docs: add FLE bridge direction pivot and squad-injection test tooling

Adds the app-centric FLE bridge direction (direction.md) replacing the Blaze-backend route as primary plan, plus a corrected foundational test procedure and snapshot/diff/apply tooling for reverse-engineering FLE's Freeze Lineup write mechanism. Also picks up prior untracked research docs (status-review, fut-integration-options, fifa23-startup-flow, track-c) and existing capture/export tooling that hadn't been committed yet.
2026-06-30 13:19:27 -07:00
parent cbb9ea49ab
commit 1fb664710a
15 changed files with 2060 additions and 0 deletions
@@ -0,0 +1,108 @@
+# FIFA 23 PC Startup Flow (Offline / Proton)
+
+Observed via FLE log, hook log, and file inspection on 2026-06-26.
+
+## Launch chain
+
+```
+umu-run / Steam → FIFA23.exe (via Proton/Wine)
+    │
+    ├─ DLL load order (before entry point)
+    │      ntdll.dll, kernel32.dll, ws2_32.dll …
+    │      version.dll         ← our hook DLL slot (loads here)
+    │      FIFALiveEditor.DLL  ← injected by FLE launcher after ~100 ms
+    │
+    ├─ anadius / LSX emulator (anadius64.dll)
+    │      Fakes EA App / Origin session
+    │      Reads  HKLM\SOFTWARE\Wow6432Node\Origin\ClientPath
+    │      Writes AppData\Local\anadius\LSX emu\achievement-*.xml
+    │      Provides fake PersonaId=1144668899 / UserId=1000200030000
+    │
+    ├─ EA Anti-Cheat (EAAntiCheat.GameServiceLauncher.exe)
+    │      Spawns as child; checks EAAntiCheat.cfg
+    │      Not active in offline/cracked builds (FakeEAACLauncher present)
+    │
+    └─ FIFA23.exe entry point
+           Frostbite engine init (BuildDate 2023-07-05, changelist 5417699)
+           Reads  Data\initfs_Win32        ← Frostbite package manifest
+           Reads  Data\layout.toc          ← file-system layout
+           Reads  Patch\initfs_Win32       ← patches on top of base
+           Reads  Documents\FIFA 23\fifasetup.ini   ← display settings
+           Reads  Data\locale.ini          ← language table
+           Reads  Data\db_meta.xml (via FLE) ← DB schema for all tables
+```
+
+## Phase timing (observed, single machine)
+
+| Phase                        | Time after launch | Trigger                          |
+|------------------------------|-------------------|----------------------------------|
+| DLL load + FLE injection     | 0 – 0.3 s         | OS loader                        |
+| Engine + DirectX init        | 0.3 – 5 s         | FIFA23 entry point               |
+| "Press any key" splash       | ~5 s              | First rendered frame             |
+| Main menu                    | ~25 s             | After key press                  |
+| FUT mode entry (attempted)   | user-driven       | User selects FUT tile            |
+| Network calls to EA services | at FUT entry      | DirtySDK / EAWebKit              |
+
+## Files read at startup (observed)
+
+| File | Format | Purpose |
+|------|--------|---------|
+| `Data/initfs_Win32` | Frostbite pkg | Base asset manifest |
+| `Data/layout.toc` | Frostbite TOC | File layout index |
+| `Patch/initfs_Win32` | Frostbite pkg | Patch layer |
+| `Data/locale.ini` | INI | String localisation |
+| `Data/db_meta.xml` | XML | DB schema (loaded by FLE) |
+| `Data/id_map.json` | JSON | Player/team ID→name map |
+| `Data/char_conv.json` | JSON | Character conversion table |
+| `Documents/FIFA 23/fifasetup.ini` | INI | Display/audio settings |
+| `AppData/Local/Temp/FIFA 23/_replay0.bin` | binary | Replay buffer |
+| `anadius.cfg` | VDF | Fake EA persona config |
+| `AppData/Local/anadius/LSX emu/achievement-*.xml` | XML | Achievement state |
+
+## Files written during a session (observed)
+
+| File | When written | Content |
+|------|-------------|---------|
+| `Documents/FIFA 23/settings/Settings*` | Main menu reached | FBCHUNKS — controller/display prefs |
+| `Documents/FIFA 23/settings/ProfileOptions` | Profile load | FBCHUNKS — 1.5 MB profile blob |
+| `Documents/FIFA 23/filesystemcache/survey.state` | Startup | Empty state file |
+| `Documents/FIFA 23/filesystemcache/atlPlayTimeJson/playtime_*.json` | Ongoing | Playtime tracking |
+| `FIFA 23 Live Editor/config.json` | FLE ready | FLE settings (rewritten each session) |
+| `Logs/log_DD-MM-YYYY.txt` | Throughout | FLE debug log |
+
+## Save file formats
+
+### FBCHUNKS (Frostbite chunk container)
+- Magic: `46 42 43 48 55 4E 4B 53` (`FBCHUNKS`)
+- Byte 8: version (01 seen)
+- Offset 0x12: null-terminated label string (e.g. "Personal Settings 1", "Career - Player Progress 1")
+- Remainder: compressed/binary chunk data — no public spec; requires Frostbite tooling to fully parse
+- Tools: [Frosty Tool Suite](https://github.com/CadeEvs/FrostyToolSuite) can read/write these
+
+### fifasetup.ini
+- Plain `KEY = VALUE` ini, fully human-readable
+- Safe to edit (display resolution, locale, vsync)
+
+## Network calls at FUT entry (observed with iptables redirect)
+
+Traffic pattern captured before changing strategy:
+- Multiple TLS connections to port 443 (destination: EA servers, resolved as various EA IPs)
+- TLS 1.3, AES-256-GCM (DirtySDK's copy of ProtoSSL, inline in FIFA23.exe)
+- No SNI sent (DirtySDK does not set `server_name` extension)
+- Connections originate from Wine/Proton network stack via Linux kernel TCP
+
+Specific EA hostnames used (from openfut-bridge captures, not decoded from TLS):
+- `fut.ea.com` (FUT API)
+- `accounts.ea.com` (auth)
+- `gateway.ea.com` (entitlements)
+- `pin-river.data.ea.com` (telemetry)
+
+## Key FLE Lua API hooks
+
+FLE injects `FIFALiveEditor.DLL` and exposes a Lua engine that can:
+- Read any in-memory DB table via `GetDBTableRows(tableName)`
+- Write any cell via `EditDBTableField`
+- Query career mode state via `IsInCM()`
+- Get player/team names via `GetPlayerName`, `GetTeamName`
+
+This is the primary safe integration path (see `fut-integration-options.md`).