Startup, version-check & hot-update

Cold start walks an 18-state machine from splash screen to a live game connection. Three independently-versioned payloads, asset bundles, the Lua bundle, and the C# hot-update assemblies, are checked and patched separately, from a single version-check HTTP response.

State machine (cold start, first launch)

#	State	Does
1	`Logo`	Splash screen
2	`Permission`	OS permission + jailbreak checks
3	`CheckResVersion`	Version check: races N hosts in parallel, first success wins
4–5	`DownloadManifest` / `DownloadUpdate`	Downloads/patches asset bundles, table data, and the Lua bundle
6	`LoadDataTable`	Loads config tables + localization into memory
7	`GetServerList`	GSL request: RSA+AES hybrid handshake (Gate-server RSA+AES handshake), on every cold start in 1.0.364
9	`ConnectGame`	Races every gateway in the zone’s list and keeps the first to answer (see SFS2X wire protocol)
10	`Login`	SFS2X `Login` request (see Identity, login & session)
12	`LoadScene` → `EnterGame`	Loads the actual game scene

In 1.0.364, CheckResVersion clears the cached server IP, port, and connection type on every cold start, so StartConnect never finds a cached server and the GSL (Gate Server List) call always runs (static-analysis-only). The cached ip/port/zone short-cut from state 6 to state 9 still exists, but only a mid-session reconnect, such as following a serverInfo redirect, takes it. See Identity, login & session for what the GSL call does with the stored tokens.

Check-version endpoint

GET {host}/gameservice/getlsu3dversion.php
?packageName=com.fun.lastwar.gp&platform=...&appVersion=...
&gm=0&server=<cached zone>&uid=&deviceId=&table_env=table_online&buildId=<versionCode>
&returnJson=1&unityVersion=440

In 1.0.364, table_env is table_online and server carries the cached zone (static-analysis-only). goclient sends both empty, and the server answers anyway (confirmed live). Host list (requests go out to every host in parallel and the first success wins; on total failure the client retries the same list once). About 5% of devices are A/B-bucketed to the ea- hosts by GrayUtils.GetPercentageFromMd5: MD5(deviceId) read as a little-endian uint64, mod 100 + 1 <= 5.

https://lastwar-serverlist-cf.lastwarapp.net
https://lastwar-serverlist-us-aws-ali.lastwargame.com
https://lastwar-serverlist-us-gcp-ali.lastwargame.com

# ea- bucket
https://lastwar-serverlist-ea-us-aws.lastwargame.com
https://lastwar-serverlist-ea-us-gcp.lastwargame.com

goclient tries the three online hosts one after another, not in parallel. Whichever host answers becomes the base URL for every subsequent call in this bootstrap (getserverlist.php, getnotice.php, probe.php); there is no separate “gate server” discovery step. A response counts as valid when it has a non-empty code (which the client treats as an error), or when updateType is in 0..3 and hotUpdateMsg is non-empty. The 1.0.364 parser (CheckResVersionState) reads these fields:

Response field	Meaning
`code`	Error: the client throws and falls back to the versions packaged in the app
`resMsg`	Base64 DER RSA public key (no PEM armor), feeds the GSL crypto, see Gate-server RSA+AES handshake. Not hardcoded, delivered fresh every check.
`updateType`	See the table below
`downloadurl`	Store link shown with a forced update
`hotUpdateMsg`	`;`-separated `name,version,crc,size`, asset-bundle manifest versions (`GameRes`, `DataTable`, `Lua`, `Download`, `PackageRes`, `DllRes`)
`lwfile2`	The Lua bundle: `version\|bzSize\|bzCrc[\|rawSize\|rawCrc];oldVer\|patchSize\|patchCrc;...`. A patch downloads only when the local version equals one of the `oldVer` entries
`table_version`	`version,size,md5[,crc][;patch chain]` for the game-data table archive. Parsed by the C#, but absent from the live iOS response on 2026-10-04
`locale`	`version,lang1,lang2,...`. Parsed by the C#, but absent from the live iOS response on 2026-10-04
`client_config`	Server-pushed feature flags: `\|`-separated `"0"`/`"1"` values indexed by switch id (`ClientSwitch.IsOn(N)` gates throughout the client). See SFS2X wire protocol for the ones that change the wire
`checkok`	Present only in review mode; the client then skips the table and locale updates
`warmup`	Opaque asset pre-download list; not protocol-relevant
`firstLaunchForceUpdateMsg`	Read only in a first-launch skip-update experiment; not protocol-relevant

That’s every field the parser handles. A live response carries fewer: the iOS check-version response for 1.0.344 (786), fetched on 2026-10-04, held only client_config, downloadurl, firstLaunchForceUpdateMsg, hotUpdateMsg, lwfile2, resMsg, updateType, and warmup. updateType meanings (1.0.364 C#):

Value	Meaning
`0`	Proceed to download and hot-update
`1`	Optional store-update dialog: update or continue
`2`	Forced update, blocking. The server no longer accepts this build
`3`	Falls into the `default` branch, so it behaves exactly like `0`. The `Login` response handler also rewrites `3` to `0`

The Login response can carry updateType too; with 2, the client enters its app-update state instead of waiting for init. On 2026-10-04 the iOS 1.0.344 app got updateType=3 from both check-version and Login, with the Login response naming new_version 1.0.350 (observed live). goclient now logs a warning when check-version returns updateType=2, since Logins claiming that build are likely to start failing too.

resVersion

Login’s resVersion is GetResVersion() in the 1.0.364 C# (static-analysis-only):

{GameRes}.{DllRes}_{lwfile2 version}F_{table_version}.{locale}

In the C#, each part is the first field of the matching check-version entry: the GameRes and DllRes versions from hotUpdateMsg, the first | field of lwfile2, and the first , field of table_version and locale. Only the {GameRes}.{DllRes}_{lwfile2 version}F prefix can be derived from a live response. The real iOS app sent 2159.1505_821F_39516.23570 on 2026-10-04, and that day’s check-version response returned GameRes 2159, DllRes 1505, and lwfile2 version 821, matching the prefix. It carried no table_version or locale field, and neither 39516 nor 23570 appears anywhere in it. The tail’s source is unknown (local state or another endpoint), and its mapping to table_version and locale is static-analysis-only. goclient sends "0", which the server has accepted for months.

Hot-update transport & patch format

Three independently-versioned payloads, compared via the fields above and patched separately:

Asset bundles (incl. C# .mdl assemblies): standard Unity AssetBundle, tracked by the dllres manifest.
Lua bundle: one flat LWLF file, not wrapped in an AssetBundle at all.
Data tables: the plain-ZIP table_*.data archive.

Downloaded patches/replacements may be wrapped in a lightweight on-disk XOR obfuscation (not real confidentiality, key material is hardcoded client-side) built on a reduced-round ChaCha stream cipher: 8 rounds (4 double-rounds) instead of standard ChaCha20, IETF layout, detected by a short (3–6 byte) magic-prefix swap:

Plain magic	Wrapped magic	Content
`50 4B 03 04` (`PK··`)	`CHAC`	table `.data` ZIP
`42 5A 68` (`BZh`)	`PRB`	bzip2 (Lua bundle package)
`42 53 44 49 46 46` (`BSDIFF`)	`PURBDP`	bsdiff patch

Key/nonce are derived once from hardcoded dummy constants via two self-referential ChaCha8 passes (reproduced independently in Python and confirmed reproducible):

_key   = 83aa6a90bdfb210e4742405500db2c0c80b30776f6441df7cd1504f830ad1f2b
_nonce = 2122232425262728292a2b2c

CDN

https://lastwar-cdn.akamaized.net/hotupdate/     (primary)
https://lastwar-cdn.lastwarapp.net/hotupdate/    (fallback)
https://cdn.lastwar.com/hotupdate/               (fallback)

The client rotates through the fallback bases on retry. The Lua bundle sits at a predictable path under each base (NetworkURLConfig.GetDownloadURL, LWLuaFileUtil):

https://lastwar-cdn.akamaized.net/hotupdate/<app id>/<Android|iOS>/LWScripts_<version>_u440.bz2
https://lastwar-cdn.akamaized.net/hotupdate/<app id>/<Android|iOS>/LWScripts_<new>_<old>_u440.patch

<app id> is the bundle identifier: com.fun.lastwar.gp for Android, com.lastwar.ios for iOS. The .bz2 is plain bzip2, not ChaCha-wrapped; if a download ever is wrapped (PRB), the client unwraps it first. On disk, the client re-encrypts the bundle as LWLF file version 2, which never affects the CDN payload. Old versions stay hosted: every version probed between 780 and 826 returned HTTP 200 on 2026-10-04. Lua bundle versions seen on 2026-10-04:

Bundle	`LWLF` version	Chunks
1.0.351 APK baseline (recovered from the CDN)	793	18,514
1.0.364 APK (tag `20260921_1892_App`)	825	18,733
Live Android (newest hosted; 827 and 830 returned 404)	826	18,740
Live iOS (matches the iOS app’s `lwfile2`)	821	18,740

At the command-catalog level, both live bundles match the 1.0.364 APK. Their differences are debug-only UI modules, a removed diagnostic, and a handful of changed chunks outside Net/. Every request schema goclient uses is identical across all four versions, see Command reference.

Front Matter

Bootstrap & Transport

Protocol Surface

Gameplay Domains

Client Internals

Building the Client

Startup, version-check & hot-update

State machine (cold start, first launch)

Check-version endpoint

resVersion

Hot-update transport & patch format

CDN

​State machine (cold start, first launch)

​Check-version endpoint

​resVersion

​Hot-update transport & patch format

​CDN

State machine (cold start, first launch)

Check-version endpoint

resVersion

Hot-update transport & patch format

CDN