funman300
5d5198f5d1
Second session. FUT core loop, the EASFC/POW online layer, a central account
backend, and a lot of corrections. Everything risky is behind an env flag with
the default set to whatever was live-proven.
WORKING END TO END (live-verified this session):
* match loop -- POST/PUT/POST/DELETE ut/%s/match, rewards via FutDestroyMatch
(0x180121b60). Play a match, get coins, W/D/L updates.
* packs -- buy, cards land in the club, session survives (FUT_PACK_AUTOCLUB=1)
* quick sell -- POST ut/delete/%s/item was UNMAPPED and paid NOTHING; six cards
were destroyed for 0 coins. Now credits discardValue.
* POW/EASFC online -- the "EA FC servers unreachable" banner is powdll's layer,
a THIRD http api on :8094 nobody had served. Redirect needs no root: powdll
FUN_18005a460 reads FIFA_POW_URL from the same client-config store as
ROSTERUPDATE_URL. FUT_POW=1.
* account backend -- fut_account.py replaces 7 hardcoded copies of the persona
across 5 files; club/persona/online-profile editable via CLI.
CORRECTIONS TO ENDPOINT_MAP (all re-extracted from the deserializers):
* FutStoreGetPackTypes: id/packType/isPremium/quantity/saleType/purchaseLimit/
purchaseCount are NOT skipped no-ops -- all are parsed. extPrice inner objects
take externalPriceId(0x11a), not amount/currency.
* FutMoveCard 0x180128600 has NO skip handler (FUN_180135ff0 appears zero times,
unique among FUT deserializers) and parses only itemData -> dreamSquads.
* class -> deserializer resolution: the name literal is preceded by a 4-BYTE
HEADER and the factory LEA points at the header, so look up name_addr - 4.
Six attempts failed on this; now ghidra_env.class_deser(). Unlocked 11 SBC/
Draft schemas.
* live-only endpoints the request table never lists: ut/%s/squad/list,
ut/%s/user/club, ut/%s/club/stats/*, ut/%s/clientdata/<key>. The template
table is a floor, not a ceiling -- the log is the only ground truth.
* 163 RS4 call names exist; we served 17. All now served.
FIXED: club/stats/* was answering with the entire 28-item club inventory on every
poll (it fell through to the generic /club route).
UNSOLVED: the pack reveal's "Send to Club" (PUT ut/%s/item) kills the FUT session
whatever we answer -- {} included -- while its sibling quick-sell endpoint accepts
a bare {}. Seven hypotheses eliminated by live test, documented in
REBUILD_RESEARCH.md S14c so none get re-walked. FUT_PACK_AUTOCLUB routes around it.
Also unfixed: store tiles render "unknown" (displayGroup is parsed RECURSIVELY by
the same element parser; sending it FROZE the store, so FUT_STORE_GROUPS=1 is
default off).
Tests: test_fut_contract.py 380 (live, read-only) + test_match_rewards.py 51 (pure).
Note: fut_store.py carries some pre-existing uncommitted changes from before this
session (pack catalogue ids, pending-pile behaviour) that could not be separated
from this session's additions in the same file.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUT92pz6RWKih9dSr8ZpxW
37 lines
1.9 KiB
Bash
Executable File
37 lines
1.9 KiB
Bash
Executable File
#!/bin/sh
|
|
# OpenFUT FIFA 17 — arm the privileged host state (run via pkexec/sudo).
|
|
# Idempotent: safe to re-run. Volatile bits (sysctls, iptables) do NOT survive a
|
|
# reboot -> re-run after boot. /etc/hosts DOES persist.
|
|
set -e
|
|
|
|
# 1) allow /proc/PID/mem writes (autopatch's ProtoSSL cert-verify patch)
|
|
sysctl -q kernel.yama.ptrace_scope=0
|
|
# 2) allow routing DNAT'd traffic to loopback
|
|
sysctl -q net.ipv4.conf.lo.route_localnet=1
|
|
# 3) redirect FIFA17's Blaze dial (winter15 -> 159.153.51.20) to our TLS server :42127
|
|
iptables -t nat -C OUTPUT -p tcp -d 159.153.51.20 -j DNAT --to-destination 127.0.0.1:42127 2>/dev/null \
|
|
|| iptables -t nat -A OUTPUT -p tcp -d 159.153.51.20 -j DNAT --to-destination 127.0.0.1:42127
|
|
# 4) point FUT's dead hardcoded UTAS host (easw.easports.com:8099) at our utas_server
|
|
grep -q '[[:space:]]easw\.easports\.com\b' /etc/hosts 2>/dev/null \
|
|
|| printf '127.0.0.1\teasw.easports.com\n' >> /etc/hosts
|
|
# 5) POW/EASFC hosts -- ONLY with `root_arm.sh pow`. The preferred redirect is the
|
|
# FIFA_POW_URL client-config key (FUT_POW=1, no root needed); these /etc/hosts
|
|
# entries are the fallback for if the client ignores that key. Kept opt-in
|
|
# because they persist across reboots and silently change where FIFA's EASFC
|
|
# traffic goes. Remove with: root_arm.sh unpow
|
|
if [ "${1:-}" = "pow" ]; then
|
|
for h in pas.gt.easfc.ea.com content.lt.easfc.ea.com; do
|
|
grep -q "[[:space:]]$h\b" /etc/hosts 2>/dev/null \
|
|
|| printf '127.0.0.1\t%s\n' "$h" >> /etc/hosts
|
|
done
|
|
echo " POW hosts -> 127.0.0.1"
|
|
elif [ "${1:-}" = "unpow" ]; then
|
|
sed -i '/pas\.gt\.easfc\.ea\.com/d;/content\.lt\.easfc\.ea\.com/d' /etc/hosts
|
|
echo " POW hosts removed"
|
|
fi
|
|
|
|
echo "--- armed ---"
|
|
sysctl kernel.yama.ptrace_scope net.ipv4.conf.lo.route_localnet
|
|
iptables -t nat -L OUTPUT -n | grep -i '159.153.51.20' || echo " (DNAT missing!)"
|
|
grep 'easw.easports.com' /etc/hosts && echo " /etc/hosts ok" || echo " (/etc/hosts easw missing!)"
|