funman300
edab23f04a
Emulates FIFA 17's full online + Ultimate Team stack against an offline,
clean-room backend (no EA servers). Proven end-to-end 2026-08-01:
Origin login -> Blaze login -> device-trust -> the FUT hub.
Package:
- tools/openfut-fut.sh one-command orchestrator (start/stop/status/restart)
- tools/root_arm.sh idempotent host arm (sysctls, DNAT, /etc/hosts easw)
- tools/{lsx_responder_v2,blaze_responder_v3b,roster_server,utas_server,autopatch}.py
the 5 servers (Origin LSX :4216, Blaze :42127/42130/42131, roster :8081,
FUT/UTAS :8099) + heat2.py (Fire2/Heat2 TDF codec)
- FUT-RUNBOOK.md runbook + gate-ladder troubleshooting
- docs/, tools/login_dump/*.md the reverse-engineering write-ups
All findings are clean-room, from binaries we own; nothing from any leak.
The wire protocol maps 1:1 to FIFA 23.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PN5bmpDVQR1aXgefyWAt7o
3.5 KiB
FIFA 17 offline FUT — runbook
Brings FIFA 17 Ultimate Team up against a 100% offline, clean-room emulated backend (no EA servers, no internet). Proven working end-to-end 2026-08-01 (auth → Blaze login → device-trust → the FUT hub).
One-command start
cd fifa17-recon/tools
./openfut-fut.sh start # arms the host + starts all 5 servers
start is idempotent and re-arms everything, so just re-run it after a reboot. It will pop a
graphical password prompt (via pkexec) the first time to arm the host, then skip it while armed.
Then, in this order:
- Launch FIFA 17 fresh (a clean launch avoids the "FUT Squad Update"/live-DB error caused by
stale in-process state):
~/Desktop/launch-fifa17.sh - In-game, select Ultimate Team.
- At the security question ("system not trusted"): type any answer → Continue → OK. (Our server accepts any answer and marks the device trusted.)
- → the FUT hub.
./openfut-fut.sh status shows what's up; stop / restart do the obvious. The servers must be
up before launching FIFA — they bind the ports the game dials.
What it stands up
| Component | Port(s) | Role |
|---|---|---|
lsx_responder_v2.py |
4216 | Origin LSX (login, GetProfile, GetAuthCode, events) |
blaze_responder_v3b.py |
42127 / 42130 / 42131 | Blaze redirector (TLS) / Blaze / Nucleus |
roster_server.py |
8081 | FUT roster-update XML |
utas_server.py |
8099 | FUT/UTAS (RS4) API: auth, device-trust, boot calls, hub |
autopatch.py |
— | patches FIFA17.exe's ProtoSSL cert-verify on launch |
Privileged host state (armed by root_arm.sh via pkexec): kernel.yama.ptrace_scope=0,
net.ipv4.conf.lo.route_localnet=1, iptables DNAT 159.153.51.20 → 127.0.0.1:42127, and
/etc/hosts: 127.0.0.1 easw.easports.com (the last persists across reboot; the rest don't).
Persistence / reboot
Sysctls, iptables and the TLS cert are volatile — ./openfut-fut.sh start rebuilds them, so the
supported recovery is simply to re-run it after boot. (For hands-off auto-start you can wrap
root_arm.sh in a root systemd oneshot at boot and the servers in a user service, but the
one-command flow above is the sanctioned path.)
Troubleshooting — the gate ladder (each fixed; if one regresses this is where)
Watch /tmp/{lsx,blaze,roster,utas,autopatch}.log. The screens you may see and their cause:
| Screen | Cause / fix |
|---|---|
| "log in to Origin" | LSX GetInternetConnectedState → connected="1" |
| "title version outdated" | LSX GetGameInfo UPTODATE → "true" |
| "Unable to retrieve account information" | LSX response sender must echo the request recipient; AuthCode value= |
| "not eligible … age restriction" | mislabeled — the AuthCode reply needed the value= attribute |
| "Unable to connect to the EA servers" | Blaze CONF durations must be unit-suffixed ("30s", not 30000000) |
| FUT loading spinner (forever) | Blaze CensusData subscribe reply needs non-zero CNP/NTMT; and ROSTERUPDATE_URL served + roster_server up |
| "error connecting to Ultimate Team" | easw.easports.com → 127.0.0.1 (/etc/hosts) + utas_server on :8099 |
| "error downloading the FUT Squad Update" | stale in-process state — relaunch FIFA fresh |
| Security question | type any answer → our utas_server /phishing/validate accepts it |
Full reverse-engineering write-ups: login_dump/*.md, docs/*.md. All findings are clean-room
(from binaries we own); nothing from any leak. The whole protocol maps to FIFA 23 (identical wire format).