OpenFUT/fifa17-recon/tools/auth_schema_reflection.md

# FIFA 17 Blaze — Authentication component (0x0001) reflection-reversed schema

**Date:** 2026-07-30 · **Target:** live `FIFA17.exe` PID 19517 (alive throughout, still at the
main menu afterwards) · **Method:** `/proc/<pid>/mem` reflection walk + targeted disassembly +
in-process function calls via gdb.

Companion doc: `fifa17-recon/tools/preauth_schema_reflection.md` (Util component / PreAuthResponse).

---

## 0. Clean-room provenance

Every fact below came from one of three allowed sources:

1. **The client's own runtime reflection metadata**, read out of the process we own. FIFA 17's
   BlazeSDK ships full TDF type descriptors (class names, member names, wire tags, struct offsets)
   in `.data`. This is the bulk of §3–§6.
2. **Disassembly of code in the binary we own** (`getCommandName` / `getErrorName` /
   `getNotificationName` switches, TDF descriptor initialisers, notification dispatcher).
3. **Calling the client's own name-lookup functions in-process** (§2). This is reading the
   binary's answer to its own question — no external artefact involved.

**No EA/FIFA leaked source was consulted at any point.** No third-party BlazeSDK reimplementation
was consulted for this document either (unlike the Fire2 header note in the preAuth doc, the
findings here are all first-party).

---

## 1. Headline result: the client sent `logout`, not `login`

The observed live frame

```
RX #9  Authentication::cmd:0x0046  msgType=MESSAGE msgNum=16 userIdx=0 payload=0B
```

**`Authentication` command `0x0046` (70) = `logout`.** (§2, verified twice.)

`logout` has **no request TDF and no response TDF** — there is no `Blaze::Authentication::LogoutRequest`
or `LogoutResponse` anywhere in the client's type index, which is exactly why the payload was 0 bytes.
Our empty REPLY was therefore *correct on the wire*.

This reframes the whole gate:

- The client **never sent `Authentication::login` (cmd 0x000A)**, never sent `getAuthToken` (0x0024),
  never sent `listUserEntitlements2` (0x001D), never sent `listPersonas` (0x0064).
- It went `preAuth` → `ping` → 6× `fetchClientConfig` → **`logout`** → transport-ping loop.
- A client that logs out without ever logging in has decided *before touching Blaze auth* that it has
  no credential to present. That is the Origin/LSX layer (layer 1 in the repack recon), not Blaze.

**Implication for the workflow:** implementing `Authentication::login` server-side is necessary but
**not sufficient and not the current blocker**. The client must first obtain an auth code from the
in-process Origin/LSX stub on `127.0.0.1:4216` (`GetAuthCode` → `AuthCodeResponse`, and
`OriginIsOnline` / `GetInternetConnectedState` must report ONLINE). Until that succeeds the client
will keep skipping straight to `logout`. See §7 for the ordering this implies.

---

## 2. Authentication component RPC table — **complete**

### How it was recovered

Each Blaze component has a 7-pointer `ComponentDescription`-style table in `.rdata`. Layout
established by diffing the Util table (whose command map we already knew) against Authentication's:

| Offset | Meaning | Util | Authentication |
|---|---|---|---|
| `+0x00` | shared helper | `0x146f022d0` | `0x146f022d0` |
| `+0x08` | `getComponentName()` | `0x146df7370` → `"UtilComponent"` | `0x146e0ec00` → `"AuthenticationComponent"` |
| `+0x10` | **`getCommandName(u16)`** | `0x146df6dc0` | **`0x146e0d2a0`** |
| `+0x18` | shared helper | `0x145bf3580` | `0x145bf3580` |
| `+0x20` | `getErrorName(u32)` | `0x146df7380` | `0x146e0ec20` |
| `+0x28` | `getRestResourceInfo(u16)` | `0x146f82070` (null stub) | `0x146e0f2e0` |
| `+0x30` | shared helper | `0x1465734f0` | `0x1465734f0` |

Table addresses: Util `0x143895820`, Authentication `0x14389d628`, plus one more at `0x143891940`
(Redirector) and six in `0x1438f5xxx` (FIFA-custom components).

Util's `getCommandName` is clean code — `movzx eax,dx; dec eax; cmp eax,0x1b; ja default;`
jump table of 28 image-relative RVAs at `0x141b17af4`. Decoding it statically **reproduces the
previously-known Util table exactly** (`fetchClientConfig=1, ping=2, preAuth=7, postAuth=8`, …),
which validates the whole approach.

**Authentication's `getCommandName` at `0x146e0d2a0` is Denuvo-mutated** — it begins
`push rcx; lea rcx,[rip+…]; jmp 0x14e183f34` into the protector arena. Consequently:

- the 33-name alphabetical string pool at `0x14389d690`–`0x14389d928` has **zero** references
  anywhere in the address space (no `lea`, no qword pointer, no image-relative u32 — checked across
  every readable region including the heap);
- so the command map cannot be recovered statically.

It was recovered instead by **calling the function in the live process**:

```
gdb --batch -p <pid> -ex 'p ((char*(*)(long,long,int))0x146e0d2a0)(0,0,<id>)'
```

Note the calling-convention detail: the target is **Windows x64** code (`this`→`rcx`, arg→`rdx`) but
gdb marshals with the **SysV** ABI (`rdi, rsi, rdx, …`), so the command id must be passed as the
**third** gdb argument to land in `rdx`. Validated against Util first (returned `preAuth` for 7,
`ping` for 2, `fetchClientConfig` for 1, `postAuth` for 8), then applied to Authentication.

Two independent cross-checks on the Authentication result:
- id `0x000B` → `"trustedLogin"`, which matches the static REST-binding struct at `0x143896a80`
  (`{u16 component=0x0001, u16 command=0x000B, …, const char* name="trustedLogin", …, "GET"}`).
- every one of the 33 names in the static string pool is accounted for, with no leftovers.

### The table

Ids 1–320 were swept; everything not listed returns the empty default string.

| Cmd | RPC | Cmd | RPC |
|---|---|---|---|
| `0x000A` (10) | **`login`** | `0x003C` (60) | `expressLogin` |
| `0x000B` (11) | `trustedLogin` | **`0x0046` (70)** | **`logout`** ← *observed on the wire* |
| `0x0014` (20) | `updateAccount` | `0x005A` (90) | `getPersona` |
| `0x0015` (21) | `upgradeAccount` | `0x0064` (100) | `listPersonas` |
| `0x001D` (29) | `listUserEntitlements2` | `0x0065` (101) | `expressCreateAccount` |
| `0x001E` (30) | `getAccount` | `0x00E6` (230) | `createWalUserSession` |
| `0x001F` (31) | `grantEntitlement` | `0x00F1` (241) | `acceptLegalDocs` |
| `0x0020` (32) | `listEntitlements` | `0x00F2` (242) | `getEmailOptInSettings` |
| `0x0022` (34) | `getUseCount` | `0x00F6` (246) | `getTermsOfServiceContent` |
| `0x0023` (35) | `decrementUseCount` | `0x0104` (260) | `getOriginPersona` |
| `0x0024` (36) | `getAuthToken` | `0x010E` (270) | `checkEmail` |
| `0x0026` (38) | `getPasswordRules` | `0x0118` (280) | `getPersonaNameSuggestions` |
| `0x0027` (39) | `grantEntitlement2` | `0x0122` (290) | `guestLogin` |
| `0x002B` (43) | `modifyEntitlement2` | | |
| `0x002C` (44) | `consumecode` | | |
| `0x002D` (45) | `passwordForgot` | | |
| `0x002F` (47) | `getPrivacyPolicyContent` | | |
| `0x0030` (48) | `listPersonaEntitlements2` | | |
| `0x0033` (51) | `checkAgeReq` | | |
| `0x0034` (52) | `getOptIn` | | |
| `0x0035` (53) | `enableOptIn` | | |
| `0x0036` (54) | `disableOptIn` | | |

Confidence: **certain** for every row (the client itself produced these strings).

### Request / response type binding

From the reflection type index (`Blaze::Authentication::*`):

| Cmd | RPC | Request TDF | Response TDF |
|---|---|---|---|
| `0x000A` | `login` | `LoginRequest` | **`LoginResponse`** |
| `0x000B` | `trustedLogin` | `TrustedLoginRequest` | `LoginResponse` |
| `0x003C` | `expressLogin` | `ExpressLoginRequest` | `LoginResponse` |
| `0x0122` | `guestLogin` | *(none)* | `LoginResponse` |
| **`0x0046`** | **`logout`** | ***(none — empty)*** | ***(none — empty)*** |
| `0x0024` | `getAuthToken` | *(none)* | `GetAuthTokenResponse` |
| `0x001D` | `listUserEntitlements2` | `ListUserEntitlements2Request` | `Entitlements` |
| `0x0030` | `listPersonaEntitlements2` | `ListPersonaEntitlements2Request` | `Entitlements` |
| `0x0064` | `listPersonas` | *(none)* | `ListPersonasResponse` |
| `0x005A` | `getPersona` | *(none)* | `GetPersonaResponse` |
| `0x001E` | `getAccount` | *(none)* | `AccountInfo` |
| `0x0104` | `getOriginPersona` | `GetOriginPersonaRequest` | `PersonaInfo` |

`logout` having no TDFs on either side is confirmed by absence: there is no `LogoutRequest` /
`LogoutResponse` type anywhere in the client's index.

---

## 3. `Blaze::Authentication::LoginResponse` — the login reply (cmd `0x000A`)

Descriptor `0x14487d170`, member table `0x1448789c0`, 5 members. Serialise in **ascending packed-tag
order** (which is the order the table itself is sorted in).

| Tag | Member | TDF type | Wire type | Offset |
|---|---|---|---|---|
| `ANON` | `isAnonymous` | bool | `0x00` | `+0x12` |
| `NTOS` | `needsLegalDoc` | bool | `0x00` | `+0x13` |
| `SESS` | `userLoginInfo` | `Blaze::Authentication::UserLoginInfo` | `0x03` | `+0x18` |
| `SPAM` | `isOfLegalContactAge` | bool | `0x00` | `+0x10` |
| `UNDR` | `isUnderage` | bool | `0x00` | `+0x11` |

### `Blaze::Authentication::UserLoginInfo` (`SESS`) — 8 members, descriptor `0x14487cb00`

| Tag | Member | Type | Offset |
|---|---|---|---|
| `1CON` | `isFirstConsoleLogin` | bool | `+0x51` |
| `BUID` | `blazeUserId` | int64 | `+0x28` |
| `FRST` | `isFirstLogin` | bool | `+0x50` |
| `KEY ` | `sessionKey` | string | `+0x10` |
| `LLOG` | `lastLoginDateTime` | int64 | `+0x58` |
| `MAIL` | `email` | string | `+0x38` |
| `PDTL` | `personaDetails` | `PersonaDetails` (struct) | `+0x60` |
| `UID ` | `userId` | int64 | `+0x30` |

> Note the trailing-space tags: `KEY` and `UID` are 3-char tags. `heat2.py`'s `encode_tag`
> pads to 4 with the 6-bit "space" code, which is what the wire expects.

### `Blaze::Authentication::PersonaDetails` (`PDTL`) — 6 members, descriptor `0x14487cab0`

| Tag | Member | Type | Offset |
|---|---|---|---|
| `DSNM` | `displayName` | string | `+0x18` |
| `LAST` | `lastAuthenticated` | uint32 | `+0x3c` |
| `PID ` | `personaId` | int64 | `+0x10` |
| `PLAT` | `clientPlatform` | `Blaze::ClientPlatformType` (enum → int) | `+0x38` |
| `STAS` | `status` | `PersonaStatus::Code` (enum → int) | `+0x40` |
| `XREF` | `extId` | uint64 | `+0x30` |

### Request side (for completeness)

`Blaze::Authentication::LoginRequest` (`0x14487ca10`, 3 members):

| Tag | Member | Type |
|---|---|---|
| `AUTH` | `authCode` | string ← *the Origin/LSX auth code* |
| `EXTB` | `externalBlob` | blob |
| `EXTI` | `externalId` | uint64 |

`TrustedLoginRequest` (`0x14487ca60`): `ID ` id:string, `ITYP` idType:string, `TOKN` accessToken:string.
`ExpressLoginRequest` (`0x14487d0d0`): `MAIL` email:string, `PASS` password:string, `PNAM` personaName:string.
`StressLoginRequest` (`0x14487d120`): `MAIL` email:string, `NUID` nucleusId:uint64, `PNAM` personaName:string.

The `AUTH` field being a plain string is the whole hinge: **the client cannot fill it without a
working Origin `GetAuthCode`.**

---

## 4. What the server must return for the client to consider itself authenticated

**Caveat on method.** For `PreAuthResponse` we could read `ConnectionManager::onPreAuthResponse`
directly and prove field-by-field what is and isn't validated. The equivalent login-response handler
lives in the FIFA/OSDK layer, and that code is **Denuvo-mutated** — the same protection that hid
`getCommandName`. So the list below is derived from *structure* (what the types carry, what the
UserSessions notification duplicates, what the client must have in order to name itself), not from
reading the handler. Flagged accordingly.

| Field | Why it matters | Confidence it is required |
|---|---|---|
| `SESS.KEY ` `sessionKey` | The Blaze session credential. Every later component echoes it; a session with an empty key is not a session. Must be non-empty. | **high** |
| `SESS.BUID` `blazeUserId` | The client's own BlazeId. Used as the identity key in UserManager and in every later `lookupUser*`. Must be non-zero. | **high** |
| `SESS.UID ` `userId` | Nucleus user id. Should equal `blazeUserId` for a single-account offline emu unless you have a reason to split them. | **high** |
| `SESS.PDTL.PID ` `personaId` | **Must equal `33068179`** (the `stp-origin_emu.ini` `PersonaId`). A mismatch is exactly what trips `AUTH_ERR_INVALID_PERSONA` / `AUTH_ERR_USER_DOES_NOT_MATCH_PERSONA` / `AUTH_ERR_PERSONA_NOT_FOUND`. | **high** |
| `SESS.PDTL.DSNM` `displayName` | **Must equal `CAGE`.** This is the name the UI renders and the value later persona lookups are matched against. | **high** |
| `SESS.PDTL.STAS` `status` | Persona status enum. Must be the "active" value; `AUTH_ERR_PERSONA_INACTIVE` (19) and `AUTH_ERR_PERSONA_BANNED` (32) exist for the other cases. Send `0`. | medium |
| `SESS.PDTL.PLAT` `clientPlatform` | Should match the `PLAT` you returned in `PreAuthResponse` (`pc`). | medium |
| `SESS.PDTL.XREF` `extId` | External (Origin) id. Safe to mirror `personaId`. | low |
| `SESS.MAIL` `email` | Cosmetic; any well-formed address. | low |
| `ANON` `isAnonymous` | **Must be `false`/0.** An anonymous session is precisely a not-really-logged-in session and will not enable online features. | **high** |
| `NTOS` `needsLegalDoc` | **Must be `false`/0**, otherwise the client will branch into the legal-doc flow (`acceptLegalDocs` = 241, `getTermsOfServiceContent` = 246) instead of proceeding. | **high** |
| `UNDR` `isUnderage` | **Must be `false`/0** — underage gates online play. | **high** |
| `SPAM` `isOfLegalContactAge` | Set `true`/1 for symmetry with `UNDR=false`. | medium |
| `FRST` / `1CON` / `LLOG` | First-login flags and timestamp. Cosmetic; `false/false/<now>` is fine. | low |

Consistency rule that spans both layers: **`personaId` and `personaName` returned over LSX,
returned in `LoginResponse.PDTL`, and pushed in the `UserAuthenticated` notification must be the
same triple** (`33068179` / `CAGE` / `en_US`). Every `AUTH_ERR_*_PERSONA*` code in §6 is a symptom
of these three disagreeing.

---

## 5. The login-success notification the server must push

Authentication (component `0x0001`) has **exactly one** notification. Its `getNotificationName`-slot
function `0x146e0f2e0` is a one-case switch:

```
cmp dx,0xb ; jne default ; lea rax,[0x143896a80] ; ret
```

and `0x143896a80` is **not** a notification name — it is the REST-binding struct for
`trustedLogin` (cmd `0x000B`). So Authentication publishes **no async notifications at all**; the
slot is `getRestResourceInfo`, not `getNotificationName`.

**The login-success notification lives on `UserSessions`, component `0x7802` (30722).**
Component id confirmed independently: that component's error table compares against
`(errorNumber<<16)|0x7802` (`0x17802`, `0x27802`, … `0x177802`).

`UserSessions::getNotificationName` at `0x146de19a0` is **clean, unmutated** code —
`movzx eax,dx; dec eax; cmp eax,0xb; ja default;` with a 12-entry image-relative jump table at
`0x141b03f70`. Decoded statically:

| Notification id | Name | Payload TDF |
|---|---|---|
| `0x0001` | `UserSessionExtendedDataUpdate` | `Blaze::UserSessionExtendedDataUpdate` |
| `0x0002` | `UserAdded` | `Blaze::UserData` |
| `0x0003` | `UserRemoved` | `Blaze::UserIdentification` *(or `UserStatus`)* |
| `0x0004` | *(unused)* | — |
| `0x0005` | `UserUpdated` | `Blaze::UserStatus` |
| `0x0006`–`0x0007` | *(unused)* | — |
| **`0x0008`** | **`UserAuthenticated`** | **`Blaze::UserSessionLoginInfo`** |
| `0x0009` | `UserUnauthenticated` | `Blaze::UserSessionLogoutInfo` |
| `0x000A`–`0x000B` | *(unused)* | — |
| `0x000C` | `ServerDraining` | — |

The **id → name** column is certain (decoded from the client's own jump table). The **payload TDF**
column is *inferred*: the notification dispatcher at `0x146de2803` (12-entry jump table at
`0x141b05258`, branches at `0x146de2bc3 / 289c / 2ae9 / 2dd8 / 29e0 / 2cf1 / 2825`) constructs its
TDFs on the stack rather than through the type-descriptor getters, so I could not bind each branch
to a descriptor by xref. The mapping above is a 1:1 name match against the only session types the
client links in, and `UserSessionLoginInfo` is the only type in the entire index that carries a
session key plus a persona — but treat the payload column as **high confidence, not verified**.

### `Blaze::UserSessionLoginInfo` — 16 members, descriptor `0x14486f920`

This is the notification body to push after a successful `login`. Note it is a **superset** of
`UserLoginInfo` with the persona fields flattened in rather than nested.

| Tag | Member | Type | Offset |
|---|---|---|---|
| `1CON` | `isFirstConsoleLogin` | bool | `+0x51` |
| `ALOC` | `accountLocale` | uint32 | `+0x60` |
| `BUID` | `blazeUserId` | int64 | `+0x28` |
| `CGID` | `connectionGroupObjectId` | ObjectId | `+0xb0` |
| `DSNM` | `displayName` | string | `+0x70` |
| `FRST` | `isFirstLogin` | bool | `+0x50` |
| `KEY ` | `sessionKey` | string | `+0x10` |
| `LAST` | `lastAuthenticated` | uint32 | `+0xac` |
| `LLOG` | `lastLoginDateTime` | int64 | `+0x58` |
| `MAIL` | `email` | string | `+0x38` |
| `NASP` | `personaNamespace` | string | `+0x88` |
| `PID ` | `personaId` | int64 | `+0x68` |
| `PLAT` | `clientPlatform` | enum | `+0xa8` |
| `UID ` | `userId` | int64 | `+0x30` |
| `USTP` | `userSessionType` | `Blaze::UserSessionType` (enum) | `+0xc0` |
| `XREF` | `extId` | uint64 | `+0xa0` |

`ALOC` (`accountLocale`) is a packed uint32 locale — use the same encoding the client sent in
`ClientData.LANG` in the PreAuth request, i.e. echo it back rather than inventing one. `NASP`
(`personaNamespace`) should match the `NASP` you returned in `PreAuthResponse`.

### Related UserSessions types (for the rest of the session bring-up)

```
Blaze::UserSessionLogoutInfo            (0x14486f970, 2)
  BID   blazeId          int64
  USTP  userSessionType  enum

Blaze::SessionInfo                      (0x14486ffa0, 5)
  BUID  blazeUserId  int64      DSNM  displayName  string
  KEY   sessionKey   string     MAIL  email        string
  UID   userId       int64

Blaze::UserIdentification               (0x14486ebc0, 9)
  AID   accountId        int64     ALOC  accountLocale    uint32
  EXBB  externalBlob     blob      EXID  externalId       uint64
  ID    blazeId          int64     NAME  name             string
  NASP  personaNamespace string    ORIG  originPersonaId  uint64
  PIDI  pidId            int64

Blaze::UserData                         (0x1448706b0, 3)
  EDAT  extendedData  Blaze::UserSessionExtendedData
  FLGS  statusFlags   Blaze::UserDataFlags (bitfield)
  USER  userInfo      Blaze::UserIdentification

Blaze::UserStatus                       (0x14486ed10, 2)
  FLGS  statusFlags  Blaze::UserDataFlags     ID  blazeId  int64

Blaze::UserSessionExtendedData           (0x144870390, 12)
  ADDR  address                Blaze::NetworkAddress (union, 5 cases)
  BPS   bestPingSiteAlias      string
  CTY   country                string
  CVAR  clientData             variable
  DMAP  dataMap                map<int64,uint32>
  HWFG  hardwareFlags          Blaze::HardwareFlags (bitfield)
  ISP   iSP                    string
  PSLM  latencyList            list<int32>
  QDAT  qosData                Blaze::Util::NetworkQosData
  TZ    timeZone               string
  UATT  userInfoAttribute      uint64
  ULST  blazeObjectIdList      list<ObjectId>

Blaze::UserSessionExtendedDataUpdate     (0x1448703e0, 3)
  DATA  extendedData  Blaze::UserSessionExtendedData
  SUBS  subscribed    bool
  USID  userId        int64
```

---

## 6. Authentication error codes — **complete**

Blaze error codes for this component are packed `(errorNumber << 16) | 0x0001`. Recovered by calling
`getErrorName` (`0x146e0ec20`, clean code) in-process across the range; the static `cmp edx,0xNN0001`
chain at `0x146e0ec20`+ corroborates.

| # | Name | # | Name |
|---|---|---|---|
| 1 | `AUTH_ERR_INVALID_TOKEN` | 72 | `AUTH_ERR_TOO_MANY_ENTITLEMENTS` |
| 2 | `AUTH_ERR_TOS_REQUIRED` | 73 | `AUTH_ERR_PAGESIZE_ZERO` |
| 6 | `AUTH_ERR_INVALID_SANDBOX_ID` | 74 | `AUTH_ERR_ENTITLEMENT_TAG_REQUIRED` |
| 10 | `AUTH_ERR_INVALID_COUNTRY` | 75 | `AUTH_ERR_PAGENO_ZERO` |
| 11 | `AUTH_ERR_INVALID_USER` | 76 | `AUTH_ERR_MODIFIED_STATUS_INVALID` |
| 12 | `AUTH_ERR_INVALID_PASSWORD` | 77 | `AUTH_ERR_USECOUNT_INCREMENT` |
| 14 | `AUTH_ERR_EXPIRED_TOKEN` | 78 | `AUTH_ERR_TERMINATION_INVALID` |
| 16 | `AUTH_ERR_TOO_YOUNG` | 79 | `AUTH_ERR_UNKNOWN_ENTITLEMENT` |
| 17 | `AUTH_ERR_NO_ACCOUNT` | 80 | `AUTH_ERR_EXCEEDS_PSU_LIMIT` |
| 19 | `AUTH_ERR_PERSONA_INACTIVE` | 81 | `AUTH_ERR_OPTIN_NAME_REQUIRED` |
| 20 | `AUTH_ERR_INVALID_PMAIL` | 82 | `AUTH_ERR_INVALID_OPTIN` |
| 21 | `AUTH_ERR_INVALID_FIELD` | 83 | `AUTH_ERR_OPTIN_MISMATCH` |
| 22 | `AUTH_ERR_INVALID_EMAIL` | 84 | `AUTH_ERR_NO_SUCH_OPTIN` |
| 23 | `AUTH_ERR_INVALID_STATUS` | 85 | `AUTH_ERR_AUTHID_REQUIRED` |
| 32 | `AUTH_ERR_PERSONA_BANNED` | 86 | `AUTH_ERR_PERSONA_EXTREFID_REQUIRED` |
| 33 | `AUTH_ERR_INVALID_PERSONA` | 87 | `AUTH_ERR_SOURCE_REQUIRED` |
| 34 | `AUTH_ERR_CURRENT_PASSWORD_REQUIRED` | 88 | `AUTH_ERR_APPLICATION_REQUIRED` |
| 41 | `AUTH_ERR_DEACTIVATED` | 89 | `AUTH_ERR_TOKEN_REQUIRED` |
| 43 | `AUTH_ERR_BANNED` | 90 | `AUTH_ERR_PARAMETER_TOO_LENGTH` |
| 44 | `AUTH_ERR_DISABLED` | 91 | `AUTH_ERR_NO_SUCH_PERSONA_REFERENCE` |
| 50 | `AUTH_ERR_NEED_PCCDKEY` | 93 | `AUTH_ERR_INVALID_SOURCE` |
| 51 | `AUTH_ERR_CODE_ALREADY_USED` | 94 | `AUTH_ERR_NO_SUCH_AUTH_DATA` |
| 52 | `AUTH_ERR_INVALID_CODE` | 101 | `AUTH_ERR_USER_INACTIVE` |
| 53 | `AUTH_ERR_CODE_ALREADY_DISABLED` | 102 | `AUTH_ERR_UNEXPECTED_ACTIVATION` |
| 54 | `AUTH_ERR_NO_ASSOCIATED_PRODUCT` | 103 | `AUTH_ERR_NAME_MISMATCH` |
| 55 | `AUTH_ERR_INVALID_MAPPING_ERROR` | 105 | `AUTH_ERR_INVALID_NAMESPACE` |
| 56 | `AUTH_ERR_NO_SUCH_GROUP_NAME` | 198 | `AUTH_ERR_FIELD_MIN_LOWER_CHARS` |
| 57 | `AUTH_ERR_MISSING_PERSONAID` | 199 | `AUTH_ERR_FIELD_MIN_UPPER_CHARS` |
| 58 | `AUTH_ERR_USER_DOES_NOT_MATCH_PERSONA` | 200 | `AUTH_ERR_FIELD_MIN_DIGITS` |
| 59 | `AUTH_ERR_WHITELIST` | 201 | `AUTH_ERR_FIELD_INVALID_CHARS` |
| 60 | `AUTH_ERR_LINK_PERSONA` | 202 | `AUTH_ERR_FIELD_TOO_SHORT` |
| 61 | `AUTH_ERR_NO_SUCH_GROUP` | 203 | `AUTH_ERR_FIELD_TOO_LONG` |
| 63 | `AUTH_ERR_NO_SUCH_ENTITLEMENT` | 204 | `AUTH_ERR_FIELD_MUST_BEGIN_WITH_LETTER` |
| 64 | `AUTH_ERR_GROUP_NAME_DOES_NOT_MATCH` | 205 | `AUTH_ERR_FIELD_MISSING` |
| 66 | `AUTH_ERR_USECOUNT_ZERO` | 206 | `AUTH_ERR_FIELD_INVALID` |
| 67 | `AUTH_ERR_ENTITLEMETNTAG_EMPTY` *(sic)* | 207 | `AUTH_ERR_FIELD_NOT_ALLOWED` |
| 70 | `AUTH_ERR_GROUPNAME_REQUIRED` | 208 | `AUTH_ERR_FIELD_NEEDS_SPECIAL_CHARS` |
| 71 | `AUTH_ERR_GROUPNAME_INVALID` | 209 | `AUTH_ERR_FIELD_ALREADY_EXISTS` |
| | | 210 | `AUTH_ERR_FIELD_NEEDS_CONSENT` |
| | | 211 | `AUTH_ERR_FIELD_TOO_YOUNG` |
| | | 212 | `AUTH_ERR_ASSOCIATION_TOO_YOUNG` |

---

## 7. Supporting types for the post-login flow

```
Blaze::Authentication::GetAuthTokenResponse       (0x14487d080, 1)
  AUTH  authToken  string

Blaze::Authentication::GetUserAccessTokenResponse (0x14487db80, 2)
  ATOK  accessToken  string      CLID  clientId  string

Blaze::Authentication::ListPersonasResponse       (0x14487d210, 1)
  PINF  list  list<Blaze::Authentication::PersonaDetails>

Blaze::Authentication::GetPersonaResponse         (0x14487d1c0, 2)
  PINF  personaInfo  Blaze::Authentication::PersonaInfo
  UID   userId       int64

Blaze::Authentication::PersonaInfo                (0x14487c7c0, 7)
  DSNM  displayName    string     DTCR  dateCreated       string
  LADT  lastAuthenticated uint32  NSNM  nameSpaceName     string
  PID   personaId      int64      STAS  status            enum
  STRC  statusReasonCode enum

Blaze::Authentication::AccountInfo                (0x14487c810, 16)
  AMU anonymousUser:bool     ASRC authenticationSource:string
  CO  country:string         DOB  dOB:string
  DTCR dateCreated:string    GOPT globalOptin:int8
  LATH lastAuth:string       LN   language:string
  MAIL email:string          PML  parentalEmail:string
  RC  reasonCode:enum        STAS status:enum
  STAT emailStatus:enum      TPOT thirdPartyOptin:int8
  UDU underageUser:bool      UID  userId:int64

Blaze::Authentication::Entitlements               (0x14487d4e0, 1)
  NLST  entitlements  list<Blaze::Authentication::Entitlement>

Blaze::Authentication::Entitlement                (0x14487d490, 16)
  DEVI deviceUri:string     GDAY grantDate:string      GNAM groupName:string
  ID   id:uint64            ISCO isConsumable:bool     PID  personaId:int64
  PJID projectId:string     PRCA productCatalog:enum   PRID productId:string
  STAT status:enum          STRC statusReasonCode:enum TAG  entitlementTag:string
  TDAY terminationDate:string  TYPE entitlementType:enum
  UCNT useCount:uint32      VER  version:uint32

Blaze::Authentication::UserProfileInfo             (0x14487c860, 8)
  CITY city:string  CTRY country:string  STAT state:string  STRT street:string
  ZIP zipCode:string  GNDR gender:enum   UID userId:int64
  ELEM profileInfoElementsByCategory: map<string, map<string,string>>
       (the binary's own map<> name string is written value-first — read it backwards,
        same caveat as documented for QoS maps in the preAuth doc)
```

When `listUserEntitlements2` (`0x001D`) does eventually get called, the entitlement the retail exe
requires is `TAG = "ONLINE_ACCESS"` with `PRID` tied to offer id `1027460`, `STAT` = active, and
`PID` = `33068179`. `AUTH_ERR_NO_SUCH_ENTITLEMENT` (63) and `AUTH_ERR_ENTITLEMENT_TAG_REQUIRED` (74)
are the failure modes.

---

## 8. Recommended server behaviour, in order

1. **Fix layer 1 first.** Nothing in this document is reachable until the in-process Origin/LSX stub
   on `127.0.0.1:4216` answers `OriginIsOnline` / `GetInternetConnectedState` with *online* and
   `GetAuthCode` with a non-empty code. Right now the client's `logout` at cmd `0x0046` is the
   observable proof that it never got one. This is the single highest-value next step.
2. Keep replying to `Util::fetchClientConfig` (9/1) — an empty `FetchConfigResponse { CONF: {} }` is
   structurally valid, but see the preAuth doc for the tunables the client reads out of `CONF`.
3. When `Authentication::login` (`0x0001`/`0x000A`) finally arrives, reply `LoginResponse` per §3
   with the §4 field values, keyed to persona `33068179` / `CAGE`.
4. Immediately after the login REPLY, push a **NOTIFICATION** frame (msgType=2) on component
   `0x7802`, notification id `0x0008` (`UserAuthenticated`), payload `Blaze::UserSessionLoginInfo`
   per §5 — same session key, same BlazeId, same persona triple.
5. Expect `Util::postAuth` (9/8) next; `PostAuthResponse` is documented in the preAuth doc.
6. Answer `logout` (`0x0046`) with an empty REPLY — which is already correct.

---

## 9. Tooling produced (all in the session scratchpad)

| Script | Purpose |
|---|---|
| `stubscan.py` | list every `lea rax,[rip+str]; ret` name stub in a VA window, in address order |
| `authcmd.py` | locate RPC-name strings and every reference to them |
| `refscan.py` | find all references (rip-rel lea / qword / image-relative u32) into a VA window |
| `heapref.py` | same, but across *every* readable region including the heap |
| `cmdinfo.py` | scan the metadata arena for `{u16 component, u16 command, …, name}` REST structs |
| `comptabs.py` | enumerate Blaze `ComponentDescription` 7-pointer tables |
| `qdump.py` / `pooldump.py` / `dumpregion.py` | annotated qword dump / string-pool dump / raw region dump |
| `jt.py` | decode an MSVC image-relative jump table of `lea/ret` name stubs |
| `rpcmap.py` / `factref.py` / `vt2.py` | descriptor-getter and factory xref mapping (all three came up empty for Authentication — recorded as negative results) |
| `authcmds*.gdb`, `autherr.gdb` | in-process `getCommandName` / `getErrorName` sweeps |

Reused from the previous pass: `memtool.py`, `reflect2.py`, `strsearch.py`, `all_types.txt`.

### Negative results worth recording

- The 33-name Authentication command-name pool at `0x14389d690` is **completely unreferenced** —
  no lea, no pointer, no RVA, anywhere in the process. Do not waste time looking for its xrefs.
- `Blaze::Authentication::LoginRequest`'s vtable (`0x14389ac68`) is referenced only by its own
  factory/ctor/dtor. No game code constructs one statically — the login call site is inside
  Denuvo-mutated code.
- Every `Blaze::Authentication::*` type-descriptor getter has exactly one caller: the TDF factory
  registration run at `0x1451cd0xx`. There is no per-command descriptor table to mine.