rr3-apk/CLOUDCELL_DISCOVERY.md

# 🎯 CRITICAL FINDING: RR3 Asset System Uses "Cloudcell"

## Key Discovery

From analyzing the game binary (`libRealRacing3.so`), we found:

```
"Downloading from CDN has failed! NO Cloudcell"
"Download attempt %d of %d from CDN has failed"
"CC_AssetManager_Class::AssetDownloadError()"
```

**Real Racing 3 uses a system called "Cloudcell" for asset delivery!**

---

## What is Cloudcell?

**Cloudcell** appears to be Electronic Arts' internal content delivery network system. Based on the code references:

- `CC_AssetManager_Class` - "CC" likely stands for "Cloudcell"
- Downloads assets from a CDN
- Has retry logic for failed downloads
- Part of the game's asset management system

---

## How It Works

Based on our findings:

### 1. Game Flow
```
Game Starts
    ↓
Contacts Director Service
    ↓
Gets service URLs (including Cloudcell CDN URL)
    ↓
Uses CC_AssetManager to download assets
    ↓
Checks manifests (the 1,236 .txt files we found)
    ↓
Downloads missing assets from Cloudcell CDN
```

### 2. Asset Manifest Format
We already have all the manifests! Each lists:
```
/path/to/asset<TAB>md5hash<TAB>compressed_size<TAB>uncompressed_size
```

### 3. CDN URL Structure (Likely)
```
https://[cloudcell-domain]/[asset-path]
```

Example:
```
Manifest: /data/events.dat.nct
CDN URL:  https://[cloudcell-cdn]/data/events.dat.nct
```

---

## Possible Cloudcell CDN Domains

Based on EA's infrastructure patterns, try:

1. **Cloudcell-specific:**
   - `https://cloudcell.ea.com`
   - `https://cdn-cloudcell.ea.com`
   - `https://cloudcell-cdn.ea.com`
   - `https://assets.cloudcell.ea.com`

2. **RR3-specific:**
   - `https://rr3-assets.ea.com`
   - `https://cdn-rr3.ea.com`
   - `https://realracing3-assets.ea.com`

3. **CloudFront (AWS):**
   - `https://d[random-id].cloudfront.net`
   - EA likely uses AWS CloudFront for Cloudcell

4. **Akamai:**
   - `https://[id].akamaihd.net`
   - EA also uses Akamai for CDN

---

## Testing Script

```powershell
# Test possible Cloudcell CDN URLs
$possibleCdns = @(
    "https://cloudcell.ea.com",
    "https://cdn-cloudcell.ea.com",
    "https://rr3-assets.ea.com",
    "https://cdn-rr3.ea.com",
    "https://realracing3-cdn.ea.com"
)

# Try downloading a known asset from manifests
$testAsset = "/0.dat"  # First asset from asset_list_base.txt

foreach ($cdn in $possibleCdns) {
    $url = "$cdn$testAsset"
    Write-Host "Testing: $url"
    try {
        $response = Invoke-WebRequest -Uri $url -Method Head -TimeoutSec 10
        Write-Host "  ✅ SUCCESS! Found: $cdn" -ForegroundColor Green
        break
    } catch {
        Write-Host "  ❌ Failed" -ForegroundColor Red
    }
}
```

---

## Alternative: Network Capture

Since the CDN URL isn't hardcoded, we MUST capture it from a live game session:

### Method 1: mitmproxy (Best)
```bash
# Install
pip install mitmproxy

# Run
mitmproxy --mode transparent --showhost

# Configure Android device to use proxy
# Launch RR3
# Capture the Cloudcell CDN URL from traffic
```

### Method 2: tcpdump on rooted device
```bash
adb shell
su
tcpdump -i wlan0 -w /sdcard/rr3-traffic.pcap

# Launch RR3
# Stop capture
# Analyze with Wireshark
```

### Method 3: Hosts file redirect (Advanced)
```bash
# Add to Android hosts file (/system/etc/hosts)
# Redirect potential domains to your PC running Wireshark
# See which domain the game tries to contact
```

---

## For Community Server

**Good news:** We control the Director service!

Our `DirectorController.cs` can return ANY URL for `synergy.content`:

```csharp
[HttpGet("director")]
public IActionResult GetServiceUrls()
{
    var baseUrl = $"{Request.Scheme}://{Request.Host}";
    
    return Ok(new
    {
        serverUrls = new Dictionary<string, string>
        {
            { "synergy.content", $"{baseUrl}/assets/" },  // OUR CDN!
            ...
        }
    });
}
```

Then create `/assets/` endpoint that serves files from:
```
RR3CommunityServer/Assets/downloaded/
```

**The game will download from YOUR server instead of EA's!**

---

## Current Status

✅ **Found:** Cloudcell asset delivery system  
✅ **Have:** All 1,236 asset manifests  
✅ **Know:** Asset download flow  
❌ **Missing:** Actual Cloudcell CDN URL  

---

## Next Steps

### Option A: Network Capture (Recommended)
1. Setup mitmproxy
2. Configure Android device
3. Launch RR3
4. Capture Cloudcell CDN URL
5. Update downloader script
6. Download all assets (2-5 GB)

### Option B: Serve from Community Server
1. Don't download from EA
2. Let community members extract from their devices
3. Upload to community server via web panel
4. Our Director returns our server URL
5. Game downloads from us!

### Option C: Hybrid
1. Try to find Cloudcell URL with network capture
2. Download critical assets (~500 MB)
3. After EA shutdown, crowdsource the rest
4. Complete preservation over time

---

## Key Insight

**Real Racing 3 uses "Cloudcell" - EA's internal CDN system!**

The URL is provided dynamically by the Director service, not hardcoded in the APK. This is actually GREAT for us because:

1. We control the Director in our community server
2. We can point it at OUR asset storage
3. Game will happily download from us
4. No need to find EA's CDN if we have the assets!

---

## Files to Reference

- Binary strings: `libRealRacing3.so` (31.5 MB)
- Asset manifests: `E:\rr3\RR3CommunityServer\RR3CommunityServer\Assets\manifests\` (1,236 files)
- Downloader: `E:\rr3\RR3CommunityServer\download-assets.ps1`

---

**Conclusion:** The CDN URL is NOT in the APK. We need to either:
1. Capture it from live game traffic, OR
2. Serve assets from our own community server (recommended!)

The second option is actually BETTER for long-term preservation! 🎮💾