funman300
6ddd5e9d47
Milestone: FIFA 17 Ultimate Team boots end-to-end on our offline backend
past every EA gate into the hub and a live Squads editor (correct 4-4-2,
5-star squad, no freezes).
Key findings this session:
- userMassInfo MUST stay {} (any content desyncs the massinfo parser
0x180174630 -> tokenizer busy-loop freeze). Deliver the squad via
GET /squad/0 (fetched on Squads-tab entry) instead.
- Player cards render generic because the card view-model (0x1800d7920)
reads identity/rating/face from a resolved record at item+0x10, filled
by a lookup (0x18011cca0) in the FUT item-definition std::map at
CardsDb+0x160c0 -- which is EMPTY offline -> default blank record.
- Version advertising (itemDbVersion/checkServerDbVersion) is proven inert
(JSON fields routed to the skip handler). Owned items don't auto-trigger
a definition fetch. In-place map overwrite is dead (map stays empty).
- Definition-serving endpoints (item/resource, defid, item?idList) built +
ready; the fetch trigger lives in the packed FIFA17.exe.
New: docs/CARD_SYSTEM.md (findings + ordered next-steps plan for real
player cards: patch-POC, dbdata extractor, drive FIFA17.exe fetch, or
live-memory store injection). Plus tools: fut_seed.py (squad ladder +
definition serving), fifadrive.sh, vgamepad.py, and the login-RE toolset.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PN5bmpDVQR1aXgefyWAt7o
56 lines
2.3 KiB
Python
56 lines
2.3 KiB
Python
#!/usr/bin/env python3
|
|
"""Continuously PIN OriginMgr.m_isLoggedIn = 1 (and clear loginError) from the
|
|
earliest moment OriginMgr exists, for the whole FIFA17 session.
|
|
|
|
Rationale (2026-07-31 live finding): setting the flag AFTER boot does nothing --
|
|
FIFA decides logged-out during its boot Blaze handshake (sends Authentication::
|
|
logout 1/0x46, never login 1/0x0A) and never re-auths. This pins the flag to 1
|
|
FROM BOOT so it is already set when FIFA does that handshake. Run BEFORE launching
|
|
FIFA; it auto-attaches to each FIFA17.exe and re-pins fast enough to win the race.
|
|
|
|
Needs ptrace_scope=0 (already set by root_arm.sh). Idempotent, harmless.
|
|
"""
|
|
import glob, os, struct, time
|
|
|
|
ORIGINMGR_PP = 0x1448acf50 # *(void**)0x1448acf50 -> OriginMgr
|
|
OFF_LOGGEDIN = 0x13 # OriginMgr.m_isLoggedIn (u8)
|
|
OFF_LOGINERR = 0x14 # OriginMgr.loginError (u32)
|
|
|
|
def find_pid():
|
|
for d in glob.glob('/proc/[0-9]*'):
|
|
try:
|
|
if open(d + '/comm').read().strip() == 'FIFA17.exe':
|
|
return int(os.path.basename(d))
|
|
except Exception:
|
|
pass
|
|
return None
|
|
|
|
def main():
|
|
print("[pin] waiting for FIFA17.exe (pin m_isLoggedIn=1 from boot)...", flush=True)
|
|
last_pid = None
|
|
first_pin = False
|
|
while True:
|
|
pid = find_pid()
|
|
if not pid:
|
|
last_pid = None; first_pin = False; time.sleep(0.2); continue
|
|
if pid != last_pid:
|
|
print(f"[pin] FIFA17.exe pid={pid}", flush=True); last_pid = pid; first_pin = False
|
|
try:
|
|
with open(f"/proc/{pid}/mem", "r+b") as f:
|
|
f.seek(ORIGINMGR_PP); om = struct.unpack('<Q', f.read(8))[0]
|
|
if om:
|
|
f.seek(om + OFF_LOGGEDIN); cur = f.read(1)
|
|
if cur != b'\x01':
|
|
f.seek(om + OFF_LOGGEDIN); f.write(b'\x01')
|
|
f.seek(om + OFF_LOGINERR); f.write(b'\x00\x00\x00\x00')
|
|
if not first_pin:
|
|
print(f"[pin] OriginMgr={om:#x} -> m_isLoggedIn PINNED=1 "
|
|
f"(was {cur[0] if cur else '?'})", flush=True)
|
|
first_pin = True
|
|
except Exception:
|
|
pass
|
|
time.sleep(0.02) # 50 Hz: fast enough to win the boot race + hold it
|
|
|
|
if __name__ == "__main__":
|
|
main()
|