kits: 0x757a is the command "useSavedMatchKits" - the gate was never the bug
Recovered from the live retail client (pid 44405, parked on the pre-match kit
selector) by read-only /proc/PID/mem. No writes, no debugger, no detours, no
client modification. Denuvo decrypts FIFA17.exe in memory, so the immediate that
is absent on disk is present at runtime.
At live 0x147de80e8 FIFA17.exe runs a name-registration loop through the same
string-setter vtable slot (+0x20) CardsDLL uses, so each id can be given its
name:
0x7579 useSavedMatchData -> movb $1, ctx+0x151
0x757a useSavedMatchKits -> movb $1, ctx+0x152 == KITS_AVAILABLE
0x7587 setFUTServerEnvironment
271 pairs recovered and committed. This is a DIFFERENT namespace from CardsDLL's
DataProvider id table -- the same numeric id has a different name in each --
matching the APT's own split between game.uif.UIFDataProviderList and the
action/command list.
KITS_AVAILABLE therefore does not mean "the server sent kits". It means "use the
previously SAVED match kits", and the APT writes those via ACTION_SAVE_MATCH_KIT
in SaveKitsForMatch. Live, both flags read 0 on a fresh match at the exact
moment the tiles are blank. So 0 is CORRECT on first entry and the client is
designed to take the fallback path. The gate was never the defect, which is what
the 2026-08-23 measured negative was already indicating when better item data
changed nothing.
The fallback is GetKitArrayForFUT -> ION_Uniform.GetIDs(teamId), which natively
gates on team id 130000 (0x1800d8ab0) or 130001 (0x1800d8ad0) -- the synthetic
FUT home/away pair -- and otherwise defers to the generic engine catalogue. For
a matching team it packs the two active kit records and admits them through a
check that resolves at runtime to "cmp edx,0x189a1003 / setne al", i.e. merely
"not the invalid sentinel".
Still no OpenFUT change: whether the selector requests 130000/130001, and
whether the active kit records resolve, are both unanswered and both live
questions. Full write-up in the Vault under Kit Selector APT Decode section 8.
This commit is contained in:
funman300
@@ -0,0 +1,278 @@
|
||||
# FIFA17.exe runtime command/event id -> name registry
|
||||
# Recovered 2026-08-24 from live pid 44405 (Denuvo-decrypted, /proc/PID/mem, read-only).
|
||||
# CardsDLL live base 0x6ffffc0f0000; registration loop at live 0x147dd0000-0x147df8000.
|
||||
# NOTE: this is a DIFFERENT namespace from CardsDLL's DataProvider id table.
|
||||
# the same numeric id has a different name in each, matching the APT's split
|
||||
# between game.uif.UIFDataProviderList and the action/command list.
|
||||
#
|
||||
0x0207 %d
|
||||
0x0bb9 back
|
||||
0x0bbb preScreenSucceeded
|
||||
0x0bbc preScreenFailed
|
||||
0x0bc0 clearTeamSheets
|
||||
0x0be7 selectTab
|
||||
0x0c15 optionSelected
|
||||
0x0c2a leaveGameGroup
|
||||
0x0c2c quitToHub
|
||||
0x0dac UpdateStadiumCrests
|
||||
0x0dac startStoryMode
|
||||
0x2713 matchdayFixtureChange
|
||||
0x271a evt_set_matchDay_offline_fixture
|
||||
0x271b evt_team_setup_state
|
||||
0x271c advanceDefault
|
||||
0x271d advanceDefaultWithTeam
|
||||
0x271e advancePran
|
||||
0x271f feInitialized
|
||||
0x2720 skipBootflow
|
||||
0x2721 startBootflow
|
||||
0x2722 bootflowStarted
|
||||
0x2723 bootflowFinished
|
||||
0x2724 bootflowSaveLoadFailed
|
||||
0x2725 returnToPressStart
|
||||
0x2726 showPressStart
|
||||
0x2727 evt_load_personal_settings
|
||||
0x2728 evt_settings_load_complete
|
||||
0x2729 assetUpdate
|
||||
0x272a pranUpload
|
||||
0x272b pranDownload
|
||||
0x272c controllerConfig
|
||||
0x272d activateGameModeIntro
|
||||
0x272e ActivateFullGame
|
||||
0x272f startIntroFlow
|
||||
0x2730 offlineEulaProfileSuccess
|
||||
0x2731 offlineEulaProfileFail
|
||||
0x2732 startIntroMatch
|
||||
0x2733 abortIntroMatch
|
||||
0x2735 setCareerType
|
||||
0x2736 exitTitle
|
||||
0x2737 evt_set_fullscreen
|
||||
0x273e enterSubPanel
|
||||
0x273f exitSubPanel
|
||||
0x2742 evt_invite_accepted
|
||||
0x2743 profileSignOut
|
||||
0x2744 profilePrepareForSave
|
||||
0x2745 logTelemetry
|
||||
0x2746 enterPracticeArena
|
||||
0x2748 navigationBackoutStart
|
||||
0x2749 navigationBackoutContinue
|
||||
0x274a navigationBackoutComplete
|
||||
0x274b checkSpeechData
|
||||
0x274c newsSharingSettings
|
||||
0x274d leaveBootFlow
|
||||
0x274e mainMenuProfileCreationDone
|
||||
0x274f nonLeadProfileCreation
|
||||
0x2750 nonLeadProfileLoad
|
||||
0x2755 teamSheetAction
|
||||
0x2758 evt_set_lead_profile
|
||||
0x2759 evt_sign_out
|
||||
0x275a notifySignOut
|
||||
0x275b notifySignOutReady
|
||||
0x275c notifySignOutTitleScreen
|
||||
0x275d evt_sign_out_flow_ready
|
||||
0x275e evt_sign_out_flow_not_ready
|
||||
0x275f showSignOutPopup
|
||||
0x2760 showSignOutTitleScreenPopup
|
||||
0x2761 evt_dismiss_sign_out_popup
|
||||
0x2762 evt_show_account_picker
|
||||
0x2763 evt_lead_profile_recovered
|
||||
0x2764 triggerSignOut
|
||||
0x2765 checkLeadProfilePairing
|
||||
0x2766 evt_lead_profile_paired
|
||||
0x2767 evt_lead_profile_unpaired
|
||||
0x2768 evt_lead_profile_controller_changed
|
||||
0x2769 beginProfileCheck
|
||||
0x276a endProfileCheck
|
||||
0x276b evt_controller_disconnect
|
||||
0x276c evt_notify_controller_disconnect
|
||||
0x276d evt_controller_disconnect_flow_ready
|
||||
0x276e evt_controller_disconnect_flow_not_ready
|
||||
0x276f showLoadPersonalSettingsPopup
|
||||
0x2770 showSavePersonalSettingsPopup
|
||||
0x2771 feRenderInGame
|
||||
0x2772 pvProfilerStart
|
||||
0x2773 pvProfilerStop
|
||||
0x2775 enterMatchDayTab
|
||||
0x2776 exitMatchDayTab
|
||||
0x2777 restartWithNewTeams
|
||||
0x2778 playSecondLegFixture
|
||||
0x2779 setupSecondLegFixture
|
||||
0x277a welcomeToMatchDayLive
|
||||
0x277b exitMatchDayLivePanel
|
||||
0x277c enableAardvark
|
||||
0x277d disableAardvark
|
||||
0x277e conditionAardvark
|
||||
0x2780 adaptiveDifficultyDetectedPopup
|
||||
0x2781 adaptiveDifficultyUpPopup
|
||||
0x2782 adaptiveDifficultyDownPopup
|
||||
0x2783 adaptiveDifficultyDetected
|
||||
0x2784 adaptiveDifficultyUp
|
||||
0x2785 adaptiveDifficultyDown
|
||||
0x2786 adaptiveDifficultyDisable
|
||||
0x2787 adaptiveDifficultyReset
|
||||
0x2788 adaptiveDifficultyKeep
|
||||
0x2789 adaptiveDifficultyOverride
|
||||
0x278c evt_countdown_done
|
||||
0x278d evt_countdown_restart
|
||||
0x278e evt_start_stadium_change
|
||||
0x278f evt_wait_for_stadium_change
|
||||
0x2790 evt_wait_for_stadium_change_bootflow
|
||||
0x2791 evt_advance_to_wait_popup
|
||||
0x2792 evt_advance_to_wait
|
||||
0x2793 evt_stadium_background_loaded
|
||||
0x2795 setupTournament
|
||||
0x2796 createTournament
|
||||
0x2797 createWomenTournament
|
||||
0x2799 setWomenTournament
|
||||
0x279a evt_sl_operation_started
|
||||
0x279b evt_sl_operation_complete
|
||||
0x279c evt_sl_operation_load
|
||||
0x279d evt_sl_operation_boot_load
|
||||
0x279e evt_sl_operation_save
|
||||
0x279f evt_sl_operation_delete
|
||||
0x27a0 FUTLoginComplete
|
||||
0x27a1 requestDownload
|
||||
0x27a2 backendEnter
|
||||
0x27a3 backendExit
|
||||
0x27a4 onlineLoginToEaPopup
|
||||
0x27a5 onlineBootLoginToEaPopup
|
||||
0x27a6 evt_onlineAlertPopup
|
||||
0x27a7 evt_onlineBootLoginFailurePopup
|
||||
0x27a8 evt_onlineLoginFailurePopup
|
||||
0x27a9 onlineLoginPopupHide
|
||||
0x27aa onlineLoginPopupShow
|
||||
0x27ab evt_invite_flow_ready
|
||||
0x27ac evt_invite_flow_not_ready
|
||||
0x27ad inviteFlowAbortSaveLoad
|
||||
0x27ae evt_verify_invite_nav_cleanup
|
||||
0x27af downloadComplete
|
||||
0x27b0 downloadFailed
|
||||
0x27b1 spevnetNotAvailable
|
||||
0x27b2 spevnetNotRegistered
|
||||
0x27b3 spevnetNotRegisteredBeta
|
||||
0x27b4 userBanned
|
||||
0x27b5 showExitConfirmPopup
|
||||
0x27b6 hideExitConfirmPopup
|
||||
0x27b7 confirmExit
|
||||
0x27b8 showRegisterConfirmPopup
|
||||
0x27b9 hideRegisterConfirmPopup
|
||||
0x27ba setStadiumPosition
|
||||
0x27bb liveCompCountryDecision
|
||||
0x27bc liveCompAllCountriesSelect
|
||||
0x27bd liveCompLimitedCountriesSelect
|
||||
0x27be liveCompAdvanceToTeamSelect
|
||||
0x27bf liveCompRegistrationConfirm
|
||||
0x27c0 liveCompEventListSuccess
|
||||
0x27c1 liveCompEventListFail
|
||||
0x27c2 postMatchHighlightExit
|
||||
0x27c3 postMatchHighlightComplete
|
||||
0x27c4 postMatchHighlightSelect
|
||||
0x27c5 postMatchHighlightReelSelect
|
||||
0x27c6 postMatchHighlightIRSelect
|
||||
0x27cf leaveUpsell
|
||||
0x27d0 purchase
|
||||
0x27d1 advanceFromPMA
|
||||
0x27d2 evt_transitionToPMADone
|
||||
0x27d3 cutSceneCommand
|
||||
0x27d4 cutScenePlay
|
||||
0x27d5 loadCutScenesSubLevel
|
||||
0x27d6 unloadCutScenesSubLevel
|
||||
0x27d7 evt_enable_skip_cutscene
|
||||
0x27d8 gmCutSceneStarted
|
||||
0x27d9 gmCutSceneEnded
|
||||
0x27da gmCutScenesSublevelLoaded
|
||||
0x27db gmCutScenesSublevelUnloaded
|
||||
0x27dc gmAirlockToGameplayEnded
|
||||
0x27dd gmAirlockLoadComplete
|
||||
0x27de evt_quit_to_training_hub
|
||||
0x27e0 evt_training_allow_advance_to_game
|
||||
0x27e1 checkOriginConnected
|
||||
0x27e2 OriginIsOnline
|
||||
0x27e3 OriginIsOffline
|
||||
0x27e4 OIGOpened
|
||||
0x27e5 OIGClosed
|
||||
0x27e6 overrideOnlineStadium
|
||||
0x27e7 smLoadFEStadium
|
||||
0x27e8 smActivateFreeRoam
|
||||
0x27e9 smGameOver
|
||||
0x27ea smScenePrime
|
||||
0x27eb smScenePrimeAndPrep
|
||||
0x27ec smScenePause
|
||||
0x27ed smSceneResume
|
||||
0x27ee smMoment
|
||||
0x27ef smMomentRepeat
|
||||
0x27f0 smMomentComplete
|
||||
0x27f1 smExitMomentState
|
||||
0x27f2 smOnPlayScene
|
||||
0x27f3 smConversation
|
||||
0x27f4 smConversationComplete
|
||||
0x27f5 smConversationNotification
|
||||
0x27f6 smConversationNotificationComplete
|
||||
0x27f7 smGameplayStartLoad
|
||||
0x27f8 smGameplayLoadOver
|
||||
0x27f9 smGameplayStart
|
||||
0x27fa smGameplayOver
|
||||
0x27fb smGameplayPause
|
||||
0x27fc smGameplayResume
|
||||
0x27ff smTweetConsume
|
||||
0x2800 smHeroLoanedOut
|
||||
0x2801 smSetupAcademyMatch
|
||||
0x2802 smSetupAcademyTeams
|
||||
0x2803 smStartIntroFlow
|
||||
0x2804 smStartSeason
|
||||
0x2805 smPlayMatch
|
||||
0x2806 smEndMatch
|
||||
0x2807 smGetTrainingSet
|
||||
0x2808 smEnterTrainingTeamHub
|
||||
0x2809 smEnterTraining
|
||||
0x280a smPlayTrainingSessionVO
|
||||
0x280b smPrepareTraining
|
||||
0x280c smPlayTraining
|
||||
0x280d smStopTraining
|
||||
0x280e smStartSkillGame
|
||||
0x280f smSimTraining
|
||||
0x2810 smEndTraining
|
||||
0x2811 smSave
|
||||
0x2812 smAutoSave
|
||||
0x2814 smLoad
|
||||
0x2815 smSetScreenFlowLocation
|
||||
0x2816 smGetScreenFlowLocation
|
||||
0x2817 smGetHomeHubLocation
|
||||
0x2818 smGetHeroLeague
|
||||
0x2819 smCompleteMatchday
|
||||
0x281a smEndInterviewPeriod
|
||||
0x281b smHeroRemovedFromMatch
|
||||
0x281c smEpisodicUploadCheck
|
||||
0x281d smRetryEpisodicUpload
|
||||
0x281e smNotifyMatchNotPlayed
|
||||
0x281f matchFlowStart
|
||||
0x2820 matchFlowHalftime
|
||||
0x2821 matchFlowPostgame
|
||||
0x2822 matchFlowEnd
|
||||
0x2823 enterGameplay
|
||||
0x2824 leaveGameplay
|
||||
0x2825 forfeitMatch
|
||||
0x2826 matchSetType
|
||||
0x2827 simMatch
|
||||
0x2828 simStarted
|
||||
0x2829 simStopped
|
||||
0x282a fbStartFlowEvent
|
||||
0x282b stopSavedInput
|
||||
0x282c changeSonyStoreBrowseMode
|
||||
0x282d trialCheck
|
||||
0x282e gotoTrialUpsell
|
||||
0x754d retrieveManagerQuestData
|
||||
0x7560 futWidgetShow
|
||||
0x7561 futWidgetHide
|
||||
0x7562 futWidgetLoad
|
||||
0x7563 futWidgetUnload
|
||||
0x7567 inviteAcceptedFUT
|
||||
0x7568 futAddCriticalSection
|
||||
0x7569 futRemoveCriticalSection
|
||||
0x7572 exitDraftMode
|
||||
0x7579 useSavedMatchData
|
||||
0x757a useSavedMatchKits
|
||||
0x7580 exitSbcMode
|
||||
0x7587 setFUTServerEnvironment
|
||||
0x9cc1 discardTeamSheet
|
||||
0x9cc1 resetReady
|
||||
0x9cd0 showKeyboard
|
||||
Reference in New Issue
Block a user