fifa17-recon: FUT squad blocker solved + userInfo delivered

The client now issues PUT /squad and the hub renders coins, record and the squad roster. Three separate root causes, all verified live. Squad blocker (the long-standing "client never sends PUT /squad"): AddPlayerToSquad, GetSquads and SelectSquadById issue ZERO network requests (pure local model reads/mutations, FutSquadServiceImpl vtable 0x180233ff0); only SaveCurrentSquad writes, and it is unguarded. The client simply needed a populated ACTIVE squad model, which arrives via the massinfo `squad` member. No response of ours was ever being rejected. userMassInfo is NOT required to be {}: 0x180174630 is a FLAT {userInfo, squad, settings, userData} body -- the old "wrapper key is user" note was wrong, and the historical freeze was the malformed squad member, not the envelope. clubNameChangeAllowed must be false: sending true advertises a club-rename flow whose UI model is never populated; the client shows a naming prompt and dies confirming it (ACCESS_VIOLATION reading 0x0 at FIFA17.exe+0x71b8651, 4/4 runs, no CardsDLL frame and no request in flight). Isolated by a single-variable run; guarded by a contract check. Endpoint/schema corrections found in live traffic, invisible to static analysis: * GET ut/%s/squad/list is a real endpoint and must return {"squad":[...]}, not the active-squad object (the /list suffix is appended by the caller, so it never appeared in the request table) * PUT lands on ut/%s/squad/<id>, not a bare ut/%s/squad * userInfo currencies are read as name/funds/finalFunds/active -- there is no "value" key, so coins always rendered 0 * squad-list elements take STRING formation/squadType, not ints * the CardsDLL script-API thunk<->name table was off by one (AddPlayerToSquad is 0x18004aa70; 0x18004aff0 is GetPotentialChemistry_Club) FUT_MASSINFO / FUT_USERINFO ladders keep every step of the bisect reproducible. Contract suite 311 -> 358 checks. Tooling added: PyGhidra harness (Ghidra's Java/OSGi script path is broken on this box), minidump reader, live code grabber. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VUT92pz6RWKih9dSr8ZpxW
2026-08-03 20:47:16 -07:00
parent 6270c37208
commit 59934b4ef0
16 changed files with 1811 additions and 94 deletions
@@ -0,0 +1,65 @@
+# Q16: FutComponentServicesImpl::FutSquadServiceImpl -- get its ctor + vtable and
+# decompile SaveCurrentSquad(+0x50) / AddPlayerToSquad(+0x168) for real.
+out = open("/tmp/ghidra_fut/squad_impl.txt", "w")
+P = lambda *a: print(*a, file=out)
+
+P("=== all FutComponentServicesImpl::* service classes ===")
+for a in find_all(b"FutComponentServicesImpl::", blocks=(".rdata", ".data")):
+    P("  %#x  %s" % (a, rd_str(a, 90)))
+
+P("\n=== ctor/factory FUN_180189be0 ===")
+P(dec(0x180189be0)[:3000])
+
+NAME = None
+for a in find_all(b"FutComponentServicesImpl::FutSquadServiceImpl", blocks=(".rdata", ".data")):
+    NAME = a
+P("\nclass-name string @ %#x; xrefs:" % NAME)
+for frm, typ, fn, ent in xrefs_to(NAME):
+    P("  %#x %s in %s @ %#x" % (frm, typ, fn, ent))
+
+# The ctor writes the vtable into the object. Find vtables whose slot count is
+# large and that live near other Fut service vtables; verify by checking that
+# +0x50 / +0x168 / +0x198 / +0x1b8 / +0x1c8 are all real functions.
+P("\n=== candidate FutSquadServiceImpl vtables (>=58 slots) ===")
+TXT_LO, TXT_HI = 0x180001000, 0x1801e4fff
+
+
+def is_fn(v):
+    return TXT_LO <= v <= TXT_HI and fm.getFunctionAt(addr(v)) is not None
+
+
+p, cur, runs = 0x1801e5000, None, []
+while p < 0x2891f0 + 0x180000000:
+    try:
+        v = qword(p)
+    except Exception:
+        v = 0
+    if is_fn(v):
+        if cur is None:
+            cur = [p, 0]
+        cur[1] += 1
+    else:
+        if cur and cur[1] >= 58:
+            runs.append(tuple(cur))
+        cur = None
+    p += 8
+if cur and cur[1] >= 58:
+    runs.append(tuple(cur))
+
+for s, n in runs:
+    nm = rd_str(s + n * 8, 60)
+    P("  vtable %#x  %d slots  trailing=%r" % (s, n, nm[:45]))
+
+P("\n=== slot decompiles for every candidate ===")
+for s, n in runs:
+    nm = rd_str(s + n * 8, 60)
+    P("\n##### vtable %#x (%d slots, %r) #####" % (s, n, nm[:40]))
+    for off, tag in ((0x50, "SaveCurrentSquad"), (0x168, "AddPlayerToSquad")):
+        if off // 8 >= n:
+            continue
+        t = qword(s + off)
+        f = fm.getFunctionAt(addr(t))
+        P("--- +%#05x %s -> %#x %s ---" % (off, tag, t, f.getName() if f else ""))
+        P(dec(t)[:3000])
+out.close()
+print("wrote squad_impl.txt")
@@ -0,0 +1,36 @@
+# Q17: FutSquadServiceImpl vtable = 0x180233ff0 (written by ctor FUN_180189be0).
+# Dump it and decompile the placement/save slots.
+out = open("/tmp/ghidra_fut/squad_svc.txt", "w")
+P = lambda *a: print(*a, file=out)
+
+VT = 0x180233FF0
+SL = {0x50: "SaveCurrentSquad", 0xb8: "pre-save getter", 0x168: "AddPlayerToSquad",
+      0x198: "GetSquadList", 0x1b8: "GetSquads", 0x1c8: "SelectSquadById"}
+
+P("=== FutSquadServiceImpl vtable @ %#x ===" % VT)
+n = 0x60
+for i in range(n):
+    a = VT + i * 8
+    try:
+        t = qword(a)
+    except Exception:
+        break
+    f = fm.getFunctionContaining(addr(t)) if 0x180001000 <= t <= 0x1801e4fff else None
+    if f is None and not (0x180001000 <= t <= 0x1801e4fff):
+        P("  +%#05x  %#x   <end of vtable>" % (i * 8, t))
+        break
+    P("  +%#05x -> %#x %-18s %s" % (i * 8, t, f.getName() if f else "(no fn)",
+                                    SL.get(i * 8, "")))
+
+P("\n=== decompiles ===")
+for off in (0x50, 0xb8, 0x168, 0x198, 0x1b8, 0x1c8):
+    try:
+        t = qword(VT + off)
+    except Exception:
+        continue
+    f = fm.getFunctionContaining(addr(t))
+    P("\n########## +%#05x  %s -> %#x %s ##########"
+      % (off, SL.get(off, ""), t, f.getName() if f else ""))
+    P(dec(t))
+out.close()
+print("wrote squad_svc.txt")
@@ -0,0 +1,43 @@
+# Q7: build the definitive FUT script-API map: script name -> thunk -> service
+# vtable slot, by parsing the 24-byte {?, fnptr, name} records the registrar
+# FUN_18004a3a0 writes, then joining with the slot each thunk calls.
+import re
+out = open("/tmp/ghidra_fut/fut_api_map.txt", "w")
+P = lambda *a: print(*a, file=out)
+
+c = dec(0x18004a3a0, 300)
+# records appear as: <lhs> = FUN_xxxxxxxxx;  <lhs> = "Name";
+pairs = re.findall(r'=\s*(FUN_[0-9a-f]+);\s*\n\s*\w+\s*=\s*"([^"]+)"', c)
+P("=== registrar records: %d ===" % len(pairs))
+
+SLOT = re.compile(r"\*\(code \*\*\)\(lVar\d+ \+ (0x[0-9a-f]+|\d+)\)")
+rows = []
+for fnname, script in pairs:
+    ent = int(fnname.replace("FUN_", ""), 16)
+    body = dec(ent, 60)
+    slots = sorted(set(int(s, 16) if s.startswith("0x") else int(s)
+                       for s in SLOT.findall(body)))
+    nargs = len(re.findall(r"FUN_18019fb[45]0\(", body))
+    ret = "FUN_18019fc00(" in body or "FUN_18019fbf0(" in body
+    rows.append((slots[0] if slots else -1, script, ent, nargs, ret, body))
+
+P("\n%-34s %-8s %-14s %s" % ("script name", "slot", "thunk", "args ret"))
+for slot, script, ent, nargs, ret, _ in sorted(rows):
+    P("%-34s %-8s %#-14x %d    %s" % (script, hex(slot) if slot >= 0 else "-", ent,
+                                      nargs, "Y" if ret else ""))
+
+P("\n=== thunks with NO service call (pure local/query) ===")
+for slot, script, ent, nargs, ret, body in sorted(rows):
+    if slot < 0:
+        P("--- %s @ %#x ---" % (script, ent))
+        P(body)
+
+WANT = ("AddPlayer", "SaveCurrentSquad", "SaveSquad", "RemovePlayer",
+        "GetCurrentSquadID", "GetCurrentSquadData", "SetPlayer", "SwapPlayer")
+P("\n=== decompiles of the placement/save path ===")
+for slot, script, ent, nargs, ret, body in sorted(rows):
+    if any(w.lower() in script.lower() for w in WANT):
+        P("--- %s  slot=%s @ %#x ---" % (script, hex(slot) if slot >= 0 else "-", ent))
+        P(body)
+out.close()
+print("wrote fut_api_map.txt; records:", len(pairs))
@@ -0,0 +1,64 @@
+# Q9: FUN_18004c180 builds the squad-service object registered into DAT_1802dfd18.
+# Recover its vtable, then decompile AddPlayerToSquad(+0xc8) and SaveCurrentSquad
+# (+0x28) -- the two slots that decide whether PUT /squad is ever issued.
+out = open("/tmp/ghidra_fut/squad_service.txt", "w")
+P = lambda *a: print(*a, file=out)
+
+P("=== factory FUN_18004c180 ===")
+P(dec(0x18004c180))
+
+# find vtable pointers written by the factory
+f = func(0x18004c180)
+cands = {}
+for a in f.getBody().getAddresses(True):
+    ins = listing.getInstructionAt(a)
+    if ins is None:
+        continue
+    for r in ins.getReferencesFrom():
+        t = int(r.getToAddress().getOffset())
+        if 0x1801e5000 <= t <= 0x1802891ff:
+            cands[t] = cands.get(t, 0) + 1
+
+P("\n=== vtable candidates referenced by the factory ===")
+best = None
+for t, n in sorted(cands.items()):
+    try:
+        fns = [fm.getFunctionAt(addr(qword(t + i * 8))) for i in range(6)]
+    except Exception:
+        continue
+    nf = sum(1 for x in fns if x)
+    if nf >= 5:
+        P("  %#x  (%d/6 fnptrs, %d refs)" % (t, nf, n))
+        if best is None:
+            best = t
+
+SLOTS = {0x20: "SaveSquad", 0x28: "SaveCurrentSquad", 0x30: "RemovePlayer",
+         0x40: "GetCurrentSquadID?", 0x48: "GetCurrentSquadChemistry",
+         0x58: "GetCurrentSquadData", 0x80: "GetSquadList", 0x88: "GetSquads",
+         0x90: "SelectSquadById", 0xa8: "IsCardInSquad", 0xb8: "GetSquadLineup",
+         0xc0: "LoadActiveSquad", 0xc8: "AddPlayerToSquad"}
+
+for t in sorted(cands):
+    try:
+        fns = [fm.getFunctionAt(addr(qword(t + i * 8))) for i in range(6)]
+    except Exception:
+        continue
+    if sum(1 for x in fns if x) < 5:
+        continue
+    P("\n=== VTABLE %#x ===" % t)
+    for off, tgt, name in vtable(t, 40):
+        tag = SLOTS.get(off, "")
+        P("  +%#04x -> %#x %-16s %s" % (off, tgt, name, tag))
+    P("\n--- key slot decompiles ---")
+    for off in (0x28, 0xc8, 0x88, 0x80, 0x90, 0xc0):
+        try:
+            tgt = qword(t + off)
+        except Exception:
+            continue
+        if not fm.getFunctionAt(addr(tgt)):
+            continue
+        P("### +%#04x %s -> %#x" % (off, SLOTS.get(off, ""), tgt))
+        P(dec(tgt))
+    break
+out.close()
+print("wrote squad_service.txt")