got-re/
├── README.md                   ← this file
├── FLOW.md                     ← complete discovered data flow
├── SETUP.md                    ← environment setup guide
├── TOOLS_AND_COMMANDS.md       ← all commands and tools reference
├── CLAUDE.md                   ← context for AI-assisted sessions
├── captures/
│   ├── battle.pcap             ← gateway traffic sample (session 1)
│   └── battle2.pcap            ← gateway traffic sample (session 2, richer)
└── scripts/
    ├── frida/
    │   ├── certval_hook.js     ← observe BestHTTP certificate validation
    │   ├── button_hook.js      ← hook Unity UI button events
    │   ├── ssl_unpin.js        ← SSL unpinning (Java + IL2CPP layers)
    │   └── nesec_bypass.js     ← neutralize libnesec anti-tampering
    ├── analysis/
    │   ├── analyze_gateway.py  ← parse and decode port 30101 pcap captures
    │   ├── analyze_mitm.py     ← read and filter mitmproxy .mitm files
    │   ├── decode_1d_v2.py     ← deep decode of 0x1d state-sync frames
    │   └── deep_analysis.py    ← coordinates, JSON fragments, opcode 0x59
    └── proxy/
        ├── mitm_setup.py       ← install mitmproxy CA on device
        ├── run_ssl_unpin.py    ← mitmdump + Frida SSL unpin combined runner
        └── run_button_hook.py  ← mitmdump + Frida button hook combined runner

# 1. Start frida-server on device
adb shell "su -c '/data/local/tmp/fs17 -l 0.0.0.0:37555 &'"
adb forward tcp:37555 tcp:37555

# 2. Capture gateway traffic
adb shell "su -c 'tcpdump -i any -w /sdcard/session.pcap port 30101'"
# ... play the game ...
adb pull /sdcard/session.pcap captures/

# 3. Analyze it
python scripts/analysis/analyze_gateway.py captures/session.pcap