OpenFUT/fifa17-recon/tools/auth_refs.md

# FIFA 17 Blaze — Authentication (component 0x0001) login flow

**Date:** 2026-07-30 · **Scope:** what the client needs so it believes it is logged in.

---

## 0. Provenance legend

| Flag | Meaning |
|---|---|
| **(A) binary** | Reflected/disassembled out of **our own `FIFA17.exe`** (live `/proc/<pid>/mem`, PID 19517). Authoritative for FIFA 17. |
| **(A) wire** | Our own captured bytes (`fifa17-recon/captures/blaze/session/`). |
| **(A) clean-room 3P** | Third-party clean-room reimplementations cloned in the scratchpad. `grid-blaze` states explicitly it is "a clean-room implementation based entirely on network analysis"; `pamplona-future`/`catalyst-mitm` are the same Beat-Revival lineage (packet captures + `zeroKilo`/`jacobtread` public TDF work). Mirror's Edge Catalyst = **Blaze 15.1.1.0.5**, FIFA 17 = **Blaze 15.1.1.3.0** — same SDK generation. |
| **(B?) unverified 3P** | `refs/z7_*.txt` in the scratchpad — pre-existing reference captures of *unknown* origin, **not** produced by us. Treated as a hint only; every z7 claim below was independently re-derived from (A). Where z7 disagrees with our binary, **our binary wins** (see §6). |

**No EA/FIFA leaked source was consulted.** Nothing below is derived from the 2021 leak.

---

## 1. THE HEADLINE: the client is not stalling — it is **logging out**

Observed frame #9 (`captures/blaze/session/auth_cmd0x46.bin`):

```
00 00 00 00 | 00 00 | 00 01 | 00 46 | 00 00 10 | 00 | 00 00
payload=0     meta=0  comp=1  cmd=0x46 msgNum=16 MESSAGE
```

`component 0x0001 (Authentication), command 0x0046 = 70 decimal, EMPTY payload.`

**Command 70 = `logout`.** Evidence:

1. **(A) clean-room 3P** — `pamplona-future/src/blaze/components/authentication.ts:10-46` is a full BlazeSDK-15.1.1 `Authentication` command enum, and it lists `logout = 70`. That enum is independently corroborated on three other entries by our own data:
   - `login = 10` ↔ z7 capture `comp=0x0001 cmd=0x000A [LoginRequest]`
   - `getAuthToken = 36` ↔ z7 capture `comp=0x0001 cmd=0x0024 [GetAuthTokenResponse]`
   - `listUserEntitlements2 = 29` ↔ `grid-blaze/src/main.rs:35` routes `1, 29 => list_entitlments`
2. **(A) binary** — FIFA 17's own Authentication RPC-name literal pool at `0x14389d6xx–0x14389d928` contains **exactly the same 33 RPC names** as the pamplona enum (`acceptLegalDocs … logout … upgradeAccount`), i.e. FIFA 17 and MEC ship the *same* Authentication component definition. `"logout"` is at `0x14389d8d8`.
3. `logout` is the only Authentication RPC in that set that takes **no request parameters**, which matches the observed 0-byte payload. (`getAuthToken` is also parameterless but is `0x24`, not `0x46`.)

> Confidence: **high**, cross-validated three ways, but *not* 100% binary-pinned — FIFA 17's `getCommandName` for Authentication is not emitted as the `lea rax,[rip+str]; ret` stub pattern that yielded the Util table, and the name pool has **zero** code xrefs (searched every `lea/mov rip-rel` and every aligned+unaligned 8-byte pointer, module-wide). So the id↔name mapping itself is inherited from (A) clean-room 3P, not re-derived from FIFA 17.

### What this changes

The client **never attempted `login` (cmd 10)**. It went:

`preAuth → ping → 6× fetchClientConfig (all answered EMPTY) → logout → give up`

So it is *not* waiting on an Authentication response we failed to send. It decided, **before** issuing any login, that it had nothing to log in with, and tore the Blaze session down. That is consistent with the two-layer gate: it had **no Origin auth code** to put in `LoginRequest.AUTH`, and/or the OSDK layer failed to initialise from the empty configs.

**(A) binary corroboration of layer 1:** `FIFA17.exe` contains the localisation key **`TXT_NOT_LOGIN_TO_EBISU`** at `0x1439633e8` (Ebisu = EA's internal codename for Origin), sitting immediately beside `TXT_ORIGIN_GAME_VERSION_OUT_OF_DATE`, `OSDK_PRESENCE_OFFLINE`, `OSDK_OL_STATE_NONE`. The UI flow events `checkOriginConnected` / `OriginIsOnline` / `OriginIsOffline` live at `0x143b4cb58`. This is almost certainly the on-screen message, and it is produced by the **Origin/LSX layer**, not by Blaze.

---

## 2. Authentication component — command ids

Component id **0x0001**. Ids **(A) clean-room 3P** (pamplona enum); every name **(A) binary**-confirmed present in FIFA 17's RPC name pool unless noted.

| Cmd | RPC | Cmd | RPC |
|---|---|---|---|
| 10 (0x0A) | **`login`** | 54 | `disableOptIn` |
| 11 (0x0B) | `trustedLogin` | 60 (0x3C) | `expressLogin` |
| 20 | `updateAccount` | **70 (0x46)** | **`logout`** ← *observed* |
| 21 | `upgradeAccount` | 90 (0x5A) | `getPersona` |
| 29 (0x1D) | **`listUserEntitlements2`** | 100 | `listPersonas` |
| 30 | `getAccount` | 101 | `expressCreateAccount` |
| 31 | `grantEntitlement` | 230 | `createWalUserSession` |
| 32 | `listEntitlements` | 241 | `acceptLegalDocs` |
| 34 | `getUseCount` | 242 | `getEmailOptInSettings` |
| 35 | `decrementUseCount` | 246 | `getTermsOfServiceContent` |
| 36 (0x24) | **`getAuthToken`** | 260 | `getOriginPersona` |
| 38 | `getPasswordRules` | 270 | `checkEmail` |
| 39 | `grantEntitlement2` | 280 | `getPersonaNameSuggestions` |
| 43 | `modifyEntitlement2` | 290 | `guestLogin` |
| 44 | `consumecode` | | |
| 45 | `passwordForgot` | | |
| 47 | `getPrivacyPolicyContent` | | |
| 48 | `listPersonaEntitlements2` | | |
| 51 | `checkAgeReq` | | |
| 52 | `getOptIn` | | |
| 53 | `enableOptIn` | | |

FIFA 17 additionally ships types with no id in the MEC enum — `GetUserAccessTokenRequest/Response`, `GetUserXblTokenRequest/Response`, `StressLoginRequest`, `CheckLegalDocRequest/Response`, `GetSuggestionsRequest` — so FIFA's component is a **superset**. Ids for those are unknown.

**Error-code encoding (A) binary:** Blaze error codes are `(index << 16) | componentId`. Confirmed by the `0x000N7802` constant block at `0x146de08xx` sitting alongside the `USER_ERR_*` name stubs (component `0x7802` = UserSessions). So an Authentication error is `0xNNNN0001`.

---

## 3. `login` (1/10) request + response TDF — **(A) binary, authoritative**

Reflected from FIFA 17's own TDF type descriptors. **Fields MUST be emitted in ascending packed-tag order**, which for A–Z tags is plain alphabetical with `' '` (pad) sorting first — the member tables below are already in that order.

### Request — `Blaze::Authentication::LoginRequest` @ `0x14487ca10` (3 members)

| Tag | Member | Type |
|---|---|---|
| `AUTH` | `authCode` | string ← **the Origin/Nucleus auth code** |
| `EXTB` | `externalBlob` | blob |
| `EXTI` | `externalId` | uint64 |

> z7's `LoginRequest` also carried `ACHT{SHID,SKID}` — **FIFA 17 has no `ACHT` member**. z7 is a different title/version. Ignore it.

### Response — `Blaze::Authentication::LoginResponse` @ `0x14487d170` (**5 members**)

| Tag | Member | Type |
|---|---|---|
| `ANON` | `isAnonymous` | bool |
| `NTOS` | `needsLegalDoc` | bool |
| `SESS` | `userLoginInfo` | struct `UserLoginInfo` |
| `SPAM` | `isOfLegalContactAge` | bool |
| `UNDR` | `isUnderage` | bool |

> **Important divergence from the MEC emulators.** `grid-blaze/src/models/authentication.rs:23-50` and `pamplona-future/.../authentication.ts:78-128` both emit `CNTX`, `ERRC` and a top-level `SKEY` in the login *payload*. **FIFA 17's `LoginResponse` has none of those.** `CNTX`/`ERRC` are the Blaze **error metadata** block (see `grid-blaze/src/packet.rs:62-71` `ErrorBody`, and its own `// TODO: move ErrorBody to metadata`; pamplona sets `metadataSize: 75` on the login reply). Emit **exactly the 5 members above** in the payload; leave metadata empty on success. The session key lives at `SESS.KEY`, not at top level.

### `SESS` — `Blaze::Authentication::UserLoginInfo` @ `0x14487cb00` (8 members)

| Tag | Member | Type |
|---|---|---|
| `1CON` | `isFirstConsoleLogin` | bool |
| `BUID` | `blazeUserId` | int64 |
| `FRST` | `isFirstLogin` | bool |
| `KEY` | `sessionKey` | string ← **the forged session key** |
| `LLOG` | `lastLoginDateTime` | int64 |
| `MAIL` | `email` | string |
| `PDTL` | `personaDetails` | struct `PersonaDetails` |
| `UID` | `userId` | int64 |

(`1` = 0x31 → packed 0x11, which is **below** `A` = 0x21, so `1CON` correctly sorts first.)

### `PDTL` — `Blaze::Authentication::PersonaDetails` @ `0x14487cab0` (6 members)

| Tag | Member | Type |
|---|---|---|
| `DSNM` | `displayName` | string |
| `LAST` | `lastAuthenticated` | uint32 |
| `PID` | `personaId` | int64 |
| `PLAT` | `clientPlatform` | enum `ClientPlatformType` |
| `STAS` | `status` | enum `PersonaStatus::Code` |
| `XREF` | `extId` | uint64 |

### `getAuthToken` (1/36) response — `GetAuthTokenResponse` @ `0x14487d080`

Single member: `AUTH` `authToken` : string. (Matches z7 exactly.)

### `listUserEntitlements2` (1/29) response — `Blaze::Authentication::Entitlements` @ `0x14487d4e0`

Single member `NLST` : `list<Entitlement>`.

`Blaze::Authentication::Entitlement` @ `0x14487d490` (16 members, tag order):
`DEVI` deviceUri(str), `GDAY` grantDate(str), `GNAM` groupName(str), `ID` id(u64), `ISCO` isConsumable(bool), `PID` personaId(i64), `PJID` projectId(str), `PRCA` productCatalog(enum), `PRID` productId(str), `STAT` status(enum `EntitlementStatus::Code`), `STRC` statusReasonCode(enum), `TAG` entitlementTag(str), `TDAY` terminationDate(str), `TYPE` entitlementType(enum `EntitlementType::Code`), `UCNT` useCount(u32), `VER` version(u32).

**(A) binary** enum literals: `EntitlementType::Code` = `ONLINE_ACCESS`, `TRIAL_ONLINE_ACCESS`, `SUBSCRIPTIONS`, `PARENTAL_APPROVAL` (@`0x1438991e8`). `EntitlementStatus::Code` includes `ACTIVE`/`USED`/`UNUSED`/`BANNED`/`DISABLED`.

---

## 4. Forging a session with no Nucleus — the recipe

**(A) clean-room 3P** for the *shape* of the forgery, **(A) binary** for every tag.

### 4.1 What a fake session consists of

`grid-blaze/src/routes/authentication.rs:17-133` is the canonical minimal pattern:

1. Ignore whatever is in `LoginRequest.AUTH` (it never validates it against Nucleus — it swaps in Discord OAuth; an offline emulator just skips validation entirely).
2. Mint a `User { user_id, persona_id, username }` from local storage / config.
3. Store it on the session (`session.data.set_user`).
4. **Push the `UserAuthenticated` notification** (see §4.3).
5. Reply with `LoginResponse`.

### 4.2 Session key

Both 3P emulators use a **canned literal**; the client does not verify it:
- `grid-blaze` uses simply `"0"` for both `SKEY` and `SESS.KEY`.
- `pamplona-future` uses a realistic-looking `"0540000031e5dde8_wT9NlhYTUidv3EMiZo7kaRMYV0x3$x72YrtOC*QU1v"`.

Real Blaze session keys look like `<16 hex>_<44 random base64-ish chars>`. Recommend generating that shape once per session and reusing the **same string** in `LoginResponse.SESS.KEY` **and** in the `UserAuthenticated` notification's `KEY` — they must match.

### 4.3 The `UserAuthenticated` notification — **(A) binary, exact**

Component **`0x7802` (30722, UserSessions)**, command **`0x0008`**, msgType = **NOTIFICATION (2)**, msgNum = 0.

Payload type is **`Blaze::UserSessionLoginInfo`** @ `0x14486f920`, **16 members**:

| Tag | Member | Type |
|---|---|---|
| `1CON` | `isFirstConsoleLogin` | bool |
| `ALOC` | `accountLocale` | uint32 |
| `BUID` | `blazeUserId` | int64 |
| `CGID` | `connectionGroupObjectId` | ObjectId (triple) |
| `DSNM` | `displayName` | string |
| `FRST` | `isFirstLogin` | bool |
| `KEY` | `sessionKey` | string |
| `LAST` | `lastAuthenticated` | uint32 |
| `LLOG` | `lastLoginDateTime` | int64 |
| `MAIL` | `email` | string |
| `NASP` | `personaNamespace` | string |
| `PID` | `personaId` | int64 |
| `PLAT` | `clientPlatform` | enum |
| `UID` | `userId` | int64 |
| `USTP` | `userSessionType` | enum `UserSessionType` |
| `XREF` | `extId` | uint64 |

> This is a **hard confirmation** of the z7 reference: `z7_userauth_notif.txt` (`comp=0x7802 cmd=0x0008 [UserSessions::UserAuthenticated]`) carries exactly these 16 tags. It also **corrects both MEC emulators**, which call notification 30722/8 `updateHardwareFlags` — that is the name of *command* 8, not *notification* 8. The payload they build is right; the name is wrong.

### 4.4 `UserSessionExtendedDataUpdate` — **(A) binary**

`Blaze::UserSessionExtendedDataUpdate` @ `0x1448703e0`, 3 members: `DATA` (struct `UserSessionExtendedData`), `SUBS` (bool), `USID` (int64).
This is what pamplona/grid-blaze mislabel `validateSessionKey` and send as **notification 30722/1**.

`Blaze::UserSessionExtendedData` @ `0x144870390` — **12 members** (tag order):
`ADDR` address(`NetworkAddress`, union), `BPS` bestPingSiteAlias(str), `CTY` country(str), `CVAR` clientData(variable), `DMAP` dataMap(`map<int64,uint32>`), `HWFG` hardwareFlags, `ISP` iSP(str), **`PSLM` latencyList(`list<int32>`)**, `QDAT` qosData, `TZ` timeZone(str), `UATT` userInfoAttribute(u64), `ULST` blazeObjectIdList(`list<ObjectId>`).

> Two FIFA-17-specific deltas vs the MEC emulators: FIFA has **`PSLM`** (they don't), and FIFA has **`BPS` as a top-level string member** (they wrap it inside the `ADDR` union as `BPS `). Follow the FIFA layout.

`Blaze::Util::NetworkQosData` (`QDAT`) @ `0x14486e680`: `BWHR` u32, `DBPS` u32, `NAHR` u32, `NATT` enum `NatType`, `UBPS` u32.

### 4.5 Persona identity must match the Origin emu

From `stp-origin_emu.ini [Globals]`: `PersonaId=33068179`, `PersonaName=CAGE`, `Language=en_US`.
Use `BUID = PID = 33068179`, `DSNM = "CAGE"`, `NASP = "cem_ea_id"` (namespace confirmed by our own PreAuthResponse being accepted), `PLAT = 4` (pc), `USTP = 0`.
Mismatch trips `AUTH_ERR_INVALID_PERSONA` / `AUTH_ERR_USER_DOES_NOT_MATCH_PERSONA` / `AUTH_ERR_PERSONA_NOT_FOUND` — all present in the binary at `0x146e0ed91`, `0x146e0eebf`, `0x146e0ecf8`.

---

## 5. `Util::fetchClientConfig` (9/1) — what to return

Request: `Blaze::Util::FetchClientConfigRequest` = `{ CFID: string }`.
Response: `Blaze::Util::FetchConfigResponse` @ `0x1448752e0` = **single member `CONF` : `map<string,string>`**. (Note: **not** wrapped in an extra struct — the extra nesting only exists inside `PreAuthResponse`, where `CONF` is a `FetchConfigResponse` struct whose own single member is also called `CONF`. Easy to get wrong.)

### 5.1 The `BlazeSDK` section (returned inside `PreAuthResponse.CONF.CONF`)

Our capture shows the client asks for this **inside the preAuth request**: `FCCR { CFID = 'BlazeSDK' }`. **(A) binary** — these are the config keys FIFA 17 actually parses (string literals present in the exe; the "absent" ones are MEC-only and are silently ignored by FIFA 17):

| Key | Present in FIFA17.exe | Owner (from adjacent literals) |
|---|---|---|
| `connIdleTimeout` | ✅ `0x1438a0a58` | `ConnectionManager` |
| `defaultRequestTimeout` | ✅ `0x1438a0a40` | `ConnectionManager` |
| `pingPeriod` | ✅ `0x1438a0a30` | `ConnectionManager` |
| `autoReconnectEnabled` | ✅ `0x1438a0a68` | `ConnectionManager` |
| `maxReconnectAttempts` | ✅ `0x1438a0a80` | `ConnectionManager` |
| `enableQosFirewallTest` | ✅ `0x1438a09f0` | `ConnectionManager`/`QosManager` |
| `enableQosBandwidthTest` | ✅ `0x1438a0a08` | `ConnectionManager`/`QosManager` |
| **`nucleusConnect`** | ✅ `0x14389fef8` | **`LoginStateMachineImpl`** |
| **`nucleusConnectTrusted`** | ✅ `0x14389fdf8` | **`LoginStateMachineImpl`** |
| `associationListSkipInitialSet` | ✅ `0x143b6eb88` | `AssociationListAPI` |
| `userManagerMaxCachedUsers` | ✅ | UserManager |
| `voipHeadsetUpdateRate` | ✅ | VoIP |
| `nucleusPortal` | ❌ absent | MEC-only |
| `nucleusProxy` | ❌ absent | MEC-only |
| `bytevaultHostname` / `bytevaultPort` / `bytevaultSecure` | ❌ absent | MEC-only |
| `xblTokenUrn`, `xboxOneStringValidationUri`, `xlspConnectionIdleTimeout` | ❌ absent | MEC/Xbox-only |

**How `nucleusConnect` is used — (A) binary.** The `LoginManagerImpl` / `LoginStateMachineImpl` string cluster at `0x14389fd50–0x14389fef8` reads, in order:

```
LoginManagerImpl · LoginData · LoginStateMachineImpl · LoginStateMachine
nucleusConnectTrusted · "%s/connect/token" · "grant_type=client_credentials"
recvBuf · "NEXUS_S2S " · "\"access_token\" : \"" · headers
LoginStateBase::buffer
LoginStateAuthenticated::mTermsOfServiceBuffer
LoginStateAuthenticated::mPrivacypolicyBuffer
nucleusConnect
```

So the client builds **`<nucleusConnect>/connect/token`**, POSTs `grant_type=client_credentials`, and scrapes `"access_token" : "` out of the JSON reply. **Point `nucleusConnect` / `nucleusConnectTrusted` at our own HTTPS listener and serve a canned OAuth token JSON** — that is the Blaze-side half of defeating auth. There is a `NEXUS_S2S` header value involved. `LoginStateAuthenticated` also buffers ToS + privacy-policy text, which is why `NTOS` (`needsLegalDoc`) in `LoginResponse` should be **0**.

Recommended `BlazeSDK` map (keep it minimal — FIFA 17 ignores unknown keys):

```
associationListSkipInitialSet = 1
autoReconnectEnabled          = 0
connIdleTimeout               = 90000000
defaultRequestTimeout         = 30000000
enableQosBandwidthTest        = false
enableQosFirewallTest         = false
maxReconnectAttempts          = 0
nucleusConnect                = https://accounts.ea.com      <- repoint to us
nucleusConnectTrusted         = https://accounts2s.ea.com    <- repoint to us
pingPeriod                    = 20000000
userManagerMaxCachedUsers     = 0
```

### 5.2 The `OSDK_*` sections — **(A) binary**

`OSDK_CORE`, `OSDK_CLIENT`, `OSDK_NUCLEUS`, `OSDK_WEBOFFER`, `OSDK_ABUSE_REPORTING`, `OSDK_TICKER` are literals at `0x143962be8..0x143962c40`, and they sit **inside the `ResourceLoader` / `NETRESOURCE` / `LoadResourceFromMultiUrl` / `netres` string cluster**. Adjacent source path: `.../extern/OSDK/8.01.03.00-fifa.01/source/common/presencedownloadmanagerabstract.cpp` → the game embeds **OSDK 8.01.03.00-fifa.01**.

Meaning: these sections are **game-tuning key/value maps** consumed by FIFA's OSDK layer (a `ResourceLoader` with states `LOADING`/`LOADED`/`NOT_FOUND`), not Blaze plumbing. The key namespace is `OSDK_*`; confirmed examples of *real* config keys (as opposed to the many `OSDK_*` localisation ids):

`OSDK_PRESENCE_DELAY`, `OSDK_PRESENCE_POLL`, `OSDK_ABUSE_NUM_TYPES`, `OSDK_ANTIGRIEFING_MAX_COUNT`, `OSDK_ARENA_ENABLED`, `OSDK_ARENA_CHALLENGE_SCHEDULE_URL`, `OSDK_ARENA_REGISTER_EMAIL_URL`, `OSDK_CLUBS_MAX_SEARCH_RESULT`, `OSDK_CLUBS_LOAD_MEMBER_PAGE_SIZE`, `OSDK_CLUBS_MAX_USERS_FOR_GAME`, `OSDK_CLUBS_LEADERBOARD_CLUB_MAX`, `OSDK_CLUBS_INCOME_SEARCH_MAX`.

There is **no `nucleusConnect`-equivalent in `OSDK_NUCLEUS`** that we could find; the Nucleus URLs are BlazeSDK-level (§5.1). `OSDK_NUCLEUS` most likely holds Nucleus *tuning* (poll intervals, retry counts).

> **Assessment:** returning an empty `CONF` map for the `OSDK_*` sections is probably **not** what killed us — these are tuning values that fall back to defaults. Answering them non-empty is cheap insurance, but the real blocker is layer 1 (Origin/LSX `GetAuthCode` / `OriginIsOnline`). Also note `OSDK_XMS_ABUSE_REPORTING` (which the client requested) is **not** in the literal block — so the section list is built dynamically.

### 5.3 `IdentityParams`

Not requested by FIFA 17 in our capture, but both MEC emulators and z7 answer it identically:
`display = console2/welcome`, `redirect_uri = http://127.0.0.1/success`.

---

## 6. Post-login RPC order

**(A) wire (ours)** for everything up to `logout`. Beyond that, **(A) clean-room 3P** + z7, since we have never got past it.

Observed by us (FIFA 17):
```
1  9/7   Util::preAuth            (req carries FCCR{CFID='BlazeSDK'}, CINF{CLNT='FIFA17', BSDK='15.1.1.3.0'})
2  9/2   Util::ping
   -- reconnect --
3  9/1   Util::fetchClientConfig   CFID=OSDK_CORE
4  9/1                             CFID=OSDK_CLIENT
5  9/1                             CFID=OSDK_NUCLEUS
6  9/1                             CFID=OSDK_WEBOFFER
7  9/1                             CFID=OSDK_ABUSE_REPORTING
8  9/1                             CFID=OSDK_XMS_ABUSE_REPORTING
9  1/70  Authentication::logout    <-- gave up here
```

Expected happy path (compiled from `grid-blaze/src/main.rs:32-44`, `pamplona-future/.../util.ts:41-74`, and the z7 msgNum ordering):

```
9/7    Util::preAuth              -> PreAuthResponse
9/1    Util::fetchClientConfig    -> FetchConfigResponse   (xN)
1/10   Authentication::login      -> LoginResponse
       << NOTIFY 30722/8  UserAuthenticated (UserSessionLoginInfo)
9/8    Util::postAuth             -> PostAuthResponse
       << NOTIFY 30722/1  UserSessionExtendedDataUpdate
       << NOTIFY 30722/2  (UserAdded — DATA + USER)
1/29   Authentication::listUserEntitlements2 -> Entitlements{NLST}
9/28   Util::setClientState       -> empty reply     (req: MODE=1, STAT=0)
1/36   Authentication::getAuthToken -> {AUTH: "<token>"}
9/10   Util::userSettingsLoad     -> UserSettingsResponse
25/6   AssociationLists::getLists -> GetListsResponse{LMAP}
30722/20 UserSessions::updateNetworkInfo -> empty reply
9/22   Util::setClientMetrics     -> empty reply
9/2    Util::ping                 (every pingPeriod)
```

Ordering caveat: in `grid-blaze` the `UserAuthenticated` notification is pushed **from inside the login handler, before the login reply is written** (`routes/authentication.rs:128-132`); pamplona writes the reply first, then the notification (`authentication.ts:54-57`). Both apparently work. `postAuth` pushes its two notifications around its reply (`util.ts:60-64`: extendedDataAttribute → reply → extendedData).

### `Util::postAuth` (9/8) — **(A) binary**

Request `Blaze::Util::PostAuthRequest` @ `0x1448757c0`: **`DSUI` dirtySockUserIndex(int32), `UDID` uniqueDeviceId(string)** — only 2 members. *(z7 shows a third `MAC` field; FIFA 17 does not have it. Another z7 mismatch.)*

Response `Blaze::Util::PostAuthResponse` @ `0x144875810`: `TELE`, `TICK`, `UROP`.
- `TELE` = `GetTelemetryServerResponse` @ `0x144875470`, 15 members: `ADRS`(str) `ANON`(bool) `DISA`(str) `EDCT`(bool) `FILT`(str) `LOC`(u32) `MINR`(bool) `NOOK`(str) `PORT`(u32) `SDLY`(u32) `SESS`(str) `SKEY`(str) `SPCT`(u32) `STIM`(str) `SVNM`(str).
- `TICK` = `GetTickerServerResponse` @ `0x1448754c0`, 3 members: `ADRS`(str) `PORT`(u32) `SKEY`(str).
- `UROP` = `UserOptions` @ `0x144875770`, 2 members: `TMOP`(enum `TelemetryOpt`) `UID`(int64).

### Bug in our current responder

`Blaze::Util::PingResponse` @ `0x144875560` has **exactly one member: `STIM` (serverTime, uint32)**. `blaze_responder_v2.py` sends `STIM` **and** `TIME`. `TIME` is not a member of FIFA 17's `PingResponse` (it is MEC's). Harmless-ish, but drop it.

---

## 7. Association lists (25/6) — for completeness

**(A) clean-room 3P** only (`grid-blaze/src/models/association_lists.rs`). Response `GetListsResponse{ LMAP: list<AssociationList> }`; each entry is `INFO{ BOID(ObjectId) FLGS(u8) LID{LNM(str) TYPE(u8)} LMS(u32) PNAM(str) PRID(u8) PRMS(u32) }`, `OFRC`, `TOCT`. MEC ships `friendList`(type 1), `followList`(type 5), `communicationBlockList`(type 4). FIFA's list names are **not** verified — do not assume.

---

## 8. Recommended next actions

1. **Fix layer 1 first.** The client logs out *before* trying to log in, and the on-screen string is `TXT_NOT_LOGIN_TO_EBISU`. Make the in-process LSX server on `127.0.0.1:4216` answer `OriginIsOnline` / `GetInternetConnectedState` as **online**, and `GetAuthCode` with any non-empty code. Without that there is nothing to put in `LoginRequest.AUTH` and Blaze work is unreachable.
2. Implement `Util::fetchClientConfig` returning a non-empty `CONF` map (`{CONF: map<string,string>}`) for every `CFID`, even if only a couple of keys — removes it as a variable.
3. Put `nucleusConnect` / `nucleusConnectTrusted` in the **preAuth** `CONF` map pointing at our own listener, and serve `POST <base>/connect/token` returning `{"access_token" : "<anything>"}`.
4. Implement `Authentication::login` (1/10) → the 5-member `LoginResponse` above, then push `UserAuthenticated` (30722/8, 16 members) with the **same** session-key string, using PersonaId 33068179 / "CAGE".
5. Implement `Util::postAuth` (9/8), `Authentication::listUserEntitlements2` (1/29) returning one `ONLINE_ACCESS` entitlement (`PJID`/offer id `1027460`, `TYPE`=ONLINE_ACCESS, `STAT`=ACTIVE), `Util::setClientState` (9/28) empty, `Authentication::getAuthToken` (1/36) → `{AUTH}`.
6. Keep handling `Authentication::logout` (1/70) with an empty reply — but treat receiving it as a **failure signal** in the responder log, not a normal step.

---

## 9. File index

**Cloned reference repos (scratchpad):**
- `/tmp/.../scratchpad/grid-blaze/src/routes/authentication.rs` — login handler + entitlements
- `/tmp/.../scratchpad/grid-blaze/src/models/authentication.rs` — AuthResponse/Entitlement serialisers
- `/tmp/.../scratchpad/grid-blaze/src/routes/util.rs`, `src/models/util.rs` — preAuth/postAuth/fetchClientConfig
- `/tmp/.../scratchpad/grid-blaze/src/models/user_sessions.rs` — the 4 session notifications
- `/tmp/.../scratchpad/grid-blaze/src/main.rs:32-44` — full route table
- `/tmp/.../scratchpad/grid-blaze/src/packet.rs` — Fire2 framing (matches our corrected layout)
- `/tmp/.../scratchpad/pamplona-future/src/blaze/components/authentication.ts:10-46` — **the command-id enum**
- `/tmp/.../scratchpad/pamplona-future/src/blaze/components/util.ts:17-39` — Util command enum
- `/tmp/.../scratchpad/pamplona-future/src/blaze/components/user-sessions.ts:21-50` — UserSessions command enum
- `/tmp/.../scratchpad/catalyst-mitm/blaze/interceptor.ts` — redirector request XML shape
- `/tmp/.../scratchpad/tdf/src/{writer,reader,tag,types}.rs` — reference TDF codec

**Our own artefacts:**
- `/home/alex/Documents/OpenFUT/fifa17-recon/captures/blaze/session/session_full.log` — the live session
- `/home/alex/Documents/OpenFUT/fifa17-recon/captures/blaze/session/auth_cmd0x46.bin` — the logout frame
- `/home/alex/Documents/OpenFUT/fifa17-recon/tools/preauth_schema_reflection.md` — prior reflection write-up + Util command table

**Tooling written/used this pass (scratchpad):**
- `reflect2.py` — TDF type-descriptor walker (`raw <va>` / `index <pat>` / `byname`)
- `authscan.py`, `stubrange.py`, `allstubs.txt` — `lea/ret` command-name stub recovery
- `findstr2.py`, `nameblk.py`, `allstr.py`, `xref.py`, `rvatab.py`, `notifid.py` — string/xref/constant hunting
- `clusters.json` — all 124 name-stub clusters (includes the UserSessions notification-name cluster
  `ServerDraining, UserAdded, UserAuthenticated, UserRemoved, UserSessionExtendedDataUpdate, UserUnauthenticated` @ `0x146de19c0`)

**Descriptor VAs (FIFA17.exe, base `0x140000000`):**
`LoginRequest 0x14487ca10` · `LoginResponse 0x14487d170` · `UserLoginInfo 0x14487cb00` · `PersonaDetails 0x14487cab0` · `GetAuthTokenResponse 0x14487d080` · `ExpressLoginRequest 0x14487d0d0` · `Entitlement 0x14487d490` · `Entitlements 0x14487d4e0` · `AccountInfo 0x14487c810` · `PersonaInfo 0x14487c7c0` · `UserSessionLoginInfo 0x14486f920` · `UserSessionLogoutInfo 0x14486f970` · `UserSessionExtendedData 0x144870390` · `UserSessionExtendedDataUpdate 0x1448703e0` · `Util::PostAuthRequest 0x1448757c0` · `Util::PostAuthResponse 0x144875810` · `Util::FetchConfigResponse 0x1448752e0` · `Util::PingResponse 0x144875560` · `Util::PreAuthResponse 0x144875600`