Whiteout Survival — API & Protocol Investigation Report V2

1. Verified Player Data Extraction

Using the new wos_player_lookup.py tool, we can now extract real player data from PCAP captures. Below is the verified output for player "Pano":

Usage Example

# Search for a specific player by ID
python3 wos_player_lookup.py --pcap capture.pcap --pid 288979040

# List all players found in capture
python3 wos_player_lookup.py --pcap capture.pcap --list

# Get JSON output
python3 wos_player_lookup.py --pcap capture.pcap --pid 288979040 --json

# Live server connection (requires session token)
python3 wos_player_lookup.py --token "YOUR_TOKEN" --pid 77754601

2. Power Leaderboard Correlation

Cross-referencing the live power leaderboard screenshot with PCAP binary data confirms our extraction methodology:

3. Sproto Binary Protocol (TCP:30101)

3.1 Confirmed Player Profile Structure

The player profile in sproto type 0x5502 messages follows this binary layout in the packed stream:

[04 1f] [Player Name]    - 04=field tag, 1f=string marker
[04 04 1f] [Power LE4]   - 04 04=field tags, 1f=value marker, 4-byte LE power
[f1 04] [Kingdom LE4]    - f1 04=kingdom tag, LE4 kingdom composite ID
[f1 03] [Alliance Abbr]  - f1 03=alliance tag, 2-5 uppercase ASCII
[0d f8] [Alliance Full]  - full alliance name with sproto packing
[71 02] [Language]        - 2-char language code
[04 7c] [Player ID LE4]  - 04 7c=PID tag, 4-byte LE player ID
[20 fc] [Avatar Path]    - avatar URL path on CDN

3.2 Binary Verification: Pano's Profile

Hex dump of Pano's profile in the raw sproto S->C stream:

58842: 11 0b 04 1f 50 61 6e 6f          - "Pano" (04 1f prefix)
58850: 04 1f 1f 18 4e 04 04 1f
58858: 9d db 6b 2d                       - Power: 762,043,293 (LE4)
58862: 28 01 03 f1 04 ed 64 a0 77        - Kingdom: 2,007,000,301
58871: f1 03 50 4f 4c                    - "POL" alliance
58876: 0d f8 50 6f 6c 73 6b ff 00 61 48 75 73 61 72 69 61  - "PolskaHusaria"
58889: 71 02 70 6c                       - "pl" language
58893: 04 7c 60 78 39 11                 - Player ID: 288,979,040 (LE4)
58899: 20 fc 32 30 32 36...              - Avatar: /2026/04/15/lVMJMM_1776289540.png

3.3 Algorithm for Player Data Extraction

The extraction algorithm uses validated sproto tag patterns:

1. Find alliance tag f1 03 [ALLIANCE] in the raw S->C stream
2. Search BACKWARDS from alliance for power value: 1f [LE4 power] within 60 bytes
3. Search BACKWARDS from power for player name: 04 1f [NAME] within 60 bytes
4. Search FORWARD from alliance for kingdom: f1 04 [LE4 kingdom]
5. Search FORWARD from alliance for PID: 04 7c [LE4 pid] or direct LE4 search
6. Extract language code (2 lowercase chars) and avatar path

4. Network Architecture

4.1 Server Infrastructure

4.2 Connection Flow

1. App Launch
   -> platform-config-prod.centurygame.com (server list)
   -> passport-apa.centurygame.com (authenticate)
   -> gof-login-formal-ga.centurygame.com (session token)

2. Game Session
   -> TCP :30101 (sproto - ALL game data INCLUDING POWER)
   -> TCP :13321 (FPNN chat - VIP, alliance, kingdom)

3. Background
   -> logagent-rum.centurygame.com (analytics)
   -> gof-formal-avatar.akamaized.net (avatars)

5. Chat Protocol (FPNN over TCP:13321)

5.1 Chat Message Player Data

Chat messages contain JSON payloads with player metadata - the easiest way to get VIP, kingdom, and alliance info:

{
  "nickName": "Mr. Lonely",
  "vip": 9,
  "show_vip": 1,
  "kid": 2007,
  "abbr": "ONE",
  "uid": 78773088,
  "rank": 3,
  "torank": 1,
  "point": {"x": 770, "y": 698}
}

5.2 Fields Available from Chat

6. Player Data Fields Summary

7. Security Observations

Anti-Cheat Measures

• Device fingerprinting (registering-device-apa.centurygames.net)
• NetEase IR SDK (behavioral analysis)
• Network protection (libNetHTProtect.so 4.5MB)
• Encrypted IL2CPP metadata (HTPX format)
• Encrypted Lua scripts (40MB+ bundles)
• Code signing (libsigner.so)
• Hook detection (libhtpcrash.so)

8. How to Get Player Data

Method 1: PCAP Analysis (Most Reliable)

1. Install PCAPdroid on Android
2. Start capture -> Open WOS -> Navigate to Power Leaderboard
3. Stop capture -> Export PCAP
4. Run: python3 wos_player_lookup.py --pcap capture.pcap --pid PLAYER_ID

Method 2: Live Server (Requires Token)

1. Capture HTTPS login to get session token
2. Run: python3 wos_player_lookup.py --token TOKEN --pid PLAYER_ID

Method 3: Chat Server (VIP/Kingdom Only - No Power)

Listen to chat messages for vip, kid, abbr fields. Power is NOT available via chat.

9. Credentials & Keys

10. File Inventory

11. Recommendations

1. Extended PCAP capture - Capture while viewing leaderboard, alliance info, VIP benefits, and kingdom map
2. Runtime Frida hooking - Hook sproto_decode() and luaL_loadbuffer() to extract schemas
3. IL2CPP decryption - Hook HTProtect decryption on rooted device to get class/method names
4. Test GitLab token - glpat-ni86rqoefyhoTkMsNYiR may access source code with protocol schemas