funman300
89da7b7609
Three things: the envelope rule was wrong and is corrected, /hub is settled, and two
documented response shapes that would freeze the client are fixed.
THE CORRECTION. The previous commit concluded that a three-token root consumes `{`, the
first field name and that field's value without dispatching them, so the first key of a
flat body was silently eaten, and that `login` had therefore never been delivered on
POST /user. That is WRONG and is withdrawn, along with the claim that the key order of
the auth dict is load-bearing.
The first call to FUN_1801c7f10 returns token 7 and consumes NO input. It is a
once-only start-of-document token, guarded by the flag at parser+0xda together with the
zero character counter at parser+0x30. So the three tokens are BOF, `{`, and the FIRST
FIELD NAME, and the key loop dispatches from that first key onward. The `== 10` test on
the third token is not an envelope check, it is the empty-object early-out: for `{}` the
third token is END_OBJECT and the root exits with its constructor defaults intact, which
is why answering `{}` has always been safe.
Corrected enum: 7=BOF 9=START_OBJECT 10=END_OBJECT 11=FIELD_NAME 12=START_ARRAY
13=END_ARRAY. The enum itself was right before; the inference from it was not.
HOW IT WAS CAUGHT, which is the part worth keeping. Not by more decompiling. /hub is
served flat and the wrong model predicted its first key would be discarded, so the
prediction was checked against the client's own memory: clubPlayers read back as 205,
the value the server sent, at model+0x1fd70+0x3c with the slide proven against the FNV
prologue first. One live read refuted a chain of otherwise sound static reasoning in
about a minute. tools/hub_counter_probe.py keeps it repeatable.
Consequence worth flagging: a wrapper is not just unnecessary for these roots, it would
be harmful, since a wrapper key hashes to an atom with no arm and the whole object is
skipped. That makes the createPackResponse envelope DOUBTFUL rather than confirmed.
Atom 0xbe has no arm in FUN_180162880. There is no live evidence either way because
nothing has ever parsed that body, so the buy path is left exactly as it is.
TWO ERRORS OF MINE ON THE WAY, both recorded in the doc because both are cheap to
repeat. I searched for RS4:FutGetHubServerResponse, found nothing and reported that no
hub class existed; the class is FutGetHubDataServerResponse (literal 0x18022ce40,
vtable 0x18022cd48, deser 0x1801738b0, control FutSquadSave -> 0x180171a60 matched in
the same run). Then I scanned 152 deserializers for clubPlayers, got zero hits and a
passing control, because the guard is `!= 0x90` and my pattern only matched `== 0x`.
The control passed only because auctionCount happens to use `==`. A control that does
not exercise the same code shape as the target is not a control. The comment already at
utas_server.py:1076 had the hub chain right the whole time.
ENDPOINT_MAP corrections, both freeze-risky as written, neither affecting what we serve
today:
* duplicateItemIdList is an ARRAY OF OBJECTS (element deser 0x180138e10), not the int
list at :1095. Bare ints where the element parser expects objects is a tokenizer
desync, i.e. a hard freeze at 0x1801c7f1a. Control that this is not a misread:
dreamSquads 0xe9 in FutMoveCard genuinely is a bare int array.
* FutDiscardCardServerResponse is {"items":[{"id":N}],"totalCredits":N}. There is no
top-level id.
No behaviour change. utas_server.py is comment-only. 439 contract checks pass.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
80 lines
3.1 KiB
Python
80 lines
3.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Did clubPlayers actually land in the client, or was it eaten as the envelope key?
|
|
|
|
Read-only. The argument cannot settle this; the client's own memory can.
|
|
|
|
Chain, from the comment at utas_server.py:1076 (established earlier by two independent
|
|
agents and two reviewers, so this probe TESTS that chain rather than assuming it):
|
|
R = <model> + 0x1fd70 (FUN_18011a810 is `lea rax,[rcx+0x1fd70]; ret`)
|
|
clubPlayers -> R + 0x3c
|
|
auctionCount -> R + 0x38
|
|
The server logged "HUB: clubPlayers=205 auctionCount=0" for this session.
|
|
|
|
PREDICTIONS, stated before reading so this cannot be rationalised after the fact:
|
|
* if R+0x3c reads 205, clubPlayers reached its arm. The flat two-key hub body is
|
|
fine and the envelope worry does not apply to this root.
|
|
* if R+0x3c reads 0 while R+0x38 reads 0 too, the result is ambiguous, because
|
|
auctionCount is legitimately 0 this session. Say so rather than claiming a result.
|
|
* if R+0x3c reads 0 and some other plausible field is populated, clubPlayers was
|
|
eaten as the first key/value pair and the MY CLUB tile is showing a wrong number.
|
|
"""
|
|
import os
|
|
import struct
|
|
|
|
pid = None
|
|
for d in os.listdir('/proc'):
|
|
if d.isdigit():
|
|
try:
|
|
if open('/proc/%s/comm' % d).read().strip() == 'FIFA17.exe':
|
|
pid = int(d)
|
|
break
|
|
except Exception:
|
|
pass
|
|
if not pid:
|
|
raise SystemExit("FIFA17.exe not running")
|
|
|
|
base = None
|
|
for ln in open('/proc/%d/maps' % pid):
|
|
if 'CardsDLL' in ln:
|
|
base = int(ln.split('-')[0], 16)
|
|
if not base:
|
|
raise SystemExit("CardsDLL not mapped: the client has not reached Ultimate Team")
|
|
slide = base - 0x180000000
|
|
print("pid %d cardsdll %#x slide %#x" % (pid, base, slide))
|
|
|
|
fd = os.open('/proc/%d/mem' % pid, os.O_RDONLY)
|
|
|
|
|
|
def rd(va, n):
|
|
return os.pread(fd, n, va)
|
|
|
|
|
|
# Prove the slide before trusting any address derived from it.
|
|
pe = open('/mnt/games/FIFA 17/CardsDLL_Win64_retail.dll', 'rb').read()
|
|
off = 0x180180D00 - 0x180000000 - 0x1000 + 0x400
|
|
ok = pe[off:off + 32] == rd(0x180180D00 + slide, 32)
|
|
print("slide control (FNV prologue): %s" % ("MATCH" if ok else "MISMATCH -- STOP"))
|
|
if not ok:
|
|
raise SystemExit(1)
|
|
|
|
model = struct.unpack('<Q', rd(0x1802E6398 + slide, 8))[0]
|
|
print("model singleton %#x" % model)
|
|
R = model + 0x1FD70
|
|
club, auction = struct.unpack('<i', rd(R + 0x3C, 4))[0], struct.unpack('<i', rd(R + 0x38, 4))[0]
|
|
print("\n R = model+0x1fd70 = %#x" % R)
|
|
print(" R+0x3c clubPlayers = %d (server sent 205)" % club)
|
|
print(" R+0x38 auctionCount = %d (server sent 0)" % auction)
|
|
|
|
print("\nVERDICT:")
|
|
if club == 205:
|
|
print(" clubPlayers REACHED its arm. The flat hub body parses correctly and the")
|
|
print(" envelope concern does not apply to FutGetHubData.")
|
|
elif club == 0:
|
|
print(" clubPlayers is 0. Either it was eaten as the first key/value pair, or the")
|
|
print(" hub has not been loaded this session. Check the tile in game before")
|
|
print(" concluding: auctionCount is legitimately 0, so it cannot break the tie.")
|
|
else:
|
|
print(" clubPlayers = %d, which is neither 205 nor 0. The chain above is wrong"
|
|
" somewhere." % club)
|
|
os.close(fd)
|