fifa17-recon: FUT squad blocker solved + userInfo delivered

The client now issues PUT /squad and the hub renders coins, record and the
squad roster. Three separate root causes, all verified live.

Squad blocker (the long-standing "client never sends PUT /squad"):
  AddPlayerToSquad, GetSquads and SelectSquadById issue ZERO network requests
  (pure local model reads/mutations, FutSquadServiceImpl vtable 0x180233ff0);
  only SaveCurrentSquad writes, and it is unguarded. The client simply needed a
  populated ACTIVE squad model, which arrives via the massinfo `squad` member.
  No response of ours was ever being rejected.

userMassInfo is NOT required to be {}:
  0x180174630 is a FLAT {userInfo, squad, settings, userData} body -- the old
  "wrapper key is user" note was wrong, and the historical freeze was the
  malformed squad member, not the envelope.

clubNameChangeAllowed must be false:
  sending true advertises a club-rename flow whose UI model is never populated;
  the client shows a naming prompt and dies confirming it (ACCESS_VIOLATION
  reading 0x0 at FIFA17.exe+0x71b8651, 4/4 runs, no CardsDLL frame and no request
  in flight). Isolated by a single-variable run; guarded by a contract check.

Endpoint/schema corrections found in live traffic, invisible to static analysis:
  * GET ut/%s/squad/list is a real endpoint and must return {"squad":[...]},
    not the active-squad object (the /list suffix is appended by the caller, so
    it never appeared in the request table)
  * PUT lands on ut/%s/squad/<id>, not a bare ut/%s/squad
  * userInfo currencies are read as name/funds/finalFunds/active -- there is no
    "value" key, so coins always rendered 0
  * squad-list elements take STRING formation/squadType, not ints
  * the CardsDLL script-API thunk<->name table was off by one (AddPlayerToSquad
    is 0x18004aa70; 0x18004aff0 is GetPotentialChemistry_Club)

FUT_MASSINFO / FUT_USERINFO ladders keep every step of the bisect reproducible.
Contract suite 311 -> 358 checks. Tooling added: PyGhidra harness (Ghidra's
Java/OSGi script path is broken on this box), minidump reader, live code grabber.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUT92pz6RWKih9dSr8ZpxW

fifa17-recon/tools/ghidra_queries/q7_map.py

@@ -0,0 +1,43 @@
+# Q7: build the definitive FUT script-API map: script name -> thunk -> service
+# vtable slot, by parsing the 24-byte {?, fnptr, name} records the registrar
+# FUN_18004a3a0 writes, then joining with the slot each thunk calls.
+import re
+out = open("/tmp/ghidra_fut/fut_api_map.txt", "w")
+P = lambda *a: print(*a, file=out)
+
+c = dec(0x18004a3a0, 300)
+# records appear as: <lhs> = FUN_xxxxxxxxx;  <lhs> = "Name";
+pairs = re.findall(r'=\s*(FUN_[0-9a-f]+);\s*\n\s*\w+\s*=\s*"([^"]+)"', c)
+P("=== registrar records: %d ===" % len(pairs))
+
+SLOT = re.compile(r"\*\(code \*\*\)\(lVar\d+ \+ (0x[0-9a-f]+|\d+)\)")
+rows = []
+for fnname, script in pairs:
+    ent = int(fnname.replace("FUN_", ""), 16)
+    body = dec(ent, 60)
+    slots = sorted(set(int(s, 16) if s.startswith("0x") else int(s)
+                       for s in SLOT.findall(body)))
+    nargs = len(re.findall(r"FUN_18019fb[45]0\(", body))
+    ret = "FUN_18019fc00(" in body or "FUN_18019fbf0(" in body
+    rows.append((slots[0] if slots else -1, script, ent, nargs, ret, body))
+
+P("\n%-34s %-8s %-14s %s" % ("script name", "slot", "thunk", "args ret"))
+for slot, script, ent, nargs, ret, _ in sorted(rows):
+    P("%-34s %-8s %#-14x %d    %s" % (script, hex(slot) if slot >= 0 else "-", ent,
+                                      nargs, "Y" if ret else ""))
+
+P("\n=== thunks with NO service call (pure local/query) ===")
+for slot, script, ent, nargs, ret, body in sorted(rows):
+    if slot < 0:
+        P("--- %s @ %#x ---" % (script, ent))
+        P(body)
+
+WANT = ("AddPlayer", "SaveCurrentSquad", "SaveSquad", "RemovePlayer",
+        "GetCurrentSquadID", "GetCurrentSquadData", "SetPlayer", "SwapPlayer")
+P("\n=== decompiles of the placement/save path ===")
+for slot, script, ent, nargs, ret, body in sorted(rows):
+    if any(w.lower() in script.lower() for w in WANT):
+        P("--- %s  slot=%s @ %#x ---" % (script, hex(slot) if slot >= 0 else "-", ent))
+        P(body)
+out.close()
+print("wrote fut_api_map.txt; records:", len(pairs))