7f78fd5104
audit findings #8/#11. the encoded deploy field (LogicCharacter field47) is the REMAINING deploy time: the client seeds it with DeployTime in setState(5) and LogicCharacter::tick counts it down by 50 each tick, returning early from the whole tick - no move, no retarget, no attack - until it reaches 0, then setDefaultState flips the unit to moving(1) or idle(0). our advance_deploy counted the opposite way (elapsed, 0 up to DeployTime), so the encoded timer was DeployTime-minus-the-client's every tick of every deploy, and the troop also moved and fought a full second early. now: a summoned troop spawns in state 5 with deploy_timer = DeployTime, the timer decrements to 0, is_deploying() gates retarget/move/attack while it is positive, and the state flips to moving/idle when it lands. towers have DeployTime 0 and are unaffected. harness: one tick in, the timer has dropped by 50 and the troop has not moved; after the window it is at 0 and moving. |
||
|---|---|---|
| assets | ||
| config | ||
| crates | ||
| .gitignore | ||
| Cargo.lock | ||
| Cargo.toml | ||
| LICENSE | ||
| README.md | ||
scroll-server
A server for the scroll client (Clash Royale 2.0.1306, iOS). Takes a real
client from TCP connect to the lobby: login, own home data, chests, card
upgrades, the shop.
Requirements
- Rust 1.75+
- PostgreSQL 16
Running
createdb scroll
cargo run --release -p scroll-server
Listens on 0.0.0.0:9339, the port the client hardcodes. The schema is created
on first boot. DATABASE_URL defaults to postgres:///scroll.
On macOS a Homebrew cluster may need LC_ALL=C to start at all.
That runs everything in one process. For real isolation, SCROLL_MODE=supervised
makes it spawn the three services as child processes and restart any that dies,
with backoff:
SCROLL_MODE=supervised ./target/release/scroll-server
They can also be started by hand, in any order:
cargo run --release -p auth-service
cargo run --release -p game-service
cargo run --release -p gateway
Checking it without a phone
scroll-probe speaks the same protocol and prints the decoded lobby:
cargo run --release -p gateway --bin scroll-probe -- 127.0.0.1:9339
Flags: --claim-free-chest, --buy-chest <name>, --desync. Pass an account
and pass token to reconnect as an existing player:
scroll-probe 127.0.0.1:9339 0 1 <passtoken>.
Pointing a client at it
The client hardcodes game.clashroyaleapp.com. Patch that string in the binary
inside the ipa to your machine's address, keeping the 23 byte slot NUL padded so
nothing around it moves.
Configuration
| variable | default |
|---|---|
DATABASE_URL |
postgres:///scroll |
SCROLL_MODE |
single, or supervised |
SCROLL_BIN_DIR |
next to the running binary |
SCROLL_AUTH_LISTEN |
127.0.0.1:9401 |
SCROLL_GAME_LISTEN |
127.0.0.1:9402 |
SCROLL_GATEWAY_LISTEN |
0.0.0.0:9339 |
SCROLL_CSV_ROOT |
assets |
SCROLL_SHOP |
config/shop.json |
SCROLL_STARTER_PROFILE |
built in |
RUST_LOG |
info |
Shop
config/shop.json lists what the server sells, as Name#count:
{
"offers": [
{ "id": 1, "give": "Gold#1000" },
{ "id": 5, "give": "chest:Gold#1" },
{ "id": 7, "give": "Diamonds#500", "cost": "Gold#20000" }
]
}
Names resolve against the csv tables. cost is optional; without it the server
charges the same price the client computes from the game data.