03 · Two surprises

Day 7 — Oct 12

Brought in a friend — RE background, has taken uglier binaries apart than mine. We looked at the auto ecosystem together instead of at the game. Surprise #1 landed within the hour: the tool is not an image-clicker at all.

It’s a protocol-level, multi-instance operation built for the PC client: several game windows on one machine (a slot engine with sandboxed, junctioned data directories), a hook that runs inside the game’s own scripting runtime, marching and buying by sending the game’s real network commands, a licensing server, auto-update channels, remote control through a Telegram bot, a supervisor loop that restarts everything 24/7 — it even watches for the “logged in elsewhere” popup in ~30 languages and kills the window before it can block automation. My Lords Mobile mental model was two generations old. “Emulation” was never emulators — they solved it by cloning the PC client.

Day 8 — Oct 13

Chasing the obvious contradiction: how does a hook survive in a client that deletes foreign DLLs? Reading around the anti-cheat history gave me surprise #2, the embarrassing one. The kernel-level anti-cheat (Tencent’s ACE) that shipped at one point got walked back after the player revolt — the community noise about kernel access was loud enough that the whole thing was neutered. My firm belief that “the game has anti-cheat, don’t bother” came from one stale Google result I never re-checked. Weeks of planning around a defense that wasn’t there.

Day 9 — Oct 14

Wrote up implications for the alliance. The big one for management: nobody upstream is coming. Platform-level enforcement is, at protocol level, effectively absent — the only layer that reacts to automation with consequences that matter (rank, trust, membership, reputation) is alliance management. That reframes the whole project: less “catch the hacker,” more “build the culture and the checks.”

Also: if the tool talks protocol natively, then presence-based policing (activity feeds, “was online at 4am”) is useless — the tool is perfectly present. Rules have to target what it doesn&em> do. First gap already spotted while reading feature lists: the tool fires an emoji after a dig to look human… but it never likes a message, and it never sends stickers. Noting that one for the rules doc.