Client reimplementation roadmap

Principle: bootstrap first, core loop second, everything else is additive.

Phase 1 — Bootstrap (order)

1. GET getlsu3dversion.php, extract resMsg (RSA pubkey) + answering host; updateType=2 = server rejects the claimed build.
2. GSL envelope: RSA-PKCS1v15 + AES-256-ECB-PKCS7 (manual 16-byte block loop where the stdlib omits ECB).
3. POST getserverlist.php, code=0 = success; parse serverList[]; pick the last-logged server (else first); persist at/at.time/rt/rt.time.
4. Plain TCP to the gateway; serverList[].ip is |-delimited; race entries, first to answer the ping wins; implement the packet envelope, length-derived XOR, zlib, SFSObject codec.
5. Send SFS Login with ~50 fields incl. the SecurityCode/OneCode/CoreV MD5 constructions.
6. Await the bare init push (no init.before/init.after); capture chatToken.
7. Start the 4-second PingPongRequest heartbeat.

Phase 2 — Core loop

Build the dispatch table from the extracted cmd-data catalog (~3,178 rows — don't hand-transcribe). Order: City/Building → Military/Army → World Map → Alliance + Chat + Mail → Hero → Shop/Economy.

Phase 3 — Defer

Season (754 cmds) + Activity (900 cmds) = 54% of the protocol surface by count, and it churns every patch.

Crypto checklist

rsa.EncryptPKCS1v15; AES + hand-rolled ECB loop; MD5-hex-as-key via hex(md5.Sum(...)); base64 URL-safe no-padding; ChaCha8 hand-rolled (fixed at 8 rounds); compress/zlib; zstd (battle reports / LZ4-flagged packets); bsdiff/bspatch.

Session config

Persists zone, gameUid, deviceId, shumeiBoxId, accessToken, iosMode, appVersion, versionCode. Values come from captured real logins (plain TCP, no TLS). Access tokens are non-single-use but bound to platform identity + build; need refresh eventually; server invalidation (ec=28, ep=[E011]) → fresh capture. Device identity persists per-install; multiple identities via a state dir.

live-confirmed feature surface

GSL crypto; SFS2X framing (incl. Zstandard); SFSObject codec; guest-account login; email-verification binding; resource collection across 14 building types (Farmland, Iron Mine, Gold Mine, Smelter, Material Workshop, Training Base, Oil Well, Drone Parts Workshop, Component Factory, Tactical Institute, four Season-6 Spore Factory tiers; 1.0.364 Crystal Factory + Season-6 week-card building wired but unconfirmed). Automations: lw.pve.idle.reward, visitor.operate, al.help.all, alliance.reward.allreceive, chat.get.system.mails + mail.reward.batch, science.data.refresh + al.science.donate, vip.add.login.score, vip.get.every.day.reward. Reconnect with empty ta placeholders re-confirmed (unattended cron, August 2026). iOS own-device bind = third-party report only, not reproduced.

Duel-aware gating (reference design)

Feature list with per-feature policy (hold/always) in the session config; run refuses held features, bypass flag exists. Features: radar-claims (hold, score type 82, sends receive.detect.event.reward), free-recruits (always, 42/120, useFree: 1), duel-speedups (hold, 51/queues 4-6-7-9), duel-recruit-tickets (hold), duel-troop-training (hold, building.camp.training), secret-tasks-start (always, 99, hero.dispatch.start), truck-deploy (always, 98/5, train.send), radar-execute (always, 82). Read-only: duel-speedups-plan, secret-tasks-start-plan, radar-inventory. Tripwire file: while present, all duel spends + Treasure Hunt pickaxe digs + brick opens refuse — a safety valve against accidental economy actions.