Add gated FIFA17 Offline Seasons PMA repair

Two client breakages in a row from detouring FUN_180033770 / sub_180033430 /
FUN_1800d73d0: the first cut froze FIFA at the "are both teams ready" prompt,
and the rate-limited rewrite CRASHED it at the same point. Rate limiting fixed
the I/O problem and the crash still happened, so the fault is the detours
themselves, not the logging.

Most likely cause: sub_180033430 is an address Ghidra never functionised, and at
least one of these is reached in a way a 14-byte inline patch cannot survive -
an interior branch target, or a callee taking stack arguments that the 4-register
wrapper silently drops when it tail-calls the original.

What the aborted runs did establish, and it is worth keeping:
  - KIT_SCAN fires for cardtype 7 with subtype 9 selector 2 AND selector 3, so
    BOTH the home and away club scans do run.
  - The FUT club enumerate (teamId 130000) did NOT occur in the crashed run
    before the kit screen, and KIT_DESC never fired at all.
  - KITS_AVAILABLE remains 0.
  - The "ret" value logged by kit_scan is the same constant for every call and
    is not a usable item pointer, so that reading was wrong.

Next attempt must NOT patch this code path. Read the state from outside the
process instead - /proc/PID/mem plus objdump against the live client, which
cannot crash the game because it never writes to it.

Cargo.lock

@@ -2293,6 +2293,7 @@ dependencies = [
  "eframe",
  "egui",
  "openfut-common",
+ "parking_lot",
  "serde",
  "serde_json",
  "tokio",

openfut-common/src/lib.rs

@@ -40,6 +40,21 @@ pub mod ea_ports {
     pub const FIFA17_BLAZE_REDIRECTOR: u16 = 42230;
     /// EA Blaze main server source port.
     pub const BLAZE_MAIN: u16 = 42127;
+    /// The roster / "FUT Squad Update" port.
+    ///
+    /// Unlike the others this number is OURS: the client only dials it because
+    /// our Blaze hands it `ROSTERUPDATE_URL = https://<roster-host>:8081/...`.
+    /// It is still a *signature* in exactly the same sense, because the IP the
+    /// client dials is whatever the roster hostname resolved to — in practice
+    /// EA's live `159.153.51.20` record — and we rewrite that to the configured
+    /// server while leaving the hostname (and therefore SNI) untouched.
+    ///
+    /// Keeping the hostname is the whole point: FIFA 17's ProtoSSL verifies the
+    /// roster certificate by **dNSName only**, so redirecting at the socket
+    /// preserves certificate validity in a way an IP-addressed URL cannot. This
+    /// is what removes the need for a client hosts entry, an NRPT rule, or an
+    /// external DNS responder.
+    pub const FIFA17_ROSTER: u16 = 8081;
 }
 
 /// Default OpenFUT *destination* ports, derived from the current OpenFUT server
@@ -53,6 +68,22 @@ pub mod default_ports {
     pub const BLAZE_REDIRECTOR: u16 = 42127;
     /// OpenFUT FIFA 17 Blaze main listener.
     pub const BLAZE_MAIN: u16 = 42130;
+    /// OpenFUT FUT web-file (CDN) content server. Unlike the others this is not
+    /// an EA redirect target: the client never dials it directly, because its
+    /// `RS4::ServerSettings` CDN base arrives EMPTY in the emulator. The hook
+    /// supplies the missing `<base>/fut/` prefix, and the base is built from the
+    /// configured server host plus this port.
+    ///
+    /// 8085 is the POW content server (`pow_server.py`, kind "content"), which is
+    /// the port Blaze already advertises to the client as its content host and
+    /// which serves `/fut/packs/loc/storepackdescriptions.en_us.xml`. Verified
+    /// live: that path returns 200 with a 180-byte XLIFF document.
+    pub const FUT_CONTENT: u16 = 8085;
+    /// OpenFUT roster / "FUT Squad Update" listener. Same number as the
+    /// [`ea_ports::FIFA17_ROSTER`] signature because we advertise that port
+    /// ourselves; it is a separate constant so a deployment can move the roster
+    /// service without changing what the client dials.
+    pub const ROSTER: u16 = 8081;
 }
 
 /// OpenFUT destination ports. Each field is where an intercepted EA source port
@@ -66,6 +97,11 @@ pub struct OpenFutPorts {
     pub blaze_redirector: u16,
     /// Destination for EA :42127 traffic (Blaze main).
     pub blaze_main: u16,
+    /// FUT web-file content server. Not a redirect destination — see
+    /// [`default_ports::FUT_CONTENT`].
+    pub fut_content: u16,
+    /// Destination for roster traffic ([`ea_ports::FIFA17_ROSTER`]).
+    pub roster: u16,
 }
 
 impl Default for OpenFutPorts {
@@ -74,6 +110,8 @@ impl Default for OpenFutPorts {
             https: default_ports::HTTPS,
             blaze_redirector: default_ports::BLAZE_REDIRECTOR,
             blaze_main: default_ports::BLAZE_MAIN,
+            fut_content: default_ports::FUT_CONTENT,
+            roster: default_ports::ROSTER,
         }
     }
 }
@@ -89,6 +127,7 @@ impl OpenFutPorts {
                 Some(self.blaze_redirector)
             }
             ea_ports::BLAZE_MAIN => Some(self.blaze_main),
+            ea_ports::FIFA17_ROSTER => Some(self.roster),
             _ => None,
         }
     }
@@ -115,6 +154,41 @@ pub struct ResolvedServer {
     pub ports: OpenFutPorts,
 }
 
+/// Where one matched EA connection is rewritten to, in the exact WinSock
+/// on-the-wire representation the socket hooks need. Produced by
+/// [`ResolvedServer::redirect_for_ea_port`] so the hook and the launcher's
+/// `openfut.cfg` share one decision by construction.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Redirect {
+    /// Rewritten IPv4 for `sockaddr_in.sin_addr` (network byte order in memory).
+    pub addr_nbo: u32,
+    /// Rewritten port for `sin_port` / `sin6_port` (network byte order).
+    pub port_nbo: u16,
+    /// The resolved server IPv4, for callers building an IPv6 v4-mapped address.
+    pub redirect_ip: Ipv4Addr,
+}
+
+impl ResolvedServer {
+    /// Decide the redirect for an outbound EA connection whose destination port
+    /// is `ea_port_nbo` (network byte order, as read straight from the sockaddr).
+    ///
+    /// Returns `None` when the port is not a recognised OpenFUT route — the hook
+    /// then leaves the connection untouched. The original destination IP is
+    /// intentionally ignored: matching is by the fixed EA source-port signature
+    /// ([`ea_ports`]), so a hardcoded EA IP (e.g. FIFA17's `159.153.51.20`
+    /// redirector) and a DNS-resolved one are treated identically and both land
+    /// on the configured server — no `/etc/hosts`, DNAT, or portproxy required.
+    pub fn redirect_for_ea_port(&self, ea_port_nbo: u16) -> Option<Redirect> {
+        let ea_port = u16::from_be(ea_port_nbo);
+        let dest_port = self.ports.map_source_port(ea_port)?;
+        Some(Redirect {
+            addr_nbo: sin_addr_from_ipv4(self.redirect_ip),
+            port_nbo: sin_port_nbo(dest_port),
+            redirect_ip: self.redirect_ip,
+        })
+    }
+}
+
 /// Errors loading/validating OpenFUT server configuration. Every one of these
 /// must BLOCK operation — none of them may fall back to loopback.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -209,6 +283,8 @@ impl ServerConfig {
                 "https_port" => ports.https = parse_port(value)?,
                 "blaze_redirector_port" => ports.blaze_redirector = parse_port(value)?,
                 "blaze_main_port" => ports.blaze_main = parse_port(value)?,
+                "fut_content_port" => ports.fut_content = parse_port(value)?,
+                "roster_port" => ports.roster = parse_port(value)?,
                 other => {
                     return Err(ConfigError::MalformedConfig(format!(
                         "line {}: unknown key '{other}'",
@@ -223,10 +299,40 @@ impl ServerConfig {
     }
 
     /// Serialize to the structured `openfut.cfg` format.
+    ///
+    /// `roster_port` is emitted ONLY when it differs from the default. The
+    /// parser rejects unknown keys, so a config written by a newer launcher and
+    /// read by an older hook would fail to parse and install NO redirect at all
+    /// — breaking the game rather than degrading. Withholding the default keeps
+    /// the common case byte-identical to what every deployed hook already
+    /// accepts, while still round-tripping a deliberately changed port.
     pub fn to_cfg_string(&self) -> String {
+        let mut out = format!(
+            "host={}\nhttps_port={}\nblaze_redirector_port={}\nblaze_main_port={}\nfut_content_port={}\n",
+            self.host,
+            self.ports.https,
+            self.ports.blaze_redirector,
+            self.ports.blaze_main,
+            self.ports.fut_content
+        );
+        if self.ports.roster != default_ports::ROSTER {
+            out.push_str(&format!("roster_port={}\n", self.ports.roster));
+        }
+        out
+    }
+
+    /// Base URL the FUT web-file (CDN) prefix is built from, e.g.
+    /// `http://10.10.0.120:8085/fut/`.
+    ///
+    /// The client's `RS4::ServerSettings` CDN base arrives EMPTY in the emulator,
+    /// so FUT web-file urls reach the download entry point as bare relative paths
+    /// and fail. The hook supplies this prefix. Built from the SAME configured
+    /// host as every other redirect, so a lab address is never compiled in.
+    pub fn fut_content_base(&self) -> String {
         format!(
-            "host={}\nhttps_port={}\nblaze_redirector_port={}\nblaze_main_port={}\n",
-            self.host, self.ports.https, self.ports.blaze_redirector, self.ports.blaze_main
+            "http://{}:{}/fut/",
+            self.host.trim(),
+            self.ports.fut_content
         )
     }
 
@@ -414,12 +520,37 @@ mod tests {
                 https: 8443,
                 blaze_redirector: 10041,
                 blaze_main: 42127,
+                fut_content: 8085,
+                roster: default_ports::ROSTER,
             },
         };
         let s = c.to_cfg_string();
         assert_eq!(ServerConfig::parse(&s).unwrap(), c);
     }
 
+    /// The FUT web-file prefix follows the CONFIGURED server, so no lab address
+    /// is ever compiled into the hook.
+    #[test]
+    fn fut_content_base_follows_the_configured_host() {
+        let c = ServerConfig::parse("host=192.168.1.50\n").unwrap();
+        assert_eq!(c.fut_content_base(), "http://192.168.1.50:8085/fut/");
+
+        let c = ServerConfig::parse("host=fut.mylan.home\nfut_content_port=9110\n").unwrap();
+        assert_eq!(c.fut_content_base(), "http://fut.mylan.home:9110/fut/");
+    }
+
+    /// A cfg written before `fut_content_port` existed must still parse, taking
+    /// the default rather than failing the whole config (which would disarm the
+    /// network redirect too).
+    #[test]
+    fn cfg_without_content_port_takes_the_default() {
+        let c = ServerConfig::parse(
+            "host=10.0.0.5\nhttps_port=8443\nblaze_redirector_port=42127\nblaze_main_port=42130\n",
+        )
+        .unwrap();
+        assert_eq!(c.ports.fut_content, default_ports::FUT_CONTENT);
+    }
+
     #[test]
     fn configured_ipv4_becomes_correct_sockaddr() {
         // Resolve an IPv4 literal and confirm the sin_addr value.
@@ -461,6 +592,46 @@ mod tests {
         assert_eq!(p.map_source_port(12345), None);
     }
 
+    /// The roster dial is the whole point of the FIFA17_ROSTER signature: the
+    /// client resolves `winter15.gosredirector.ea.com` to EA's live record and
+    /// dials THAT ip on 8081, so the socket layer is the only place we can send
+    /// it to ourselves without touching the client's DNS.
+    #[test]
+    fn roster_port_is_redirected_to_the_configured_server() {
+        let server = ServerConfig::parse("host=10.10.0.120\n")
+            .unwrap()
+            .resolve()
+            .unwrap();
+        let redirect = server
+            .redirect_for_ea_port(sin_port_nbo(ea_ports::FIFA17_ROSTER))
+            .expect("roster dial must be recognised");
+        assert_eq!(redirect.redirect_ip, Ipv4Addr::new(10, 10, 0, 120));
+        // Port is preserved: we advertise 8081 and serve 8081.
+        assert_eq!(redirect.port_nbo, sin_port_nbo(8081));
+    }
+
+    #[test]
+    fn roster_destination_port_is_configurable() {
+        let c = ServerConfig::parse("host=10.10.0.120\nroster_port=9443\n").unwrap();
+        assert_eq!(c.ports.roster, 9443);
+        assert_eq!(c.ports.map_source_port(ea_ports::FIFA17_ROSTER), Some(9443));
+    }
+
+    /// A default roster port must NOT appear in the written config: the parser
+    /// rejects unknown keys, so emitting it unconditionally would make every
+    /// already-deployed hook reject the whole file and install no redirect.
+    #[test]
+    fn default_roster_port_is_not_emitted_but_a_custom_one_round_trips() {
+        let default_cfg = ServerConfig::parse("host=10.10.0.120\n").unwrap();
+        assert!(!default_cfg.to_cfg_string().contains("roster_port"));
+
+        let mut custom = default_cfg.clone();
+        custom.ports.roster = 9443;
+        let reparsed = ServerConfig::parse(&custom.to_cfg_string()).unwrap();
+        assert_eq!(reparsed.ports.roster, 9443);
+        assert_eq!(reparsed, custom);
+    }
+
     #[test]
     fn resolve_literal_ipv4_no_dns() {
         let c = ServerConfig::parse("host=127.0.0.1\n").unwrap();
@@ -476,4 +647,58 @@ mod tests {
         };
         assert_eq!(c.resolve().unwrap_err(), ConfigError::ServerMissing);
     }
+
+    #[test]
+    fn redirect_maps_every_fifa17_route_to_configured_server() {
+        // The canonical staging cfg. Ports come from the file, not constants.
+        let resolved = ServerConfig::parse(
+            "host=10.10.0.120\nhttps_port=8443\nblaze_redirector_port=42127\nblaze_main_port=42130\n",
+        )
+        .unwrap()
+        .resolve()
+        .unwrap();
+        let server = Ipv4Addr::new(10, 10, 0, 120);
+        // (EA source port [host order], expected OpenFUT dest port)
+        for (ea, dest) in [
+            (443u16, 8443u16),
+            (10041, 42127),
+            (42230, 42127),
+            (42127, 42130),
+        ] {
+            let r = resolved
+                .redirect_for_ea_port(ea.to_be())
+                .unwrap_or_else(|| panic!("EA port {ea} should be a route"));
+            assert_eq!(u16::from_be(r.port_nbo), dest, "EA {ea} -> dest");
+            assert_eq!(r.redirect_ip, server, "EA {ea} -> server ip");
+            assert_eq!(
+                r.addr_nbo,
+                sin_addr_from_ipv4(server),
+                "EA {ea} -> sin_addr"
+            );
+        }
+    }
+
+    #[test]
+    fn redirect_leaves_unknown_ports_untouched() {
+        let resolved = ServerConfig::parse("host=10.10.0.120\n")
+            .unwrap()
+            .resolve()
+            .unwrap();
+        assert!(resolved.redirect_for_ea_port(8080u16.to_be()).is_none());
+        assert!(resolved.redirect_for_ea_port(22u16.to_be()).is_none());
+        assert!(resolved.redirect_for_ea_port(443u16.to_be()).is_some());
+    }
+
+    #[test]
+    fn redirect_targets_configured_remote_host_not_loopback() {
+        let resolved = ServerConfig::parse("host=10.10.0.120\n")
+            .unwrap()
+            .resolve()
+            .unwrap();
+        // FIFA17 redirector (hardcoded EA IP 159.153.51.20:42230) must be rewritten
+        // to the configured REMOTE server, never 127.0.0.1.
+        let r = resolved.redirect_for_ea_port(42230u16.to_be()).unwrap();
+        assert_eq!(r.redirect_ip, Ipv4Addr::new(10, 10, 0, 120));
+        assert_ne!(r.redirect_ip, Ipv4Addr::LOCALHOST);
+    }
 }

openfut-hook/Cargo.lock

@@ -2,10 +2,15 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "openfut-common"
+version = "0.1.0"
+
 [[package]]
 name = "openfut-hook"
 version = "0.1.0"
 dependencies = [
+ "openfut-common",
  "windows-sys",
 ]
 

openfut-hook/Cargo.toml

@@ -13,17 +13,10 @@ edition = "2021"
 crate-type = ["cdylib"]
 
 [features]
-# Build with `--features capture_baseline` to DISABLE the LSX 3216→3217 redirect,
-# so FIFA's LSX goes to anadius's in-process server (for capturing anadius's real
-# responses). Default build keeps the redirect (LSX → our bridge).
-capture_baseline = []
-# Build with `--features probe` to install passive logging detours on FIFA's
-# in-process online-flow functions (GoOnline, GetInternetConnectedState, event
-# deserializers). Writes PROBE lines to C:\openfut_hook.log for RE. See probe.rs.
-probe = []
-# Build with `--features fifa17` for the FIFA 17 injection path. DllMain runs ONLY
-# the minimal FIFA-17-safe logic in fifa17.rs (prove injection, dump module map,
-# patch DirtySDK/ProtoSSL cert-verify) and skips ALL the FIFA-23-specific hooking.
+# Per-game selection: each supported game is a feature enabling its module. Exactly
+# one MUST be set (the crate emits a compile_error otherwise). Build the deployed
+# artifact with `--features fifa17`. Add a future game as a new feature here plus a
+# `mod <game>;` + dispatch arm in lib.rs — never by copying a retired game's code.
 fifa17 = []
 
 [dependencies]
@@ -39,6 +32,10 @@ windows-sys = { version = "0.59", features = [
     "Win32_System_Diagnostics_Debug",
     "Win32_System_Kernel",
 ] }
+# Single source of truth for the OpenFUT redirect config (openfut.cfg schema,
+# EA-port -> OpenFUT-port map, WinSock byte-order helpers). Shared with the
+# launcher so the hook and openfut.cfg agree by construction.
+openfut-common = { path = "../openfut-common" }
 
 [profile.release]
 opt-level = "s"

openfut-hook/build.rs

@@ -12,6 +12,6 @@ fn main() {
     {
         let definition =
             PathBuf::from(env::var_os("CARGO_MANIFEST_DIR").unwrap()).join("version.def");
-        println!("cargo:rustc-link-arg={}", definition.display());
+        println!("cargo:rustc-cdylib-link-arg={}", definition.display());
     }
 }

openfut-hook/src/config.rs

@@ -1,32 +0,0 @@
-/// Reads openfut.cfg from the same directory as this DLL.
-///
-/// The file contains a single line: the IP the hook should redirect EA
-/// hostnames to, e.g. "192.168.1.10" or "127.0.0.1".
-/// Falls back to 127.0.0.1 if the file is missing or unreadable.
-use windows_sys::Win32::System::LibraryLoader::GetModuleFileNameA;
-
-pub fn read_redirect_ip(module: windows_sys::Win32::Foundation::HMODULE) -> String {
-    if let Some(cfg_path) = config_path(module) {
-        if let Ok(content) = std::fs::read_to_string(&cfg_path) {
-            let ip = content.trim().to_string();
-            if !ip.is_empty() {
-                return ip;
-            }
-        }
-    }
-    "127.0.0.1".to_string()
-}
-
-fn config_path(module: windows_sys::Win32::Foundation::HMODULE) -> Option<std::path::PathBuf> {
-    let mut buf = vec![0u8; 512];
-    let len = unsafe { GetModuleFileNameA(module, buf.as_mut_ptr(), buf.len() as u32) };
-    if len == 0 {
-        return None;
-    }
-    let path = std::ffi::CStr::from_bytes_until_nul(&buf[..len as usize + 1])
-        .ok()?
-        .to_str()
-        .ok()?;
-    let dll_path = std::path::Path::new(path);
-    Some(dll_path.parent()?.join("openfut.cfg"))
-}

openfut-hook/src/connect_hook.rs

@@ -5,20 +5,6 @@ use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::OnceLock;
 
 const AF_INET: u16 = 2;
-const PORT_HTTPS_NBO: u16 = 0xBB01; // 443   big-endian
-const PORT_BRIDGE_NBO: u16 = 0xFB20; // 8443  big-endian
-const PORT_BLAZE_REDIRECTOR_NBO: u16 = 0x3927; // 10041 big-endian
-const PORT_BLAZE_MAIN_NBO: u16 = 0x8FA4; // 42127 big-endian
-                                         // EA App LSX. anadius handles :3216 in-process before it reaches the host TCP
-                                         // stack (keyed on port 3216 specifically), so redirecting FIFA's LSX connect to a
-                                         // *different* host port (:3217) slips past that interception and lands on the
-                                         // native openfut-bridge LSX server. This is the load-bearing redirect that routes
-                                         // LSX to our bridge; without it FIFA uses anadius's in-process emu instead.
-#[allow(dead_code)] // unused when built with the `capture_baseline` feature
-const PORT_LSX_NBO: u16 = 0x900C; // 3216  big-endian (EA App LSX)
-#[allow(dead_code)]
-const PORT_LSX_TARGET_NBO: u16 = 0x910C; // 3217  big-endian (bridge LSX target)
-const ADDR_LOOPBACK_NBO: u32 = 0x0100_007F; // 127.0.0.1 big-endian
 
 #[repr(C)]
 struct SockaddrIn {
@@ -41,19 +27,37 @@ struct SockaddrIn6 {
     sin6_scope_id: u32,
 }
 
-/// IPv4-mapped IPv6 loopback: `::ffff:127.0.0.1`. An `AF_INET6` socket connecting to
-/// this sends real IPv4 packets to 127.0.0.1, so the connection lands on the bridge's
-/// existing IPv4 listener on :8443 — no separate IPv6 listener needed. The game's own
-/// EA dials already use v4-mapped addresses (`::ffff:x.x.x.x`), so its sockets are not
-/// `IPV6_V6ONLY` and will accept this target.
-const V4MAPPED_LOOPBACK: [u8; 16] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff, 127, 0, 0, 1];
-
 // Address of ws2_32!connect (set at hook installation)
 static CONNECT_ADDR: AtomicUsize = AtomicUsize::new(0);
 
 // Original 14 bytes saved before we overwrite them
 static mut ORIGINAL_BYTES: [u8; 14] = [0u8; 14];
 
+/// Restores the real WinSock call's thread-local last error after detour repair,
+/// logging, and other instrumentation have run. Callers inspect this value after
+/// `SOCKET_ERROR`; leaking a logger/VirtualProtect error changes connect semantics.
+struct WsaLastErrorGuard(i32);
+
+impl WsaLastErrorGuard {
+    unsafe fn capture() -> Self {
+        use windows_sys::Win32::Networking::WinSock::WSAGetLastError;
+        Self(WSAGetLastError())
+    }
+
+    fn value(&self) -> i32 {
+        self.0
+    }
+}
+
+impl Drop for WsaLastErrorGuard {
+    fn drop(&mut self) {
+        unsafe {
+            use windows_sys::Win32::Networking::WinSock::WSASetLastError;
+            WSASetLastError(self.0);
+        }
+    }
+}
+
 // For WSAConnect IAT fallback
 type WsaConnectFn = unsafe extern "system" fn(
     s: usize,
@@ -89,82 +93,82 @@ unsafe fn restore_original(target: *mut u8) {
     VirtualProtect(target as _, 14, old, &mut old);
 }
 
-/// If `name` is an EA-relevant connect target, return a rewritten sockaddr pointing at
-/// the local bridge (plus its byte length). Handles BOTH `AF_INET` and `AF_INET6`: the
-/// game's Blaze/DirtySDK stack dials EA over IPv6 (v4-mapped) on :443, and the old
-/// IPv4-only path let those slip straight past us to the real (dead) servers.
-///
-/// The returned buffer is 28 bytes (enough for a `sockaddr_in6`); the second value is
-/// how many of those bytes are meaningful (16 for v4, 28 for v6). `pub(crate)` so the
-/// ConnectEx path can share this one implementation.
+/// The armed redirect target, resolved once from `openfut.cfg` via `openfut-common`.
+/// When set, `redirect_if_ea` rewrites matched EA connections to this configured
+/// server; when unset, matched connections are left untouched (no redirect).
+static REDIRECT: OnceLock<openfut_common::ResolvedServer> = OnceLock::new();
+
+/// Arm the config-driven redirect (FIFA17). Idempotent: the first call wins.
+pub fn set_redirect(server: openfut_common::ResolvedServer) {
+    let _ = REDIRECT.set(server);
+}
+
+/// If `name` is a matched EA connect target, return a rewritten sockaddr pointing
+/// at the configured OpenFUT server (plus its meaningful byte length: 16 for v4,
+/// 28 for v6). The target is armed once from `openfut.cfg` via `set_redirect`;
+/// when unset — or when the port is not a known EA route — the connection is left
+/// untouched. Shared by the connect / WSAConnect / ConnectEx detours.
 pub(crate) unsafe fn redirect_if_ea(name: *const u8, namelen: i32) -> Option<([u8; 28], i32)> {
     if namelen < 8 || name.is_null() {
         return None;
     }
-    // The first u16 of any sockaddr is the address family.
+    redirect_configured(REDIRECT.get()?, name, namelen)
+}
+
+/// FIFA17 config-driven rewrite. Destination host+port come from `openfut.cfg`
+/// through `openfut-common`, so the hook and the launcher agree by construction.
+/// Matching is by EA source-port signature only (see `openfut_common::ea_ports`),
+/// so a hardcoded EA IP (e.g. the `159.153.51.20:42230` redirector) and a
+/// DNS-resolved one both land on the configured — possibly remote — server. An
+/// unrecognised port returns `None` (connection left untouched). Never corrupts
+/// the sockaddr: it only writes into a fresh 28-byte buffer.
+unsafe fn redirect_configured(
+    server: &openfut_common::ResolvedServer,
+    name: *const u8,
+    namelen: i32,
+) -> Option<([u8; 28], i32)> {
     let family = *(name as *const u16);
     let mut buf = [0u8; 28];
-
     match family {
         AF_INET => {
-            // SAFE: family is AF_INET and namelen >= 8 == the sockaddr_in fields we read.
             let sa = &*(name as *const SockaddrIn);
-            let new_port_nbo = match sa.sin_port {
-                PORT_HTTPS_NBO => PORT_BRIDGE_NBO,
-                #[cfg(not(feature = "capture_baseline"))]
-                PORT_LSX_NBO => PORT_LSX_TARGET_NBO,
-                PORT_BLAZE_REDIRECTOR_NBO => PORT_BLAZE_REDIRECTOR_NBO,
-                PORT_BLAZE_MAIN_NBO => PORT_BLAZE_MAIN_NBO,
-                _ => return None,
-            };
-            // sin_addr is network order; to_le_bytes gives memory order = the dotted
-            // quad, so b[0].b[1].b[2].b[3] is correct (the old code printed it reversed).
-            let o = sa.sin_addr.to_le_bytes();
+            let redir = server.redirect_for_ea_port(sa.sin_port)?;
             crate::write_log(&format!(
-                "connect_hook: v4 {}.{}.{}.{}:{} → 127.0.0.1:{}\n",
-                o[0],
-                o[1],
-                o[2],
-                o[3],
+                "connect_hook: v4 :{} → {}:{}\n",
                 u16::from_be(sa.sin_port),
-                u16::from_be(new_port_nbo)
+                redir.redirect_ip,
+                u16::from_be(redir.port_nbo)
             ));
-            // SAFE: buf is 28 bytes, larger than the 16-byte sockaddr_in we write.
             let out = &mut *(buf.as_mut_ptr() as *mut SockaddrIn);
             out.sin_family = AF_INET;
-            out.sin_port = new_port_nbo;
-            out.sin_addr = ADDR_LOOPBACK_NBO;
+            out.sin_port = redir.port_nbo;
+            out.sin_addr = redir.addr_nbo;
             Some((buf, 16))
         }
         AF_INET6 => {
             if namelen < 28 {
                 return None;
             }
-            // SAFE: family is AF_INET6 and namelen >= 28 == sizeof(sockaddr_in6).
             let sa6 = &*(name as *const SockaddrIn6);
-            // LSX is IPv4-only (anadius keys on it), so it is intentionally omitted here.
-            let new_port_nbo = match sa6.sin6_port {
-                PORT_HTTPS_NBO => PORT_BRIDGE_NBO,
-                PORT_BLAZE_REDIRECTOR_NBO => PORT_BLAZE_REDIRECTOR_NBO,
-                PORT_BLAZE_MAIN_NBO => PORT_BLAZE_MAIN_NBO,
-                _ => return None,
-            };
-            let a = sa6.sin6_addr;
+            let redir = server.redirect_for_ea_port(sa6.sin6_port)?;
+            // ::ffff:<redirect_ip> — a v4-mapped v6 target so a v6 socket sends
+            // real IPv4 packets to the configured server.
+            let o = redir.redirect_ip.octets();
+            let mut v4mapped = [0u8; 16];
+            v4mapped[10] = 0xff;
+            v4mapped[11] = 0xff;
+            v4mapped[12..16].copy_from_slice(&o);
             crate::write_log(&format!(
-                "connect_hook: v6 [{:02x}{:02x}:..:{:02x}{:02x}]:{} → ::ffff:127.0.0.1:{}\n",
-                a[0],
-                a[1],
-                a[14],
-                a[15],
+                "connect_hook: v6 :{} → ::ffff:{}:{}\n",
                 u16::from_be(sa6.sin6_port),
-                u16::from_be(new_port_nbo)
+                redir.redirect_ip,
+                u16::from_be(redir.port_nbo)
             ));
-            // SAFE: buf is exactly 28 bytes == sizeof(sockaddr_in6).
             let out = &mut *(buf.as_mut_ptr() as *mut SockaddrIn6);
             out.sin6_family = AF_INET6;
-            out.sin6_port = new_port_nbo;
+            out.sin6_port = redir.port_nbo;
             out.sin6_flowinfo = 0;
-            out.sin6_addr = V4MAPPED_LOOPBACK;
+            out.sin6_addr = v4mapped;
             out.sin6_scope_id = 0;
             Some((buf, 28))
         }
@@ -175,9 +179,6 @@ pub(crate) unsafe fn redirect_if_ea(name: *const u8, namelen: i32) -> Option<([u
 pub unsafe extern "system" fn hooked_connect(s: usize, name: *const u8, namelen: i32) -> i32 {
     let addr = CONNECT_ADDR.load(Ordering::Relaxed) as *mut u8;
 
-    // Milestone-0 transport watch (self-gates on OPENFUT_TRANSPORT_WATCH).
-    crate::transport_watch::note_connect("connect", name, namelen, s);
-
     // Log every call so we can confirm the hook fires at all
     if namelen >= 8 {
         let sa = &*(name as *const SockaddrIn);
@@ -215,6 +216,8 @@ pub unsafe extern "system" fn hooked_connect(s: usize, name: *const u8, namelen:
                 core::mem::transmute(addr);
             f(s, buf.as_ptr(), len)
         };
+        // Named binding held until `return r`: its Drop restores the WSA error after `write_hook`.
+        let _last_error = WsaLastErrorGuard::capture();
         write_hook(addr, hooked_connect as *const () as u64);
         return r;
     } else {
@@ -226,17 +229,15 @@ pub unsafe extern "system" fn hooked_connect(s: usize, name: *const u8, namelen:
         let f: unsafe extern "system" fn(usize, *const u8, i32) -> i32 = core::mem::transmute(addr);
         f(s, call_name, call_len)
     };
+    let last_error = WsaLastErrorGuard::capture();
     write_hook(addr, hooked_connect as *const () as u64);
     if namelen >= 8 {
         let sa = &*(call_name as *const SockaddrIn);
         if sa.sin_family == AF_INET {
-            let err = if r != 0 {
-                use windows_sys::Win32::Networking::WinSock::WSAGetLastError;
-                WSAGetLastError()
-            } else {
-                0
-            };
-            crate::write_log(&format!("connect_hook: result={r} wsa_err={err}\n"));
+            let logged_error = if r != 0 { last_error.value() } else { 0 };
+            crate::write_log(&format!(
+                "connect_hook: result={r} wsa_err={logged_error}\n"
+            ));
         }
     }
     r
@@ -251,8 +252,6 @@ pub unsafe extern "system" fn hooked_wsa_connect(
     sqos: *const (),
     gqos: *const (),
 ) -> i32 {
-    // Milestone-0 transport watch (self-gates on OPENFUT_TRANSPORT_WATCH).
-    crate::transport_watch::note_connect("WSAConnect", name, namelen, s);
     let real = REAL_WSA.get().copied().unwrap();
     if let Some((buf, len)) = redirect_if_ea(name, namelen) {
         real(s, buf.as_ptr(), len, caller, callee, sqos, gqos)
@@ -286,3 +285,24 @@ pub unsafe fn install_inline_connect_hook() -> bool {
     write_hook(connect_fn, hooked_connect as *const () as u64);
     true
 }
+
+#[cfg(test)]
+mod tests {
+    use super::WsaLastErrorGuard;
+    use windows_sys::Win32::Networking::WinSock::{
+        WSAGetLastError, WSASetLastError, WSAEWOULDBLOCK,
+    };
+
+    #[test]
+    fn restores_winsock_last_error_after_instrumentation() {
+        unsafe {
+            WSASetLastError(WSAEWOULDBLOCK);
+            {
+                let guard = WsaLastErrorGuard::capture();
+                assert_eq!(guard.value(), WSAEWOULDBLOCK);
+                WSASetLastError(0);
+            }
+            assert_eq!(WSAGetLastError(), WSAEWOULDBLOCK);
+        }
+    }
+}

openfut-hook/src/connectex_hook.rs

@@ -77,10 +77,6 @@ unsafe extern "system" fn hooked_connectex(
     overlapped: *mut c_void,
 ) -> i32 {
     let real_fn: ConnectExFn = core::mem::transmute(REAL_CONNECTEX.load(Ordering::Relaxed));
-
-    // Milestone-0 transport watch (self-gates on OPENFUT_TRANSPORT_WATCH).
-    crate::transport_watch::note_connect("ConnectEx", name, namelen, s);
-
     // Share the one redirect implementation (v4 + v6) with connect_hook, so ConnectEx
     // dials get the same IPv6 handling as plain connect().
     if let Some((buf, len)) = crate::connect_hook::redirect_if_ea(name, namelen) {

openfut-hook/src/dial_notification.rs

@@ -1,183 +0,0 @@
-//! Synthetic "notification" struct for the direct-call dial trigger.
-//!
-//! STATIC ARTIFACT ONLY — this module builds the byte layout the dial handler
-//! (FIFA23.exe+0x4f4d360) expects in its `rdx` argument, plus a do-nothing
-//! completion callback. It does NOT call the game, does NOT install any detour,
-//! and is NOT wired into the hook yet. The invocation phase (later) consumes
-//! `build_notification()` + `completion_stub`.
-//!
-//! Layout contract (from the 2026-07-03 dial-branch RE report on 0x144f4d590):
-//!   [+0x00]  byte   : entry gate — MUST be non-zero (else the error path fires). => 1
-//!   [+0x80]  qword  : completion delegate fn pointer. => &completion_stub
-//!   [+0x88]  qword  : delegate capture #1. => 0
-//!   [+0x90]  qword  : delegate capture #2. => 0
-//!   [+0xa0]  dword  : RpcJob key/priority (copied, never compared on dial path). => 0
-//!   everything else in [0x00..0x100] : 0
-//! The RE confirmed no other offset in this range is read on the success path.
-//! Total size 0x100 (256): the tail 0xa4..0x100 is zero padding — cheap insurance
-//! against a read we might have missed. Any offset here is TODO/CONFIRM against the
-//! RE report; if the game contradicts it at runtime, stop and re-verify.
-
-// This module is deliberately unused for now (the invocation phase will call into
-// it). Silence "never used" warnings until then rather than sprinkle #[allow] on
-// each item. Remove this once the trigger wires the API up.
-#![allow(dead_code)]
-
-use core::sync::atomic::{AtomicU32, Ordering};
-
-/// Size of the notification struct, in bytes. 0x100 = 256.
-const NOTIFICATION_SIZE: usize = 0x100;
-
-// --- field offsets (named so the code reads like the RE contract) -------------
-const OFF_GATE: usize = 0x00; // byte, must be non-zero
-const OFF_DELEGATE_FN: usize = 0x80; // qword, completion fn pointer
-const OFF_DELEGATE_CAP1: usize = 0x88; // qword, capture (0)
-const OFF_DELEGATE_CAP2: usize = 0x90; // qword, capture (0)
-const OFF_KEY: usize = 0xa0; // dword, job key/priority (0)
-
-/// Counts how many times `completion_stub` has been entered.
-///
-/// Why `AtomicU32` and not `static mut u32`: a `static mut` needs `unsafe` to
-/// touch and, worse, gives *undefined behaviour* if two threads write it at once
-/// (a data race). The completion callback may be invoked from an arbitrary game
-/// thread, so a plain counter would race. `AtomicU32` makes increment a single
-/// lock-free hardware instruction with well-defined concurrent semantics, and it
-/// needs no `unsafe`. `Ordering::Relaxed` is enough here: we only care about the
-/// count value, not about ordering it against other memory.
-static COMPLETION_STUB_CALLS: AtomicU32 = AtomicU32::new(0);
-
-/// The completion callback the game may invoke when the RpcJob finishes.
-///
-/// `extern "C"`: on the `x86_64-pc-windows-gnu` target this selects the Microsoft
-/// x64 calling convention — exactly how the game invokes the pointer (`call r10`,
-/// args in rcx/rdx/r8/r9, return in rax, caller cleans the stack). Matching the
-/// convention is what makes it safe for the game to call us.
-///
-/// We declare four pointer-sized params and ignore them. The RE showed the delegate
-/// is called with e.g. an HRESULT in `rdx` and a `this`-like pointer in `rcx`; the
-/// success-path completion may pass different values. Because Win64 is caller-clean
-/// and puts the first four integer args in registers, declaring four ignored args is
-/// safe no matter what the caller actually passes — we simply never read them.
-///
-/// The body does the absolute minimum: bump the atomic counter and return 0. NO
-/// logging, NO allocation, NO calls — a completion callback can fire from any game
-/// context, and even a log write there could be unsafe. Observe from outside via
-/// `completion_stub_call_count()` instead.
-///
-/// Returns `usize` = 0, which reads as an `S_OK`-shaped HRESULT if the caller looks
-/// at the return value. (Returning void would be equally fine; 0 is a safe default.)
-pub extern "C" fn completion_stub(_a: usize, _b: usize, _c: usize, _d: usize) -> usize {
-    // `fetch_add` is a single atomic read-modify-write (lock xadd) — no lock, no
-    // syscall, no allocation. Safe to call from any thread/context.
-    COMPLETION_STUB_CALLS.fetch_add(1, Ordering::Relaxed);
-    0
-}
-
-/// Read how many times `completion_stub` has fired. For an outside observer thread —
-/// keeps all I/O out of the stub itself.
-pub fn completion_stub_call_count() -> u32 {
-    COMPLETION_STUB_CALLS.load(Ordering::Relaxed)
-}
-
-/// Write a little-endian u64 into `buf` starting at `offset`.
-///
-/// Endianness matters because we're hand-laying a memory image the game will read
-/// back as a raw pointer/integer. x86-64 is *little-endian*: the least-significant
-/// byte sits at the lowest address. `value.to_le_bytes()` produces the 8 bytes in
-/// exactly that order, so when the game does `mov rax,[ptr]` it reconstructs the
-/// original `value`. Using the native byte order by hand (or `transmute`) would be
-/// wrong on a big-endian machine; `to_le_bytes` states the intent explicitly.
-///
-/// `buf[offset..offset + 8]` is an 8-byte sub-slice; `copy_from_slice` copies the
-/// 8-byte array into it. Both sides are length 8, so it can't panic here. (This is
-/// the standard, safe way to poke a fixed-width integer into a `[u8]`.)
-fn write_u64_le(buf: &mut [u8], offset: usize, value: u64) {
-    buf[offset..offset + 8].copy_from_slice(&value.to_le_bytes());
-}
-
-/// Write a little-endian u32 into `buf` starting at `offset`. (Same idea as
-/// `write_u64_le`, 4 bytes wide.)
-fn write_u32_le(buf: &mut [u8], offset: usize, value: u32) {
-    buf[offset..offset + 4].copy_from_slice(&value.to_le_bytes());
-}
-
-/// Build the fully-populated notification struct, ready to be passed by pointer to
-/// the dial handler as its `rdx` argument.
-///
-/// Returns a `[u8; 0x100]` by value. Why a byte array and not a `#[repr(C)]` struct:
-/// the layout is a precise *offset* contract recovered by RE, with meaningful data
-/// only at 0x00/0x80/0x88/0x90/0xa0 and zeros elsewhere. A byte array makes every
-/// offset literally visible and immune to any field-ordering/padding surprise. A
-/// `#[repr(C)] struct` with explicit padding fields would work too, but it's easier
-/// to get a padding byte wrong than to index a flat array. (For future reference:
-/// the `bytemuck` crate can safely reinterpret a `#[repr(C)]` struct as `&[u8]`
-/// zero-copy — worth knowing, but overkill here and an extra dependency.)
-pub fn build_notification() -> [u8; NOTIFICATION_SIZE] {
-    // Start fully zeroed. This already satisfies every "= 0" field (caps at +0x88/
-    // +0x90, the key at +0xa0, and all padding); we only need to set the non-zero
-    // fields below.
-    let mut buf = [0u8; NOTIFICATION_SIZE];
-
-    // [+0x00] entry gate: must be non-zero to reach the dial path.
-    buf[OFF_GATE] = 1;
-
-    // [+0x80] completion delegate function pointer = &completion_stub.
-    //
-    // `completion_stub as *const ()`: a *function item* in Rust is a zero-sized,
-    // unique type, not a value. Casting it to a raw pointer coerces it to a function
-    // pointer and then to an untyped code pointer `*const ()` — i.e. the address of
-    // the function's machine code. The intermediate `*const ()` before `as u64` is
-    // the idiomatic form: it says "treat this as an address" and also avoids the
-    // `clippy`/rustc "direct cast of function item into an integer" lint you'd get
-    // from `completion_stub as u64`.
-    let stub_addr = completion_stub as *const () as u64;
-    write_u64_le(&mut buf, OFF_DELEGATE_FN, stub_addr);
-
-    // [+0x88]/[+0x90] delegate captures = 0. Already zero from initialization; write
-    // them explicitly so the layout intent is visible at a glance.
-    write_u64_le(&mut buf, OFF_DELEGATE_CAP1, 0);
-    write_u64_le(&mut buf, OFF_DELEGATE_CAP2, 0);
-
-    // [+0xa0] RpcJob key/priority dword = 0 (copied, never compared on the dial path).
-    write_u32_le(&mut buf, OFF_KEY, 0);
-
-    buf
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn notification_layout() {
-        let n = build_notification();
-
-        // Total size is exactly 0x100.
-        assert_eq!(n.len(), NOTIFICATION_SIZE);
-
-        // [+0x00] gate byte == 1.
-        assert_eq!(n[0x00], 1);
-
-        // [+0xa0..0xa4] as u32 == 0.
-        // `try_into().unwrap()` turns the 4-byte slice into a `[u8; 4]` (it can only
-        // fail if the slice weren't length 4, which it is), and `from_le_bytes`
-        // reads it back the same little-endian way we wrote it.
-        let key = u32::from_le_bytes(n[0xa0..0xa4].try_into().unwrap());
-        assert_eq!(key, 0);
-
-        // [+0x80..0x88] as u64 == address of completion_stub.
-        let stub = u64::from_le_bytes(n[0x80..0x88].try_into().unwrap());
-        assert_eq!(stub, completion_stub as *const () as u64);
-
-        // [+0x88..0x90] and [+0x90..0x98] captures == 0.
-        assert_eq!(u64::from_le_bytes(n[0x88..0x90].try_into().unwrap()), 0);
-        assert_eq!(u64::from_le_bytes(n[0x90..0x98].try_into().unwrap()), 0);
-    }
-
-    #[test]
-    fn stub_counter_increments() {
-        let before = completion_stub_call_count();
-        let _ = completion_stub(0, 0, 0, 0);
-        assert_eq!(completion_stub_call_count(), before + 1);
-    }
-}

openfut-hook/src/ea_stub.rs

@@ -1,179 +0,0 @@
-/// In-process LSX server (port 3216 / EA App Local Services Exchange).
-///
-/// Runs in a background thread inside FIFA's process so Wine's wineserver
-/// routes FIFA's connect() directly here without needing any external process.
-///
-/// Protocol: server speaks first (sends XML greeting with challenge key),
-/// then both sides do an AES-128-ECB challenge/response handshake, then
-/// all subsequent messages are AES-128-ECB encrypted.
-use windows_sys::Win32::Networking::WinSock::{
-    WSAStartup, WSACleanup, socket, bind, listen, accept, recv, send,
-    closesocket, setsockopt,
-    WSADATA, SOCKADDR, SOCKET, SOCKET_ERROR, INVALID_SOCKET,
-    AF_INET, SOCK_STREAM, IPPROTO_TCP, SOMAXCONN,
-    SO_REUSEADDR, SOL_SOCKET,
-};
-
-const PORT: u16 = 3216;
-const GREETING_KEY: &str = "cacf897a20b6d612ad0c05e011df52bb";
-
-fn server_loop() {
-    unsafe {
-        let mut wsa = core::mem::zeroed::<WSADATA>();
-        if WSAStartup(0x0202, &mut wsa) != 0 {
-            crate::write_log("ea_stub: WSAStartup failed\n");
-            return;
-        }
-
-        let srv = socket(AF_INET as i32, SOCK_STREAM, IPPROTO_TCP as i32);
-        if srv == INVALID_SOCKET {
-            crate::write_log("ea_stub: socket() failed\n");
-            WSACleanup();
-            return;
-        }
-
-        let yes: i32 = 1;
-        setsockopt(srv, SOL_SOCKET as i32, SO_REUSEADDR, &yes as *const i32 as *const u8, 4);
-
-        // sockaddr_in: sin_family(u16-LE) + sin_port(u16-BE) + sin_addr(u32) + padding
-        let mut addr = [0u8; 16];
-        let family = AF_INET as u16;
-        addr[0] = (family & 0xFF) as u8;
-        addr[1] = (family >> 8) as u8;
-        addr[2] = (PORT >> 8) as u8;
-        addr[3] = (PORT & 0xFF) as u8;
-
-        if bind(srv, addr.as_ptr() as *const SOCKADDR, addr.len() as i32) == SOCKET_ERROR {
-            crate::write_log("ea_stub: bind() failed — port 3216 in use\n");
-            closesocket(srv);
-            WSACleanup();
-            return;
-        }
-
-        listen(srv, SOMAXCONN as i32);
-        crate::write_log("ea_stub: listening on port 3216\n");
-
-        loop {
-            crate::write_log("ea_stub: calling accept...\n");
-            let client = accept(srv, core::ptr::null_mut(), core::ptr::null_mut());
-            if client == INVALID_SOCKET {
-                use windows_sys::Win32::Networking::WinSock::WSAGetLastError;
-                let e = WSAGetLastError();
-                crate::write_log(&format!("ea_stub: accept FAILED wsa_err={e}\n"));
-                break;
-            }
-            crate::write_log("ea_stub: connection accepted\n");
-            handle_lsx(client);
-        }
-
-        closesocket(srv);
-        WSACleanup();
-    }
-}
-
-unsafe fn lsx_send(sock: SOCKET, msg: &str) -> bool {
-    // LSX messages are null-terminated
-    let mut buf = msg.as_bytes().to_vec();
-    buf.push(0);
-    let n = send(sock, buf.as_ptr(), buf.len() as i32, 0);
-    if n == SOCKET_ERROR {
-        use windows_sys::Win32::Networking::WinSock::WSAGetLastError;
-        let e = WSAGetLastError();
-        crate::write_log(&format!("ea_stub: send FAILED wsa_err={e}\n"));
-        false
-    } else {
-        crate::write_log(&format!("ea_stub: sent {n} bytes\n"));
-        true
-    }
-}
-
-unsafe fn lsx_recv(sock: SOCKET) -> Option<String> {
-    let mut buf = vec![0u8; 8192];
-    let n = recv(sock, buf.as_mut_ptr(), buf.len() as i32, 0);
-    if n <= 0 {
-        use windows_sys::Win32::Networking::WinSock::WSAGetLastError;
-        let e = WSAGetLastError();
-        crate::write_log(&format!("ea_stub: recv returned {n} wsa_err={e}\n"));
-        return None;
-    }
-    let text = String::from_utf8_lossy(&buf[..n as usize])
-        .trim_matches('\0')
-        .to_string();
-    crate::write_log(&format!("ea_stub: recv {n} bytes: {}\n", &text[..text.len().min(300)]));
-    Some(text)
-}
-
-unsafe fn handle_lsx(sock: SOCKET) {
-    // ── 1. Send greeting (server speaks first) ────────────────────────────
-    let greeting = format!(
-        "<LSX>\r\n    <Event sender=\"EALS\">\r\n        <Challenge build=\"release\" key=\"{GREETING_KEY}\" version=\"10,5,30,15625\" />\r\n    </Event>\r\n</LSX>"
-    );
-    crate::write_log("ea_stub: sending LSX greeting\n");
-    if !lsx_send(sock, &greeting) {
-        closesocket(sock);
-        return;
-    }
-
-    // ── 2. Receive FIFA's ChallengeResponse ───────────────────────────────
-    let challenge_xml = match lsx_recv(sock) {
-        Some(s) => s,
-        None => { closesocket(sock); return; }
-    };
-
-    // Parse: split on '"' — EAappEmulater style
-    // <Request id="N" ...><ChallengeResponse ... response="HEX" key="HEX">
-    let parts: Vec<&str> = challenge_xml.split('"').collect();
-    let id  = parts.get(3).copied().unwrap_or("1");
-    let key = parts.get(7).copied().unwrap_or("");
-    crate::write_log(&format!("ea_stub: challenge id={id} key={key}\n"));
-
-    let our_response = crate::lsx::make_challenge_response(key);
-    let seed = compute_seed(&our_response);
-    crate::write_log(&format!("ea_stub: our_response={our_response} seed={seed}\n"));
-
-    // ── 3. Send ChallengeAccepted ─────────────────────────────────────────
-    let accepted = format!(
-        "<LSX>\r\n    <Response id=\"{id}\" sender=\"EALS\">\r\n        <ChallengeAccepted response=\"{our_response}\" />\r\n    </Response>\r\n</LSX>"
-    );
-    crate::write_log("ea_stub: sending ChallengeAccepted\n");
-    if !lsx_send(sock, &accepted) {
-        closesocket(sock);
-        return;
-    }
-
-    // ── 4. Session loop ───────────────────────────────────────────────────
-    loop {
-        let encrypted = match lsx_recv(sock) {
-            Some(s) => s,
-            None => break,
-        };
-        if encrypted.trim().is_empty() { continue; }
-
-        let request = crate::lsx::lsx_decrypt(&encrypted, seed);
-        crate::write_log(&format!("ea_stub: request: {}\n", &request[..request.len().min(300)]));
-
-        if request.trim().is_empty() {
-            crate::write_log("ea_stub: empty decrypted request — skipping\n");
-            continue;
-        }
-
-        let response_xml = crate::lsx::dispatch(request.trim());
-        crate::write_log(&format!("ea_stub: response: {}\n", &response_xml[..response_xml.len().min(300)]));
-
-        let encrypted_resp = crate::lsx::lsx_encrypt(&response_xml, seed);
-        if !lsx_send(sock, &encrypted_resp) { break; }
-    }
-
-    closesocket(sock);
-    crate::write_log("ea_stub: client disconnected\n");
-}
-
-fn compute_seed(hex: &str) -> u16 {
-    let b0 = u8::from_str_radix(&hex[..2.min(hex.len())], 16).unwrap_or(0);
-    let b1 = u8::from_str_radix(&hex[2..4.min(hex.len())], 16).unwrap_or(0);
-    ((b0 as u16) << 8) | (b1 as u16)
-}
-
-pub fn start() {
-    std::thread::spawn(server_loop);
-}

openfut-hook/src/fifa17.rs

@@ -1,14 +1,12 @@
 //! FIFA 17 injection path (feature = "fifa17").
 //!
-//! This is a *separate, minimal* entry point from the FIFA-23 `install_hooks`.
-//! FIFA 17 is a different game with different in-memory structures, so we run NONE
-//! of the FIFA-23 connect/LSX/origin_spy/dial logic here — that would at best
-//! no-op and at worst crash. For now this proves the version.dll hijack actually
-//! loads us into FIFA17.exe and dumps the module map, which we need to locate
-//! DirtySDK/ProtoSSL's cert-verify function (the next milestone: patch it so the
-//! secure Blaze redirector's TLS handshake succeeds against our bridge cert).
-//!
-//! Everything here is read-only except the (not-yet-enabled) cert-verify patch.
+//! This is the game module selected by the `fifa17` feature: `install()` spawns a
+//! worker (off the loader lock) that dumps the module map, arms the config-driven
+//! network redirect (connect / WSAConnect / ConnectEx, target from `openfut.cfg`
+//! via `openfut-common`), and installs the FIFA-17 SBC dispatch repair plus the
+//! store/season hooks. Structures and RVAs here are specific to FIFA17.exe /
+//! CardsDLL_Win64_retail.dll; a future game gets its own module, never a copy of
+//! this one.
 
 use crate::write_log;
 use windows_sys::Win32::Foundation::{CloseHandle, INVALID_HANDLE_VALUE};
@@ -67,6 +65,29 @@ unsafe fn dump_modules() {
     CloseHandle(snap);
 }
 
+/// Read `openfut.cfg` from the game directory (next to `FIFA17.exe`) and resolve
+/// the OpenFUT server via the shared `openfut-common` parser. Returns `None`
+/// with a diagnostic when the file is absent or unusable, so the hook fails
+/// safe — no redirect installed rather than a corrupt one.
+fn load_server() -> Option<openfut_common::ResolvedServer> {
+    let dir = std::env::current_exe().ok()?.parent()?.to_path_buf();
+    let path = dir.join("openfut.cfg");
+    let contents = match std::fs::read_to_string(&path) {
+        Ok(c) => c,
+        Err(e) => {
+            write_log(&format!("fifa17: cannot read {}: {e}\n", path.display()));
+            return None;
+        }
+    };
+    match openfut_common::ServerConfig::parse(&contents).and_then(|c| c.resolve()) {
+        Ok(server) => Some(server),
+        Err(e) => {
+            write_log(&format!("fifa17: openfut.cfg unusable: {e}\n"));
+            None
+        }
+    }
+}
+
 /// Worker that runs AFTER DllMain returns (loader lock released). ToolHelp and
 /// other loader-touching calls are unsafe under the loader lock, so we defer them
 /// to this thread. This is what fixed the "game exits right after DllMain" issue.
@@ -79,11 +100,68 @@ unsafe extern "system" fn worker(_: *mut core::ffi::c_void) -> u32 {
     ));
     dump_modules();
     write_log("fifa17: worker complete (injection healthy)\n");
-    // Every SBC detour is deferred and inert unless its exact environment gate is `1`.
+
+    // ── FIFA17 in-process network redirect (Milestone A) ──────────────────────
+    // Route EA endpoints to the configured OpenFUT server from openfut.cfg
+    // (openfut-common is the single source of truth). No hosts/iptables/portproxy.
+    match load_server() {
+        Some(server) => {
+            write_log(&format!(
+                "fifa17: redirect armed → {} https={} redirector={} main={}\n",
+                server.redirect_ip,
+                server.ports.https,
+                server.ports.blaze_redirector,
+                server.ports.blaze_main
+            ));
+            crate::connect_hook::set_redirect(server);
+            if crate::connect_hook::install_inline_connect_hook() {
+                write_log("fifa17: connect inline-hooked\n");
+            } else {
+                write_log("fifa17: connect hook FAILED\n");
+            }
+            let wp = crate::iat::resolve(b"ws2_32.dll\0", b"WSAConnect\0");
+            if !wp.is_null() {
+                let f: unsafe extern "system" fn(
+                    usize,
+                    *const u8,
+                    i32,
+                    *const (),
+                    *const (),
+                    *const (),
+                    *const (),
+                ) -> i32 = core::mem::transmute(wp);
+                crate::connect_hook::set_real_wsa_connect(f);
+                crate::iat::patch_iat(wp, crate::connect_hook::hooked_wsa_connect as *const ());
+                write_log("fifa17: WSAConnect IAT patched\n");
+            }
+            if crate::connectex_hook::install_wsaioctl_hook() {
+                write_log("fifa17: ConnectEx (WSAIoctl) hooked\n");
+            } else {
+                write_log("fifa17: ConnectEx hook FAILED\n");
+            }
+        }
+        None => write_log(
+            "fifa17: NO redirect installed (openfut.cfg missing/invalid) — EA traffic left untouched\n",
+        ),
+    }
+
+    // FIFA17 TLS/certificate + store crash-guard compatibility (Milestone B).
+    // Spawns its own bounded polling worker: patches the FIFA17.exe ProtoSSL cert
+    // gates once the packer unpacks them, then the CardsDLL store guard once UT
+    // loads it. Fail-closed and one-shot; replaces the external openfut-autopatch.
+    crate::fifa17_tls::install();
+    // The promoted SBC dispatch repair (and the evidence traces it decides on) arms
+    // itself from the build; its safety is the runtime signature/evidence gate. The
+    // remaining legacy experiment modules stay inert unless their env gate is `1`.
     crate::sbc_hook::install();
     crate::sbc_trace::install();
     crate::sbc_dispatch::install();
     crate::sbc_request_trace::install();
+    crate::store_entry::install();
+    crate::season_trace::install();
+    crate::season_team_compat::install();
+    crate::offline_seasons_pma::install();
+    crate::kit_trace::install();
     0
 }
 

openfut-hook/src/fifa17_tls.rs

@@ -0,0 +1,334 @@
+//! FIFA 17 in-process TLS/certificate + store crash-guard compatibility.
+//!
+//! Ports the *proven* subset of the external `openfut-autopatch` patch set into
+//! `version.dll`, so the client-local contract no longer needs an external
+//! `/proc`-writing patcher. Two concerns, both fail-closed and one-shot:
+//!
+//!   1. ProtoSSL certificate gates in FIFA17.exe (REQUIRED_FOR_TLS) — let the
+//!      TLS handshake against the OpenFUT bridge cert succeed. Present only after
+//!      the STEAMPUNKS packer maps/decrypts the real code, so they are polled for.
+//!   2. The empty-"My Packs" store resolver crash-guard in CardsDLL
+//!      (REQUIRED_FOR_STORE_TLS, bug 6c) — CardsDLL loads lazily on entering UT,
+//!      so it is applied once the module appears.
+//!
+//! Deliberately NOT ported: the eight unconditional `STORE_PATCHES` from the
+//! external patcher. They carry no recovered original bytes (cannot be
+//! fail-closed) and are re-applied every tick (would require the very
+//! constant-rewrite loop this milestone forbids); the external patcher's own
+//! source records no rationale for them. See the Vault ADR.
+//!
+//! Every address is ASLR-relocated from its preferred image base at runtime
+//! (`live = module_base + (static_va - preferred_base)`); nothing patches an
+//! absolute address. Every write goes through [`crate::patch_mem`]'s fail-closed
+//! primitive: original → write+verify, already-patched → no-op, anything else →
+//! logged and skipped.
+
+use crate::patch_mem::{self, ApplyOutcome, Mem, PatchState, WinMem};
+use crate::write_log;
+use std::time::{Duration, Instant};
+
+/// FIFA17.exe preferred image base (confirmed: futmem reports the client mapped
+/// flat at this base; Wine honours it, native Windows ASLR may not — hence the
+/// runtime-base + RVA model below).
+const FIFA17_PREFERRED_BASE: u64 = 0x1_4000_0000;
+/// CardsDLL_Win64_retail.dll preferred image base.
+const CARDS_PREFERRED_BASE: u64 = 0x1_8000_0000;
+
+/// Which module a site lives in.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+enum Module {
+    Fifa17Exe,
+    CardsDll,
+}
+
+impl Module {
+    const fn preferred_base(self) -> u64 {
+        match self {
+            Module::Fifa17Exe => FIFA17_PREFERRED_BASE,
+            Module::CardsDll => CARDS_PREFERRED_BASE,
+        }
+    }
+
+    /// Runtime base of the loaded module, or `None` if not mapped yet. FIFA17.exe
+    /// is the main image (null name); CardsDLL is resolved by its retail name.
+    unsafe fn runtime_base(self) -> Option<usize> {
+        match self {
+            Module::Fifa17Exe => patch_mem::module_base(core::ptr::null()),
+            Module::CardsDll => {
+                patch_mem::module_base(c"CardsDLL_Win64_retail.dll".as_ptr().cast())
+                    .or_else(|| patch_mem::module_base(c"CardsDLL.dll".as_ptr().cast()))
+            }
+        }
+    }
+}
+
+/// One fail-closed byte patch, expressed as a static VA in its module's preferred
+/// image so the derivation `RVA = VA - preferred_base` is auditable.
+struct Site {
+    module: Module,
+    static_va: u64,
+    orig: &'static [u8],
+    patch: &'static [u8],
+    label: &'static str,
+}
+
+impl Site {
+    const fn rva(&self) -> u64 {
+        patch_mem::rva(self.static_va, self.module.preferred_base())
+    }
+    fn live_addr(&self, base: usize) -> usize {
+        patch_mem::live_addr(base, self.rva())
+    }
+}
+
+// ── ProtoSSL certificate gates (FIFA17.exe) — REQUIRED_FOR_TLS ──────────────────
+// GATE1: JNZ rel32 -> 6×NOP (fall through the cert-verify failure branch).
+// GATE2: function prologue -> `xor eax,eax; ret` (cert-verify returns 0/false).
+// Applied as a pair, exactly like the external patcher: written only when BOTH
+// read their known original, treated as done when BOTH already hold the patch.
+const GATE1: Site = Site {
+    module: Module::Fifa17Exe,
+    static_va: 0x1_4613_2548,
+    orig: &[0x0f, 0x85, 0x76, 0x01, 0x00, 0x00],
+    patch: &[0x90, 0x90, 0x90, 0x90, 0x90, 0x90],
+    label: "GATE1",
+};
+const GATE2: Site = Site {
+    module: Module::Fifa17Exe,
+    static_va: 0x1_4613_61b0,
+    orig: &[0x48, 0x89, 0x5c],
+    patch: &[0x31, 0xc0, 0xc3],
+    label: "GATE2",
+};
+
+// ── Empty "My Packs" store resolver crash-guard (CardsDLL) — REQUIRED_FOR_STORE_TLS
+// JNZ 0x14869 (75 0f) -> JG 0x14869 (7f 0f): routes zero/negative store category
+// ids through the Browse path instead of a NULL deref. Fail-closed one-shot.
+const STORE_GUARD: Site = Site {
+    module: Module::CardsDll,
+    static_va: 0x1_8001_4858,
+    orig: &[0x75, 0x0f],
+    patch: &[0x7f, 0x0f],
+    label: "empty-mypacks-store-guard",
+};
+
+/// Poll cadence while waiting for the packer to unpack / CardsDLL to load. Low
+/// frequency: the thread sleeps between ticks, so idle CPU is negligible.
+const POLL: Duration = Duration::from_millis(250);
+/// Upper bound on the whole worker's lifetime so it can never spin forever if the
+/// user never enters Ultimate Team (CardsDLL never loads).
+const MAX_WAIT: Duration = Duration::from_secs(15 * 60);
+
+/// Decision for the FIFA17.exe cert-gate pair.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+enum CertAction {
+    /// Not both readable yet, or a mixed/unrecognised state — keep polling.
+    Wait,
+    /// Both gates hold their known original — safe to apply the pair.
+    Apply,
+    /// Both gates already hold the patch — nothing to do.
+    Done,
+}
+
+/// Pure pairing rule (unit-tested): only act when both gates agree.
+fn cert_action(g1: Option<PatchState>, g2: Option<PatchState>) -> CertAction {
+    match (g1, g2) {
+        (Some(PatchState::AlreadyPatched), Some(PatchState::AlreadyPatched)) => CertAction::Done,
+        (Some(PatchState::Original), Some(PatchState::Original)) => CertAction::Apply,
+        _ => CertAction::Wait,
+    }
+}
+
+/// Arm the FIFA17 TLS/store compatibility patcher: spawns a bounded background
+/// worker so it never touches the loader lock and never blocks `install()`.
+pub fn install() {
+    std::thread::spawn(|| unsafe { worker() });
+}
+
+unsafe fn worker() {
+    write_log("fifa17_tls: patch worker start\n");
+    let mut mem = WinMem;
+    let start = Instant::now();
+    let mut cert_done = false;
+    let mut guard_done = false;
+    // Throttle the "still waiting" diagnostics to one line each.
+    let mut logged_cert_wait = false;
+    let mut logged_guard_wait = false;
+
+    loop {
+        if !cert_done {
+            cert_done = try_cert_gates(&mut mem, &mut logged_cert_wait);
+        }
+        if !guard_done {
+            match Module::CardsDll.runtime_base() {
+                Some(cbase) => guard_done = try_store_guard(&mut mem, cbase),
+                None => {
+                    if !logged_guard_wait {
+                        write_log("fifa17_tls: waiting for CardsDLL (enter Ultimate Team)\n");
+                        logged_guard_wait = true;
+                    }
+                }
+            }
+        }
+        if cert_done && guard_done {
+            write_log("fifa17_tls: TLS patch set complete\n");
+            return;
+        }
+        if start.elapsed() >= MAX_WAIT {
+            write_log(&format!(
+                "fifa17_tls: worker stop (timeout {MAX_WAIT:?}); cert_gates_done={cert_done} store_guard_done={guard_done}\n"
+            ));
+            return;
+        }
+        std::thread::sleep(POLL);
+    }
+}
+
+/// Apply the FIFA17.exe cert-gate pair. Returns `true` once the pair is settled
+/// (applied or already patched); `false` while still unpacking / not both ready.
+unsafe fn try_cert_gates(mem: &mut WinMem, logged_wait: &mut bool) -> bool {
+    let base = match Module::Fifa17Exe.runtime_base() {
+        Some(b) => b,
+        None => return false,
+    };
+    let g1_addr = GATE1.live_addr(base);
+    let g2_addr = GATE2.live_addr(base);
+    let g1 = patch_mem::read_state(mem, g1_addr, GATE1.orig, GATE1.patch);
+    let g2 = patch_mem::read_state(mem, g2_addr, GATE2.orig, GATE2.patch);
+
+    match cert_action(g1, g2) {
+        CertAction::Done => {
+            write_log("fifa17_tls: cert gates already patched\n");
+            true
+        }
+        CertAction::Apply => {
+            let o1 = patch_mem::apply_checked(mem, g1_addr, GATE1.orig, GATE1.patch);
+            let o2 = patch_mem::apply_checked(mem, g2_addr, GATE2.orig, GATE2.patch);
+            if o1.is_patched() && o2.is_patched() {
+                write_log(&format!(
+                    "fifa17_tls: PATCHED cert gates ({} @ {g1_addr:#x} {o1:?}; {} @ {g2_addr:#x} {o2:?})\n",
+                    GATE1.label, GATE2.label
+                ));
+                true
+            } else {
+                write_log(&format!(
+                    "fifa17_tls: cert gate write FAILED ({} {o1:?}; {} {o2:?}) — TLS NOT installed\n",
+                    GATE1.label, GATE2.label
+                ));
+                // Terminal: a write/verify failure will not fix itself by retrying.
+                true
+            }
+        }
+        CertAction::Wait => {
+            if !*logged_wait {
+                write_log(&format!(
+                    "fifa17_tls: cert gates not ready (still unpacking?) {}={g1:?} {}={g2:?}\n",
+                    GATE1.label, GATE2.label
+                ));
+                *logged_wait = true;
+            }
+            false
+        }
+    }
+}
+
+/// Apply the CardsDLL store crash-guard once CardsDLL is mapped. Returns `true`
+/// once the site is settled (its bytes are final the moment CardsDLL is loaded,
+/// so any read outcome is a terminal decision — no further polling).
+unsafe fn try_store_guard(mem: &mut WinMem, cbase: usize) -> bool {
+    let addr = STORE_GUARD.live_addr(cbase);
+    let outcome = patch_mem::apply_checked(mem, addr, STORE_GUARD.orig, STORE_GUARD.patch);
+    match outcome {
+        ApplyOutcome::NotReadable => false, // CardsDLL mapped but this page not yet — retry
+        ApplyOutcome::Applied | ApplyOutcome::AlreadyPatched => {
+            write_log(&format!(
+                "fifa17_tls: store guard {} @ {addr:#x} {outcome:?} (VERIFIED empty-My-Packs)\n",
+                STORE_GUARD.label
+            ));
+            true
+        }
+        ApplyOutcome::Mismatch => {
+            let mut cur = [0u8; patch_mem::MAX_PATCH_LEN];
+            let n = STORE_GUARD.patch.len();
+            let seen = if mem.read(addr, &mut cur[..n]) {
+                patch_mem::hex(&cur[..n])
+            } else {
+                "unreadable".into()
+            };
+            write_log(&format!(
+                "fifa17_tls: SKIP store guard @ {addr:#x}: unexpected {seen} (build mismatch)\n"
+            ));
+            true
+        }
+        ApplyOutcome::WriteFailed | ApplyOutcome::VerifyFailed => {
+            write_log(&format!(
+                "fifa17_tls: store guard @ {addr:#x} {outcome:?}\n"
+            ));
+            true
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_site_is_well_formed() {
+        for s in [&GATE1, &GATE2, &STORE_GUARD] {
+            assert_eq!(
+                s.orig.len(),
+                s.patch.len(),
+                "{}: orig/patch length",
+                s.label
+            );
+            assert!(!s.orig.is_empty(), "{}: empty", s.label);
+            assert!(
+                s.patch.len() <= patch_mem::MAX_PATCH_LEN,
+                "{}: exceeds MAX_PATCH_LEN",
+                s.label
+            );
+            assert_ne!(s.orig, s.patch, "{}: orig == patch", s.label);
+        }
+    }
+
+    #[test]
+    fn rvas_match_the_recovered_derivation() {
+        assert_eq!(GATE1.rva(), 0x613_2548);
+        assert_eq!(GATE2.rva(), 0x613_61b0);
+        assert_eq!(STORE_GUARD.rva(), 0x1_4858);
+    }
+
+    #[test]
+    fn live_addresses_track_the_runtime_base() {
+        // At the preferred base the live address is the recorded static VA.
+        assert_eq!(GATE1.live_addr(0x1_4000_0000), 0x1_4613_2548);
+        assert_eq!(STORE_GUARD.live_addr(0x1_8000_0000), 0x1_8001_4858);
+        // Relocated bases shift every site by the same delta.
+        assert_eq!(GATE1.live_addr(0x3_0000_0000), 0x3_0613_2548);
+    }
+
+    #[test]
+    fn cert_pair_only_acts_when_both_gates_agree() {
+        use PatchState::*;
+        assert_eq!(
+            cert_action(Some(Original), Some(Original)),
+            CertAction::Apply
+        );
+        assert_eq!(
+            cert_action(Some(AlreadyPatched), Some(AlreadyPatched)),
+            CertAction::Done
+        );
+        // Not yet unpacked / partial / mismatched => never a blind half-write.
+        assert_eq!(cert_action(None, None), CertAction::Wait);
+        assert_eq!(cert_action(Some(Original), None), CertAction::Wait);
+        assert_eq!(
+            cert_action(Some(Original), Some(AlreadyPatched)),
+            CertAction::Wait
+        );
+        assert_eq!(
+            cert_action(Some(Mismatch), Some(Mismatch)),
+            CertAction::Wait
+        );
+    }
+}

openfut-hook/src/hooks.rs

@@ -1,82 +0,0 @@
-use std::{
-    ffi::CStr,
-    sync::{
-        atomic::{AtomicBool, Ordering},
-        OnceLock,
-    },
-};
-
-use windows_sys::Win32::Networking::WinSock::{getaddrinfo as sys_getaddrinfo, ADDRINFOA};
-
-type GetaddrinfoFn =
-    unsafe extern "system" fn(*const u8, *const u8, *const ADDRINFOA, *mut *mut ADDRINFOA) -> i32;
-
-static REAL: OnceLock<GetaddrinfoFn> = OnceLock::new();
-static REDIRECT_IP: OnceLock<Vec<u8>> = OnceLock::new();
-
-// Flipped to true the first time we successfully apply the runtime cert patch.
-// The patch is deferred to here (rather than DllMain) because EAWebKit.dll may
-// not be loaded yet when the hook DLL is injected.
-static CERT_PATCHED: AtomicBool = AtomicBool::new(false);
-
-pub fn set_real(f: GetaddrinfoFn) {
-    let _ = REAL.set(f);
-}
-
-pub fn set_redirect_ip(ip: String) {
-    let mut bytes = ip.into_bytes();
-    bytes.push(0);
-    let _ = REDIRECT_IP.set(bytes);
-}
-
-/// Returns true if `host` is an EA / EA-Sports domain that should be redirected
-/// to the local OpenFUT bridge.
-fn is_ea_host(host: &str) -> bool {
-    let h = host.to_ascii_lowercase();
-    h.ends_with(".ea.com")
-        || h == "ea.com"
-        || h.ends_with(".easports.com")
-        || h == "easports.com"
-        || h.ends_with(".ugc.footapi.com")
-        || h.ends_with(".footapi.com")
-}
-
-pub unsafe extern "system" fn hooked_getaddrinfo(
-    node_name: *const u8,
-    service_name: *const u8,
-    hints: *const ADDRINFOA,
-    result: *mut *mut ADDRINFOA,
-) -> i32 {
-    if !node_name.is_null() {
-        if let Ok(host) = CStr::from_ptr(node_name as *const i8).to_str() {
-            crate::write_log(&format!("openfut_hook: getaddrinfo({host})\n"));
-            // Milestone-0 transport watch (self-gates on OPENFUT_TRANSPORT_WATCH).
-            crate::transport_watch::note_getaddrinfo(host);
-            if is_ea_host(host) {
-                // Apply the ProtoSSL cert-verify bypass the first time we see an EA
-                // hostname — EAWebKit.dll must be loaded by now because it's calling us.
-                if !CERT_PATCHED.load(Ordering::Relaxed) {
-                    if crate::ssl_patch::patch_eawebkit_cert_verify() {
-                        CERT_PATCHED.store(true, Ordering::Relaxed);
-                        crate::write_log(
-                            "openfut_hook: ProtoSSL cert-verify patched (lazy, from getaddrinfo)\n",
-                        );
-                    } else {
-                        crate::write_log(
-                            "openfut_hook: ProtoSSL cert-verify patch FAILED in getaddrinfo\n",
-                        );
-                    }
-                }
-
-                let redirect = REDIRECT_IP
-                    .get()
-                    .map(|v| v.as_ptr())
-                    .unwrap_or(c"127.0.0.1".as_ptr().cast());
-                let real = REAL.get().copied().unwrap_or(sys_getaddrinfo);
-                return real(redirect, service_name, hints, result);
-            }
-        }
-    }
-    let real = REAL.get().copied().unwrap_or(sys_getaddrinfo);
-    real(node_name, service_name, hints, result)
-}

openfut-hook/src/iat.rs

@@ -71,19 +71,6 @@ pub unsafe fn patch_iat(original_fn: *const (), hook_fn: *const ()) -> usize {
     patch_module(module, original_fn, hook_fn)
 }
 
-/// Patch the IAT of a specific already-loaded DLL (e.g. b"EAWebKit.dll\0").
-pub unsafe fn patch_iat_in(
-    module_name: &[u8],
-    original_fn: *const (),
-    hook_fn: *const (),
-) -> usize {
-    let module = GetModuleHandleA(module_name.as_ptr());
-    if module.is_null() {
-        return 0;
-    }
-    patch_module(module, original_fn, hook_fn)
-}
-
 unsafe fn patch_module(module: HMODULE, original_fn: *const (), hook_fn: *const ()) -> usize {
     if module.is_null() {
         return 0;

openfut-hook/src/kit_trace.rs

@@ -0,0 +1,235 @@
+//! Passive, behavior-preserving diagnostic traces for FIFA 17's FUT pre-match
+//! KIT SELECTOR data flow.
+//!
+//! RE (2026-08-20, Ghidra on CardsDLL_Win64_retail.dll) established that the
+//! pre-match kit selector is fed ENTIRELY client-side (NOT by POW/EASFC):
+//!
+//!   * `FUT_GET_MATCH_KITS_DP` (id 0x7565) builder `FUN_1800be6a0` (rva 0xbe6a0)
+//!     reads a boolean gate `ctx+0x152` (`KITS_AVAILABLE`); when false, or when
+//!     the two available-kit vectors are empty, the selector renders blank/white.
+//!   * The available home/away kit-id lists live on `FutSquadServiceImpl`
+//!     (`this+0xe08` home, `this+0xe38` away) and are written by the setter
+//!     `FUN_180196760` (rva 0x96760, vtable slot 0x1d0): args (this, srcVec, side).
+//!   * A club KIT ITEM is turned into an available kit by `FUN_1801c3480`
+//!     (rva 0x1c3480): it reads item fields (`+0x4c==7`, `+0x60==4`,
+//!     `+0x5c`∈{101 home,102 away}, `+0x94` source teamid, `+0xba`
+//!     teamkittypetechid) and calls `FUN_1801c44b0` (rva 0x1c44b0) to clone that
+//!     team's kit rows from the CLIENT-LOCAL `teamkits` DB into the FUT club
+//!     (teamtechid 130000).
+//!
+//! These traces answer, in one operator-driven match, exactly WHERE the empty
+//! selector originates: do kit club items reach the client (kit_item_clone), does
+//! the clone into the FUT club happen (kit_db_clone), does the available list get
+//! set non-empty (set_available_kits), and what does the selector finally read
+//! (get_match_kits: KITS_AVAILABLE + count). Every trace is read-only: it logs,
+//! then tail-calls the original through a trampoline. Copied prologues are whole,
+//! position-independent instructions (the one rip-relative prologue uses the
+//! relocating installer).
+
+use core::sync::atomic::{AtomicUsize, Ordering};
+
+use windows_sys::Win32::System::LibraryLoader::GetModuleHandleA;
+
+use crate::sbc_trace::{readable_range, validate_cards_build};
+use crate::season_trace::{install_detour, install_detour_reloc, rd_i32, rd_u8};
+use crate::write_log;
+
+static REPORTS: AtomicUsize = AtomicUsize::new(0);
+
+fn budget() -> bool {
+    REPORTS.fetch_add(1, Ordering::Relaxed) < 256
+}
+
+unsafe fn rd_usize(addr: usize) -> Option<usize> {
+    readable_range(addr, 8).then(|| core::ptr::read_volatile(addr as *const usize))
+}
+
+// FUT_GET_MATCH_KITS_DP builder FUN_1800be6a0 (0xbe6a0). rcx = DP model ctx.
+// ctx+0x152 is the KITS_AVAILABLE bool that gates the whole selector list.
+static GET_MATCH_KITS_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn get_match_kits_wrapper(
+    rcx: usize,
+    rdx: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    if budget() {
+        let avail = rd_u8(rcx + 0x152);
+        write_log(&format!(
+            "KIT_GET: FUT_GET_MATCH_KITS_DP ctx={rcx:#x} KITS_AVAILABLE={avail:?}\n"
+        ));
+    }
+    let t = GET_MATCH_KITS_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(rcx, rdx, r8, r9)
+}
+
+// setAvailableKits FUN_180196760 (0x96760): (this, srcVec, side). srcVec is an
+// int vector {begin@+0, end@+8}; count = (end-begin)/4. side 0=home, 1=away.
+static SET_AVAILABLE_KITS_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn set_available_kits_wrapper(
+    rcx: usize,
+    rdx: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    if budget() {
+        let count = match (rd_usize(rdx), rd_usize(rdx + 8)) {
+            (Some(b), Some(e)) if e >= b => ((e - b) / 4) as i64,
+            _ => -1,
+        };
+        write_log(&format!(
+            "KIT_SET: setAvailableKits this={rcx:#x} side={r8} count={count}\n"
+        ));
+    }
+    let t = SET_AVAILABLE_KITS_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(rcx, rdx, r8, r9)
+}
+
+// Kit-item clone driver FUN_1801c3480 (0x1c3480): rdx = param_2, the club-item
+// event; the item struct is at *(param_2+0x10). Logs the fields the function
+// branches on so we can see whether a kit club item reaches the client and its
+// home/away designator + source teamid.
+static KIT_ITEM_CLONE_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn kit_item_clone_wrapper(
+    rcx: usize,
+    rdx: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    if budget() {
+        if let Some(item) = rd_usize(rdx + 0x10) {
+            write_log(&format!(
+                "KIT_ITEM: clone-driver item={item:#x} type[+0x4c]={:?} subid[+0x5c]={:?} \
+                 cat[+0x60]={:?} teamid[+0x94]={:?} kittype[+0xba]={:?}\n",
+                rd_i32(item + 0x4c),
+                rd_i32(item + 0x5c),
+                rd_i32(item + 0x60),
+                rd_i32(item + 0x94),
+                rd_i32(item + 0xba),
+            ));
+        } else {
+            write_log(&format!(
+                "KIT_ITEM: clone-driver param_2={rdx:#x} (item ptr unreadable)\n"
+            ));
+        }
+    }
+    let t = KIT_ITEM_CLONE_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(rcx, rdx, r8, r9)
+}
+
+// Kit DB clone FUN_1801c44b0 (0x1c44b0): (clubmgr, side, teamtechid, kittype).
+// Fires only when the driver decided the item is a home(101)/away(102) kit, so
+// this is the proof the FUT-club (teamtechid 130000) kit rows get synthesized.
+static KIT_DB_CLONE_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn kit_db_clone_wrapper(
+    rcx: usize,
+    rdx: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    if budget() {
+        write_log(&format!(
+            "KIT_DBCLONE: clone team kit side={rdx} src_teamtechid={r8} kittype={r9}\n"
+        ));
+    }
+    let t = KIT_DB_CLONE_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(rcx, rdx, r8, r9)
+}
+
+unsafe fn worker() {
+    let mut base = 0usize;
+    for _ in 0..600u32 {
+        base = GetModuleHandleA(c"CardsDLL_Win64_retail.dll".as_ptr().cast()) as usize;
+        if base != 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(500));
+    }
+    if base == 0 || !validate_cards_build(base) {
+        write_log("KIT_TRACE: CardsDLL unavailable/invalid; kit trace inactive\n");
+        return;
+    }
+    // FUN_1800be6a0: 48 8b c4 55 41 54 41 55 41 56 41 57 48 8d 68 a1 (copy_len 16).
+    install_detour(
+        base,
+        0xbe6a0,
+        "GetMatchKits_DP(0xbe6a0)",
+        16,
+        &[
+            0x48, 0x8b, 0xc4, 0x55, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48, 0x8d,
+            0x68, 0xa1,
+        ],
+        get_match_kits_wrapper as *const () as usize,
+        &GET_MATCH_KITS_TRAMP,
+    );
+    // FUN_180196760: 48 89 54 24 10 53 48 83 ec 30 48 c7 44 24 20 fe ff ff ff (copy_len 19).
+    install_detour(
+        base,
+        0x96760,
+        "setAvailableKits(0x96760)",
+        19,
+        &[
+            0x48, 0x89, 0x54, 0x24, 0x10, 0x53, 0x48, 0x83, 0xec, 0x30, 0x48, 0xc7, 0x44, 0x24,
+            0x20, 0xfe, 0xff, 0xff, 0xff,
+        ],
+        set_available_kits_wrapper as *const () as usize,
+        &SET_AVAILABLE_KITS_TRAMP,
+    );
+    // FUN_1801c3480: 48 89 5c 24 08 57 48 83 ec 60 <48 8b 05 disp32> (rip-relative
+    // MOV RAX,[rip+..] at copied offset 10; disp32 at 13, insn end 17; copy_len 17).
+    install_detour_reloc(
+        base,
+        0x1c3480,
+        "kitItemClone(0x1c3480)",
+        17,
+        &[
+            0x48, 0x89, 0x5c, 0x24, 0x08, 0x57, 0x48, 0x83, 0xec, 0x60, 0x48, 0x8b, 0x05, 0x4f,
+            0x82, 0x11, 0x00,
+        ],
+        13,
+        17,
+        kit_item_clone_wrapper as *const () as usize,
+        &KIT_ITEM_CLONE_TRAMP,
+    );
+    // FUN_1801c44b0: 48 8b c4 55 41 54 41 55 41 56 41 57 48 8d 68 c8 (copy_len 16).
+    install_detour(
+        base,
+        0x1c44b0,
+        "kitDbClone(0x1c44b0)",
+        16,
+        &[
+            0x48, 0x8b, 0xc4, 0x55, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48, 0x8d,
+            0x68, 0xc8,
+        ],
+        kit_db_clone_wrapper as *const () as usize,
+        &KIT_DB_CLONE_TRAMP,
+    );
+    write_log("KIT_TRACE: all kit-selector traces armed\n");
+}
+
+/// Arm the passive kit-selector diagnostics on a deferred thread (CardsDLL is not
+/// yet loaded at DllMain time). Read-only: never changes game behavior.
+pub(crate) fn install() {
+    write_log("KIT_TRACE: requested; deferred signature validation starting\n");
+    std::thread::spawn(|| unsafe { worker() });
+}

openfut-hook/src/lib.rs

@@ -1,25 +1,28 @@
-// The `fifa17` feature compiles this shared crate but activates only the FIFA-17
-// injection path (fifa17.rs + sbc_*): install_hooks() routes to fifa17::install()
-// and the FIFA-23 hook modules are reached solely via install_hooks_fifa23(), which
-// is itself `#[cfg(not(feature = "fifa17"))]`. Those modules are therefore compiled
-// but unused under `fifa17` (the linker strips them from the cdylib). Scope the
-// resulting dead-code/unused-import lints to that feature so both builds stay
-// `-D warnings` clean without dropping code the default (FIFA-23) build needs.
-#![cfg_attr(feature = "fifa17", allow(dead_code, unused_imports))]
+// openfut-hook: the version.dll proxy that injects OpenFUT's client-side
+// compatibility hooks into an EA FUT client.
+//
+// GAME-GENERIC BY FEATURE: each supported game is its own module, selected by a
+// per-game Cargo feature (currently only `fifa17`). `install_hooks` dispatches to
+// the selected game's `install()`. Generic infrastructure — the version proxy,
+// the connect/WSAConnect/ConnectEx redirect, IAT primitives, and the shared
+// `openfut-common` config — stays game-neutral. Add a future game with its own
+// `mod <game>;` behind a feature plus a dispatch arm; never by copying a retired
+// game's reverse-engineering.
+#[cfg(not(any(feature = "fifa17")))]
+compile_error!("select a game, e.g. --features fifa17");
 
-mod config;
 mod connect_hook;
 mod connectex_hook;
-mod dial_notification;
 #[cfg(feature = "fifa17")]
 mod fifa17;
-mod hooks;
+#[cfg(feature = "fifa17")]
+mod fifa17_tls;
 mod iat;
-mod origin_spy;
-#[cfg(feature = "probe")]
-mod probe;
-#[cfg(feature = "capture_baseline")]
-mod recv_hook;
+#[cfg(feature = "fifa17")]
+mod kit_trace;
+#[cfg(feature = "fifa17")]
+mod offline_seasons_pma;
+mod patch_mem;
 #[cfg(feature = "fifa17")]
 mod sbc_dispatch;
 #[cfg(feature = "fifa17")]
@@ -28,14 +31,16 @@ mod sbc_hook;
 mod sbc_request_trace;
 #[cfg(feature = "fifa17")]
 mod sbc_trace;
-mod ssl_patch;
-mod tls_bypass;
-mod transport_watch;
+#[cfg(feature = "fifa17")]
+mod season_team_compat;
+#[cfg(feature = "fifa17")]
+mod season_trace;
+#[cfg(feature = "fifa17")]
+mod store_entry;
 mod version_proxy;
 
 use windows_sys::Win32::{
     Foundation::{BOOL, HMODULE, TRUE},
-    Networking::WinSock::ADDRINFOA,
     System::SystemServices::DLL_PROCESS_ATTACH,
 };
 
@@ -50,21 +55,6 @@ pub(crate) fn write_log(msg: &str) {
     }
 }
 
-/// Force the log to stable storage. `write_log` already opens+closes the file per line,
-/// so nothing is buffered *inside our process* (a process crash can't lose a written
-/// line). `sync_all` additionally flushes the OS cache to disk, for durability even
-/// across a full system crash. We call this right before the dial trigger's call so the
-/// pre-call log line is guaranteed on disk if the call faults.
-#[allow(dead_code)]
-pub(crate) fn flush_log() {
-    if let Ok(f) = std::fs::OpenOptions::new()
-        .append(true)
-        .open(r"C:\openfut_hook.log")
-    {
-        let _ = f.sync_all();
-    }
-}
-
 /// # Safety
 ///
 /// This is the DLL entry point invoked by the Windows loader; it MUST NOT be
@@ -84,177 +74,9 @@ pub unsafe extern "system" fn DllMain(module: HMODULE, reason: u32, _: *mut ())
     TRUE
 }
 
-unsafe fn install_hooks(module: HMODULE) {
-    // FIFA 17 path: run ONLY the minimal, FIFA-17-safe logic and skip every
-    // FIFA-23-specific hook below (they assume FIFA 23's memory layout).
+/// Dispatch to the selected game's install path. Exactly one game feature must be
+/// enabled (enforced by the crate-level `compile_error!` above).
+unsafe fn install_hooks(_module: HMODULE) {
     #[cfg(feature = "fifa17")]
-    {
-        let _ = module;
-        fifa17::install();
-    }
-    #[cfg(not(feature = "fifa17"))]
-    install_hooks_fifa23(module)
-}
-
-#[cfg(not(feature = "fifa17"))]
-unsafe fn install_hooks_fifa23(module: HMODULE) {
-    write_log("openfut_hook: DllMain fired\n");
-    // Milestone-0 transport watch: arm (or note disarmed) from env once, up front, so
-    // the getaddrinfo/connect/ConnectEx detours below can log Blaze-flavored activity.
-    transport_watch::arm_from_env();
-    let ip = config::read_redirect_ip(module);
-    hooks::set_redirect_ip(ip);
-
-    let ga = iat::resolve(b"ws2_32.dll\0", b"getaddrinfo\0");
-    if !ga.is_null() {
-        let f: unsafe extern "system" fn(
-            *const u8,
-            *const u8,
-            *const ADDRINFOA,
-            *mut *mut ADDRINFOA,
-        ) -> i32 = std::mem::transmute(ga);
-        hooks::set_real(f);
-        let n = iat::patch_iat(ga, hooks::hooked_getaddrinfo as *const ());
-        let m = iat::patch_iat_in(
-            b"EAWebKit.dll\0",
-            ga,
-            hooks::hooked_getaddrinfo as *const (),
-        );
-        write_log(&format!("openfut_hook: getaddrinfo IAT patched {n}+{m}\n"));
-    }
-
-    if ssl_patch::patch_main_exe_cert_verify() {
-        write_log("ssl: main exe cert-verify patched\n");
-    } else {
-        write_log("ssl: main exe cert-verify NOT FOUND\n");
-    }
-    if ssl_patch::patch_eawebkit_cert_verify() {
-        write_log("ssl: EAWebKit cert-verify patched\n");
-    } else {
-        write_log("ssl: EAWebKit cert-verify deferred\n");
-    }
-
-    if connect_hook::install_inline_connect_hook() {
-        write_log("connect: inline-hooked\n");
-    } else {
-        write_log("connect: hook FAILED\n");
-    }
-    let wp = iat::resolve(b"ws2_32.dll\0", b"WSAConnect\0");
-    if !wp.is_null() {
-        let f: unsafe extern "system" fn(
-            usize,
-            *const u8,
-            i32,
-            *const (),
-            *const (),
-            *const (),
-            *const (),
-        ) -> i32 = std::mem::transmute(wp);
-        connect_hook::set_real_wsa_connect(f);
-        iat::patch_iat(wp, connect_hook::hooked_wsa_connect as *const ());
-        write_log("connect: WSAConnect IAT patched\n");
-    }
-
-    if connectex_hook::install_wsaioctl_hook() {
-        write_log("connectex: WSAIoctl inline-hooked\n");
-    } else {
-        write_log("connectex: WSAIoctl hook FAILED\n");
-    }
-
-    // RE instrumentation: passive logging detours on FIFA's in-process online-flow
-    // functions (GoOnline, GetInternetConnectedState, event deserializers) to see
-    // where FIFA stalls after our pushed LSX events. Deferred until anadius loads.
-    #[cfg(feature = "probe")]
-    {
-        probe::install_probes_deferred();
-        write_log("probe: deferred install scheduled\n");
-    }
-
-    // recv/send hooks removed — LSX is now handled by the native openfut-bridge
-    // LSX server (port 3216), so in-process interception is no longer needed.
-    //
-    // Except in the `capture_baseline` build: with the LSX redirect off, FIFA talks
-    // to anadius directly, and these hooks log anadius's real LSX request/response
-    // frames (pass-through, no emulation) so we can diff them against our bridge.
-    #[cfg(feature = "capture_baseline")]
-    {
-        if recv_hook::install_recv_hook() {
-            write_log("CAP: recv inline-hooked\n");
-        } else {
-            write_log("CAP: recv hook FAILED\n");
-        }
-        if recv_hook::install_send_hook() {
-            write_log("CAP: send inline-hooked\n");
-        } else {
-            write_log("CAP: send hook FAILED\n");
-        }
-    }
-
-    macro_rules! hook_iat {
-        ($dll:expr, $sym:expr, $setter:ident, $handler:expr, $ty:ty) => {{
-            let ptr = iat::resolve($dll, $sym);
-            if !ptr.is_null() {
-                let f: $ty = std::mem::transmute(ptr);
-                origin_spy::$setter(f);
-                iat::patch_iat(ptr, $handler as *const ());
-                "ok"
-            } else {
-                "miss"
-            }
-        }};
-    }
-    let ra = hook_iat!(
-        b"advapi32.dll\0",
-        b"RegQueryValueExA\0",
-        set_real_reg_a,
-        origin_spy::hooked_reg_query_a,
-        unsafe extern "system" fn(isize, *const u8, *mut u32, *mut u32, *mut u8, *mut u32) -> i32
-    );
-    let rw = hook_iat!(
-        b"advapi32.dll\0",
-        b"RegQueryValueExW\0",
-        set_real_reg_w,
-        origin_spy::hooked_reg_query_w,
-        unsafe extern "system" fn(isize, *const u16, *mut u32, *mut u32, *mut u8, *mut u32) -> i32
-    );
-    let ma = hook_iat!(
-        b"kernel32.dll\0",
-        b"OpenMutexA\0",
-        set_real_mutex_a,
-        origin_spy::hooked_open_mutex_a,
-        unsafe extern "system" fn(u32, i32, *const u8) -> isize
-    );
-    let mw = hook_iat!(
-        b"kernel32.dll\0",
-        b"OpenMutexW\0",
-        set_real_mutex_w,
-        origin_spy::hooked_open_mutex_w,
-        unsafe extern "system" fn(u32, i32, *const u16) -> isize
-    );
-    write_log(&format!(
-        "origin_spy: RegA={ra} RegW={rw} MutexA={ma} MutexW={mw}\n"
-    ));
-
-    let cv = iat::resolve(b"crypt32.dll\0", b"CertVerifyCertificateChainPolicy\0");
-    if !cv.is_null() {
-        let f: unsafe extern "system" fn(*const u8, *const (), *const (), *mut u32) -> BOOL =
-            std::mem::transmute(cv);
-        tls_bypass::set_real(f);
-        iat::patch_iat(cv, tls_bypass::hooked_cert_verify_chain_policy as *const ());
-        iat::patch_iat_in(
-            b"EAWebKit.dll\0",
-            cv,
-            tls_bypass::hooked_cert_verify_chain_policy as *const (),
-        );
-        iat::patch_iat_in(
-            b"winhttp.dll\0",
-            cv,
-            tls_bypass::hooked_cert_verify_chain_policy as *const (),
-        );
-        iat::patch_iat_in(
-            b"wininet.dll\0",
-            cv,
-            tls_bypass::hooked_cert_verify_chain_policy as *const (),
-        );
-    }
+    fifa17::install();
 }

openfut-hook/src/lsx.rs

@@ -1,548 +0,0 @@
-/// EA App LSX protocol emulator (port 3216).
-///
-/// FIFA 23 opens two concurrent connections to port 3216 (one for EbisuSDK,
-/// one for the login service).  We track up to 4 sockets in LSX_POOL with
-/// independent state per connection.
-use core::sync::atomic::{AtomicUsize, Ordering};
-use std::sync::Mutex;
-
-// ─── per-connection slot ─────────────────────────────────────────────────────
-
-struct LsxSlot {
-    socket:  AtomicUsize,   // usize::MAX = empty
-    state:   AtomicUsize,
-    seed:    AtomicUsize,
-    pending: Mutex<Option<Vec<u8>>>,
-}
-
-const MAX_LSX: usize = 4;
-
-macro_rules! empty_slot {
-    () => { LsxSlot {
-        socket:  AtomicUsize::new(usize::MAX),
-        state:   AtomicUsize::new(0),
-        seed:    AtomicUsize::new(0),
-        pending: Mutex::new(None),
-    }};
-}
-
-static POOL: [LsxSlot; MAX_LSX] = [
-    empty_slot!(), empty_slot!(), empty_slot!(), empty_slot!(),
-];
-
-fn find_slot(s: usize) -> Option<&'static LsxSlot> {
-    POOL.iter().find(|sl| sl.socket.load(Ordering::Relaxed) == s)
-}
-
-// ─── public API ──────────────────────────────────────────────────────────────
-
-pub fn set_lsx_socket(s: usize) {
-    // Try to reuse an existing slot for this socket first
-    if find_slot(s).is_some() { return; }
-    // Find a free slot
-    for sl in &POOL {
-        if sl.socket.load(Ordering::Relaxed) == usize::MAX {
-            sl.state.store(0, Ordering::Relaxed);
-            sl.seed.store(0, Ordering::Relaxed);
-            if let Ok(mut g) = sl.pending.lock() { *g = None; }
-            sl.socket.store(s, Ordering::Relaxed);
-            crate::write_log(&format!("lsx: socket registered s={s}\n"));
-            return;
-        }
-    }
-    // All slots full — evict the first one
-    let sl = &POOL[0];
-    sl.state.store(0, Ordering::Relaxed);
-    sl.seed.store(0, Ordering::Relaxed);
-    if let Ok(mut g) = sl.pending.lock() { *g = None; }
-    sl.socket.store(s, Ordering::Relaxed);
-    crate::write_log(&format!("lsx: socket registered s={s} (evicted old slot)\n"));
-}
-
-pub fn is_lsx(s: usize) -> bool {
-    find_slot(s).is_some()
-}
-
-pub fn current_socket() -> usize {
-    // Return any active LSX socket (used by select hook if needed)
-    POOL.iter()
-        .map(|sl| sl.socket.load(Ordering::Relaxed))
-        .find(|&s| s != usize::MAX)
-        .unwrap_or(usize::MAX)
-}
-
-const GREETING_KEY: &str = "cacf897a20b6d612ad0c05e011df52bb";
-const AES_KEY: [u8; 16] = [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15];
-
-pub unsafe fn on_recv(s: usize, buf: *mut u8, len: i32) -> i32 {
-    let sl = match find_slot(s) { Some(x) => x, None => return -1 };
-    let state = sl.state.load(Ordering::Relaxed);
-    crate::write_log(&format!("lsx: recv s={s} state={state}\n"));
-
-    let payload: Vec<u8> = match state {
-        0 => {
-            let xml = format!(
-                "<LSX>\r\n    <Event sender=\"EALS\">\r\n        <Challenge build=\"release\" key=\"{GREETING_KEY}\" version=\"10,5,30,15625\" />\r\n    </Event>\r\n</LSX>\0"
-            );
-            sl.state.store(1, Ordering::Relaxed);
-            xml.into_bytes()
-        }
-        _ => {
-            let mut guard = sl.pending.lock().unwrap_or_else(|e| e.into_inner());
-            match guard.take() {
-                Some(pb) => pb,
-                None => {
-                    // No pending data — return 0.
-                    // For the state-1 probe recv (FIFA checking if there is more
-                    // greeting data), 0 is the correct "no more data" signal and
-                    // FIFA proceeds to send the ChallengeResponse.
-                    return 0;
-                }
-            }
-        }
-    };
-
-    let n = payload.len().min(len as usize);
-    core::ptr::copy_nonoverlapping(payload.as_ptr(), buf, n);
-    crate::write_log(&format!("lsx: recv -> {n} bytes\n"));
-    n as i32
-}
-
-pub unsafe fn on_send(s: usize, buf: *const u8, len: i32) -> i32 {
-    let sl = match find_slot(s) { Some(x) => x, None => return len };
-    let state = sl.state.load(Ordering::Relaxed);
-    let data = core::slice::from_raw_parts(buf, len as usize);
-    let text = core::str::from_utf8(data).unwrap_or("(binary)");
-    crate::write_log(&format!("lsx: send s={s} state={state} len={len} data={}\n",
-        &text[..text.len().min(300)]));
-
-    let response = match state {
-        1 => handle_challenge(sl, data),
-        st => handle_request(sl, data, st),
-    };
-
-    if let Some(payload) = response {
-        let mut guard = sl.pending.lock().unwrap_or_else(|e| e.into_inner());
-        *guard = Some(payload);
-    }
-    sl.state.fetch_add(1, Ordering::Relaxed);
-    len
-}
-
-// ─── handshake ───────────────────────────────────────────────────────────────
-
-fn handle_challenge(sl: &LsxSlot, raw: &[u8]) -> Option<Vec<u8>> {
-    let text = core::str::from_utf8(raw).unwrap_or("").trim_end_matches('\0');
-    let parts: Vec<&str> = text.split('"').collect();
-    let id  = parts.get(3).copied().unwrap_or("1");
-    let key = parts.get(7).copied().unwrap_or("");
-    crate::write_log(&format!("lsx: challenge id={id} key={key}\n"));
-
-    let our_response = make_challenge_response(key);
-    let seed = compute_seed(&our_response);
-    sl.seed.store(seed as usize, Ordering::Relaxed);
-    crate::write_log(&format!("lsx: response={our_response} seed={seed}\n"));
-
-    let xml = format!(
-        "<LSX>\r\n    <Response id=\"{id}\" sender=\"EALS\">\r\n        <ChallengeAccepted response=\"{our_response}\" />\r\n    </Response>\r\n</LSX>\0"
-    );
-    Some(xml.into_bytes())
-}
-
-fn compute_seed(hex: &str) -> u16 {
-    let b0 = u8::from_str_radix(&hex[..2.min(hex.len())], 16).unwrap_or(0);
-    let b1 = u8::from_str_radix(&hex[2..4.min(hex.len())], 16).unwrap_or(0);
-    ((b0 as u16) << 8) | (b1 as u16)
-}
-
-fn handle_request(sl: &LsxSlot, raw: &[u8], _state: usize) -> Option<Vec<u8>> {
-    let seed = sl.seed.load(Ordering::Relaxed) as u16;
-    let text = core::str::from_utf8(raw).unwrap_or("").trim_end_matches('\0');
-
-    let decrypted = lsx_decrypt(text, seed);
-    crate::write_log(&format!("lsx: request decrypted={}\n", &decrypted[..decrypted.len().min(300)]));
-
-    let response_xml = dispatch_request(decrypted.trim());
-    crate::write_log(&format!("lsx: response={}\n", &response_xml[..response_xml.len().min(300)]));
-
-    let encrypted = lsx_encrypt(&response_xml, seed);
-    let payload = format!("{encrypted}\0");
-    Some(payload.into_bytes())
-}
-
-// ─── session dispatcher ───────────────────────────────────────────────────────
-
-pub fn dispatch(xml: &str) -> String { dispatch_request(xml) }
-
-fn dispatch_request(xml: &str) -> String {
-    let parts: Vec<&str> = xml.split('"').collect();
-    let id = parts.get(3).copied().unwrap_or("1");
-    let req_type = parts.get(4).copied().unwrap_or("");
-    crate::write_log(&format!("lsx: dispatch id={id} type={req_type}\n"));
-
-    match req_type {
-        "><GetConfig version=" => get_config(id),
-        "><GetAuthCode ClientId=" | "><GetAuthCode UserId=" => get_auth_code(id),
-        "><GetInternetConnectedState version=" => get_internet_state(id),
-        "><GetProfile index=" => get_profile(id),
-        "><GetSetting SettingId=" => {
-            let setting = parts.get(5).copied().unwrap_or("");
-            get_setting(id, setting)
-        }
-        "><QueryEntitlements UserId=" => query_entitlements(id),
-        "><RequestLicense UserId=" => request_license(id),
-        "><QueryContent UserId=" => query_content(id),
-        "><GetBlockList version=" => get_block_list(id),
-        "><QueryFriends UserId=" => query_friends(id),
-        "><QueryPresence UserId=" => query_presence(id),
-        "><SetPresence UserId=" => set_presence(id),
-        "><GetPresenceVisibility UserId=" => get_presence_visibility(id),
-        "><GetWalletBalance UserId=" => get_wallet_balance(id),
-        "><GetAllGameInfo version=" => get_all_game_info(id),
-        _ => {
-            crate::write_log(&format!("lsx: UNKNOWN type: {req_type}\n"));
-            format!("<LSX><Response id=\"{id}\" sender=\"EbisuSDK\"><Ok /></Response></LSX>\0")
-        }
-    }
-}
-
-// ─── LSX response templates ───────────────────────────────────────────────────
-
-fn get_config(id: &str) -> String {
-    format!(r#"<LSX>
-    <Response id="{id}" sender="EbisuSDK">
-        <GetConfigResponse>
-            <Service Facility="SDK" Name="EbisuSDK" />
-            <Service Facility="PROFILE" Name="EbisuSDK" />
-            <Service Facility="PRESENCE" Name="XMPP" />
-            <Service Facility="FRIENDS" Name="XMPP" />
-            <Service Facility="COMMERCE" Name="Commerce" />
-            <Service Facility="RECENTPLAYER" Name="EbisuSDK" />
-            <Service Facility="IGO" Name="EbisuSDK" />
-            <Service Facility="MISC" Name="EbisuSDK" />
-            <Service Facility="LOGIN" Name="EALS" />
-            <Service Facility="UTILITY" Name="Utility" />
-            <Service Facility="XMPP" Name="XMPP" />
-            <Service Facility="CHAT" Name="XMPP" />
-            <Service Facility="IGO_EVENT" Name="EbisuSDK" />
-            <Service Facility="EALS_EVENTS" Name="EALS" />
-            <Service Facility="LOGIN_EVENT" Name="EbisuSDK" />
-            <Service Facility="INVITE_EVENT" Name="XMPP" />
-            <Service Facility="PROFILE_EVENT" Name="EbisuSDK" />
-            <Service Facility="PRESENCE_EVENT" Name="XMPP" />
-            <Service Facility="FRIENDS_EVENT" Name="XMPP" />
-            <Service Facility="COMMERCE_EVENT" Name="Commerce" />
-            <Service Facility="CHAT_EVENT" Name="XMPP" />
-            <Service Facility="DOWNLOAD_EVENT" Name="EbisuSDK" />
-            <Service Facility="PERMISSION" Name="EbisuSDK" />
-            <Service Facility="RESOURCES" Name="EbisuSDK" />
-            <Service Facility="BLOCKED_USERS" Name="EbisuSDK" />
-            <Service Facility="BLOCKED_USER_EVENT" Name="EbisuSDK" />
-            <Service Facility="GET_USERID" Name="EbisuSDK" />
-            <Service Facility="ONLINE_STATUS_EVENT" Name="EbisuSDK" />
-            <Service Facility="ACHIEVEMENT" Name="EbisuSDK" />
-            <Service Facility="ACHIEVEMENT_EVENT" Name="EbisuSDK" />
-            <Service Facility="BROADCAST_EVENT" Name="EbisuSDK" />
-            <Service Facility="PROGRESSIVE_INSTALLATION" Name="PI" />
-            <Service Facility="PROGRESSIVE_INSTALLATION_EVENT" Name="PI" />
-            <Service Facility="CONTENT" Name="EbisuSDK" />
-        </GetConfigResponse>
-    </Response>
-</LSX>"#)
-}
-
-fn get_auth_code(id: &str) -> String {
-    format!(r#"<LSX>
-    <Response id="{id}" sender="Utility">
-        <AuthCode value="OpenFUT_fake_auth_code_v1" />
-    </Response>
-</LSX>"#)
-}
-
-fn get_internet_state(id: &str) -> String {
-    format!(r#"<LSX>
-    <Response id="{id}" sender="Utility">
-        <InternetConnectedState connected="1" />
-    </Response>
-</LSX>"#)
-}
-
-fn get_profile(id: &str) -> String {
-    format!(r#"<LSX>
-  <Response id="{id}" sender="EbisuSDK">
-    <GetProfileResponse PersonaId="1000000000001" Persona="OpenFUT_Player" Country="US" GeoCountry="US"
-        UserIndex="0" IsTrialSubscriber="false" AvatarId="1"
-        IsUnderAge="false" IsSubscriber="false" IsSteamSubscriber="false" SubscriberLevel="2"
-        CommerceCurrency="USD" UserId="2000000000001" CommerceCountry="US" />
-  </Response>
-</LSX>"#)
-}
-
-fn get_setting(id: &str, setting: &str) -> String {
-    let value = match setting { "ENVIRONMENT" => "production", _ => "false" };
-    format!(r#"<LSX>
-    <Response id="{id}" sender="EbisuSDK">
-        <GetSettingResponse Setting="{value}" />
-    </Response>
-</LSX>"#)
-}
-
-fn query_entitlements(id: &str) -> String {
-    format!(r#"<LSX>
-    <Response id="{id}" sender="Commerce">
-        <QueryEntitlementsResponse>
-            <Entitlements ItemId="Origin.OFR.50.0004658" Type="ONLINE_ACCESS"
-                EntitlementId="1021747550001" EntitlementTag="ONLINE_ACCESS"
-                Group="FIFA23PC" ResourceId="" UseCount="0"
-                Expiration="0000-00-00T00:00:00" GrantDate="2022-09-30T00:00:00"
-                LastModifiedDate="2022-09-30T00:00:00" Version="0" />
-            <Entitlements ItemId="Origin.OFR.50.0004658" Type="DEFAULT"
-                EntitlementId="1021747550002" EntitlementTag="ONLINE_ACCESS"
-                Group="FIFA23PC" ResourceId="" UseCount="0"
-                Expiration="0000-00-00T00:00:00" GrantDate="2022-09-30T00:00:00"
-                LastModifiedDate="2022-09-30T00:00:00" Version="0" />
-        </QueryEntitlementsResponse>
-    </Response>
-</LSX>"#)
-}
-
-fn request_license(id: &str) -> String {
-    format!(r#"<LSX>
-    <Response sender="EbisuSDK" id="{id}">
-        <RequestLicenseResponse License="OpenFUT_fake_license_v1" />
-    </Response>
-</LSX>"#)
-}
-
-fn query_content(id: &str) -> String {
-    format!(r#"<LSX>
-    <Response id="{id}" sender="EbisuSDK">
-        <QueryContentResponse>
-            <Content Gamestate="READY_TO_PLAY" progressValue="0"
-                contentID="Origin.OFR.50.0004658"
-                installedVersion="1.0.0.0" availableVersion="1.0.0.0"
-                displayName="FIFA 23" />
-        </QueryContentResponse>
-    </Response>
-</LSX>"#)
-}
-
-fn get_block_list(id: &str) -> String {
-    format!(r#"<LSX><Response id="{id}" sender="EbisuSDK"><GetBlockListResponse /></Response></LSX>"#)
-}
-
-fn query_friends(id: &str) -> String {
-    format!(r#"<LSX><Response id="{id}" sender="XMPP"><QueryFriendsResponse /></Response></LSX>"#)
-}
-
-fn query_presence(id: &str) -> String {
-    format!(r#"<LSX><Response id="{id}" sender="XMPP"><QueryPresenceResponse UserId="2000000000001" PersonaId="1000000000001" /></Response></LSX>"#)
-}
-
-fn set_presence(id: &str) -> String {
-    format!(r#"<LSX><Response id="{id}" sender="XMPP"><SetPresenceResponse /></Response></LSX>"#)
-}
-
-fn get_presence_visibility(id: &str) -> String {
-    format!(r#"<LSX><Response id="{id}" sender="EbisuSDK"><GetPresenceVisibilityResponse Visibility="FRIENDS" /></Response></LSX>"#)
-}
-
-fn get_wallet_balance(id: &str) -> String {
-    format!(r#"<LSX><Response id="{id}" sender="Commerce"><GetWalletBalanceResponse Balance="0" Currency="USD" /></Response></LSX>"#)
-}
-
-fn get_all_game_info(id: &str) -> String {
-    format!(r#"<LSX><Response id="{id}" sender="EbisuSDK"><GetAllGameInfoResponse /></Response></LSX>"#)
-}
-
-// ─── AES-128-ECB (pure Rust) ──────────────────────────────────────────────────
-
-#[rustfmt::skip]
-const SBOX: [u8; 256] = [
-    0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,
-    0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,
-    0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,
-    0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,
-    0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,
-    0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,
-    0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,
-    0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,
-    0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,
-    0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,
-    0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,
-    0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,
-    0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,
-    0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,
-    0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,
-    0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16,
-];
-
-fn xtime(a: u8) -> u8 { if a & 0x80 != 0 { (a << 1) ^ 0x1b } else { a << 1 } }
-fn mul(mut a: u8, mut b: u8) -> u8 {
-    let mut r = 0u8;
-    while b > 0 { if b & 1 != 0 { r ^= a; } a = xtime(a); b >>= 1; }
-    r
-}
-
-fn sub_bytes(s: &mut [u8; 16]) { for b in s.iter_mut() { *b = SBOX[*b as usize]; } }
-fn shift_rows(s: &mut [u8; 16]) {
-    let t = s[1]; s[1]=s[5]; s[5]=s[9]; s[9]=s[13]; s[13]=t;
-    s.swap(2,10); s.swap(6,14);
-    let t = s[15]; s[15]=s[11]; s[11]=s[7]; s[7]=s[3]; s[3]=t;
-}
-fn mix_col(s: &mut [u8; 16], c: usize) {
-    let (a,b,c2,d) = (s[c],s[c+4],s[c+8],s[c+12]);
-    s[c]    = mul(2,a)^mul(3,b)^c2^d;
-    s[c+4]  = a^mul(2,b)^mul(3,c2)^d;
-    s[c+8]  = a^b^mul(2,c2)^mul(3,d);
-    s[c+12] = mul(3,a)^b^c2^mul(2,d);
-}
-fn mix_columns(s: &mut [u8; 16]) { for c in 0..4 { mix_col(s,c); } }
-fn add_round_key(s: &mut [u8; 16], rk: &[u8; 16]) { for i in 0..16 { s[i] ^= rk[i]; } }
-
-fn expand_key(key: &[u8; 16]) -> [[u8; 16]; 11] {
-    let rcon: [u8; 10] = [0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x1b,0x36];
-    let mut w = [[0u8; 4]; 44];
-    for i in 0..4 { w[i] = [key[4*i],key[4*i+1],key[4*i+2],key[4*i+3]]; }
-    for i in 4..44 {
-        let mut t = w[i-1];
-        if i % 4 == 0 {
-            t.rotate_left(1);
-            for b in &mut t { *b = SBOX[*b as usize]; }
-            t[0] ^= rcon[i/4-1];
-        }
-        w[i] = [w[i-4][0]^t[0], w[i-4][1]^t[1], w[i-4][2]^t[2], w[i-4][3]^t[3]];
-    }
-    let mut rk = [[0u8; 16]; 11];
-    for r in 0..11 { for c in 0..4 { rk[r][4*c..4*c+4].copy_from_slice(&w[r*4+c]); } }
-    rk
-}
-
-fn aes_block_encrypt(block: &[u8; 16], rk: &[[u8; 16]; 11]) -> [u8; 16] {
-    let mut s = *block;
-    add_round_key(&mut s, &rk[0]);
-    for r in 1..10 { sub_bytes(&mut s); shift_rows(&mut s); mix_columns(&mut s); add_round_key(&mut s, &rk[r]); }
-    sub_bytes(&mut s); shift_rows(&mut s); add_round_key(&mut s, &rk[10]);
-    s
-}
-
-fn aes_ecb_pkcs7_encrypt(key: &[u8; 16], plaintext: &[u8]) -> Vec<u8> {
-    let rk = expand_key(key);
-    let pad = 16 - (plaintext.len() % 16);
-    let mut padded = plaintext.to_vec();
-    padded.resize(plaintext.len() + pad, pad as u8);
-    let mut out = Vec::with_capacity(padded.len());
-    for chunk in padded.chunks(16) {
-        let mut b = [0u8; 16]; b.copy_from_slice(chunk);
-        out.extend_from_slice(&aes_block_encrypt(&b, &rk));
-    }
-    out
-}
-
-#[rustfmt::skip]
-const INV_SBOX: [u8; 256] = [
-    0x52,0x09,0x6a,0xd5,0x30,0x36,0xa5,0x38,0xbf,0x40,0xa3,0x9e,0x81,0xf3,0xd7,0xfb,
-    0x7c,0xe3,0x39,0x82,0x9b,0x2f,0xff,0x87,0x34,0x8e,0x43,0x44,0xc4,0xde,0xe9,0xcb,
-    0x54,0x7b,0x94,0x32,0xa6,0xc2,0x23,0x3d,0xee,0x4c,0x95,0x0b,0x42,0xfa,0xc3,0x4e,
-    0x08,0x2e,0xa1,0x66,0x28,0xd9,0x24,0xb2,0x76,0x5b,0xa2,0x49,0x6d,0x8b,0xd1,0x25,
-    0x72,0xf8,0xf6,0x64,0x86,0x68,0x98,0x16,0xd4,0xa4,0x5c,0xcc,0x5d,0x65,0xb6,0x92,
-    0x6c,0x70,0x48,0x50,0xfd,0xed,0xb9,0xda,0x5e,0x15,0x46,0x57,0xa7,0x8d,0x9d,0x84,
-    0x90,0xd8,0xab,0x00,0x8c,0xbc,0xd3,0x0a,0xf7,0xe4,0x58,0x05,0xb8,0xb3,0x45,0x06,
-    0xd0,0x2c,0x1e,0x8f,0xca,0x3f,0x0f,0x02,0xc1,0xaf,0xbd,0x03,0x01,0x13,0x8a,0x6b,
-    0x3a,0x91,0x11,0x41,0x4f,0x67,0xdc,0xea,0x97,0xf2,0xcf,0xce,0xf0,0xb4,0xe6,0x73,
-    0x96,0xac,0x74,0x22,0xe7,0xad,0x35,0x85,0xe2,0xf9,0x37,0xe8,0x1c,0x75,0xdf,0x6e,
-    0x47,0xf1,0x1a,0x71,0x1d,0x29,0xc5,0x89,0x6f,0xb7,0x62,0x0e,0xaa,0x18,0xbe,0x1b,
-    0xfc,0x56,0x3e,0x4b,0xc6,0xd2,0x79,0x20,0x9a,0xdb,0xc0,0xfe,0x78,0xcd,0x5a,0xf4,
-    0x1f,0xdd,0xa8,0x33,0x88,0x07,0xc7,0x31,0xb1,0x12,0x10,0x59,0x27,0x80,0xec,0x5f,
-    0x60,0x51,0x7f,0xa9,0x19,0xb5,0x4a,0x0d,0x2d,0xe5,0x7a,0x9f,0x93,0xc9,0x9c,0xef,
-    0xa0,0xe0,0x3b,0x4d,0xae,0x2a,0xf5,0xb0,0xc8,0xeb,0xbb,0x3c,0x83,0x53,0x99,0x61,
-    0x17,0x2b,0x04,0x7e,0xba,0x77,0xd6,0x26,0xe1,0x69,0x14,0x63,0x55,0x21,0x0c,0x7d,
-];
-
-fn inv_sub_bytes(s: &mut [u8; 16]) { for b in s.iter_mut() { *b = INV_SBOX[*b as usize]; } }
-fn inv_shift_rows(s: &mut [u8; 16]) {
-    let t = s[13]; s[13]=s[9]; s[9]=s[5]; s[5]=s[1]; s[1]=t;
-    s.swap(2,10); s.swap(6,14);
-    let t = s[3]; s[3]=s[7]; s[7]=s[11]; s[11]=s[15]; s[15]=t;
-}
-fn inv_mix_col(s: &mut [u8; 16], c: usize) {
-    let (a,b,c2,d) = (s[c],s[c+4],s[c+8],s[c+12]);
-    s[c]    = mul(0x0e,a)^mul(0x0b,b)^mul(0x0d,c2)^mul(0x09,d);
-    s[c+4]  = mul(0x09,a)^mul(0x0e,b)^mul(0x0b,c2)^mul(0x0d,d);
-    s[c+8]  = mul(0x0d,a)^mul(0x09,b)^mul(0x0e,c2)^mul(0x0b,d);
-    s[c+12] = mul(0x0b,a)^mul(0x0d,b)^mul(0x09,c2)^mul(0x0e,d);
-}
-fn inv_mix_columns(s: &mut [u8; 16]) { for c in 0..4 { inv_mix_col(s,c); } }
-
-fn aes_ecb_decrypt_nopad(key: &[u8; 16], data: &[u8]) -> Vec<u8> {
-    let rk = expand_key(key);
-    let mut out = Vec::with_capacity(data.len());
-    for chunk in data.chunks(16) {
-        if chunk.len() < 16 { break; }
-        let mut b = [0u8; 16]; b.copy_from_slice(chunk);
-        add_round_key(&mut b, &rk[10]);
-        inv_shift_rows(&mut b); inv_sub_bytes(&mut b);
-        for r in (1..10).rev() {
-            add_round_key(&mut b, &rk[r]);
-            inv_mix_columns(&mut b); inv_shift_rows(&mut b); inv_sub_bytes(&mut b);
-        }
-        add_round_key(&mut b, &rk[0]);
-        out.extend_from_slice(&b);
-    }
-    if let Some(&pad) = out.last() {
-        let pad = pad as usize;
-        if pad <= 16 && out.len() >= pad { out.truncate(out.len() - pad); }
-    }
-    out
-}
-
-// ─── CRandom ─────────────────────────────────────────────────────────────────
-
-struct CRandom { seed: u32 }
-impl CRandom {
-    fn new() -> Self { Self { seed: 0 } }
-    fn seed_with(&mut self, s: u32) { self.seed = s; }
-    fn rand(&mut self) -> u32 {
-        self.seed = self.seed.wrapping_mul(214013).wrapping_add(2531011);
-        (self.seed >> 16) & 0xFFFF
-    }
-}
-
-fn get_lsx_key(seed: u16) -> [u8; 16] {
-    let mut rng = CRandom::new();
-    rng.seed_with(7);
-    let next = rng.rand();
-    rng.seed_with(next.wrapping_add(seed as u32));
-    let mut k = [0u8; 16];
-    for b in &mut k { *b = rng.rand() as u8; }
-    k
-}
-
-// ─── session encrypt/decrypt ─────────────────────────────────────────────────
-
-fn hex_to_bytes(s: &str) -> Vec<u8> {
-    let s: String = s.chars().filter(|c| c.is_ascii_hexdigit()).collect();
-    if s.len() % 2 != 0 { return Vec::new(); }
-    (0..s.len()/2).filter_map(|i| u8::from_str_radix(&s[2*i..2*i+2], 16).ok()).collect()
-}
-
-fn bytes_to_hex(b: &[u8]) -> String {
-    b.iter().map(|x| format!("{x:02x}")).collect()
-}
-
-pub fn lsx_decrypt(hex_data: &str, seed: u16) -> String {
-    let key = get_lsx_key(seed);
-    let ct = hex_to_bytes(hex_data);
-    if ct.is_empty() { return String::new(); }
-    let plain = aes_ecb_decrypt_nopad(&key, &ct);
-    String::from_utf8_lossy(&plain).trim_matches('\0').to_string()
-}
-
-pub fn lsx_encrypt(text: &str, seed: u16) -> String {
-    let key = get_lsx_key(seed);
-    bytes_to_hex(&aes_ecb_pkcs7_encrypt(&key, text.as_bytes()))
-}
-
-pub fn make_challenge_response(key: &str) -> String {
-    bytes_to_hex(&aes_ecb_pkcs7_encrypt(&AES_KEY, key.as_bytes()))
-}

openfut-hook/src/offline_seasons_pma.rs

@@ -0,0 +1,399 @@
+//! FIFA 17 Offline Seasons PMA completion compatibility repair.
+//!
+//! Retail-compatible main-menu Kick Off completes the PMA instructions state by
+//! broadcasting event `1` through the mode-zero child's callback dispatcher. FUT
+//! Offline Seasons reaches the same PMA UI state but its completed drill scenario
+//! broadcasts event `5`, which returns the UI to state `0` and leaves the drill
+//! active. This default-off repair intercepts that shared callback dispatcher and
+//! rewrites only the fully identified Offline Seasons `5` to `1`, then calls the
+//! original dispatcher so every native subscriber observes the working completion.
+
+use core::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+
+use windows_sys::Win32::System::LibraryLoader::GetModuleHandleA;
+
+use crate::sbc_trace::{guarded_u8, guarded_usize, readable_range, validate_cards_build};
+use crate::season_trace::install_detour;
+use crate::write_log;
+
+const ENABLE_ENV: &str = "OPENFUT_FIFA17_OFFLINE_SEASONS_PMA_FIX";
+
+const CALLBACK_DISPATCHER_RVA: usize = 0x07ac_87b0;
+const CALLBACK_DISPATCHER_COPY_LEN: usize = 15;
+const CALLBACK_DISPATCHER_SIGNATURE: [u8; CALLBACK_DISPATCHER_COPY_LEN] = [
+    0x48, 0x89, 0x5c, 0x24, 0x08, 0x48, 0x89, 0x74, 0x24, 0x10, 0x57, 0x48, 0x83, 0xec, 0x20,
+];
+
+const GAMEPLAY_GLOBAL_SLOT_RVA: usize = 0x04bf_b910;
+const CALLBACK_DISPATCHER_VTABLE_RVA: usize = 0x03ae_9ba0;
+const PMA_INSTRUCTIONS_VTABLE_RVA: usize = 0x03af_2750;
+const PMA_INSTRUCTIONS_HANDLER_RVA: usize = 0x07ac_91e0;
+const FREE_ROAM_VTABLE_RVA: usize = 0x03ae_df58;
+const FREE_ROAM_DTOR_RVA: usize = 0x07a5_db70;
+
+const FUT_SECONDARY_LISTENER_VTABLE_RVA: usize = 0x20e9b8;
+const FUT_SELECTED_LISTENER_VTABLE_RVA: usize = 0x20fea8;
+
+const EVENT_COMPLETE_ADVANCE: u32 = 1;
+const EVENT_DRILL_COMPLETE: u32 = 5;
+const PMA_UI_INSTRUCTIONS_STATE: usize = 4;
+const FREE_ROAM_ACTIVE_PMA_STATE: i32 = 9;
+const OFFLINE_SEASONS_MODE_ID: i32 = 21;
+
+static REPAIR_ACTIVE: AtomicBool = AtomicBool::new(false);
+static DISPATCHER_TRAMPOLINE: AtomicUsize = AtomicUsize::new(0);
+static CANDIDATE_REPORTS: AtomicUsize = AtomicUsize::new(0);
+static MAIN_BASE: AtomicUsize = AtomicUsize::new(0);
+static CARDS_BASE: AtomicUsize = AtomicUsize::new(0);
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Decision {
+    Rewrite,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[repr(usize)]
+enum Rejection {
+    None,
+    RepairDisabled,
+    DispatcherClass,
+    InstructionsState,
+    ListenerTopology,
+    FreeRoamClass,
+    FreeRoamState,
+    FreeRoamNotReady,
+    SecondaryListenerClass,
+    SelectedListenerClass,
+    OfflineSeasonsMode,
+}
+
+#[derive(Clone, Copy, Debug)]
+struct DecisionInput {
+    repair_enabled: bool,
+    dispatcher_class: bool,
+    instructions_state: bool,
+    selected_index: Option<i32>,
+    free_roam_class: bool,
+    free_roam_state: Option<i32>,
+    free_roam_ready: Option<i32>,
+    secondary_listener_class: bool,
+    selected_listener_class: bool,
+    selected_mode: Option<i32>,
+}
+
+fn decide(input: DecisionInput) -> Result<Decision, Rejection> {
+    if !input.repair_enabled {
+        return Err(Rejection::RepairDisabled);
+    }
+    if !input.dispatcher_class {
+        return Err(Rejection::DispatcherClass);
+    }
+    if !input.instructions_state {
+        return Err(Rejection::InstructionsState);
+    }
+    if input.selected_index != Some(2) {
+        return Err(Rejection::ListenerTopology);
+    }
+    if !input.free_roam_class {
+        return Err(Rejection::FreeRoamClass);
+    }
+    if input.free_roam_state != Some(FREE_ROAM_ACTIVE_PMA_STATE) {
+        return Err(Rejection::FreeRoamState);
+    }
+    if input.free_roam_ready != Some(1) {
+        return Err(Rejection::FreeRoamNotReady);
+    }
+    if !input.secondary_listener_class {
+        return Err(Rejection::SecondaryListenerClass);
+    }
+    if !input.selected_listener_class {
+        return Err(Rejection::SelectedListenerClass);
+    }
+    if input.selected_mode != Some(OFFLINE_SEASONS_MODE_ID) {
+        return Err(Rejection::OfflineSeasonsMode);
+    }
+    Ok(Decision::Rewrite)
+}
+
+fn enabled(value: Option<&str>) -> bool {
+    value == Some("1")
+}
+
+unsafe fn read_i32(address: usize) -> Option<i32> {
+    readable_range(address, 4).then(|| core::ptr::read_volatile(address as *const i32))
+}
+
+unsafe fn expected_pointer(address: usize, expected: usize) -> bool {
+    guarded_usize(address) == Some(expected)
+}
+
+unsafe fn main_image_matches(base: usize) -> bool {
+    expected_pointer(
+        base + CALLBACK_DISPATCHER_VTABLE_RVA,
+        base + CALLBACK_DISPATCHER_RVA,
+    ) && expected_pointer(
+        base + PMA_INSTRUCTIONS_VTABLE_RVA,
+        base + PMA_INSTRUCTIONS_HANDLER_RVA,
+    ) && expected_pointer(base + FREE_ROAM_VTABLE_RVA, base + FREE_ROAM_DTOR_RVA)
+}
+
+unsafe fn instructions_state_active(dispatcher: usize, main_base: usize) -> bool {
+    let sentinel = match dispatcher.checked_add(8) {
+        Some(value) => value,
+        None => return false,
+    };
+    let mut node = match guarded_usize(sentinel) {
+        Some(value) => value,
+        None => return false,
+    };
+    for _ in 0..8 {
+        if node == sentinel {
+            return false;
+        }
+        let listener = match node
+            .checked_add(0x10)
+            .and_then(|address| guarded_usize(address))
+        {
+            Some(value) if value != 0 => value,
+            _ => return false,
+        };
+        if guarded_usize(listener) == Some(main_base + PMA_INSTRUCTIONS_VTABLE_RVA) {
+            let parent = listener
+                .checked_add(8)
+                .and_then(|address| guarded_usize(address));
+            let machine = parent
+                .and_then(|value| value.checked_add(8))
+                .and_then(|address| guarded_usize(address));
+            let states = machine
+                .and_then(|value| value.checked_add(8))
+                .and_then(|address| guarded_usize(address));
+            let current = machine
+                .and_then(|value| value.checked_add(0x10))
+                .and_then(|address| guarded_usize(address));
+            let state_four = states
+                .and_then(|value| value.checked_add(PMA_UI_INSTRUCTIONS_STATE * 8))
+                .and_then(|address| guarded_usize(address));
+            return current == Some(listener)
+                && state_four == Some(listener)
+                && guarded_u8(listener + 0x18) == Some(0);
+        }
+        node = match guarded_usize(node) {
+            Some(value) => value,
+            None => return false,
+        };
+    }
+    false
+}
+
+unsafe fn snapshot(dispatcher: usize) -> DecisionInput {
+    let main_base = MAIN_BASE.load(Ordering::Acquire);
+    let cards_base = CARDS_BASE.load(Ordering::Acquire);
+    let dispatcher_class =
+        guarded_usize(dispatcher) == Some(main_base + CALLBACK_DISPATCHER_VTABLE_RVA);
+
+    let gameplay_global = guarded_usize(main_base + GAMEPLAY_GLOBAL_SLOT_RVA);
+    let listener_manager = gameplay_global
+        .and_then(|value| value.checked_add(0x58))
+        .and_then(|address| guarded_usize(address));
+    let table = listener_manager.and_then(|value| guarded_usize(value));
+    let selected_index = table
+        .and_then(|value| value.checked_add(0x20))
+        .and_then(|address| read_i32(address));
+    let free_roam = table.and_then(|value| guarded_usize(value));
+    let secondary = table
+        .and_then(|value| value.checked_add(8))
+        .and_then(|address| guarded_usize(address));
+    let selected = match (table, selected_index) {
+        (Some(value), Some(index @ 0..=2)) => value
+            .checked_add(index as usize * 8)
+            .and_then(|address| guarded_usize(address)),
+        _ => None,
+    };
+
+    DecisionInput {
+        repair_enabled: REPAIR_ACTIVE.load(Ordering::Acquire),
+        dispatcher_class,
+        instructions_state: instructions_state_active(dispatcher, main_base),
+        selected_index,
+        free_roam_class: free_roam.and_then(|value| guarded_usize(value))
+            == Some(main_base + FREE_ROAM_VTABLE_RVA),
+        free_roam_state: free_roam
+            .and_then(|value| value.checked_add(0x30))
+            .and_then(|address| read_i32(address)),
+        free_roam_ready: free_roam
+            .and_then(|value| value.checked_add(0x124))
+            .and_then(|address| read_i32(address)),
+        secondary_listener_class: secondary.and_then(|value| guarded_usize(value))
+            == Some(cards_base + FUT_SECONDARY_LISTENER_VTABLE_RVA),
+        selected_listener_class: selected.and_then(|value| guarded_usize(value))
+            == Some(cards_base + FUT_SELECTED_LISTENER_VTABLE_RVA),
+        selected_mode: selected
+            .and_then(|value| value.checked_add(0x18))
+            .and_then(|address| read_i32(address)),
+    }
+}
+
+type DispatcherFn = unsafe extern "system" fn(usize, u32, usize, usize) -> usize;
+
+unsafe extern "system" fn dispatcher_wrapper(
+    dispatcher: usize,
+    event: u32,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    let trampoline = DISPATCHER_TRAMPOLINE.load(Ordering::Acquire);
+    if trampoline == 0 {
+        return 0;
+    }
+    let original: DispatcherFn = core::mem::transmute(trampoline);
+    if event != EVENT_DRILL_COMPLETE {
+        return original(dispatcher, event, r8, r9);
+    }
+
+    let input = snapshot(dispatcher);
+    let decision = decide(input);
+    let rewritten = matches!(decision, Ok(Decision::Rewrite));
+    let forwarded_event = if rewritten {
+        EVENT_COMPLETE_ADVANCE
+    } else {
+        event
+    };
+    let report = CANDIDATE_REPORTS.fetch_add(1, Ordering::Relaxed);
+    if report < 16 {
+        write_log(&format!(
+            "[OpenFUT][OfflineSeasons] PMA completion observed event={event} dispatcher={dispatcher:#x} pma_state4={} selected_index={} selected_mode={} free_roam_state={} ready={} action={} rejection={:?}\n",
+            input.instructions_state,
+            input.selected_index.unwrap_or(-1),
+            input.selected_mode.unwrap_or(-1),
+            input.free_roam_state.unwrap_or(-1),
+            input.free_roam_ready.unwrap_or(-1),
+            if rewritten { "rewrite-5-to-1" } else { "native" },
+            decision.err().unwrap_or(Rejection::None),
+        ));
+    }
+    original(dispatcher, forwarded_event, r8, r9)
+}
+
+unsafe fn worker() {
+    let main_base = GetModuleHandleA(core::ptr::null()) as usize;
+    if main_base == 0 || !main_image_matches(main_base) {
+        write_log("[OpenFUT][OfflineSeasons] main FIFA image mismatch; inactive\n");
+        return;
+    }
+
+    let mut cards_base = 0usize;
+    for _ in 0..600u32 {
+        cards_base = GetModuleHandleA(c"CardsDLL_Win64_retail.dll".as_ptr().cast()) as usize;
+        if cards_base != 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(500));
+    }
+    if cards_base == 0 || !validate_cards_build(cards_base) {
+        write_log("[OpenFUT][OfflineSeasons] CardsDLL unavailable/invalid; inactive\n");
+        return;
+    }
+
+    MAIN_BASE.store(main_base, Ordering::Release);
+    CARDS_BASE.store(cards_base, Ordering::Release);
+    if !install_detour(
+        main_base,
+        CALLBACK_DISPATCHER_RVA,
+        "OfflineSeasons_PMA_callback_dispatcher",
+        CALLBACK_DISPATCHER_COPY_LEN,
+        &CALLBACK_DISPATCHER_SIGNATURE,
+        dispatcher_wrapper as *const () as usize,
+        &DISPATCHER_TRAMPOLINE,
+    ) {
+        write_log("[OpenFUT][OfflineSeasons] callback dispatcher hook failed; inactive\n");
+        return;
+    }
+    REPAIR_ACTIVE.store(true, Ordering::Release);
+    write_log("[OpenFUT][OfflineSeasons] PMA completion repair ARMED\n");
+}
+
+pub(crate) fn install() {
+    if !enabled(std::env::var(ENABLE_ENV).ok().as_deref()) {
+        write_log("[OpenFUT][OfflineSeasons] PMA completion repair disabled\n");
+        return;
+    }
+    write_log("[OpenFUT][OfflineSeasons] PMA completion repair requested\n");
+    std::thread::spawn(|| unsafe { worker() });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn valid_input() -> DecisionInput {
+        DecisionInput {
+            repair_enabled: true,
+            dispatcher_class: true,
+            instructions_state: true,
+            selected_index: Some(2),
+            free_roam_class: true,
+            free_roam_state: Some(9),
+            free_roam_ready: Some(1),
+            secondary_listener_class: true,
+            selected_listener_class: true,
+            selected_mode: Some(21),
+        }
+    }
+
+    #[test]
+    fn feature_is_default_off() {
+        assert!(!enabled(None));
+        assert!(!enabled(Some("0")));
+        assert!(!enabled(Some("true")));
+        assert!(enabled(Some("1")));
+    }
+
+    #[test]
+    fn exact_offline_seasons_evidence_rewrites() {
+        assert_eq!(decide(valid_input()), Ok(Decision::Rewrite));
+    }
+
+    #[test]
+    fn every_runtime_gate_fails_closed() {
+        let cases: &[(Rejection, fn(&mut DecisionInput))] = &[
+            (Rejection::RepairDisabled, |input: &mut DecisionInput| {
+                input.repair_enabled = false
+            }),
+            (Rejection::DispatcherClass, |input: &mut DecisionInput| {
+                input.dispatcher_class = false
+            }),
+            (Rejection::InstructionsState, |input: &mut DecisionInput| {
+                input.instructions_state = false
+            }),
+            (Rejection::ListenerTopology, |input: &mut DecisionInput| {
+                input.selected_index = Some(1)
+            }),
+            (Rejection::FreeRoamClass, |input: &mut DecisionInput| {
+                input.free_roam_class = false
+            }),
+            (Rejection::FreeRoamState, |input: &mut DecisionInput| {
+                input.free_roam_state = Some(10)
+            }),
+            (Rejection::FreeRoamNotReady, |input: &mut DecisionInput| {
+                input.free_roam_ready = Some(0)
+            }),
+            (
+                Rejection::SecondaryListenerClass,
+                |input: &mut DecisionInput| input.secondary_listener_class = false,
+            ),
+            (
+                Rejection::SelectedListenerClass,
+                |input: &mut DecisionInput| input.selected_listener_class = false,
+            ),
+            (
+                Rejection::OfflineSeasonsMode,
+                |input: &mut DecisionInput| input.selected_mode = Some(1),
+            ),
+        ];
+        for &(expected, mutate) in cases {
+            let mut input = valid_input();
+            mutate(&mut input);
+            assert_eq!(decide(input), Err(expected));
+        }
+    }
+}

openfut-hook/src/origin_spy.rs

@@ -1,137 +0,0 @@
-/// Hooks RegQueryValueExA/W and OpenMutexA/W to log what the Origin SDK is checking.
-use std::sync::OnceLock;
-
-type RegQueryValueExAFn = unsafe extern "system" fn(
-    hkey: isize,
-    lpvaluename: *const u8,
-    lpreserved: *mut u32,
-    lptype: *mut u32,
-    lpdata: *mut u8,
-    lpcbdata: *mut u32,
-) -> i32;
-
-type RegQueryValueExWFn = unsafe extern "system" fn(
-    hkey: isize,
-    lpvaluename: *const u16,
-    lpreserved: *mut u32,
-    lptype: *mut u32,
-    lpdata: *mut u8,
-    lpcbdata: *mut u32,
-) -> i32;
-
-type OpenMutexAFn = unsafe extern "system" fn(u32, i32, *const u8) -> isize;
-type OpenMutexWFn = unsafe extern "system" fn(u32, i32, *const u16) -> isize;
-
-static REAL_REG_A: OnceLock<RegQueryValueExAFn> = OnceLock::new();
-static REAL_REG_W: OnceLock<RegQueryValueExWFn> = OnceLock::new();
-static REAL_MUTEX_A: OnceLock<OpenMutexAFn> = OnceLock::new();
-static REAL_MUTEX_W: OnceLock<OpenMutexWFn> = OnceLock::new();
-
-pub fn set_real_reg_a(f: RegQueryValueExAFn) {
-    let _ = REAL_REG_A.set(f);
-}
-pub fn set_real_reg_w(f: RegQueryValueExWFn) {
-    let _ = REAL_REG_W.set(f);
-}
-pub fn set_real_mutex_a(f: OpenMutexAFn) {
-    let _ = REAL_MUTEX_A.set(f);
-}
-pub fn set_real_mutex_w(f: OpenMutexWFn) {
-    let _ = REAL_MUTEX_W.set(f);
-}
-
-fn narrow_to_string(p: *const u8) -> String {
-    if p.is_null() {
-        return "(null)".into();
-    }
-    let bytes = unsafe { std::ffi::CStr::from_ptr(p as *const i8) };
-    bytes.to_string_lossy().into_owned()
-}
-
-fn wide_to_string(p: *const u16) -> String {
-    if p.is_null() {
-        return "(null)".into();
-    }
-    let mut len = 0usize;
-    unsafe {
-        while *p.add(len) != 0 {
-            len += 1;
-        }
-    }
-    String::from_utf16_lossy(unsafe { std::slice::from_raw_parts(p, len) })
-}
-
-fn is_interesting(name: &str) -> bool {
-    name.contains("LSX")
-        || name.contains("Origin")
-        || name.contains("EAL")
-        || name.contains("Client")
-        || name.contains("lsx")
-        || name.contains("Port")
-        || name.contains("EA")
-        || name.contains("Connection")
-}
-
-pub unsafe extern "system" fn hooked_reg_query_a(
-    hkey: isize,
-    lpvaluename: *const u8,
-    lpreserved: *mut u32,
-    lptype: *mut u32,
-    lpdata: *mut u8,
-    lpcbdata: *mut u32,
-) -> i32 {
-    let name = narrow_to_string(lpvaluename);
-    let real = REAL_REG_A.get().copied().unwrap();
-    let ret = real(hkey, lpvaluename, lpreserved, lptype, lpdata, lpcbdata);
-    if is_interesting(&name) {
-        crate::write_log(&format!("origin_spy: RegQueryValueExA({name}) → {ret}\n"));
-    }
-    ret
-}
-
-pub unsafe extern "system" fn hooked_reg_query_w(
-    hkey: isize,
-    lpvaluename: *const u16,
-    lpreserved: *mut u32,
-    lptype: *mut u32,
-    lpdata: *mut u8,
-    lpcbdata: *mut u32,
-) -> i32 {
-    let name = wide_to_string(lpvaluename);
-    let real = REAL_REG_W.get().copied().unwrap();
-    let ret = real(hkey, lpvaluename, lpreserved, lptype, lpdata, lpcbdata);
-    if is_interesting(&name) {
-        crate::write_log(&format!("origin_spy: RegQueryValueExW({name}) → {ret}\n"));
-    }
-    ret
-}
-
-pub unsafe extern "system" fn hooked_open_mutex_a(
-    dwdesiredaccess: u32,
-    binherithandle: i32,
-    lpmutexname: *const u8,
-) -> isize {
-    let name = narrow_to_string(lpmutexname);
-    let real = REAL_MUTEX_A.get().copied().unwrap();
-    let handle = real(dwdesiredaccess, binherithandle, lpmutexname);
-    crate::write_log(&format!(
-        "origin_spy: OpenMutexA({name}) → {}\n",
-        if handle == 0 { "NOT_FOUND" } else { "FOUND" }
-    ));
-    handle
-}
-
-pub unsafe extern "system" fn hooked_open_mutex_w(
-    dwdesiredaccess: u32,
-    binherithandle: i32,
-    lpmutexname: *const u16,
-) -> isize {
-    let name = wide_to_string(lpmutexname);
-    let real = REAL_MUTEX_W.get().copied().unwrap();
-    let handle = real(dwdesiredaccess, binherithandle, lpmutexname);
-    crate::write_log(&format!(
-        "origin_spy: OpenMutexW({name}) → {}\n",
-        if handle == 0 { "NOT_FOUND" } else { "FOUND" }
-    ));
-    handle
-}

openfut-hook/src/patch_mem.rs

@@ -0,0 +1,358 @@
+//! Generic, fail-closed byte-patch primitive shared by per-game compatibility
+//! patch tables (currently FIFA 17's TLS/store gates in [`crate::fifa17_tls`]).
+//!
+//! The decision logic is expressed against the [`Mem`] trait rather than raw
+//! process memory, so every outcome — ORIGINAL / ALREADY_PATCHED / MISMATCH and
+//! the write/verify path — is unit-testable on the host without a live client.
+//! [`WinMem`] is the in-process Windows implementation used at runtime.
+//!
+//! FAIL-CLOSED INVARIANT: a site is written only when its live bytes are *exactly*
+//! the known original. Already-patched is an idempotent no-op; anything else is
+//! reported and left untouched — an unrecognised or not-yet-unpacked build is
+//! never blindly overwritten.
+
+/// Longest patch payload across all tables (FIFA17 GATE1 is 6 bytes). Sizes the
+/// fixed stack buffers so no slicing panic is reachable from the patch logic.
+pub const MAX_PATCH_LEN: usize = 6;
+
+/// Byte-level access to the target's address space.
+pub trait Mem {
+    /// Fill `buf` from `addr`. `false` = not readable yet (page uncommitted /
+    /// module not mapped / not unpacked) — the caller waits, it is not an error.
+    fn read(&self, addr: usize, buf: &mut [u8]) -> bool;
+    /// Write `data` at `addr`. `false` = the write could not be performed.
+    fn write(&mut self, addr: usize, data: &[u8]) -> bool;
+}
+
+/// Fail-closed classification of live bytes against a site's original/replacement.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PatchState {
+    /// Live bytes are the known original — safe to patch.
+    Original,
+    /// Live bytes already equal the replacement — idempotent.
+    AlreadyPatched,
+    /// Neither — unrecognised/not-yet-ready build; must be left untouched.
+    Mismatch,
+}
+
+/// Pure classification (no memory access).
+pub fn classify(cur: &[u8], orig: &[u8], patch: &[u8]) -> PatchState {
+    if cur == patch {
+        PatchState::AlreadyPatched
+    } else if cur == orig {
+        PatchState::Original
+    } else {
+        PatchState::Mismatch
+    }
+}
+
+/// Outcome of a checked patch attempt at one site.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ApplyOutcome {
+    /// Bytes were the original and were written and re-read as the replacement.
+    Applied,
+    /// Bytes already equalled the replacement; nothing written.
+    AlreadyPatched,
+    /// Bytes were neither original nor replacement; nothing written.
+    Mismatch,
+    /// Bytes could not be read yet (module/page not available) — retry later.
+    NotReadable,
+    /// The write itself failed (protection change or copy).
+    WriteFailed,
+    /// Wrote, but the re-read did not equal the replacement.
+    VerifyFailed,
+}
+
+impl ApplyOutcome {
+    /// Whether the site now holds the replacement (freshly or already).
+    pub fn is_patched(self) -> bool {
+        matches!(self, ApplyOutcome::Applied | ApplyOutcome::AlreadyPatched)
+    }
+}
+
+/// Read → classify → (only on ORIGINAL) write → re-read verify. Never writes on
+/// MISMATCH; treats ALREADY_PATCHED as success. `orig`/`patch` must be equal,
+/// non-empty and within [`MAX_PATCH_LEN`].
+pub fn apply_checked<M: Mem>(mem: &mut M, addr: usize, orig: &[u8], patch: &[u8]) -> ApplyOutcome {
+    debug_assert_eq!(orig.len(), patch.len());
+    debug_assert!(!patch.is_empty() && patch.len() <= MAX_PATCH_LEN);
+    let n = patch.len();
+    let mut cur = [0u8; MAX_PATCH_LEN];
+    if !mem.read(addr, &mut cur[..n]) {
+        return ApplyOutcome::NotReadable;
+    }
+    match classify(&cur[..n], orig, patch) {
+        PatchState::AlreadyPatched => ApplyOutcome::AlreadyPatched,
+        PatchState::Mismatch => ApplyOutcome::Mismatch,
+        PatchState::Original => {
+            if !mem.write(addr, patch) {
+                return ApplyOutcome::WriteFailed;
+            }
+            let mut after = [0u8; MAX_PATCH_LEN];
+            if !mem.read(addr, &mut after[..n]) || &after[..n] != patch {
+                return ApplyOutcome::VerifyFailed;
+            }
+            ApplyOutcome::Applied
+        }
+    }
+}
+
+/// RVA of a static VA relative to an image's preferred base (pure).
+pub const fn rva(static_va: u64, preferred_base: u64) -> u64 {
+    static_va - preferred_base
+}
+/// Read and classify a site without writing (`None` = not readable yet). Used to
+/// decide multi-site patches (e.g. apply a gate pair only when both are original).
+pub fn read_state<M: Mem>(mem: &M, addr: usize, orig: &[u8], patch: &[u8]) -> Option<PatchState> {
+    let n = patch.len();
+    let mut cur = [0u8; MAX_PATCH_LEN];
+    if !mem.read(addr, &mut cur[..n]) {
+        return None;
+    }
+    Some(classify(&cur[..n], orig, patch))
+}
+
+/// Live in-process address of an image-relative site given the module's runtime base.
+pub const fn live_addr(module_base: usize, rva: u64) -> usize {
+    module_base + rva as usize
+}
+
+/// Lowercase, unseparated hex for diagnostics (matches the autopatch SKIP line).
+pub fn hex(bytes: &[u8]) -> String {
+    let mut s = String::with_capacity(bytes.len() * 2);
+    for b in bytes {
+        s.push(char::from_digit((b >> 4) as u32, 16).unwrap());
+        s.push(char::from_digit((b & 0xf) as u32, 16).unwrap());
+    }
+    s
+}
+
+// ─── In-process Windows memory (runtime only; not exercised by host tests) ──────
+
+/// In-process implementation of [`Mem`] over this (FIFA17.exe) address space.
+pub struct WinMem;
+
+impl Mem for WinMem {
+    fn read(&self, addr: usize, buf: &mut [u8]) -> bool {
+        unsafe { guarded_read(addr, buf) }
+    }
+    fn write(&mut self, addr: usize, data: &[u8]) -> bool {
+        unsafe { protected_write(addr, data) }
+    }
+}
+
+/// Resolve a loaded module's runtime base by name, or `None` if not loaded.
+pub unsafe fn module_base(name: *const u8) -> Option<usize> {
+    use windows_sys::Win32::System::LibraryLoader::GetModuleHandleA;
+    let h = GetModuleHandleA(name);
+    if h.is_null() {
+        None
+    } else {
+        Some(h as usize)
+    }
+}
+
+/// Read `buf.len()` bytes from `addr` only if the whole range is committed and
+/// readable (VirtualQuery-guarded), so a wrong base/RVA can never fault.
+unsafe fn guarded_read(addr: usize, buf: &mut [u8]) -> bool {
+    use windows_sys::Win32::System::Memory::{
+        VirtualQuery, MEMORY_BASIC_INFORMATION, MEM_COMMIT, PAGE_EXECUTE_READ,
+        PAGE_EXECUTE_READWRITE, PAGE_EXECUTE_WRITECOPY, PAGE_GUARD, PAGE_NOACCESS, PAGE_READONLY,
+        PAGE_READWRITE, PAGE_WRITECOPY,
+    };
+    if addr == 0 || buf.is_empty() {
+        return false;
+    }
+    let mut mbi: MEMORY_BASIC_INFORMATION = core::mem::zeroed();
+    let want = core::mem::size_of::<MEMORY_BASIC_INFORMATION>();
+    if VirtualQuery(addr as _, &mut mbi, want) != want {
+        return false;
+    }
+    if mbi.State != MEM_COMMIT {
+        return false;
+    }
+    let readable = PAGE_READONLY
+        | PAGE_READWRITE
+        | PAGE_WRITECOPY
+        | PAGE_EXECUTE_READ
+        | PAGE_EXECUTE_READWRITE
+        | PAGE_EXECUTE_WRITECOPY;
+    if mbi.Protect & readable == 0 || mbi.Protect & (PAGE_GUARD | PAGE_NOACCESS) != 0 {
+        return false;
+    }
+    // The full range must fit inside this single committed region.
+    let region_end = (mbi.BaseAddress as usize).wrapping_add(mbi.RegionSize);
+    if addr.checked_add(buf.len()).is_none_or(|e| e > region_end) {
+        return false;
+    }
+    core::ptr::copy_nonoverlapping(addr as *const u8, buf.as_mut_ptr(), buf.len());
+    true
+}
+
+/// Make `[addr, addr+data.len())` writable, copy `data`, flush the instruction
+/// cache, then restore the original protection. `false` if protection could not
+/// be changed. Verification is the caller's re-read (see [`apply_checked`]).
+unsafe fn protected_write(addr: usize, data: &[u8]) -> bool {
+    use windows_sys::Win32::System::Diagnostics::Debug::FlushInstructionCache;
+    use windows_sys::Win32::System::Memory::{VirtualProtect, PAGE_EXECUTE_READWRITE};
+    use windows_sys::Win32::System::Threading::GetCurrentProcess;
+    if addr == 0 || data.is_empty() {
+        return false;
+    }
+    let mut old: u32 = 0;
+    if VirtualProtect(addr as _, data.len(), PAGE_EXECUTE_READWRITE, &mut old) == 0 {
+        return false;
+    }
+    core::ptr::copy_nonoverlapping(data.as_ptr(), addr as *mut u8, data.len());
+    FlushInstructionCache(GetCurrentProcess(), addr as _, data.len());
+    // Best-effort restore of the original page protection.
+    let mut restored: u32 = 0;
+    VirtualProtect(addr as _, data.len(), old, &mut restored);
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashMap;
+
+    /// Deterministic fake address space for the pure patch logic.
+    struct FakeMem {
+        cells: HashMap<usize, u8>,
+        readable: bool,
+        writable: bool,
+    }
+    impl FakeMem {
+        fn with(addr: usize, bytes: &[u8]) -> Self {
+            let mut cells = HashMap::new();
+            for (i, b) in bytes.iter().enumerate() {
+                cells.insert(addr + i, *b);
+            }
+            Self {
+                cells,
+                readable: true,
+                writable: true,
+            }
+        }
+    }
+    impl Mem for FakeMem {
+        fn read(&self, addr: usize, buf: &mut [u8]) -> bool {
+            if !self.readable {
+                return false;
+            }
+            for (i, slot) in buf.iter_mut().enumerate() {
+                match self.cells.get(&(addr + i)) {
+                    Some(b) => *slot = *b,
+                    None => return false,
+                }
+            }
+            true
+        }
+        fn write(&mut self, addr: usize, data: &[u8]) -> bool {
+            if !self.writable {
+                return false;
+            }
+            for (i, b) in data.iter().enumerate() {
+                self.cells.insert(addr + i, *b);
+            }
+            true
+        }
+    }
+
+    const ORIG: [u8; 2] = [0x75, 0x0f];
+    const PATCH: [u8; 2] = [0x7f, 0x0f];
+
+    #[test]
+    fn classify_recognises_all_three_states() {
+        assert_eq!(classify(&ORIG, &ORIG, &PATCH), PatchState::Original);
+        assert_eq!(classify(&PATCH, &ORIG, &PATCH), PatchState::AlreadyPatched);
+        assert_eq!(classify(&[0x12, 0x34], &ORIG, &PATCH), PatchState::Mismatch);
+    }
+
+    #[test]
+    fn original_bytes_are_applied_and_verified() {
+        let mut m = FakeMem::with(0x1000, &ORIG);
+        assert_eq!(
+            apply_checked(&mut m, 0x1000, &ORIG, &PATCH),
+            ApplyOutcome::Applied
+        );
+        // Memory now holds the replacement.
+        let mut got = [0u8; 2];
+        assert!(m.read(0x1000, &mut got));
+        assert_eq!(got, PATCH);
+    }
+
+    #[test]
+    fn already_patched_is_idempotent_noop() {
+        let mut m = FakeMem::with(0x2000, &PATCH);
+        assert_eq!(
+            apply_checked(&mut m, 0x2000, &ORIG, &PATCH),
+            ApplyOutcome::AlreadyPatched
+        );
+    }
+
+    #[test]
+    fn mismatch_never_writes() {
+        let junk = [0xde, 0xad];
+        let mut m = FakeMem::with(0x3000, &junk);
+        assert_eq!(
+            apply_checked(&mut m, 0x3000, &ORIG, &PATCH),
+            ApplyOutcome::Mismatch
+        );
+        // Untouched.
+        let mut got = [0u8; 2];
+        assert!(m.read(0x3000, &mut got));
+        assert_eq!(got, junk);
+    }
+
+    #[test]
+    fn unreadable_module_waits_without_crashing() {
+        let mut m = FakeMem::with(0x4000, &ORIG);
+        m.readable = false;
+        let out = apply_checked(&mut m, 0x4000, &ORIG, &PATCH);
+        assert_eq!(out, ApplyOutcome::NotReadable);
+        assert!(!out.is_patched());
+    }
+
+    #[test]
+    fn write_failure_is_reported_not_pretended() {
+        let mut m = FakeMem::with(0x5000, &ORIG);
+        m.writable = false;
+        assert_eq!(
+            apply_checked(&mut m, 0x5000, &ORIG, &PATCH),
+            ApplyOutcome::WriteFailed
+        );
+    }
+
+    #[test]
+    fn running_twice_does_not_corrupt() {
+        let mut m = FakeMem::with(0x6000, &ORIG);
+        assert_eq!(
+            apply_checked(&mut m, 0x6000, &ORIG, &PATCH),
+            ApplyOutcome::Applied
+        );
+        // Second pass sees the replacement and is a no-op.
+        assert_eq!(
+            apply_checked(&mut m, 0x6000, &ORIG, &PATCH),
+            ApplyOutcome::AlreadyPatched
+        );
+        let mut got = [0u8; 2];
+        assert!(m.read(0x6000, &mut got));
+        assert_eq!(got, PATCH);
+    }
+
+    #[test]
+    fn rva_and_live_addr_relocate_across_bases() {
+        // GATE1 example: preferred 0x140000000, VA 0x146132548.
+        assert_eq!(rva(0x1_4613_2548, 0x1_4000_0000), 0x613_2548);
+        // Applied at the preferred base gives the static VA back.
+        assert_eq!(live_addr(0x1_4000_0000, 0x613_2548), 0x1_4613_2548);
+        // Applied at a relocated (ASLR) base tracks the base exactly.
+        assert_eq!(live_addr(0x2_0000_0000, 0x613_2548), 0x2_0613_2548);
+    }
+
+    #[test]
+    fn hex_is_lowercase_unseparated() {
+        assert_eq!(hex(&[0x0f, 0x85, 0xde]), "0f85de");
+    }
+}

openfut-hook/src/recv_hook.rs

@@ -1,321 +0,0 @@
-/// Inline hooks on ws2_32!recv and ws2_32!send only.
-///
-/// WSARecv/WSASend are NOT hooked — their prologues contain RIP-relative
-/// (short conditional jump) instructions that would break trampolines.
-/// FIFA's LSX client uses plain recv/send, which is confirmed by prior logs.
-///
-/// Trampolines allow multiple threads to call the original function
-/// concurrently without locks or unhook/rehook races.
-use core::sync::atomic::{AtomicUsize, Ordering};
-
-unsafe fn write_jmp(target: *mut u8, dest: u64) {
-    use windows_sys::Win32::System::Memory::{VirtualProtect, PAGE_EXECUTE_READWRITE};
-    let mut old: u32 = 0;
-    VirtualProtect(target as _, 14, PAGE_EXECUTE_READWRITE, &mut old);
-    target.write(0xFF);
-    target.add(1).write(0x25);
-    (target.add(2) as *mut u32).write(0);
-    (target.add(6) as *mut u64).write(dest);
-    VirtualProtect(target as _, 14, old, &mut old);
-}
-
-unsafe fn make_trampoline(orig: *mut u8, name: &str) -> Option<usize> {
-    use windows_sys::Win32::System::Memory::{
-        VirtualAlloc, MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READWRITE,
-    };
-    // Read enough prologue to walk instruction boundaries.
-    let probe: [u8; 24] = core::array::from_fn(|i| *orig.add(i));
-    let hex: String = probe[..14].iter().map(|b| format!("{b:02x} ")).collect();
-    crate::write_log(&format!("recv_hook: {name} prologue {hex}\n"));
-
-    // Copy WHOLE instructions until we've covered >= 14 bytes (the size of the JMP
-    // patch), so the trampoline never splits an instruction. Copying a fixed 14
-    // bytes lands mid-instruction on these prologues and crashes on execution.
-    let mut copy_len = 0usize;
-    while copy_len < 14 {
-        let (len, branch) = decode_instr_len(&probe[copy_len..]);
-        if len == 0 || branch {
-            crate::write_log(&format!(
-                "recv_hook: {name} unrelocatable prologue (len={len} branch={branch}), skipping\n"
-            ));
-            return None;
-        }
-        copy_len += len;
-    }
-
-    let mem = VirtualAlloc(
-        core::ptr::null_mut(),
-        64,
-        MEM_COMMIT | MEM_RESERVE,
-        PAGE_EXECUTE_READWRITE,
-    );
-    if mem.is_null() {
-        crate::write_log("recv_hook: VirtualAlloc failed\n");
-        return None;
-    }
-
-    let t = mem as *mut u8;
-    core::ptr::copy_nonoverlapping(orig, t, copy_len);
-    // JMP [RIP+0] → orig+copy_len (resume at the next whole instruction)
-    let cont = (orig as u64) + copy_len as u64;
-    t.add(copy_len).write(0xFF);
-    t.add(copy_len + 1).write(0x25);
-    (t.add(copy_len + 2) as *mut u32).write(0);
-    (t.add(copy_len + 6) as *mut u64).write(cont);
-    crate::write_log(&format!(
-        "recv_hook: {name} trampoline copy_len={copy_len}\n"
-    ));
-    Some(t as usize)
-}
-
-/// Walk x86-64 instruction boundaries and return true if any relative branch
-/// (JE/JNE/JCC rel8, JMP rel8, JMP/CALL rel32, Jcc rel32) is encountered.
-/// Correctly skips over immediate operands so `sub rsp, 0x70` doesn't trigger.
-fn has_rip_relative_branch(bytes: &[u8]) -> bool {
-    let mut pos = 0;
-    while pos < bytes.len() {
-        let (len, branch) = decode_instr_len(&bytes[pos..]);
-        if branch {
-            return true;
-        }
-        if len == 0 {
-            break;
-        } // unknown/truncated — stop safely
-        pos += len;
-    }
-    false
-}
-
-fn modrm_extra(modrm: u8) -> usize {
-    let md = (modrm >> 6) & 3;
-    let rm = modrm & 7;
-    match md {
-        0 => {
-            if rm == 5 {
-                4
-            } else if rm == 4 {
-                1
-            } else {
-                0
-            }
-        }
-        1 => {
-            if rm == 4 {
-                2
-            } else {
-                1
-            }
-        }
-        2 => {
-            if rm == 4 {
-                5
-            } else {
-                4
-            }
-        }
-        _ => 0,
-    }
-}
-
-/// Returns (instruction_length_in_bytes, is_rip_relative_branch).
-/// Returns (0, false) for unknown/truncated.
-fn decode_instr_len(b: &[u8]) -> (usize, bool) {
-    if b.is_empty() {
-        return (0, false);
-    }
-    let mut i = 0;
-    // Legacy prefixes
-    while let Some(&p) = b.get(i) {
-        if matches!(p, 0x66 | 0x67 | 0xF0 | 0xF2 | 0xF3) {
-            i += 1;
-        } else {
-            break;
-        }
-    }
-    // REX prefix (40–4F)
-    if b.get(i)
-        .copied()
-        .map(|x| (0x40..=0x4F).contains(&x))
-        .unwrap_or(false)
-    {
-        i += 1;
-    }
-
-    let op = match b.get(i) {
-        Some(&x) => x,
-        None => return (0, false),
-    };
-    i += 1;
-
-    match op {
-        // push/pop reg (50-5F): no extra bytes
-        0x50..=0x5F => (i, false),
-        // nop
-        0x90 => (i, false),
-        // Short Jcc (70-7F): 1 byte operand, IS a relative branch
-        x if (0x70..=0x7F).contains(&x) => (i + 1, true),
-        // JMP rel8, JMP rel32, CALL rel32
-        0xEB => (i + 1, true),
-        0xE9 | 0xE8 => (i + 4, true),
-        // 0F prefix
-        0x0F => {
-            let op2 = match b.get(i) {
-                Some(&x) => x,
-                None => return (0, false),
-            };
-            i += 1;
-            if (0x80..=0x8F).contains(&op2) {
-                return (i + 4, true);
-            } // Jcc rel32
-              // Most 0F XX: ModRM
-            let modrm = match b.get(i) {
-                Some(&x) => x,
-                None => return (0, false),
-            };
-            (i + 1 + modrm_extra(modrm), false)
-        }
-        // Instructions with ModRM only (no immediate)
-        0x85 | 0x87 | 0x88 | 0x89 | 0x8A | 0x8B | 0x8C | 0x8D | 0x8E | 0x8F | 0x01 | 0x03
-        | 0x09 | 0x0B | 0x11 | 0x13 | 0x21 | 0x23 | 0x29 | 0x2B | 0x31 | 0x33 | 0x39 | 0x3B
-        | 0xD3 | 0xFF | 0xF7 => {
-            let modrm = match b.get(i) {
-                Some(&x) => x,
-                None => return (0, false),
-            };
-            (i + 1 + modrm_extra(modrm), false)
-        }
-        // ModRM + imm8
-        0x6B | 0x80 | 0x83 | 0xC0 | 0xC1 | 0xC6 => {
-            let modrm = match b.get(i) {
-                Some(&x) => x,
-                None => return (0, false),
-            };
-            (i + 1 + modrm_extra(modrm) + 1, false)
-        }
-        // ModRM + imm32
-        0x69 | 0x81 | 0xC7 => {
-            let modrm = match b.get(i) {
-                Some(&x) => x,
-                None => return (0, false),
-            };
-            (i + 1 + modrm_extra(modrm) + 4, false)
-        }
-        // MOV reg, imm8/imm32
-        0xB0..=0xB7 => (i + 1, false),
-        0xB8..=0xBF => (i + 4, false),
-        // PUSH imm
-        0x6A => (i + 1, false),
-        0x68 => (i + 4, false),
-        // RET
-        0xC2 => (i + 2, false),
-        0xC3 => (i, false),
-        _ => (0, false), // unknown — stop
-    }
-}
-
-unsafe fn get_fn(dll: &[u8], sym: &[u8]) -> Option<*mut u8> {
-    use windows_sys::Win32::System::LibraryLoader::{GetModuleHandleA, GetProcAddress};
-    let h = GetModuleHandleA(dll.as_ptr());
-    if h.is_null() {
-        return None;
-    }
-    GetProcAddress(h, sym.as_ptr()).map(|f| f as *mut u8)
-}
-
-// ─── recv ──────────────────────────────────────────────────────────────────────
-
-static RECV_TRAMPOLINE: AtomicUsize = AtomicUsize::new(0);
-
-/// True if socket `s` is connected to the EA App LSX port (127.0.0.1:3216).
-/// Used in capture mode to tap only the LSX conversation.
-unsafe fn peer_is_lsx(s: usize) -> bool {
-    use windows_sys::Win32::Networking::WinSock::getpeername;
-    let mut sa = [0u8; 16];
-    let mut sl: i32 = 16;
-    if getpeername(s, sa.as_mut_ptr() as *mut _, &mut sl) != 0 {
-        return false;
-    }
-    // sockaddr_in: sa_family (2 bytes) then sin_port (2 bytes, network order).
-    u16::from_be_bytes([sa[2], sa[3]]) == 3216
-}
-
-// IAT-hook approach (no inline trampoline — FIFA's `recv`/`send` prologues have
-// instructions that straddle the 14-byte patch boundary, so an inline trampoline
-// corrupts them and crashes. IAT hooking only swaps import-table pointers and
-// never touches the function body). The real fns are resolved in lib.rs and set
-// here; our hooks call them directly.
-static REAL_RECV: AtomicUsize = AtomicUsize::new(0);
-static REAL_SEND: AtomicUsize = AtomicUsize::new(0);
-
-pub fn set_real_recv(f: unsafe extern "system" fn(usize, *mut u8, i32, i32) -> i32) {
-    REAL_RECV.store(f as usize, Ordering::Relaxed);
-}
-pub fn set_real_send(f: unsafe extern "system" fn(usize, *const u8, i32, i32) -> i32) {
-    REAL_SEND.store(f as usize, Ordering::Relaxed);
-}
-
-/// Inline-hook ws2_32!recv: build a boundary-safe trampoline (the "real" fn our
-/// hook calls) and overwrite the entry with a JMP to `hooked_recv`. Inline hooks
-/// catch calls from every module and dynamically-resolved calls, unlike IAT.
-pub unsafe fn install_recv_hook() -> bool {
-    let ptr = match get_fn(b"ws2_32.dll\0", b"recv\0") {
-        Some(p) => p,
-        None => return false,
-    };
-    match make_trampoline(ptr, "recv") {
-        Some(t) => REAL_RECV.store(t, Ordering::Relaxed),
-        None => return false,
-    }
-    write_jmp(ptr, hooked_recv as u64);
-    true
-}
-
-pub unsafe fn install_send_hook() -> bool {
-    let ptr = match get_fn(b"ws2_32.dll\0", b"send\0") {
-        Some(p) => p,
-        None => return false,
-    };
-    match make_trampoline(ptr, "send") {
-        Some(t) => REAL_SEND.store(t, Ordering::Relaxed),
-        None => return false,
-    }
-    write_jmp(ptr, hooked_send as u64);
-    true
-}
-
-pub unsafe extern "system" fn hooked_recv(s: usize, buf: *mut u8, len: i32, flags: i32) -> i32 {
-    let t = REAL_RECV.load(Ordering::Relaxed);
-    if t == 0 {
-        return -1;
-    }
-    let f: unsafe extern "system" fn(usize, *mut u8, i32, i32) -> i32 = core::mem::transmute(t);
-    // Pass through to anadius's real socket, then log what it sent back
-    // (anadius's LSX response — the ground truth we want to diff against).
-    let n = f(s, buf, len, flags);
-    if n > 0 && peer_is_lsx(s) {
-        let data = core::slice::from_raw_parts(buf, n as usize);
-        let text = core::str::from_utf8(data).unwrap_or("(binary)");
-        crate::write_log(&format!(
-            "CAP recv<-anadius s={s} n={n}: {}\n",
-            &text[..text.len().min(2400)]
-        ));
-    }
-    n
-}
-
-pub unsafe extern "system" fn hooked_send(s: usize, buf: *const u8, len: i32, flags: i32) -> i32 {
-    if len > 0 && peer_is_lsx(s) {
-        let data = core::slice::from_raw_parts(buf, len as usize);
-        let text = core::str::from_utf8(data).unwrap_or("(binary)");
-        crate::write_log(&format!(
-            "CAP send->anadius s={s} len={len}: {}\n",
-            &text[..text.len().min(2400)]
-        ));
-    }
-    let t = REAL_SEND.load(Ordering::Relaxed);
-    if t == 0 {
-        return -1;
-    }
-    let f: unsafe extern "system" fn(usize, *const u8, i32, i32) -> i32 = core::mem::transmute(t);
-    f(s, buf, len, flags)
-}

openfut-hook/src/sbc_dispatch.rs

@@ -1,8 +1,8 @@
 //! Guarded FIFA 17 SBC completion dispatch and passive event tracing.
 //!
-//! `OPENFUT_SBC_DISPATCH=1` permits one narrowly-scoped repair per native
-//! deserializer generation. The default and `OPENFUT_SBC_DISPATCH_TRACE=1` paths
-//! are behavior-preserving.
+//! The repair is a PROMOTED feature: it is armed by the build itself, never by an
+//! environment variable (see [`REPAIR_PROMOTED`]). Safety lives in the runtime
+//! evidence gate, not in a flag.
 
 use core::ffi::c_void;
 use core::sync::atomic::{AtomicBool, AtomicU64, AtomicUsize, Ordering};
@@ -44,6 +44,30 @@ const EVENT_SIGNATURE: [u8; EVENT_COPY_LEN] = [
 type CompletionFn = unsafe extern "system" fn(*mut c_void, *mut c_void) -> usize;
 type EventDispatchFn = unsafe extern "system" fn(*mut c_void, u32, *mut c_void) -> usize;
 
+/// The guarded native dispatch repair is PROMOTED: armed by the build, never by an
+/// environment variable. Retail Gates A–G passed on the pinned CardsDLL build, so a
+/// deployed hook must repair the SBC completion on every launch path (Steam, the
+/// launcher, or a bare `umu-run`) with nothing to export.
+///
+/// Promotion does NOT weaken any check — every guard stays in the runtime evidence
+/// gate rather than in a flag. `worker` still validates the exact CardsDLL
+/// signatures before installing a detour, and [`decide`] still requires the
+/// transport sentinel status, the pinned category-response vtable captured while
+/// the response object was provably live, balanced parser counts on the one parser
+/// thread, this generation's notifier having entered AND returned, the captured
+/// controller/model identity, and one repair per deserializer generation. Anything
+/// unrecognised leaves native execution untouched.
+///
+/// Rollback is a file swap (restore the previous `version.dll`) — the documented
+/// client rollback path — deliberately not an env kill-switch.
+pub(crate) const REPAIR_PROMOTED: bool = true;
+
+/// Compile-time contract: the repair stays armed by the build. Flipping this back to
+/// an env gate would silently cost a normal launch (Steam or the launcher) its SBC
+/// screen, which is exactly the regression promotion removed — so it must be a
+/// deliberate, visible change here rather than a missing variable at runtime.
+const _: () = assert!(REPAIR_PROMOTED);
+
 static REPAIR_ENABLED: AtomicBool = AtomicBool::new(false);
 static COMPLETION_TRAMPOLINE: AtomicUsize = AtomicUsize::new(0);
 static EVENT_TRAMPOLINE: AtomicUsize = AtomicUsize::new(0);
@@ -180,9 +204,15 @@ fn decide(input: DecisionInput) -> Result<Decision, Rejection> {
     if input.live_category_count != input.category_count {
         return Err(Rejection::ModelChanged);
     }
+    // The category-success notifier for this generation must have entered and
+    // fully returned before the SBC completion runs. On the pinned CardsDLL the
+    // completion fires immediately after the notifier unwinds (measured: notifier
+    // entries == exits == generation at completion), not nested inside it, so we
+    // bind both notifier counts to the current generation rather than requiring
+    // an in-flight notifier.
     if input.notifier_entries != generation
         || input.notifier_entries == 0
-        || input.notifier_exits.checked_add(1) != Some(input.notifier_entries)
+        || input.notifier_exits != generation
     {
         return Err(Rejection::NotifierNotCurrent);
     }
@@ -413,6 +443,10 @@ unsafe extern "system" fn event_wrapper(
         }
         _ => {}
     }
+    // Piggyback the store pre-warm on this game-thread hub event: it loads the
+    // purchase groups once, before the store screen is shown, so the store's native
+    // screen-show tab bind sees a populated group list (see `store_entry`).
+    crate::store_entry::maybe_prewarm_groups();
     let original: EventDispatchFn = core::mem::transmute(EVENT_TRAMPOLINE.load(Ordering::Acquire));
     let result = original(controller, event, payload);
     EVENT_EXITS.fetch_add(1, Ordering::Release);
@@ -685,22 +719,12 @@ unsafe fn worker() {
 }
 
 pub(crate) fn install() {
-    let repair =
-        crate::sbc_trace::env_enabled(std::env::var("OPENFUT_SBC_DISPATCH").ok().as_deref());
-    let trace = repair
-        || crate::sbc_trace::env_enabled(
-            std::env::var("OPENFUT_SBC_DISPATCH_TRACE").ok().as_deref(),
-        );
-    REPAIR_ENABLED.store(repair, Ordering::Release);
-    if !trace {
-        crate::write_log("SBC_DISPATCH: disabled\n");
-        return;
-    }
-    crate::write_log(if repair {
-        "SBC_DISPATCH: repair ARMED; strict native evidence gate enabled\n"
-    } else {
-        "SBC_DISPATCH: passive trace requested; repair disabled\n"
-    });
+    // Promoted: armed by the build. No environment variable participates in the
+    // decision, so every launch path behaves identically.
+    REPAIR_ENABLED.store(REPAIR_PROMOTED, Ordering::Release);
+    crate::write_log(
+        "SBC_DISPATCH: repair ARMED (promoted); strict native evidence gate enabled\n",
+    );
     std::thread::spawn(|| unsafe { worker() });
 }
 
@@ -730,7 +754,7 @@ mod tests {
             live_category_count: 2,
             category_count: 2,
             notifier_entries: generation,
-            notifier_exits: generation - 1,
+            notifier_exits: generation,
             controller_matches: true,
             controller_model_matches: true,
             last_repaired_generation: generation - 1,
@@ -776,8 +800,16 @@ mod tests {
         input.status = None;
         assert_eq!(decide(input), Err(Rejection::StatusUnreadable));
 
+        // Notifier still in flight for this generation (has not returned) is rejected:
+        // on the pinned build the completion only runs after the notifier unwinds.
         let mut input = valid_input(1);
-        input.notifier_exits = 1;
+        input.notifier_exits = 0;
+        assert_eq!(decide(input), Err(Rejection::NotifierNotCurrent));
+
+        // A notifier count that does not match the current generation is rejected.
+        let mut input = valid_input(1);
+        input.notifier_entries = 2;
+        input.notifier_exits = 2;
         assert_eq!(decide(input), Err(Rejection::NotifierNotCurrent));
 
         let mut input = valid_input(1);

openfut-hook/src/sbc_hook.rs

@@ -10,8 +10,7 @@
 //!   OPENFUT_SBC_POPULATE=1   -> legacy Tier-1 gate: BLOCKED (logs corrected trace gap, returns)
 //!
 //! CardsDLL_Win64_retail.dll is loaded lazily (only on entering Ultimate Team), so we
-//! defer off the loader lock and poll for it — the same shape as
-//! `probe::install_probes_deferred` polling for anadius64.dll.
+//! defer off the loader lock and poll for it in a background thread.
 //!
 //! ── Address model (static VAs; PE image base 0x180000000) ────────────────────────
 //! All values below are RVAs (VA_static - 0x180000000); live = cards_base + rva.
@@ -80,6 +79,9 @@ static DONE: AtomicBool = AtomicBool::new(false);
 static CARDS_BASE: AtomicUsize = AtomicUsize::new(0);
 static STATE: AtomicUsize = AtomicUsize::new(RuntimeState::Disabled as usize);
 
+// Full SBC state model. The live repair jumps Resolved -> Validated -> Committed;
+// Intercepted/Parsed document the intermediate states but are never entered.
+#[allow(dead_code)]
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 #[repr(usize)]
 enum RuntimeState {
@@ -192,7 +194,7 @@ fn validate_snapshot(base: usize, s: &RuntimeSnapshot) -> Result<(), ValidationE
     Ok(())
 }
 
-/// Fault-safe pointer read (mirrors `probe::read_ptr`): returns None unless `ptr` lands
+/// Fault-safe pointer read: returns None unless `ptr` lands
 /// in a committed, readable page and the full 8 bytes fit inside the region.
 unsafe fn read_ptr(ptr: usize) -> Option<usize> {
     if ptr < 0x10000 || ptr & 7 != 0 {
@@ -262,6 +264,8 @@ unsafe fn writable_u8(ptr: usize) -> bool {
             .is_some_and(|end| end <= (mbi.BaseAddress as usize).saturating_add(mbi.RegionSize))
 }
 
+// Fault-safe executable-range check retained with the address model; not currently wired.
+#[allow(dead_code)]
 unsafe fn executable_range(ptr: usize, len: usize) -> bool {
     let Some(end) = ptr.checked_add(len) else {
         return false;

openfut-hook/src/sbc_trace.rs

@@ -29,6 +29,7 @@ pub(crate) const CATEGORY_FACTORY_RVA: usize = 0x17aa10;
 pub(crate) const CATEGORY_DESERIALIZER_RVA: usize = 0x17b2b0;
 const COPY_LEN: usize = 19;
 const ABS_JUMP_LEN: usize = 14;
+#[allow(dead_code)] // documents the relocated-prologue trampoline size (COPY_LEN + jump)
 const TRAMPOLINE_LEN: usize = COPY_LEN + ABS_JUMP_LEN;
 const NOTIFIER_RVA: usize = 0x17aa80;
 const NOTIFIER_COPY_LEN: usize = 15;
@@ -1148,7 +1149,9 @@ fn install_notifier(enabled: bool) {
 }
 
 pub(crate) fn install() {
-    let dispatch_repair = env_enabled(std::env::var("OPENFUT_SBC_DISPATCH").ok().as_deref());
+    // The repair's evidence traces (parser, notifier, controller registration) are
+    // its decision inputs, so they follow the promoted repair, not an env var.
+    let dispatch_repair = crate::sbc_dispatch::REPAIR_PROMOTED;
     let dispatch_trace =
         dispatch_repair || env_enabled(std::env::var("OPENFUT_SBC_DISPATCH_TRACE").ok().as_deref());
     let enabled =

openfut-hook/src/season_team_compat.rs

@@ -0,0 +1,445 @@
+//! FIFA 17 Offline Seasons game-setup team compatibility candidate.
+//!
+//! `FUT::SeasonsManagerOfflineHelper` first projects the authentic dynamic pair
+//! `[fixture_team, user_team]`. Later, `futSelectTeam::SetupTeamsInfo()` asks
+//! `CardsGameSetupAdapter.GetTeam(side)` while rebuilding its panel state. The
+//! first native reads expose the correct fixture and user teams on distinct GetTeam
+//! sides. A later repeated read of the user-returning side is fed into SetTeam's
+//! inverse side mapping and duplicates the user's XI over the opponent.
+//!
+//! This default-off candidate corrects that source read, not SetTeam or the final
+//! writer. It records the projector pair, requires one native observation of each
+//! team on distinct sides, and permits one correction on the next repeated
+//! user-team read. Missing or conflicting evidence always preserves native behavior.
+
+use core::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::Mutex;
+
+use windows_sys::Win32::System::LibraryLoader::GetModuleHandleA;
+
+use crate::sbc_trace::{readable_range, target_va, validate_cards_build};
+use crate::season_trace::{install_detour, install_detour_reloc, rd_i32};
+use crate::write_log;
+
+const ENABLE_ENV: &str = "OPENFUT_FIFA17_SEASON_TEAM_COMPAT";
+
+const FIXTURE_PROJECTOR_RVA: usize = 0x0fc500;
+const GET_TEAM_RVA: usize = 0x0054a0;
+
+const FIXTURE_PROJECTOR_SIGNATURE: [u8; 19] = [
+    0x40, 0x57, 0x41, 0x54, 0x41, 0x56, 0x48, 0x83, 0xec, 0x30, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe,
+    0xff, 0xff, 0xff,
+];
+const GET_TEAM_SIGNATURE: [u8; 17] = [
+    0x48, 0x8b, 0x05, 0xb9, 0x8a, 0x2d, 0x00, 0x4c, 0x8b, 0x80, 0x50, 0x03, 0x00, 0x00, 0x49, 0xff,
+    0xe0,
+];
+
+const UNKNOWN_SIDE: i32 = -1;
+
+static REPAIR_ACTIVE: AtomicBool = AtomicBool::new(false);
+static FIXTURE_PROJECTOR_TRAMPOLINE: AtomicUsize = AtomicUsize::new(0);
+static GET_TEAM_TRAMPOLINE: AtomicUsize = AtomicUsize::new(0);
+static TEAM_STATE: Mutex<TeamState> = Mutex::new(TeamState::empty());
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+struct TeamState {
+    fixture_team: i32,
+    user_team: i32,
+    fixture_get_side: i32,
+    user_get_side: i32,
+    correction_used: bool,
+}
+
+impl TeamState {
+    const fn empty() -> Self {
+        Self {
+            fixture_team: 0,
+            user_team: 0,
+            fixture_get_side: UNKNOWN_SIDE,
+            user_get_side: UNKNOWN_SIDE,
+            correction_used: false,
+        }
+    }
+
+    fn capture(&mut self, fixture_team: i32, user_team: i32) -> bool {
+        if !valid_pair(fixture_team, user_team) {
+            *self = Self::empty();
+            return false;
+        }
+        *self = Self {
+            fixture_team,
+            user_team,
+            fixture_get_side: UNKNOWN_SIDE,
+            user_get_side: UNKNOWN_SIDE,
+            correction_used: false,
+        };
+        true
+    }
+
+    fn observe_get_team(&mut self, side: i32, native_team: i32) -> GetTeamDecision {
+        if !valid_side(side) || !valid_pair(self.fixture_team, self.user_team) {
+            return GetTeamDecision::native(native_team);
+        }
+
+        if native_team == self.fixture_team {
+            if (self.fixture_get_side != UNKNOWN_SIDE && self.fixture_get_side != side)
+                || self.user_get_side == side
+            {
+                return self.clear_on_conflict(native_team);
+            }
+            let first_observation = self.fixture_get_side == UNKNOWN_SIDE;
+            self.fixture_get_side = side;
+            return GetTeamDecision {
+                team: native_team,
+                event: if self.user_get_side != UNKNOWN_SIDE {
+                    DecisionEvent::NativePairConfirmed
+                } else if first_observation {
+                    DecisionEvent::FixtureObserved
+                } else {
+                    DecisionEvent::None
+                },
+            };
+        }
+
+        if native_team == self.user_team {
+            if self.user_get_side == UNKNOWN_SIDE {
+                if self.fixture_get_side == side {
+                    return self.clear_on_conflict(native_team);
+                }
+                self.user_get_side = side;
+                return GetTeamDecision {
+                    team: native_team,
+                    event: if self.fixture_get_side != UNKNOWN_SIDE {
+                        DecisionEvent::NativePairConfirmed
+                    } else {
+                        DecisionEvent::UserObserved
+                    },
+                };
+            }
+            if self.user_get_side != side {
+                return self.clear_on_conflict(native_team);
+            }
+            if !self.correction_used && self.fixture_get_side != UNKNOWN_SIDE {
+                self.correction_used = true;
+                return GetTeamDecision {
+                    team: self.fixture_team,
+                    event: DecisionEvent::Corrected,
+                };
+            }
+        }
+
+        GetTeamDecision::native(native_team)
+    }
+
+    fn clear_on_conflict(&mut self, native_team: i32) -> GetTeamDecision {
+        *self = Self::empty();
+        GetTeamDecision {
+            team: native_team,
+            event: DecisionEvent::ConflictingNativePair,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum DecisionEvent {
+    None,
+    FixtureObserved,
+    UserObserved,
+    NativePairConfirmed,
+    ConflictingNativePair,
+    Corrected,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+struct GetTeamDecision {
+    team: i32,
+    event: DecisionEvent,
+}
+
+impl GetTeamDecision {
+    const fn native(team: i32) -> Self {
+        Self {
+            team,
+            event: DecisionEvent::None,
+        }
+    }
+}
+
+const fn valid_side(side: i32) -> bool {
+    side == 0 || side == 1
+}
+
+const fn valid_pair(fixture_team: i32, user_team: i32) -> bool {
+    fixture_team > 0 && user_team > 0 && fixture_team != user_team
+}
+
+fn enabled(value: Option<&str>) -> bool {
+    value == Some("1")
+}
+
+fn exact_signature(current: &[u8], expected: &[u8]) -> bool {
+    current == expected
+}
+
+unsafe fn target_matches(base: usize, rva: usize, signature: &[u8]) -> bool {
+    let Some(target) = target_va(base, rva) else {
+        return false;
+    };
+    readable_range(target, signature.len())
+        && exact_signature(
+            core::slice::from_raw_parts(target as *const u8, signature.len()),
+            signature,
+        )
+}
+
+type FixtureProjectorFn = unsafe extern "system" fn(usize, usize, usize, usize) -> usize;
+type GetTeamFn = unsafe extern "system" fn(usize, i32) -> i32;
+
+unsafe extern "system" fn fixture_projector_wrapper(
+    context: usize,
+    output_pair: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    let trampoline = FIXTURE_PROJECTOR_TRAMPOLINE.load(Ordering::Acquire);
+    if trampoline == 0 {
+        return 0;
+    }
+    let original: FixtureProjectorFn = core::mem::transmute(trampoline);
+    let result = original(context, output_pair, r8, r9);
+
+    let pair = rd_i32(output_pair).zip(rd_i32(output_pair.saturating_add(4)));
+    let captured = pair.is_some_and(|(fixture_team, user_team)| {
+        TEAM_STATE
+            .lock()
+            .map(|mut state| state.capture(fixture_team, user_team))
+            .unwrap_or(false)
+    });
+    match pair {
+        Some((fixture_team, user_team)) if captured => write_log(&format!(
+            "SEASON_TEAM_COMPAT: fixture captured fixture={fixture_team} user={user_team}\n"
+        )),
+        Some((fixture_team, user_team)) => write_log(&format!(
+            "SEASON_TEAM_COMPAT: invalid fixture pair [{fixture_team},{user_team}]; inactive\n"
+        )),
+        None => {
+            if let Ok(mut state) = TEAM_STATE.lock() {
+                *state = TeamState::empty();
+            }
+            write_log("SEASON_TEAM_COMPAT: unreadable fixture pair; inactive\n");
+        }
+    }
+    result
+}
+
+unsafe extern "system" fn get_team_wrapper(adapter: usize, side: i32) -> i32 {
+    let trampoline = GET_TEAM_TRAMPOLINE.load(Ordering::Acquire);
+    if trampoline == 0 {
+        return 0;
+    }
+    let original: GetTeamFn = core::mem::transmute(trampoline);
+    let native_team = original(adapter, side);
+    if !REPAIR_ACTIVE.load(Ordering::Acquire) {
+        return native_team;
+    }
+
+    let decision = TEAM_STATE
+        .lock()
+        .map(|mut state| state.observe_get_team(side, native_team))
+        .unwrap_or_else(|_| GetTeamDecision::native(native_team));
+    match decision.event {
+        DecisionEvent::FixtureObserved => write_log(&format!(
+            "SEASON_TEAM_COMPAT: fixture observed side={side} team={native_team}\n"
+        )),
+        DecisionEvent::UserObserved => write_log(&format!(
+            "SEASON_TEAM_COMPAT: user observed side={side} team={native_team}\n"
+        )),
+        DecisionEvent::NativePairConfirmed => write_log(&format!(
+            "SEASON_TEAM_COMPAT: native pair confirmed side={side} team={native_team}\n"
+        )),
+        DecisionEvent::ConflictingNativePair => write_log(&format!(
+            "SEASON_TEAM_COMPAT: conflicting native pair at side={side}; state cleared\n"
+        )),
+        DecisionEvent::Corrected => write_log(&format!(
+            "SEASON_TEAM_COMPAT: corrected GetTeam side={side} native={native_team} fixture={}\n",
+            decision.team
+        )),
+        DecisionEvent::None => {}
+    }
+    decision.team
+}
+
+unsafe fn worker() {
+    let mut base = 0usize;
+    for _ in 0..600u32 {
+        base = GetModuleHandleA(c"CardsDLL_Win64_retail.dll".as_ptr().cast()) as usize;
+        if base != 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(500));
+    }
+    if base == 0 || !validate_cards_build(base) {
+        write_log("SEASON_TEAM_COMPAT: CardsDLL unavailable/invalid; inactive\n");
+        return;
+    }
+    if !target_matches(base, FIXTURE_PROJECTOR_RVA, &FIXTURE_PROJECTOR_SIGNATURE)
+        || !target_matches(base, GET_TEAM_RVA, &GET_TEAM_SIGNATURE)
+    {
+        write_log("SEASON_TEAM_COMPAT: target signature mismatch; inactive\n");
+        return;
+    }
+
+    if !install_detour(
+        base,
+        FIXTURE_PROJECTOR_RVA,
+        "OfflineSeason_fixture_projector",
+        FIXTURE_PROJECTOR_SIGNATURE.len(),
+        &FIXTURE_PROJECTOR_SIGNATURE,
+        fixture_projector_wrapper as *const () as usize,
+        &FIXTURE_PROJECTOR_TRAMPOLINE,
+    ) {
+        write_log("SEASON_TEAM_COMPAT: fixture projector hook failed; inactive\n");
+        return;
+    }
+    if !install_detour_reloc(
+        base,
+        GET_TEAM_RVA,
+        "CardsGameSetupAdapter_GetTeam",
+        GET_TEAM_SIGNATURE.len(),
+        &GET_TEAM_SIGNATURE,
+        3,
+        7,
+        get_team_wrapper as *const () as usize,
+        &GET_TEAM_TRAMPOLINE,
+    ) {
+        write_log("SEASON_TEAM_COMPAT: GetTeam hook failed; inactive\n");
+        return;
+    }
+
+    REPAIR_ACTIVE.store(true, Ordering::Release);
+    write_log("SEASON_TEAM_COMPAT: candidate ARMED; exact fixture evidence gate enabled\n");
+}
+
+pub(crate) fn install() {
+    if !enabled(std::env::var(ENABLE_ENV).ok().as_deref()) {
+        write_log("SEASON_TEAM_COMPAT: disabled\n");
+        return;
+    }
+    write_log("SEASON_TEAM_COMPAT: requested; deferred signature validation starting\n");
+    std::thread::spawn(|| unsafe { worker() });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn feature_is_default_off() {
+        assert!(!enabled(None));
+        assert!(!enabled(Some("0")));
+        assert!(!enabled(Some("true")));
+        assert!(enabled(Some("1")));
+    }
+
+    #[test]
+    fn signature_validation_is_exact() {
+        assert!(exact_signature(&GET_TEAM_SIGNATURE, &GET_TEAM_SIGNATURE));
+        let mut changed = GET_TEAM_SIGNATURE;
+        changed[0] ^= 1;
+        assert!(!exact_signature(&changed, &GET_TEAM_SIGNATURE));
+    }
+
+    #[test]
+    fn invalid_fixture_never_arms_state() {
+        let mut state = TeamState::empty();
+        assert!(!state.capture(0, 130000));
+        assert!(!state.capture(73, 73));
+        assert_eq!(
+            state.observe_get_team(0, 130000),
+            GetTeamDecision::native(130000)
+        );
+    }
+
+    #[test]
+    fn fixture_must_be_observed_natively_before_correction() {
+        let mut state = TeamState::empty();
+        assert!(state.capture(73, 130000));
+        assert_eq!(
+            state.observe_get_team(1, 130000),
+            GetTeamDecision {
+                team: 130000,
+                event: DecisionEvent::UserObserved
+            }
+        );
+        assert_eq!(
+            state.observe_get_team(1, 130000),
+            GetTeamDecision::native(130000)
+        );
+        assert_eq!(state.fixture_get_side, UNKNOWN_SIDE);
+        assert!(!state.correction_used);
+    }
+
+    #[test]
+    fn correction_requires_native_pair_then_is_one_shot() {
+        let mut state = TeamState::empty();
+        assert!(state.capture(73, 130000));
+        assert_eq!(
+            state.observe_get_team(0, 73),
+            GetTeamDecision {
+                team: 73,
+                event: DecisionEvent::FixtureObserved
+            }
+        );
+        assert_eq!(
+            state.observe_get_team(1, 130000),
+            GetTeamDecision {
+                team: 130000,
+                event: DecisionEvent::NativePairConfirmed
+            }
+        );
+        assert_eq!(
+            state.observe_get_team(1, 130000),
+            GetTeamDecision {
+                team: 73,
+                event: DecisionEvent::Corrected
+            }
+        );
+        assert_eq!(
+            state.observe_get_team(1, 130000),
+            GetTeamDecision::native(130000)
+        );
+    }
+
+    #[test]
+    fn second_fixture_replaces_all_prior_state() {
+        let mut state = TeamState::empty();
+        assert!(state.capture(73, 130000));
+        assert_eq!(state.observe_get_team(0, 73).team, 73);
+        assert_eq!(state.observe_get_team(1, 130000).team, 130000);
+        assert_eq!(state.observe_get_team(1, 130000).team, 73);
+
+        assert!(state.capture(240, 130000));
+        assert_eq!(state.fixture_get_side, UNKNOWN_SIDE);
+        assert_eq!(state.user_get_side, UNKNOWN_SIDE);
+        assert!(!state.correction_used);
+        assert_eq!(state.observe_get_team(0, 240).team, 240);
+        assert_eq!(state.observe_get_team(1, 130000).team, 130000);
+        assert_eq!(state.observe_get_team(1, 130000).team, 240);
+    }
+
+    #[test]
+    fn conflicting_fixture_sides_fail_closed() {
+        let mut state = TeamState::empty();
+        assert!(state.capture(73, 130000));
+        assert_eq!(
+            state.observe_get_team(0, 73).event,
+            DecisionEvent::FixtureObserved
+        );
+        assert_eq!(
+            state.observe_get_team(1, 73).event,
+            DecisionEvent::ConflictingNativePair
+        );
+        assert_eq!(state, TeamState::empty());
+    }
+}

openfut-hook/src/season_trace.rs

@@ -0,0 +1,703 @@
+//! Passive, behavior-preserving diagnostic traces for FIFA 17's offline-season
+//! entry flow.
+//!
+//! RE (2026-08-19, live memory) placed the "problem communicating with the FIFA
+//! Ultimate Team servers" modal in the `futOfflineSeasonEntry` ActionScript's
+//! season-load path. A first trace on the load completion `FUN_1800578e0`
+//! (`0x578e0`) armed but NEVER fired on an entry attempt — so the modal is raised
+//! before that callback runs. These traces log the actual CardsDLL season-native
+//! call sequence (which functions the entry screen reaches, and in what order) so
+//! we can see exactly where the flow stops/fails. Every trace is read-only: it
+//! logs, then calls the original through a trampoline; it never alters control
+//! flow. Targets are chosen so their copied prologues are position-independent
+//! (no rip-relative / rel32 in the copied bytes).
+
+use core::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::OnceLock;
+
+use windows_sys::Win32::System::Diagnostics::Debug::FlushInstructionCache;
+use windows_sys::Win32::System::LibraryLoader::GetModuleHandleA;
+use windows_sys::Win32::System::Memory::{
+    VirtualAlloc, VirtualProtect, MEM_COMMIT, MEM_RESERVE, PAGE_EXECUTE_READ,
+    PAGE_EXECUTE_READWRITE, PAGE_READWRITE,
+};
+use windows_sys::Win32::System::Threading::GetCurrentProcess;
+
+use crate::sbc_trace::{
+    absolute_jump, allocate_trampoline, readable_range, target_va, validate_cards_build,
+};
+use crate::write_log;
+
+static REPORTS: AtomicUsize = AtomicUsize::new(0);
+
+pub(crate) unsafe fn rd_i32(addr: usize) -> Option<i32> {
+    readable_range(addr, 4).then(|| core::ptr::read_volatile(addr as *const i32))
+}
+pub(crate) unsafe fn rd_u8(addr: usize) -> Option<u8> {
+    readable_range(addr, 1).then(|| core::ptr::read_volatile(addr as *const u8))
+}
+/// Read a NUL-terminated string safely (bounded, only reads mapped bytes).
+pub(crate) unsafe fn rd_cstr(addr: usize, max: usize) -> String {
+    if addr == 0 || !readable_range(addr, 1) {
+        return String::from("<unreadable>");
+    }
+    let mut out = Vec::new();
+    let mut i = 0;
+    while i < max && readable_range(addr + i, 1) {
+        let b = core::ptr::read_volatile((addr + i) as *const u8);
+        if b == 0 {
+            break;
+        }
+        out.push(b);
+        i += 1;
+    }
+    String::from_utf8_lossy(&out).into_owned()
+}
+
+/// Generic passive detour: overwrite the first `copy_len` bytes of `target` (which
+/// MUST be whole, position-independent instructions) with an absolute jump to
+/// `wrapper`; the wrapper calls the trampoline (copied prologue + jump back).
+pub(crate) unsafe fn install_detour(
+    base: usize,
+    rva: usize,
+    name: &str,
+    copy_len: usize,
+    signature: &[u8],
+    wrapper: usize,
+    trampoline_slot: &AtomicUsize,
+) -> bool {
+    let Some(target) = target_va(base, rva) else {
+        write_log(&format!("SEASON_TRACE: {name}: VA overflow\n"));
+        return false;
+    };
+    if !readable_range(target, copy_len)
+        || core::slice::from_raw_parts(target as *const u8, copy_len) != signature
+    {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: prologue signature mismatch at {target:#x}; skip\n"
+        ));
+        return false;
+    }
+    let Some(trampoline) = allocate_trampoline(target, copy_len) else {
+        write_log(&format!("SEASON_TRACE: {name}: trampoline alloc failed\n"));
+        return false;
+    };
+    trampoline_slot.store(trampoline, Ordering::Release);
+    let mut patch = [0x90u8; 24];
+    let jump = absolute_jump(wrapper);
+    patch[..jump.len()].copy_from_slice(&jump);
+    let mut old = 0u32;
+    if VirtualProtect(target as _, copy_len, PAGE_EXECUTE_READWRITE, &mut old) == 0 {
+        write_log(&format!("SEASON_TRACE: {name}: VirtualProtect failed\n"));
+        return false;
+    }
+    core::ptr::copy_nonoverlapping(patch.as_ptr(), target as *mut u8, copy_len);
+    let flushed = FlushInstructionCache(GetCurrentProcess(), target as _, copy_len) != 0;
+    let mut ignored = 0u32;
+    VirtualProtect(target as _, copy_len, old, &mut ignored);
+    if flushed {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: installed at {target:#x} (tramp {trampoline:#x})\n"
+        ));
+        true
+    } else {
+        write_log(&format!("SEASON_TRACE: {name}: flush failed\n"));
+        false
+    }
+}
+
+fn log_call(name: &str, rcx: usize, rdx: usize, r8: usize) {
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        write_log(&format!(
+            "SEASON_CALL: {name} rcx={rcx:#x} rdx={rdx:#x} r8={r8:#x}\n"
+        ));
+    }
+}
+
+/// Declare a passive 4-register-arg call trace. The wrapper is entered via the
+/// abs-jump patched over the target prologue (original args in rcx/rdx/r8/r9,
+/// caller's return address on the stack), logs, then tail-calls the original via
+/// the trampoline. A 4-arg/usize-return signature safely covers these season
+/// natives (<=4 integer args, void/int returns).
+macro_rules! season_call_trace {
+    ($wrap:ident, $tramp:ident, $name:literal) => {
+        static $tramp: AtomicUsize = AtomicUsize::new(0);
+        unsafe extern "system" fn $wrap(rcx: usize, rdx: usize, r8: usize, r9: usize) -> usize {
+            log_call($name, rcx, rdx, r8);
+            let t = $tramp.load(Ordering::Acquire);
+            if t == 0 {
+                return 0;
+            }
+            let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+                core::mem::transmute(t);
+            original(rcx, rdx, r8, r9)
+        }
+    };
+}
+
+season_call_trace!(
+    load_current_native_wrapper,
+    LOAD_CURRENT_NATIVE_TRAMP,
+    "LoadCurrentOfflineSeason_native"
+);
+season_call_trace!(
+    start_season_native_wrapper,
+    START_SEASON_NATIVE_TRAMP,
+    "StartSeason_native"
+);
+season_call_trace!(
+    get_info_native_wrapper,
+    GET_INFO_NATIVE_TRAMP,
+    "GetOfflineSeasonInfo_native"
+);
+// Real LoadOfflineSeasons native (FUN_18004ee10) — what _LoadCurrentSeason
+// actually calls; hands the callback name to the manager's async slot 0x80.
+season_call_trace!(
+    load_offline_real_wrapper,
+    LOAD_OFFLINE_REAL_TRAMP,
+    "LoadOfflineSeasons_native(0x4ee10)"
+);
+// Async LoadOfflineSeasons impl (mgr slot 0x80, FUN_180057560): reads the season
+// count and invokes the LoadSeasons_Complete AS callback.
+season_call_trace!(
+    load_offline_async_wrapper,
+    LOAD_OFFLINE_ASYNC_TRAMP,
+    "LoadOfflineSeasons_asyncimpl(0x57560)"
+);
+
+// LoadCurrentOfflineSeason IMPL (manager slot 0x20): registers the load callbacks
+// and starts the async op. param_1=manager, param_2=state byte, param_3=seasonId
+// string ptr. Logs those, then calls the original.
+static LOAD_CURRENT_IMPL_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn load_current_impl_wrapper(
+    param_1: usize,
+    param_2: usize,
+    param_3: usize,
+    param_4: usize,
+) -> usize {
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        // param_3 -> C string season id (best-effort read of first bytes).
+        let sid = if param_3 != 0 && readable_range(param_3, 8) {
+            let p = *(param_3 as *const usize);
+            if p != 0 && readable_range(p, 8) {
+                *(p as *const u64)
+            } else {
+                0
+            }
+        } else {
+            0
+        };
+        write_log(&format!(
+            "SEASON_CALL: LoadCurrentOfflineSeason_impl mgr={param_1:#x} stateByte={param_2:#x} sidPtr={param_3:#x} sidHead={sid:#x}\n"
+        ));
+    }
+    let t = LOAD_CURRENT_IMPL_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(param_1, param_2, param_3, param_4)
+}
+
+// Completion callback FUN_1800578e0 (0x578e0). Kept from the first pass to confirm
+// whether it ever fires; logs the result fields it branches on.
+static COMPLETION_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn completion_wrapper(
+    ctx: usize,
+    result: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        let status = rd_i32(result + 0x1c);
+        let state = rd_u8(result + 0x68);
+        let season_id = rd_i32(result + 0x5c);
+        write_log(&format!(
+            "SEASON_LOAD_COMPLETE: ctx={ctx:#x} result={result:#x} status(+0x1c)={} state(+0x68)={} seasonId(+0x5c)={}\n",
+            status.map(|x| x.to_string()).unwrap_or_else(|| "??".into()),
+            state.map(|x| x.to_string()).unwrap_or_else(|| "??".into()),
+            season_id.map(|x| x.to_string()).unwrap_or_else(|| "??".into()),
+        ));
+    }
+    let t = COMPLETION_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(ctx, result, r8, r9)
+}
+
+// GetUsersOfflineDivision native FUN_18004eb50 (registration FUN_18004e3f0 proved
+// this binding — it is NOT LoadOfflineSeasons). Called from _InitializeScreen for
+// the division display, sync. Its prologue holds a rip-relative `MOV RCX,[rip+disp]`,
+// so it needs the relocating installer below.
+season_call_trace!(
+    get_users_division_wrapper,
+    GET_USERS_DIVISION_TRAMP,
+    "GetUsersOfflineDivision_native(0x4eb50)"
+);
+
+/// Find a free page within ~±1.5 GiB of `base`, so a rip-relative disp32 into
+/// CardsDLL data still fits after we relocate a copied prologue into it.
+unsafe fn alloc_near(base: usize, size: usize) -> Option<usize> {
+    const GRAN: usize = 0x10000;
+    let mut step = GRAN;
+    while step < 0x6000_0000 {
+        for signed in [step as isize, -(step as isize)] {
+            let cand = base.wrapping_add(signed as usize) & !(GRAN - 1);
+            if cand == 0 {
+                continue;
+            }
+            let p = VirtualAlloc(cand as _, size, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
+            if !p.is_null() {
+                return Some(p as usize);
+            }
+        }
+        step += GRAN;
+    }
+    None
+}
+
+/// Passive detour for a target whose copied prologue contains a single
+/// rip-relative operand (disp32 at `disp_off`, instruction ending at `insn_end`,
+/// both within the copied bytes). The trampoline is allocated near `base` and the
+/// disp32 is relocated so it resolves to the same absolute address. Read-only.
+#[allow(clippy::too_many_arguments)]
+pub(crate) unsafe fn install_detour_reloc(
+    base: usize,
+    rva: usize,
+    name: &str,
+    copy_len: usize,
+    signature: &[u8],
+    disp_off: usize,
+    insn_end: usize,
+    wrapper: usize,
+    trampoline_slot: &AtomicUsize,
+) -> bool {
+    let Some(target) = target_va(base, rva) else {
+        write_log(&format!("SEASON_TRACE: {name}: VA overflow\n"));
+        return false;
+    };
+    if !readable_range(target, copy_len)
+        || core::slice::from_raw_parts(target as *const u8, copy_len) != signature
+    {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: prologue signature mismatch at {target:#x}; skip\n"
+        ));
+        return false;
+    }
+    let jump = absolute_jump(wrapper);
+    let tramp_len = copy_len + jump.len();
+    let Some(tramp) = alloc_near(base, tramp_len) else {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: near trampoline alloc failed\n"
+        ));
+        return false;
+    };
+    core::ptr::copy_nonoverlapping(target as *const u8, tramp as *mut u8, copy_len);
+    // Relocate the rip-relative disp32 to keep the same absolute target.
+    let orig_disp = core::ptr::read_unaligned((target + disp_off) as *const i32) as i64;
+    let abs_target = target as i64 + insn_end as i64 + orig_disp;
+    let new_disp = abs_target - (tramp as i64 + insn_end as i64);
+    if new_disp < i32::MIN as i64 || new_disp > i32::MAX as i64 {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: reloc out of range ({new_disp:#x})\n"
+        ));
+        return false;
+    }
+    core::ptr::write_unaligned((tramp + disp_off) as *mut i32, new_disp as i32);
+    let back = absolute_jump(target + copy_len);
+    core::ptr::copy_nonoverlapping(back.as_ptr(), (tramp + copy_len) as *mut u8, back.len());
+    let mut old = 0u32;
+    if VirtualProtect(tramp as _, tramp_len, PAGE_EXECUTE_READ, &mut old) == 0 {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: trampoline protect failed\n"
+        ));
+        return false;
+    }
+    FlushInstructionCache(GetCurrentProcess(), tramp as _, tramp_len);
+    trampoline_slot.store(tramp, Ordering::Release);
+    let mut patch = [0x90u8; 24];
+    patch[..jump.len()].copy_from_slice(&jump);
+    let mut prot = 0u32;
+    if VirtualProtect(target as _, copy_len, PAGE_EXECUTE_READWRITE, &mut prot) == 0 {
+        write_log(&format!("SEASON_TRACE: {name}: VirtualProtect failed\n"));
+        return false;
+    }
+    core::ptr::copy_nonoverlapping(patch.as_ptr(), target as *mut u8, copy_len);
+    let flushed = FlushInstructionCache(GetCurrentProcess(), target as _, copy_len) != 0;
+    let mut ignored = 0u32;
+    VirtualProtect(target as _, copy_len, prot, &mut ignored);
+    if flushed {
+        write_log(&format!(
+            "SEASON_TRACE: {name}: installed(reloc) at {target:#x} (tramp {tramp:#x})\n"
+        ));
+        true
+    } else {
+        write_log(&format!("SEASON_TRACE: {name}: flush failed\n"));
+        false
+    }
+}
+
+// FutCompetitionServiceImpl::LoadOfflineSeasons FINAL completion (FUN_1800ffe90):
+// delivers the result to the AS callback LoadSeasons_Complete via
+// FUN_18019fb30->slot0x20(vm,"_global",cbref, "SUCCESS" | errString). param_1 = the
+// completion ctx (cbref at +0x18), param_2 = result obj (byte0=ok flag; +8 = error
+// string ptr when byte0==0). Logs the EXACT status string delivered. Passive.
+static FINAL_COMPLETION_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn final_completion_wrapper(
+    ctx: usize,
+    result: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    // Read the delivered status: byte0==0 => failure with an error string at +8.
+    let flag = rd_u8(result);
+    let errstr = if flag == Some(0) {
+        let p = if readable_range(result + 8, 8) {
+            core::ptr::read_volatile((result + 8) as *const usize)
+        } else {
+            0
+        };
+        rd_cstr(p, 96)
+    } else {
+        String::new()
+    };
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        let cbref = if readable_range(ctx + 0x18, 8) {
+            core::ptr::read_volatile((ctx + 0x18) as *const usize)
+        } else {
+            0
+        };
+        let kind = match flag {
+            Some(0) => "ERROR",
+            Some(_) => "SUCCESS",
+            None => "??",
+        };
+        let shown = if flag == Some(0) {
+            errstr.as_str()
+        } else {
+            "SUCCESS"
+        };
+        write_log(&format!(
+            "SEASONS_LOAD_CALLBACK: final kind={kind} result={shown:?} flag={flag:?} ctx={ctx:#x} cbref={cbref:#x}\n"
+        ));
+    }
+
+    let t = FINAL_COMPLETION_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(ctx, result, r8, r9)
+}
+
+// LoadOfflineSeasons STAGE-1 async completion (FUN_180106240): fails with
+// "CACHE_PACKNAMES_FAILED" when result==0 or *(i32)(result+0x1c)!=0; else chains
+// the next async stage. Logs whether the first async stage succeeded. Passive.
+static STAGE1_COMPLETION_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn stage1_completion_wrapper(
+    param1: usize,
+    result: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        if result == 0 {
+            write_log("SEASONS_STAGE1: result=NULL -> CACHE_PACKNAMES_FAILED\n");
+        } else {
+            let status = rd_i32(result + 0x1c);
+            let verdict = if status == Some(0) {
+                "ok(chain next)"
+            } else {
+                "CACHE_PACKNAMES_FAILED"
+            };
+            write_log(&format!(
+                "SEASONS_STAGE1: result={result:#x} status(+0x1c)={} -> {verdict}\n",
+                status.map(|x| x.to_string()).unwrap_or_else(|| "??".into()),
+            ));
+        }
+    }
+    let t = STAGE1_COMPLETION_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    original(param1, result, r8, r9)
+}
+
+// WEBFILE_DL download start FUN_18017ff90(url, ctx): param_1 (rcx) is the C-string
+// URL of the pack-names / cards-tournament-list web file. Its prologue has a
+// rip-relative `MOV R8,[DAT_1802e6580]`, so it uses the relocating installer
+// (disp32 at copied offset 7, instruction end 11).
+//
+// BASE-SUPPLY: the client's RS4::ServerSettings CDN base (DAT_1802e6408+0x30) is
+// EMPTY in the emulator — FUN_180124270 only sets it when the OSDK getter
+// slot0x3f8 is non-empty, and it has no default (unlike the API base). So every
+// FUT WEBFILE url arrives here as a BARE relative path and 999s (client
+// sentinel). We supply the missing intended `<CDN>/fut/` prefix so the REAL file
+// downloads and parses. This is a data-supply, NOT a success-forcing bypass;
+// absolute urls (containing "://", e.g. the "http://sbc/..." tile route) pass
+// through untouched.
+//
+// The prefix comes from `openfut.cfg` via `openfut-common`, the same single
+// source of truth as every redirect target, so no lab address is compiled in.
+// Unset (config missing/unusable) means NO rewrite: a url is left exactly as the
+// client built it rather than pointed at a guessed host.
+static FUT_CONTENT_BASE: OnceLock<String> = OnceLock::new();
+
+/// Arm the FUT web-file prefix from the resolved configuration. Idempotent: the
+/// first call wins.
+pub(crate) fn set_fut_content_base(base: String) {
+    let _ = FUT_CONTENT_BASE.set(base);
+}
+static URL_CAPTURE_TRAMP: AtomicUsize = AtomicUsize::new(0);
+unsafe extern "system" fn url_capture_wrapper(
+    rcx: usize,
+    rdx: usize,
+    r8: usize,
+    r9: usize,
+) -> usize {
+    let orig = rd_cstr(rcx, 256);
+    let mut arg_rcx = rcx;
+    // Owned buffer that stays alive across the original() call below. The caller
+    // frees its own url buffer immediately after FUN_18017ff90 returns, so the
+    // client copies the url synchronously during the call — a local buffer is
+    // sufficient and nothing is leaked.
+    let mut full: Vec<u8> = Vec::new();
+    if let Some(base) = FUT_CONTENT_BASE.get() {
+        if !orig.is_empty() && !orig.contains("://") {
+            full.extend_from_slice(base.as_bytes());
+            full.extend_from_slice(orig.trim_start_matches('/').as_bytes());
+            full.push(0); // NUL terminator for the C-string
+            arg_rcx = full.as_ptr() as usize;
+        }
+    }
+    let n = REPORTS.fetch_add(1, Ordering::Relaxed);
+    if n < 64 {
+        if arg_rcx != rcx {
+            write_log(&format!(
+                "SEASONS_WEBFILE_URL: orig={orig:?} rewritten={:?}\n",
+                rd_cstr(arg_rcx, 256)
+            ));
+        } else {
+            write_log(&format!("SEASONS_WEBFILE_URL: url={orig:?} (unchanged)\n"));
+        }
+    }
+    let t = URL_CAPTURE_TRAMP.load(Ordering::Acquire);
+    if t == 0 {
+        return 0;
+    }
+    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
+        core::mem::transmute(t);
+    let ret = original(arg_rcx, rdx, r8, r9);
+    drop(full); // ensure the url buffer outlives the download-start call
+    ret
+}
+
+unsafe fn worker() {
+    let mut base = 0usize;
+    for _ in 0..600u32 {
+        base = GetModuleHandleA(c"CardsDLL_Win64_retail.dll".as_ptr().cast()) as usize;
+        if base != 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(500));
+    }
+    if base == 0 || !validate_cards_build(base) {
+        write_log("SEASON_TRACE: CardsDLL unavailable/invalid; season trace inactive\n");
+        return;
+    }
+    // (rva, name, copy_len, signature, wrapper, trampoline slot)
+    install_detour(
+        base,
+        0x4eb70,
+        "LoadCurrentOfflineSeason_native",
+        15,
+        &[
+            0x40, 0x57, 0x48, 0x83, 0xec, 0x60, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff,
+            0xff,
+        ],
+        load_current_native_wrapper as *const () as usize,
+        &LOAD_CURRENT_NATIVE_TRAMP,
+    );
+    install_detour(
+        base,
+        0x4f340,
+        "StartSeason_native",
+        15,
+        &[
+            0x40, 0x57, 0x48, 0x83, 0xec, 0x60, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff,
+            0xff,
+        ],
+        start_season_native_wrapper as *const () as usize,
+        &START_SEASON_NATIVE_TRAMP,
+    );
+    install_detour(
+        base,
+        0x4e850,
+        "GetOfflineSeasonInfo_native",
+        15,
+        &[
+            0x48, 0x89, 0x5c, 0x24, 0x08, 0x48, 0x89, 0x6c, 0x24, 0x10, 0x48, 0x89, 0x74, 0x24,
+            0x18,
+        ],
+        get_info_native_wrapper as *const () as usize,
+        &GET_INFO_NATIVE_TRAMP,
+    );
+    install_detour(
+        base,
+        0x57230,
+        "LoadCurrentOfflineSeason_impl",
+        19,
+        &[
+            0x48, 0x8b, 0xc4, 0x57, 0x48, 0x81, 0xec, 0x80, 0x00, 0x00, 0x00, 0x48, 0xc7, 0x40,
+            0x98, 0xfe, 0xff, 0xff, 0xff,
+        ],
+        load_current_impl_wrapper as *const () as usize,
+        &LOAD_CURRENT_IMPL_TRAMP,
+    );
+    install_detour(
+        base,
+        0x578e0,
+        "LoadCurrentOfflineSeason_completion",
+        16,
+        &[
+            0x48, 0x8b, 0xc4, 0x57, 0x48, 0x83, 0xec, 0x70, 0x48, 0xc7, 0x40, 0xd0, 0xfe, 0xff,
+            0xff, 0xff,
+        ],
+        completion_wrapper as *const () as usize,
+        &COMPLETION_TRAMP,
+    );
+    install_detour_reloc(
+        base,
+        0x4eb50,
+        "GetUsersOfflineDivision_native",
+        14,
+        &[
+            0x48, 0x83, 0xec, 0x28, 0x48, 0x8b, 0x0d, 0x75, 0x18, 0x29, 0x00, 0x48, 0x8b, 0x01,
+        ],
+        7,
+        11,
+        get_users_division_wrapper as *const () as usize,
+        &GET_USERS_DIVISION_TRAMP,
+    );
+    install_detour(
+        base,
+        0x4ee10,
+        "LoadOfflineSeasons_native",
+        15,
+        &[
+            0x40, 0x57, 0x48, 0x83, 0xec, 0x60, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff,
+            0xff,
+        ],
+        load_offline_real_wrapper as *const () as usize,
+        &LOAD_OFFLINE_REAL_TRAMP,
+    );
+    install_detour(
+        base,
+        0x57560,
+        "LoadOfflineSeasons_asyncimpl",
+        17,
+        &[
+            0x40, 0x55, 0x56, 0x57, 0x48, 0x83, 0xec, 0x30, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe,
+            0xff, 0xff, 0xff,
+        ],
+        load_offline_async_wrapper as *const () as usize,
+        &LOAD_OFFLINE_ASYNC_TRAMP,
+    );
+    install_detour(
+        base,
+        0xffe90,
+        "LoadOfflineSeasons_final_completion",
+        16,
+        &[
+            0x48, 0x89, 0x5c, 0x24, 0x08, 0x57, 0x48, 0x83, 0xec, 0x30, 0x80, 0x3a, 0x00, 0x48,
+            0x8b, 0xda,
+        ],
+        final_completion_wrapper as *const () as usize,
+        &FINAL_COMPLETION_TRAMP,
+    );
+    install_detour(
+        base,
+        0x106240,
+        "LoadOfflineSeasons_stage1_completion",
+        15,
+        &[
+            0x48, 0x8b, 0xc4, 0x55, 0x48, 0x8d, 0x68, 0xa1, 0x48, 0x81, 0xec, 0xc0, 0x00, 0x00,
+            0x00,
+        ],
+        stage1_completion_wrapper as *const () as usize,
+        &STAGE1_COMPLETION_TRAMP,
+    );
+    install_detour_reloc(
+        base,
+        0x17ff90,
+        "start_webfile_dl_url",
+        14,
+        &[
+            0x48, 0x83, 0xec, 0x38, 0x4c, 0x8b, 0x05, 0xe5, 0x65, 0x16, 0x00, 0x4c, 0x8b, 0xd1,
+        ],
+        7,
+        11,
+        url_capture_wrapper as *const () as usize,
+        &URL_CAPTURE_TRAMP,
+    );
+    write_log("SEASON_TRACE: all season-native traces armed\n");
+}
+
+/// Arm the passive season-flow diagnostics on a deferred thread (CardsDLL is not
+/// yet loaded at DllMain time). Read-only: never changes game behavior.
+pub(crate) fn install() {
+    arm_fut_content_base();
+    write_log("SEASON_TRACE: requested; deferred signature validation starting\n");
+    std::thread::spawn(|| unsafe { worker() });
+}
+
+/// Resolve the FUT web-file prefix from `openfut.cfg` next to the game exe, via
+/// the shared `openfut-common` parser — the same single source of truth the
+/// network redirect uses, so the lab address is never compiled in.
+///
+/// Fails SAFE: an absent or unusable config arms nothing, and the url rewriter
+/// then leaves every url exactly as the client built it.
+fn arm_fut_content_base() {
+    let path = match std::env::current_exe()
+        .ok()
+        .and_then(|p| p.parent().map(|d| d.join("openfut.cfg")))
+    {
+        Some(p) => p,
+        None => {
+            write_log("SEASONS_WEBFILE_BASE: cannot locate openfut.cfg — no url rewrite\n");
+            return;
+        }
+    };
+    let contents = match std::fs::read_to_string(&path) {
+        Ok(c) => c,
+        Err(e) => {
+            write_log(&format!(
+                "SEASONS_WEBFILE_BASE: {} unreadable ({e}) — no url rewrite\n",
+                path.display()
+            ));
+            return;
+        }
+    };
+    match openfut_common::ServerConfig::parse(&contents) {
+        Ok(cfg) => {
+            let base = cfg.fut_content_base();
+            write_log(&format!("SEASONS_WEBFILE_BASE: armed {base}\n"));
+            set_fut_content_base(base);
+        }
+        Err(e) => write_log(&format!(
+            "SEASONS_WEBFILE_BASE: openfut.cfg unusable ({e}) — no url rewrite\n"
+        )),
+    }
+}

openfut-hook/src/ssl_patch.rs

@@ -1,81 +0,0 @@
-// Runtime in-memory patch for ProtoSSL's certificate verification function inside
-// EAWebKit.dll. Rather than patching the DLL on disk (offset-dependent, fragile),
-// we scan the loaded module for the function's unique byte prologue and overwrite the
-// first six bytes with `mov eax, 1; ret` — making every cert-chain validation call
-// immediately return success.
-//
-// Why this is safe: the patched function (`ProtoSSL_VerifyCert` at VA 0x180a85570 in
-// the shipped binary) is only used by ProtoSSL's TLS state machine to validate the
-// server's certificate chain.  Always returning 1 is equivalent to trusting all certs,
-// which is the behaviour we want for the local self-signed bridge certificate.
-
-use windows_sys::Win32::System::{
-    LibraryLoader::GetModuleHandleA,
-    Memory::{VirtualProtect, PAGE_EXECUTE_READWRITE},
-};
-
-// Unique 22-byte prologue of ProtoSSL's cert-verify function.
-// Confirmed present in the EA-shipped EAWebKit.dll (June 2023 build).
-const PROLOGUE: &[u8] = &[
-    0x44, 0x89, 0x44, 0x24, 0x18, // mov  [rsp+0x18], r8d
-    0x48, 0x89, 0x54, 0x24, 0x10, // mov  [rsp+0x10], rdx
-    0x56, // push rsi
-    0x57, // push rdi
-    0x41, 0x55, // push r13
-    0x41, 0x56, // push r14
-    0x41, 0x57, // push r15
-    0x48, 0x83, 0xec, 0x30, // sub  rsp, 0x30
-];
-
-// Return 0 (PROTOSSL_ERROR_NONE = success).  ProtoSSL convention: 0 = ok, negative = error.
-// The function sets r15d = 0xFFFFFFFF (-1) for its own error returns, confirming 0 = success.
-const PATCH: &[u8] = &[
-    0x31, 0xc0, // xor eax, eax  (eax = 0 = PROTOSSL_ERROR_NONE)
-    0xc3, // ret
-    0x90, 0x90, 0x90, // nop padding
-];
-
-fn patch_module(module: isize, scan_bytes: usize) -> bool {
-    if module == 0 {
-        return false;
-    }
-    let base = module as usize;
-    let image: &[u8] = unsafe { core::slice::from_raw_parts(base as *const u8, scan_bytes) };
-    let offset = match image.windows(PROLOGUE.len()).position(|w| w == PROLOGUE) {
-        Some(o) => o,
-        None => return false,
-    };
-    let target = (base + offset) as *mut u8;
-    let mut old_prot: u32 = 0;
-    unsafe {
-        VirtualProtect(
-            target as *const core::ffi::c_void,
-            PATCH.len(),
-            PAGE_EXECUTE_READWRITE,
-            &mut old_prot,
-        );
-        core::ptr::copy_nonoverlapping(PATCH.as_ptr(), target, PATCH.len());
-        VirtualProtect(
-            target as *const core::ffi::c_void,
-            PATCH.len(),
-            old_prot,
-            &mut old_prot,
-        );
-    }
-    true
-}
-
-/// Patch ProtoSSL cert-verify in EAWebKit.dll (call when EAWebKit is loaded).
-pub unsafe fn patch_eawebkit_cert_verify() -> bool {
-    let module = GetModuleHandleA(c"EAWebKit.dll".as_ptr().cast()) as isize;
-    // EAWebKit.dll is ~22 MB
-    patch_module(module, 24 * 1024 * 1024)
-}
-
-/// Patch ProtoSSL cert-verify compiled into FIFA23.exe itself (DirtySDK's copy).
-/// The main exe is ~100 MB; confirmed present at file offset 0xf0c850.
-pub unsafe fn patch_main_exe_cert_verify() -> bool {
-    let module = GetModuleHandleA(core::ptr::null()) as isize;
-    // Scan first 110 MB — the function is near offset 0xf0c850 (~15 MB in)
-    patch_module(module, 110 * 1024 * 1024)
-}

openfut-hook/src/store_entry.rs

@@ -0,0 +1,485 @@
+//! FIFA 17 store tab-bar repair — pre-warm the purchase groups before screen-show.
+//!
+//! # Confirmed root cause (live, 2026-08-19)
+//!
+//! `FUN_18007e5e0(ctx, panel)` is the native tab binder the screen framework
+//! invokes at store screen-show. It is an unrolled six-slot loop; each slot gates
+//! on one hard-coded category token and either publishes that group's id as
+//! `PANEL_ID` for the slot, or hides the slot:
+//!
+//! ```text
+//! if (FUN_180014df0(_, idx))                                  // token present?
+//!     (*(panel_vtbl+0x48))(panel, slot, "PANEL_ID", FUN_180014580(_, idx));
+//! else
+//!     (*(panel_vtbl+0xa0))(panel, slot);                      // hide slot
+//! ```
+//!
+//! slot -> token, in bind order: `mypacks, bronze, silver, gold, special, points`.
+//! The gate `FUN_180014df0` resolves the token through `FUN_180014380`, which scans
+//! the loaded purchase groups (stride `0x108`) comparing the token at `group+0x70`.
+//! So a tab appears iff a purchase group carrying that token is loaded AT BIND TIME.
+//!
+//! The bind detour below measured the ground truth on the retail client:
+//!
+//! ```text
+//! STORE_TABS: bind generation=2 mask=0x00 ...        <- empty at screen-show
+//! STORE_TABS: rebound generation=2 mask=0x0e (...)   <- groups present ~instantly after
+//! ```
+//!
+//! `mask=0x00` at screen-show confirms the container is empty when the framework
+//! binds, so all six slots hide and no tab bar is built. The store's own
+//! `GET store/purchasegroup/all` only returns *after* screen-show, so re-entry works
+//! (groups cached) but first entry does not. (`0x0e` = bronze|silver|gold; bit 0
+//! `mypacks` is clear because an empty My Packs serves no `mypacks` group.)
+//!
+//! # What did NOT work, and why this module changed
+//!
+//! A previous version re-invoked the binder at the next render, once the groups had
+//! arrived (`rebound ... mask=0x0e` above). The movie built NO tab bar from that
+//! late bind: the Scaleform movie only honours the framework's OWN bind at
+//! screen-show, not a later re-publish/commit. That approach is abandoned.
+//!
+//! # This module: make the container non-empty BEFORE the first bind
+//!
+//! The only publish the movie honours is the framework's bind at screen-show, and
+//! re-entry proves that bind builds the bar correctly when the container is already
+//! full. So the fix is to load the purchase groups BEFORE the store screen is shown.
+//!
+//! `FUN_180017870(storefront)` issues the store's own `GET store/purchasegroup/all`.
+//! Firing it from the FUT hub event pump (a real game thread, well before the store
+//! screen exists) gives the response time to arrive and populate the container, so
+//! the first screen-show bind sees a full list and binds the tabs natively — exactly
+//! the re-entry path, on first entry.
+//!
+//! The bind detour is retained purely as the SENSOR: the first-entry bind mask is
+//! the safe, definitive measurement of whether the pre-warm populated the container
+//! in time. `mask != 0` at first bind ⇒ pre-warm worked and the tabs bind natively;
+//! `mask == 0` (with `storefront_seen=1` in the pre-warm log) ⇒ a hub-time request
+//! cannot land in time and the remaining route is the extracted `StoreFront.apt`.
+//!
+//! # Fail-closed
+//!
+//! * Pre-warm fires at most once per process, claimed atomically, and only once the
+//!   storefront singleton is non-null; the storefront pointer is read through a
+//!   guarded load and the request function's signature is validated before the call.
+//! * The bind detour only reads (captures pointers, probes the game's own gate with
+//!   a provably-dead `this`) and never mutates store state.
+//! * Image plus every function signature are verified before any write and again
+//!   under thread suspension; one wrong byte aborts with no write and no call.
+//!
+//! # Promotion
+//!
+//! PROMOTED: armed by the build, never by an environment variable (see
+//! [`REPAIR_PROMOTED`]). Rollback is a `version.dll` file swap.
+
+use core::ffi::c_void;
+use core::sync::atomic::{AtomicBool, AtomicU32, AtomicU64, AtomicUsize, Ordering};
+use windows_sys::Win32::System::Diagnostics::Debug::FlushInstructionCache;
+use windows_sys::Win32::System::LibraryLoader::{
+    GetModuleHandleA, GetModuleHandleExA, GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS,
+    GET_MODULE_HANDLE_EX_FLAG_PIN,
+};
+use windows_sys::Win32::System::Memory::{
+    VirtualFree, VirtualProtect, MEM_RELEASE, PAGE_EXECUTE_READWRITE,
+};
+use windows_sys::Win32::System::Threading::{GetCurrentProcess, GetCurrentThreadId};
+
+/// Native tab binder `FUN_18007e5e0(ctx, panel)`, invoked by the screen framework
+/// at screen-show. Detoured as the read-only sensor: captures the gate mask it saw.
+const BIND_RVA: usize = 0x7e5e0;
+/// Category gate `FUN_180014df0(dead_this, idx) -> bool`: maps `idx` to one of the
+/// six hard-coded tokens and reports whether a loaded purchase group carries it.
+const HAS_CATEGORY_RVA: usize = 0x14df0;
+/// `FUN_180017870(storefront)` issues `GET store/purchasegroup/all` — the exact call
+/// the store screen makes at entry (from `0x18007f25e`). Fired early to pre-warm.
+const REQUEST_GROUPS_RVA: usize = 0x17870;
+/// `*(base + STOREFRONT_GLOBAL_RVA)` is the storefront the store code passes to its
+/// request/lookup helpers (loaded at `0x18007f25e`, right before the pack-list GET).
+const STOREFRONT_GLOBAL_RVA: usize = 0x2de0d0;
+
+/// Gate indices in slot order: `mypacks, bronze, silver, gold, special, points`.
+/// Taken from the binder's unrolled call sequence, not from the index order of
+/// `FUN_180014580`'s jump table (which is deliberately different).
+const GATE_INDICES: [u32; 6] = [0, 2, 3, 4, 5, 1];
+
+/// Whole-instruction prologue length relocated into the trampoline; also the number
+/// of bytes overwritten by the entry detour. 15 bytes, a clean boundary covering the
+/// 14-byte absolute jump.
+const COPY_LEN: usize = 15;
+const ABS_JUMP_LEN: usize = 14;
+
+/// First 15 bytes of `FUN_18007e5e0`: `mov [rsp+8],rbx; mov [rsp+0x10],rbp;
+/// mov [rsp+0x18],rsi` = 5 + 5 + 5.
+const BIND_SIGNATURE: [u8; COPY_LEN] = [
+    0x48, 0x89, 0x5c, 0x24, 0x08, 0x48, 0x89, 0x6c, 0x24, 0x10, 0x48, 0x89, 0x74, 0x24, 0x18,
+];
+/// First 15 bytes of `FUN_180014df0`. Validated before we ever call it, so the gate
+/// probe only runs on the exact build it was reversed against.
+const HAS_CATEGORY_SIGNATURE: [u8; 15] = [
+    0x40, 0x53, 0x48, 0x83, 0xec, 0x20, 0x33, 0xdb, 0x44, 0x8b, 0xc3, 0x85, 0xd2, 0x74, 0x35,
+];
+/// First 18 bytes of `FUN_180017870`. Validated before we ever call it, so the
+/// pre-warm only fires the genuine request on the exact build it was reversed against.
+const REQUEST_GROUPS_SIGNATURE: [u8; 18] = [
+    0x40, 0x57, 0x48, 0x81, 0xec, 0x90, 0x00, 0x00, 0x00, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff,
+    0xff, 0xff,
+];
+
+type BindFn = unsafe extern "system" fn(*mut c_void, *mut c_void) -> *mut c_void;
+type HasCategoryFn = unsafe extern "system" fn(*mut c_void, u32) -> u8;
+type RequestGroupsFn = unsafe extern "system" fn(*mut c_void) -> usize;
+
+/// The tab-bar repair is PROMOTED: armed by the build, never by an environment
+/// variable, so every launch path (Steam, the launcher, a bare `umu-run`) behaves
+/// identically. Promotion does not weaken any check — the signature gate, the image
+/// validation and the thread quiesce all remain in the runtime evidence path.
+pub(crate) const REPAIR_PROMOTED: bool = true;
+
+/// Compile-time contract: the repair stays build-armed. Regressing it to an env gate
+/// would silently restore the missing first-entry tab bar on a normal launch, so it
+/// must be a deliberate, visible change here rather than a missing variable.
+const _: () = assert!(REPAIR_PROMOTED);
+
+static REPAIR_ENABLED: AtomicBool = AtomicBool::new(false);
+static BIND_TRAMPOLINE: AtomicUsize = AtomicUsize::new(0);
+static STORE_BASE: AtomicUsize = AtomicUsize::new(0);
+static BIND_ENTRIES: AtomicU64 = AtomicU64::new(0);
+/// Gate mask the framework's most recent bind observed (bit N = slot N would bind).
+static LAST_BIND_MASK: AtomicU32 = AtomicU32::new(0);
+static LAST_THREAD: AtomicUsize = AtomicUsize::new(0);
+/// Set once the pre-warm request has been fired (or is provably unnecessary).
+static PREWARM_DONE: AtomicBool = AtomicBool::new(false);
+static PREWARM_ATTEMPTS: AtomicU64 = AtomicU64::new(0);
+/// Highest storefront pointer observed at hub time (0 = never non-null yet). Logged
+/// so a failed pre-warm can be attributed to "storefront not up at hub" vs "fired
+/// but the response did not land before screen-show".
+static PREWARM_STOREFRONT_SEEN: AtomicUsize = AtomicUsize::new(0);
+
+/// Pure pre-warm decision, isolated for host tests.
+///
+/// Fire exactly once, and only once the storefront singleton is non-null; before
+/// that, keep waiting (a null storefront early at the hub is expected).
+fn should_prewarm(already_done: bool, storefront: usize) -> bool {
+    !already_done && storefront != 0
+}
+
+/// Probe all six category tokens with the game's own gate and return a slot mask.
+///
+/// `FUN_180014df0` forwards its `this` to `FUN_180014380`, which discards it and
+/// fetches the group container from a singleton, so a null `this` is exactly what
+/// the native code effectively passes. Called only from the bind detour, where the
+/// store subsystem is provably live.
+unsafe fn gate_mask() -> u8 {
+    let base = STORE_BASE.load(Ordering::Acquire);
+    if base == 0 {
+        return 0;
+    }
+    let Some(gate) = base.checked_add(HAS_CATEGORY_RVA) else {
+        return 0;
+    };
+    let gate_fn: HasCategoryFn = core::mem::transmute(gate);
+    let mut mask = 0u8;
+    for (slot, index) in GATE_INDICES.iter().enumerate() {
+        if gate_fn(core::ptr::null_mut(), *index) != 0 {
+            mask |= 1 << slot;
+        }
+    }
+    mask
+}
+
+/// Ask the game to load the purchase groups now, on the caller's (game) thread.
+///
+/// Called from the FUT event dispatcher so it runs on a real game thread well before
+/// the store screen is ever shown — the same thread the store screen itself would use
+/// for this call at entry. Fail-closed: base/signature/storefront all validated, at
+/// most one request per process.
+pub(crate) unsafe fn maybe_prewarm_groups() {
+    if PREWARM_DONE.load(Ordering::Acquire) || !REPAIR_ENABLED.load(Ordering::Acquire) {
+        return;
+    }
+    let base = STORE_BASE.load(Ordering::Acquire);
+    if base == 0 || !crate::sbc_trace::valid_cards_image(base) {
+        return;
+    }
+    let Some(storefront) = base
+        .checked_add(STOREFRONT_GLOBAL_RVA)
+        .and_then(|slot| crate::sbc_trace::guarded_usize(slot))
+    else {
+        return;
+    };
+    if storefront != 0 {
+        PREWARM_STOREFRONT_SEEN.store(storefront, Ordering::Release);
+    }
+    if !should_prewarm(false, storefront) {
+        // Storefront not up yet at the hub: keep waiting, do not consume the attempt.
+        return;
+    }
+    let Some(request) = base.checked_add(REQUEST_GROUPS_RVA) else {
+        return;
+    };
+    if !crate::sbc_trace::executable_range_in_image(base, request, REQUEST_GROUPS_SIGNATURE.len())
+        || core::slice::from_raw_parts(request as *const u8, REQUEST_GROUPS_SIGNATURE.len())
+            != REQUEST_GROUPS_SIGNATURE
+    {
+        return;
+    }
+    // Claim the single attempt before issuing it, so a re-entrant event can never
+    // fire a second request.
+    PREWARM_DONE.store(true, Ordering::Release);
+    PREWARM_ATTEMPTS.fetch_add(1, Ordering::Relaxed);
+    let request_fn: RequestGroupsFn = core::mem::transmute(request);
+    request_fn(storefront as *mut c_void);
+    crate::write_log(&format!(
+        "STORE_TABS: pre-warmed purchase groups at hub (storefront={storefront:#x})\n"
+    ));
+}
+
+unsafe fn restore_entry<const N: usize>(target: usize, original: &[u8; N]) -> bool {
+    let mut old = 0u32;
+    if VirtualProtect(target as _, N, PAGE_EXECUTE_READWRITE, &mut old) == 0 {
+        return false;
+    }
+    core::ptr::copy_nonoverlapping(original.as_ptr(), target as *mut u8, N);
+    let flushed = FlushInstructionCache(GetCurrentProcess(), target as _, N) != 0;
+    let mut ignored = 0u32;
+    flushed && VirtualProtect(target as _, N, old, &mut ignored) != 0
+}
+
+unsafe fn write_entry<const N: usize>(
+    target: usize,
+    destination: usize,
+    original: &[u8; N],
+) -> Result<(), bool> {
+    let mut patch = [0x90u8; N];
+    patch[..ABS_JUMP_LEN].copy_from_slice(&crate::sbc_trace::absolute_jump(destination));
+    let mut old = 0u32;
+    if VirtualProtect(target as _, N, PAGE_EXECUTE_READWRITE, &mut old) == 0 {
+        return Err(true);
+    }
+    core::ptr::copy_nonoverlapping(patch.as_ptr(), target as *mut u8, N);
+    let flushed = FlushInstructionCache(GetCurrentProcess(), target as _, N) != 0;
+    let mut ignored = 0u32;
+    if flushed && VirtualProtect(target as _, N, old, &mut ignored) != 0 {
+        Ok(())
+    } else {
+        Err(restore_entry(target, original))
+    }
+}
+
+/// Detour target for the native tab binder. Read-only sensor: records the gate mask
+/// the framework's bind is about to act on, then runs the original unchanged. This is
+/// the definitive measurement of whether the pre-warm populated the container in time.
+unsafe extern "system" fn bind_wrapper(ctx: *mut c_void, panel: *mut c_void) -> *mut c_void {
+    let mask = gate_mask();
+    LAST_BIND_MASK.store(mask as u32, Ordering::Release);
+    LAST_THREAD.store(GetCurrentThreadId() as usize, Ordering::Relaxed);
+    BIND_ENTRIES.fetch_add(1, Ordering::AcqRel);
+    let original: BindFn = core::mem::transmute(BIND_TRAMPOLINE.load(Ordering::Acquire));
+    original(ctx, panel)
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum InstallOutcome {
+    Installed,
+    CleanFailure,
+    DegradedHookActive,
+    DegradedProcessState,
+    DegradedHookAndProcess,
+}
+
+unsafe fn install_hook(base: usize) -> InstallOutcome {
+    let Some(bind) = crate::sbc_trace::target_va(base, BIND_RVA) else {
+        return InstallOutcome::CleanFailure;
+    };
+    let Some(gate) = crate::sbc_trace::target_va(base, HAS_CATEGORY_RVA) else {
+        return InstallOutcome::CleanFailure;
+    };
+    let Some(request) = crate::sbc_trace::target_va(base, REQUEST_GROUPS_RVA) else {
+        return InstallOutcome::CleanFailure;
+    };
+    // Fingerprint the image and ALL THREE functions: the one we detour and the two we
+    // call (gate probe, group request). A single mismatched byte aborts cleanly with
+    // no write and no call.
+    if !crate::sbc_trace::valid_cards_image(base)
+        || !crate::sbc_trace::executable_range_in_image(base, bind, BIND_SIGNATURE.len())
+        || !crate::sbc_trace::executable_range_in_image(base, gate, HAS_CATEGORY_SIGNATURE.len())
+        || !crate::sbc_trace::executable_range_in_image(
+            base,
+            request,
+            REQUEST_GROUPS_SIGNATURE.len(),
+        )
+        || core::slice::from_raw_parts(bind as *const u8, BIND_SIGNATURE.len()) != BIND_SIGNATURE
+        || core::slice::from_raw_parts(gate as *const u8, HAS_CATEGORY_SIGNATURE.len())
+            != HAS_CATEGORY_SIGNATURE
+        || core::slice::from_raw_parts(request as *const u8, REQUEST_GROUPS_SIGNATURE.len())
+            != REQUEST_GROUPS_SIGNATURE
+    {
+        return InstallOutcome::CleanFailure;
+    }
+    let mut pinned = core::ptr::null_mut();
+    if GetModuleHandleExA(
+        GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_PIN,
+        bind as *const u8,
+        &mut pinned,
+    ) == 0
+        || pinned as usize != base
+    {
+        return InstallOutcome::CleanFailure;
+    }
+    let Some(trampoline) = crate::sbc_trace::allocate_trampoline(bind, COPY_LEN) else {
+        return InstallOutcome::CleanFailure;
+    };
+    BIND_TRAMPOLINE.store(trampoline, Ordering::Release);
+    STORE_BASE.store(base, Ordering::Release);
+
+    let Some(_gate_lock) = crate::sbc_trace::acquire_patch_installer_gate() else {
+        VirtualFree(trampoline as _, 0, MEM_RELEASE);
+        BIND_TRAMPOLINE.store(0, Ordering::Release);
+        return InstallOutcome::CleanFailure;
+    };
+    let mut peers = match crate::sbc_trace::suspend_peers(bind, bind) {
+        Ok(peers) => peers,
+        Err(crate::sbc_trace::QuiesceFailure::Acquire) => {
+            VirtualFree(trampoline as _, 0, MEM_RELEASE);
+            BIND_TRAMPOLINE.store(0, Ordering::Release);
+            return InstallOutcome::CleanFailure;
+        }
+        Err(crate::sbc_trace::QuiesceFailure::Resume) => {
+            return InstallOutcome::DegradedProcessState;
+        }
+    };
+    let final_valid = crate::sbc_trace::valid_cards_image(base)
+        && core::slice::from_raw_parts(bind as *const u8, BIND_SIGNATURE.len()) == BIND_SIGNATURE;
+    let transaction = if !final_valid {
+        InstallOutcome::CleanFailure
+    } else {
+        match write_entry(bind, bind_wrapper as *const () as usize, &BIND_SIGNATURE) {
+            Ok(()) => InstallOutcome::Installed,
+            Err(true) => InstallOutcome::CleanFailure,
+            Err(false) => InstallOutcome::DegradedHookActive,
+        }
+    };
+    let resumed = peers.resume_all();
+    let outcome = if resumed {
+        transaction
+    } else if matches!(
+        transaction,
+        InstallOutcome::Installed | InstallOutcome::DegradedHookActive
+    ) {
+        InstallOutcome::DegradedHookAndProcess
+    } else {
+        InstallOutcome::DegradedProcessState
+    };
+    if outcome == InstallOutcome::CleanFailure {
+        VirtualFree(trampoline as _, 0, MEM_RELEASE);
+        BIND_TRAMPOLINE.store(0, Ordering::Release);
+    }
+    outcome
+}
+
+unsafe fn worker() {
+    let _pending = crate::sbc_trace::CodeInstallerPending;
+    let mut base = 0usize;
+    for _ in 0..600u32 {
+        base = GetModuleHandleA(c"CardsDLL_Win64_retail.dll".as_ptr().cast()) as usize;
+        if base != 0 {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(500));
+    }
+    let outcome = if base == 0 {
+        InstallOutcome::CleanFailure
+    } else {
+        install_hook(base)
+    };
+    drop(_pending);
+    match outcome {
+        InstallOutcome::Installed => {
+            crate::write_log("STORE_TABS: bind sensor + pre-warm installed (promoted)\n")
+        }
+        InstallOutcome::CleanFailure => {
+            crate::write_log("STORE_TABS: clean install failure; inactive\n");
+            return;
+        }
+        InstallOutcome::DegradedHookActive => {
+            crate::write_log("STORE_TABS: DEGRADED hook may be active; terminate game now\n");
+            return;
+        }
+        InstallOutcome::DegradedProcessState => {
+            crate::write_log("STORE_TABS: DEGRADED thread state; terminate game now\n");
+            return;
+        }
+        InstallOutcome::DegradedHookAndProcess => {
+            crate::write_log("STORE_TABS: DEGRADED hook and thread state; terminate game now\n");
+            return;
+        }
+    }
+
+    let mut binds_seen = 0u64;
+    let mut reports = 0u8;
+    while reports < 64 {
+        std::thread::sleep(std::time::Duration::from_millis(250));
+        let binds = BIND_ENTRIES.load(Ordering::Acquire);
+        if binds != binds_seen {
+            crate::write_log(&format!(
+                "STORE_TABS: bind generation={} mask={:#04x} prewarm_fired={} storefront_seen={:#x} tid={}\n",
+                binds,
+                LAST_BIND_MASK.load(Ordering::Acquire),
+                PREWARM_ATTEMPTS.load(Ordering::Acquire),
+                PREWARM_STOREFRONT_SEEN.load(Ordering::Acquire),
+                LAST_THREAD.load(Ordering::Relaxed),
+            ));
+            binds_seen = binds;
+            reports += 1;
+        }
+    }
+    crate::write_log("STORE_TABS: report cap reached; hook remains installed\n");
+}
+
+pub(crate) fn install() {
+    // Promoted: armed by the build. No environment variable participates.
+    REPAIR_ENABLED.store(REPAIR_PROMOTED, Ordering::Release);
+    crate::write_log(
+        "STORE_TABS: bind sensor + pre-warm ARMED (promoted); strict signature gate\n",
+    );
+    std::thread::spawn(|| unsafe { worker() });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn gate_indices_match_the_native_slot_order() {
+        // mypacks, bronze, silver, gold, special, points — the order FUN_18007e5e0
+        // tests them in, which is NOT the index order of FUN_180014580's jump table.
+        assert_eq!(GATE_INDICES, [0, 2, 3, 4, 5, 1]);
+    }
+
+    #[test]
+    fn prewarms_once_the_storefront_is_up() {
+        assert!(should_prewarm(false, 0x1000));
+    }
+
+    #[test]
+    fn waits_while_the_storefront_is_still_null() {
+        assert!(!should_prewarm(false, 0));
+    }
+
+    #[test]
+    fn never_prewarms_twice() {
+        assert!(!should_prewarm(true, 0x1000));
+    }
+
+    #[test]
+    fn detour_signature_is_long_enough_for_the_absolute_jump() {
+        assert!(BIND_SIGNATURE.len() >= ABS_JUMP_LEN);
+        assert_eq!(COPY_LEN, BIND_SIGNATURE.len());
+    }
+
+    #[test]
+    fn request_signature_covers_the_validated_prologue() {
+        // 18 bytes: `push rdi; sub rsp,0x90; movq [rsp+0x20],-2`.
+        assert_eq!(REQUEST_GROUPS_SIGNATURE.len(), 18);
+    }
+}

openfut-hook/src/tls_bypass.rs

@@ -1,40 +0,0 @@
-use std::sync::OnceLock;
-use windows_sys::Win32::Foundation::BOOL;
-
-// CERT_CHAIN_POLICY_STATUS.dwError offset 0 = u32 error code; 0 = success.
-// We use raw pointers to avoid pulling in the full Cryptography struct tree.
-type CertVerifyChainPolicyFn = unsafe extern "system" fn(
-    *const u8, // pszPolicyOID
-    *const (), // pChainContext
-    *const (), // pPolicyPara
-    *mut u32,  // &mut pPolicyStatus.dwError (first field)
-) -> BOOL;
-
-static REAL: OnceLock<CertVerifyChainPolicyFn> = OnceLock::new();
-
-pub fn set_real(f: CertVerifyChainPolicyFn) {
-    let _ = REAL.set(f);
-}
-
-/// Hooked CertVerifyCertificateChainPolicy — always reports success.
-/// This allows the bridge's self-signed TLS cert to be accepted by the game.
-pub unsafe extern "system" fn hooked_cert_verify_chain_policy(
-    psz_policy_oid: *const u8,
-    p_chain_context: *const (),
-    p_policy_para: *const (),
-    p_policy_status: *mut u32,
-) -> BOOL {
-    if let Some(real) = REAL.get().copied() {
-        real(
-            psz_policy_oid,
-            p_chain_context,
-            p_policy_para,
-            p_policy_status,
-        );
-    }
-    // Clear the error field of CERT_CHAIN_POLICY_STATUS regardless
-    if !p_policy_status.is_null() {
-        *p_policy_status = 0;
-    }
-    1 // TRUE = verified OK
-}

openfut-hook/src/transport_watch.rs

@@ -1,227 +0,0 @@
-//! Milestone 0 — Blaze transport reachability observation.
-//!
-//! PURE LOGGING, NO NEW DETOURS. This module does not hook anything itself. It is
-//! called from the three Winsock detours the hook ALREADY installs — getaddrinfo
-//! (`hooks.rs`), connect/WSAConnect (`connect_hook.rs`) and ConnectEx
-//! (`connectex_hook.rs`) — and, when armed, emits a single grep-friendly
-//! `TRANSPORT_WATCH:` line per resolution/connect so we can answer one question:
-//!
-//!   Does the FIFA 23 client attempt ANY Blaze-flavored transport activity across a
-//!   full menu+FUT session, or none at all?
-//!
-//! Everything here is READ-ONLY: we parse the hostname / sockaddr the game passed
-//! only to describe it in the log. We never change a resolution result or a
-//! connection target — that redirect logic lives in the detours themselves and is
-//! untouched. The env kill switch `OPENFUT_TRANSPORT_WATCH=1` gates all output;
-//! disarmed (default) this module is inert (each entry point returns immediately).
-//!
-//! Future-reference note (beyond-beginner, deliberately NOT done here): a
-//! types-first design would model a `ConnectTarget` enum (Inet{ip,port} / NonInet /
-//! Short) and a `TransportEvent` and route them through the `tracing` crate with
-//! structured fields, instead of hand-formatting strings into a flat log file. That
-//! buys machine-parseable logs and log levels. For a one-shot observation gate,
-//! flat `write_log` lines that `grep` cleanly are the lower-ceremony choice.
-
-use core::sync::atomic::{AtomicBool, Ordering};
-
-/// Armed once at DLL load from `OPENFUT_TRANSPORT_WATCH`. `AtomicBool` (not a plain
-/// `static mut bool`) because the detours that read it run on arbitrary game threads;
-/// an atomic gives race-free reads with no `unsafe`. `Relaxed` is enough — this is a
-/// standalone flag with no ordering relationship to other memory.
-static ARMED: AtomicBool = AtomicBool::new(false);
-
-/// Read the env var once, at DLL load, and log the arm state. Called from `DllMain`
-/// (`install_hooks`). Reading the env in-process (rather than as a command prefix) is
-/// what makes the switch actually propagate through the umu/Proton launch — the same
-/// gotcha the probe switches hit; it works because the launch script `export`s it.
-pub fn arm_from_env() {
-    let on = std::env::var("OPENFUT_TRANSPORT_WATCH")
-        .map(|v| v == "1")
-        .unwrap_or(false);
-    ARMED.store(on, Ordering::Relaxed);
-    crate::write_log(&format!(
-        "TRANSPORT_WATCH: {} (env OPENFUT_TRANSPORT_WATCH)\n",
-        if on { "ARMED" } else { "disarmed" }
-    ));
-}
-
-fn armed() -> bool {
-    ARMED.load(Ordering::Relaxed)
-}
-
-/// True if `host` looks like EA/Blaze infrastructure. Broad on purpose: this is a log
-/// classifier that makes a hit visually pop (`<-- BLAZE/EA-FLAVORED`), NOT a routing
-/// decision. The actual redirect decision stays in `hooks::is_ea_host`, which is
-/// deliberately narrower and unchanged.
-fn is_blaze_flavored(host: &str) -> bool {
-    let h = host.to_ascii_lowercase();
-    [
-        "redirector",
-        "gosredirector",
-        "blaze",
-        "gosca",
-        "easfc",
-        "utas",
-        "fut",
-        "ea.com",
-        "easports",
-    ]
-    .iter()
-    .any(|k| h.contains(k))
-}
-
-/// Log one getaddrinfo hostname. Self-gates on the arm flag, so the call site can be
-/// unconditional. The existing `openfut_hook: getaddrinfo(...)` line stays; this adds
-/// the tagged, classified line so `grep TRANSPORT_WATCH` sees the full resolution set
-/// and a Blaze host stands out.
-pub fn note_getaddrinfo(host: &str) {
-    if !armed() {
-        return;
-    }
-    let tag = if is_blaze_flavored(host) {
-        "  <-- BLAZE/EA-FLAVORED"
-    } else {
-        ""
-    };
-    crate::write_log(&format!(
-        "TRANSPORT_WATCH: getaddrinfo host=\"{host}\"{tag}\n"
-    ));
-}
-
-const AF_INET: u16 = 2; // IPv4
-const AF_INET6: u16 = 23; // IPv6 (Windows value; Linux uses 10 — we're in Wine/Win ABI)
-
-/// Minimal view of a `sockaddr_in`; the first `u16` is the address family for ANY
-/// sockaddr, so reading this layout is safe enough to classify the family even when
-/// the real struct is a `sockaddr_un` or larger — we only trust the rest once we've
-/// confirmed `sin_family == AF_INET`.
-#[repr(C)]
-struct SockaddrIn {
-    sin_family: u16,
-    sin_port: u16,
-    sin_addr: u32,
-    sin_zero: [u8; 8],
-}
-
-/// Minimal view of a `sockaddr_in6` (Win32 layout). `sin6_port` is network byte order;
-/// `sin6_addr` is the 16 raw address bytes in network order. We ignore flowinfo/scope.
-#[repr(C)]
-struct SockaddrIn6 {
-    sin6_family: u16,
-    sin6_port: u16,
-    sin6_flowinfo: u32,
-    sin6_addr: [u8; 16],
-    sin6_scope_id: u32,
-}
-
-/// Is `port` a known/suspected Blaze port? SHAPE — public general knowledge; the exact
-/// port for FIFA23's Blaze version is UNKNOWN. 42127 main, 10041/10744 redirector
-/// variants, 3659 classic redirector.
-fn is_blaze_port(port: u16) -> bool {
-    matches!(port, 42127 | 10744 | 3659 | 10041)
-}
-
-/// Log one outbound connect attempt. `api` names the call path (`connect` /
-/// `WSAConnect` / `ConnectEx`) so we can tell which Winsock entry the client used.
-///
-/// SAFETY: `name` must point to at least `namelen` readable bytes — it's the sockaddr
-/// the game just handed to a Winsock connect API, so that always holds at the call
-/// sites. We read it read-only and never write through it. `s` is the socket handle,
-/// used only to query `SO_TYPE` (TCP=1 / UDP=2) so a real Blaze TCP dial is
-/// distinguishable from UDP game/voice traffic.
-pub unsafe fn note_connect(api: &str, name: *const u8, namelen: i32, s: usize) {
-    if !armed() {
-        return;
-    }
-    if name.is_null() || namelen < 8 {
-        crate::write_log(&format!(
-            "TRANSPORT_WATCH: {api} (no/short sockaddr, namelen={namelen})\n"
-        ));
-        return;
-    }
-    // SAFE: name is non-null and >= 8 bytes (checked above); the first u16 is the
-    // address family for ANY sockaddr, so reading it is valid regardless of the real
-    // struct type. We only trust family-specific fields after matching the family.
-    let family = *(name as *const u16);
-
-    // SAFE: getsockopt is a read-only Winsock query on a valid socket handle; a bad
-    // handle just leaves ty=-1, which we log verbatim. TCP=1 / UDP=2.
-    let sock_type = {
-        use windows_sys::Win32::Networking::WinSock::{getsockopt, SOL_SOCKET, SO_TYPE};
-        let mut ty: i32 = -1;
-        let mut len: i32 = 4;
-        getsockopt(
-            s,
-            SOL_SOCKET,
-            SO_TYPE,
-            &mut ty as *mut i32 as *mut u8,
-            &mut len,
-        );
-        ty
-    };
-
-    match family {
-        AF_INET => {
-            // SAFE: family is AF_INET and namelen >= 8 == sizeof(sockaddr_in) fields we read.
-            let sa = &*(name as *const SockaddrIn);
-            // sin_addr holds the address in NETWORK byte order; on little-endian x86,
-            // to_le_bytes reproduces those 4 bytes in memory order, which IS the dotted
-            // quad. So b[0].b[1].b[2].b[3] is correct. (The legacy connect_hook log line
-            // prints these reversed — a cosmetic bug there; this M0 line is the correct
-            // one to trust.)
-            let b = sa.sin_addr.to_le_bytes();
-            let port = u16::from_be(sa.sin_port);
-            let is_loopback = b[0] == 127;
-            let is_lsx = matches!(port, 3216 | 3217); // known-good LSX channel; not Blaze
-            let mut tag = String::new();
-            if is_blaze_port(port) {
-                tag.push_str("  <-- BLAZE-PORT");
-            }
-            // A loopback connect on anything other than LSX is the situation-(a) signal.
-            if is_loopback && !is_lsx {
-                tag.push_str("  <-- LOOPBACK non-LSX");
-            }
-            crate::write_log(&format!(
-                "TRANSPORT_WATCH: {api} target={}.{}.{}.{}:{port} sock_type={sock_type}{tag}\n",
-                b[0], b[1], b[2], b[3]
-            ));
-        }
-        AF_INET6 => {
-            if namelen < 28 {
-                crate::write_log(&format!(
-                    "TRANSPORT_WATCH: {api} family=INET6 (short sockaddr, namelen={namelen})\n"
-                ));
-                return;
-            }
-            // SAFE: family is AF_INET6 and namelen >= 28 == sizeof(sockaddr_in6).
-            let sa = &*(name as *const SockaddrIn6);
-            let a = sa.sin6_addr; // 16 bytes, network order
-            let port = u16::from_be(sa.sin6_port);
-            // Format as 8 colon-separated hex groups (not compressed — clarity over
-            // brevity for a log meant to be grepped).
-            let hex = (0..8)
-                .map(|i| format!("{:02x}{:02x}", a[i * 2], a[i * 2 + 1]))
-                .collect::<Vec<_>>()
-                .join(":");
-            // ::1 = loopback: first 15 bytes zero, last byte 1.
-            let is_loopback = a[..15].iter().all(|&x| x == 0) && a[15] == 1;
-            let mut tag = String::new();
-            if is_blaze_port(port) {
-                tag.push_str("  <-- BLAZE-PORT");
-            }
-            if is_loopback {
-                tag.push_str("  <-- IPv6 LOOPBACK (::1)");
-            }
-            crate::write_log(&format!(
-                "TRANSPORT_WATCH: {api} target=[{hex}]:{port} sock_type={sock_type} (IPv6){tag}\n"
-            ));
-        }
-        other => {
-            // AF_UNIX=1 or anything else — where a named-pipe/unix-socket-style local
-            // Blaze transport would surface.
-            crate::write_log(&format!(
-                "TRANSPORT_WATCH: {api} family={other} (non-INET — possible AF_UNIX/pipe-like)\n"
-            ));
-        }
-    }
-}

openfut-hook/tests/connect_hook.rs

@@ -0,0 +1,10 @@
+#![cfg(windows)]
+#![allow(dead_code)]
+
+// Compile the production connect hook directly into an executable test target.
+// The hook crate itself is a cdylib, whose unit-test artifact remains a DLL and
+// therefore cannot be executed by the native Windows test runner.
+fn write_log(_: &str) {}
+
+#[path = "../src/connect_hook.rs"]
+mod connect_hook;

src/app.rs

@@ -541,7 +541,7 @@ impl LauncherApp {
                     status_text(ui, readiness_status(server), &server_label);
                     ui.end_row();
 
-                    ui.label(RichText::new("Client integration").color(theme::TEXT_WEAK));
+                    ui.label(RichText::new("Game files").color(theme::TEXT_WEAK));
                     status_text(
                         ui,
                         readiness_status(integration),
@@ -555,11 +555,11 @@ impl LauncherApp {
                     );
                     ui.end_row();
 
-                    ui.label(RichText::new("Local services").color(theme::TEXT_WEAK));
+                    ui.label(RichText::new("Background helpers").color(theme::TEXT_WEAK));
                     status_text(ui, readiness_status(services), &services_label);
                     ui.end_row();
 
-                    ui.label(RichText::new("Hook DLL").color(theme::TEXT_WEAK));
+                    ui.label(RichText::new("Game patch").color(theme::TEXT_WEAK));
                     status_text(ui, readiness_status(hook), &hook_label);
                     ui.end_row();
                 });
@@ -725,13 +725,12 @@ impl LauncherApp {
         match (ready, blocked) {
             (_, true) => (launch::Readiness::Attention, "Blocked".into()),
             (2, _) => (launch::Readiness::Ready, "Ready".into()),
-            (0, _) => (
-                // Not a problem: Launch starts them. Stating "Stopped" is honest
-                // and does not demand an action.
-                launch::Readiness::Unknown,
-                "Stopped — Launch starts them".into(),
-            ),
-            (_, _) => (launch::Readiness::Unknown, "Partly running".into()),
+            // Neither stopped nor mid-start is a fault: the helpers only run
+            // alongside a session and Launch brings up whatever is missing. This
+            // used to read "Partly running", which sounds broken for what is the
+            // normal idle state and gave the player nothing to act on. Say what
+            // will happen instead.
+            (_, _) => (launch::Readiness::Unknown, "Start with the game".into()),
         }
     }
 
@@ -745,14 +744,14 @@ impl LauncherApp {
             .and_then(|body| openfut_common::ServerConfig::parse(&body).ok())
         {
             Some(d) if d == self.config.server_config() => {
-                (launch::Readiness::Ready, format!("Deployed → {}", d.host))
+                (launch::Readiness::Ready, "Installed".into())
             }
             // Launch rewrites it, so this is not something to demand action for.
-            Some(d) => (
+            Some(_) => (
                 launch::Readiness::Unknown,
-                format!("Deployed → {} · Launch updates it", d.host),
+                "Installed · Launch will update it".into(),
             ),
-            None => (launch::Readiness::Attention, "No openfut.cfg".into()),
+            None => (launch::Readiness::Attention, "Not set up".into()),
         }
     }
 
@@ -1805,7 +1804,15 @@ impl LauncherApp {
 
 impl eframe::App for LauncherApp {
     fn update(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        ctx.request_repaint_after(std::time::Duration::from_millis(500));
+        // Render continuously (present every vsync) instead of reactively. egui
+        // normally idles at a low, bursty repaint rate; on a G-Sync / FreeSync
+        // (VRR) display a windowed app that presents in bursts with idle gaps
+        // makes DWM keep moving the window in and out of the VRR path and the
+        // refresh rate swing — which the panel shows as flicker. Presenting on
+        // every frame keeps the window continuously in VRR at the display's own
+        // (variable) refresh, which is stable. vsync (on by default) paces this to
+        // the monitor rather than spinning uncapped.
+        ctx.request_repaint();
         self.drive_restart_queue();
 
         egui::TopBottomPanel::top("header")
@@ -2177,7 +2184,7 @@ fn group_thousands(digits: &str) -> String {
     let len = bytes.len();
     let mut out = String::with_capacity(len + len / 3);
     for (i, b) in bytes.iter().enumerate() {
-        if i > 0 && (len - i) % 3 == 0 {
+        if i > 0 && (len - i).is_multiple_of(3) {
             out.push(',');
         }
         out.push(*b as char);

src/arm.rs

@@ -25,6 +25,7 @@ use crate::config::LauncherConfig;
 /// Accept only hostname/IP characters. These values come from config fields that
 /// are ever only IPs or hostnames, so a surprising character is a bug — reject it
 /// rather than try to escape it into an elevated shell command.
+#[cfg(unix)]
 fn safe_host(s: &str) -> anyhow::Result<&str> {
     let t = s.trim();
     if t.is_empty() {
@@ -41,6 +42,7 @@ fn safe_host(s: &str) -> anyhow::Result<&str> {
 
 /// Build the privileged arming script. Pure and unit-tested; the effectful part
 /// ([`arm`]) only validates config and hands this to the elevated runner.
+#[cfg(unix)]
 pub(crate) fn arming_script(
     server: &str,
     redirector_port: u16,
@@ -84,6 +86,7 @@ pub(crate) fn arming_script(
 /// Human-readable list of what [`arm`] changed, in the order the script applies
 /// it. Logged by the UI so the user sees exactly what was set — not just that
 /// "something" ran under `pkexec`.
+#[cfg(unix)]
 pub(crate) fn arming_summary(
     server: &str,
     redirector_port: u16,
@@ -103,6 +106,16 @@ pub(crate) fn arming_summary(
 /// Arm the client from config, under one elevated prompt. Requires the same
 /// fields preflight reads; a missing one is a clear error, never a silent
 /// loopback fallback. Returns the applied changes for the UI to surface.
+/// On native Windows there is nothing to arm: routing is the `openfut.cfg` the
+/// client-files step writes into the game directory (read by the version.dll
+/// hook), and there is no `ptrace_scope`, DNAT, or `/etc/hosts` to set. Returns
+/// no changes so the launch sequence treats client preparation as satisfied.
+#[cfg(windows)]
+pub fn arm(_cfg: &LauncherConfig) -> anyhow::Result<Vec<String>> {
+    Ok(Vec::new())
+}
+
+#[cfg(unix)]
 pub fn arm(cfg: &LauncherConfig) -> anyhow::Result<Vec<String>> {
     let server = cfg.openfut_server_host.trim();
     if server.is_empty() {
@@ -128,7 +141,7 @@ pub fn arm(cfg: &LauncherConfig) -> anyhow::Result<Vec<String>> {
     ))
 }
 
-#[cfg(test)]
+#[cfg(all(test, unix))]
 mod tests {
     use super::*;
 

src/config.rs

@@ -54,13 +54,18 @@ pub struct GameProfile {
 impl GameProfile {
     /// Whether this profile is filled in enough to launch from.
     pub fn configured(&self) -> bool {
-        !self.runner.trim().is_empty()
-            && !self.executable.trim().is_empty()
-            && !self.game_dir.trim().is_empty()
+        // Windows starts the executable directly (no runner); unix needs a
+        // runner such as umu-run.
+        #[cfg(windows)]
+        let runner_ok = true;
+        #[cfg(unix)]
+        let runner_ok = !self.runner.trim().is_empty();
+        runner_ok && !self.executable.trim().is_empty() && !self.game_dir.trim().is_empty()
     }
 
     /// Reject a half-filled profile rather than launching something surprising.
     pub fn validate(&self) -> Result<(), String> {
+        #[cfg(unix)]
         if self.runner.trim().is_empty() {
             return Err("Game profile has no runner (e.g. umu-run).".into());
         }
@@ -70,23 +75,30 @@ impl GameProfile {
         if self.game_dir.trim().is_empty() {
             return Err("Game profile has no game directory.".into());
         }
-        if !self.prefix_links.is_empty() && self.wine_prefix.trim().is_empty() {
-            return Err("Game profile defines prefix links but no wine_prefix.".into());
-        }
-        for l in &self.prefix_links {
-            if l.link.trim().is_empty() || l.target.trim().is_empty() {
-                return Err("Game profile has a prefix link with an empty link or target.".into());
+        // Wine-prefix links and the DRM licence precondition only exist on the
+        // unix/Proton launch path; native Windows has neither.
+        #[cfg(unix)]
+        {
+            if !self.prefix_links.is_empty() && self.wine_prefix.trim().is_empty() {
+                return Err("Game profile defines prefix links but no wine_prefix.".into());
             }
-            if std::path::Path::new(&l.link).is_absolute() {
-                return Err(format!(
-                    "Prefix link {:?} must be relative to the Wine prefix.",
-                    l.link
-                ));
+            for l in &self.prefix_links {
+                if l.link.trim().is_empty() || l.target.trim().is_empty() {
+                    return Err(
+                        "Game profile has a prefix link with an empty link or target.".into(),
+                    );
+                }
+                if std::path::Path::new(&l.link).is_absolute() {
+                    return Err(format!(
+                        "Prefix link {:?} must be relative to the Wine prefix.",
+                        l.link
+                    ));
+                }
             }
-        }
-        if let Some(lic) = &self.license {
-            if lic.path.trim().is_empty() || lic.generator.trim().is_empty() {
-                return Err("Game profile licence needs both a path and a generator.".into());
+            if let Some(lic) = &self.license {
+                if lic.path.trim().is_empty() || lic.generator.trim().is_empty() {
+                    return Err("Game profile licence needs both a path and a generator.".into());
+                }
             }
         }
         Ok(())
@@ -110,7 +122,8 @@ pub struct LauncherConfig {
     pub bridge_tls_enabled: bool,
     /// Path to the built openfut_hook.dll (Windows DLL for Proton injection).
     pub hook_dll_path: String,
-    /// FIFA 23 game folder inside the Proton prefix (where the DLL is deployed).
+    /// Game folder where the hook DLL (version.dll) is deployed. Empty means
+    /// "not configured" — the hook deploy/check is skipped until the user sets it.
     pub fifa_game_dir: String,
     /// The OpenFUT server FIFA's EA traffic is redirected to. IPv4 literal or
     /// hostname. Empty means "not configured" — launching is blocked until set.
@@ -225,11 +238,9 @@ impl Default for LauncherConfig {
                 .unwrap_or_default()
                 .to_string_lossy()
                 .into(),
-            fifa_game_dir: dirs::home_dir()
-                .map(|h| h.join(".steam/steam/steamapps/common/FIFA 23"))
-                .unwrap_or_default()
-                .to_string_lossy()
-                .into(),
+            // Empty by default, like the server host and game profile: the
+            // launcher never invents a path to somebody's game install.
+            fifa_game_dir: String::new(),
             // No server configured by default — the user MUST enter one. There
             // is deliberately no loopback/localhost default.
             openfut_server_host: String::new(),
@@ -263,12 +274,57 @@ impl LauncherConfig {
             .join("config.json")
     }
 
+    /// Parse a config body, tolerating a leading UTF-8 BOM.
+    ///
+    /// Windows text editors and PowerShell's `Set-Content -Encoding UTF8` both
+    /// prepend `EF BB BF`, and `serde_json` rejects it. Kept separate from
+    /// [`Self::load`] so the BOM behaviour is testable without touching the
+    /// user's real config path.
+    pub fn parse_json(raw: &str) -> Result<Self, serde_json::Error> {
+        serde_json::from_str(raw.trim_start_matches('\u{feff}'))
+    }
+
+    /// Load the saved config.
+    ///
+    /// A MISSING file is first-run and correctly yields defaults. A file that
+    /// exists but does not parse is NOT: silently returning defaults there means
+    /// the launcher comes up pointing at the **production** ports
+    /// (`blaze_main` 42130, `account_sync` 8099) with an empty `game_profile`,
+    /// and the next [`Self::save`] writes that over the user's real settings —
+    /// losing the configuration and silently retargeting the game. That happened
+    /// on 2026-08-23 from nothing worse than a BOM.
+    ///
+    /// So an unparseable config is quarantined rather than overwritten: it is
+    /// renamed next to itself and the error is reported, leaving the operator
+    /// something to recover from.
     pub fn load() -> Self {
         let path = Self::config_path();
-        std::fs::read_to_string(&path)
-            .ok()
-            .and_then(|s| serde_json::from_str(&s).ok())
-            .unwrap_or_default()
+        let Ok(raw) = std::fs::read_to_string(&path) else {
+            return Self::default();
+        };
+        match Self::parse_json(&raw) {
+            Ok(cfg) => cfg,
+            Err(e) => {
+                let stamp = std::time::SystemTime::now()
+                    .duration_since(std::time::UNIX_EPOCH)
+                    .map(|d| d.as_secs())
+                    .unwrap_or(0);
+                let quarantine = path.with_file_name(format!("config.json.corrupt-{stamp}"));
+                let moved = std::fs::rename(&path, &quarantine).is_ok();
+                eprintln!(
+                    "openfut-launcher: {} is not valid JSON ({e}). Falling back to defaults, \
+                     which point at the PRODUCTION ports — check the server settings before \
+                     launching.{}",
+                    path.display(),
+                    if moved {
+                        format!(" Previous file kept at {}.", quarantine.display())
+                    } else {
+                        String::new()
+                    }
+                );
+                Self::default()
+            }
+        }
     }
 
     pub fn save(&self) {
@@ -314,6 +370,8 @@ impl LauncherConfig {
                 https: self.openfut_https_port,
                 blaze_redirector: self.openfut_blaze_redirector_port,
                 blaze_main: self.openfut_blaze_main_port,
+                fut_content: openfut_common::default_ports::FUT_CONTENT,
+                roster: openfut_common::default_ports::ROSTER,
             },
         }
     }
@@ -504,6 +562,52 @@ mod tests {
         assert!(c.ea_hostnames.is_empty());
     }
 
+    /// Regression, 2026-08-23: a config written by PowerShell's
+    /// `Set-Content -Encoding UTF8` carries a UTF-8 BOM. `serde_json` rejected
+    /// it, `load()` silently returned defaults, and the next `save()` wrote
+    /// those defaults over the operator's real settings — replacing the STAGING
+    /// ports with the PRODUCTION ones and emptying `game_profile`, so the
+    /// launcher could no longer start the game and would have pointed it at the
+    /// live service. Parsing must tolerate the BOM.
+    #[test]
+    fn a_bom_prefixed_config_still_parses_and_keeps_its_ports() {
+        let body = r#"{
+            "core_binary":"","bridge_binary":"","core_database_url":"",
+            "core_data_dir":"","core_listen_addr":"","bridge_listen_addr":"",
+            "bridge_captures_dir":"","bridge_core_url":"","bridge_tls_enabled":true,
+            "hook_dll_path":"","fifa_game_dir":"C:\\FIFA 17",
+            "openfut_server_host":"10.10.0.120",
+            "openfut_blaze_redirector_port":42327,
+            "openfut_blaze_main_port":42330,
+            "openfut_account_sync_port":8299
+        }"#;
+        let with_bom = format!("\u{feff}{body}");
+
+        assert!(
+            serde_json::from_str::<LauncherConfig>(&with_bom).is_err(),
+            "precondition: raw serde_json must reject the BOM, else this guards nothing"
+        );
+
+        let c = LauncherConfig::parse_json(&with_bom).expect("BOM must be tolerated");
+        assert_eq!(c.openfut_blaze_redirector_port, 42327);
+        assert_eq!(
+            c.openfut_blaze_main_port, 42330,
+            "must NOT fall back to 42130"
+        );
+        assert_eq!(
+            c.openfut_account_sync_port, 8299,
+            "must NOT fall back to 8099"
+        );
+        assert_eq!(c.fifa_game_dir, "C:\\FIFA 17");
+    }
+
+    /// Genuinely corrupt JSON must stay an error so `load()` quarantines the
+    /// file instead of overwriting it with defaults.
+    #[test]
+    fn a_corrupt_config_is_an_error_not_silent_defaults() {
+        assert!(LauncherConfig::parse_json("{not json").is_err());
+    }
+
     #[test]
     fn a_configured_profile_satisfies_launch_without_a_shell_command() {
         let mut c = LauncherConfig {

src/game_launch.rs

@@ -24,11 +24,13 @@
 //! falls back to it, so an existing working setup cannot be broken by upgrading.
 
 use parking_lot::Mutex;
+#[cfg(unix)]
 use std::collections::BTreeMap;
 use std::io::{BufRead, BufReader};
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
 use std::sync::Arc;
+#[cfg(unix)]
 use std::time::{Duration, Instant};
 
 use crate::config::GameProfile;
@@ -45,6 +47,7 @@ fn say(log: &Log, msg: impl Into<String>) {
 /// Returns once the game process has been spawned; its output continues to
 /// stream into `log` on background threads. `on_exit` fires when the process
 /// ends, which is how the launch state machine leaves its Running state.
+#[cfg(unix)]
 pub fn launch(
     profile: &GameProfile,
     log: &Log,
@@ -58,6 +61,7 @@ pub fn launch(
     }
 
     prepare_prefix(profile, log)?;
+    ensure_dll_override(profile, log);
     ensure_license(profile, log)?;
 
     let mut cmd = Command::new(&profile.runner);
@@ -95,6 +99,160 @@ pub fn launch(
     Ok(())
 }
 
+/// Windows-native launch: no Wine prefix, no `WINEDLLOVERRIDES` (the game loads
+/// the `version.dll` hook from its own directory through the normal search
+/// order), and no licence regeneration (the native loader handles DRM).
+/// Routing is the `openfut.cfg` that the client-files step already wrote into
+/// the game directory.
+///
+/// The launcher must itself be running elevated (its shortcut carries the
+/// RunAsAdmin bit): the loader requires administrator rights, and a child
+/// started with `CreateProcess` inherits the launcher's token instead of
+/// raising its own UAC prompt.
+#[cfg(windows)]
+pub fn launch(
+    profile: &GameProfile,
+    log: &Log,
+    on_exit: impl FnOnce() + Send + 'static,
+) -> anyhow::Result<()> {
+    profile.validate().map_err(anyhow::Error::msg)?;
+
+    let game_dir = PathBuf::from(&profile.game_dir);
+    if !game_dir.is_dir() {
+        anyhow::bail!("game_dir does not exist: {}", game_dir.display());
+    }
+    let exe = game_dir.join(&profile.executable);
+    if !exe.is_file() {
+        anyhow::bail!("game executable not found: {}", exe.display());
+    }
+
+    let mut cmd = Command::new(&exe);
+    cmd.current_dir(&game_dir)
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    for (k, v) in &profile.env {
+        cmd.env(k, v);
+    }
+
+    say(
+        log,
+        format!(
+            "[launcher] launching {} (cwd {})",
+            exe.display(),
+            game_dir.display()
+        ),
+    );
+
+    let child = cmd
+        .spawn()
+        .map_err(|e| anyhow::anyhow!("could not start {}: {e}", exe.display()))?;
+    stream(
+        child,
+        log.clone(),
+        "[launcher] game process exited.",
+        on_exit,
+    );
+    Ok(())
+}
+
+/// The registry key Wine reads DLL overrides from, and the one value the hook needs.
+///
+/// Wine loads its own builtin `version.dll` unless an override says otherwise, so the
+/// game-directory proxy is ignored by default. `WINEDLLOVERRIDES` fixes that only for
+/// a process we spawn ourselves — it cannot help a player who presses Play in Steam,
+/// which is why the old advice was to paste launch options by hand (see
+/// `setup::STEAM_LAUNCH_OPTIONS`). Asking a player to edit launch options is exactly
+/// the kind of step that makes this unusable for anyone who does not already know what
+/// a DLL override is.
+///
+/// Persisting the override in the prefix registry removes the manual step entirely: it
+/// survives restarts and applies to every launch path, including Steam. This mirrors
+/// what BepInEx documents for Proton (configure the proxy in winecfg rather than the
+/// environment) and what Proton itself already does in this prefix for other titles.
+#[cfg(unix)]
+const DLL_OVERRIDE_KEY: &str = r"HKCU\Software\Wine\DllOverrides";
+#[cfg(unix)]
+const HOOK_DLL_VALUE: &str = "version";
+#[cfg(unix)]
+const HOOK_DLL_OVERRIDE: &str = "native,builtin";
+
+/// `reg add` argv that persists the hook's DLL override, native-first with a builtin
+/// fallback. `/f` makes it idempotent, so this is safe to run on every launch and
+/// repairs a prefix a player has reset or replaced.
+#[cfg(unix)]
+fn dll_override_args() -> [&'static str; 10] {
+    [
+        "reg",
+        "add",
+        DLL_OVERRIDE_KEY,
+        "/v",
+        HOOK_DLL_VALUE,
+        "/t",
+        "REG_SZ",
+        "/d",
+        HOOK_DLL_OVERRIDE,
+        "/f",
+    ]
+}
+
+/// Persist the hook's DLL override into the prefix, so the game loads the proxy no
+/// matter how it is started.
+///
+/// Best-effort by design: a failure here is not fatal, because a launch we spawn also
+/// carries `WINEDLLOVERRIDES`. It is reported in plain language rather than as a Wine
+/// error, since the player cannot act on the latter.
+#[cfg(unix)]
+fn ensure_dll_override(profile: &GameProfile, log: &Log) {
+    if profile.wine_prefix.trim().is_empty() {
+        return;
+    }
+    let mut cmd = Command::new(&profile.runner);
+    cmd.args(dll_override_args())
+        .current_dir(&profile.game_dir)
+        .stdout(Stdio::null())
+        .stderr(Stdio::null());
+    for (k, v) in &profile.env {
+        cmd.env(k, v);
+    }
+    cmd.env("WINEPREFIX", &profile.wine_prefix);
+    match cmd.status() {
+        Ok(status) if status.success() => {
+            say(log, "[launcher] game files ready (mod support enabled)");
+        }
+        Ok(_) | Err(_) => say(
+            log,
+            "[launcher] could not pre-enable mod support in the game prefix; \
+             launching anyway (this launch still enables it directly)",
+        ),
+    }
+}
+
+#[cfg(all(test, unix))]
+mod override_tests {
+    use super::*;
+
+    #[test]
+    fn dll_override_is_persisted_native_first_and_idempotently() {
+        let args = dll_override_args();
+        assert_eq!(args[0], "reg");
+        assert_eq!(args[1], "add");
+        assert_eq!(
+            args[2], r"HKCU\Software\Wine\DllOverrides",
+            "Wine reads overrides from this key; a typo silently leaves the hook unloaded"
+        );
+        assert_eq!(args[4], "version", "the hook ships as a version.dll proxy");
+        assert_eq!(
+            args[8], "native,builtin",
+            "native first so the proxy wins, builtin as fallback so a missing proxy \
+             cannot make the game unlaunchable"
+        );
+        assert_eq!(
+            args[9], "/f",
+            "idempotent, so running it on every launch repairs a reset prefix"
+        );
+    }
+}
+
 /// The `WINEDLLOVERRIDES` value the game must be started with.
 ///
 /// The hook ships as a `version.dll` proxy inside the game directory, and Proton
@@ -110,6 +268,7 @@ pub fn launch(
 ///
 /// A profile that already pins `version=` wins: an operator overriding the hijack
 /// deliberately must not be silently overruled.
+#[cfg(unix)]
 fn hook_dll_overrides(env: &BTreeMap<String, String>) -> String {
     const HOOK: &str = "version=n,b";
     match env.get("WINEDLLOVERRIDES").map(|v| v.trim()) {
@@ -123,6 +282,7 @@ fn hook_dll_overrides(env: &BTreeMap<String, String>) -> String {
 ///
 /// Equivalent to `mkdir -p $WINEPREFIX/dosdevices && ln -sfn <target> <link>`:
 /// an existing link is replaced, so re-running is harmless.
+#[cfg(unix)]
 fn prepare_prefix(profile: &GameProfile, log: &Log) -> anyhow::Result<()> {
     if profile.wine_prefix.trim().is_empty() || profile.prefix_links.is_empty() {
         return Ok(());
@@ -163,6 +323,7 @@ fn prepare_prefix(profile: &GameProfile, log: &Log) -> anyhow::Result<()> {
 /// A crashed or failed launch deletes the licence, so this runs before every
 /// launch rather than only on first setup — that is the behaviour the shell
 /// script proved, and it is why a crash is normally self-healing on the next try.
+#[cfg(unix)]
 fn ensure_license(profile: &GameProfile, log: &Log) -> anyhow::Result<()> {
     let Some(lic) = &profile.license else {
         return Ok(());
@@ -222,6 +383,7 @@ fn ensure_license(profile: &GameProfile, log: &Log) -> anyhow::Result<()> {
 /// and it is reproduced deliberately — the pattern is a Windows executable name,
 /// which cannot match the launcher or a shell running it. (A `pkill -f` pattern
 /// that *can* match its own caller is a real hazard; this one cannot.)
+#[cfg(unix)]
 fn stop_generator(child: &mut Child, lic: &crate::config::LicenseCheck, log: &Log) {
     let _ = child.kill();
     let _ = child.wait();
@@ -239,6 +401,7 @@ fn stop_generator(child: &mut Child, lic: &crate::config::LicenseCheck, log: &Lo
 
 /// A relative licence path is taken as relative to the Wine prefix; an absolute
 /// one is used as given.
+#[cfg(unix)]
 fn resolve_under_prefix(prefix: &str, path: &str) -> PathBuf {
     let p = Path::new(path);
     if p.is_absolute() || prefix.trim().is_empty() {
@@ -251,6 +414,7 @@ fn resolve_under_prefix(prefix: &str, path: &str) -> PathBuf {
 /// The script's `[[ -s FILE ]]`: present *and* non-empty. A zero-byte licence is
 /// as useless as a missing one, and treating it as valid would skip the
 /// regeneration that fixes it.
+#[cfg(unix)]
 fn non_empty_file(path: &Path) -> bool {
     std::fs::metadata(path)
         .map(|m| m.len() > 0)
@@ -287,7 +451,7 @@ pub fn stream(
     });
 }
 
-#[cfg(test)]
+#[cfg(all(test, unix))]
 mod tests {
     use super::*;
     use crate::config::{LicenseCheck, PrefixLink};

src/local_services.rs

@@ -22,6 +22,7 @@ use std::{
     time::{Duration, Instant},
 };
 
+#[cfg(unix)]
 use std::os::unix::process::CommandExt;
 
 use crate::fifa17_capability::{
@@ -79,12 +80,18 @@ impl Service {
 /// keeps `spawn` responsible for reporting a missing binary, with one error message
 /// instead of two.
 fn resolve_binary(service: Service) -> PathBuf {
-    let name = service.binary();
+    let base = service.binary();
+    // On Windows the built companion is `openfut-lsx.exe`; a bare name without the
+    // extension matches neither the sibling file nor CreateProcess resolution.
+    #[cfg(windows)]
+    let name = format!("{base}.exe");
+    #[cfg(unix)]
+    let name = base.to_string();
     if let Some(dir) = std::env::current_exe()
         .ok()
         .and_then(|p| p.parent().map(Path::to_path_buf))
     {
-        let sibling = dir.join(name);
+        let sibling = dir.join(&name);
         if sibling.is_file() {
             return sibling;
         }
@@ -433,6 +440,18 @@ impl ServiceSupervisor {
     /// Start `service` only if it is not already usable. Never restarts a healthy
     /// service, and never adopts a foreign one as ours.
     pub fn ensure_running(&mut self, service: Service, spec: SpawnSpec) -> Result<Ensured, String> {
+        // On Windows the ProtoSSL cert-verify patch (autopatch's job on unix, via
+        // /proc/PID/mem) is performed in-process by the version.dll hook, so there
+        // is no autopatch process to run. LSX is different: the game dials it on
+        // 127.0.0.1:4216, so it MUST run locally here exactly as on unix.
+        #[cfg(windows)]
+        if service == Service::Autopatch {
+            self.log.lock().push(
+                "[launcher] autopatch runs in-process on Windows (version.dll hook) — nothing to start."
+                    .to_string(),
+            );
+            return Ok(Ensured::Reused);
+        }
         let runtime = self.observe(service);
         if runtime.ready() {
             self.log.lock().push(format!(
@@ -532,6 +551,7 @@ pub fn spawn(
         cmd.env("OPENFUT_AUTOPATCH_LOG", log_path);
     }
     // Put each companion in its own process group for lifecycle isolation.
+    #[cfg(unix)]
     cmd.process_group(0);
     cmd.stdout(Stdio::piped()).stderr(Stdio::piped());
 

src/main.rs

@@ -22,6 +22,9 @@ fn main() -> eframe::Result<()> {
             .with_icon(app_icon())
             .with_inner_size([1040.0, 720.0])
             .with_min_inner_size([880.0, 600.0]),
+        // Pair vsync with the display's VRR (G-Sync + Vsync is the recommended
+        // combination): frames present on the monitor's own variable refresh.
+        vsync: true,
         ..Default::default()
     };
 

src/preflight.rs

@@ -31,6 +31,7 @@ use std::time::Duration;
 use crate::config::LauncherConfig;
 
 const PROBE_TIMEOUT: Duration = Duration::from_secs(2);
+#[cfg(unix)]
 const PTRACE_SCOPE: &str = "/proc/sys/kernel/yama/ptrace_scope";
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -86,6 +87,7 @@ impl Check {
 }
 
 /// Run every applicable check. Order is the order the game exercises them.
+#[cfg(unix)]
 pub fn run(cfg: &LauncherConfig) -> Vec<Check> {
     vec![
         ptrace_scope(),
@@ -96,6 +98,16 @@ pub fn run(cfg: &LauncherConfig) -> Vec<Check> {
     ]
 }
 
+/// On native Windows the client-preparation checks (ptrace_scope, the EA
+/// redirector DNAT, `/etc/hosts`) do not apply: there is no host to arm and
+/// routing is entirely the `openfut.cfg` the hook reads. Only the two the game
+/// truly depends on remain: the backend is reachable and the deployed hook
+/// config agrees with the launcher's settings.
+#[cfg(windows)]
+pub fn run(cfg: &LauncherConfig) -> Vec<Check> {
+    vec![backend_reachable(cfg), hook_config(cfg)]
+}
+
 /// Checks that will stop the game working.
 pub fn failures(checks: &[Check]) -> usize {
     checks.iter().filter(|c| c.state == State::Fail).count()
@@ -113,6 +125,7 @@ pub fn warnings(checks: &[Check]) -> usize {
 /// Unconditional. autopatch is a workspace binary that ships alongside the
 /// launcher, so there is no configuration that could make this inapplicable —
 /// every launch runs it.
+#[cfg(unix)]
 fn ptrace_scope() -> Check {
     const NAME: &str = "ptrace_scope (autopatch)";
     match std::fs::read_to_string(PTRACE_SCOPE) {
@@ -127,6 +140,7 @@ fn ptrace_scope() -> Check {
 /// Reading `/proc` in a test would assert facts about the machine running the
 /// suite rather than about this code — and left inline, "any value is fine"
 /// was a mutation no test could catch.
+#[cfg(unix)]
 fn ptrace_verdict(raw: &str) -> Check {
     const NAME: &str = "ptrace_scope (autopatch)";
     let v = raw.trim();
@@ -146,6 +160,7 @@ fn ptrace_verdict(raw: &str) -> Check {
 ///
 /// This tests the *effect* rather than reading firewall rules, so it needs no
 /// privilege and stays honest about what the game will actually experience.
+#[cfg(unix)]
 fn ea_redirect(cfg: &LauncherConfig) -> Check {
     const NAME: &str = "EA redirector IP is redirected";
     let ip = cfg.ea_redirect_probe_ip.trim();
@@ -184,6 +199,7 @@ fn ea_redirect(cfg: &LauncherConfig) -> Check {
 /// So this is a real misconfiguration worth fixing and not a reason to expect
 /// failure. Reporting it as fatal, and then being contradicted by a working
 /// game, is how a checklist trains its user to ignore it.
+#[cfg(unix)]
 fn hostname_mapping(cfg: &LauncherConfig) -> Check {
     const NAME: &str = "EA hostnames point at OpenFUT";
     if cfg.ea_hostnames.is_empty() {
@@ -320,7 +336,7 @@ fn join(ips: &[IpAddr]) -> String {
         .join(",")
 }
 
-#[cfg(test)]
+#[cfg(all(test, unix))]
 mod tests {
     use super::*;
 

src/setup.rs

@@ -70,13 +70,13 @@ pub(crate) fn run_elevated(script: &str) -> anyhow::Result<()> {
 /// The file the injected hook reads its server address from, in the game dir.
 pub const HOOK_CFG_FILE: &str = "openfut.cfg";
 
-/// Deploy openfut_hook.dll into the FIFA 23 game directory and write
-/// openfut.cfg with the structured server configuration the hook reads.
-/// `cfg_contents` must be the full `openfut.cfg` body (see
-/// `LauncherConfig::hook_cfg_contents`) — this function does not invent any
-/// address itself, so a missing server can never silently become loopback.
-/// Uses `version.dll` as the hijack name — FIFA 23 loads it but defers to
-/// the system copy, so Proton picks up our local one first.
+/// Deploy openfut_hook.dll into the game directory and write openfut.cfg with the
+/// structured server configuration the hook reads. `cfg_contents` must be the full
+/// `openfut.cfg` body (see `LauncherConfig::hook_cfg_contents`) — this function
+/// does not invent any address itself, so a missing server can never silently
+/// become loopback. Uses `version.dll` as the hijack name: the game loads it but
+/// defers to the system copy, so the loader (native or Wine) picks up our local
+/// one first.
 pub fn deploy_hook_dll(dll_src: &Path, game_dir: &Path, cfg_contents: &str) -> anyhow::Result<()> {
     if !dll_src.exists() {
         anyhow::bail!(
@@ -126,8 +126,14 @@ pub fn hook_dll_deployed(game_dir: &Path) -> bool {
     game_dir.join("version.dll").exists()
 }
 
-/// The Steam launch options the user needs to paste in to enable the override.
-/// Proton loads local DLLs named in WINEDLLOVERRIDES ahead of system ones.
+/// Steam launch options that enable the hook's DLL override.
+///
+/// Kept only as a fallback to show a user who runs the game outside this launcher on
+/// a prefix we have never prepared. It is NOT the normal path any more: the launcher
+/// persists the override in the prefix registry itself
+/// (`game_launch::ensure_dll_override`), which applies to every launch including
+/// Steam's own Play button. Telling a player to paste launch options is exactly the
+/// kind of manual step this launcher exists to remove.
 pub const STEAM_LAUNCH_OPTIONS: &str = "WINEDLLOVERRIDES=\"version=n,b\" %command%";
 
 // ── Game launch ───────────────────────────────────────────────────────────────

src/theme.rs

@@ -299,5 +299,13 @@ fn install_style(ctx: &Context) {
     v.widgets.open.rounding = radius;
 
     style.visuals = v;
-    ctx.set_style(style);
+    // egui 0.29 keeps a separate `Style` per theme (dark/light) and renders with
+    // whichever the theme preference resolves to. `set_style` touches only the
+    // currently-active theme, so a later switch to the other one would drop our
+    // named text styles ("Hero", "Subheading", …) and panic in `TextStyle::resolve`.
+    // Install the full style into BOTH themes and pin the preference to Dark so
+    // the branded look is stable regardless of the host's system theme.
+    ctx.set_style_of(egui::Theme::Dark, style.clone());
+    ctx.set_style_of(egui::Theme::Light, style);
+    ctx.set_theme(egui::ThemePreference::Dark);
 }