# FIFA 23 PC Startup Flow (Offline / Proton)

Observed via FLE log, hook log, and file inspection on 2026-06-26.

## Launch chain

```
umu-run / Steam → FIFA23.exe (via Proton/Wine)
    │
    ├─ DLL load order (before entry point)
    │      ntdll.dll, kernel32.dll, ws2_32.dll …
    │      version.dll         ← our hook DLL slot (loads here)
    │      FIFALiveEditor.DLL  ← injected by FLE launcher after ~100 ms
    │
    ├─ anadius / LSX emulator (anadius64.dll)
    │      Fakes EA App / Origin session
    │      Reads  HKLM\SOFTWARE\Wow6432Node\Origin\ClientPath
    │      Writes AppData\Local\anadius\LSX emu\achievement-*.xml
    │      Provides fake PersonaId=1144668899 / UserId=1000200030000
    │
    ├─ EA Anti-Cheat (EAAntiCheat.GameServiceLauncher.exe)
    │      Spawns as child; checks EAAntiCheat.cfg
    │      Not active in offline/cracked builds (FakeEAACLauncher present)
    │
    └─ FIFA23.exe entry point
           Frostbite engine init (BuildDate 2023-07-05, changelist 5417699)
           Reads  Data\initfs_Win32        ← Frostbite package manifest
           Reads  Data\layout.toc          ← file-system layout
           Reads  Patch\initfs_Win32       ← patches on top of base
           Reads  Documents\FIFA 23\fifasetup.ini   ← display settings
           Reads  Data\locale.ini          ← language table
           Reads  Data\db_meta.xml (via FLE) ← DB schema for all tables
```

## Phase timing (observed, single machine)

| Phase                        | Time after launch | Trigger                          |
|------------------------------|-------------------|----------------------------------|
| DLL load + FLE injection     | 0 – 0.3 s         | OS loader                        |
| Engine + DirectX init        | 0.3 – 5 s         | FIFA23 entry point               |
| "Press any key" splash       | ~5 s              | First rendered frame             |
| Main menu                    | ~25 s             | After key press                  |
| FUT mode entry (attempted)   | user-driven       | User selects FUT tile            |
| Network calls to EA services | at FUT entry      | DirtySDK / EAWebKit              |

## Files read at startup (observed)

| File | Format | Purpose |
|------|--------|---------|
| `Data/initfs_Win32` | Frostbite pkg | Base asset manifest |
| `Data/layout.toc` | Frostbite TOC | File layout index |
| `Patch/initfs_Win32` | Frostbite pkg | Patch layer |
| `Data/locale.ini` | INI | String localisation |
| `Data/db_meta.xml` | XML | DB schema (loaded by FLE) |
| `Data/id_map.json` | JSON | Player/team ID→name map |
| `Data/char_conv.json` | JSON | Character conversion table |
| `Documents/FIFA 23/fifasetup.ini` | INI | Display/audio settings |
| `AppData/Local/Temp/FIFA 23/_replay0.bin` | binary | Replay buffer |
| `anadius.cfg` | VDF | Fake EA persona config |
| `AppData/Local/anadius/LSX emu/achievement-*.xml` | XML | Achievement state |

## Files written during a session (observed)

| File | When written | Content |
|------|-------------|---------|
| `Documents/FIFA 23/settings/Settings*` | Main menu reached | FBCHUNKS — controller/display prefs |
| `Documents/FIFA 23/settings/ProfileOptions` | Profile load | FBCHUNKS — 1.5 MB profile blob |
| `Documents/FIFA 23/filesystemcache/survey.state` | Startup | Empty state file |
| `Documents/FIFA 23/filesystemcache/atlPlayTimeJson/playtime_*.json` | Ongoing | Playtime tracking |
| `FIFA 23 Live Editor/config.json` | FLE ready | FLE settings (rewritten each session) |
| `Logs/log_DD-MM-YYYY.txt` | Throughout | FLE debug log |

## Save file formats

### FBCHUNKS (Frostbite chunk container)
- Magic: `46 42 43 48 55 4E 4B 53` (`FBCHUNKS`)
- Byte 8: version (01 seen)
- Offset 0x12: null-terminated label string (e.g. "Personal Settings 1", "Career - Player Progress 1")
- Remainder: compressed/binary chunk data — no public spec; requires Frostbite tooling to fully parse
- Tools: [Frosty Tool Suite](https://github.com/CadeEvs/FrostyToolSuite) can read/write these

### fifasetup.ini
- Plain `KEY = VALUE` ini, fully human-readable
- Safe to edit (display resolution, locale, vsync)

## Network calls at FUT entry (observed with iptables redirect)

Traffic pattern captured before changing strategy:
- Multiple TLS connections to port 443 (destination: EA servers, resolved as various EA IPs)
- TLS 1.3, AES-256-GCM (DirtySDK's copy of ProtoSSL, inline in FIFA23.exe)
- No SNI sent (DirtySDK does not set `server_name` extension)
- Connections originate from Wine/Proton network stack via Linux kernel TCP

Specific EA hostnames used (from openfut-bridge captures, not decoded from TLS):
- `fut.ea.com` (FUT API)
- `accounts.ea.com` (auth)
- `gateway.ea.com` (entitlements)
- `pin-river.data.ea.com` (telemetry)

## Key FLE Lua API hooks

FLE injects `FIFALiveEditor.DLL` and exposes a Lua engine that can:
- Read any in-memory DB table via `GetDBTableRows(tableName)`
- Write any cell via `EditDBTableField`
- Query career mode state via `IsInCM()`
- Get player/team names via `GetPlayerName`, `GetTeamName`

This is the primary safe integration path (see `fut-integration-options.md`).