{"slug":"game-client-to-server-reverse","title":"game-client-to-server-reverse","summary":"从游戏客户端（安装包/APK/IPA/EXE 或 dump.cs、lua、usmap、抓包等）反推服务端协议并复现可部署服务端。含阅读路径分派、原理层(primer：三要素/数据包协议/协议表/热更源码)、四阶段路线图(workflow-roadmap：静态分析→建工具+登录链→重定向→补包循环→清单迭代)、11 种反推方法选择器（含内联服务端路线）、接口清单提取器（tools/）、协议规格模板(protocol.spec.yaml)、wire 级定点改写（不等 schema 齐就能跑）、客户端地址来源清查、三轴状态与验收体系、发布运维清单、进度清单(T","platform":"Claude","tags":[],"authorName":"LLM Mart","authorSlug":"llm-mart","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-09-24T15:42:19.350863Z","repo":{"url":"https://github.com/ShrugYu/game-client-to-server-reverse","stars":17,"forks":5,"license":"AGPL-3.0","updatedAt":"2026-09-24T02:02:09Z"},"bodyHtml":"<h1>游戏客户端 → 离线本地化 Skill</h1>\n<p>完整支持 <strong>Unity（IL2CPP / Mono / Lua）</strong> 与 <strong>Unreal Engine（UE4 / UE5）</strong>，也覆盖 C#/AS3/Lua/JS/Java 等各类客户端。\n从客户端反推服务端协议 → 复现本地离线服务端 → 部署 → 让原版客户端<strong>本地离线运行</strong>。</p>\n<blockquote>\n<p>[x] 本包自带的服务端已<strong>实测跑通</strong>：握手 → 登录 → 建角 → 选角 → 进场景 → 移动 → 心跳，\n并验证 XOR 加密 + zlib 压缩 + 充值/邮件发放。</p>\n<p>服务端参考实现原Github地址：https://github.com/Nanako660/peach-haven</p>\n<p><strong>2026-09-22 更新（v2.0）</strong> —— 本版主题：原理层 + 四阶段路线 + <strong>换服务端（重定向）</strong>：\n⓪ <strong>版本升至 2.0</strong>：整合 1.x 全部成果 + 以下 ①<sub>⑪；\n① <strong>原理层</strong> <code>references/primer.md</code>：三要素（配置=数值 / 协议=格式 / 代码=用法）、\n数据包协议本质、协议号与协议表、<strong>热更新代码是比 dump 更好读的源码</strong>；\n② <strong>四阶段路线总纲</strong> <code>references/workflow-roadmap.md</code>（静态分析 → 建工具+登录链 → 重定向 → 补包循环 → 清单迭代）+ <strong>四层重定向表</strong>；\n③ 模板：<code>templates/login-chain.md</code>（登录链条）、<code>templates/function-checklist.md</code>（功能清单）；\n④ SKILL §0 开头新增<strong>阅读地图（三条主线）</strong>；\n⑤ <strong>反推对象地图</strong> <code>references/server-architecture-basics.md</code>（逆向视角）：你在还原哪几类服、\n网关留下的隐藏层（合并/加解密/压缩 flag）、从包里认 Protobuf/KCP、同步模型决定\"要还原多少逻辑\"\n（来源：平台云架构演进、GameDevAndOps、KCP/protobuf 官方、Skynet/Pomelo/KBEngine/NF）；\n⑥ <strong>取长补短（折进现有文件）</strong>：<code>methods.md</code> M8 补入<strong>现成实现速查（按类型）</strong> + \"先查别人做过没\" + <strong>先锁版本</strong>；<code>protocol-spec.md</code> 补入人类可读协议文档格式；\n⑦ <strong>SKILL.md 瘦身</strong>：与 references 重复的 §1</sub>§8、§11、§14~§19 压成\"要点+指针\"（1122 → ~650 行）；§11 常见坑并入 <code>closure-verification.md §附</code>；\n⑧ <strong>跨模型阅读优化（GLM / DeepSeek / Claude）</strong>：SKILL 顶部改为<strong>模型无关的显式阅读协议</strong>（\"打开哪个文件\"写死）；\n去掉顶部大段变更历史；给 5 篇 &gt;300 行的 reference 补<strong>章节目录</strong>；<code>reading-path.md</code> 顶部声明按它分派；\n⑨ <strong>去除 emoji</strong>：全库清理（状态标记转 ASCII、装饰 emoji 删除、箭头保留）；\n⑩ <strong>框架修正 + 资源</strong>：<code> §0</code> 改为\"<strong>主动改客户端对接本地离线服务端</strong>\"（按重定向四层表、优先跑起来）；\n⑪ <strong>换服务端手法补全（v2.0 新增）</strong>：<code>client-address-sources.md §3.0b</code> 加入 <strong>Xposed / LSPatch 模块重定向</strong>\n（第三方代理模块实测范例，免 root）；<code>methods.md</code> M8 加\"<strong>多人/联机复活项目</strong>\"检索入口；\n⑫ <strong>签名绕过</strong>：<code>repack-rename.md §8</code> 加入 <strong>LSPatch Signature Bypass（等级 2）机制</strong> / 独立签名破解\n（<code>ApkSignatureKiller</code> / 核心破解） / 真正不改签名的虚拟容器（VirtualXposed / 太极）；§7 落点表述改为\"按代价从低到高\"；\n接入点：<code>account.md §6</code>、<code>release-and-ops.md §7</code>、<code>SKILL §16</code>；</p>\n<p><strong>2026-09-15 实战沉淀（v1.8 新增）</strong>：\n⑬ <strong>内联服务端</strong>：不起外部服务端，在客户端<strong>进程内</strong>拦截网络门面合成响应\n（三类入口 / 回调投递纪律 / 延迟派发 / 双通路 / 内联版验收与假阳性）→ <code>references/inline-server.md</code>\n⑭ <strong>运行时对象合成与字段发现</strong>：用客户端自己的类型系统当 schema，先 dump 再合成 → <code>references/runtime-object-synthesis.md</code>\n⑮ <strong>平台 SDK 登录态复用 + 目录服→区服两段准入</strong> → <code>references/platform-sdk-and-admission.md</code>\n⑯ 真实案例：Unity IL2CPP + 平台 SDK 的内联服务端 → <code>references/case-il2cpp-inline.md</code></p>\n<p><strong>2026-09-13 实战沉淀（新增）</strong>：\n② <strong>改包名 / 重打包 / 保留原签名</strong>全清单 → <code>references/repack-rename.md</code>\n④ <strong>闭环验证与 6 类假阳性</strong>（端口在听≠服务可用、自环≠客户端兼容）→ <code>references/closure-verification.md</code>\n⑤ <strong>真实案例：Unity IL2CPP + ECDH 登录服</strong>（帧格式 / SPKI / 已证伪项）→ <code>references/case-il2cpp-ecdh.md</code>\n⑥ SKILL 铁律 3 → 4 条：<strong>不把「能跑」当成「跑通」</strong>\n⑦ <strong>工程范式</strong>（实机跑通项目的做法：fixture 回放 / 具名完成点 / 证据分档 / ADR）→ <code>references/engineering-practices.md</code>\n⑧ 文档模板：<code>templates/adr-template.md</code>、<code>templates/e2e-evidence-template.md</code>\n⑨ <strong>实现层核心</strong>：不依赖 protobuf 运行时的 <strong>wire 级定点改写</strong>（帧 codec + 字段遍历 + splice 替换 + 空子消息必须保留）→ <code>references/wire-level-patching.md</code>\n⑩ <strong>客户端地址来源清查</strong>（六类来源 + 落点优先级 + 重签后果 + 阶段验收）→ <code>references/client-address-sources.md</code>\n⑪ <strong>三轴状态与验收体系</strong>（实现 / 自动测试 / 客户端验收 + 可达性五分类 + 提交门禁）→ <code>references/verification-and-status.md</code>\n⑫ <strong>发布、部署与运营</strong>（监听 vs 对外地址 / 端口族 / 启动期冻结配置 / CDN 版本策略 / 备份）→ <code>references/release-and-ops.md</code></p>\n</blockquote>\n<hr>\n<h2>目录映射（本 skill 的结构）</h2>\n<blockquote>\n<p>本 skill 遵循 <strong>Agent Skills</strong> 规范：<strong>一个文件夹 = 一个 skill</strong>，且 frontmatter 的 <code>name</code>\n必须与文件夹名一致。本文件夹即 <code>game-client-to-server-reverse/</code>；内部目录是对规范约定目录的映射。</p>\n</blockquote>\n<table>\n<thead>\n<tr>\n<th>规范约定</th>\n<th>本 skill 实际</th>\n<th>说明</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><code>SKILL.md</code></td>\n<td><code>SKILL.md</code></td>\n<td>必需：元数据 + 主干（已瘦身到 &lt; 500 行，符合规范建议）</td>\n</tr>\n<tr>\n<td><code>references/</code></td>\n<td><code>references/</code></td>\n<td>按需加载的详细文档（正文下沉于此）</td>\n</tr>\n<tr>\n<td><code>assets/</code></td>\n<td><code>templates/</code>、<code>schema/</code>、<code>server/</code></td>\n<td>模板 / 中间产物模板 / 可运行参考实现</td>\n</tr>\n<tr>\n<td><code>scripts/</code></td>\n<td><code>tools/</code></td>\n<td>可执行脚本（<code>extract_interfaces.py</code> / `` / <code>repack_zip.py</code>）</td>\n</tr>\n<tr>\n<td>—</td>\n<td><code>examples/</code>、<code>extensions/</code></td>\n<td>推演示例 / 可选拓展</td>\n</tr>\n</tbody>\n</table>\n<blockquote>\n<p>阅读顺序：<code>SKILL.md</code>（导航+主干）→ <code>references/reading-path.md</code>（按任务分派）→ 按需打开具体文件。</p>\n</blockquote>\n<hr>\n<h2>先读什么（别一次读完整包）</h2>\n<p>本包有 37 篇参考 + 一份长主文档。<strong>通读完再动手 = 上下文耗尽 + 在半懂的地方开始猜。</strong></p>\n<pre><code>1. references/reading-path.md      ← 按任务类型拿到 3~5 个文件的阅读路径\n2. SKILL.md §0.0 ~ §0.6            ← 方法选择 + 铁律 + 工作流主干\n3. 按路径读完场景层文件 → 动手\n收工前：reading-path.md §2 的「收工前检查」\n</code></pre>\n<p><strong>上下文极少时</strong>的优先级：\n<code>SKILL §0</code> → <code>reading-path.md</code> → <code>wire-level-patching.md</code> → <code>closure-verification.md</code> → <code>client-address-sources.md</code></p>\n<blockquote>\n<p>skill 是<strong>查询手册</strong>，不是必读教材。</p>\n</blockquote>\n<hr>\n<h1>如何使用本 Skill</h1>\n<h2>一句话</h2>\n<p>把游戏（安装包 / 客户端 / 辅助文件）交给 AI，说清「要什么」，\nAI 会<strong>自己取证 → 产出协议规格 → 生成并部署本地离线服务端 → 让客户端本地离线运行</strong>。</p>\n<h2>你最少只需给一样</h2>\n<table>\n<thead>\n<tr>\n<th>给什么</th>\n<th>推荐度</th>\n<th>AI 会做什么</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>一个安装包</strong>（<code>.apk</code> / <code>.ipa</code> / <code>.exe</code>）</td>\n<td>最推荐</td>\n<td>自己解包、判引擎、跑 dump、抓包（见 <code>references/from-installer.md</code>）</td>\n</tr>\n<tr>\n<td>客户端目录 / <code>dump.cs</code> / <code>*.lua</code> / <code>*.usmap</code></td>\n<td></td>\n<td>直接进静态分析</td>\n</tr>\n<tr>\n<td>抓包 <code>*.pcap</code> / mitm 导出</td>\n<td></td>\n<td>直接做协议分层</td>\n</tr>\n<tr>\n<td>已有服务端样本 / 协议文档</td>\n<td></td>\n<td>对照分析</td>\n</tr>\n<tr>\n<td>只有一个游戏名</td>\n<td>[x]</td>\n<td>没有证据，建议先提供安装包</td>\n</tr>\n</tbody>\n</table>\n<h2>提问模板（直接复制改）</h2>\n<pre><code>① 最简\n帮我反推这个游戏的服务端：/文件路径/game.apk\n\n② 带目标\n用这个 APK 反推服务端协议，先跑通登录，然后部署到本地。\n\n③ 带约束\n这是 Unity 手游，服务端请分析根据当前用户给出客户端来用什么编写（如Go编写），要支持局域网联机链接到我们当前写的服务端上，先做协议分析.md文档再写代码。\n\n④ 指定阶段\n先别写代码，只做协议分层，产出 protocol.spec.yaml 和证据清单。\n</code></pre>\n<h2>一个好提问包含 4 个要素</h2>\n<table>\n<thead>\n<tr>\n<th>要素</th>\n<th>说明</th>\n<th>例子</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td><strong>输入</strong></td>\n<td>你给什么</td>\n<td><code>game.apk</code> / <code>dump.cs</code> / <code>capture.pcap</code></td>\n</tr>\n<tr>\n<td><strong>目标</strong></td>\n<td>做到哪一步</td>\n<td>只分析 / 跑通登录 / 完整服务端+部署</td>\n</tr>\n<tr>\n<td><strong>约束</strong></td>\n<td>语言/平台/版本</td>\n<td>Go / 安卓局域网 / 客户端 1.8.1</td>\n</tr>\n<tr>\n<td><strong>环境</strong></td>\n<td>跑在哪</td>\n<td>本地 / 云服务器 / Termux</td>\n</tr>\n</tbody>\n</table>\n<blockquote>\n<p>缺哪个都行，AI 会用占位符推进；但<strong>输入</strong>最好给一个。</p>\n</blockquote>\n<h2>AI 会按这个顺序回应（重要）</h2>\n<pre><code>1. project-profile.yaml    ← 我读了什么、还缺什么        （项目档案）\n2. evidence-inventory      ← 每条结论的证据 + 置信度     （证据清单）\n3. protocol.spec.yaml      ← 协议规格（唯一事实来源）\n4. 服务端代码 + 部署 + 验证 ← 由 Spec 派生\n</code></pre>\n<blockquote>\n<p>注意: <strong>如果 AI 直接甩给你一堆代码，却没有前 3 样，让它重来。</strong>\n「先规格，后代码」是本 skill 的硬性要求（见 <code>references/ai-contract.md</code>）。</p>\n</blockquote>\n<p><strong>另有两份\"开工/收工\"契约</strong>（详见 <code>references/ai-contract.md</code>）：</p>\n<pre><code>AGENTS.md                  ← 工作区边界 + 验证命令 + 收工状态（放在项目根）\ndocs/status/support-matrix ← 三轴状态：实现 / 自动测试 / 客户端验收\n</code></pre>\n<h2>可以这样追问</h2>\n<ul>\n<li>「先给我证据清单」</li>\n<li>「先只做协议分层」</li>\n<li>「为什么判定是 4 字节大端？证据是哪条？」</li>\n<li>「服务端换成 Go 重写」</li>\n<li>「把 opcode 表填进去」</li>\n<li>「客户端连不上，帮我定位是哪一步」</li>\n<li>「先把账号/登录接口列出来，登记到 TRACKER」</li>\n</ul>\n<h2>常见问题指路</h2>\n<table>\n<thead>\n<tr>\n<th>问题</th>\n<th>看哪</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>不懂\"在反推什么\"/第一次做</td>\n<td><code>references/primer.md</code>（原理层）</td>\n</tr>\n<tr>\n<td>不知道先做什么、在哪验收</td>\n<td><code>references/workflow-roadmap.md</code>（四阶段路线）</td>\n</tr>\n<tr>\n<td>只有安装包怎么办</td>\n<td><code>references/from-installer.md</code></td>\n</tr>\n<tr>\n<td>怎么注册账号 / 替换登录接口</td>\n<td><code>references/account.md</code>（§16）</td>\n</tr>\n<tr>\n<td>需要人机（假玩家）</td>\n<td><code>extensions/</code>（§18，可选）</td>\n</tr>\n<tr>\n<td>不想起服务端 / 想单机化</td>\n<td><code>references/inline-server.md</code>（M11 内联服务端）</td>\n</tr>\n<tr>\n<td>进度/接口清单</td>\n<td><code>TRACKER.md</code></td>\n</tr>\n</tbody>\n</table>\n<h2>不要这样问</h2>\n<ul>\n<li><input disabled=\"disabled\" type=\"checkbox\" checked=\"checked\"> 只给游戏名就让 AI 凭空写服务端 —— 没有证据 = 必错</li>\n<li><input disabled=\"disabled\" type=\"checkbox\" checked=\"checked\"> 「直接给我能用的服务端」却不给任何输入</li>\n</ul>\n<h2>使用守则与限制</h2>\n<blockquote>\n<p>完整守则见 <a href=\"references/usage-policy.md\"><code>references/usage-policy.md</code></a>；每次动手前先读。</p>\n</blockquote>\n<p><strong>可做（允许）</strong>：自研 / 已授权 / 离线单机目标的互操作性研究、协议文档化、学习与教学、已停服游戏的本地化存档（非商业）、授权范围内的安全评估。</p>\n<p><strong>不做（禁止）</strong>：未授权架设 / 运营他人游戏的服务器、绕过或破坏他人的技术保护 / 完整性校验 / 反作弊、商业化牟利、侵犯他人权益、破坏性攻击。</p>\n<p><strong>硬性约束</strong>：证据驱动（无证据 = 假设）、先规格后代码、只给方法不给具体游戏的成品 / 密钥、不提供保护绕过、fail closed（缺信息就说缺什么）、越界即停并给出合规替代。</p>\n<ul>\n<li>使用参考项目 / 代码前先看其许可证。</li>\n</ul>\n<hr>\n<h2>目录结构</h2>\n<pre><code>离线本地化/\n├── SKILL.md                主流程（18 节，核心方法论）\n├── README.md               本文件\n├── TRACKER.md               进度与接口清单（每模块更新，从简）\n├── schema/                  中间产物模板（AI 填这些）\n│   ├── project-profile.yaml   项目档案\n│   └── protocol.spec.yaml     协议规格（唯一事实来源）\n├── references/\n│   ├── adaptation.md        自适应方法论：项目→证据→决策→Spec\n│   ├── reading-path.md      最小必读路径（按任务类型分派）\n│   ├── primer.md            原理层：三要素/数据包协议/协议表/热更源码/双证据链\n│   ├── workflow-roadmap.md  四阶段路线总纲（静态分析→建工具+登录链→重定向→补包循环→清单迭代）\n│   ├── phases-detail.md     §1~§10 反推主流程详细版（命令/工具/判断/坑）\n│   ├── ai-contract.md       AI 行为契约（强制产物/禁止/终点/回滚）\n│   ├── usage-policy.md      使用守则与限制（允许/禁止用途 + 硬性约束 + 自检）\n│   ├── server-architecture-basics.md  反推对象地图（逆向视角：你在还原哪几类服/网关隐藏层/同步模型）\n│   ├── methods.md           10 种反推方法 + 选择矩阵（动手前先看）\n│   ├── closure-verification.md  闭环验证 6 类假阳性（宣布成功前必看）\n│   ├── engineering-practices.md  实机跑通范式：fixture 回放 + 完成点 + 证据分档 + ADR\n│   ├── wire-level-patching.md  实现层核心：不依赖 pb runtime 的 wire 级定点改写\n│   ├── client-address-sources.md  客户端地址来源清查 + 落点策略\n│   ├── verification-and-status.md  三轴状态 + 可达性分类 + 测试门禁\n│   ├── release-and-ops.md   发布 / 部署 / 运营 / CDN / 备份\n│   ├── case-il2cpp-ecdh.md  真实案例：IL2CPP + ECDH 登录服 + 卡点复核\n│   ├── inline-server.md     内联服务端：进程内合成响应（与外部服务端并列的第二条路）\n│   ├── runtime-object-synthesis.md  运行时对象合成与字段发现（对象级 schema 自举）\n│   ├── platform-sdk-and-admission.md  平台 SDK 登录态复用 + 目录服→区服两段准入\n│   ├── case-il2cpp-inline.md  真实案例：IL2CPP + 平台 SDK 的内联服务端\n│   ├── account.md           账号体系与接口还原（登录/注册/接口替换）\n│   ├── combat.md            房间与战斗（局内、同步模型、服务端权威）\n│   ├── drops.md             掉落与物资（掉落表、掷骰、背包满转邮件）\n│   ├── gacha.md             抽卡/扭蛋（服务端掷骰、保底、重复转换）\n│   ├── decision-tree.md     逐层决策树（引擎/传输/封装/加密/序列化/架构）\n│   ├── protocol-spec.md     协议规格规范 + codegen 映射\n│   ├── codegen.md           由 Spec 生成/改造服务端（多语言）\n│   ├── client-languages.md  客户端语言分支（C#/AS3/Lua/JS/Java/C++）\n│   ├── from-installer.md    零输入自举：只有安装包怎么自产证据\n│   ├── cases.md             两个真实成功项目案例（Go / Node）\n│   ├── unity.md            Unity(IL2CPP/Mono/Lua) 深潜\n│   ├── unreal.md           Unreal(UE4/UE5) 深潜\n│   ├── windows.md          端游：Windows 运行服务端\n│   ├── termux.md           手游：Android/Termux 运行服务端\n│   └── repack-rename.md     改包名/重打包/签名/包名派生密钥\n├── examples/                推演示例（同 skill，不同项目→不同方案）\n│   ├── A-unity-il2cpp-protobuf.md\n│   ├── B-ue-kcp-custom.md\n│   ├── C-unity-lua-http.md\n│   └── D-real-lua-client.md     真实 Lua 源码分析（1794 个 opCode）\n├── tools/\n│   └── extract_interfaces.py    接口清单提取器（扒 opCode/路由）\n├── templates/              参考代码与文档模板\n│   ├── mock_server.py      极简桩\n│   ├── frida_bypass_ssl.js / kcp_sniff.py\n│   ├── frida-redirect.js   客户端重定向：hook getaddrinfo/connect（native/il2cpp）\n│   ├── xposed-redirect/    LSPosed 模块骨架：改写 URL（Java/OkHttp 客户端）\n│   ├── register-site/      注册网站（index.html + 最小 Flask 后端）\n│   ├── AGENTS.md            工作区 AI 协作契约（放在项目根）\n│   ├── adr-template.md      架构决策记录（含「当前不做的事情」+ 回滚）\n│   ├── e2e-evidence-template.md  实机端到端证据（帧序表 + 差异解释 + 重连快照）\n│   ├── status-matrix.md     三轴状态矩阵（实现 / 测试 / 客户端验收）\n│   ├── login-chain.md       登录链条文档（启动到主场景每一步）\n│   └── function-checklist.md  功能清单（按子系统登记实通/未通）\n├── extensions/              后续拓展（可选，不影响核心运行）\n│   ├── README.md           拓展说明与判断标准\n│   ├── bots.md             服务端人机（假玩家）\n│   └── bot-reverse.md      反推人机机制再复刻\n└── server/                 参考实现：长连接二进制协议服务端（Python）\n                               （GitHub: https://github.com/ShrugYu/game-client-to-server-reverse/tree/main/game-client-to-server-reverse/server）\n</code></pre>\n<h2>端游 / 手游怎么跑</h2>\n<table>\n<thead>\n<tr>\n<th>平台</th>\n<th>启动</th>\n<th>常驻</th>\n<th>客户端对接</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>Windows(端游)</td>\n<td><code>deploy/start_windows.bat</code></td>\n<td>NSSM 服务</td>\n<td>改 hosts → 127.0.0.1</td>\n</tr>\n<tr>\n<td>Android(手游)</td>\n<td><code>bash start_termux.sh</code></td>\n<td>wake-lock + tmux</td>\n<td>hosts / DNS 重定向</td>\n</tr>\n<tr>\n<td>Linux 服务器</td>\n<td><code>deploy/deploy.sh</code></td>\n<td>systemd</td>\n<td>域名解析 / 端口转发</td>\n</tr>\n<tr>\n<td>Docker</td>\n<td><code>docker compose up -d</code></td>\n<td>容器策略</td>\n<td>同上</td>\n</tr>\n</tbody>\n</table>\n<h2>客户端语言不只有 Unity/UE</h2>\n<table>\n<thead>\n<tr>\n<th>客户端语言</th>\n<th>反编译工具</th>\n<th>能拿到源码？</th>\n<th>客户端补丁方式</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>C#（Unity Mono / .NET）</td>\n<td>dnSpy / ILSpy</td>\n<td>[x] 近源码</td>\n<td>配置 / 重编译 / hook</td>\n</tr>\n<tr>\n<td>C#（Unity IL2CPP）</td>\n<td>Il2CppDumper + IDA</td>\n<td>[x] 仅签名</td>\n<td>Frida hook</td>\n</tr>\n<tr>\n<td>ActionScript3 / Flash</td>\n<td>JPEXS FFDec</td>\n<td>[x] 反编译</td>\n<td>改源码重编译</td>\n</tr>\n<tr>\n<td>Lua 热更</td>\n<td>unluac / luadec</td>\n<td>[x]</td>\n<td>改 lua</td>\n</tr>\n<tr>\n<td>Java/Kotlin</td>\n<td>jadx</td>\n<td>[x]</td>\n<td>smali patch / hook</td>\n</tr>\n<tr>\n<td>JS / H5</td>\n<td>beautify / sourcemap</td>\n<td>[x]</td>\n<td>改 js</td>\n</tr>\n<tr>\n<td>C++ / UE</td>\n<td>SDK dump</td>\n<td>注意: 结构</td>\n<td>hook / patch</td>\n</tr>\n</tbody>\n</table>\n<p>详见 <code>references/client-languages.md</code>。\n真实项目案例（Go 服务端 + C# 启动器；Node/TS 服务端 + AS3 客户端）见 <code>references/cases.md</code>。</p>\n<h2>服务端语言也不固定</h2>\n<p>Python 只是本仓库的参考实现。真实案例里：<strong>Go</strong>（某 Unity 手游）、<strong>Node/TS</strong>（某 Cocos 手游）。\n选型见 <code>references/codegen.md</code>，由 Spec 决定，不是照抄。</p>\n<h2>充值 / 发放（自托管支付）</h2>\n<ul>\n<li><code>game.pay_grant_mode</code>: <code>direct</code>（直接进背包）/ <code>mail</code>（发邮件领取）</li>\n<li><code>game.pay_auto_success: true</code> → 点击购买直接成功</li>\n<li>商品表 <code>PAY_PRODUCTS</code> 键 = 客户端真实 <code>product_id</code></li>\n</ul>\n<h2>后续拓展（可选，不影响核心运行）</h2>\n<blockquote>\n<p><strong>判断标准</strong>：去掉它，游戏还能不能正常玩？<strong>能 → 就是拓展。</strong></p>\n<p>注意: <strong>内联服务端不是拓展</strong>：它是与「外部服务端」并列的<strong>核心路线</strong>（M11，见 <code>references/inline-server.md</code>），\n不适用本判断标准。</p>\n</blockquote>\n<table>\n<thead>\n<tr>\n<th>拓展</th>\n<th>文件</th>\n<th>一句话</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>服务端人机（假玩家）</td>\n<td><code>extensions/bots.md</code></td>\n<td>多人游戏凑不齐人时用 AI 补位</td>\n</tr>\n<tr>\n<td>反推人机机制</td>\n<td><code>extensions/bot-reverse.md</code></td>\n<td>无参考项时，从客户端反推它的人机实现</td>\n</tr>\n</tbody>\n</table>\n<p><strong>人机为什么是拓展</strong>：单人也能玩的游戏完全不需要；多人游戏缺人只是<strong>体验受损，\n服务端本身能跑</strong>，不影响「本地离线运行 / 登录 / 进游戏」。</p>\n<ul>\n<li>参考骨架：<code>server/app/logic/bots.py</code>（<strong>只是骨架</strong>，默认 <code>auto_fill: 0</code> 不生成假玩家）</li>\n<li>联调：<code>python server/test_bots.py</code></li>\n</ul>\n<blockquote>\n<p>注意: 拓展<strong>不参与</strong>核心验收。没做拓展 ≠ 交付不完整。</p>\n</blockquote>\n<h2>两种服务端模板怎么选</h2>\n<table>\n<thead>\n<tr>\n<th></th>\n<th>templates/mock_server.py</th>\n<th>server/</th>\n</tr>\n</thead>\n<tbody>\n<tr>\n<td>用途</td>\n<td>抓包后快速验证协议结论</td>\n<td>真正部署、长期运营</td>\n</tr>\n<tr>\n<td>规模</td>\n<td>单文件</td>\n<td>分层工程</td>\n</tr>\n<tr>\n<td>能力</td>\n<td>帧收发 + opcode 桩</td>\n<td>数据库/状态机/客户端保护/部署</td>\n</tr>\n<tr>\n<td>何时用</td>\n<td>逆向中期试探</td>\n<td>逆向完成、要跑起来</td>\n</tr>\n</tbody>\n</table>\n<h2>最快上手</h2>\n<pre><code># 1. 起服务端\ncd server &amp;&amp; chmod +x start.sh &amp;&amp; ./start.sh\n\n# 2. 联调自测（另开一个终端）\n./venv/bin/python client_test.py --host 127.0.0.1 --port 8888 \\\n    --user alice --password 123456 --name Hero01\n# 期望输出结尾：[+] full flow OK\n\n# 3. 部署到服务器\nsudo bash server/deploy/deploy.sh\n</code></pre>\n<h2>工作流</h2>\n<pre><code>[只有安装包？] 解包 → 判引擎/语言 → 自产 dump/lua/资源 → 抓包 → 动态dump\n        ↓\n侦察引擎 → 协议分层 → 客户端静态定位 → 字段推断\n        → 服务端建模 → 部署 → 客户端对接 → 闭环验证\n</code></pre>\n<blockquote>\n<p>只有 <code>.apk</code>/<code>.ipa</code>/<code>.exe</code> 也能开始 —— 见 <code>references/from-installer.md</code>。</p>\n</blockquote>\n<h2>给 AI 的使用方式</h2>\n<ol>\n<li>把辅助文件（<code>dump.cs</code> / <code>*.lua</code> / <code>*.usmap</code> / SDK <code>.h</code>）丢进来。</li>\n<li>AI 按 <code>SKILL.md §1</code> 分类，自动进入 Unity 或 UE 分支。</li>\n<li>逆向结论落到 <code>server/app/proto/</code>（消息号 + 结构）与 <code>config.yaml</code>（协议参数）。</li>\n<li>起点验证用 <code>templates/mock_server.py</code>，终点交付用 <code>server/</code>。</li>\n</ol>\n","files":[{"path":"examples/A-unity-il2cpp-protobuf.md","sizeBytes":3634,"isText":true},{"path":"examples/B-ue-kcp-custom.md","sizeBytes":3421,"isText":true},{"path":"examples/C-unity-lua-http.md","sizeBytes":2945,"isText":true},{"path":"examples/D-real-lua-client.md","sizeBytes":8533,"isText":true},{"path":"examples/E-cocos2dx-http-js.md","sizeBytes":10493,"isText":true},{"path":"examples/README.md","sizeBytes":1368,"isText":true},{"path":"extensions/bot-reverse.md","sizeBytes":9092,"isText":true},{"path":"extensions/bots.md","sizeBytes":8705,"isText":true},{"path":"extensions/README.md","sizeBytes":2316,"isText":true},{"path":"README.md","sizeBytes":21403,"isText":true},{"path":"references/account.md","sizeBytes":4436,"isText":true},{"path":"references/adaptation.md","sizeBytes":5657,"isText":true},{"path":"references/ai-contract.md","sizeBytes":3087,"isText":true},{"path":"references/case-il2cpp-ecdh.md","sizeBytes":6593,"isText":true},{"path":"references/case-il2cpp-inline.md","sizeBytes":4446,"isText":true},{"path":"references/cases.md","sizeBytes":5259,"isText":true},{"path":"references/client-address-sources.md","sizeBytes":17947,"isText":true},{"path":"references/client-languages.md","sizeBytes":6486,"isText":true},{"path":"references/closure-verification.md","sizeBytes":11866,"isText":true},{"path":"references/cocos2d.md","sizeBytes":15644,"isText":true},{"path":"references/codegen.md","sizeBytes":4972,"isText":true},{"path":"references/combat.md","sizeBytes":3864,"isText":true},{"path":"references/decision-tree.md","sizeBytes":10228,"isText":true},{"path":"references/drops.md","sizeBytes":3140,"isText":true},{"path":"references/engineering-practices.md","sizeBytes":16271,"isText":true},{"path":"references/from-installer.md","sizeBytes":10991,"isText":true},{"path":"references/gacha.md","sizeBytes":5504,"isText":true},{"path":"references/inline-server.md","sizeBytes":11131,"isText":true},{"path":"references/live-ops.md","sizeBytes":6834,"isText":true},{"path":"references/methods.md","sizeBytes":11726,"isText":true},{"path":"references/phases-detail.md","sizeBytes":10418,"isText":true},{"path":"references/platform-sdk-and-admission.md","sizeBytes":4950,"isText":true},{"path":"references/primer.md","sizeBytes":11085,"isText":true},{"path":"references/protocol-spec.md","sizeBytes":7883,"isText":true},{"path":"references/reading-path.md","sizeBytes":9014,"isText":true},{"path":"references/release-and-ops.md","sizeBytes":12111,"isText":true},{"path":"references/repack-rename.md","sizeBytes":8142,"isText":true},{"path":"references/runtime-object-synthesis.md","sizeBytes":5370,"isText":true},{"path":"references/server-architecture-basics.md","sizeBytes":10154,"isText":true},{"path":"references/termux.md","sizeBytes":4137,"isText":true},{"path":"references/unity.md","sizeBytes":2469,"isText":true},{"path":"references/unreal.md","sizeBytes":2204,"isText":true},{"path":"references/usage-policy.md","sizeBytes":3518,"isText":true},{"path":"references/verification-and-status.md","sizeBytes":8650,"isText":true},{"path":"references/windows.md","sizeBytes":9363,"isText":true},{"path":"references/wire-level-patching.md","sizeBytes":13396,"isText":true},{"path":"references/workflow-roadmap.md","sizeBytes":12631,"isText":true},{"path":"schema/project-profile.yaml","sizeBytes":2845,"isText":true},{"path":"schema/protocol.spec.yaml","sizeBytes":5592,"isText":true},{"path":"server/app/config.py","sizeBytes":3265,"isText":true},{"path":"server/app/__init__.py","sizeBytes":35,"isText":true},{"path":"server/app/logic/bots.py","sizeBytes":7948,"isText":true},{"path":"server/app/logic/handlers/auth.py","sizeBytes":4275,"isText":true},{"path":"server/app/logic/handlers/battle.py","sizeBytes":3293,"isText":true},{"path":"server/app/logic/handlers/char.py","sizeBytes":3636,"isText":true},{"path":"server/app/logic/handlers/drop.py","sizeBytes":1988,"isText":true},{"path":"server/app/logic/handlers/__init__.py","sizeBytes":313,"isText":true},{"path":"server/app/logic/handlers/mail.py","sizeBytes":5267,"isText":true},{"path":"server/app/logic/handlers/pay.py","sizeBytes":5066,"isText":true},{"path":"server/app/logic/handlers/room.py","sizeBytes":4518,"isText":true},{"path":"server/app/logic/handlers/scene.py","sizeBytes":3095,"isText":true},{"path":"server/app/logic/__init__.py","sizeBytes":15,"isText":true},{"path":"server/app/logic/loot.py","sizeBytes":3468,"isText":true},{"path":"server/app/logic/rooms.py","sizeBytes":7573,"isText":true},{"path":"server/app/logic/security.py","sizeBytes":2116,"isText":true},{"path":"server/app/logic/state.py","sizeBytes":1093,"isText":true},{"path":"server/app/log.py","sizeBytes":919,"isText":true},{"path":"server/app/main.py","sizeBytes":1898,"isText":true},{"path":"server/app/net/codec.py","sizeBytes":6667,"isText":true},{"path":"server/app/net/crypto.py","sizeBytes":3946,"isText":true},{"path":"server/app/net/dispatcher.py","sizeBytes":1532,"isText":true},{"path":"server/app/net/__init__.py","sizeBytes":14,"isText":true},{"path":"server/app/net/server.py","sizeBytes":6078,"isText":true},{"path":"server/app/net/session.py","sizeBytes":2276,"isText":true},{"path":"server/app/proto/__init__.py","sizeBytes":15,"isText":true},{"path":"server/app/proto/messages.py","sizeBytes":9998,"isText":true},{"path":"server/app/proto/opcodes.py","sizeBytes":3678,"isText":true},{"path":"server/app/store/db.py","sizeBytes":8309,"isText":true},{"path":"server/app/store/__init__.py","sizeBytes":15,"isText":true},{"path":"server/app/store/models.py","sizeBytes":4591,"isText":true},{"path":"server/client_test.py","sizeBytes":4908,"isText":true},{"path":"server/config/config.yaml","sizeBytes":3235,"isText":true},{"path":"server/deploy/deploy.sh","sizeBytes":1456,"isText":true},{"path":"server/deploy/docker-compose.yml","sizeBytes":1198,"isText":true},{"path":"server/deploy/Dockerfile","sizeBytes":448,"isText":false},{"path":"server/deploy/gsrv.service","sizeBytes":593,"isText":false},{"path":"server/deploy/install_windows_service.bat","sizeBytes":842,"isText":false},{"path":"server/deploy/start_windows.bat","sizeBytes":450,"isText":false},{"path":"server/README.md","sizeBytes":5172,"isText":true},{"path":"server/requirements.txt","sizeBytes":271,"isText":true},{"path":"server/start.sh","sizeBytes":354,"isText":true},{"path":"server/start_termux.sh","sizeBytes":1010,"isText":true},{"path":"server/test_battle.py","sizeBytes":5707,"isText":true},{"path":"server/test_pay_mail.py","sizeBytes":4492,"isText":true},{"path":"SKILL.md","sizeBytes":30234,"isText":true},{"path":"templates/adr-template.md","sizeBytes":2839,"isText":true},{"path":"templates/AGENTS.md","sizeBytes":5386,"isText":true},{"path":"templates/e2e-evidence-template.md","sizeBytes":4270,"isText":true},{"path":"templates/frida_bypass_ssl.js","sizeBytes":2611,"isText":true},{"path":"templates/frida-redirect.js","sizeBytes":3454,"isText":true},{"path":"templates/function-checklist.md","sizeBytes":3554,"isText":true},{"path":"templates/kcp_sniff.py","sizeBytes":1795,"isText":true},{"path":"templates/login-chain.md","sizeBytes":3704,"isText":true},{"path":"templates/mock_server.py","sizeBytes":3759,"isText":true},{"path":"templates/README.md","sizeBytes":4554,"isText":true},{"path":"templates/register-site/index.html","sizeBytes":16142,"isText":false},{"path":"templates/register-site/README.md","sizeBytes":2626,"isText":true},{"path":"templates/register-site/server.py","sizeBytes":6349,"isText":true},{"path":"templates/status-matrix.md","sizeBytes":3094,"isText":true},{"path":"templates/xposed-redirect/AndroidManifest.xml","sizeBytes":583,"isText":false},{"path":"templates/xposed-redirect/build.gradle","sizeBytes":302,"isText":false},{"path":"templates/xposed-redirect/MainHook.java","sizeBytes":4712,"isText":false},{"path":"templates/xposed-redirect/README.md","sizeBytes":2712,"isText":true},{"path":"templates/xposed-redirect/redirect_config.txt","sizeBytes":129,"isText":true},{"path":"templates/xposed-redirect/xposed_init","sizeBytes":26,"isText":false},{"path":"tools/extract_interfaces.py","sizeBytes":5535,"isText":true},{"path":"tools/repack_zip.py","sizeBytes":4998,"isText":true},{"path":"TRACKER.md","sizeBytes":10651,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-09-24T15:42:32.378708Z","sha256":"A1AFC0A740E848B49C42EDBEF1169BF200B47DE994019D9790CF11C0B3FC0C27","sizeBytes":336215},"review":null,"source":{"repositoryUrl":"https://github.com/ShrugYu/game-client-to-server-reverse","path":"game-client-to-server-reverse","license":"AGPL-3.0","commit":"65c7a74ac6c70ec125ec49c6f26b1dffe115467c","subtreeSha":"89F68C7BC17CF1B5598E8F9E8FEEA28CACF706A0F1AC14AB3CD868F59E154348","lastSyncedAt":"2026-09-24T15:42:19.347575Z"},"reviewedAt":"2026-09-24T15:42:58.851074Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/ShrugYu/game-client-to-server-reverse/tree/main/game-client-to-server-reverse"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install shrugyu-game-client-to-server-reverse@llmmart"},{"target":"git","command":"git clone https://github.com/ShrugYu/game-client-to-server-reverse.git"}]}