fifa17-recon: offline FUT squad-shell working + full card-system RE

Milestone: FIFA 17 Ultimate Team boots end-to-end on our offline backend past every EA gate into the hub and a live Squads editor (correct 4-4-2, 5-star squad, no freezes). Key findings this session: - userMassInfo MUST stay {} (any content desyncs the massinfo parser 0x180174630 -> tokenizer busy-loop freeze). Deliver the squad via GET /squad/0 (fetched on Squads-tab entry) instead. - Player cards render generic because the card view-model (0x1800d7920) reads identity/rating/face from a resolved record at item+0x10, filled by a lookup (0x18011cca0) in the FUT item-definition std::map at CardsDb+0x160c0 -- which is EMPTY offline -> default blank record. - Version advertising (itemDbVersion/checkServerDbVersion) is proven inert (JSON fields routed to the skip handler). Owned items don't auto-trigger a definition fetch. In-place map overwrite is dead (map stays empty). - Definition-serving endpoints (item/resource, defid, item?idList) built + ready; the fetch trigger lives in the packed FIFA17.exe. New: docs/CARD_SYSTEM.md (findings + ordered next-steps plan for real player cards: patch-POC, dbdata extractor, drive FIFA17.exe fetch, or live-memory store injection). Plus tools: fut_seed.py (squad ladder + definition serving), fifadrive.sh, vgamepad.py, and the login-RE toolset. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PN5bmpDVQR1aXgefyWAt7o
2026-08-01 20:24:30 -07:00
parent edab23f04a
commit 6ddd5e9d47
36 changed files with 9421 additions and 5 deletions
@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""Detached poller: watch the FirstPartyAuthTokenRetriever auth-request region for
+ANY change (does FUT-entry ever enqueue an auth request?).
+
+DoTick @0x146f199c0 (read at rip 0x146f199e3) polls *[0x1448a3b20]+0x4e98+0x08 every
+frame and always sees 0 -> never requests a token. If entering FUT enqueues a request,
+one of these bytes changes. Pure /proc/mem reads (no ptrace) so it survives across turns.
+Logs every change with a timestamp to /tmp/auth_watch.log.
+"""
+import glob, os, struct, time
+
+AUTHBLOCK_PP = 0x1448a3b20
+SLOT_OFF = 0x4e98
+SPAN = 0x40
+ORIGINMGR_PP = 0x1448acf50
+LOG = "/tmp/auth_watch.log"
+
+def log(m):
+    line = f"[{time.strftime('%H:%M:%S')}] {m}"
+    print(line, flush=True)
+    with open(LOG, "a") as f: f.write(line + "\n")
+
+def find_pid():
+    for d in glob.glob('/proc/[0-9]*'):
+        try:
+            if open(d + '/comm').read().strip() == 'FIFA17.exe':
+                return int(os.path.basename(d))
+        except Exception:
+            pass
+    return None
+
+def main():
+    open(LOG, "w").close()
+    log("=== auth_watch start ===")
+    pid = None; f = None; last = None; last_flag = None
+    while True:
+        p = find_pid()
+        if p != pid:
+            pid = p; last = None; last_flag = None
+            if f: f.close(); f = None
+            if pid:
+                f = open(f"/proc/{pid}/mem", "rb")
+                log(f"FIFA pid={pid}")
+        if not pid:
+            time.sleep(0.2); continue
+        try:
+            f.seek(AUTHBLOCK_PP); ab = struct.unpack('<Q', f.read(8))[0]
+            f.seek(ORIGINMGR_PP); om = struct.unpack('<Q', f.read(8))[0]
+            snap = None
+            if ab:
+                f.seek(ab + SLOT_OFF); snap = f.read(SPAN)
+            flag = None
+            if om:
+                f.seek(om + 0x13); flag = f.read(1)[0]
+        except Exception:
+            time.sleep(0.05); continue
+        if snap is not None and snap != last:
+            hx = " ".join(f"{b:02x}" for b in snap)
+            log(f"AUTH-REGION CHANGE @[{ab+SLOT_OFF:#x}]:")
+            log(f"   {hx}")
+            # decode the two 8-byte slots the retriever cares about
+            s08 = struct.unpack('<Q', snap[0x08:0x10])[0]
+            s10 = struct.unpack('<Q', snap[0x10:0x18])[0]
+            log(f"   +0x08={s08:#x}  +0x10={s10:#x}  (nonzero = auth request enqueued!)")
+            last = snap
+        if flag is not None and flag != last_flag:
+            log(f"m_isLoggedIn -> {flag}")
+            last_flag = flag
+        time.sleep(0.01)
+
+if __name__ == "__main__":
+    main()