Skip to main content
Cold start walks an 18-state machine from splash screen to a live game connection. Three independently-versioned payloads, asset bundles, the Lua bundle, and the C# hot-update assemblies, are checked and patched separately, from a single version-check HTTP response.

​
State machine (cold start, first launch)

A returning user with a cached, still-valid ip/port/zone skips straight from step 6 to step 9; the RSA+AES GSL dance only runs on first launch or when the cache is stale/rejected.

​
Check-version endpoint

Host list (first success wins, ~5% of devices A/B-bucketed to an ea- variant by GrayUtils.GetPercentageFromMd5: MD5(deviceId) read as a little-endian uint64, mod 100 + 1 <= 5):
Whichever host answers becomes the base URL for every subsequent call in this bootstrap (getserverlist.php, getnotice.php, probe.php); there is no separate “gate server” discovery step.

​
Hot-update transport & patch format

Three independently-versioned payloads, compared via the fields above and patched separately:
  • Asset bundles (incl. C# .mdl assemblies): standard Unity AssetBundle, tracked by the dllres manifest.
  • Lua bundle: one flat LWLF file, not wrapped in an AssetBundle at all.
  • Data tables: the plain-ZIP table_*.data archive.
Downloaded patches/replacements may be wrapped in a lightweight on-disk XOR obfuscation (not real confidentiality, key material is hardcoded client-side) built on a reduced-round ChaCha stream cipher: 8 rounds (4 double-rounds) instead of standard ChaCha20, IETF layout, detected by a short (3–6 byte) magic-prefix swap: Key/nonce are derived once from hardcoded dummy constants via two self-referential ChaCha8 passes (reproduced independently in Python and confirmed reproducible):

​
CDN