funman300
59934b4ef0
The client now issues PUT /squad and the hub renders coins, record and the
squad roster. Three separate root causes, all verified live.
Squad blocker (the long-standing "client never sends PUT /squad"):
AddPlayerToSquad, GetSquads and SelectSquadById issue ZERO network requests
(pure local model reads/mutations, FutSquadServiceImpl vtable 0x180233ff0);
only SaveCurrentSquad writes, and it is unguarded. The client simply needed a
populated ACTIVE squad model, which arrives via the massinfo `squad` member.
No response of ours was ever being rejected.
userMassInfo is NOT required to be {}:
0x180174630 is a FLAT {userInfo, squad, settings, userData} body -- the old
"wrapper key is user" note was wrong, and the historical freeze was the
malformed squad member, not the envelope.
clubNameChangeAllowed must be false:
sending true advertises a club-rename flow whose UI model is never populated;
the client shows a naming prompt and dies confirming it (ACCESS_VIOLATION
reading 0x0 at FIFA17.exe+0x71b8651, 4/4 runs, no CardsDLL frame and no request
in flight). Isolated by a single-variable run; guarded by a contract check.
Endpoint/schema corrections found in live traffic, invisible to static analysis:
* GET ut/%s/squad/list is a real endpoint and must return {"squad":[...]},
not the active-squad object (the /list suffix is appended by the caller, so
it never appeared in the request table)
* PUT lands on ut/%s/squad/<id>, not a bare ut/%s/squad
* userInfo currencies are read as name/funds/finalFunds/active -- there is no
"value" key, so coins always rendered 0
* squad-list elements take STRING formation/squadType, not ints
* the CardsDLL script-API thunk<->name table was off by one (AddPlayerToSquad
is 0x18004aa70; 0x18004aff0 is GetPotentialChemistry_Club)
FUT_MASSINFO / FUT_USERINFO ladders keep every step of the bisect reproducible.
Contract suite 311 -> 358 checks. Tooling added: PyGhidra harness (Ghidra's
Java/OSGi script path is broken on this box), minidump reader, live code grabber.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUT92pz6RWKih9dSr8ZpxW
37 lines
1.2 KiB
Python
37 lines
1.2 KiB
Python
# Q17: FutSquadServiceImpl vtable = 0x180233ff0 (written by ctor FUN_180189be0).
|
|
# Dump it and decompile the placement/save slots.
|
|
out = open("/tmp/ghidra_fut/squad_svc.txt", "w")
|
|
P = lambda *a: print(*a, file=out)
|
|
|
|
VT = 0x180233FF0
|
|
SL = {0x50: "SaveCurrentSquad", 0xb8: "pre-save getter", 0x168: "AddPlayerToSquad",
|
|
0x198: "GetSquadList", 0x1b8: "GetSquads", 0x1c8: "SelectSquadById"}
|
|
|
|
P("=== FutSquadServiceImpl vtable @ %#x ===" % VT)
|
|
n = 0x60
|
|
for i in range(n):
|
|
a = VT + i * 8
|
|
try:
|
|
t = qword(a)
|
|
except Exception:
|
|
break
|
|
f = fm.getFunctionContaining(addr(t)) if 0x180001000 <= t <= 0x1801e4fff else None
|
|
if f is None and not (0x180001000 <= t <= 0x1801e4fff):
|
|
P(" +%#05x %#x <end of vtable>" % (i * 8, t))
|
|
break
|
|
P(" +%#05x -> %#x %-18s %s" % (i * 8, t, f.getName() if f else "(no fn)",
|
|
SL.get(i * 8, "")))
|
|
|
|
P("\n=== decompiles ===")
|
|
for off in (0x50, 0xb8, 0x168, 0x198, 0x1b8, 0x1c8):
|
|
try:
|
|
t = qword(VT + off)
|
|
except Exception:
|
|
continue
|
|
f = fm.getFunctionContaining(addr(t))
|
|
P("\n########## +%#05x %s -> %#x %s ##########"
|
|
% (off, SL.get(off, ""), t, f.getName() if f else ""))
|
|
P(dec(t))
|
|
out.close()
|
|
print("wrote squad_svc.txt")
|