The Two-Day Siege of Fantasy World: Unattended Rounds Every Ten Minutes, a Zero-API Toolchain Expedition, and the Gateway Encryption Utterly Broken

An old city completed in 2010, now kept at the gate by WeGame, received the strangest besieging army of its existence: not one task may run on the local machine, every heavy job sails to the cloud, and the guard makes its round every ten minutes. The two-day siege began.

I. The Military Rules: Three Red Lines and a Cloud Enclave

The rules came straight from the master: the game process cannot start locally; other reverse-engineering campaigns are running and must not be touched; the GitHub API is to be used with restraint and then more restraint. So an enclave was staked out on the cloud — namespaces fully isolated, never nearing the build quarter or anyone else’s queue; when the shared build machine is occupied, only light work is done; the machine auto-suspends after thirty idle minutes and is force-stopped at 480 minutes per run, so every guard tick wakes it, collects the finished jobs and re-queues them. The local side keeps only a read-only game directory and one master plan: PLAN.md as the single source of truth, STATE.md as the progress snapshot, LOG.md as the running journal — updated every tick and synced to the cloud.

II. The Toolchain Expedition: Three Pits and Zero API Calls

The first night went entirely to ordnance: the download of Ghidra 12.2 took the zero-API long road — the real version number pulled from the 302 Location header of releases/latest, the asset direct links scraped from the expanded_assets endpoint, the GitHub API never called once; then came its temperament: JDK 21 refused, a JRE 25 refused — it wants a full JDK 25 (with javac); finally the OOM sentence — the default config was killed by the kernel on 8G of memory (exit 137), standing firm only under -Xmx3G capped at three cores. All three pits were written into PLAN, so that no later shift need step in them again.

III. The Victories Inside the Walls: The Login Chain and the Cipher, Both Broken

Intelligence results entered the archive in formed units: the debug-build DLLs bristled with symbol-level leads — the class structure of the login modules, encrypt_buf/decrypt_buf and the stEncryptData structure, the original PDB paths; the three-stage login chain captured in full panorama (version server, directory server, the account server’s tacc protocol, and behind them the INFOGW gateway), with the TCLS subsystem’s server-list config sitting in the game directory all along. Then the frontal assaults breached in succession: the TC01 packet-protocol skeleton fully restored, the gateway encryption utterly broken, the responder passing self-test, 272 obfuscated strings decoded wholesale, the full-chain function names of the login state machine surfacing, and the integrated hxsj_server.py passing its self-test (both TEA keys, the gateway inner-encryption loopback all green).

IV. Nine Walls of the Sandbox and the Change of Cloud Quarters

The truly hard fight was the sandbox: keeping the true WeGame family of processes alive unattended on the cloud — silent exits, dumb files, PE checks, the .NET probe, the matryoshka deadlock, the tmpfs flood, the installer slimming — nine walls broken in a row before the historic moment arrived: the real launcher running stable at four processes, the WeGame window rendering a genuine 542KB frame inside the sandbox, writing its own logs. Then came a change of quarters worthy of a textbook: with the old cloud machine to be abandoned, an inventory confirmed all 4.6G of assets regenerable, and the new machine was rebuilt in twenty minutes — wine, the responder, Ghidra and the first asset batches — with the core intellectual property (protocol and cryptography) suffering zero loss. The siege closed with the TCLS chain’s first run reproduced on the new machine and four modules re-imported into the analysis project — the gate on the wall has been found, and the key is being cut.