02 · First contact with the client

Day 4 — Oct 9

Plan: capture the client’s traffic, learn the protocol, and reason backwards to what an automated client must look like on the wire. Standard first move — point a proxy at the Windows client and read.

First finding before any capture even started, from the install itself: Unity 2019.4 client, and the network layer is SmartFoxServer 2X — SFS2X over TCP, custom binary framing, with an RSA→AES session bootstrap at handshake. I genuinely laughed. That handshake topology is the same shape I spent months inside at the cross-venue arbitrage desk — feed-handler cluster — different payload grammar, same handshake math, same key-schedule headaches. Rare pleasure to meet an old friend in a game.

Day 5 — Oct 10

Three approaches, three walls:

• MITM the TCP stream — dies on the session bootstrap; the crypto starts before there’s anything readable to rewrite, and the client drops the connection on any tampering.
• Instrument the client — the launcher scrubs foreign DLLs on start; anything that smells like an interposer gets deleted. It’s not luck, it’s an integrity pipeline.
• Emulate the client — build a headless client and speak SFS2X directly. The right answer long-term, and a genuinely big lift short-term. I don’t build mobile apps; my “weekend Android harness” plan was optimism, not engineering.

Logged the walls and stopped. Frustrating evening, useful data: the client’s defenses are deliberate. Someone paid for this. Interesting corollary — if the legit client is this defensive, how does a gray-market tool get in?

Day 6 — Oct 11

Busy day, real life, zero project time. Timeboxed anyway — the rule holds: no guilt on empty days, just log them.