From dd8dddd7afc908e30ab223c0606de153aaf0ffe7 Mon Sep 17 00:00:00 2001 From: funman300 Date: Tue, 4 Aug 2026 11:30:33 -0700 Subject: [PATCH] fifa17-recon: log archaeology -- /club is only ever the SEARCH form REBUILD_RESEARCH S18, from running futlog.py over the full 3044-request history. The client has requested /club six times and EVERY ONE carried a query string (year/type/count/position/level/nation/league/team/sort). The bare path has never been requested. ENDPOINT_MAP says GET ut/%s/club is FutGetClubInfo, whose only recognised member is user(0x36c), and concludes our itemData body is skipped and the club list must therefore be empty. The club list is NOT empty; every card renders. So either the query form dispatches elsewhere or the row is wrong. TODO/CONFIRM. Relevant to the MY CLUB counter: we ignore the query string completely and return all 109 items to a request asking for count=11 with position and sort filters, and our response carries no result total. A paged search response is exactly where a tab counter would read its number from. Also recorded: the unmapped view is a standing detector for suffix endpoints the URL template table cannot show. It has caught four so far. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01VUT92pz6RWKih9dSr8ZpxW --- fifa17-recon/docs/REBUILD_RESEARCH.md | 55 +++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/fifa17-recon/docs/REBUILD_RESEARCH.md b/fifa17-recon/docs/REBUILD_RESEARCH.md index e1d78a9..901105a 100644 --- a/fifa17-recon/docs/REBUILD_RESEARCH.md +++ b/fifa17-recon/docs/REBUILD_RESEARCH.md @@ -726,3 +726,58 @@ Two self-inflicted incidents in the same session, both worth recording: the pattern also contained the literal script name in a later clause. It killed the invoking shell before it reached the restart. Split the kill and the start into separate commands, or obfuscate every occurrence. + +--- + +## 18. Log-archaeology findings (2026-08-04, `futlog.py`) + +Filtering the full 3,044-request log to real client traffic (486 requests, User-Agent +`ProtoHttp`) surfaced three things that were sitting in evidence already collected. + +### 18a. `GET /club` is only ever the SEARCH form, and `itemData` is right for it + +The client has requested `/club` six times, **every one of them with a query string**: + +``` +/club?year=2017&type=player&count=34&position=ST&level=any&nation=-1&league=-1&team=-1&sort=desc +/club?year=2017&type=player&count=34&position=RB&level=any&... +/club?year=2017&type=player&count=34&level=any&... +/club?year=2017&type=player&count=11&level=any&sort=desc (x3) +``` + +**The bare path `/club` has never been requested.** Zero times. + +This contradicts `ENDPOINT_MAP.md`, which states that `GET ut/%s/club` resolves to +`FutGetClubInfoServerResponse`, that its only recognised member is `user`(0x36c) as an +array of user-records, and therefore that our `{"itemData":[...]}` is skipped and the +club list must be empty. The club list is **not** empty: the user opened MY CLUB and +every card rendered. So either the query form dispatches to a different response class, +or the row is wrong. `TODO/CONFIRM` which. + +Two consequences worth chasing: + +- We **ignore the query string entirely** and return all 109 items to a request that + asked for `count=11` with position and sort filters. That happens to work for + rendering, but a search response that carries a result total is exactly the sort of + place the MY CLUB counter would read from, and ours carries no count of any kind. +- `position=ST` and `position=RB` appear only in the 20:15 pair, which is squad-slot + filtering. The client is using this endpoint as a player picker, not just a list. + +### 18b. The move request had been captured eight times before it was read + +See the correction in ยง17. `PUT /item` appears nine times in the log, eight of them +during the failed attempts, every one carrying `swap` and `tradeId`. The shape was never +missing; nobody looked. + +### 18c. Endpoints the client wanted that fell through to the catch-all + +`futlog.py -s --unmapped` over the whole history: + +``` +/leaderboards/options /match/reset +/clientdata/userHubData /delete/game/fifa17/item +``` + +All four are now routed. The value here is the method: the unmapped view is a standing +detector for the suffix endpoints the binary's URL template table cannot show, which +have now caught this project four separate times. Run it after every session.