Findings & open questions

8 original open items; a research pass closed 6 static, live production testing closed the remaining 2 live. The 1.0.364 full-coverage pass (Oct 2026) corrected 21 claims and opened new questions.

Resolved via live testing

Enum numeric values live in Global_EnumType.lua; ShuMei/ACE not enforced on login; the missing post-login init push (Zstd decompression + SFSObject array-tag bugs); established-account reconnect block (token bound to packageName/platform/appVersion/versionCode identity); E005 = Android Login with empty ta (guest logins accept either); at.time = issue time; resVersion tail from CURRENT_TABLE_VERSION/LOCALE_VERSION; radar tasks survive endTime in state 1; items-only build.ccd.m.new doesn't touch diamonds; Alliance Duel detail uses activityid "70000" not id 55000; duel day window is st/et; forward-header 2-byte id = zone number via ParseSid("APS783") = 783.

Resolved via research pass static

March recall = MarchTargetType.BACK_HOME = 3 in world.march.change; WorldPointInfo parsed via WorldPointManager.ParseWorldGetBlock; 18 proto schemas recovered (not just 4) from C# descriptors + a 525 MB bundle (BundleFragment0.bytes); CalcChatSign = MD5(MD5(appId+uid) + timestamp) (unkeyed; branch unreachable anyway); GetABTestTableName = server-pushed monopoly_ab; Season/Activity boundary 97% label-defensible.

Partly resolved

Minimal ta content (Android Login needs it filled; which keys open is unknown); opt=refresh doesn't rotate rt at 8 days; two devices' tokens can coexist with a captured real-app token.

Open questions

Which ta keys the server reads; dataConfigMd5 persistence; refresh behavior past 30 days; whether real-app refresh invalidates own-device pairs; Tactical Chip Factory chip.collect vs building.camp.collect; whether live init carries real_timezone_offset; platform check on refresh; status=0 handling; when duel actions book points (radar confirmed at claim); unclaimed duel chest mailing; empty/over-count itemIDs diamond charging.

Coverage ledger (1.0.364)

22,401 analysis units, all claimed (covered 22401/22401); 4,827 read line-by-line, 17,574 summarized. 18,733 Lua modules; 1,291 data tables; 118 C# assemblies (ILSpy); 407 Java packages (jadx); 39 native libraries (symbol/string survey + targeted arm64 disassembly); 1,813 other files. Anti-cheat/anti-fraud surfaces (Tencent ACE, ShuMei, psh, init.add, login.ext) inventoried. Message-class hand-checks: 84/84 request params, 77/84 response fields.

Headline results

3,115 MsgDefines commands indexed, 4,561 send sites; 54 C#-only commands; 133 chat wire names; 159 game systems mapped; 558 claim-like requests (55 hand-traced).

Notable corrections

Runtime is FM_Mono (Mono 6.13.0), not HybridCLR; the world map streams viewport via C# block pulls, season maps 3000×3000; hotUpdateMsg = name,version,size,crc32; ~20 commands report client-computed battle results (not one); SmartFox2X 1.7.8 in use, Smartfox2xLw dead; the two readygo.tech cleartext endpoints are dead; alliance chat room id is deterministic.

Never-automate inventory

Rewarded ads (no ad SDK shipped), rating/survey rewards, account/role deletion, payments/diamond spends, irreversible moves, client-reported results (some differ from free claims by one parameter).

ta policy

After the security fix, LwDeviceID/LwShumeiID/LwAirKey sub-fields became empty-string placeholders; reconnect re-confirmed working (August 2026, including after a zone-server migration).