diff --git a/KILLSWITCH-REMOVAL-GUIDE.md b/KILLSWITCH-REMOVAL-GUIDE.md new file mode 100644 index 000000000..d27e50583 --- /dev/null +++ b/KILLSWITCH-REMOVAL-GUIDE.md @@ -0,0 +1,295 @@ +# 🔓 RR3 Killswitch Removal Guide + +**Version:** 14.0.1 Ultimate Edition +**Purpose:** Bypass EA's server-controlled killswitch to keep RR3 playable after March 2026 shutdown +**Status:** ✅ Successfully bypassed in v14 Ultimate APK + +--- + +## 🎯 What is the Killswitch? + +EA added a **server-controlled killswitch** to Real Racing 3 v14 that allows them to remotely disable the game without pushing an update. + +### How It Works + +1. **Startup Check:** Game calls EA's Director API on every launch + ``` + POST https://director.ea.com/director/api/android/getDirectionByPackage + ``` + +2. **Server Response:** + ```json + { + "appUpgrade": 0 // 0=OK, 1=Update Recommended, 2=Update REQUIRED (blocks game) + } + ``` + +3. **Game Enforcement:** + - File: `com/ea/nimble/EnvironmentDataContainer.smali` + - Method: `getLatestAppVersionCheckResult()` + - Returns: 0 (OK), 1 (Warning), or 2 (BLOCKED) + +4. **Result:** When EA sets `appUpgrade=2`, game refuses to launch + +--- + +## 💣 The Threat + +When EA shuts down RR3 service in **late March 2026**: + +❌ Stock APK will receive `appUpgrade=2` +❌ Game will display "Update Required" message +❌ No update will be available (service ended) +❌ Game becomes **permanently unplayable** + +--- + +## ✅ The Community Fix + +We surgically removed the killswitch by patching one single method in the EA Nimble SDK. + +### Technical Details + +**File:** `smali_classes2/com/ea/nimble/EnvironmentDataContainer.smali` +**Method:** `getLatestAppVersionCheckResult()` (line 648) + +### Before (Original Code - 88 lines) +```smali +.method public getLatestAppVersionCheckResult()I + .locals 6 + + # Complex logic checking m_getDirectionResponseDictionary + # Gets "appUpgrade" value from server response + # Returns 0, 1, or 2 based on server's decision + # If server says 2 (BLOCKED), game refuses to start + + # ... 80+ lines of code ... + + return v0 # Could be 0, 1, or 2 +.end method +``` + +### After (Patched Code - 20 lines) +```smali +.method public getLatestAppVersionCheckResult()I + .locals 1 + + # KILLSWITCH DISABLED BY COMMUNITY MOD + # Original code checked server's "appUpgrade" field (0=OK, 1=Recommended, 2=Required) + # This patch always returns 0 (APP_VERSION_OK) to bypass EA's March shutdown + # Game will continue working even after EA servers go offline + + .line 180 + invoke-static {p0}, Lcom/ea/nimble/Log$Helper;->LOGPUBLICFUNC(Ljava/lang/Object;)V + + const-string v0, "RealRacing3" + + const-string v1, "🔓 Killswitch bypassed - returning APP_VERSION_OK (community mod)" + + invoke-static {v0, v1}, Landroid/util/Log;->i(Ljava/lang/String;Ljava/lang/String;)I + + const/4 v0, 0x0 # Always return 0 (APP_VERSION_OK) + + return v0 +.end method +``` + +### What Changed? + +1. ✅ Removed all 80+ lines of server response checking +2. ✅ Hardcoded return value to `0` (APP_VERSION_OK) +3. ✅ Added debug log message for verification +4. ✅ Method now **ignores** server's killswitch command + +--- + +## 🔬 Why This Works + +### Compiled Code is Immutable + +- Smali bytecode → DEX → Machine code = **PERMANENT** +- EA can only change DATA (server responses) +- EA **CANNOT** change compiled METHOD CODE +- Our patch modifies the METHOD itself (not data) +- Even if server sends `appUpgrade=2`, our code ignores it + +### No Hot-Patching in RR3 + +Investigated potential remote code injection: +- ❌ No `DexClassLoader` in EA Nimble code +- ❌ No dynamic method replacement +- ❌ No code download mechanisms +- ✅ Firebase Remote Config = **data only**, not code +- ✅ Director API = **configuration only**, not code + +**Verdict:** EA physically **cannot** revert our patch remotely + +--- + +## 📊 Testing Verification + +### How to Verify Patch Works + +1. **Check Logcat:** Look for this message on startup: + ``` + I/RealRacing3: 🔓 Killswitch bypassed - returning APP_VERSION_OK (community mod) + ``` + +2. **Test Airplane Mode:** + - Enable airplane mode + - Launch game + - Should start normally (no network check) + +3. **Simulate EA Shutdown:** + - Block `director.ea.com` in hosts file + - Game still launches (ignores server check) + +--- + +## 🛠️ How to Apply This Patch + +### Option 1: Use Pre-Built APK (Recommended) +Download **RR3-v14.0.1-Ultimate-SIGNED.apk** from releases + +### Option 2: Manual Patching + +1. **Decompile APK:** + ```bash + apktool d RealRacing3-v14.0.1.apk -o rr3-workspace + ``` + +2. **Replace Method:** + - Open: `rr3-workspace/smali_classes2/com/ea/nimble/EnvironmentDataContainer.smali` + - Find: `.method public getLatestAppVersionCheckResult()I` (line 648) + - Replace entire method with patched code (see above) + +3. **Rebuild APK:** + ```bash + apktool b -n -o rr3-patched.apk rr3-workspace + ``` + +4. **Sign APK:** + ```bash + apksigner sign --ks your-keystore.keystore \ + --ks-key-alias your-alias \ + --out rr3-patched-signed.apk \ + rr3-patched.apk + ``` + +--- + +## 🎮 v14 Ultimate Edition Features + +The patched APK includes: + +✅ **Killswitch Removed** - Works after EA shutdown +✅ **Offline Mode** - Play without internet +✅ **Unlimited Currency** - 100M M$, 10M Gold +✅ **All Events Unlocked** - Special events offline +✅ **Startup Crash Fixed** - Delayed initialization +✅ **Latest Features** - v14 game content + +--- + +## 📁 File Structure + +``` +rr3-apk/ +├── smali_classes2/ +│ └── com/ +│ └── ea/ +│ └── nimble/ +│ └── EnvironmentDataContainer.smali # PATCHED FILE (line 648) +│ +├── KILLSWITCH-REMOVAL-GUIDE.md # This document +└── AndroidManifest.xml # Version: 14.0.1 +``` + +--- + +## ⚠️ Important Notes + +### Legal & Safety + +- ✅ Modding APKs for personal use is legal +- ✅ Does not bypass DRM or piracy protection +- ✅ Only removes server shutdown mechanism +- ❌ Do not distribute on Play Store +- ✅ Share freely with community + +### Compatibility + +- ✅ Works on Android 5.0+ (API 21+) +- ✅ Compatible with v13 saves (same signing key) +- ✅ Can upgrade from v13 modded APK +- ❌ Cannot upgrade from stock EA version (different signature) + +### What Doesn't Work + +- ❌ Online multiplayer (EA servers offline) +- ❌ Leaderboards (server-dependent) +- ❌ Live events (requires EA servers) +- ✅ Everything else works offline + +--- + +## 🤝 Community Impact + +### Before Patch +- Stock APK stops working March 2026 +- Players lose access to purchased content +- No official alternative provided by EA +- Community loses years of progress + +### After Patch +- ✅ Game works indefinitely +- ✅ Progress preserved locally +- ✅ All cars/tracks accessible +- ✅ Special events available offline +- ✅ Community continues thriving + +--- + +## 📞 Support & Questions + +**Discord:** Project Real Resurrection 3 +**Gitea Repository:** https://gitea.barrer.net/project-real-resurrection-3/rr3-apk +**Branch:** `killswitch-killer` + +### Common Questions + +**Q: Can EA revert this patch remotely?** +A: No. Compiled bytecode is immutable. See technical analysis above. + +**Q: Will this work after March 2026?** +A: Yes! That's the entire point. Game ignores server shutdown. + +**Q: Is this safe?** +A: Yes. Only modifies one method. No malware, no data collection. + +**Q: Can I sync progress with friends?** +A: Not via EA servers (offline). Community server in development. + +**Q: What about future updates?** +A: EA won't release updates after March. This is final version. + +--- + +## 📜 Version History + +- **v14.0.1-Ultimate (Feb 2026):** Killswitch removed, offline features added +- **v14.0.1-Stock (2024):** Original EA version with killswitch +- **v13.x (2023):** Pre-killswitch versions (no bypass needed) + +--- + +## 🎉 Credits + +**Development:** GitHub Copilot CLI + Community +**Testing:** Project Real Resurrection 3 Discord +**Preservation:** Community asset archival effort +**Infrastructure:** Gitea hosting (gitea.barrer.net) + +--- + +**🏁 Keep Racing! The community will never let this game die. 🏁**