funman300
6ddd5e9d47
Milestone: FIFA 17 Ultimate Team boots end-to-end on our offline backend
past every EA gate into the hub and a live Squads editor (correct 4-4-2,
5-star squad, no freezes).
Key findings this session:
- userMassInfo MUST stay {} (any content desyncs the massinfo parser
0x180174630 -> tokenizer busy-loop freeze). Deliver the squad via
GET /squad/0 (fetched on Squads-tab entry) instead.
- Player cards render generic because the card view-model (0x1800d7920)
reads identity/rating/face from a resolved record at item+0x10, filled
by a lookup (0x18011cca0) in the FUT item-definition std::map at
CardsDb+0x160c0 -- which is EMPTY offline -> default blank record.
- Version advertising (itemDbVersion/checkServerDbVersion) is proven inert
(JSON fields routed to the skip handler). Owned items don't auto-trigger
a definition fetch. In-place map overwrite is dead (map stays empty).
- Definition-serving endpoints (item/resource, defid, item?idList) built +
ready; the fetch trigger lives in the packed FIFA17.exe.
New: docs/CARD_SYSTEM.md (findings + ordered next-steps plan for real
player cards: patch-POC, dbdata extractor, drive FIFA17.exe fetch, or
live-memory store injection). Plus tools: fut_seed.py (squad ladder +
definition serving), fifadrive.sh, vgamepad.py, and the login-RE toolset.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PN5bmpDVQR1aXgefyWAt7o
58 lines
2.1 KiB
Plaintext
58 lines
2.1 KiB
Plaintext
# watch_login.gdb -- HARDWARE watchpoint on OriginMgr.m_isLoggedIn.
|
|
# Software int3 breakpoints looked unreliable under Wine wow64 (i386:x64-32 arch
|
|
# warning, zero hits even though FIFA drains the socket). Debug-register
|
|
# watchpoints work at the CPU level and catch ANY write to the byte, revealing
|
|
# the real setter + backtrace regardless of which code path does it.
|
|
#
|
|
# Q: does m_isLoggedIn ([OriginMgr+0x13]) EVER get written? by what instruction?
|
|
#
|
|
# Also arms HARDWARE exec breakpoints (hbreak) on the known setter/matcher so we
|
|
# can tell "bp mechanism broken" apart from "code never runs".
|
|
set pagination off
|
|
set confirm off
|
|
set width 0
|
|
attach PIDHERE
|
|
set architecture i386:x86-64
|
|
|
|
# CRITICAL for Wine: it drives thread scheduling with SIGUSR1/USR2 and realtime
|
|
# signals. gdb halts on them by default, which (in -batch) ends the script and
|
|
# DETACHES within seconds -- the reason earlier traces saw zero hits. Pass them
|
|
# through silently so the game keeps running and our bps/watchpoints survive.
|
|
handle SIGUSR1 nostop noprint pass
|
|
handle SIGUSR2 nostop noprint pass
|
|
handle SIGPIPE nostop noprint pass
|
|
handle SIG32 nostop noprint pass
|
|
handle SIG33 nostop noprint pass
|
|
handle SIG34 nostop noprint pass
|
|
handle SIG35 nostop noprint pass
|
|
|
|
# resolve the live OriginMgr and the flag byte address
|
|
set $om = *(unsigned long*)0x1448acf50
|
|
printf "OriginMgr = %#lx m_isLoggedIn byte @ %#lx = %d\n", $om, $om+0x13, *(unsigned char*)($om+0x13)
|
|
|
|
# --- the decisive probe: catch ANY write to the flag byte ---
|
|
watch *(unsigned char*)($om+0x13)
|
|
commands
|
|
printf "\n*** m_isLoggedIn WRITE: %d -> %d at rip=%#lx ***\n", $arg0, *(unsigned char*)($om+0x13), $rip
|
|
printf "backtrace:\n"
|
|
bt 6
|
|
continue
|
|
end
|
|
|
|
# --- validation / cross-check: hardware exec bps on the theorised machinery ---
|
|
hbreak *0x146f1e0ab
|
|
commands
|
|
silent
|
|
printf ">> [hbreak] setter 0x146f1e0ab reached (mov [rcx+0x13],1) rcx=%#lx\n", $rcx
|
|
continue
|
|
end
|
|
hbreak *0x147102880
|
|
commands
|
|
silent
|
|
printf ">> [hbreak] sender matcher 0x147102880 reached\n"
|
|
continue
|
|
end
|
|
|
|
printf "\n=== watch_login armed (HW watchpoint + hbreak). Drive the game: dismiss popup, ONLINE tab, reconnect. ===\n"
|
|
continue
|