[RE] Certificate Pinning Research — FIFA 23 PC & RPCS3 #2

New Issue

2026-06-26T05:05:37Z

funman300 commented

2026-06-26 05:05:37 +00:00

Overview

Research whether FIFA 23 (PC and/or RPCS3) uses certificate pinning, and document the bypass method if needed for mitmproxy interception. This is a blocker for the capture session issue if pinning is active.

Background

Certificate pinning means the app validates the server's certificate against a hardcoded public key or hash, rejecting the mitmproxy CA. If FIFA 23 does this, the standard mitmproxy proxy approach will not work and a bypass is required.

Steps

1. Test basic HTTPS interception first (PC)

Run mitmproxy, set the system proxy, install the mitmproxy CA, and launch FIFA 23 FUT. Check:

FUT loads normally → no pinning, stop here
SSL errors appear in mitmproxy → pinning likely active

2. Test the hosts-file redirect approach (no pinning bypass needed)

Instead of proxying, redirect FUT hostnames at DNS/hosts level to the local Bridge instance:

# C:\Windows\System32\drivers\etc\hosts  (PC)
127.0.0.1  fut.ea.com
127.0.0.1  utas.mob.v4.fut.ea.com

The Bridge TLS cert already covers these hostnames. Test if FIFA 23 accepts it. If this works, pinning bypass is not needed.

3. If pinning is detected — inspect the FIFA 23 binary (PC)

Use Ghidra or IDA Free to search FIFA23.exe for pinning-related strings:

"sha256/", "pin-sha256", "CertVerifyChain", "SSL_CTX_set_verify"

Look for hardcoded certificate hashes or public key bytes.

4. Frida-based runtime bypass (PC)

If static references are found, try a Frida hook to disable certificate validation at runtime:

pip install frida-tools
frida -l ssl_bypass.js -f "FIFA23.exe"

Use the standard ssl-pinning-bypass.js script; adjust for Windows API hooks (WinVerifyTrust, SslVerifyCertificate).

5. RPCS3 approach

Check RPCS3 Settings → Network → TLS/Certificate options
Try setting RPCS3_CURL_CAINFO env var to point at the mitmproxy CA file
RPCS3 may delegate certificate validation to the host OS, making pinning less of an issue

6. Document findings in `docs/cert-pinning.md`

## FIFA 23 PC
- Pinning detected: Yes / No
- Evidence: <strings found / SSL error messages>
- Bypass method: <method or N/A>

## RPCS3
- Pinning detected: Yes / No
- Bypass method: <method or N/A>

## Recommended approach for end users
<one paragraph summary — hosts file redirect vs mitmproxy vs Frida>

7. If a bypass tool or patch is needed

Check it into tools/ssl_bypass/ with its own README explaining how to use it.
Update the top-level README.md with the recommended interception method.

Deliverables

docs/cert-pinning.md documenting findings for PC and RPCS3
Hosts-file redirect tested and result documented
If bypass required: script or patch in tools/ssl_bypass/ with README
Main README.md updated with recommended interception approach

## Overview Research whether FIFA 23 (PC and/or RPCS3) uses certificate pinning, and document the bypass method if needed for mitmproxy interception. This is a blocker for the capture session issue if pinning is active. ## Background Certificate pinning means the app validates the server's certificate against a hardcoded public key or hash, rejecting the mitmproxy CA. If FIFA 23 does this, the standard mitmproxy proxy approach will not work and a bypass is required. ## Steps ### 1. Test basic HTTPS interception first (PC) Run mitmproxy, set the system proxy, install the mitmproxy CA, and launch FIFA 23 FUT. Check: - FUT loads normally → no pinning, stop here - SSL errors appear in mitmproxy → pinning likely active ### 2. Test the hosts-file redirect approach (no pinning bypass needed) Instead of proxying, redirect FUT hostnames at DNS/hosts level to the local Bridge instance: ``` # C:\Windows\System32\drivers\etc\hosts (PC) 127.0.0.1 fut.ea.com 127.0.0.1 utas.mob.v4.fut.ea.com ``` The Bridge TLS cert already covers these hostnames. Test if FIFA 23 accepts it. If this works, pinning bypass is not needed. ### 3. If pinning is detected — inspect the FIFA 23 binary (PC) Use Ghidra or IDA Free to search `FIFA23.exe` for pinning-related strings: ``` "sha256/", "pin-sha256", "CertVerifyChain", "SSL_CTX_set_verify" ``` Look for hardcoded certificate hashes or public key bytes. ### 4. Frida-based runtime bypass (PC) If static references are found, try a Frida hook to disable certificate validation at runtime: ```bash pip install frida-tools frida -l ssl_bypass.js -f "FIFA23.exe" ``` Use the standard `ssl-pinning-bypass.js` script; adjust for Windows API hooks (`WinVerifyTrust`, `SslVerifyCertificate`). ### 5. RPCS3 approach - Check RPCS3 Settings → Network → TLS/Certificate options - Try setting `RPCS3_CURL_CAINFO` env var to point at the mitmproxy CA file - RPCS3 may delegate certificate validation to the host OS, making pinning less of an issue ### 6. Document findings in `docs/cert-pinning.md` ```markdown ## FIFA 23 PC - Pinning detected: Yes / No - Evidence: <strings found / SSL error messages> - Bypass method: <method or N/A> ## RPCS3 - Pinning detected: Yes / No - Bypass method: <method or N/A> ## Recommended approach for end users <one paragraph summary — hosts file redirect vs mitmproxy vs Frida> ``` ### 7. If a bypass tool or patch is needed Check it into `tools/ssl_bypass/` with its own README explaining how to use it. Update the top-level `README.md` with the recommended interception method. ## Deliverables - [ ] `docs/cert-pinning.md` documenting findings for PC and RPCS3 - [ ] Hosts-file redirect tested and result documented - [ ] If bypass required: script or patch in `tools/ssl_bypass/` with README - [ ] Main `README.md` updated with recommended interception approach

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: funman300/OpenFUT-Bridge#2

[RE] Certificate Pinning Research — FIFA 23 PC & RPCS3 #2