LW Notes — client & protocol

client 1.0.364 · Android + PC parity checked · cross-checked against own captures

Working notes on the Last War: Survival client — transport, protocol surface, gameplay systems, client internals. Reference base for the anti-auto work: you can’t write counter-tactics against a system you haven’t mapped. Facts only; identifiers verbatim.

Metric	Value (1.0.364)
Network commands	3,115 in the Lua catalog (`MsgDefines`) + 54 C#-only
Lua modules	18,733 (hot-updated as one bundle)
C# assemblies	118 `.mdl` files (117 in the `dllres` manifest)
Data tables	1,291 (live table set 39516 → 1,298)
Custom container formats cracked	3 (Lua bundle, `.mdl` assemblies, data tables)
PC client parity	same `LWScripts.data` LWLF bundle on disk; 18,744 modules

Client architecture

Unity client, but the C# is not IL2CPP-compiled. libil2cpp.so is the FM_Mono bridge: exports the il2cpp ABI, runs managed code on upstream Mono 6.13. Almost no game logic ships in the store build — three independently-updatable layers:

Layer	Contents	Update granularity
Lua	gameplay logic + UI, city, army/hero, map, alliance, chat, mail, shop; the 3,115-command catalog	hot-updated, one bundle (`LWScripts.data`, LWLF container)
Hot-update C#	network stack, crypto, assets, world-map viewport protocol, SDK wiring	118 XOR’d `.mdl` assemblies; `dllres` manifest; `noUpdateAssemblies.json` pins `SmartFox2X` to the APK copy
Static native core	FM_Mono bridge, Mono runtime, Unity engine, native xLua	app-store releases only; contains no game logic

Two transports:

HTTP(S) — bootstrap, version check, hot-update manifests, gate-server discovery (GSL flow), RSA+AES hybrid envelope.
Raw TCP — hand-rolled SmartFoxServer 2X reimplementation: binary SFSObject codec, string cmd (e.g. "mail.read") + typed key/value payload. Every gameplay command rides this socket.

┌──────────────┐   ┌──────────────────┐   ┌───────────────────┐
│ Lua tier     │──▶│ hot-update C#    │──▶│ static core       │
│ 18,733 mods  │   │ 118 .mdl asm     │   │ FM_Mono + xLua    │
│ 3,115 cmds   │   │ net, crypto, SFS │   │ no game logic     │
└──────────────┘   └──────────────────┘   └───────────────────┘
        HTTP(S): GSL bootstrap, RSA+AES ─┐
        TCP: SFS2X-style SFSObject frames ┴▶ FunPlus servers

Security posture (summary — details: Native binaries)

Nothing below the protocol layer blocks a clean-room client: no kernel anti-cheat in the shipping path, no signature gating on the game socket, device fingerprint (shumeiBoxId) reproducible off-device.
Guest creation + full session drive: confirmed live, end-to-end [live]. Reconnect into an already-established session with a captured access token: confirmed live, multi-day unattended [live].
Post-2026-10-02 server fix hardened part of the ta blob on reconnect; workarounds observed in the wild [live].
Consequence: the protocol layer is the only battleground. Everything an auto tool does is a client; everything management can check is a pattern.