Initial commit: RR3 APK and documentation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
249
CLOUDCELL_DISCOVERY.md
Normal file
249
CLOUDCELL_DISCOVERY.md
Normal file
@@ -0,0 +1,249 @@
|
||||
# 🎯 CRITICAL FINDING: RR3 Asset System Uses "Cloudcell"
|
||||
|
||||
## Key Discovery
|
||||
|
||||
From analyzing the game binary (`libRealRacing3.so`), we found:
|
||||
|
||||
```
|
||||
"Downloading from CDN has failed! NO Cloudcell"
|
||||
"Download attempt %d of %d from CDN has failed"
|
||||
"CC_AssetManager_Class::AssetDownloadError()"
|
||||
```
|
||||
|
||||
**Real Racing 3 uses a system called "Cloudcell" for asset delivery!**
|
||||
|
||||
---
|
||||
|
||||
## What is Cloudcell?
|
||||
|
||||
**Cloudcell** appears to be Electronic Arts' internal content delivery network system. Based on the code references:
|
||||
|
||||
- `CC_AssetManager_Class` - "CC" likely stands for "Cloudcell"
|
||||
- Downloads assets from a CDN
|
||||
- Has retry logic for failed downloads
|
||||
- Part of the game's asset management system
|
||||
|
||||
---
|
||||
|
||||
## How It Works
|
||||
|
||||
Based on our findings:
|
||||
|
||||
### 1. Game Flow
|
||||
```
|
||||
Game Starts
|
||||
↓
|
||||
Contacts Director Service
|
||||
↓
|
||||
Gets service URLs (including Cloudcell CDN URL)
|
||||
↓
|
||||
Uses CC_AssetManager to download assets
|
||||
↓
|
||||
Checks manifests (the 1,236 .txt files we found)
|
||||
↓
|
||||
Downloads missing assets from Cloudcell CDN
|
||||
```
|
||||
|
||||
### 2. Asset Manifest Format
|
||||
We already have all the manifests! Each lists:
|
||||
```
|
||||
/path/to/asset<TAB>md5hash<TAB>compressed_size<TAB>uncompressed_size
|
||||
```
|
||||
|
||||
### 3. CDN URL Structure (Likely)
|
||||
```
|
||||
https://[cloudcell-domain]/[asset-path]
|
||||
```
|
||||
|
||||
Example:
|
||||
```
|
||||
Manifest: /data/events.dat.nct
|
||||
CDN URL: https://[cloudcell-cdn]/data/events.dat.nct
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Possible Cloudcell CDN Domains
|
||||
|
||||
Based on EA's infrastructure patterns, try:
|
||||
|
||||
1. **Cloudcell-specific:**
|
||||
- `https://cloudcell.ea.com`
|
||||
- `https://cdn-cloudcell.ea.com`
|
||||
- `https://cloudcell-cdn.ea.com`
|
||||
- `https://assets.cloudcell.ea.com`
|
||||
|
||||
2. **RR3-specific:**
|
||||
- `https://rr3-assets.ea.com`
|
||||
- `https://cdn-rr3.ea.com`
|
||||
- `https://realracing3-assets.ea.com`
|
||||
|
||||
3. **CloudFront (AWS):**
|
||||
- `https://d[random-id].cloudfront.net`
|
||||
- EA likely uses AWS CloudFront for Cloudcell
|
||||
|
||||
4. **Akamai:**
|
||||
- `https://[id].akamaihd.net`
|
||||
- EA also uses Akamai for CDN
|
||||
|
||||
---
|
||||
|
||||
## Testing Script
|
||||
|
||||
```powershell
|
||||
# Test possible Cloudcell CDN URLs
|
||||
$possibleCdns = @(
|
||||
"https://cloudcell.ea.com",
|
||||
"https://cdn-cloudcell.ea.com",
|
||||
"https://rr3-assets.ea.com",
|
||||
"https://cdn-rr3.ea.com",
|
||||
"https://realracing3-cdn.ea.com"
|
||||
)
|
||||
|
||||
# Try downloading a known asset from manifests
|
||||
$testAsset = "/0.dat" # First asset from asset_list_base.txt
|
||||
|
||||
foreach ($cdn in $possibleCdns) {
|
||||
$url = "$cdn$testAsset"
|
||||
Write-Host "Testing: $url"
|
||||
try {
|
||||
$response = Invoke-WebRequest -Uri $url -Method Head -TimeoutSec 10
|
||||
Write-Host " ✅ SUCCESS! Found: $cdn" -ForegroundColor Green
|
||||
break
|
||||
} catch {
|
||||
Write-Host " ❌ Failed" -ForegroundColor Red
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Alternative: Network Capture
|
||||
|
||||
Since the CDN URL isn't hardcoded, we MUST capture it from a live game session:
|
||||
|
||||
### Method 1: mitmproxy (Best)
|
||||
```bash
|
||||
# Install
|
||||
pip install mitmproxy
|
||||
|
||||
# Run
|
||||
mitmproxy --mode transparent --showhost
|
||||
|
||||
# Configure Android device to use proxy
|
||||
# Launch RR3
|
||||
# Capture the Cloudcell CDN URL from traffic
|
||||
```
|
||||
|
||||
### Method 2: tcpdump on rooted device
|
||||
```bash
|
||||
adb shell
|
||||
su
|
||||
tcpdump -i wlan0 -w /sdcard/rr3-traffic.pcap
|
||||
|
||||
# Launch RR3
|
||||
# Stop capture
|
||||
# Analyze with Wireshark
|
||||
```
|
||||
|
||||
### Method 3: Hosts file redirect (Advanced)
|
||||
```bash
|
||||
# Add to Android hosts file (/system/etc/hosts)
|
||||
# Redirect potential domains to your PC running Wireshark
|
||||
# See which domain the game tries to contact
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## For Community Server
|
||||
|
||||
**Good news:** We control the Director service!
|
||||
|
||||
Our `DirectorController.cs` can return ANY URL for `synergy.content`:
|
||||
|
||||
```csharp
|
||||
[HttpGet("director")]
|
||||
public IActionResult GetServiceUrls()
|
||||
{
|
||||
var baseUrl = $"{Request.Scheme}://{Request.Host}";
|
||||
|
||||
return Ok(new
|
||||
{
|
||||
serverUrls = new Dictionary<string, string>
|
||||
{
|
||||
{ "synergy.content", $"{baseUrl}/assets/" }, // OUR CDN!
|
||||
...
|
||||
}
|
||||
});
|
||||
}
|
||||
```
|
||||
|
||||
Then create `/assets/` endpoint that serves files from:
|
||||
```
|
||||
RR3CommunityServer/Assets/downloaded/
|
||||
```
|
||||
|
||||
**The game will download from YOUR server instead of EA's!**
|
||||
|
||||
---
|
||||
|
||||
## Current Status
|
||||
|
||||
✅ **Found:** Cloudcell asset delivery system
|
||||
✅ **Have:** All 1,236 asset manifests
|
||||
✅ **Know:** Asset download flow
|
||||
❌ **Missing:** Actual Cloudcell CDN URL
|
||||
|
||||
---
|
||||
|
||||
## Next Steps
|
||||
|
||||
### Option A: Network Capture (Recommended)
|
||||
1. Setup mitmproxy
|
||||
2. Configure Android device
|
||||
3. Launch RR3
|
||||
4. Capture Cloudcell CDN URL
|
||||
5. Update downloader script
|
||||
6. Download all assets (2-5 GB)
|
||||
|
||||
### Option B: Serve from Community Server
|
||||
1. Don't download from EA
|
||||
2. Let community members extract from their devices
|
||||
3. Upload to community server via web panel
|
||||
4. Our Director returns our server URL
|
||||
5. Game downloads from us!
|
||||
|
||||
### Option C: Hybrid
|
||||
1. Try to find Cloudcell URL with network capture
|
||||
2. Download critical assets (~500 MB)
|
||||
3. After EA shutdown, crowdsource the rest
|
||||
4. Complete preservation over time
|
||||
|
||||
---
|
||||
|
||||
## Key Insight
|
||||
|
||||
**Real Racing 3 uses "Cloudcell" - EA's internal CDN system!**
|
||||
|
||||
The URL is provided dynamically by the Director service, not hardcoded in the APK. This is actually GREAT for us because:
|
||||
|
||||
1. We control the Director in our community server
|
||||
2. We can point it at OUR asset storage
|
||||
3. Game will happily download from us
|
||||
4. No need to find EA's CDN if we have the assets!
|
||||
|
||||
---
|
||||
|
||||
## Files to Reference
|
||||
|
||||
- Binary strings: `libRealRacing3.so` (31.5 MB)
|
||||
- Asset manifests: `E:\rr3\RR3CommunityServer\RR3CommunityServer\Assets\manifests\` (1,236 files)
|
||||
- Downloader: `E:\rr3\RR3CommunityServer\download-assets.ps1`
|
||||
|
||||
---
|
||||
|
||||
**Conclusion:** The CDN URL is NOT in the APK. We need to either:
|
||||
1. Capture it from live game traffic, OR
|
||||
2. Serve assets from our own community server (recommended!)
|
||||
|
||||
The second option is actually BETTER for long-term preservation! 🎮💾
|
||||
Reference in New Issue
Block a user