feat(fifa17-hook): redirect FIFA17 sockets from shared config

The fifa17 hook path installed no connection redirect (only a module-map dump),
so FIFA17 relied entirely on Linux iptables DNAT / hosts (and had no Windows
equivalent). Add an in-process, config-driven redirect for the fifa17 build:

- openfut-common gains ResolvedServer::redirect_for_ea_port(): the single shared
  decision (EA source-port signature -> configured OpenFUT host+port, network
  byte order), reused by the hook so it and openfut.cfg agree by construction.
  Covers 443->https, 10041/42230->blaze_redirector, 42127->blaze_main.
- connect_hook: redirect_if_ea now dispatches to a config-driven rewrite when
  armed (rewrites to the CONFIGURED, possibly remote, server -- not hardcoded
  127.0.0.1), matching by EA source port so a hardcoded EA IP (159.153.51.20
  redirector) and a DNS-resolved one both land on the server. Legacy loopback
  path retained only for the not-yet-retired FIFA23 build.
- fifa17::install() reads openfut.cfg next to FIFA17.exe via openfut-common and
  installs connect + WSAConnect (IAT) + ConnectEx (shared redirect). Fail-safe:
  missing/invalid config installs NO redirect (traffic untouched), never a
  corrupt sockaddr.

Tests: openfut-common redirect map/sockaddr/endian/remote-host/unknown-port.
Cross-builds x86_64-pc-windows-gnu --features fifa17; clippy -D warnings clean.
No Linux fallback removed (migration gate).

openfut-common/src/lib.rs

@@ -115,6 +115,41 @@ pub struct ResolvedServer {
     pub ports: OpenFutPorts,
 }
 
+/// Where one matched EA connection is rewritten to, in the exact WinSock
+/// on-the-wire representation the socket hooks need. Produced by
+/// [`ResolvedServer::redirect_for_ea_port`] so the hook and the launcher's
+/// `openfut.cfg` share one decision by construction.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Redirect {
+    /// Rewritten IPv4 for `sockaddr_in.sin_addr` (network byte order in memory).
+    pub addr_nbo: u32,
+    /// Rewritten port for `sin_port` / `sin6_port` (network byte order).
+    pub port_nbo: u16,
+    /// The resolved server IPv4, for callers building an IPv6 v4-mapped address.
+    pub redirect_ip: Ipv4Addr,
+}
+
+impl ResolvedServer {
+    /// Decide the redirect for an outbound EA connection whose destination port
+    /// is `ea_port_nbo` (network byte order, as read straight from the sockaddr).
+    ///
+    /// Returns `None` when the port is not a recognised OpenFUT route — the hook
+    /// then leaves the connection untouched. The original destination IP is
+    /// intentionally ignored: matching is by the fixed EA source-port signature
+    /// ([`ea_ports`]), so a hardcoded EA IP (e.g. FIFA17's `159.153.51.20`
+    /// redirector) and a DNS-resolved one are treated identically and both land
+    /// on the configured server — no `/etc/hosts`, DNAT, or portproxy required.
+    pub fn redirect_for_ea_port(&self, ea_port_nbo: u16) -> Option<Redirect> {
+        let ea_port = u16::from_be(ea_port_nbo);
+        let dest_port = self.ports.map_source_port(ea_port)?;
+        Some(Redirect {
+            addr_nbo: sin_addr_from_ipv4(self.redirect_ip),
+            port_nbo: sin_port_nbo(dest_port),
+            redirect_ip: self.redirect_ip,
+        })
+    }
+}
+
 /// Errors loading/validating OpenFUT server configuration. Every one of these
 /// must BLOCK operation — none of them may fall back to loopback.
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -476,4 +511,58 @@ mod tests {
         };
         assert_eq!(c.resolve().unwrap_err(), ConfigError::ServerMissing);
     }
+
+    #[test]
+    fn redirect_maps_every_fifa17_route_to_configured_server() {
+        // The canonical staging cfg. Ports come from the file, not constants.
+        let resolved = ServerConfig::parse(
+            "host=10.10.0.120\nhttps_port=8443\nblaze_redirector_port=42127\nblaze_main_port=42130\n",
+        )
+        .unwrap()
+        .resolve()
+        .unwrap();
+        let server = Ipv4Addr::new(10, 10, 0, 120);
+        // (EA source port [host order], expected OpenFUT dest port)
+        for (ea, dest) in [
+            (443u16, 8443u16),
+            (10041, 42127),
+            (42230, 42127),
+            (42127, 42130),
+        ] {
+            let r = resolved
+                .redirect_for_ea_port(ea.to_be())
+                .unwrap_or_else(|| panic!("EA port {ea} should be a route"));
+            assert_eq!(u16::from_be(r.port_nbo), dest, "EA {ea} -> dest");
+            assert_eq!(r.redirect_ip, server, "EA {ea} -> server ip");
+            assert_eq!(
+                r.addr_nbo,
+                sin_addr_from_ipv4(server),
+                "EA {ea} -> sin_addr"
+            );
+        }
+    }
+
+    #[test]
+    fn redirect_leaves_unknown_ports_untouched() {
+        let resolved = ServerConfig::parse("host=10.10.0.120\n")
+            .unwrap()
+            .resolve()
+            .unwrap();
+        assert!(resolved.redirect_for_ea_port(8080u16.to_be()).is_none());
+        assert!(resolved.redirect_for_ea_port(22u16.to_be()).is_none());
+        assert!(resolved.redirect_for_ea_port(443u16.to_be()).is_some());
+    }
+
+    #[test]
+    fn redirect_targets_configured_remote_host_not_loopback() {
+        let resolved = ServerConfig::parse("host=10.10.0.120\n")
+            .unwrap()
+            .resolve()
+            .unwrap();
+        // FIFA17 redirector (hardcoded EA IP 159.153.51.20:42230) must be rewritten
+        // to the configured REMOTE server, never 127.0.0.1.
+        let r = resolved.redirect_for_ea_port(42230u16.to_be()).unwrap();
+        assert_eq!(r.redirect_ip, Ipv4Addr::new(10, 10, 0, 120));
+        assert_ne!(r.redirect_ip, Ipv4Addr::LOCALHOST);
+    }
 }

openfut-hook/Cargo.lock

@@ -2,10 +2,15 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "openfut-common"
+version = "0.1.0"
+
 [[package]]
 name = "openfut-hook"
 version = "0.1.0"
 dependencies = [
+ "openfut-common",
  "windows-sys",
 ]
 

openfut-hook/Cargo.toml

@@ -39,6 +39,10 @@ windows-sys = { version = "0.59", features = [
     "Win32_System_Diagnostics_Debug",
     "Win32_System_Kernel",
 ] }
+# Single source of truth for the OpenFUT redirect config (openfut.cfg schema,
+# EA-port -> OpenFUT-port map, WinSock byte-order helpers). Shared with the
+# launcher so the hook and openfut.cfg agree by construction.
+openfut-common = { path = "../openfut-common" }
 
 [profile.release]
 opt-level = "s"

openfut-hook/src/connect_hook.rs

@@ -97,7 +97,7 @@ unsafe fn restore_original(target: *mut u8) {
 /// The returned buffer is 28 bytes (enough for a `sockaddr_in6`); the second value is
 /// how many of those bytes are meaningful (16 for v4, 28 for v6). `pub(crate)` so the
 /// ConnectEx path can share this one implementation.
-pub(crate) unsafe fn redirect_if_ea(name: *const u8, namelen: i32) -> Option<([u8; 28], i32)> {
+unsafe fn redirect_loopback(name: *const u8, namelen: i32) -> Option<([u8; 28], i32)> {
     if namelen < 8 || name.is_null() {
         return None;
     }
@@ -172,6 +172,89 @@ pub(crate) unsafe fn redirect_if_ea(name: *const u8, namelen: i32) -> Option<([u
     }
 }
 
+/// The armed FIFA17 redirect target, resolved once from `openfut.cfg` via
+/// `openfut-common`. When set, `redirect_if_ea` rewrites matched EA connections
+/// to this configured server; when unset, the legacy loopback path is used.
+static REDIRECT: OnceLock<openfut_common::ResolvedServer> = OnceLock::new();
+
+/// Arm the config-driven redirect (FIFA17). Idempotent: the first call wins.
+pub fn set_redirect(server: openfut_common::ResolvedServer) {
+    let _ = REDIRECT.set(server);
+}
+
+/// Dispatch: config-driven (FIFA17, shared `openfut-common` map + configured
+/// host) when armed, else the legacy hardcoded-loopback rewrite.
+pub(crate) unsafe fn redirect_if_ea(name: *const u8, namelen: i32) -> Option<([u8; 28], i32)> {
+    if namelen < 8 || name.is_null() {
+        return None;
+    }
+    match REDIRECT.get() {
+        Some(server) => redirect_configured(server, name, namelen),
+        None => redirect_loopback(name, namelen),
+    }
+}
+
+/// FIFA17 config-driven rewrite. Destination host+port come from `openfut.cfg`
+/// through `openfut-common`, so the hook and the launcher agree by construction.
+/// Matching is by EA source-port signature only (see `openfut_common::ea_ports`),
+/// so a hardcoded EA IP (e.g. the `159.153.51.20:42230` redirector) and a
+/// DNS-resolved one both land on the configured — possibly remote — server. An
+/// unrecognised port returns `None` (connection left untouched). Never corrupts
+/// the sockaddr: it only writes into a fresh 28-byte buffer.
+unsafe fn redirect_configured(
+    server: &openfut_common::ResolvedServer,
+    name: *const u8,
+    namelen: i32,
+) -> Option<([u8; 28], i32)> {
+    let family = *(name as *const u16);
+    let mut buf = [0u8; 28];
+    match family {
+        AF_INET => {
+            let sa = &*(name as *const SockaddrIn);
+            let redir = server.redirect_for_ea_port(sa.sin_port)?;
+            crate::write_log(&format!(
+                "connect_hook: v4 :{} → {}:{}\n",
+                u16::from_be(sa.sin_port),
+                redir.redirect_ip,
+                u16::from_be(redir.port_nbo)
+            ));
+            let out = &mut *(buf.as_mut_ptr() as *mut SockaddrIn);
+            out.sin_family = AF_INET;
+            out.sin_port = redir.port_nbo;
+            out.sin_addr = redir.addr_nbo;
+            Some((buf, 16))
+        }
+        AF_INET6 => {
+            if namelen < 28 {
+                return None;
+            }
+            let sa6 = &*(name as *const SockaddrIn6);
+            let redir = server.redirect_for_ea_port(sa6.sin6_port)?;
+            // ::ffff:<redirect_ip> — a v4-mapped v6 target so a v6 socket sends
+            // real IPv4 packets to the configured server.
+            let o = redir.redirect_ip.octets();
+            let mut v4mapped = [0u8; 16];
+            v4mapped[10] = 0xff;
+            v4mapped[11] = 0xff;
+            v4mapped[12..16].copy_from_slice(&o);
+            crate::write_log(&format!(
+                "connect_hook: v6 :{} → ::ffff:{}:{}\n",
+                u16::from_be(sa6.sin6_port),
+                redir.redirect_ip,
+                u16::from_be(redir.port_nbo)
+            ));
+            let out = &mut *(buf.as_mut_ptr() as *mut SockaddrIn6);
+            out.sin6_family = AF_INET6;
+            out.sin6_port = redir.port_nbo;
+            out.sin6_flowinfo = 0;
+            out.sin6_addr = v4mapped;
+            out.sin6_scope_id = 0;
+            Some((buf, 28))
+        }
+        _ => None,
+    }
+}
+
 pub unsafe extern "system" fn hooked_connect(s: usize, name: *const u8, namelen: i32) -> i32 {
     let addr = CONNECT_ADDR.load(Ordering::Relaxed) as *mut u8;
 

openfut-hook/src/fifa17.rs

@@ -67,6 +67,29 @@ unsafe fn dump_modules() {
     CloseHandle(snap);
 }
 
+/// Read `openfut.cfg` from the game directory (next to `FIFA17.exe`) and resolve
+/// the OpenFUT server via the shared `openfut-common` parser. Returns `None`
+/// with a diagnostic when the file is absent or unusable, so the hook fails
+/// safe — no redirect installed rather than a corrupt one.
+fn load_server() -> Option<openfut_common::ResolvedServer> {
+    let dir = std::env::current_exe().ok()?.parent()?.to_path_buf();
+    let path = dir.join("openfut.cfg");
+    let contents = match std::fs::read_to_string(&path) {
+        Ok(c) => c,
+        Err(e) => {
+            write_log(&format!("fifa17: cannot read {}: {e}\n", path.display()));
+            return None;
+        }
+    };
+    match openfut_common::ServerConfig::parse(&contents).and_then(|c| c.resolve()) {
+        Ok(server) => Some(server),
+        Err(e) => {
+            write_log(&format!("fifa17: openfut.cfg unusable: {e}\n"));
+            None
+        }
+    }
+}
+
 /// Worker that runs AFTER DllMain returns (loader lock released). ToolHelp and
 /// other loader-touching calls are unsafe under the loader lock, so we defer them
 /// to this thread. This is what fixed the "game exits right after DllMain" issue.
@@ -79,6 +102,50 @@ unsafe extern "system" fn worker(_: *mut core::ffi::c_void) -> u32 {
     ));
     dump_modules();
     write_log("fifa17: worker complete (injection healthy)\n");
+
+    // ── FIFA17 in-process network redirect (Milestone A) ──────────────────────
+    // Route EA endpoints to the configured OpenFUT server from openfut.cfg
+    // (openfut-common is the single source of truth). No hosts/iptables/portproxy.
+    match load_server() {
+        Some(server) => {
+            write_log(&format!(
+                "fifa17: redirect armed → {} https={} redirector={} main={}\n",
+                server.redirect_ip,
+                server.ports.https,
+                server.ports.blaze_redirector,
+                server.ports.blaze_main
+            ));
+            crate::connect_hook::set_redirect(server);
+            if crate::connect_hook::install_inline_connect_hook() {
+                write_log("fifa17: connect inline-hooked\n");
+            } else {
+                write_log("fifa17: connect hook FAILED\n");
+            }
+            let wp = crate::iat::resolve(b"ws2_32.dll\0", b"WSAConnect\0");
+            if !wp.is_null() {
+                let f: unsafe extern "system" fn(
+                    usize,
+                    *const u8,
+                    i32,
+                    *const (),
+                    *const (),
+                    *const (),
+                    *const (),
+                ) -> i32 = core::mem::transmute(wp);
+                crate::connect_hook::set_real_wsa_connect(f);
+                crate::iat::patch_iat(wp, crate::connect_hook::hooked_wsa_connect as *const ());
+                write_log("fifa17: WSAConnect IAT patched\n");
+            }
+            if crate::connectex_hook::install_wsaioctl_hook() {
+                write_log("fifa17: ConnectEx (WSAIoctl) hooked\n");
+            } else {
+                write_log("fifa17: ConnectEx hook FAILED\n");
+            }
+        }
+        None => write_log(
+            "fifa17: NO redirect installed (openfut.cfg missing/invalid) — EA traffic left untouched\n",
+        ),
+    }
     // The promoted SBC dispatch repair (and the evidence traces it decides on) arms
     // itself from the build; its safety is the runtime signature/evidence gate. The
     // remaining legacy experiment modules stay inert unless their env gate is `1`.
@@ -88,7 +155,6 @@ unsafe extern "system" fn worker(_: *mut core::ffi::c_void) -> u32 {
     crate::sbc_request_trace::install();
     crate::store_entry::install();
     crate::season_trace::install();
-    crate::kit_trace::install();
     0
 }
 

openfut-hook/src/kit_trace.rs

@@ -1,184 +0,0 @@
-//! Passive, behavior-preserving diagnostic traces for FIFA 17's FUT pre-match
-//! KIT SELECTOR data flow.
-//!
-//! RE (2026-08-20, Ghidra on CardsDLL_Win64_retail.dll) established that the
-//! pre-match kit selector is fed ENTIRELY client-side (NOT by POW/EASFC):
-//!
-//!   * `FUT_GET_MATCH_KITS_DP` (id 0x7565) builder `FUN_1800be6a0` (rva 0xbe6a0)
-//!     reads a boolean gate `ctx+0x152` (`KITS_AVAILABLE`); when false, or when
-//!     the two available-kit vectors are empty, the selector renders blank/white.
-//!   * The available home/away kit-id lists live on `FutSquadServiceImpl`
-//!     (`this+0xe08` home, `this+0xe38` away) and are written by the setter
-//!     `FUN_180196760` (rva 0x96760, vtable slot 0x1d0): args (this, srcVec, side).
-//!   * A club KIT ITEM is turned into an available kit by `FUN_1801c3480`
-//!     (rva 0x1c3480): it reads item fields (`+0x4c==7`, `+0x60==4`,
-//!     `+0x5c`∈{101 home,102 away}, `+0x94` source teamid, `+0xba`
-//!     teamkittypetechid) and calls `FUN_1801c44b0` (rva 0x1c44b0) to clone that
-//!     team's kit rows from the CLIENT-LOCAL `teamkits` DB into the FUT club
-//!     (teamtechid 130000).
-//!
-//! These traces answer, in one operator-driven match, exactly WHERE the empty
-//! selector originates: do kit club items reach the client (kit_item_clone), does
-//! the clone into the FUT club happen (kit_db_clone), does the available list get
-//! set non-empty (set_available_kits), and what does the selector finally read
-//! (get_match_kits: KITS_AVAILABLE + count). Every trace is read-only: it logs,
-//! then tail-calls the original through a trampoline. Copied prologues are whole,
-//! position-independent instructions (the one rip-relative prologue uses the
-//! relocating installer).
-
-use core::sync::atomic::{AtomicUsize, Ordering};
-
-use windows_sys::Win32::System::LibraryLoader::GetModuleHandleA;
-
-use crate::sbc_trace::{readable_range, validate_cards_build};
-use crate::season_trace::{install_detour, install_detour_reloc, rd_i32, rd_u8};
-use crate::write_log;
-
-static REPORTS: AtomicUsize = AtomicUsize::new(0);
-
-fn budget() -> bool {
-    REPORTS.fetch_add(1, Ordering::Relaxed) < 256
-}
-
-unsafe fn rd_usize(addr: usize) -> Option<usize> {
-    readable_range(addr, 8).then(|| core::ptr::read_volatile(addr as *const usize))
-}
-
-// FUT_GET_MATCH_KITS_DP builder FUN_1800be6a0 (0xbe6a0). rcx = DP model ctx.
-// ctx+0x152 is the KITS_AVAILABLE bool that gates the whole selector list.
-static GET_MATCH_KITS_TRAMP: AtomicUsize = AtomicUsize::new(0);
-unsafe extern "system" fn get_match_kits_wrapper(rcx: usize, rdx: usize, r8: usize, r9: usize) -> usize {
-    if budget() {
-        let avail = rd_u8(rcx + 0x152);
-        write_log(&format!(
-            "KIT_GET: FUT_GET_MATCH_KITS_DP ctx={rcx:#x} KITS_AVAILABLE={avail:?}\n"
-        ));
-    }
-    let t = GET_MATCH_KITS_TRAMP.load(Ordering::Acquire);
-    if t == 0 {
-        return 0;
-    }
-    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
-        core::mem::transmute(t);
-    original(rcx, rdx, r8, r9)
-}
-
-// setAvailableKits FUN_180196760 (0x96760): (this, srcVec, side). srcVec is an
-// int vector {begin@+0, end@+8}; count = (end-begin)/4. side 0=home, 1=away.
-static SET_AVAILABLE_KITS_TRAMP: AtomicUsize = AtomicUsize::new(0);
-unsafe extern "system" fn set_available_kits_wrapper(rcx: usize, rdx: usize, r8: usize, r9: usize) -> usize {
-    if budget() {
-        let count = match (rd_usize(rdx), rd_usize(rdx + 8)) {
-            (Some(b), Some(e)) if e >= b => ((e - b) / 4) as i64,
-            _ => -1,
-        };
-        write_log(&format!(
-            "KIT_SET: setAvailableKits this={rcx:#x} side={r8} count={count}\n"
-        ));
-    }
-    let t = SET_AVAILABLE_KITS_TRAMP.load(Ordering::Acquire);
-    if t == 0 {
-        return 0;
-    }
-    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
-        core::mem::transmute(t);
-    original(rcx, rdx, r8, r9)
-}
-
-// Kit-item clone driver FUN_1801c3480 (0x1c3480): rdx = param_2, the club-item
-// event; the item struct is at *(param_2+0x10). Logs the fields the function
-// branches on so we can see whether a kit club item reaches the client and its
-// home/away designator + source teamid.
-static KIT_ITEM_CLONE_TRAMP: AtomicUsize = AtomicUsize::new(0);
-unsafe extern "system" fn kit_item_clone_wrapper(rcx: usize, rdx: usize, r8: usize, r9: usize) -> usize {
-    if budget() {
-        if let Some(item) = rd_usize(rdx + 0x10) {
-            write_log(&format!(
-                "KIT_ITEM: clone-driver item={item:#x} type[+0x4c]={:?} subid[+0x5c]={:?} \
-                 cat[+0x60]={:?} teamid[+0x94]={:?} kittype[+0xba]={:?}\n",
-                rd_i32(item + 0x4c),
-                rd_i32(item + 0x5c),
-                rd_i32(item + 0x60),
-                rd_i32(item + 0x94),
-                rd_i32(item + 0xba),
-            ));
-        } else {
-            write_log(&format!("KIT_ITEM: clone-driver param_2={rdx:#x} (item ptr unreadable)\n"));
-        }
-    }
-    let t = KIT_ITEM_CLONE_TRAMP.load(Ordering::Acquire);
-    if t == 0 {
-        return 0;
-    }
-    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
-        core::mem::transmute(t);
-    original(rcx, rdx, r8, r9)
-}
-
-// Kit DB clone FUN_1801c44b0 (0x1c44b0): (clubmgr, side, teamtechid, kittype).
-// Fires only when the driver decided the item is a home(101)/away(102) kit, so
-// this is the proof the FUT-club (teamtechid 130000) kit rows get synthesized.
-static KIT_DB_CLONE_TRAMP: AtomicUsize = AtomicUsize::new(0);
-unsafe extern "system" fn kit_db_clone_wrapper(rcx: usize, rdx: usize, r8: usize, r9: usize) -> usize {
-    if budget() {
-        write_log(&format!(
-            "KIT_DBCLONE: clone team kit side={rdx} src_teamtechid={r8} kittype={r9}\n"
-        ));
-    }
-    let t = KIT_DB_CLONE_TRAMP.load(Ordering::Acquire);
-    if t == 0 {
-        return 0;
-    }
-    let original: unsafe extern "system" fn(usize, usize, usize, usize) -> usize =
-        core::mem::transmute(t);
-    original(rcx, rdx, r8, r9)
-}
-
-unsafe fn worker() {
-    let mut base = 0usize;
-    for _ in 0..600u32 {
-        base = GetModuleHandleA(c"CardsDLL_Win64_retail.dll".as_ptr().cast()) as usize;
-        if base != 0 {
-            break;
-        }
-        std::thread::sleep(std::time::Duration::from_millis(500));
-    }
-    if base == 0 || !validate_cards_build(base) {
-        write_log("KIT_TRACE: CardsDLL unavailable/invalid; kit trace inactive\n");
-        return;
-    }
-    // FUN_1800be6a0: 48 8b c4 55 41 54 41 55 41 56 41 57 48 8d 68 a1 (copy_len 16).
-    install_detour(
-        base, 0xbe6a0, "GetMatchKits_DP(0xbe6a0)", 16,
-        &[0x48, 0x8b, 0xc4, 0x55, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48, 0x8d, 0x68, 0xa1],
-        get_match_kits_wrapper as *const () as usize, &GET_MATCH_KITS_TRAMP,
-    );
-    // FUN_180196760: 48 89 54 24 10 53 48 83 ec 30 48 c7 44 24 20 fe ff ff ff (copy_len 19).
-    install_detour(
-        base, 0x96760, "setAvailableKits(0x96760)", 19,
-        &[0x48, 0x89, 0x54, 0x24, 0x10, 0x53, 0x48, 0x83, 0xec, 0x30, 0x48, 0xc7, 0x44, 0x24, 0x20, 0xfe, 0xff, 0xff, 0xff],
-        set_available_kits_wrapper as *const () as usize, &SET_AVAILABLE_KITS_TRAMP,
-    );
-    // FUN_1801c3480: 48 89 5c 24 08 57 48 83 ec 60 <48 8b 05 disp32> (rip-relative
-    // MOV RAX,[rip+..] at copied offset 10; disp32 at 13, insn end 17; copy_len 17).
-    install_detour_reloc(
-        base, 0x1c3480, "kitItemClone(0x1c3480)", 17,
-        &[0x48, 0x89, 0x5c, 0x24, 0x08, 0x57, 0x48, 0x83, 0xec, 0x60, 0x48, 0x8b, 0x05, 0x4f, 0x82, 0x11, 0x00],
-        13, 17,
-        kit_item_clone_wrapper as *const () as usize, &KIT_ITEM_CLONE_TRAMP,
-    );
-    // FUN_1801c44b0: 48 8b c4 55 41 54 41 55 41 56 41 57 48 8d 68 c8 (copy_len 16).
-    install_detour(
-        base, 0x1c44b0, "kitDbClone(0x1c44b0)", 16,
-        &[0x48, 0x8b, 0xc4, 0x55, 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, 0x48, 0x8d, 0x68, 0xc8],
-        kit_db_clone_wrapper as *const () as usize, &KIT_DB_CLONE_TRAMP,
-    );
-    write_log("KIT_TRACE: all kit-selector traces armed\n");
-}
-
-/// Arm the passive kit-selector diagnostics on a deferred thread (CardsDLL is not
-/// yet loaded at DllMain time). Read-only: never changes game behavior.
-pub(crate) fn install() {
-    write_log("KIT_TRACE: requested; deferred signature validation starting\n");
-    std::thread::spawn(|| unsafe { worker() });
-}

openfut-hook/src/lib.rs

@@ -14,8 +14,6 @@ mod dial_notification;
 #[cfg(feature = "fifa17")]
 mod fifa17;
 mod hooks;
-#[cfg(feature = "fifa17")]
-mod kit_trace;
 mod iat;
 mod origin_spy;
 #[cfg(feature = "probe")]

openfut-hook/src/season_trace.rs

@@ -31,14 +31,14 @@ static REPORTS: AtomicUsize = AtomicUsize::new(0);
 /// One-shot guard for the staging-only CACHE_PACKNAMES_FAILED -> SUCCESS bypass.
 static BYPASS_DONE: AtomicBool = AtomicBool::new(false);
 
-pub(crate) unsafe fn rd_i32(addr: usize) -> Option<i32> {
+unsafe fn rd_i32(addr: usize) -> Option<i32> {
     readable_range(addr, 4).then(|| core::ptr::read_volatile(addr as *const i32))
 }
-pub(crate) unsafe fn rd_u8(addr: usize) -> Option<u8> {
+unsafe fn rd_u8(addr: usize) -> Option<u8> {
     readable_range(addr, 1).then(|| core::ptr::read_volatile(addr as *const u8))
 }
 /// Read a NUL-terminated string safely (bounded, only reads mapped bytes).
-pub(crate) unsafe fn rd_cstr(addr: usize, max: usize) -> String {
+unsafe fn rd_cstr(addr: usize, max: usize) -> String {
     if addr == 0 || !readable_range(addr, 1) {
         return String::from("<unreadable>");
     }
@@ -58,7 +58,7 @@ pub(crate) unsafe fn rd_cstr(addr: usize, max: usize) -> String {
 /// Generic passive detour: overwrite the first `copy_len` bytes of `target` (which
 /// MUST be whole, position-independent instructions) with an absolute jump to
 /// `wrapper`; the wrapper calls the trampoline (copied prologue + jump back).
-pub(crate) unsafe fn install_detour(
+unsafe fn install_detour(
     base: usize,
     rva: usize,
     name: &str,
@@ -240,7 +240,7 @@ unsafe fn alloc_near(base: usize, size: usize) -> Option<usize> {
 /// both within the copied bytes). The trampoline is allocated near `base` and the
 /// disp32 is relocated so it resolves to the same absolute address. Read-only.
 #[allow(clippy::too_many_arguments)]
-pub(crate) unsafe fn install_detour_reloc(
+unsafe fn install_detour_reloc(
     base: usize,
     rva: usize,
     name: &str,

src/app.rs

@@ -1804,7 +1804,15 @@ impl LauncherApp {
 
 impl eframe::App for LauncherApp {
     fn update(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) {
-        ctx.request_repaint_after(std::time::Duration::from_millis(500));
+        // Render continuously (present every vsync) instead of reactively. egui
+        // normally idles at a low, bursty repaint rate; on a G-Sync / FreeSync
+        // (VRR) display a windowed app that presents in bursts with idle gaps
+        // makes DWM keep moving the window in and out of the VRR path and the
+        // refresh rate swing — which the panel shows as flicker. Presenting on
+        // every frame keeps the window continuously in VRR at the display's own
+        // (variable) refresh, which is stable. vsync (on by default) paces this to
+        // the monitor rather than spinning uncapped.
+        ctx.request_repaint();
         self.drive_restart_queue();
 
         egui::TopBottomPanel::top("header")

src/arm.rs

@@ -25,6 +25,7 @@ use crate::config::LauncherConfig;
 /// Accept only hostname/IP characters. These values come from config fields that
 /// are ever only IPs or hostnames, so a surprising character is a bug — reject it
 /// rather than try to escape it into an elevated shell command.
+#[cfg(unix)]
 fn safe_host(s: &str) -> anyhow::Result<&str> {
     let t = s.trim();
     if t.is_empty() {
@@ -41,6 +42,7 @@ fn safe_host(s: &str) -> anyhow::Result<&str> {
 
 /// Build the privileged arming script. Pure and unit-tested; the effectful part
 /// ([`arm`]) only validates config and hands this to the elevated runner.
+#[cfg(unix)]
 pub(crate) fn arming_script(
     server: &str,
     redirector_port: u16,
@@ -84,6 +86,7 @@ pub(crate) fn arming_script(
 /// Human-readable list of what [`arm`] changed, in the order the script applies
 /// it. Logged by the UI so the user sees exactly what was set — not just that
 /// "something" ran under `pkexec`.
+#[cfg(unix)]
 pub(crate) fn arming_summary(
     server: &str,
     redirector_port: u16,
@@ -103,6 +106,16 @@ pub(crate) fn arming_summary(
 /// Arm the client from config, under one elevated prompt. Requires the same
 /// fields preflight reads; a missing one is a clear error, never a silent
 /// loopback fallback. Returns the applied changes for the UI to surface.
+/// On native Windows there is nothing to arm: routing is the `openfut.cfg` the
+/// client-files step writes into the game directory (read by the version.dll
+/// hook), and there is no `ptrace_scope`, DNAT, or `/etc/hosts` to set. Returns
+/// no changes so the launch sequence treats client preparation as satisfied.
+#[cfg(windows)]
+pub fn arm(_cfg: &LauncherConfig) -> anyhow::Result<Vec<String>> {
+    Ok(Vec::new())
+}
+
+#[cfg(unix)]
 pub fn arm(cfg: &LauncherConfig) -> anyhow::Result<Vec<String>> {
     let server = cfg.openfut_server_host.trim();
     if server.is_empty() {
@@ -128,7 +141,7 @@ pub fn arm(cfg: &LauncherConfig) -> anyhow::Result<Vec<String>> {
     ))
 }
 
-#[cfg(test)]
+#[cfg(all(test, unix))]
 mod tests {
     use super::*;
 

src/config.rs

@@ -54,13 +54,18 @@ pub struct GameProfile {
 impl GameProfile {
     /// Whether this profile is filled in enough to launch from.
     pub fn configured(&self) -> bool {
-        !self.runner.trim().is_empty()
-            && !self.executable.trim().is_empty()
-            && !self.game_dir.trim().is_empty()
+        // Windows starts the executable directly (no runner); unix needs a
+        // runner such as umu-run.
+        #[cfg(windows)]
+        let runner_ok = true;
+        #[cfg(unix)]
+        let runner_ok = !self.runner.trim().is_empty();
+        runner_ok && !self.executable.trim().is_empty() && !self.game_dir.trim().is_empty()
     }
 
     /// Reject a half-filled profile rather than launching something surprising.
     pub fn validate(&self) -> Result<(), String> {
+        #[cfg(unix)]
         if self.runner.trim().is_empty() {
             return Err("Game profile has no runner (e.g. umu-run).".into());
         }
@@ -70,23 +75,28 @@ impl GameProfile {
         if self.game_dir.trim().is_empty() {
             return Err("Game profile has no game directory.".into());
         }
-        if !self.prefix_links.is_empty() && self.wine_prefix.trim().is_empty() {
-            return Err("Game profile defines prefix links but no wine_prefix.".into());
-        }
-        for l in &self.prefix_links {
-            if l.link.trim().is_empty() || l.target.trim().is_empty() {
-                return Err("Game profile has a prefix link with an empty link or target.".into());
+        // Wine-prefix links and the DRM licence precondition only exist on the
+        // unix/Proton launch path; native Windows has neither.
+        #[cfg(unix)]
+        {
+            if !self.prefix_links.is_empty() && self.wine_prefix.trim().is_empty() {
+                return Err("Game profile defines prefix links but no wine_prefix.".into());
             }
-            if std::path::Path::new(&l.link).is_absolute() {
-                return Err(format!(
-                    "Prefix link {:?} must be relative to the Wine prefix.",
-                    l.link
-                ));
+            for l in &self.prefix_links {
+                if l.link.trim().is_empty() || l.target.trim().is_empty() {
+                    return Err("Game profile has a prefix link with an empty link or target.".into());
+                }
+                if std::path::Path::new(&l.link).is_absolute() {
+                    return Err(format!(
+                        "Prefix link {:?} must be relative to the Wine prefix.",
+                        l.link
+                    ));
+                }
             }
-        }
-        if let Some(lic) = &self.license {
-            if lic.path.trim().is_empty() || lic.generator.trim().is_empty() {
-                return Err("Game profile licence needs both a path and a generator.".into());
+            if let Some(lic) = &self.license {
+                if lic.path.trim().is_empty() || lic.generator.trim().is_empty() {
+                    return Err("Game profile licence needs both a path and a generator.".into());
+                }
             }
         }
         Ok(())

src/game_launch.rs

@@ -24,11 +24,13 @@
 //! falls back to it, so an existing working setup cannot be broken by upgrading.
 
 use parking_lot::Mutex;
+#[cfg(unix)]
 use std::collections::BTreeMap;
 use std::io::{BufRead, BufReader};
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
 use std::sync::Arc;
+#[cfg(unix)]
 use std::time::{Duration, Instant};
 
 use crate::config::GameProfile;
@@ -45,6 +47,7 @@ fn say(log: &Log, msg: impl Into<String>) {
 /// Returns once the game process has been spawned; its output continues to
 /// stream into `log` on background threads. `on_exit` fires when the process
 /// ends, which is how the launch state machine leaves its Running state.
+#[cfg(unix)]
 pub fn launch(
     profile: &GameProfile,
     log: &Log,
@@ -96,6 +99,62 @@ pub fn launch(
     Ok(())
 }
 
+/// Windows-native launch: no Wine prefix, no `WINEDLLOVERRIDES` (the game loads
+/// the `version.dll` hook from its own directory through the normal search
+/// order), and no licence regeneration (the native loader handles DRM).
+/// Routing is the `openfut.cfg` that the client-files step already wrote into
+/// the game directory.
+///
+/// The launcher must itself be running elevated (its shortcut carries the
+/// RunAsAdmin bit): the loader requires administrator rights, and a child
+/// started with `CreateProcess` inherits the launcher's token instead of
+/// raising its own UAC prompt.
+#[cfg(windows)]
+pub fn launch(
+    profile: &GameProfile,
+    log: &Log,
+    on_exit: impl FnOnce() + Send + 'static,
+) -> anyhow::Result<()> {
+    profile.validate().map_err(anyhow::Error::msg)?;
+
+    let game_dir = PathBuf::from(&profile.game_dir);
+    if !game_dir.is_dir() {
+        anyhow::bail!("game_dir does not exist: {}", game_dir.display());
+    }
+    let exe = game_dir.join(&profile.executable);
+    if !exe.is_file() {
+        anyhow::bail!("game executable not found: {}", exe.display());
+    }
+
+    let mut cmd = Command::new(&exe);
+    cmd.current_dir(&game_dir)
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    for (k, v) in &profile.env {
+        cmd.env(k, v);
+    }
+
+    say(
+        log,
+        format!(
+            "[launcher] launching {} (cwd {})",
+            exe.display(),
+            game_dir.display()
+        ),
+    );
+
+    let child = cmd
+        .spawn()
+        .map_err(|e| anyhow::anyhow!("could not start {}: {e}", exe.display()))?;
+    stream(
+        child,
+        log.clone(),
+        "[launcher] game process exited.",
+        on_exit,
+    );
+    Ok(())
+}
+
 /// The registry key Wine reads DLL overrides from, and the one value the hook needs.
 ///
 /// Wine loads its own builtin `version.dll` unless an override says otherwise, so the
@@ -110,13 +169,17 @@ pub fn launch(
 /// survives restarts and applies to every launch path, including Steam. This mirrors
 /// what BepInEx documents for Proton (configure the proxy in winecfg rather than the
 /// environment) and what Proton itself already does in this prefix for other titles.
+#[cfg(unix)]
 const DLL_OVERRIDE_KEY: &str = r"HKCU\Software\Wine\DllOverrides";
+#[cfg(unix)]
 const HOOK_DLL_VALUE: &str = "version";
+#[cfg(unix)]
 const HOOK_DLL_OVERRIDE: &str = "native,builtin";
 
 /// `reg add` argv that persists the hook's DLL override, native-first with a builtin
 /// fallback. `/f` makes it idempotent, so this is safe to run on every launch and
 /// repairs a prefix a player has reset or replaced.
+#[cfg(unix)]
 fn dll_override_args() -> [&'static str; 10] {
     [
         "reg",
@@ -138,6 +201,7 @@ fn dll_override_args() -> [&'static str; 10] {
 /// Best-effort by design: a failure here is not fatal, because a launch we spawn also
 /// carries `WINEDLLOVERRIDES`. It is reported in plain language rather than as a Wine
 /// error, since the player cannot act on the latter.
+#[cfg(unix)]
 fn ensure_dll_override(profile: &GameProfile, log: &Log) {
     if profile.wine_prefix.trim().is_empty() {
         return;
@@ -163,7 +227,7 @@ fn ensure_dll_override(profile: &GameProfile, log: &Log) {
     }
 }
 
-#[cfg(test)]
+#[cfg(all(test, unix))]
 mod override_tests {
     use super::*;
 
@@ -204,6 +268,7 @@ mod override_tests {
 ///
 /// A profile that already pins `version=` wins: an operator overriding the hijack
 /// deliberately must not be silently overruled.
+#[cfg(unix)]
 fn hook_dll_overrides(env: &BTreeMap<String, String>) -> String {
     const HOOK: &str = "version=n,b";
     match env.get("WINEDLLOVERRIDES").map(|v| v.trim()) {
@@ -217,6 +282,7 @@ fn hook_dll_overrides(env: &BTreeMap<String, String>) -> String {
 ///
 /// Equivalent to `mkdir -p $WINEPREFIX/dosdevices && ln -sfn <target> <link>`:
 /// an existing link is replaced, so re-running is harmless.
+#[cfg(unix)]
 fn prepare_prefix(profile: &GameProfile, log: &Log) -> anyhow::Result<()> {
     if profile.wine_prefix.trim().is_empty() || profile.prefix_links.is_empty() {
         return Ok(());
@@ -257,6 +323,7 @@ fn prepare_prefix(profile: &GameProfile, log: &Log) -> anyhow::Result<()> {
 /// A crashed or failed launch deletes the licence, so this runs before every
 /// launch rather than only on first setup — that is the behaviour the shell
 /// script proved, and it is why a crash is normally self-healing on the next try.
+#[cfg(unix)]
 fn ensure_license(profile: &GameProfile, log: &Log) -> anyhow::Result<()> {
     let Some(lic) = &profile.license else {
         return Ok(());
@@ -316,6 +383,7 @@ fn ensure_license(profile: &GameProfile, log: &Log) -> anyhow::Result<()> {
 /// and it is reproduced deliberately — the pattern is a Windows executable name,
 /// which cannot match the launcher or a shell running it. (A `pkill -f` pattern
 /// that *can* match its own caller is a real hazard; this one cannot.)
+#[cfg(unix)]
 fn stop_generator(child: &mut Child, lic: &crate::config::LicenseCheck, log: &Log) {
     let _ = child.kill();
     let _ = child.wait();
@@ -333,6 +401,7 @@ fn stop_generator(child: &mut Child, lic: &crate::config::LicenseCheck, log: &Lo
 
 /// A relative licence path is taken as relative to the Wine prefix; an absolute
 /// one is used as given.
+#[cfg(unix)]
 fn resolve_under_prefix(prefix: &str, path: &str) -> PathBuf {
     let p = Path::new(path);
     if p.is_absolute() || prefix.trim().is_empty() {
@@ -345,6 +414,7 @@ fn resolve_under_prefix(prefix: &str, path: &str) -> PathBuf {
 /// The script's `[[ -s FILE ]]`: present *and* non-empty. A zero-byte licence is
 /// as useless as a missing one, and treating it as valid would skip the
 /// regeneration that fixes it.
+#[cfg(unix)]
 fn non_empty_file(path: &Path) -> bool {
     std::fs::metadata(path)
         .map(|m| m.len() > 0)
@@ -381,7 +451,7 @@ pub fn stream(
     });
 }
 
-#[cfg(test)]
+#[cfg(all(test, unix))]
 mod tests {
     use super::*;
     use crate::config::{LicenseCheck, PrefixLink};

src/local_services.rs

@@ -22,6 +22,7 @@ use std::{
     time::{Duration, Instant},
 };
 
+#[cfg(unix)]
 use std::os::unix::process::CommandExt;
 
 use crate::fifa17_capability::{
@@ -79,12 +80,18 @@ impl Service {
 /// keeps `spawn` responsible for reporting a missing binary, with one error message
 /// instead of two.
 fn resolve_binary(service: Service) -> PathBuf {
-    let name = service.binary();
+    let base = service.binary();
+    // On Windows the built companion is `openfut-lsx.exe`; a bare name without the
+    // extension matches neither the sibling file nor CreateProcess resolution.
+    #[cfg(windows)]
+    let name = format!("{base}.exe");
+    #[cfg(unix)]
+    let name = base.to_string();
     if let Some(dir) = std::env::current_exe()
         .ok()
         .and_then(|p| p.parent().map(Path::to_path_buf))
     {
-        let sibling = dir.join(name);
+        let sibling = dir.join(&name);
         if sibling.is_file() {
             return sibling;
         }
@@ -433,6 +440,18 @@ impl ServiceSupervisor {
     /// Start `service` only if it is not already usable. Never restarts a healthy
     /// service, and never adopts a foreign one as ours.
     pub fn ensure_running(&mut self, service: Service, spec: SpawnSpec) -> Result<Ensured, String> {
+        // On Windows the ProtoSSL cert-verify patch (autopatch's job on unix, via
+        // /proc/PID/mem) is performed in-process by the version.dll hook, so there
+        // is no autopatch process to run. LSX is different: the game dials it on
+        // 127.0.0.1:4216, so it MUST run locally here exactly as on unix.
+        #[cfg(windows)]
+        if service == Service::Autopatch {
+            self.log.lock().push(
+                "[launcher] autopatch runs in-process on Windows (version.dll hook) — nothing to start."
+                    .to_string(),
+            );
+            return Ok(Ensured::Reused);
+        }
         let runtime = self.observe(service);
         if runtime.ready() {
             self.log.lock().push(format!(
@@ -532,6 +551,7 @@ pub fn spawn(
         cmd.env("OPENFUT_AUTOPATCH_LOG", log_path);
     }
     // Put each companion in its own process group for lifecycle isolation.
+    #[cfg(unix)]
     cmd.process_group(0);
     cmd.stdout(Stdio::piped()).stderr(Stdio::piped());
 

src/main.rs

@@ -22,6 +22,9 @@ fn main() -> eframe::Result<()> {
             .with_icon(app_icon())
             .with_inner_size([1040.0, 720.0])
             .with_min_inner_size([880.0, 600.0]),
+        // Pair vsync with the display's VRR (G-Sync + Vsync is the recommended
+        // combination): frames present on the monitor's own variable refresh.
+        vsync: true,
         ..Default::default()
     };
 

src/preflight.rs

@@ -31,6 +31,7 @@ use std::time::Duration;
 use crate::config::LauncherConfig;
 
 const PROBE_TIMEOUT: Duration = Duration::from_secs(2);
+#[cfg(unix)]
 const PTRACE_SCOPE: &str = "/proc/sys/kernel/yama/ptrace_scope";
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -86,6 +87,7 @@ impl Check {
 }
 
 /// Run every applicable check. Order is the order the game exercises them.
+#[cfg(unix)]
 pub fn run(cfg: &LauncherConfig) -> Vec<Check> {
     vec![
         ptrace_scope(),
@@ -96,6 +98,16 @@ pub fn run(cfg: &LauncherConfig) -> Vec<Check> {
     ]
 }
 
+/// On native Windows the client-preparation checks (ptrace_scope, the EA
+/// redirector DNAT, `/etc/hosts`) do not apply: there is no host to arm and
+/// routing is entirely the `openfut.cfg` the hook reads. Only the two the game
+/// truly depends on remain: the backend is reachable and the deployed hook
+/// config agrees with the launcher's settings.
+#[cfg(windows)]
+pub fn run(cfg: &LauncherConfig) -> Vec<Check> {
+    vec![backend_reachable(cfg), hook_config(cfg)]
+}
+
 /// Checks that will stop the game working.
 pub fn failures(checks: &[Check]) -> usize {
     checks.iter().filter(|c| c.state == State::Fail).count()
@@ -113,6 +125,7 @@ pub fn warnings(checks: &[Check]) -> usize {
 /// Unconditional. autopatch is a workspace binary that ships alongside the
 /// launcher, so there is no configuration that could make this inapplicable —
 /// every launch runs it.
+#[cfg(unix)]
 fn ptrace_scope() -> Check {
     const NAME: &str = "ptrace_scope (autopatch)";
     match std::fs::read_to_string(PTRACE_SCOPE) {
@@ -127,6 +140,7 @@ fn ptrace_scope() -> Check {
 /// Reading `/proc` in a test would assert facts about the machine running the
 /// suite rather than about this code — and left inline, "any value is fine"
 /// was a mutation no test could catch.
+#[cfg(unix)]
 fn ptrace_verdict(raw: &str) -> Check {
     const NAME: &str = "ptrace_scope (autopatch)";
     let v = raw.trim();
@@ -146,6 +160,7 @@ fn ptrace_verdict(raw: &str) -> Check {
 ///
 /// This tests the *effect* rather than reading firewall rules, so it needs no
 /// privilege and stays honest about what the game will actually experience.
+#[cfg(unix)]
 fn ea_redirect(cfg: &LauncherConfig) -> Check {
     const NAME: &str = "EA redirector IP is redirected";
     let ip = cfg.ea_redirect_probe_ip.trim();
@@ -184,6 +199,7 @@ fn ea_redirect(cfg: &LauncherConfig) -> Check {
 /// So this is a real misconfiguration worth fixing and not a reason to expect
 /// failure. Reporting it as fatal, and then being contradicted by a working
 /// game, is how a checklist trains its user to ignore it.
+#[cfg(unix)]
 fn hostname_mapping(cfg: &LauncherConfig) -> Check {
     const NAME: &str = "EA hostnames point at OpenFUT";
     if cfg.ea_hostnames.is_empty() {
@@ -320,7 +336,7 @@ fn join(ips: &[IpAddr]) -> String {
         .join(",")
 }
 
-#[cfg(test)]
+#[cfg(all(test, unix))]
 mod tests {
     use super::*;
 

src/theme.rs

@@ -299,5 +299,13 @@ fn install_style(ctx: &Context) {
     v.widgets.open.rounding = radius;
 
     style.visuals = v;
-    ctx.set_style(style);
+    // egui 0.29 keeps a separate `Style` per theme (dark/light) and renders with
+    // whichever the theme preference resolves to. `set_style` touches only the
+    // currently-active theme, so a later switch to the other one would drop our
+    // named text styles ("Hero", "Subheading", …) and panic in `TextStyle::resolve`.
+    // Install the full style into BOTH themes and pin the preference to Dark so
+    // the branded look is stable regardless of the host's system theme.
+    ctx.set_style_of(egui::Theme::Dark, style.clone());
+    ctx.set_style_of(egui::Theme::Light, style);
+    ctx.set_theme(egui::ThemePreference::Dark);
 }

tools/re/ghidra_env.py

@@ -1,151 +0,0 @@
-#!/usr/bin/env python3
-"""OpenFUT Ghidra helper: opens an already-analysed program from the persisted
-`fut` project and exposes decompile / xref / string / vtable helpers, then runs a
-query script passed as argv[1].
-
-Run with the restored toolchain:
-
-    GHIDRA_INSTALL_DIR=/home/alex/ghidra/ghidra_11.1.2_PUBLIC \
-      /home/alex/re-venv/bin/python tools/re/ghidra_env.py <query.py>
-
-Target program defaults to CardsDLL (the FUT UI, where the kit-selector filter
-lives). Override for powdll (the EASFC/POW layer):
-
-    GHIDRA_PROG=powdll.dll ... ghidra_env.py <query.py>
-"""
-import os, sys
-
-os.environ.setdefault("GHIDRA_INSTALL_DIR", "/home/alex/ghidra/ghidra_11.1.2_PUBLIC")
-# Ghidra 11.1.2 does not bundle the in-tree PyGhidra module that the pip
-# `pyghidra` 2.x/3.x require, so use the standalone `pyhidra` package (same API).
-try:
-    import pyhidra as _pg
-except ImportError:
-    import pyghidra as _pg
-_pg.start(verbose=False)
-
-from ghidra.app.decompiler import DecompInterface           # noqa: E402
-from ghidra.util.task import ConsoleTaskMonitor             # noqa: E402
-
-PROJ_DIR = os.environ.get("GHIDRA_PROJ_DIR", "/home/alex/ghidra_projects")
-PROJ = os.environ.get("GHIDRA_PROJ", "fut")
-PROG = os.environ.get("GHIDRA_PROG", "cardsdll.dll")
-
-# Open the ALREADY-ANALYSED program straight from the persisted project.
-# pyhidra.open_program re-imports a fresh (unanalysed) copy, so go through the
-# project API and load the saved DomainFile read-only instead.
-from ghidra.base.project import GhidraProject               # noqa: E402
-_project = GhidraProject.openProject(PROJ_DIR, PROJ, True)
-prog = _project.openProgram("/", PROG, True)  # (folder, name, readOnly)
-flat = None
-mon = ConsoleTaskMonitor()
-fm = prog.getFunctionManager()
-listing = prog.getListing()
-mem = prog.getMemory()
-refs = prog.getReferenceManager()
-
-_dec = DecompInterface()
-_dec.openProgram(prog)
-
-
-def addr(a):
-    return prog.getAddressFactory().getDefaultAddressSpace().getAddress(int(a))
-
-
-def func(a):
-    return fm.getFunctionContaining(addr(a)) if not hasattr(a, "getEntryPoint") else a
-
-
-def dec(a, timeout=180):
-    """Decompiled C for the function containing address a."""
-    f = func(a)
-    if f is None:
-        return "// no function at %#x" % int(a)
-    r = _dec.decompileFunction(f, timeout, mon)
-    if r is None or not r.decompileCompleted():
-        return "// decompile failed for %s" % f.getName()
-    return str(r.getDecompiledFunction().getC())
-
-
-def xrefs_to(a):
-    """[(from_addr, reftype, containing_function_name, entry)] for refs to a."""
-    out = []
-    for r in refs.getReferencesTo(addr(a)):
-        fr = r.getFromAddress()
-        f = fm.getFunctionContaining(fr)
-        out.append((int(fr.getOffset()), str(r.getReferenceType()),
-                    f.getName() if f else "?",
-                    int(f.getEntryPoint().getOffset()) if f else 0))
-    return out
-
-
-def qword(a):
-    return mem.getLong(addr(a)) & 0xFFFFFFFFFFFFFFFF
-
-
-def dword(a):
-    return mem.getInt(addr(a)) & 0xFFFFFFFF
-
-
-import jpype                                                    # noqa: E402
-_JBYTE = jpype.JArray(jpype.JByte)
-
-
-def read_bytes(a, n):
-    buf = _JBYTE(n)
-    got = mem.getBytes(addr(a), buf)
-    return bytes((int(x) & 0xFF) for x in buf[:got])
-
-
-def find_all(pattern, blocks=(".text", ".rdata", ".data")):
-    """[addresses] of every occurrence of `pattern` (bytes) in the named blocks."""
-    if isinstance(pattern, str):
-        pattern = pattern.encode()
-    hits = []
-    for b in mem.getBlocks():
-        if b.getName() not in blocks:
-            continue
-        start = b.getStart()
-        size = int(b.getSize())
-        data = read_bytes(int(start.getOffset()), size)
-        i = data.find(pattern)
-        while i != -1:
-            hits.append(int(start.getOffset()) + i)
-            i = data.find(pattern, i + 1)
-    return hits
-
-
-def rd_str(a, maxlen=400):
-    b = bytearray()
-    base = int(a)
-    for i in range(maxlen):
-        c = mem.getByte(addr(base + i)) & 0xFF
-        if c == 0:
-            break
-        b.append(c)
-    return b.decode("utf-8", "replace")
-
-
-def fname(a):
-    f = func(a)
-    return f.getName() if f else "?"
-
-
-def callees(a):
-    f = func(a)
-    return sorted({(int(c.getEntryPoint().getOffset()), c.getName())
-                   for c in f.getCalledFunctions(mon)}) if f else []
-
-
-def callers(a):
-    f = func(a)
-    return sorted({(int(c.getEntryPoint().getOffset()), c.getName())
-                   for c in f.getCallingFunctions(mon)}) if f else []
-
-
-if __name__ == "__main__":
-    if len(sys.argv) > 1:
-        with open(sys.argv[1]) as fh:
-            code = fh.read()
-        exec(compile(code, sys.argv[1], "exec"), globals())
-    os._exit(0)

tools/re/restore_ghidra.sh

@@ -1,70 +0,0 @@
-#!/usr/bin/env bash
-# Restore the OpenFUT Ghidra headless RE toolchain on the .120 dev box.
-#
-# Everything lands under /home/alex (which survives the env resets that wipe
-# /opt and /tmp), so a reset can be recovered by re-running THIS script.
-#
-#   - JDK 17            : apt openjdk-17-jdk-headless (Ghidra 11.1.2 needs 17..21)
-#   - Ghidra 11.1.2     : /home/alex/ghidra/ghidra_11.1.2_PUBLIC
-#   - pyghidra venv     : /home/alex/re-venv   (pyghidra 3.x + jpype)
-#   - analysed project  : /home/alex/ghidra_projects/fut.gpr
-#                         programs: /cardsdll.dll  /powdll.dll
-#
-# Inputs it expects to exist (binaries are NOT redistributable, keep them local):
-#   /tmp/fut/cardsdll.dll   (CardsDLL_Win64_retail.dll, md5 4de349...ac9b655)
-#   /tmp/powdll.dll         (powdll_Win64_retail.dll)
-# If a reset wiped /tmp, recopy them from the FIFA17 install on .105:
-#   /mnt/games/FIFA 17/CardsDLL_Win64_retail.dll  ->  /tmp/fut/cardsdll.dll
-#   (powdll) Data/win/  ...  powdll_Win64_retail.dll -> /tmp/powdll.dll
-set -euo pipefail
-
-GHIDRA_VER=11.1.2_PUBLIC
-GHIDRA_ZIP_NAME=ghidra_11.1.2_PUBLIC_20240709.zip
-GHIDRA_URL="https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_11.1.2_build/${GHIDRA_ZIP_NAME}"
-GHIDRA_HOME=/home/alex/ghidra/ghidra_${GHIDRA_VER}
-PROJ_DIR=/home/alex/ghidra_projects
-VENV=/home/alex/re-venv
-
-echo "== [1/5] JDK 17 =="
-if ! java -version 2>&1 | grep -q '"17'; then
-  sudo apt-get install -y openjdk-17-jdk-headless
-fi
-java -version
-
-echo "== [2/5] Ghidra ${GHIDRA_VER} =="
-if [ ! -x "${GHIDRA_HOME}/support/analyzeHeadless" ]; then
-  mkdir -p /home/alex/ghidra
-  if [ ! -f /tmp/ghidra.zip ]; then
-    # urlretrieve avoids the harness raw-HTTP guard; wget/curl also fine on a shell.
-    python3 - <<PY
-import urllib.request
-urllib.request.urlretrieve("${GHIDRA_URL}", "/tmp/ghidra.zip")
-print("downloaded")
-PY
-  fi
-  ( cd /home/alex/ghidra && unzip -q -o /tmp/ghidra.zip )
-fi
-export GHIDRA_INSTALL_DIR="${GHIDRA_HOME}"
-echo "GHIDRA_INSTALL_DIR=${GHIDRA_HOME}"
-
-echo "== [3/5] pyghidra venv =="
-if [ ! -x "${VENV}/bin/python" ]; then
-  python3 -m venv "${VENV}"
-  "${VENV}/bin/pip" install -q --upgrade pip
-  "${VENV}/bin/pip" install -q pyghidra
-fi
-"${VENV}/bin/python" -c "import pyghidra,jpype;print('pyghidra',pyghidra.__version__)"
-
-echo "== [4/5] analyse cardsdll + powdll into ${PROJ_DIR}/fut.gpr =="
-mkdir -p "${PROJ_DIR}"
-if [ ! -f "${PROJ_DIR}/fut.gpr" ]; then
-  for dll in /tmp/fut/cardsdll.dll /tmp/powdll.dll; do
-    "${GHIDRA_HOME}/support/analyzeHeadless" "${PROJ_DIR}" fut \
-      -import "${dll}" -processor x86:LE:64:default -cspec windows \
-      -analysisTimeoutPerFile 1200
-  done
-fi
-
-echo "== [5/5] done. Query with: =="
-echo "  GHIDRA_INSTALL_DIR=${GHIDRA_HOME} ${VENV}/bin/python \\"
-echo "    $(dirname "$0")/ghidra_env.py <query.py>"