# FIFA 17 offline FUT — runbook

Brings FIFA 17 **Ultimate Team** up against a 100% offline, clean-room emulated backend
(no EA servers, no internet). Proven working end-to-end 2026-08-01 (auth → Blaze login →
device-trust → the FUT hub).

## One-command start

```bash
cd fifa17-recon/tools
./openfut-fut.sh start      # arms the host + starts all 5 servers
```

`start` is idempotent and re-arms everything, so **just re-run it after a reboot**. It will pop a
graphical password prompt (via `pkexec`) the first time to arm the host, then skip it while armed.

Then, **in this order**:

1. Launch FIFA 17 **fresh** (a clean launch avoids the "FUT Squad Update"/live-DB error caused by
   stale in-process state): `~/Desktop/launch-fifa17.sh`
2. In-game, select **Ultimate Team**.
3. At the **security question** ("system not trusted"): type **any answer** → Continue → OK.
   (Our server accepts any answer and marks the device trusted.)
4. → the **FUT hub**.

`./openfut-fut.sh status` shows what's up; `stop` / `restart` do the obvious. The servers must be
up **before** launching FIFA — they bind the ports the game dials.

## What it stands up

| Component | Port(s) | Role |
|---|---|---|
| `lsx_responder_v2.py` | 4216 | Origin LSX (login, GetProfile, GetAuthCode, events) |
| `blaze_responder_v3b.py` | 42127 / 42130 / 42131 | Blaze redirector (TLS) / Blaze / Nucleus |
| `roster_server.py` | 8081 | FUT roster-update XML |
| `utas_server.py` | 8099 | FUT/UTAS (RS4) API: auth, device-trust, boot calls, hub |
| `autopatch.py` | — | patches FIFA17.exe's ProtoSSL cert-verify on launch |

Privileged host state (armed by `root_arm.sh` via `pkexec`): `kernel.yama.ptrace_scope=0`,
`net.ipv4.conf.lo.route_localnet=1`, iptables DNAT `159.153.51.20 → 127.0.0.1:42127`, and
`/etc/hosts: 127.0.0.1 easw.easports.com` (the last persists across reboot; the rest don't).

## Persistence / reboot

Sysctls, iptables and the TLS cert are volatile — `./openfut-fut.sh start` rebuilds them, so the
supported recovery is simply to re-run it after boot. (For hands-off auto-start you can wrap
`root_arm.sh` in a root `systemd` oneshot at boot and the servers in a user service, but the
one-command flow above is the sanctioned path.)

## Troubleshooting — the gate ladder (each fixed; if one regresses this is where)

Watch `/tmp/{lsx,blaze,roster,utas,autopatch}.log`. The screens you may see and their cause:

| Screen | Cause / fix |
|---|---|
| "log in to Origin" | LSX `GetInternetConnectedState` → `connected="1"` |
| "title version outdated" | LSX `GetGameInfo UPTODATE` → `"true"` |
| "Unable to retrieve account information" | LSX response `sender` must echo the request `recipient`; `AuthCode value=` |
| "not eligible … age restriction" | mislabeled — the `AuthCode` reply needed the `value=` attribute |
| "Unable to connect to the EA servers" | Blaze `CONF` durations must be unit-suffixed (`"30s"`, not `30000000`) |
| FUT loading spinner (forever) | Blaze `CensusData` subscribe reply needs non-zero `CNP/NTMT`; and `ROSTERUPDATE_URL` served + roster_server up |
| "error connecting to Ultimate Team" | `easw.easports.com` → 127.0.0.1 (`/etc/hosts`) + `utas_server` on :8099 |
| "error downloading the FUT Squad Update" | stale in-process state — **relaunch FIFA fresh** |
| Security question | type any answer → our `utas_server` `/phishing/validate` accepts it |

Full reverse-engineering write-ups: `login_dump/*.md`, `docs/*.md`. All findings are clean-room
(from binaries we own); nothing from any leak. The whole protocol maps to FIFA 23 (identical wire format).