From 3a51b0ebd434d4928f3f973d46ae0e692d4cad76 Mon Sep 17 00:00:00 2001 From: funman300 Date: Sun, 16 Aug 2026 21:29:52 +0000 Subject: [PATCH] docs: correct wrong Fire2 header traps in heat2.py + fifa-blaze frame.rs Both files documented a wrong Fire2 header layout as authoritative, the reader trap called out in Known Issues: - heat2.py's module docstring labelled its >IHHHHB3s header 'VALIDATED'. The round-trip only validates the payload length + TDF body; decode->encode with the same mislabelled header trivially reproduces the capture, so it never tested the [10:16] field boundaries. Marked superseded; cite the proven layout; warn at build_fire2_frame. Code unchanged (dead tooling). - fifa-blaze frame.rs: see submodule commit f4f3396. Bumps fifa-blaze submodule eccd46f -> f4f3396 (FIFA23 stub; not in the prod container; no prod impact). --- fifa-blaze | 2 +- fifa17-recon/tools/heat2.py | 40 +++++++++++++++++++++++++++---------- 2 files changed, 30 insertions(+), 12 deletions(-) diff --git a/fifa-blaze b/fifa-blaze index d2a9a01..f4f3396 160000 --- a/fifa-blaze +++ b/fifa-blaze @@ -1 +1 @@ -Subproject commit d2a9a01ec96a93b718f73ed3fe89d827ae1f9985 +Subproject commit f4f33969f2f7e0a600ce4c368cff56acd66d3c43 diff --git a/fifa17-recon/tools/heat2.py b/fifa17-recon/tools/heat2.py index 9ba15a2..9717f28 100644 --- a/fifa17-recon/tools/heat2.py +++ b/fifa17-recon/tools/heat2.py @@ -15,16 +15,27 @@ reimplementations (the `tdf` crate cloned in this scratchpad), which were used only as a cross-check of *structure*, never copied. NO EA/FIFA leaked source was consulted. -VALIDATED RULES (byte-exact round-trip against the 219-byte capture) --------------------------------------------------------------------- -Fire2 frame header, 16 bytes big-endian: - [0:4] u32 payload length (bytes after the header) - [4:6] u16 always 0 (observed) - [6:8] u16 component - [8:10] u16 command - [10:12]u16 error / msgId - [12] u8 msgType (0x01 ping, 0x02 request, 0x03 pong/response) - [13:16]3 reserved bytes (observed 00 00 00) +VALIDATED RULES (the TDF body; byte-exact round-trip against the 219-byte capture) +--------------------------------------------------------------------------------- +Fire2 frame header, 16 bytes big-endian. + + !!! SUPERSEDED — the [10:16] FIELD SEMANTICS below are WRONG for FIFA 17. !!! + The "byte-exact round-trip" only proves the payload length and the TDF body + encoding: decoding then re-encoding with the SAME (mis)labelled header layout + trivially reproduces the capture, so it never tested the header's field + boundaries. The authoritative, live-driven layout is + `openfut-protocol-blaze::fire2` / `blaze_responder_v3b.py::fire2`: + [0:4] u32 payload length (bytes after header + metadata) + [4:6] u16 metadata length (0 when absent — what this file called "always 0") + [6:8] u16 component + [8:10] u16 command + [10:13] u24 msgNum (this file WRONGLY split it as [10:12] msgId + [12] msgType) + [13] u8 (msgType << 5) | (userIndex & 0x1F) + [14] u8 options + [15] u8 reserved + There is NO error field in Fire2 (that is Fire v1) and NO jumbo escape — the + length is already a full u32. `build_fire2_frame`/`decode_fire2` below keep the + old wrong `>IHHHHB3s` layout; they are dead and retained only for history. Heat2 field = 3-byte packed tag + 1 type byte + value. @@ -359,7 +370,14 @@ MSG_ERROR = 0x05 # UNVERIFIED def build_fire2_frame(component: int, command: int, msgType: int, msgId: int, tdf_bytes: bytes) -> bytes: - """16-byte big-endian Fire2 header + TDF payload.""" + """16-byte big-endian Fire2 header + TDF payload. + + WRONG HEADER (dead code): the ``>IHHHHB3s`` layout mislabels [10:16] — it + puts a u16 msgId at [10:12] and msgType at [12]. FIFA 17's real Fire2 header + is [10:13] u24 msgNum, [13] (msgType<<5)|userIndex, [14] options, [15] + reserved, and has no error field. Use ``openfut-protocol-blaze::fire2`` or + ``blaze_responder_v3b.py::fire2``; this is retained only for history. + """ tdf_bytes = bytes(tdf_bytes) hdr = struct.pack(">IHHHHB3s", len(tdf_bytes), 0, component & 0xFFFF, command & 0xFFFF, msgId & 0xFFFF, msgType & 0xFF,