root
70a64e3709
Freeze the running offline FUT backend into version control as fifa17-recon/docker/fifa17-python/ - declarative and rebuildable from a fresh checkout: * OPENFUT_BIND / OPENFUT_ADVERTISE client/server split in the responders (lsx, blaze, roster, utas, pow) + entrypoint.sh; OPENFUT_ADVERTISE is required for remote mode (compose and entrypoint fail without it) * docker-compose.yml reproducing the frozen baseline container exactly (env, ports incl. the 8085->8080 POW-content remap, /state bind, restart) * .env.example / .env for site config - the LAN IP is never hardcoded in source * tools/ + data/ staged from openfut-fut-backend:python-baseline-2026-08-10, verified byte-identical to the running container at freeze time * client_arm.sh (the 105 client-side arming counterpart) * Dockerfile bakes /app/SHA256SUMS.txt so any image is self-identifying * docs/BASELINE-python-2026-08-10.md: frozen image/container/hash record, restore instructions and rebuild-equivalence procedure Secrets (redir key/cert, .env) and runtime state (docker/state) stay gitignored. The live container is untouched pending the .105 launcher audit.
97 lines
4.2 KiB
Python
Executable File
97 lines
4.2 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Dump the DECRYPTED FIFA17 login machinery from live /proc/PID/mem.
|
|
|
|
FIFA17.exe's .data-region code is packed/encrypted on disk (objdump of the file is
|
|
garbage); the real instructions only exist decrypted in memory at runtime. This grabs
|
|
generous windows around the known login-path VAs (from prior live recon) plus the
|
|
resolved OriginMgr / session objects, then disassembles each window at its true VA so a
|
|
follow-up reversing pass works on real code.
|
|
|
|
Run while FIFA17 is running (ptrace_scope=0). Output -> ./login_dump/ + manifest.txt.
|
|
"""
|
|
import glob, os, subprocess, struct, sys
|
|
|
|
OUT = os.path.join(os.path.dirname(os.path.abspath(__file__)), "login_dump")
|
|
os.makedirs(OUT, exist_ok=True)
|
|
|
|
# (name, VA, bytes_before, bytes_after) — code windows around the login machinery.
|
|
CODE = [
|
|
("dispatch_case2", 0x146f1e080, 0x120, 0x180), # event dispatcher; case-2 sets m_isLoggedIn
|
|
("event_matcher", 0x147102880, 0x40, 0x400), # sender/element matcher
|
|
("login_parser", 0x147138660, 0x40, 0x400), # <Login> element parser (reads IsLoggedIn)
|
|
("loginstate_pclogin", 0x1471b58e0, 0x40, 0x600), # LoginStatePCLogin entry
|
|
("txt_not_login_ebisu", 0x1471b5b00, 0x40, 0x400), # TXT_NOT_LOGIN_TO_EBISU write site(s)
|
|
("pclogin_callsite", 0x1471b6780, 0x60, 0x120), # session-object call: ff 50 60 (vtbl+0x60)
|
|
]
|
|
|
|
# Data pointers to resolve (name, ptr_VA, deref_chain_offsets, dump_span).
|
|
# We read *[ptr_VA], then optionally add offsets, then dump `span` bytes there.
|
|
DATA = [
|
|
("originmgr", 0x1448acf50, [], 0x80), # OriginMgr; m_isLoggedIn @+0x13, loginError @+0x14
|
|
("online_flags", 0x1448a3ac0, [], 0x40), # "internet reachable" byte lives here
|
|
("auth_block", 0x1448a3b20, [0x4e98], 0x60), # auth slots +0x08/+0x10
|
|
("session_obj", 0x144b86bf8, [], 0x80), # LoginStatePCLogin session object (vtbl @+0)
|
|
]
|
|
|
|
def find_pid():
|
|
for d in glob.glob('/proc/[0-9]*'):
|
|
try:
|
|
if open(d + '/comm').read().strip() == 'FIFA17.exe':
|
|
return int(os.path.basename(d))
|
|
except Exception:
|
|
pass
|
|
return None
|
|
|
|
def read(f, va, n):
|
|
f.seek(va); return f.read(n)
|
|
|
|
def rd_u64(f, va):
|
|
b = read(f, va, 8)
|
|
return struct.unpack('<Q', b)[0] if len(b) == 8 else 0
|
|
|
|
def disasm(path, va):
|
|
asm = path + ".asm"
|
|
with open(asm, "w") as out:
|
|
subprocess.run(["objdump", "-D", "-b", "binary", "-m", "i386:x86-64",
|
|
"-M", "intel", "--adjust-vma=%#x" % va, path],
|
|
stdout=out, stderr=subprocess.DEVNULL)
|
|
return asm
|
|
|
|
def main():
|
|
pid = find_pid()
|
|
if not pid:
|
|
print("FIFA17.exe not running — launch it first."); sys.exit(1)
|
|
man = open(os.path.join(OUT, "manifest.txt"), "w")
|
|
man.write("FIFA17 login-machinery dump pid=%d\n\n" % pid)
|
|
with open(f"/proc/{pid}/mem", "rb") as f:
|
|
for name, va, before, after in CODE:
|
|
start = va - before
|
|
data = read(f, start, before + after)
|
|
p = os.path.join(OUT, f"{name}_{start:x}.bin")
|
|
open(p, "wb").write(data)
|
|
disasm(p, start)
|
|
line = f"CODE {name:22s} window {start:#x}..{start+len(data):#x} ({len(data)}B) -> {os.path.basename(p)}[.asm]"
|
|
print(line); man.write(line + "\n")
|
|
man.write("\n")
|
|
for name, ptr, chain, span in DATA:
|
|
base = rd_u64(f, ptr)
|
|
addr = base
|
|
trail = f"*[{ptr:#x}]={base:#x}"
|
|
for off in chain:
|
|
nxt = rd_u64(f, addr + off) if off and base else base
|
|
# for a single deref-with-offset we dump AT base+off, not deref again:
|
|
addr = base
|
|
target = base + (chain[0] if chain else 0)
|
|
data = read(f, target, span) if base else b""
|
|
p = os.path.join(OUT, f"{name}_{target:x}.bin")
|
|
open(p, "wb").write(data)
|
|
# hex preview
|
|
hexp = " ".join("%02x" % x for x in data[:0x40])
|
|
line = f"DATA {name:22s} {trail} dump@{target:#x} ({len(data)}B) -> {os.path.basename(p)}\n first64: {hexp}"
|
|
print(line); man.write(line + "\n")
|
|
man.close()
|
|
print("\nWrote dumps + manifest to", OUT)
|
|
|
|
if __name__ == "__main__":
|
|
main()
|