funman300
59934b4ef0
The client now issues PUT /squad and the hub renders coins, record and the
squad roster. Three separate root causes, all verified live.
Squad blocker (the long-standing "client never sends PUT /squad"):
AddPlayerToSquad, GetSquads and SelectSquadById issue ZERO network requests
(pure local model reads/mutations, FutSquadServiceImpl vtable 0x180233ff0);
only SaveCurrentSquad writes, and it is unguarded. The client simply needed a
populated ACTIVE squad model, which arrives via the massinfo `squad` member.
No response of ours was ever being rejected.
userMassInfo is NOT required to be {}:
0x180174630 is a FLAT {userInfo, squad, settings, userData} body -- the old
"wrapper key is user" note was wrong, and the historical freeze was the
malformed squad member, not the envelope.
clubNameChangeAllowed must be false:
sending true advertises a club-rename flow whose UI model is never populated;
the client shows a naming prompt and dies confirming it (ACCESS_VIOLATION
reading 0x0 at FIFA17.exe+0x71b8651, 4/4 runs, no CardsDLL frame and no request
in flight). Isolated by a single-variable run; guarded by a contract check.
Endpoint/schema corrections found in live traffic, invisible to static analysis:
* GET ut/%s/squad/list is a real endpoint and must return {"squad":[...]},
not the active-squad object (the /list suffix is appended by the caller, so
it never appeared in the request table)
* PUT lands on ut/%s/squad/<id>, not a bare ut/%s/squad
* userInfo currencies are read as name/funds/finalFunds/active -- there is no
"value" key, so coins always rendered 0
* squad-list elements take STRING formation/squadType, not ints
* the CardsDLL script-API thunk<->name table was off by one (AddPlayerToSquad
is 0x18004aa70; 0x18004aff0 is GetPotentialChemistry_Club)
FUT_MASSINFO / FUT_USERINFO ladders keep every step of the bisect reproducible.
Contract suite 311 -> 358 checks. Tooling added: PyGhidra harness (Ghidra's
Java/OSGi script path is broken on this box), minidump reader, live code grabber.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUT92pz6RWKih9dSr8ZpxW
44 lines
1.9 KiB
Python
44 lines
1.9 KiB
Python
# Q7: build the definitive FUT script-API map: script name -> thunk -> service
|
|
# vtable slot, by parsing the 24-byte {?, fnptr, name} records the registrar
|
|
# FUN_18004a3a0 writes, then joining with the slot each thunk calls.
|
|
import re
|
|
out = open("/tmp/ghidra_fut/fut_api_map.txt", "w")
|
|
P = lambda *a: print(*a, file=out)
|
|
|
|
c = dec(0x18004a3a0, 300)
|
|
# records appear as: <lhs> = FUN_xxxxxxxxx; <lhs> = "Name";
|
|
pairs = re.findall(r'=\s*(FUN_[0-9a-f]+);\s*\n\s*\w+\s*=\s*"([^"]+)"', c)
|
|
P("=== registrar records: %d ===" % len(pairs))
|
|
|
|
SLOT = re.compile(r"\*\(code \*\*\)\(lVar\d+ \+ (0x[0-9a-f]+|\d+)\)")
|
|
rows = []
|
|
for fnname, script in pairs:
|
|
ent = int(fnname.replace("FUN_", ""), 16)
|
|
body = dec(ent, 60)
|
|
slots = sorted(set(int(s, 16) if s.startswith("0x") else int(s)
|
|
for s in SLOT.findall(body)))
|
|
nargs = len(re.findall(r"FUN_18019fb[45]0\(", body))
|
|
ret = "FUN_18019fc00(" in body or "FUN_18019fbf0(" in body
|
|
rows.append((slots[0] if slots else -1, script, ent, nargs, ret, body))
|
|
|
|
P("\n%-34s %-8s %-14s %s" % ("script name", "slot", "thunk", "args ret"))
|
|
for slot, script, ent, nargs, ret, _ in sorted(rows):
|
|
P("%-34s %-8s %#-14x %d %s" % (script, hex(slot) if slot >= 0 else "-", ent,
|
|
nargs, "Y" if ret else ""))
|
|
|
|
P("\n=== thunks with NO service call (pure local/query) ===")
|
|
for slot, script, ent, nargs, ret, body in sorted(rows):
|
|
if slot < 0:
|
|
P("--- %s @ %#x ---" % (script, ent))
|
|
P(body)
|
|
|
|
WANT = ("AddPlayer", "SaveCurrentSquad", "SaveSquad", "RemovePlayer",
|
|
"GetCurrentSquadID", "GetCurrentSquadData", "SetPlayer", "SwapPlayer")
|
|
P("\n=== decompiles of the placement/save path ===")
|
|
for slot, script, ent, nargs, ret, body in sorted(rows):
|
|
if any(w.lower() in script.lower() for w in WANT):
|
|
P("--- %s slot=%s @ %#x ---" % (script, hex(slot) if slot >= 0 else "-", ent))
|
|
P(body)
|
|
out.close()
|
|
print("wrote fut_api_map.txt; records:", len(pairs))
|