The New Cellar Behind the New Plates: The creativeObject Suspect in the Moyu Kernel, the Reconfirmation of the C2S Plaintext Chain, and the AES Key to the UIScript Vault

The court that changed its plates keeps handing over new maps. The duty of November 1 pushed three fronts one grid forward at once: the layer relations of the send chain, the boundary of VM-ization, and the key to the Lua asset cellar.

I. The Send Chain Reconfirmed: The Message Layer Is a Plaintext Vestibule

The corrected characterization of the C2S send path landed: the 19,552 frames of send-frames.txt are high-entropy down to their headers — captured from send_wrapper (0x33019a0) plus the 0x10020 buffer, they are whole-frame ciphertext; and the eaXX frames taken at 0x3306110 trace back to dispatch, the UI direction (S2C plaintext dispatch), not the send side. The plaintext frame format is confirmed: [u16 len][u16 id][payload], len being the total frame length (matching the u16≤0x3ff check at 0x33031d0). Hence the stage’s most important inference: the 0x33031d0 layer is the message layer (headers plaintext), and whole-frame TEA encryption happens automatically below it — injecting plaintext message frames walks the whole chain with zero cipher knowledge required. The inject_v3 one-shot sendmsg/raw interface stands ready, awaiting live calibration the moment the game is online with mouse-driven movement and attacks.

II. The Boundary of VM-ization: Even the Heartbeat’s Send Call Is Behind the Wall

The heartbeat construction code was found in disassembly with its arithmetic intact (rdi=conn, st=conn[0x418], st[4]²+0x2537 XOR TimeGet, then XOR 0xa3c9f) — but its send call at 0x1431b9260 is VM-ized (prologue leaping straight into the .vlizer segment), the same protection regime as the fdeb handler. The reasonable extrapolation: message constructors are likely VM-ized as well, the static road narrows again, and black-box hooking (input-output correspondence) remains the only viable path. The guard also fixed its nightly-retry bug (night_guard2), and the residual effect of the account-protection period on logins is being skirted at low frequency.

III. The Key Cabinet of the UIScript Cellar: AES-CBC Down to the Symbol Names

The Lua asset front’s harvest is a key cabinet precise to the symbol name: LuaInterface.dll carries the complete decryption implementation — LuaSceneScript::DecryptAndLoadLuaFile, two overloads of DecryptLuaFile, EncryptLuaFile, and AES_CBC_decrypt_buffer / AES_CBC_encrypt_buffer (calling into LuaSrc.dll’s AES implementation) with the it_ctx_iv context. The strategic meaning is settled: the .dat files of UIScript/luaui are encrypted with AES-CBC, not XXTEA, independent of the c3_config XXTEA regime. The next step is cleanly executable: locate the decryption function through the code references of the AES_CBC_decrypt_buffer string → extract key/IV → decrypt all 3,924 UIScript .dat files offline → the complete Lua source corpus enters the archive. The doorplate of the court’s script cellar is found; only the final grinding of the key blank remains.