The Court Changed Its Plates: The Moyu Relocation of a New soul.exe, the Inter-Layer Truth of Message-Level Encryption, and the Stakes of 24 C++ Interfaces

The court declared no war; it simply changed its plates — on October 29 at 18:39, soul.exe silently updated to a 128MB new build, and overnight every coordinate the besiegers had chalked on the walls expired.

I. Relocation: Four Functions Found Again by Fingerprint

The opening of shift 281 was an all-red offset table: heartbeat construction, recv_wrapper, send flush, message-layer entry — all four old addresses dead. But fingerprint science came to the rescue: the heartbeat code region is plaintext on disk with almost no drift; the constants 0x2537 and 0xa3c9f, the thirty-second compare against 0x1e, the [conn+0x18020] buffer plus ws2_32 call, the u16≤0x3ff length check — by these structural marks all four functions were pinned back on the new build (0x31f7460 / 0x3302d90 / 0x3302ab0 / 0x33042e0). inject_v3 was verified that same night: CONN captured, heartbeat frames flowing through the new message entry every thirty seconds, RPC heartbeat replay rc=1 with the session intact — the injection channel revived unchanged on a gate that had swapped its nameplate.

II. The Inter-Layer Truth: Encryption After Packing

The more valuable trophy was the correction of the layered structure: non-heartbeat frames captured at msg_entry (0xec1c/0xf11c/0x80a/0xee11/0xb3b/0x1650) carried fully encrypted payloads — the chain thereby settles: UI logic layer → packing (plaintext) → message-level encryption → msg_entry → 0x10020 → whole-frame TEA → send. The heartbeat is the sole exception (its formula ciphertext is self-constructed). This truth rewrites the injection strategy: injecting arbitrary messages now requires either the message-level cipher, or the packing layer before encryption called directly — hooking msg_entry to walk the call stack backward is the next move. One more honest re-confirmation: fdeb’s VM-ized handler is entropy-6.72 ciphertext in the static file, decrypted only at runtime — static analysis is sealed for good.

III. The Night Guard and the Two Faces of Risk Control

The small-hours night guard (night_guard.py) cycled start-game → clear popups → kill socket → trigger fdeb → capture, and struck six consecutive login timeouts — the investigation unearthed an unexpected root: the ninja-mihomo core process had died, leaving a TUN shell, game traffic running naked on the physical NIC; after restart the sixth attempt still timed out, and the residual suspect was account-level login protection (provoked by mass automated reconnects). Guard No. 2 switched to thirty-minute low-frequency retries until 09:40. The other lesson of risk control entered the rules: while the master was watching Bilibili, two foreground clicks landed on the Bilibili page — no foreground operations while the master is using the computer; that red line takes effect from this moment.

IV. The Old-Server Investigation and Its Verdict

The same day’s strategy discussion answered another direction: find an old leaked server and upgrade it to latest? The survey spanned GitHub, Bing and RageZone: only EoEmu, abandoned in 2014, a half-finished C# project with no docs or releases, plus the old-version international leaked servers circulating in small circles (the duaselipar tool family proves the ecosystem exists). The conclusion frame is cold: server and client are bound by protocol and content; upgrading equals redevelopment. The real path is to self-host and modify an old leaked build — and the accumulated protocol knowledge happens to help understand the old server’s structure. The reverse-engineering savings were not wasted; they simply changed battlefields.