does android apk contain game mechanics?

Question

Let's say I have an apk of an android fighting game. The mechanics of the game includes how characters use their skills, how the damages are calculated, etc. Are such mechanics stored within the apk? Or perhaps on the server-side? Thanks in advance.

Answer 1

Short answer

Single player games most frequently do contain all the information hard coded in the APK. Multiplayer games usually require more work such as packet analysis and more black box work but may contain some of the mechanics hard-coded.

---

Generally

It depends on the app, usually, most single player games don't require any online verifications other than in-app purchases and such. Multiplayer game producers are less likely to reveal the mechanics behind the game, and try to depend as much as possible on server side verifications. Especially in games where PvP is present, thus even the pseudo random number generator used to calculate hits may be black boxed from the user to prevent any misuse/exploitation of the game mechanics.

However, since performance over different connection strength is important, sacrifices could be necessary for maintaining sensible gameplay experience and as a consequence some game mechanics remain hard-coded in the APK to improve performance and reduce the load on the server (and may be encrypted and verified by server-side upon game load). for example, instead of requesting the server to update player location on every input, a request is being made periodically to sync the server and client copy of the location which means that the core movement and physics mechanics must be stored on the client side.

In order to understand the mechanics of a single player game without any kind of online verifications and little to no interactions with a server-side. Simple decompilation (or disassembly in case of obfuscation and NDK usage for example) would provide all the information required to understand all the game mechanics.

On multiplayer games usually you need to resort to more through research which may include:

• packet analysis - Observing interactions with the server are very useful and reveal a lot of useful information. But note that this information could be frequently black boxed, such as a request which contains a string similar to hit target_object and the response may be just the same packet with a concatination of a number.

• local data observation - Another technique is to observe and analyse downloaded data from the server which might help revealing game mechanics (xp rate multipliers from items, additional hidden stats for items etc..) sometimes you might find yourself trying to unencrypt encrypted data which was downloaded and is verified each time a connection is made in hope to reveal some information on mechanics by observing the requests and responses.

Debugging online games can sometimes be difficult due to crashes and disconnections from the server which may be the cause of getting out of sync and tgus observing the memory isn't very practical in the more intense online games which sync every couple of milliseconds with the server.

In short, it largely depends on how the game is constructed and on the nature of the client-server interactions.