White Out Survival — API Investigation Report

{
  "fid": 250893802,
  "nickname": "FADL2",
  "kid": 2007,
  "stove_lv": 31,
  "stove_lv_content": 30,
  "avatar_image": "https://gof-formal-avatar.akamaized.net/avatar/2026/04/18/nmAP54_1776551552.png",
  "total_recharge_amount": 0
}

POST https://wos-giftcode-api.centurygame.com/api/player

Auth: MD5 sign with secret "tB87#kPtkxqOS2"
Sign = MD5("fid={fid}&time={ts}tB87#kPtkxqOS2")

Body (form-data):
  fid: 250893802
  time: {timestamp_ms}
  sign: {md5_hash}

Returns: fid, nickname, kid, stove_lv, stove_lv_content, avatar_image, total_recharge_amount

POST https://wos-giftcode-api.centurygame.com/api/gift_code_config

Returns: Banner configuration for the gift code web portal

GET https://platform-config-prod.centurygame.com/config.json

No auth required
Returns: FPCS hosts, acc regions, CDN hosts, source UUID

Key data:
  - fpcs hosts (3 endpoints)
  - acc regions (default: APA, US/AU/JP/KR/TW: GA)
  - cs_cdn_host (3 CDN mirrors)
  - age_compliance host

GET https://fpcs-prod-apa.centurygame.com/api/location

No auth required
Returns: { country_code, ip, cmp_region }

POST https://gof-report-api-formal.centurygame.com/api/web_notice

Returns: In-game notice/announcement data

POST https://fpcs-prod-apa.centurygame.com/api/config

Requires: game_id (20121), version, platform
Issue: Version validation currently fails (server-side mapping issue)
The server does not recognize the v1.31.20 version string,
likely requires a specific version code mapping that differs
from the APK version_code (269).

-- power_rank type
.power_rank {
  id          0
  abbr        2
  gflag       3
  __bg        4
  leader      5
  uid         6
  language    8
  power_rank  9
}

-- soldier_map type
.soldier_map {
  soldier_map 7 : *battle_(id)(quality)
}

-- finish_ts field
.finish_ts 4 : integer(0)

-- vcount field
.vcount 5

-- expert_info type
.expert_info {
  -- includes effect_source field
}

-- powerFight field (found in UI context with formatnumberthousands)

Algorithm: MD5 hash
Formula: MD5(sorted_query_params + secret)
Secret:  "tB87#kPtkxqOS2"

Example:
  params: fid=250893802, time=1700000000000
  string: "fid=250893802&time=1700000000000tB87#kPtkxqOS2"
  sign:   MD5(above) = <32-char hex>

Algorithm: MD5 hash with prefix
Formula: MD5("UxXkyv4g9nmvK8gP:" + timestamp_ms)

Used for: platform-config-prod.centurygame.com requests

Algorithm: AES-192
Key:       Jm93LUl9xqWd/1Ar+7QXeApCZw==  (Base64, 24 bytes)
Transport: WebSocket (binary frames)
Encoding:  sproto binary (pack/unpack)
Flow:      App ↔ FPCS Gateway ↔ Game Server

Packet structure:
  [AES-192 encrypted payload]
    → decrypt
    → sproto_unpack
    → decoded protocol message

import hashlib
import time
import requests

def lookup_player(fid):
    """Look up a White Out Survival player by their FID."""
    ts = str(int(time.time() * 1000))
    secret = 'tB87#kPtkxqOS2'

    # Compute MD5 signature
    sign_str = f'fid={fid}&time={ts}{secret}'
    sign = hashlib.md5(sign_str.encode()).hexdigest()

    # Make the request
    resp = requests.post(
        'https://wos-giftcode-api.centurygame.com/api/player',
        data={
            'fid': str(fid),
            'time': ts,
            'sign': sign,
        },
        headers={
            'User-Agent': 'Mozilla/5.0 (Linux; Android 14) Chrome/125.0.0.0',
            'Origin': 'https://wos-giftcode.centurygame.com',
            'Referer': 'https://wos-giftcode.centurygame.com/',
        },
    )
    return resp.json()


# --- Test ---
result = lookup_player(250893802)
print(result)
# Expected output:
# {
#   "code": 0,
#   "data": {
#     "fid": 250893802,
#     "nickname": "FADL2",
#     "kid": 2007,
#     "stove_lv": 31,
#     "stove_lv_content": 30,
#     "avatar_image": "https://gof-formal-avatar.akamaized.net/...",
#     "total_recharge_amount": 0
#   }
# }

def decode_furnace_level(stove_lv):
    """Convert numeric stove_lv to human-readable furnace level."""
    if stove_lv <= 30:
        return f"Level {stove_lv}"

    fc_map = {35: "FC1", 40: "FC2", 45: "FC3", 50: "FC4", 55: "FC5", 60: "FC6", 65: "FC7"}

    # FC milestone levels
    if stove_lv in fc_map:
        return fc_map[stove_lv]

    # Find which FC tier this falls into
    milestones = sorted(fc_map.keys(), reverse=True)
    for ms in milestones:
        if stove_lv > ms:
            offset = stove_lv - ms
            tier_num = ms // 5 - 6  # FC1=1, FC2=2, etc.
            return f"FC{tier_num}-{offset}"

    # Between 30 and FC1 (31-34)
    if 31 <= stove_lv <= 34:
        return f"30-{stove_lv - 30}"

    return f"Unknown ({stove_lv})"


# Examples:
print(decode_furnace_level(31))   # "30-1"
print(decode_furnace_level(35))   # "FC1"
print(decode_furnace_level(37))   # "FC1-2"
print(decode_furnace_level(50))   # "FC4"
print(decode_furnace_level(65))   # "FC7"

# Fetch platform config (no auth needed)
curl -s https://platform-config-prod.centurygame.com/config.json | python -m json.tool

# GeoIP lookup
curl -s https://fpcs-prod-apa.centurygame.com/api/location | python -m json.tool

# Player lookup with signature
FID=250893802
TS=$(date +%s%3N)
SIGN=$(echo -n "fid=${FID}&time=${TS}tB87#kPtkxqOS2" | md5sum | cut -d' ' -f1)

curl -s -X POST https://wos-giftcode-api.centurygame.com/api/player \
  -d "fid=${FID}&time=${TS}&sign=${SIGN}" \
  -H "Origin: https://wos-giftcode.centurygame.com" \
  -H "Referer: https://wos-giftcode.centurygame.com/" | python -m json.tool