# Last War

## Docs

- [Overview & architecture](https://lastwar.tech/index.md): A reverse-engineered technical dossier of the Last War: Survival Game Android client: crypto, wire protocol, command catalog, and Go client roadmap.
- [Extraction methodology](https://lastwar.tech/methodology.md): How three custom, undocumented file formats were reverse-engineered from first principles to recover readable Lua and C# source from the APK.
- [Startup, version-check & hot-update](https://lastwar.tech/bootstrap.md): The 18-state cold-start machine and the three independently-versioned hot-update payloads it downloads and patches.
- [Gate-server RSA+AES handshake](https://lastwar.tech/gate-server-crypto.md): How the GSL (Gate Server List) HTTP exchange's hybrid RSA+AES-ECB envelope encryption works, and how to reproduce it in Go.
- [SFS2X wire protocol](https://lastwar.tech/wire-protocol.md): How the game's hand-rolled SmartFoxServer 2X packet envelope, header flags, XOR obfuscation, and binary SFSObject codec work on the wire, validated against the official SmartFoxServer JS SDK.
- [Identity, login & session](https://lastwar.tech/auth.md): How device identity, SFS2X zone login, the MD5 integrity fields, post-login init sequence, and the separate chat channel authenticate a client against the game's servers.
- [Command reference](https://lastwar.tech/command-reference.md): How the client's ~3,178 dispatch commands break down by gameplay domain and transport channel, and where the full searchable catalog lives.
- [Entity ID reference](https://lastwar.tech/entity-id-reference.md): Numeric ID catalog for every building, monster, hero, troop line, resource, and item/equipment type the client can reference, extracted from Global_EnumType.lua and the table_decompiled data tables.
- [City & building](https://lastwar.tech/city-building.md): The base-building loop: two distinct queue systems, the building-id encoding scheme, core commands, and the two-part resource economy.
- [Military, hero & battle](https://lastwar.tech/military-battle.md): Combat resolution is server-authoritative everywhere except one scripted PVE minigame; recovered BattleReport/LwBattleReport proto schemas and the core army/hero/formation commands.
- [Alliance, chat & mail](https://lastwar.tech/alliance-chat-mail.md): How alliance management and mail ride the main SFS2X socket while real-time chat text runs over a separate, independently-authenticated JSON WebSocket.
- [Shop, trading & real-money IAP](https://lastwar.tech/shop-iap.md): The full purchase flow, Google Play to server credit, traced end to end, including how the client smuggles its own order-correlation id through Google's generic obfuscated account id field.
- [World map](https://lastwar.tech/world-map.md): The fixed 1000×1000 per-server tile grid, its linear point-id addressing, and the four query patterns the client uses instead of SFS2X's unused area-of-interest streaming.
- [Lua scripting architecture](https://lastwar.tech/lua-architecture.md): How the C# hot-update tier hands off to xLua, the module tree, boot sequence, require() resolution, and the BaseClass OOP convention used across the codebase.
- [Game data tables](https://lastwar.tech/data-tables.md): The shape, container format, and categorized index of the 1,279 balance/config Lua data tables shipped alongside the client.
- [Android platform layer](https://lastwar.tech/android-platform.md): Permissions, third-party SDK wiring, and the Java-native-C# bridge on Android, none of which gates the SFS2X/HTTP game protocol.
- [Native binaries & security posture](https://lastwar.tech/native-binaries.md): Symbol/string survey of the game's native libraries and an assessment of whether anything below the protocol layer blocks a clean-room Go client.
- [Go client implementation roadmap](https://lastwar.tech/go-client-roadmap.md): The recommended build order for a from-scratch Go client, plus a step-by-step guide to building, configuring, and actually running the researcher's own Go implementation.
- [Capturing and decoding traffic](https://lastwar.tech/capturing-and-decoding-traffic.md): The exact, reproducible pipeline behind every live-confirmed finding in this dossier: capture real client traffic, find the right TCP stream, reassemble it, and decode it with the same codec the Go client runs on its own connection.
- [Live validation against production](https://lastwar.tech/live-validation.md): Live packet-capture testing against real production servers and a real account confirms the protocol and codec work end-to-end, and traces the root cause of the Zstd decompression bug, the SFSObject array-decode bugs, and the token-identity-mismatch reconnect fix.
- [Findings & further work](https://lastwar.tech/findings.md): Every question flagged during the client-building effort and how it was resolved, plus the narrow follow-on work that remains.