||
- RE toolkit: `protossl-scan` (scan / xref / disasm / module+offset).
|
||||
|
||||
## M1 — Locate the connection-state decision point · Outcome B core
|
||||
- Read-only hook `ProtoSSLConnect`; find the Ebisu connection-state getter the
|
||||
FUT-entry path polls.
|
||||
- **Done:** we can name the exact function/return that gates "attempt online."
|
||||
- Unknown: coupling to anadius's detour. **Effort:** ~days.
|
||||
|
||||
## M2 — Flip the gate (force "connected") · pure gate-flip proof
|
||||
- Out-hook the getter / patch the polled state so the game attempts the real
|
||||
connection.
|
||||
- **Done (observable):** the game emits a DNS lookup / `connect` for the Blaze
|
||||
redirector (`gosredirector.*`).
|
||||
- Unknown: a secondary auth-token gate may also block. `TODO/CONFIRM`.
|
||||
**Effort:** ~days.
|
||||
|
||||
## M3 — First real ProtoSSL plaintext on the Blaze connection · SMALLEST END-TO-END PROOF (see "Smallest milestone")
|
||||
- Our redirect catches the Blaze connect; the ProtoSSL hook logs the first
|
||||
plaintext it emits (the TLS **ClientHello** to the redirector).
|
||||
- **Done:** `hook.log` shows the ClientHello from the *real* Blaze connection.
|
||||
- Note: this is a TLS handshake frame, **not yet** a Blaze/Fire2 app-data frame.
|
||||
**Effort:** small once M2 lands.
|
||||
|
||||
## M4 — Answer the redirector + decode first Fire2 frame · Outcome B: first decode
|
||||
- Inject a response via the ProtoSSL recv side so the client advances; decode
|
||||
the first Blaze/Fire2 request frame from real captured bytes.
|
||||
- **Done:** the client advances past the redirector (sends the next gate's frame).
|
||||
- Unknown (**BIG**): **Fire2 framing UNCONFIRMED**; **ProtoSSL recv-injection /
|
||||
TLS-bypass convention UNCONFIRMED**; **Blaze component/command IDs UNCONFIRMED**.
|
||||
**Effort:** high.
|
||||
|
||||
## M5 — Blaze preauth / login / postauth (online session) · Outcome B: full auth surface
|
||||
- Answer UTIL preauth, AUTHENTICATION login (reusing anadius's persona surface),
|
||||
UTIL postauth.
|
||||
- **Done:** client reports online / reaches the FUT entry check.
|
||||
- Depends on M4 framing. **Effort:** high.
|
||||
|
||||
## M6 — FUT entry + hub load (route to OpenFUT Core) · Outcome A
|
||||
- Answer the FUT eligibility check; serve the FUT hub (club/squad) from OpenFUT
|
||||
Core via the bridge.
|
||||
- **Done:** the FUT hub UI loads (club/squad screen).
|
||||
- Depends on Core's FUT REST surface. **Effort:** high.
|
||||
|
||||
## M7 — Squad Battles (AI FUT) · Outcome A goal
|
||||
- Wire Squad Battles match setup / rewards against Core.
|
||||
- **Done:** a Squad Battles match starts and rewards apply.
|
||||
- **Effort:** medium-high after M6.
|
||||
|
||||
## Outcome mapping
|
||||
- **B (spec)** completes as M1–M5 are documented — valuable even if A stalls.
|
||||
- **A (playable AI FUT)** requires M1–M7.
|
||||
|
||||
## Smallest provable milestone (step 4)
|
||||
|
||||
Refined from the proposed candidate. The single smallest result that validates
|
||||
the whole architecture end-to-end:
|
||||
|
||||
> **M3 — the client emits its first ProtoSSL plaintext onto the _real_ Blaze
|
||||
> connection (the ClientHello to the redirector), captured by our hook.**
|
||||
|
||||
It proves both halves at once: (1) we got the game past its connection-state
|
||||
check — it went online **for real**; and (2) our redirect + ProtoSSL hook
|
||||
capture real plaintext from that connection.
|
||||
|
||||
It deliberately stops short of the candidate's "first **Blaze** frame" (a Fire2
|
||||
app-data message), which requires answering the TLS handshake (M4) and depends
|
||||
on the unconfirmed Fire2 / recv-injection work. ClientHello capture needs none
|
||||
of that — making it the smallest, safest proof. The first Fire2 frame is the
|
||||
immediate follow-on (M4).
|
||||
Generated
-336
@@ -1,336 +0,0 @@
|
||||
# This file is automatically @generated by Cargo.
|
||||
# It is not intended for manual editing.
|
||||
version = 4
|
||||
|
||||
[[package]]
|
||||
name = "bitflags"
|
||||
version = "1.3.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
|
||||
|
||||
[[package]]
|
||||
name = "cc"
|
||||
version = "1.2.65"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
|
||||
dependencies = [
|
||||
"find-msvc-tools",
|
||||
"shlex",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "cfg-if"
|
||||
version = "1.0.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
|
||||
|
||||
[[package]]
|
||||
name = "find-msvc-tools"
|
||||
version = "0.1.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
|
||||
|
||||
[[package]]
|
||||
name = "generic-array"
|
||||
version = "0.14.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4bb6743198531e02858aeaea5398fcc883e71851fcbcb5a2f773e2fb6cb1edf2"
|
||||
dependencies = [
|
||||
"typenum",
|
||||
"version_check",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "libc"
|
||||
version = "0.2.186"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
|
||||
|
||||
[[package]]
|
||||
name = "libudis86-sys"
|
||||
version = "0.2.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "139bbf9ddb1bfc90c1ac64dd2923d9c957cd433cee7315c018125d72ab08a6b0"
|
||||
dependencies = [
|
||||
"cc",
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "mach2"
|
||||
version = "0.4.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d640282b302c0bb0a2a8e0233ead9035e3bed871f0b7e81fe4a1ec829765db44"
|
||||
dependencies = [
|
||||
"libc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "mmap-fixed-fixed"
|
||||
version = "0.1.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0681853891801e4763dc252e843672faf32bcfee27a0aa3b19733902af450acc"
|
||||
dependencies = [
|
||||
"libc",
|
||||
"winapi",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "once_cell"
|
||||
version = "1.21.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
|
||||
|
||||
[[package]]
|
||||
name = "openfut-hook"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"retour",
|
||||
"windows",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "proc-macro2"
|
||||
version = "1.0.106"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
|
||||
dependencies = [
|
||||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "quote"
|
||||
version = "1.0.46"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "region"
|
||||
version = "3.0.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e6b6ebd13bc009aef9cd476c1310d49ac354d36e240cf1bd753290f3dc7199a7"
|
||||
dependencies = [
|
||||
"bitflags",
|
||||
"libc",
|
||||
"mach2",
|
||||
"windows-sys",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "retour"
|
||||
version = "0.3.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "a9af44d40e2400b44d491bfaf8eae111b09f23ac4de6e92728e79d93e699c527"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"generic-array",
|
||||
"libc",
|
||||
"libudis86-sys",
|
||||
"mmap-fixed-fixed",
|
||||
"once_cell",
|
||||
"region",
|
||||
"slice-pool2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "shlex"
|
||||
version = "2.0.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
|
||||
|
||||
[[package]]
|
||||
name = "slice-pool2"
|
||||
version = "0.4.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7a3d689654af89bdfeba29a914ab6ac0236d382eb3b764f7454dde052f2821f8"
|
||||
|
||||
[[package]]
|
||||
name = "syn"
|
||||
version = "2.0.118"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "typenum"
|
||||
version = "1.20.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
|
||||
|
||||
[[package]]
|
||||
name = "unicode-ident"
|
||||
version = "1.0.24"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
|
||||
|
||||
[[package]]
|
||||
name = "version_check"
|
||||
version = "0.9.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
|
||||
|
||||
[[package]]
|
||||
name = "winapi"
|
||||
version = "0.3.9"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
|
||||
dependencies = [
|
||||
"winapi-i686-pc-windows-gnu",
|
||||
"winapi-x86_64-pc-windows-gnu",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "winapi-i686-pc-windows-gnu"
|
||||
version = "0.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
|
||||
|
||||
[[package]]
|
||||
name = "winapi-x86_64-pc-windows-gnu"
|
||||
version = "0.4.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
|
||||
|
||||
[[package]]
|
||||
name = "windows"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dd04d41d93c4992d421894c18c8b43496aa748dd4c081bac0dc93eb0489272b6"
|
||||
dependencies = [
|
||||
"windows-core",
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-core"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99"
|
||||
dependencies = [
|
||||
"windows-implement",
|
||||
"windows-interface",
|
||||
"windows-result",
|
||||
"windows-strings",
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-implement"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2bbd5b46c938e506ecbce286b6628a02171d56153ba733b6c741fc627ec9579b"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-interface"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "053c4c462dc91d3b1504c6fe5a726dd15e216ba718e84a0e46a88fbe5ded3515"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-result"
|
||||
version = "0.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
|
||||
dependencies = [
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-strings"
|
||||
version = "0.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
|
||||
dependencies = [
|
||||
"windows-result",
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-sys"
|
||||
version = "0.52.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
|
||||
dependencies = [
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-targets"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
|
||||
dependencies = [
|
||||
"windows_aarch64_gnullvm",
|
||||
"windows_aarch64_msvc",
|
||||
"windows_i686_gnu",
|
||||
"windows_i686_gnullvm",
|
||||
"windows_i686_msvc",
|
||||
"windows_x86_64_gnu",
|
||||
"windows_x86_64_gnullvm",
|
||||
"windows_x86_64_msvc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows_aarch64_gnullvm"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
|
||||
|
||||
[[package]]
|
||||
name = "windows_aarch64_msvc"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
|
||||
|
||||
[[package]]
|
||||
name = "windows_i686_gnu"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
|
||||
|
||||
[[package]]
|
||||
name = "windows_i686_gnullvm"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
|
||||
|
||||
[[package]]
|
||||
name = "windows_i686_msvc"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_gnu"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_gnullvm"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_msvc"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
|
||||
@@ -1,30 +0,0 @@
|
||||
[package]
|
||||
name = "openfut-hook"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
description = "FIFA 23 version.dll proxy + ProtoSSL plaintext capture hook"
|
||||
|
||||
[lib]
|
||||
# Output is `version.dll` (the proxy/sideload name FIFA 23 loads).
|
||||
name = "version"
|
||||
crate-type = ["cdylib"]
|
||||
|
||||
[dependencies]
|
||||
# Inline-hooking library (installs the detour on _ProtoSSLSendPacket).
|
||||
retour = "0.3"
|
||||
|
||||
# Win32 bindings for the loader/threading/module APIs the hook needs.
|
||||
windows = { version = "0.58", features = [
|
||||
"Win32_Foundation",
|
||||
"Win32_Security",
|
||||
"Win32_Networking_WinSock",
|
||||
"Win32_System_LibraryLoader",
|
||||
"Win32_System_ProcessStatus",
|
||||
"Win32_System_Threading",
|
||||
"Win32_System_SystemInformation",
|
||||
"Win32_System_SystemServices",
|
||||
] }
|
||||
|
||||
# Own workspace root so Cargo doesn't attach this to the openfut-bridge package
|
||||
# in the parent directory.
|
||||
[workspace]
|
||||
@@ -1,752 +0,0 @@
|
||||
//! openfut-hook — FIFA 23 `version.dll` proxy + ProtoSSL plaintext capture.
|
||||
//!
|
||||
//! This DLL is built as `version.dll` and dropped next to `FIFA23.exe`. The
|
||||
//! game loads it (DLL search-order / sideload), at which point we:
|
||||
//!
|
||||
//! 1. (Task 2) Forward every real `version.dll` export to the genuine system
|
||||
//! DLL, so the game keeps working. We prove load with a log line.
|
||||
//! 2. (Task 3) Pattern-scan FIFA23.exe for `_ProtoSSLSendPacket` (the DirtySDK
|
||||
//! TLS record assembler we located at FIFA23.exe+0xEFA530) and install an
|
||||
//! inline detour. At its entry the record payload is still PLAINTEXT, so we
|
||||
//! log the content type + the source buffers, then call the original.
|
||||
//!
|
||||
//! Everything is written to `C:\openfut\hook.log` with timestamps, in stages,
|
||||
//! so the log alone tells us how far initialization got.
|
||||
//!
|
||||
//! Clean-room: this is generic proxy/loader/hook scaffolding plus a byte
|
||||
//! pattern derived from observing the binary the user owns. No EA source.
|
||||
|
||||
use core::ffi::c_void;
|
||||
use std::sync::atomic::{AtomicUsize, Ordering};
|
||||
use std::sync::Mutex;
|
||||
|
||||
use retour::RawDetour;
|
||||
use windows::core::{PCSTR, PCWSTR};
|
||||
use windows::Win32::Foundation::{BOOL, HMODULE};
|
||||
use windows::Win32::Networking::WinSock::{WSAGetLastError, AF_INET, SOCKADDR, SOCKADDR_IN};
|
||||
use windows::Win32::System::LibraryLoader::{
|
||||
DisableThreadLibraryCalls, GetModuleHandleW, GetProcAddress, LoadLibraryW,
|
||||
};
|
||||
use windows::Win32::System::ProcessStatus::{GetModuleInformation, MODULEINFO};
|
||||
use windows::Win32::System::SystemInformation::GetLocalTime;
|
||||
use windows::Win32::System::SystemServices::DLL_PROCESS_ATTACH;
|
||||
use windows::Win32::System::Threading::{
|
||||
CreateThread, GetCurrentProcess, Sleep, THREAD_CREATION_FLAGS,
|
||||
};
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Task 2: version.dll export forwarding
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Resolved addresses of the real system `version.dll` exports. Each proxy stub
|
||||
/// below tail-jumps to its slot. AtomicUsize (not `static mut`) keeps this sound
|
||||
/// and lets the naked stubs read the raw pointer via a simple memory load.
|
||||
static REAL: [AtomicUsize; 17] = [const { AtomicUsize::new(0) }; 17];
|
||||
|
||||
/// The 17 exports a real `version.dll` provides, in the SAME order as the proxy
|
||||
/// stubs' indices below.
|
||||
const EXPORTS: [&str; 17] = [
|
||||
"GetFileVersionInfoA",
|
||||
"GetFileVersionInfoByHandle",
|
||||
"GetFileVersionInfoExA",
|
||||
"GetFileVersionInfoExW",
|
||||
"GetFileVersionInfoSizeA",
|
||||
"GetFileVersionInfoSizeExA",
|
||||
"GetFileVersionInfoSizeExW",
|
||||
"GetFileVersionInfoSizeW",
|
||||
"GetFileVersionInfoW",
|
||||
"VerFindFileA",
|
||||
"VerFindFileW",
|
||||
"VerInstallFileA",
|
||||
"VerInstallFileW",
|
||||
"VerLanguageNameA",
|
||||
"VerLanguageNameW",
|
||||
"VerQueryValueA",
|
||||
"VerQueryValueW",
|
||||
];
|
||||
|
||||
/// Generate an exported, naked proxy stub that tail-jumps to `REAL[idx]`.
|
||||
/// A tail `jmp` leaves every register/stack arg untouched, so it forwards any
|
||||
/// signature correctly regardless of how many arguments the real function takes.
|
||||
macro_rules! proxy_stub {
|
||||
($idx:literal, $name:ident) => {
|
||||
#[no_mangle]
|
||||
#[unsafe(naked)]
|
||||
pub unsafe extern "system" fn $name() {
|
||||
core::arch::naked_asm!(
|
||||
"jmp qword ptr [rip + {base} + {off}]",
|
||||
base = sym REAL,
|
||||
off = const $idx * 8,
|
||||
);
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
proxy_stub!(0, GetFileVersionInfoA);
|
||||
proxy_stub!(1, GetFileVersionInfoByHandle);
|
||||
proxy_stub!(2, GetFileVersionInfoExA);
|
||||
proxy_stub!(3, GetFileVersionInfoExW);
|
||||
proxy_stub!(4, GetFileVersionInfoSizeA);
|
||||
proxy_stub!(5, GetFileVersionInfoSizeExA);
|
||||
proxy_stub!(6, GetFileVersionInfoSizeExW);
|
||||
proxy_stub!(7, GetFileVersionInfoSizeW);
|
||||
proxy_stub!(8, GetFileVersionInfoW);
|
||||
proxy_stub!(9, VerFindFileA);
|
||||
proxy_stub!(10, VerFindFileW);
|
||||
proxy_stub!(11, VerInstallFileA);
|
||||
proxy_stub!(12, VerInstallFileW);
|
||||
proxy_stub!(13, VerLanguageNameA);
|
||||
proxy_stub!(14, VerLanguageNameW);
|
||||
proxy_stub!(15, VerQueryValueA);
|
||||
proxy_stub!(16, VerQueryValueW);
|
||||
|
||||
/// Load the genuine `version.dll` by full path (so we don't re-load ourselves)
|
||||
/// and fill `REAL[]` with each export's address. Done synchronously in DllMain
|
||||
/// so the slots are ready before the game calls any version function.
|
||||
unsafe fn resolve_exports() {
|
||||
let path = wide("C:\\Windows\\System32\\version.dll");
|
||||
let module = match LoadLibraryW(PCWSTR(path.as_ptr())) {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
log(&format!("FATAL: could not load real version.dll: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
let mut missing = 0;
|
||||
for (i, name) in EXPORTS.iter().enumerate() {
|
||||
let cname = std::ffi::CString::new(*name).unwrap();
|
||||
let addr = GetProcAddress(module, PCSTR(cname.as_ptr() as *const u8))
|
||||
.map(|f| f as usize)
|
||||
.unwrap_or(0);
|
||||
REAL[i].store(addr, Ordering::SeqCst);
|
||||
if addr == 0 {
|
||||
missing += 1;
|
||||
log(&format!("warn: real version.dll missing export {name}"));
|
||||
}
|
||||
}
|
||||
log(&format!("forwarded {} version.dll exports", 17 - missing));
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Task 3: the _ProtoSSLSendPacket detour
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Trampoline to the original `_ProtoSSLSendPacket`, stored after we hook.
|
||||
static ORIG: AtomicUsize = AtomicUsize::new(0);
|
||||
|
||||
/// Signature derived from the disassembly (Windows x64 ABI):
|
||||
/// `_ProtoSSLSendPacket(pState, contentType, bufA, lenA, bufB, lenB) -> i32`.
|
||||
type SendPacket =
|
||||
unsafe extern "system" fn(*mut c_void, u32, *const u8, i32, *const u8, i32) -> i32;
|
||||
|
||||
/// Byte pattern for the `_ProtoSSLSendPacket` prologue. The four `0x00` bytes at
|
||||
/// the masked positions are the stack-cookie `mov rax,[rip+disp32]` displacement
|
||||
/// (position-dependent), so they're wildcarded via `MASK`.
|
||||
const PATTERN: [u8; 36] = [
|
||||
0x40, 0x53, 0x55, 0x56, 0x57, 0x41, 0x54, 0x41, 0x55, 0x41, 0x57, 0x48, 0x81, 0xEC, 0xB0,
|
||||
0x00, 0x00, 0x00, 0x48, 0x8B, 0x05, 0x00, 0x00, 0x00, 0x00, 0x48, 0x33, 0xC4, 0x48, 0x89,
|
||||
0x84, 0x24, 0xA0, 0x00, 0x00, 0x00,
|
||||
];
|
||||
/// `false` = wildcard byte (don't compare). Indices 21..=24 are the disp32.
|
||||
const MASK: [bool; 36] = {
|
||||
let mut m = [true; 36];
|
||||
m[21] = false;
|
||||
m[22] = false;
|
||||
m[23] = false;
|
||||
m[24] = false;
|
||||
m
|
||||
};
|
||||
|
||||
/// Our detour. At entry the record payload is still plaintext, so we log the
|
||||
/// content type and source buffers, then forward to the original unchanged.
|
||||
unsafe extern "system" fn hooked(
|
||||
p_state: *mut c_void,
|
||||
content_type: u32,
|
||||
buf_a: *const u8,
|
||||
len_a: i32,
|
||||
buf_b: *const u8,
|
||||
len_b: i32,
|
||||
) -> i32 {
|
||||
log_frame(content_type as u8, buf_a, len_a, buf_b, len_b);
|
||||
|
||||
let orig = ORIG.load(Ordering::SeqCst);
|
||||
if orig != 0 {
|
||||
let orig: SendPacket = core::mem::transmute(orig);
|
||||
orig(p_state, content_type, buf_a, len_a, buf_b, len_b)
|
||||
} else {
|
||||
// Should never happen (we store ORIG before the game can call us), but
|
||||
// never crash the game if it does.
|
||||
0
|
||||
}
|
||||
}
|
||||
|
||||
/// Background init: pattern-scan FIFA23.exe for the function, then detour it.
|
||||
/// Retries for a while in case the image isn't fully paged in at load.
|
||||
unsafe extern "system" fn init_thread(_: *mut c_void) -> u32 {
|
||||
// Connection capture first. Listen on the LSX port (gate 1, so the launcher
|
||||
// bootstrap succeeds) and on the redirect port (for external TLS/Blaze).
|
||||
start_listener(LSX_PORT, "LSX");
|
||||
start_listener(LOCAL_PORT, "BLZ");
|
||||
hook_dns();
|
||||
hook_winsock_data();
|
||||
hook_connect();
|
||||
|
||||
// Then the plaintext-capture detour on _ProtoSSLSendPacket.
|
||||
for _ in 0..60 {
|
||||
if let Some(addr) = find_send_packet() {
|
||||
install_hook(addr);
|
||||
return 0;
|
||||
}
|
||||
Sleep(1000);
|
||||
}
|
||||
log("ERROR: _ProtoSSLSendPacket pattern not found after 60s");
|
||||
0
|
||||
}
|
||||
|
||||
/// Scan the FIFA23.exe image for the `_ProtoSSLSendPacket` prologue pattern.
|
||||
unsafe fn find_send_packet() -> Option<usize> {
|
||||
let module = GetModuleHandleW(PCWSTR::null()).ok()?; // null => the EXE itself
|
||||
let base = module.0 as usize;
|
||||
|
||||
let mut info = MODULEINFO::default();
|
||||
GetModuleInformation(
|
||||
GetCurrentProcess(),
|
||||
module,
|
||||
&mut info,
|
||||
core::mem::size_of::<MODULEINFO>() as u32,
|
||||
)
|
||||
.ok()?;
|
||||
let size = info.SizeOfImage as usize;
|
||||
let hay = core::slice::from_raw_parts(base as *const u8, size);
|
||||
|
||||
let plen = PATTERN.len();
|
||||
if hay.len() < plen {
|
||||
return None;
|
||||
}
|
||||
for i in 0..=hay.len() - plen {
|
||||
// Cheap first-byte gate before the full compare.
|
||||
if hay[i] != PATTERN[0] {
|
||||
continue;
|
||||
}
|
||||
let mut ok = true;
|
||||
for j in 1..plen {
|
||||
if MASK[j] && hay[i + j] != PATTERN[j] {
|
||||
ok = false;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if ok {
|
||||
return Some(base + i);
|
||||
}
|
||||
}
|
||||
None
|
||||
}
|
||||
|
||||
/// Install the inline detour on the resolved function address.
|
||||
unsafe fn install_hook(addr: usize) {
|
||||
let detour = match RawDetour::new(addr as *const (), hooked as *const ()) {
|
||||
Ok(d) => d,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: could not create detour: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
if let Err(e) = detour.enable() {
|
||||
log(&format!("ERROR: could not enable detour: {e:?}"));
|
||||
return;
|
||||
}
|
||||
// Leak the detour so it lives forever (dropping it would un-hook), and
|
||||
// publish its trampoline so `hooked` can call the original.
|
||||
let detour: &'static RawDetour = Box::leak(Box::new(detour));
|
||||
ORIG.store(detour.trampoline() as *const () as usize, Ordering::SeqCst);
|
||||
log(&format!(
|
||||
"hook installed: _ProtoSSLSendPacket @ 0x{addr:X} (FIFA23.exe+0x{:X})",
|
||||
addr - module_base(),
|
||||
));
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Connection capture: log every connect() and redirect external attempts to a
|
||||
// local listener, so the client's TCP succeeds and it starts sending TLS.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Local port our in-DLL listener binds; redirected connections land here.
|
||||
const LOCAL_PORT: u16 = 7777;
|
||||
|
||||
/// The EA launcher LSX port. The game connects here for launcher↔game bootstrap
|
||||
/// (gate 1). We listen so the connect succeeds and we can see the LSX protocol.
|
||||
const LSX_PORT: u16 = 3216;
|
||||
|
||||
/// Trampoline to the original ws2_32 `connect`.
|
||||
static ORIG_CONNECT: AtomicUsize = AtomicUsize::new(0);
|
||||
|
||||
type ConnectFn = unsafe extern "system" fn(usize, *const SOCKADDR, i32) -> i32;
|
||||
|
||||
/// Our `connect` detour: log the real destination, and for any non-loopback
|
||||
/// IPv4 target, rewrite it to 127.0.0.1:LOCAL_PORT before calling the original.
|
||||
unsafe extern "system" fn hooked_connect(s: usize, name: *const SOCKADDR, namelen: i32) -> i32 {
|
||||
let orig: ConnectFn = core::mem::transmute(ORIG_CONNECT.load(Ordering::SeqCst));
|
||||
|
||||
if !name.is_null() && (*name).sa_family == AF_INET {
|
||||
let sin = name as *const SOCKADDR_IN;
|
||||
let port = u16::from_be((*sin).sin_port);
|
||||
let octets = (*sin).sin_addr.S_un.S_addr.to_ne_bytes();
|
||||
let is_loopback = octets[0] == 127;
|
||||
let dst = format!("{}.{}.{}.{}:{}", octets[0], octets[1], octets[2], octets[3], port);
|
||||
|
||||
if !is_loopback {
|
||||
// Build a fresh 127.0.0.1:LOCAL_PORT address and connect there.
|
||||
let mut local: SOCKADDR_IN = core::mem::zeroed();
|
||||
local.sin_family = AF_INET;
|
||||
local.sin_port = LOCAL_PORT.to_be();
|
||||
local.sin_addr.S_un.S_addr = u32::from_ne_bytes([127, 0, 0, 1]);
|
||||
let ret = orig(
|
||||
s,
|
||||
&local as *const SOCKADDR_IN as *const SOCKADDR,
|
||||
core::mem::size_of::<SOCKADDR_IN>() as i32,
|
||||
);
|
||||
let err = if ret != 0 { WSAGetLastError().0 } else { 0 };
|
||||
log(&format!("CONNECT -> {dst} [redirected->7777] ret={ret} err={err}"));
|
||||
return ret;
|
||||
} else {
|
||||
let ret = orig(s, name, namelen);
|
||||
let err = if ret != 0 { WSAGetLastError().0 } else { 0 };
|
||||
log(&format!("CONNECT -> {dst} ret={ret} err={err}"));
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
|
||||
orig(s, name, namelen)
|
||||
}
|
||||
|
||||
// --- DNS logging: what hostnames does the client try to resolve? ----------
|
||||
|
||||
static ORIG_GAIW: AtomicUsize = AtomicUsize::new(0);
|
||||
static ORIG_GAI: AtomicUsize = AtomicUsize::new(0);
|
||||
|
||||
type GaiWFn = unsafe extern "system" fn(PCWSTR, PCWSTR, *const c_void, *mut *mut c_void) -> i32;
|
||||
type GaiFn = unsafe extern "system" fn(PCSTR, PCSTR, *const c_void, *mut *mut c_void) -> i32;
|
||||
|
||||
unsafe extern "system" fn hooked_gaiw(
|
||||
node: PCWSTR,
|
||||
svc: PCWSTR,
|
||||
hints: *const c_void,
|
||||
res: *mut *mut c_void,
|
||||
) -> i32 {
|
||||
let name = if node.is_null() {
|
||||
"<null>".to_string()
|
||||
} else {
|
||||
node.to_string().unwrap_or_else(|_| "<?>".into())
|
||||
};
|
||||
let orig: GaiWFn = core::mem::transmute(ORIG_GAIW.load(Ordering::SeqCst));
|
||||
let ret = orig(node, svc, hints, res);
|
||||
log(&format!("DNS GetAddrInfoW(\"{name}\") ret={ret}"));
|
||||
ret
|
||||
}
|
||||
|
||||
unsafe extern "system" fn hooked_gai(
|
||||
node: PCSTR,
|
||||
svc: PCSTR,
|
||||
hints: *const c_void,
|
||||
res: *mut *mut c_void,
|
||||
) -> i32 {
|
||||
let name = if node.is_null() {
|
||||
"<null>".to_string()
|
||||
} else {
|
||||
node.to_string().unwrap_or_else(|_| "<?>".into())
|
||||
};
|
||||
let orig: GaiFn = core::mem::transmute(ORIG_GAI.load(Ordering::SeqCst));
|
||||
let ret = orig(node, svc, hints, res);
|
||||
log(&format!("DNS getaddrinfo(\"{name}\") ret={ret}"));
|
||||
ret
|
||||
}
|
||||
|
||||
/// Generic: resolve `name` in `module`, install a detour to `detour`, store the
|
||||
/// trampoline in `slot`.
|
||||
unsafe fn install_detour(
|
||||
module: HMODULE,
|
||||
name: &[u8],
|
||||
detour: *const (),
|
||||
slot: &AtomicUsize,
|
||||
label: &str,
|
||||
) {
|
||||
let addr = match GetProcAddress(module, PCSTR(name.as_ptr())) {
|
||||
Some(f) => f as usize,
|
||||
None => {
|
||||
log(&format!("ERROR: {label} not found"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
let d = match RawDetour::new(addr as *const (), detour) {
|
||||
Ok(d) => d,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: {label} detour create: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
if d.enable().is_err() {
|
||||
log(&format!("ERROR: {label} detour enable failed"));
|
||||
return;
|
||||
}
|
||||
let d: &'static RawDetour = Box::leak(Box::new(d));
|
||||
slot.store(d.trampoline() as *const () as usize, Ordering::SeqCst);
|
||||
log(&format!("{label} hook installed"));
|
||||
}
|
||||
|
||||
/// Detour the DNS resolvers so we see every hostname lookup.
|
||||
unsafe fn hook_dns() {
|
||||
let ws2 = match LoadLibraryW(PCWSTR(wide("ws2_32.dll").as_ptr())) {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: load ws2_32 for DNS: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
install_detour(ws2, b"GetAddrInfoW\0", hooked_gaiw as *const (), &ORIG_GAIW, "GetAddrInfoW");
|
||||
install_detour(ws2, b"getaddrinfo\0", hooked_gai as *const (), &ORIG_GAI, "getaddrinfo");
|
||||
}
|
||||
|
||||
// --- LSX capture: read the Ebisu-SDK <-> anadius XML conversation ----------
|
||||
|
||||
static ORIG_SEND: AtomicUsize = AtomicUsize::new(0);
|
||||
static ORIG_RECV: AtomicUsize = AtomicUsize::new(0);
|
||||
|
||||
type SendFn = unsafe extern "system" fn(usize, *const u8, i32, i32) -> i32;
|
||||
type RecvFn = unsafe extern "system" fn(usize, *mut u8, i32, i32) -> i32;
|
||||
|
||||
/// Cheap test: does this buffer look like LSX/Ebisu XML (not TLS/binary)?
|
||||
fn looks_like_lsx(buf: &[u8]) -> bool {
|
||||
let n = buf.len().min(64);
|
||||
let head = &buf[..n];
|
||||
let has_lt = head.iter().any(|&b| b == b'<');
|
||||
let has_gt = head.iter().any(|&b| b == b'>');
|
||||
head.windows(3).any(|w| w == b"LSX")
|
||||
|| head.windows(5).any(|w| w == b"Ebisu")
|
||||
|| (has_lt && has_gt)
|
||||
}
|
||||
|
||||
unsafe extern "system" fn hooked_send(s: usize, buf: *const u8, len: i32, flags: i32) -> i32 {
|
||||
if len > 0 && !buf.is_null() {
|
||||
let head = core::slice::from_raw_parts(buf, (len as usize).min(64));
|
||||
if looks_like_lsx(head) {
|
||||
let show = core::slice::from_raw_parts(buf, (len as usize).min(800));
|
||||
log(&format!("LSX send sock={s} {len}B: {}", ascii_render(show)));
|
||||
}
|
||||
}
|
||||
let orig: SendFn = core::mem::transmute(ORIG_SEND.load(Ordering::SeqCst));
|
||||
orig(s, buf, len, flags)
|
||||
}
|
||||
|
||||
unsafe extern "system" fn hooked_recv(s: usize, buf: *mut u8, len: i32, flags: i32) -> i32 {
|
||||
let orig: RecvFn = core::mem::transmute(ORIG_RECV.load(Ordering::SeqCst));
|
||||
let ret = orig(s, buf, len, flags);
|
||||
if ret > 0 && !buf.is_null() {
|
||||
let head = core::slice::from_raw_parts(buf, (ret as usize).min(64));
|
||||
if looks_like_lsx(head) {
|
||||
let show = core::slice::from_raw_parts(buf, (ret as usize).min(800));
|
||||
log(&format!("LSX recv sock={s} {ret}B: {}", ascii_render(show)));
|
||||
}
|
||||
}
|
||||
ret
|
||||
}
|
||||
|
||||
// Async (overlapped/IOCP) variants. A WSABUF is { len, buf }.
|
||||
#[repr(C)]
|
||||
struct WsaBuf {
|
||||
len: u32,
|
||||
buf: *mut u8,
|
||||
}
|
||||
|
||||
static ORIG_WSASEND: AtomicUsize = AtomicUsize::new(0);
|
||||
static ORIG_WSARECV: AtomicUsize = AtomicUsize::new(0);
|
||||
|
||||
type WsaSendFn = unsafe extern "system" fn(
|
||||
usize,
|
||||
*const WsaBuf,
|
||||
u32,
|
||||
*mut u32,
|
||||
u32,
|
||||
*mut c_void,
|
||||
*mut c_void,
|
||||
) -> i32;
|
||||
type WsaRecvFn = unsafe extern "system" fn(
|
||||
usize,
|
||||
*const WsaBuf,
|
||||
u32,
|
||||
*mut u32,
|
||||
*mut u32,
|
||||
*mut c_void,
|
||||
*mut c_void,
|
||||
) -> i32;
|
||||
|
||||
unsafe extern "system" fn hooked_wsasend(
|
||||
s: usize,
|
||||
bufs: *const WsaBuf,
|
||||
count: u32,
|
||||
sent: *mut u32,
|
||||
flags: u32,
|
||||
ovl: *mut c_void,
|
||||
cr: *mut c_void,
|
||||
) -> i32 {
|
||||
// Outgoing data is readable before the call — capture the first buffer.
|
||||
if !bufs.is_null() && count > 0 {
|
||||
let b0 = &*bufs;
|
||||
if b0.len > 0 && !b0.buf.is_null() {
|
||||
let head = core::slice::from_raw_parts(b0.buf, (b0.len as usize).min(64));
|
||||
if looks_like_lsx(head) {
|
||||
let show = core::slice::from_raw_parts(b0.buf, (b0.len as usize).min(800));
|
||||
log(&format!("LSX WSASend sock={s} {}B: {}", b0.len, ascii_render(show)));
|
||||
}
|
||||
}
|
||||
}
|
||||
let orig: WsaSendFn = core::mem::transmute(ORIG_WSASEND.load(Ordering::SeqCst));
|
||||
orig(s, bufs, count, sent, flags, ovl, cr)
|
||||
}
|
||||
|
||||
unsafe extern "system" fn hooked_wsarecv(
|
||||
s: usize,
|
||||
bufs: *const WsaBuf,
|
||||
count: u32,
|
||||
recvd: *mut u32,
|
||||
flags: *mut u32,
|
||||
ovl: *mut c_void,
|
||||
cr: *mut c_void,
|
||||
) -> i32 {
|
||||
let orig: WsaRecvFn = core::mem::transmute(ORIG_WSARECV.load(Ordering::SeqCst));
|
||||
let ret = orig(s, bufs, count, recvd, flags, ovl, cr);
|
||||
// Only the synchronous case (no overlapped) has data ready on return.
|
||||
if ret == 0 && ovl.is_null() && !recvd.is_null() && !bufs.is_null() && count > 0 {
|
||||
let n = *recvd as usize;
|
||||
let b0 = &*bufs;
|
||||
if n > 0 && !b0.buf.is_null() {
|
||||
let cap = n.min(b0.len as usize);
|
||||
let head = core::slice::from_raw_parts(b0.buf, cap.min(64));
|
||||
if looks_like_lsx(head) {
|
||||
let show = core::slice::from_raw_parts(b0.buf, cap.min(800));
|
||||
log(&format!("LSX WSARecv sock={s} {n}B: {}", ascii_render(show)));
|
||||
}
|
||||
}
|
||||
}
|
||||
ret
|
||||
}
|
||||
|
||||
/// Detour ws2_32 send/recv (sync) and WSASend/WSARecv (async) to capture LSX XML.
|
||||
unsafe fn hook_winsock_data() {
|
||||
let ws2 = match LoadLibraryW(PCWSTR(wide("ws2_32.dll").as_ptr())) {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: load ws2_32 for send/recv: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
install_detour(ws2, b"send\0", hooked_send as *const (), &ORIG_SEND, "send");
|
||||
install_detour(ws2, b"recv\0", hooked_recv as *const (), &ORIG_RECV, "recv");
|
||||
install_detour(ws2, b"WSASend\0", hooked_wsasend as *const (), &ORIG_WSASEND, "WSASend");
|
||||
install_detour(ws2, b"WSARecv\0", hooked_wsarecv as *const (), &ORIG_WSARECV, "WSARecv");
|
||||
}
|
||||
|
||||
/// Resolve and detour ws2_32 `connect`.
|
||||
unsafe fn hook_connect() {
|
||||
let ws2 = match LoadLibraryW(PCWSTR(wide("ws2_32.dll").as_ptr())) {
|
||||
Ok(m) => m,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: could not load ws2_32.dll: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
let addr = match GetProcAddress(ws2, PCSTR(b"connect\0".as_ptr())) {
|
||||
Some(f) => f as usize,
|
||||
None => {
|
||||
log("ERROR: connect not found in ws2_32.dll");
|
||||
return;
|
||||
}
|
||||
};
|
||||
let detour = match RawDetour::new(addr as *const (), hooked_connect as *const ()) {
|
||||
Ok(d) => d,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: could not create connect detour: {e:?}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
if let Err(e) = detour.enable() {
|
||||
log(&format!("ERROR: could not enable connect detour: {e:?}"));
|
||||
return;
|
||||
}
|
||||
let detour: &'static RawDetour = Box::leak(Box::new(detour));
|
||||
ORIG_CONNECT.store(detour.trampoline() as *const () as usize, Ordering::SeqCst);
|
||||
log("connect hook installed (external IPv4 -> 127.0.0.1:7777)");
|
||||
}
|
||||
|
||||
/// Spawn a TCP listener on `127.0.0.1:port`, tagging logged traffic with `tag`.
|
||||
/// Accepts connections and logs what the client sends — as readable text (for
|
||||
/// the text-based LSX protocol) plus a hex prefix (for binary TLS/Blaze).
|
||||
fn start_listener(port: u16, tag: &'static str) {
|
||||
std::thread::spawn(move || {
|
||||
let listener = match std::net::TcpListener::bind(("127.0.0.1", port)) {
|
||||
Ok(l) => l,
|
||||
Err(e) => {
|
||||
log(&format!("ERROR: listener[{tag}] bind {port} failed: {e}"));
|
||||
return;
|
||||
}
|
||||
};
|
||||
let bound = listener
|
||||
.local_addr()
|
||||
.map(|a| a.to_string())
|
||||
.unwrap_or_default();
|
||||
log(&format!("listener[{tag}] up, bound {bound}, accepting"));
|
||||
|
||||
// Explicit accept loop so accept errors are visible (not swallowed).
|
||||
loop {
|
||||
match listener.accept() {
|
||||
Ok((stream, peer)) => {
|
||||
log(&format!("ACCEPT[{tag}] from {peer}"));
|
||||
std::thread::spawn(move || handle_conn(stream, tag, peer.to_string()));
|
||||
}
|
||||
Err(e) => {
|
||||
log(&format!("ACCEPT[{tag}] error: {e}"));
|
||||
std::thread::sleep(std::time::Duration::from_millis(250));
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
fn handle_conn(mut stream: std::net::TcpStream, tag: &'static str, peer: String) {
|
||||
use std::io::Read;
|
||||
let mut buf = [0u8; 2048];
|
||||
let mut total = 0usize;
|
||||
loop {
|
||||
match stream.read(&mut buf) {
|
||||
Ok(0) | Err(_) => break,
|
||||
Ok(n) => {
|
||||
total += n;
|
||||
let ascii = ascii_render(&buf[..n.min(400)]);
|
||||
let hexp = hex(&buf[..n.min(24)]);
|
||||
log(&format!("RECV[{tag}] {n}B | hex: {hexp} | text: {ascii}"));
|
||||
}
|
||||
}
|
||||
}
|
||||
log(&format!("CLOSE[{tag}] from {peer} after {total}B total"));
|
||||
}
|
||||
|
||||
/// Render bytes as printable ASCII (non-printable -> '.'), for text protocols.
|
||||
fn ascii_render(bytes: &[u8]) -> String {
|
||||
bytes
|
||||
.iter()
|
||||
.map(|&b| {
|
||||
if (0x20..=0x7e).contains(&b) || b == b'\n' || b == b'\r' || b == b'\t' {
|
||||
b as char
|
||||
} else {
|
||||
'.'
|
||||
}
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Logging
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
fn log_frame(content_type: u8, buf_a: *const u8, len_a: i32, buf_b: *const u8, len_b: i32) {
|
||||
let label = match content_type {
|
||||
0x14 => "ccs",
|
||||
0x15 => "alert",
|
||||
0x16 => "handshake",
|
||||
0x17 => "appdata",
|
||||
_ => "?",
|
||||
};
|
||||
let mut line = format!("SEND type=0x{content_type:02X}({label}) lenA={len_a} lenB={len_b}");
|
||||
if !buf_a.is_null() && len_a > 0 {
|
||||
let n = (len_a as usize).min(48);
|
||||
let bytes = unsafe { core::slice::from_raw_parts(buf_a, n) };
|
||||
line.push_str(&format!(" | A: {}", hex(bytes)));
|
||||
}
|
||||
if !buf_b.is_null() && len_b > 0 {
|
||||
let n = (len_b as usize).min(16);
|
||||
let bytes = unsafe { core::slice::from_raw_parts(buf_b, n) };
|
||||
line.push_str(&format!(" | B: {}", hex(bytes)));
|
||||
}
|
||||
log(&line);
|
||||
}
|
||||
|
||||
fn hex(bytes: &[u8]) -> String {
|
||||
bytes
|
||||
.iter()
|
||||
.map(|b| format!("{b:02X}"))
|
||||
.collect::<Vec<_>>()
|
||||
.join(" ")
|
||||
}
|
||||
|
||||
/// Serializes log writes so concurrent threads don't corrupt each other's lines.
|
||||
static LOG_LOCK: Mutex<()> = Mutex::new(());
|
||||
|
||||
/// Append a timestamped line to `C:\openfut\hook.log`.
|
||||
fn log(msg: &str) {
|
||||
use std::io::Write;
|
||||
let _guard = LOG_LOCK.lock();
|
||||
let _ = std::fs::create_dir_all("C:\\openfut");
|
||||
if let Ok(mut f) = std::fs::OpenOptions::new()
|
||||
.create(true)
|
||||
.append(true)
|
||||
.open("C:\\openfut\\hook.log")
|
||||
{
|
||||
let _ = writeln!(f, "[{}] {}", now(), msg);
|
||||
}
|
||||
}
|
||||
|
||||
fn now() -> String {
|
||||
let st = unsafe { GetLocalTime() };
|
||||
format!(
|
||||
"{:04}-{:02}-{:02} {:02}:{:02}:{:02}",
|
||||
st.wYear, st.wMonth, st.wDay, st.wHour, st.wMinute, st.wSecond
|
||||
)
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Helpers + entry point
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
fn wide(s: &str) -> Vec<u16> {
|
||||
s.encode_utf16().chain(std::iter::once(0)).collect()
|
||||
}
|
||||
|
||||
/// FIFA23.exe base address (the main module), for pretty logging.
|
||||
fn module_base() -> usize {
|
||||
unsafe {
|
||||
GetModuleHandleW(PCWSTR::null())
|
||||
.map(|h| h.0 as usize)
|
||||
.unwrap_or(0)
|
||||
}
|
||||
}
|
||||
|
||||
#[no_mangle]
|
||||
pub extern "system" fn DllMain(module: HMODULE, reason: u32, _reserved: *mut c_void) -> BOOL {
|
||||
if reason == DLL_PROCESS_ATTACH {
|
||||
unsafe {
|
||||
let _ = DisableThreadLibraryCalls(module);
|
||||
|
||||
let host = std::env::current_exe()
|
||||
.map(|p| p.display().to_string())
|
||||
.unwrap_or_default();
|
||||
log(&format!(
|
||||
"openfut-hook loaded | pid {} | host {host}",
|
||||
std::process::id()
|
||||
));
|
||||
|
||||
// Forward exports synchronously (must be ready before any call)...
|
||||
resolve_exports();
|
||||
|
||||
// ...then do the pattern scan + hook on a background thread (never
|
||||
// do real work directly in DllMain — loader lock).
|
||||
let _ = CreateThread(
|
||||
None,
|
||||
0,
|
||||
Some(init_thread),
|
||||
None,
|
||||
THREAD_CREATION_FLAGS(0),
|
||||
None,
|
||||
);
|
||||
}
|
||||
}
|
||||
BOOL(1)
|
||||
}
|
||||
+88
-3
@@ -381,6 +381,36 @@ const EXACT: &[ExactRoute] = &[
|
||||
core_method: "GET", core_path: "/notifications",
|
||||
notes: "FUT active messages → Core notifications (mapped to nearest equivalent)",
|
||||
},
|
||||
// ── Dynamic objectives (FIFA 23 actual path) ──────────────────────────────
|
||||
ExactRoute {
|
||||
ea_method: "GET", ea_path: "/ut/game/fut/user/dynamicobjectives",
|
||||
core_method: "GET", core_path: "/objectives",
|
||||
notes: "FIFA 23 dynamic objectives list → Core objectives",
|
||||
},
|
||||
// ── SBS challenges (FIFA 23 uses /sbs/ not /sbc/) ────────────────────────
|
||||
ExactRoute {
|
||||
ea_method: "GET", ea_path: "/ut/game/fut/sbs/challenges",
|
||||
core_method: "GET", core_path: "/sbc",
|
||||
notes: "FIFA 23 SBS challenges list → Core SBC list",
|
||||
},
|
||||
// ── Squad Battles result (separate from rivals/result) ───────────────────
|
||||
ExactRoute {
|
||||
ea_method: "POST", ea_path: "/ut/game/fut/squadbattle/result",
|
||||
core_method: "POST", core_path: "/matches/result",
|
||||
notes: "Squad Battles match result → Core match result",
|
||||
},
|
||||
// ── Match submission (FIFA 23 uses /game/r) ───────────────────────────────
|
||||
ExactRoute {
|
||||
ea_method: "POST", ea_path: "/ut/game/fut/game/r",
|
||||
core_method: "POST", core_path: "/matches/result",
|
||||
notes: "FIFA 23 match result (short path /game/r) → Core match result",
|
||||
},
|
||||
// ── Squad list ────────────────────────────────────────────────────────────
|
||||
ExactRoute {
|
||||
ea_method: "GET", ea_path: "/ut/game/fut/squads/user",
|
||||
core_method: "GET", core_path: "/squad",
|
||||
notes: "FUT squad list for user → Core squad",
|
||||
},
|
||||
];
|
||||
|
||||
// ── Prefix mappings (dynamic path segments after a known prefix) ───────────────
|
||||
@@ -431,6 +461,36 @@ fn prefix_routes() -> &'static [PrefixRoute] {
|
||||
core_path_fn: |_| "/sbc/submit".to_string(),
|
||||
notes: "FUT SBC set submission → Core SBC submit",
|
||||
},
|
||||
// /ut/game/fut/sbs/challenges/{id} → GET /sbc/{id}
|
||||
PrefixRoute {
|
||||
ea_method: "GET",
|
||||
ea_prefix: "/ut/game/fut/sbs/challenges/",
|
||||
core_path_fn: |suffix| {
|
||||
// suffix is "{id}" or "{id}/sets/{setId}" — strip extra segments
|
||||
let id = suffix.split('/').next().unwrap_or(suffix);
|
||||
format!("/sbc/{id}")
|
||||
},
|
||||
notes: "FIFA 23 SBS challenge detail → Core SBC by ID",
|
||||
},
|
||||
// /ut/game/fut/sbs/challenges/{id}/sets/{setId}/trade → POST /sbc/submit
|
||||
PrefixRoute {
|
||||
ea_method: "POST",
|
||||
ea_prefix: "/ut/game/fut/sbs/challenges/",
|
||||
core_path_fn: |_| "/sbc/submit".to_string(),
|
||||
notes: "FIFA 23 SBS challenge trade → Core SBC submit",
|
||||
},
|
||||
// /ut/game/fut/user/dynamicobjectives/{id}/milestones/{m}/claim
|
||||
// → POST /objectives/{id}/claim
|
||||
PrefixRoute {
|
||||
ea_method: "POST",
|
||||
ea_prefix: "/ut/game/fut/user/dynamicobjectives/",
|
||||
core_path_fn: |suffix| {
|
||||
// suffix is "{id}/milestones/{m}/claim" — extract just the obj id
|
||||
let obj_id = suffix.split('/').next().unwrap_or(suffix);
|
||||
format!("/objectives/{obj_id}/claim")
|
||||
},
|
||||
notes: "FIFA 23 dynamic objective claim → Core objective claim by ID",
|
||||
},
|
||||
// /ut/game/fut/trade/{trade_id} (DELETE) → DELETE /market/listings/{trade_id}
|
||||
PrefixRoute {
|
||||
ea_method: "DELETE",
|
||||
@@ -523,7 +583,7 @@ pub fn map_to_core(method: &str, path: &str) -> Option<CoreMapping> {
|
||||
if !suffix.is_empty() {
|
||||
let core_path = (r.core_path_fn)(suffix);
|
||||
return Some(CoreMapping {
|
||||
method: "GET", // overridden per-route below
|
||||
method: r.ea_method,
|
||||
core_path,
|
||||
notes: r.notes,
|
||||
});
|
||||
@@ -720,14 +780,39 @@ mod tests {
|
||||
fn test_quick_sell_maps() {
|
||||
let m = map_to_core("DELETE", "/ut/game/fut/item/owned-111");
|
||||
assert!(m.is_some());
|
||||
assert_eq!(m.unwrap().core_path, "/collection/owned-111");
|
||||
let m = m.unwrap();
|
||||
assert_eq!(m.core_path, "/collection/owned-111");
|
||||
assert_eq!(m.method, "DELETE");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_cancel_listing_maps() {
|
||||
let m = map_to_core("DELETE", "/ut/game/fut/trade/trade-222");
|
||||
assert!(m.is_some());
|
||||
assert_eq!(m.unwrap().core_path, "/market/listings/trade-222");
|
||||
let m = m.unwrap();
|
||||
assert_eq!(m.core_path, "/market/listings/trade-222");
|
||||
assert_eq!(m.method, "DELETE");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn test_prefix_routes_preserve_method() {
|
||||
let cases = [
|
||||
("POST", "/ut/game/fut/draft/abc-123/pick", "POST"),
|
||||
("POST", "/ut/game/fut/champs/sess-456/result", "POST"),
|
||||
("DELETE", "/ut/game/fut/trade/trade-222", "DELETE"),
|
||||
("DELETE", "/ut/game/fut/item/owned-111", "DELETE"),
|
||||
("PUT", "/ut/game/fut/item/owned-999", "PUT"),
|
||||
("POST", "/ut/game/fut/store/pack/pack-789/open", "POST"),
|
||||
];
|
||||
for (ea_method, path, expected_method) in cases {
|
||||
let m = map_to_core(ea_method, path)
|
||||
.unwrap_or_else(|| panic!("no mapping for {ea_method} {path}"));
|
||||
assert_eq!(
|
||||
m.method, expected_method,
|
||||
"{ea_method} {path} → expected method {expected_method}, got {}",
|
||||
m.method
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
|
||||
Generated
-196
@@ -1,196 +0,0 @@
|
||||
# This file is automatically @generated by Cargo.
|
||||
# It is not intended for manual editing.
|
||||
version = 4
|
||||
|
||||
[[package]]
|
||||
name = "iced-x86"
|
||||
version = "1.21.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "7c447cff8c7f384a7d4f741cfcff32f75f3ad02b406432e8d6c878d56b1edf6b"
|
||||
dependencies = [
|
||||
"lazy_static",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "lazy_static"
|
||||
version = "1.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
|
||||
|
||||
[[package]]
|
||||
name = "memchr"
|
||||
version = "2.8.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
|
||||
|
||||
[[package]]
|
||||
name = "proc-macro2"
|
||||
version = "1.0.106"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
|
||||
dependencies = [
|
||||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "protossl-scan"
|
||||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"iced-x86",
|
||||
"memchr",
|
||||
"windows",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "quote"
|
||||
version = "1.0.46"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "syn"
|
||||
version = "2.0.118"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"unicode-ident",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "unicode-ident"
|
||||
version = "1.0.24"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
|
||||
|
||||
[[package]]
|
||||
name = "windows"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "dd04d41d93c4992d421894c18c8b43496aa748dd4c081bac0dc93eb0489272b6"
|
||||
dependencies = [
|
||||
"windows-core",
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-core"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "6ba6d44ec8c2591c134257ce647b7ea6b20335bf6379a27dac5f1641fcf59f99"
|
||||
dependencies = [
|
||||
"windows-implement",
|
||||
"windows-interface",
|
||||
"windows-result",
|
||||
"windows-strings",
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-implement"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "2bbd5b46c938e506ecbce286b6628a02171d56153ba733b6c741fc627ec9579b"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-interface"
|
||||
version = "0.58.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "053c4c462dc91d3b1504c6fe5a726dd15e216ba718e84a0e46a88fbe5ded3515"
|
||||
dependencies = [
|
||||
"proc-macro2",
|
||||
"quote",
|
||||
"syn",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-result"
|
||||
version = "0.2.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
|
||||
dependencies = [
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-strings"
|
||||
version = "0.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
|
||||
dependencies = [
|
||||
"windows-result",
|
||||
"windows-targets",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows-targets"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
|
||||
dependencies = [
|
||||
"windows_aarch64_gnullvm",
|
||||
"windows_aarch64_msvc",
|
||||
"windows_i686_gnu",
|
||||
"windows_i686_gnullvm",
|
||||
"windows_i686_msvc",
|
||||
"windows_x86_64_gnu",
|
||||
"windows_x86_64_gnullvm",
|
||||
"windows_x86_64_msvc",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "windows_aarch64_gnullvm"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
|
||||
|
||||
[[package]]
|
||||
name = "windows_aarch64_msvc"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
|
||||
|
||||
[[package]]
|
||||
name = "windows_i686_gnu"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
|
||||
|
||||
[[package]]
|
||||
name = "windows_i686_gnullvm"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
|
||||
|
||||
[[package]]
|
||||
name = "windows_i686_msvc"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_gnu"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_gnullvm"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
|
||||
|
||||
[[package]]
|
||||
name = "windows_x86_64_msvc"
|
||||
version = "0.52.6"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
|
||||
@@ -1,35 +0,0 @@
|
||||
[package]
|
||||
name = "protossl-scan"
|
||||
version = "0.1.0"
|
||||
edition = "2021"
|
||||
description = "Task 1: read-only memory scan to confirm FIFA 23 uses EA DirtySDK / ProtoSSL"
|
||||
|
||||
[[bin]]
|
||||
name = "protossl-scan"
|
||||
path = "src/main.rs"
|
||||
|
||||
[dependencies]
|
||||
# SIMD-accelerated substring search. Orders of magnitude faster than a naive
|
||||
# byte-by-byte scan when sweeping the game's multi-GB address space.
|
||||
memchr = "2"
|
||||
|
||||
# Pure-Rust x86/x64 disassembler. Lets us read the game's own code around a
|
||||
# code anchor (clean-room: we only disassemble the binary the user owns).
|
||||
iced-x86 = "1"
|
||||
|
||||
# The official Microsoft `windows` crate gives us safe-ish bindings to the
|
||||
# Win32 APIs we need. We only turn on the few feature modules we use, to keep
|
||||
# build times and binary size down.
|
||||
windows = { version = "0.58", features = [
|
||||
"Win32_Foundation",
|
||||
"Win32_System_Threading",
|
||||
"Win32_System_Memory",
|
||||
"Win32_System_Diagnostics_ToolHelp",
|
||||
"Win32_System_Diagnostics_Debug",
|
||||
] }
|
||||
|
||||
# This tool lives inside the openfut-bridge repo but is its OWN crate. Declaring
|
||||
# an empty [workspace] here makes Cargo treat this directory as a standalone
|
||||
# workspace root, so it does not try to attach to the openfut-bridge package
|
||||
# in the parent directory (which would error).
|
||||
[workspace]
|
||||
@@ -1,955 +0,0 @@
|
||||
//! protossl-scan — OpenFUT Bridge, Task 1: confirm the transport (read-only).
|
||||
//!
|
||||
//! GOAL
|
||||
//! ----
|
||||
//! Before we build any hook around FIFA 23's networking, we want to *prove*
|
||||
//! that the game uses EA's DirtySDK / ProtoSSL stack, and then locate the
|
||||
//! actual `ProtoSSLSend` function so a later task can hook it. We do that by
|
||||
//! reading the running game's memory (read-only!).
|
||||
//!
|
||||
//! This program ONLY READS memory. It never writes, patches, injects, or hooks
|
||||
//! anything. It is completely passive and safe to run against the live client.
|
||||
//!
|
||||
//! TWO MODES
|
||||
//! ---------
|
||||
//! protossl-scan [pid|name]
|
||||
//! Marker scan. Searches memory for DirtySDK/ProtoSSL/Blaze strings and
|
||||
//! prints a verdict on whether the transport is present.
|
||||
//!
|
||||
//! protossl-scan xref <hex-addr> [pid|name]
|
||||
//! Cross-reference scan. Given the address of something (e.g. the
|
||||
//! "ProtoSSLSend" string the marker scan found), finds:
|
||||
//! (a) absolute 8-byte pointers to it (likely a name/function table in
|
||||
//! .rdata) — and dumps the neighbouring pointers so we can spot the
|
||||
//! matching *function* pointer; and
|
||||
//! (b) RIP-relative references to it from executable code (e.g. a
|
||||
//! `lea reg, [rip+disp]` that loads the string).
|
||||
//! This is how we turn the *string* address into the *function* address.
|
||||
//!
|
||||
//! USAGE EXAMPLES
|
||||
//! --------------
|
||||
//! protossl-scan # marker scan of "FIFA23.exe"
|
||||
//! protossl-scan 8088 # marker scan of PID 8088
|
||||
//! protossl-scan xref 0x147D198B9 # who references that address?
|
||||
//! protossl-scan xref 0x147D198B9 8088 # ...in PID 8088
|
||||
//!
|
||||
//! NOTE: reach the game's MAIN MENU before scanning (networking strings/code
|
||||
//! may not be paged in at the title screen). Run the terminal "as
|
||||
//! administrator" so you're allowed to read the game's memory, and make sure EA
|
||||
//! Anticheat is in its offline/neutralized state.
|
||||
|
||||
use core::ffi::c_void;
|
||||
use std::collections::HashSet;
|
||||
|
||||
use memchr::memmem;
|
||||
|
||||
use windows::Win32::Foundation::{CloseHandle, HANDLE};
|
||||
use windows::Win32::System::Diagnostics::Debug::ReadProcessMemory;
|
||||
use windows::Win32::System::Diagnostics::ToolHelp::{
|
||||
CreateToolhelp32Snapshot, Module32FirstW, Module32NextW, Process32FirstW, Process32NextW,
|
||||
MODULEENTRY32W, PROCESSENTRY32W, TH32CS_SNAPMODULE, TH32CS_SNAPMODULE32, TH32CS_SNAPPROCESS,
|
||||
};
|
||||
use windows::Win32::System::Memory::{
|
||||
VirtualQueryEx, MEMORY_BASIC_INFORMATION, MEM_COMMIT, PAGE_EXECUTE_READ,
|
||||
PAGE_EXECUTE_READWRITE, PAGE_EXECUTE_WRITECOPY, PAGE_GUARD, PAGE_READONLY, PAGE_READWRITE,
|
||||
PAGE_WRITECOPY,
|
||||
};
|
||||
use windows::Win32::System::Threading::{OpenProcess, PROCESS_QUERY_INFORMATION, PROCESS_VM_READ};
|
||||
|
||||
/// The ASCII strings the marker scan hunts for. Finding any ProtoSSL* /
|
||||
/// `protossl:` marker is strong evidence the game speaks DirtySDK/ProtoSSL.
|
||||
const MARKERS: &[&[u8]] = &[
|
||||
b"protossl:",
|
||||
b"ProtoSSLSend",
|
||||
b"ProtoSSLRecv",
|
||||
b"ProtoSSLConnect",
|
||||
b"gosredirector",
|
||||
b"DirtySDK",
|
||||
b"blaze",
|
||||
];
|
||||
|
||||
/// How much memory we read per `ReadProcessMemory` call. Larger chunks mean
|
||||
/// fewer syscalls when sweeping a multi-GB address space.
|
||||
const CHUNK: usize = 4 << 20; // 4 MiB
|
||||
|
||||
/// One module loaded in the target process: its name, base address and size.
|
||||
struct ModuleInfo {
|
||||
name: String,
|
||||
base: usize,
|
||||
size: usize,
|
||||
}
|
||||
|
||||
fn main() {
|
||||
let args: Vec<String> = std::env::args().skip(1).collect();
|
||||
|
||||
// Decide the mode from the first argument.
|
||||
match args.first().map(|s| s.as_str()) {
|
||||
// xref-str <text> [pid|name]
|
||||
// Convenience: find the CURRENT address of a string ourselves, then
|
||||
// xref it. This is ASLR-proof — no copy-pasting absolute addresses.
|
||||
Some("xref-str") => {
|
||||
let text = match args.get(1) {
|
||||
Some(t) => t.clone(),
|
||||
None => {
|
||||
eprintln!("Usage: protossl-scan xref-str <text> [pid|name]");
|
||||
eprintln!("Example: protossl-scan xref-str ProtoSSLSend");
|
||||
std::process::exit(1);
|
||||
}
|
||||
};
|
||||
let pid = resolve_pid(args.get(2).map(|s| s.as_str()));
|
||||
let process = open_for_read(pid);
|
||||
let modules = enumerate_modules(pid);
|
||||
|
||||
let all = find_string_addresses(process, text.as_bytes());
|
||||
// Only xref hits inside the app modules (FIFA23.exe / anadius64.dll).
|
||||
// Hits in system DLLs are noise and each one would trigger a slow
|
||||
// full-memory scan, so we skip them.
|
||||
let addrs: Vec<usize> = all
|
||||
.iter()
|
||||
.copied()
|
||||
.filter(|a| in_app_module(*a, &modules))
|
||||
.collect();
|
||||
if all.is_empty() {
|
||||
println!("String \"{text}\" not found in PID {pid}. Did you reach the menu?");
|
||||
} else if addrs.is_empty() {
|
||||
println!(
|
||||
"Found \"{text}\" at {} location(s), but none in FIFA23.exe/anadius64.dll.",
|
||||
all.len()
|
||||
);
|
||||
} else {
|
||||
println!(
|
||||
"Found \"{text}\" at {} location(s) ({} in app modules):",
|
||||
all.len(),
|
||||
addrs.len()
|
||||
);
|
||||
for a in addrs {
|
||||
println!();
|
||||
// Show the surrounding bytes and find the TRUE start of the
|
||||
// C-string containing the hit. A pointer/reference targets
|
||||
// the string's start, not a substring offset, so we xref
|
||||
// that start rather than the raw hit address.
|
||||
let start = dump_string_context(process, a, &modules);
|
||||
run_xref(process, &modules, start);
|
||||
}
|
||||
}
|
||||
unsafe {
|
||||
let _ = CloseHandle(process);
|
||||
}
|
||||
}
|
||||
// callers <hex-addr | module+0xoffset> [pid|name]
|
||||
// Find direct call/jmp sites that target an address — walks up the call
|
||||
// graph (e.g. from a connect helper to the code that gates it).
|
||||
Some("callers") => {
|
||||
let arg = match args.get(1) {
|
||||
Some(a) => a.clone(),
|
||||
None => {
|
||||
eprintln!("Usage: protossl-scan callers <hex-addr | module+0xoffset> [pid|name]");
|
||||
eprintln!("Example: protossl-scan callers anadius64.dll+0x2BB90");
|
||||
std::process::exit(1);
|
||||
}
|
||||
};
|
||||
let pid = resolve_pid(args.get(2).map(|s| s.as_str()));
|
||||
let process = open_for_read(pid);
|
||||
let modules = enumerate_modules(pid);
|
||||
let target = match resolve_target(&arg, &modules) {
|
||||
Some(t) => t,
|
||||
None => {
|
||||
eprintln!("Could not resolve '{arg}' (unknown module or bad address)");
|
||||
std::process::exit(1);
|
||||
}
|
||||
};
|
||||
run_callers(process, &modules, target);
|
||||
unsafe {
|
||||
let _ = CloseHandle(process);
|
||||
}
|
||||
}
|
||||
// disasm <hex-addr> [pid|name]
|
||||
// Disassemble the function enclosing an address, annotating string
|
||||
// loads and call targets. Use this on a code anchor (e.g. the lea that
|
||||
// loads the "_ProtoSSLSendPacket" string) to read the real code.
|
||||
Some("disasm") => {
|
||||
let arg = match args.get(1) {
|
||||
Some(a) => a.clone(),
|
||||
None => {
|
||||
eprintln!("Usage: protossl-scan disasm <hex-addr | module+0xoffset> [pid|name]");
|
||||
eprintln!("Examples: protossl-scan disasm 0x140EFA631");
|
||||
eprintln!(" protossl-scan disasm anadius64.dll+0x2BB90");
|
||||
std::process::exit(1);
|
||||
}
|
||||
};
|
||||
let pid = resolve_pid(args.get(2).map(|s| s.as_str()));
|
||||
let process = open_for_read(pid);
|
||||
let modules = enumerate_modules(pid);
|
||||
let target = match resolve_target(&arg, &modules) {
|
||||
Some(t) => t,
|
||||
None => {
|
||||
eprintln!("Could not resolve '{arg}' (unknown module or bad address)");
|
||||
std::process::exit(1);
|
||||
}
|
||||
};
|
||||
run_disasm(process, &modules, target);
|
||||
unsafe {
|
||||
let _ = CloseHandle(process);
|
||||
}
|
||||
}
|
||||
// xref <hex-addr> [pid|name] (power-user form, exact absolute address)
|
||||
Some("xref") => {
|
||||
let arg = match args.get(1) {
|
||||
Some(a) => a.clone(),
|
||||
None => {
|
||||
eprintln!("Usage: protossl-scan xref <hex-addr | module+0xoffset> [pid|name]");
|
||||
eprintln!("Example: protossl-scan xref 0x147D198B9");
|
||||
eprintln!("Or just use: protossl-scan xref-str ProtoSSLSend");
|
||||
std::process::exit(1);
|
||||
}
|
||||
};
|
||||
let pid = resolve_pid(args.get(2).map(|s| s.as_str()));
|
||||
let process = open_for_read(pid);
|
||||
let modules = enumerate_modules(pid);
|
||||
let target = match resolve_target(&arg, &modules) {
|
||||
Some(t) => t,
|
||||
None => {
|
||||
eprintln!("Could not resolve '{arg}' (unknown module or bad address)");
|
||||
std::process::exit(1);
|
||||
}
|
||||
};
|
||||
run_xref(process, &modules, target);
|
||||
unsafe {
|
||||
let _ = CloseHandle(process);
|
||||
}
|
||||
}
|
||||
// Default: marker scan. An optional argument selects the process.
|
||||
_ => {
|
||||
let pid = resolve_pid(args.first().map(|s| s.as_str()));
|
||||
let process = open_for_read(pid);
|
||||
let modules = enumerate_modules(pid);
|
||||
run_marker_scan(process, &modules);
|
||||
unsafe {
|
||||
let _ = CloseHandle(process);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Find every absolute address where the byte string `text` currently appears
|
||||
/// in the target process. Used by `xref-str` so the user never has to copy an
|
||||
/// ASLR'd address by hand.
|
||||
fn find_string_addresses(process: HANDLE, text: &[u8]) -> Vec<usize> {
|
||||
let mut hits: HashSet<usize> = HashSet::new();
|
||||
let overlap = text.len().saturating_sub(1);
|
||||
let finder = memmem::Finder::new(text);
|
||||
walk_regions(process, false, overlap, None, |chunk_base, bytes| {
|
||||
for off in finder.find_iter(bytes) {
|
||||
hits.insert(chunk_base + off);
|
||||
}
|
||||
});
|
||||
let mut v: Vec<usize> = hits.into_iter().collect();
|
||||
v.sort_unstable();
|
||||
v
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Mode 1: marker scan
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
fn run_marker_scan(process: HANDLE, modules: &[ModuleInfo]) {
|
||||
println!("== protossl-scan : marker scan ==");
|
||||
println!("Loaded modules: {}", modules.len());
|
||||
|
||||
// For each marker, the set of absolute addresses where we found it. A
|
||||
// HashSet de-duplicates hits landing in the overlap between two chunks.
|
||||
let mut hits: Vec<HashSet<usize>> = vec![HashSet::new(); MARKERS.len()];
|
||||
let overlap = MARKERS.iter().map(|m| m.len()).max().unwrap_or(1) - 1;
|
||||
|
||||
// Build one SIMD finder per marker, reused across every chunk.
|
||||
let finders: Vec<memmem::Finder> = MARKERS.iter().map(|m| memmem::Finder::new(m)).collect();
|
||||
|
||||
walk_regions(process, false, overlap, None, |chunk_base, bytes| {
|
||||
for (i, finder) in finders.iter().enumerate() {
|
||||
for off in finder.find_iter(bytes) {
|
||||
hits[i].insert(chunk_base + off);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
println!("\n-- Results --");
|
||||
let mut protossl_present = false;
|
||||
for (i, marker) in MARKERS.iter().enumerate() {
|
||||
let name = String::from_utf8_lossy(marker);
|
||||
let addrs = &hits[i];
|
||||
if addrs.is_empty() {
|
||||
println!(" {name:<16} : not found");
|
||||
continue;
|
||||
}
|
||||
if matches!(
|
||||
*marker,
|
||||
b"protossl:" | b"ProtoSSLSend" | b"ProtoSSLRecv" | b"ProtoSSLConnect"
|
||||
) {
|
||||
protossl_present = true;
|
||||
}
|
||||
let mut sorted: Vec<usize> = addrs.iter().copied().collect();
|
||||
sorted.sort_unstable();
|
||||
println!(" {name:<16} : {} hit(s)", sorted.len());
|
||||
for addr in sorted.iter().take(8) {
|
||||
println!(" {}", describe(*addr, modules));
|
||||
}
|
||||
if sorted.len() > 8 {
|
||||
println!(" ... and {} more", sorted.len() - 8);
|
||||
}
|
||||
}
|
||||
|
||||
println!("\n-- Verdict --");
|
||||
if protossl_present {
|
||||
println!("ProtoSSL present — transport confirmed.");
|
||||
println!("Next: `protossl-scan xref <ProtoSSLSend-string-addr>` to find the function.");
|
||||
} else {
|
||||
println!("No ProtoSSL markers found.");
|
||||
println!("STOP: did you reach the MAIN MENU before scanning? If you did and");
|
||||
println!("still see nothing, the transport assumption is wrong — rethink it.");
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Mode 2: cross-reference scan
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
fn run_xref(process: HANDLE, modules: &[ModuleInfo], target: usize) {
|
||||
println!("== protossl-scan : xref of 0x{target:X} ==");
|
||||
println!("({})", describe(target, modules));
|
||||
|
||||
// Restrict the (expensive) scans to the app modules; the code/tables that
|
||||
// reference our target live in FIFA23.exe or anadius64.dll, not system DLLs.
|
||||
let app = app_module_ranges(modules);
|
||||
let allow = Some(app.as_slice());
|
||||
|
||||
// (a) Absolute 8-byte pointers to `target`. These usually live in a
|
||||
// read-only data table. If the table pairs names with functions, a
|
||||
// neighbouring slot will hold the function pointer we actually want.
|
||||
let needle = (target as u64).to_le_bytes();
|
||||
let ptr_finder = memmem::Finder::new(&needle);
|
||||
let mut ptr_hits: HashSet<usize> = HashSet::new();
|
||||
walk_regions(process, false, needle.len() - 1, allow, |chunk_base, bytes| {
|
||||
for off in ptr_finder.find_iter(bytes) {
|
||||
ptr_hits.insert(chunk_base + off);
|
||||
}
|
||||
});
|
||||
|
||||
println!("\n-- Absolute pointers to target --");
|
||||
if ptr_hits.is_empty() {
|
||||
println!(" none");
|
||||
} else {
|
||||
let mut sorted: Vec<usize> = ptr_hits.iter().copied().collect();
|
||||
sorted.sort_unstable();
|
||||
for at in sorted.iter().take(8) {
|
||||
println!(" pointer stored at {}", describe(*at, modules));
|
||||
// Dump the neighbouring pointer-sized slots so a name/function
|
||||
// table becomes visible. A neighbour resolving to a LOW FIFA23.exe
|
||||
// offset (the .text/code section) is a strong function candidate;
|
||||
// the string itself lives at a HIGH offset (.rdata).
|
||||
dump_neighbours(process, *at, modules);
|
||||
}
|
||||
if sorted.len() > 8 {
|
||||
println!(" ... and {} more", sorted.len() - 8);
|
||||
}
|
||||
}
|
||||
|
||||
// (b) RIP-relative references from executable code. For x64, an instruction
|
||||
// like `lea rcx, [rip+disp32]` encodes a 4-byte signed displacement
|
||||
// relative to the address of the *next* instruction. So if the 4 bytes
|
||||
// at address P are `disp`, the referenced target is `P + 4 + disp`.
|
||||
// We scan executable pages for any P where that equals our target.
|
||||
let mut code_hits: HashSet<usize> = HashSet::new();
|
||||
walk_regions(process, true, 3, allow, |chunk_base, bytes| {
|
||||
if bytes.len() < 4 {
|
||||
return;
|
||||
}
|
||||
for i in 0..=bytes.len() - 4 {
|
||||
let disp = i32::from_le_bytes([bytes[i], bytes[i + 1], bytes[i + 2], bytes[i + 3]]);
|
||||
let after = chunk_base + i + 4; // address just past the disp field
|
||||
let referenced = after.wrapping_add(disp as i64 as usize);
|
||||
if referenced == target {
|
||||
code_hits.insert(chunk_base + i);
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
println!("\n-- RIP-relative code references --");
|
||||
if code_hits.is_empty() {
|
||||
println!(" none");
|
||||
} else {
|
||||
let mut sorted: Vec<usize> = code_hits.iter().copied().collect();
|
||||
sorted.sort_unstable();
|
||||
for at in sorted.iter().take(12) {
|
||||
// The instruction opcode starts a few bytes before the disp field
|
||||
// (e.g. `48 8D 05 <disp32>` => opcode begins 3 bytes earlier).
|
||||
println!(
|
||||
" disp field at {} (instruction begins ~3 bytes earlier)",
|
||||
describe(*at, modules)
|
||||
);
|
||||
}
|
||||
if sorted.len() > 12 {
|
||||
println!(" ... and {} more", sorted.len() - 12);
|
||||
}
|
||||
}
|
||||
|
||||
println!("\n-- Next --");
|
||||
println!("Look for a neighbour pointer (or a code reference) that resolves to a LOW");
|
||||
println!("FIFA23.exe offset — that is the candidate ProtoSSLSend function address.");
|
||||
println!("TODO/CONFIRM: validate the candidate by disassembling around it before hooking.");
|
||||
}
|
||||
|
||||
/// Read and print the pointer-sized slots immediately around `at`, resolving
|
||||
/// each stored value to module+offset. Reveals name/function tables.
|
||||
fn dump_neighbours(process: HANDLE, at: usize, modules: &[ModuleInfo]) {
|
||||
// 4 slots before through 4 slots after (8 bytes each).
|
||||
for k in -4i64..=4 {
|
||||
let slot = (at as i64 + k * 8) as usize;
|
||||
match read_u64(process, slot) {
|
||||
Some(val) => {
|
||||
let marker = if k == 0 { " <- string ptr" } else { "" };
|
||||
println!(
|
||||
" [{:+}] 0x{:016X} -> {}{}",
|
||||
k,
|
||||
val,
|
||||
describe(val as usize, modules),
|
||||
marker
|
||||
);
|
||||
}
|
||||
None => {}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Mode 2b: find callers (who calls/jmps to a function)
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Scan app-module executable memory for near `call`/`jmp` (E8/E9 + rel32)
|
||||
/// instructions whose target is `target`. This walks UP the call graph — e.g.
|
||||
/// from a connect helper to the code that decides whether to call it.
|
||||
fn run_callers(process: HANDLE, modules: &[ModuleInfo], target: usize) {
|
||||
println!("== protossl-scan : callers of 0x{target:X} ==");
|
||||
println!("({})\n", describe(target, modules));
|
||||
|
||||
let app = app_module_ranges(modules);
|
||||
let allow = Some(app.as_slice());
|
||||
let mut hits: Vec<(usize, u8)> = Vec::new();
|
||||
|
||||
walk_regions(process, true, 4, allow, |chunk_base, bytes| {
|
||||
if bytes.len() < 5 {
|
||||
return;
|
||||
}
|
||||
for i in 0..=bytes.len() - 5 {
|
||||
let op = bytes[i];
|
||||
if op != 0xE8 && op != 0xE9 {
|
||||
continue;
|
||||
}
|
||||
let rel = i32::from_le_bytes([bytes[i + 1], bytes[i + 2], bytes[i + 3], bytes[i + 4]]);
|
||||
let after = chunk_base + i + 5; // address just past the rel32
|
||||
let tgt = after.wrapping_add(rel as i64 as usize);
|
||||
if tgt == target {
|
||||
hits.push((chunk_base + i, op));
|
||||
}
|
||||
}
|
||||
});
|
||||
|
||||
hits.sort_unstable();
|
||||
hits.dedup();
|
||||
if hits.is_empty() {
|
||||
println!(" no direct call/jmp sites found (may be called indirectly via a pointer)");
|
||||
} else {
|
||||
println!("-- {} call/jmp site(s) --", hits.len());
|
||||
for (at, op) in hits.iter().take(40) {
|
||||
let kind = if *op == 0xE8 { "call" } else { "jmp " };
|
||||
println!(" {kind} from {}", describe(*at, modules));
|
||||
}
|
||||
if hits.len() > 40 {
|
||||
println!(" ... and {} more", hits.len() - 40);
|
||||
}
|
||||
println!("\n-- Next --");
|
||||
println!("`disasm <one of the call sites>` to read the calling function and find");
|
||||
println!("the branch/condition that gates the call.");
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Mode 3: disassemble the enclosing function
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
fn run_disasm(process: HANDLE, modules: &[ModuleInfo], target: usize) {
|
||||
use iced_x86::{
|
||||
Decoder, DecoderOptions, Formatter, Instruction, Mnemonic, NasmFormatter, OpKind,
|
||||
};
|
||||
|
||||
println!("== protossl-scan : disasm around 0x{target:X} ==");
|
||||
println!("({})\n", describe(target, modules));
|
||||
|
||||
// Read a window of code: enough before the anchor to capture the function
|
||||
// prologue, and enough after to see the body.
|
||||
const BACK: usize = 0x400;
|
||||
const FWD: usize = 0x300;
|
||||
let win_start = target.saturating_sub(BACK);
|
||||
let buf = match read_bytes(process, win_start, BACK + FWD) {
|
||||
Some(b) => b,
|
||||
None => {
|
||||
println!("Could not read code memory around 0x{target:X}.");
|
||||
return;
|
||||
}
|
||||
};
|
||||
let target_off = target - win_start;
|
||||
|
||||
// Find the start of the enclosing function. MSVC pads the gap between
|
||||
// functions with int3 (0xCC) bytes, so the nearest 0xCC before the anchor
|
||||
// marks the end of the previous function; ours starts right after it.
|
||||
let mut p = target_off.min(buf.len());
|
||||
while p > 0 && buf[p - 1] != 0xCC {
|
||||
p -= 1;
|
||||
}
|
||||
let func_start_addr = win_start + p;
|
||||
if p == 0 {
|
||||
println!("(warning: no int3 padding found in window — disassembly may begin mid-function)\n");
|
||||
} else {
|
||||
println!(
|
||||
"Enclosing function starts at {}\n",
|
||||
describe(func_start_addr, modules)
|
||||
);
|
||||
}
|
||||
|
||||
let code = &buf[p..];
|
||||
let mut decoder = Decoder::with_ip(64, code, func_start_addr as u64, DecoderOptions::NONE);
|
||||
let mut formatter = NasmFormatter::new();
|
||||
let mut instr = Instruction::default();
|
||||
let mut text = String::new();
|
||||
|
||||
let mut count = 0;
|
||||
while decoder.can_decode() && count < 220 {
|
||||
decoder.decode_out(&mut instr);
|
||||
count += 1;
|
||||
|
||||
let ip = instr.ip() as usize;
|
||||
text.clear();
|
||||
formatter.format(&instr, &mut text);
|
||||
|
||||
// Raw instruction bytes.
|
||||
let idx = ip - func_start_addr;
|
||||
let len = instr.len();
|
||||
let raw: String = code
|
||||
.get(idx..idx + len)
|
||||
.unwrap_or(&[])
|
||||
.iter()
|
||||
.map(|b| format!("{b:02X}"))
|
||||
.collect::<Vec<_>>()
|
||||
.join(" ");
|
||||
|
||||
// Annotate RIP-relative data loads (strings!) and call/jmp targets.
|
||||
let mut note = String::new();
|
||||
if instr.is_ip_rel_memory_operand() {
|
||||
let tgt = instr.ip_rel_memory_address() as usize;
|
||||
match read_string(process, tgt, 48) {
|
||||
Some(s) => note = format!(" ; -> \"{s}\""),
|
||||
None => note = format!(" ; -> {}", describe(tgt, modules)),
|
||||
}
|
||||
} else if matches!(instr.mnemonic(), Mnemonic::Call | Mnemonic::Jmp)
|
||||
&& matches!(
|
||||
instr.op0_kind(),
|
||||
OpKind::NearBranch64 | OpKind::NearBranch32 | OpKind::NearBranch16
|
||||
)
|
||||
{
|
||||
let tgt = instr.near_branch_target() as usize;
|
||||
note = format!(" ; -> {}", describe(tgt, modules));
|
||||
}
|
||||
|
||||
let here = if ip == target { " <== anchor" } else { "" };
|
||||
println!(" 0x{ip:012X} {raw:<30} {text}{note}{here}");
|
||||
|
||||
// Stop at the function's terminating `ret` (followed by int3 padding).
|
||||
if instr.mnemonic() == Mnemonic::Ret {
|
||||
let next = idx + len;
|
||||
if next >= code.len() || code[next] == 0xCC {
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
println!("\n-- Next --");
|
||||
println!("Look for the public ProtoSSLSend: it's the function that CALLS this one");
|
||||
println!("with plaintext. Use `protossl-scan callers 0x{func_start_addr:X}` (coming next)");
|
||||
println!("or scan upward for a nearby function that calls into here.");
|
||||
}
|
||||
|
||||
/// Read a printable ASCII C-string at `addr` (up to `max` bytes). Returns None
|
||||
/// if there isn't at least a short run of printable characters.
|
||||
fn read_string(process: HANDLE, addr: usize, max: usize) -> Option<String> {
|
||||
let bytes = read_bytes(process, addr, max)?;
|
||||
let mut s = String::new();
|
||||
for &b in &bytes {
|
||||
if (0x20..=0x7e).contains(&b) {
|
||||
s.push(b as char);
|
||||
} else {
|
||||
break;
|
||||
}
|
||||
}
|
||||
if s.len() >= 3 {
|
||||
Some(s)
|
||||
} else {
|
||||
None
|
||||
}
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Shared helpers
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
/// Turn an optional process selector (numeric PID or name) into a PID, exiting
|
||||
/// with a helpful message if it can't be resolved. No selector => "FIFA23.exe".
|
||||
fn resolve_pid(arg: Option<&str>) -> u32 {
|
||||
match arg {
|
||||
Some(a) if a.chars().all(|c| c.is_ascii_digit()) => {
|
||||
a.parse::<u32>().expect("PID should be a valid number")
|
||||
}
|
||||
Some(name) => find_process_by_name(name).unwrap_or_else(|| {
|
||||
eprintln!("Could not find a running process named '{name}'.");
|
||||
std::process::exit(1);
|
||||
}),
|
||||
None => find_process_by_name("FIFA23.exe").unwrap_or_else(|| {
|
||||
eprintln!("Could not find 'FIFA23.exe'. Is the game running?");
|
||||
eprintln!("Tip: pass a process name or PID, e.g. `protossl-scan 8088`.");
|
||||
std::process::exit(1);
|
||||
}),
|
||||
}
|
||||
}
|
||||
|
||||
/// Open the target process with read-only rights, or exit with guidance.
|
||||
fn open_for_read(pid: u32) -> HANDLE {
|
||||
match unsafe { OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid) } {
|
||||
Ok(h) => {
|
||||
println!("Target PID: {pid}");
|
||||
h
|
||||
}
|
||||
Err(e) => {
|
||||
eprintln!("OpenProcess failed for PID {pid}: {e}");
|
||||
eprintln!("Try running this terminal as administrator, and make sure");
|
||||
eprintln!("EA Anticheat is in its offline/neutralized state.");
|
||||
std::process::exit(1);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Parse a hex address that may or may not have a "0x" prefix.
|
||||
fn parse_hex(s: &str) -> Option<usize> {
|
||||
let trimmed = s.trim_start_matches("0x").trim_start_matches("0X");
|
||||
usize::from_str_radix(trimmed, 16).ok()
|
||||
}
|
||||
|
||||
/// Is this address inside one of the app modules we care about
|
||||
/// (FIFA23.exe or anadius64.dll)? Used to skip noisy system-DLL hits.
|
||||
fn in_app_module(addr: usize, modules: &[ModuleInfo]) -> bool {
|
||||
for m in modules {
|
||||
if addr >= m.base && addr < m.base + m.size {
|
||||
let n = m.name.to_ascii_lowercase();
|
||||
return n.starts_with("fifa23") || n.starts_with("anadius64");
|
||||
}
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
/// `[base, base+size)` ranges for the app modules (FIFA23.exe / anadius64.dll),
|
||||
/// used to restrict expensive scans to the code we care about.
|
||||
fn app_module_ranges(modules: &[ModuleInfo]) -> Vec<(usize, usize)> {
|
||||
modules
|
||||
.iter()
|
||||
.filter(|m| {
|
||||
let n = m.name.to_ascii_lowercase();
|
||||
n.starts_with("fifa23") || n.starts_with("anadius64")
|
||||
})
|
||||
.map(|m| (m.base, m.base + m.size))
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Resolve a target that is either a raw hex address or a `module+0xoffset`
|
||||
/// form (e.g. `anadius64.dll+0x2BB90`). The module form is ASLR-robust: it adds
|
||||
/// the offset to the module's CURRENT base in the running process.
|
||||
fn resolve_target(s: &str, modules: &[ModuleInfo]) -> Option<usize> {
|
||||
if let Some(idx) = s.find('+') {
|
||||
let name = s[..idx].trim().to_ascii_lowercase();
|
||||
let want = name.strip_suffix(".dll").unwrap_or(&name);
|
||||
let off = parse_hex(s[idx + 1..].trim())?;
|
||||
for m in modules {
|
||||
let mn = m.name.to_ascii_lowercase();
|
||||
let mn = mn.strip_suffix(".dll").unwrap_or(&mn);
|
||||
if mn == want {
|
||||
return Some(m.base + off);
|
||||
}
|
||||
}
|
||||
return None;
|
||||
}
|
||||
parse_hex(s)
|
||||
}
|
||||
|
||||
/// Read a single u64 from the target process at `addr`. Returns None if the
|
||||
/// memory can't be read (e.g. unmapped).
|
||||
fn read_u64(process: HANDLE, addr: usize) -> Option<u64> {
|
||||
let b = read_bytes(process, addr, 8)?;
|
||||
if b.len() == 8 {
|
||||
Some(u64::from_le_bytes(b.try_into().unwrap()))
|
||||
} else {
|
||||
None
|
||||
}
|
||||
}
|
||||
|
||||
/// Read up to `len` bytes from the target process at `addr`. Returns however
|
||||
/// many bytes were actually readable (possibly fewer than `len`), or None.
|
||||
fn read_bytes(process: HANDLE, addr: usize, len: usize) -> Option<Vec<u8>> {
|
||||
let mut buf = vec![0u8; len];
|
||||
let mut got = 0usize;
|
||||
let ok = unsafe {
|
||||
ReadProcessMemory(
|
||||
process,
|
||||
addr as *const c_void,
|
||||
buf.as_mut_ptr() as *mut c_void,
|
||||
len,
|
||||
Some(&mut got),
|
||||
)
|
||||
};
|
||||
if ok.is_ok() && got > 0 {
|
||||
buf.truncate(got);
|
||||
Some(buf)
|
||||
} else {
|
||||
None
|
||||
}
|
||||
}
|
||||
|
||||
/// Print the bytes around a string hit (full containing C-string + a hex/ASCII
|
||||
/// dump) and return the address of the TRUE start of that C-string. This tells
|
||||
/// us whether the hit is a standalone string or embedded in a larger blob.
|
||||
fn dump_string_context(process: HANDLE, hit: usize, modules: &[ModuleInfo]) -> usize {
|
||||
const BACK: usize = 256;
|
||||
const FWD: usize = 256;
|
||||
let win_start = hit.saturating_sub(BACK);
|
||||
let buf = match read_bytes(process, win_start, BACK + FWD) {
|
||||
Some(b) => b,
|
||||
None => {
|
||||
println!(" (could not read memory around 0x{hit:X})");
|
||||
return hit;
|
||||
}
|
||||
};
|
||||
let hit_off = hit - win_start; // index of the hit within the window
|
||||
|
||||
// A printable ASCII byte (the alphabet C-strings are made of here).
|
||||
let printable = |b: u8| (0x20..=0x7e).contains(&b);
|
||||
|
||||
// Walk backward/forward to the NUL (or non-printable) boundaries.
|
||||
let mut s = hit_off;
|
||||
while s > 0 && printable(buf[s - 1]) {
|
||||
s -= 1;
|
||||
}
|
||||
let mut e = hit_off;
|
||||
while e < buf.len() && printable(buf[e]) {
|
||||
e += 1;
|
||||
}
|
||||
|
||||
let start_addr = win_start + s;
|
||||
let full = String::from_utf8_lossy(&buf[s..e]);
|
||||
println!(" containing string: \"{full}\"");
|
||||
println!(" string starts at : {}", describe(start_addr, modules));
|
||||
if start_addr != hit {
|
||||
println!(" (hit was a substring; xref-ing the string start instead)");
|
||||
}
|
||||
|
||||
// Hex + ASCII dump of ~96 bytes centred on the hit, for structural insight
|
||||
// (e.g. is this a NUL-separated table of names, or one long message?).
|
||||
println!(" context:");
|
||||
let dump_start = hit_off.saturating_sub(32) & !0xF; // 16-byte aligned
|
||||
for row in 0..6 {
|
||||
let off = dump_start + row * 16;
|
||||
if off >= buf.len() {
|
||||
break;
|
||||
}
|
||||
let end = (off + 16).min(buf.len());
|
||||
let slice = &buf[off..end];
|
||||
let mut hex = String::new();
|
||||
let mut asc = String::new();
|
||||
for &b in slice {
|
||||
hex.push_str(&format!("{b:02X} "));
|
||||
asc.push(if printable(b) { b as char } else { '.' });
|
||||
}
|
||||
println!(" 0x{:016X} {:<48} {}", win_start + off, hex, asc);
|
||||
}
|
||||
|
||||
start_addr
|
||||
}
|
||||
|
||||
/// Format an address as "module+0xOFFSET" or note it's outside any module.
|
||||
fn describe(addr: usize, modules: &[ModuleInfo]) -> String {
|
||||
for m in modules {
|
||||
if addr >= m.base && addr < m.base + m.size {
|
||||
return format!("0x{addr:016X} ({}+0x{:X})", m.name, addr - m.base);
|
||||
}
|
||||
}
|
||||
format!("0x{addr:016X} (outside any module)")
|
||||
}
|
||||
|
||||
/// Walk every committed, readable region of the process. If `exec_only`, only
|
||||
/// executable regions are visited. Each readable chunk is passed to `f` as
|
||||
/// `(absolute_base_of_chunk, bytes)`, in overlapping `CHUNK`-sized pieces.
|
||||
fn walk_regions<F: FnMut(usize, &[u8])>(
|
||||
process: HANDLE,
|
||||
exec_only: bool,
|
||||
overlap: usize,
|
||||
allow: Option<&[(usize, usize)]>,
|
||||
mut f: F,
|
||||
) {
|
||||
let mut buf = vec![0u8; CHUNK];
|
||||
let mut address: usize = 0;
|
||||
|
||||
loop {
|
||||
let mut mbi = MEMORY_BASIC_INFORMATION::default();
|
||||
let written = unsafe {
|
||||
VirtualQueryEx(
|
||||
process,
|
||||
Some(address as *const c_void),
|
||||
&mut mbi,
|
||||
core::mem::size_of::<MEMORY_BASIC_INFORMATION>(),
|
||||
)
|
||||
};
|
||||
if written == 0 {
|
||||
break;
|
||||
}
|
||||
|
||||
let region_base = mbi.BaseAddress as usize;
|
||||
let region_size = mbi.RegionSize;
|
||||
|
||||
let wanted = if exec_only {
|
||||
is_executable(mbi.Protect.0)
|
||||
} else {
|
||||
is_readable(mbi.Protect.0)
|
||||
};
|
||||
// If an allow-list of ranges is given, only scan regions that overlap
|
||||
// one of them (e.g. restrict to the FIFA23.exe / anadius64.dll images).
|
||||
let in_allow = match allow {
|
||||
None => true,
|
||||
Some(ranges) => ranges
|
||||
.iter()
|
||||
.any(|&(b, e)| region_base < e && region_base + region_size > b),
|
||||
};
|
||||
if mbi.State == MEM_COMMIT && wanted && in_allow {
|
||||
// Read this region in overlapping chunks.
|
||||
let end = region_base.saturating_add(region_size);
|
||||
let mut pos = region_base;
|
||||
while pos < end {
|
||||
let want = CHUNK.min(end - pos);
|
||||
let mut got: usize = 0;
|
||||
let ok = unsafe {
|
||||
ReadProcessMemory(
|
||||
process,
|
||||
pos as *const c_void,
|
||||
buf.as_mut_ptr() as *mut c_void,
|
||||
want,
|
||||
Some(&mut got),
|
||||
)
|
||||
};
|
||||
if ok.is_err() || got == 0 {
|
||||
pos = pos.saturating_add(want.max(1));
|
||||
continue;
|
||||
}
|
||||
f(pos, &buf[..got]);
|
||||
if pos + got >= end {
|
||||
break;
|
||||
}
|
||||
let step = if got > overlap { got - overlap } else { got };
|
||||
pos += step;
|
||||
}
|
||||
}
|
||||
|
||||
match region_base.checked_add(region_size) {
|
||||
Some(next) if next > address => address = next,
|
||||
_ => break,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Find a running process by executable name (case-insensitive). Returns PID.
|
||||
fn find_process_by_name(target: &str) -> Option<u32> {
|
||||
unsafe {
|
||||
let snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0).ok()?;
|
||||
let mut entry = PROCESSENTRY32W {
|
||||
dwSize: core::mem::size_of::<PROCESSENTRY32W>() as u32,
|
||||
..Default::default()
|
||||
};
|
||||
let mut found = None;
|
||||
if Process32FirstW(snapshot, &mut entry).is_ok() {
|
||||
loop {
|
||||
if wide_to_string(&entry.szExeFile).eq_ignore_ascii_case(target) {
|
||||
found = Some(entry.th32ProcessID);
|
||||
break;
|
||||
}
|
||||
if Process32NextW(snapshot, &mut entry).is_err() {
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
let _ = CloseHandle(snapshot);
|
||||
found
|
||||
}
|
||||
}
|
||||
|
||||
/// List every module (EXE + DLLs) in the target process with base and size.
|
||||
fn enumerate_modules(pid: u32) -> Vec<ModuleInfo> {
|
||||
let mut modules = Vec::new();
|
||||
unsafe {
|
||||
let snapshot =
|
||||
match CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, pid) {
|
||||
Ok(s) => s,
|
||||
Err(_) => return modules,
|
||||
};
|
||||
let mut entry = MODULEENTRY32W {
|
||||
dwSize: core::mem::size_of::<MODULEENTRY32W>() as u32,
|
||||
..Default::default()
|
||||
};
|
||||
if Module32FirstW(snapshot, &mut entry).is_ok() {
|
||||
loop {
|
||||
modules.push(ModuleInfo {
|
||||
name: wide_to_string(&entry.szModule),
|
||||
base: entry.modBaseAddr as usize,
|
||||
size: entry.modBaseSize as usize,
|
||||
});
|
||||
if Module32NextW(snapshot, &mut entry).is_err() {
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
let _ = CloseHandle(snapshot);
|
||||
}
|
||||
modules
|
||||
}
|
||||
|
||||
/// Readable page? Accept read/write/execute-read variants; reject NOACCESS,
|
||||
/// plain EXECUTE (not readable), and guard pages.
|
||||
fn is_readable(protect: u32) -> bool {
|
||||
if protect & PAGE_GUARD.0 != 0 {
|
||||
return false;
|
||||
}
|
||||
let base = protect & 0xFF;
|
||||
base == PAGE_READONLY.0
|
||||
|| base == PAGE_READWRITE.0
|
||||
|| base == PAGE_WRITECOPY.0
|
||||
|| base == PAGE_EXECUTE_READ.0
|
||||
|| base == PAGE_EXECUTE_READWRITE.0
|
||||
|| base == PAGE_EXECUTE_WRITECOPY.0
|
||||
}
|
||||
|
||||
/// Executable AND readable page? (We can only scan code we can also read.)
|
||||
fn is_executable(protect: u32) -> bool {
|
||||
if protect & PAGE_GUARD.0 != 0 {
|
||||
return false;
|
||||
}
|
||||
let base = protect & 0xFF;
|
||||
base == PAGE_EXECUTE_READ.0
|
||||
|| base == PAGE_EXECUTE_READWRITE.0
|
||||
|| base == PAGE_EXECUTE_WRITECOPY.0
|
||||
}
|
||||
|
||||
/// Convert a fixed-size, NUL-terminated UTF-16 (wide) buffer into a String.
|
||||
fn wide_to_string(wide: &[u16]) -> String {
|
||||
let len = wide.iter().position(|&c| c == 0).unwrap_or(wide.len());
|
||||
String::from_utf16_lossy(&wide[..len])
|
||||
}
|
||||
Reference in New Issue
Block a user