fifa17-recon: offline FUT squad-shell working + full card-system RE

Milestone: FIFA 17 Ultimate Team boots end-to-end on our offline backend
past every EA gate into the hub and a live Squads editor (correct 4-4-2,
5-star squad, no freezes).

Key findings this session:
- userMassInfo MUST stay {} (any content desyncs the massinfo parser
  0x180174630 -> tokenizer busy-loop freeze). Deliver the squad via
  GET /squad/0 (fetched on Squads-tab entry) instead.
- Player cards render generic because the card view-model (0x1800d7920)
  reads identity/rating/face from a resolved record at item+0x10, filled
  by a lookup (0x18011cca0) in the FUT item-definition std::map at
  CardsDb+0x160c0 -- which is EMPTY offline -> default blank record.
- Version advertising (itemDbVersion/checkServerDbVersion) is proven inert
  (JSON fields routed to the skip handler). Owned items don't auto-trigger
  a definition fetch. In-place map overwrite is dead (map stays empty).
- Definition-serving endpoints (item/resource, defid, item?idList) built +
  ready; the fetch trigger lives in the packed FIFA17.exe.

New: docs/CARD_SYSTEM.md (findings + ordered next-steps plan for real
player cards: patch-POC, dbdata extractor, drive FIFA17.exe fetch, or
live-memory store injection). Plus tools: fut_seed.py (squad ladder +
definition serving), fifadrive.sh, vgamepad.py, and the login-RE toolset.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PN5bmpDVQR1aXgefyWAt7o

fifa17-recon/tools/memtool.py

@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+"""Live FIFA17 /proc/mem reader + patcher.
+Usage:
+  memtool.py read  <va_hex> [nbytes]
+  memtool.py patch <va_hex> <hexbytes>      # saves original to /tmp/orig_<va>.bin
+  memtool.py restore <va_hex>
+"""
+import sys, os, glob
+
+def find_pid():
+    for d in glob.glob('/proc/[0-9]*'):
+        try:
+            if open(d+'/comm').read().strip() == 'FIFA17.exe':
+                return int(d.split('/')[-1])
+        except Exception:
+            pass
+    raise SystemExit("FIFA17.exe not found")
+
+def main():
+    cmd = sys.argv[1]
+    va = int(sys.argv[2], 16)
+    pid = find_pid()
+    path = f'/proc/{pid}/mem'
+    if cmd == 'read':
+        n = int(sys.argv[3]) if len(sys.argv) > 3 else 16
+        with open(path, 'rb') as f:
+            f.seek(va); data = f.read(n)
+        print(f"pid={pid} va={va:#x} : " + data.hex())
+    elif cmd == 'patch':
+        patch = bytes.fromhex(sys.argv[3])
+        with open(path, 'rb') as f:
+            f.seek(va); orig = f.read(len(patch))
+        open(f'/tmp/orig_{va:x}.bin', 'wb').write(orig)
+        with open(path, 'r+b') as f:
+            f.seek(va); f.write(patch)
+            f.seek(va); check = f.read(len(patch))
+        print(f"pid={pid} va={va:#x} orig={orig.hex()} -> now={check.hex()}")
+    elif cmd == 'restore':
+        orig = open(f'/tmp/orig_{va:x}.bin', 'rb').read()
+        with open(path, 'r+b') as f:
+            f.seek(va); f.write(orig)
+            f.seek(va); check = f.read(len(orig))
+        print(f"pid={pid} va={va:#x} restored={check.hex()}")
+
+main()