ClashFarmer v2.4 RC18 — Technical Analysis Report

Disclaimer: This document is a technical analysis for educational and research purposes only.
All trademarks, product names, and assets mentioned belong to their respective owners (ClashFarmer.com / Supercell).
No proprietary binaries, assets, or extracted files are included in this repository.

---

1. File Overview

Attribute	Value
Original Filename	ClashFarmer_24_RC18__Installer_f52029.exe
File Type	PE32 executable (GUI) Intel 80386
Packaging	Nullsoft Installer (NSIS v3.09) — Self-extracting archive
File Size	~58.9 MB (58,999,785 bytes)

---

2. Installer Structure (NSIS)

The executable is a Nullsoft Scriptable Install System (NSIS) self-extracting archive. Silent extraction is possible via:

ClashFarmer_Installer.exe /S /D="C:\Output\Path"

Post-Extraction Layout

extracted/
├── ClashFarmer.exe              # Main entry point (PyInstaller one-file)
├── python310.dll                # Python 3.10 runtime
├── python3.dll
├── base_library.zip             # Compiled Python stdlib (.pyc files)
├── config.db                    # SQLite database (bot configuration)
├── pyarmor_runtime_000000/      # PyArmor obfuscation runtime
│   └── pyarmor_runtime.pyd      # PyArmor C extension
├── images/                      # Computer vision template library
│   ├── buttons/
│   ├── armyCampTroops/
│   ├── barracksTroops/
│   ├── battleTroops/
│   ├── buildingFont/
│   ├── deadBaseIndicators/
│   ├── donationTroops/
│   ├── indicators/
│   ├── lootCart/
│   ├── walls/
│   └── ...
├── PyQt6/                       # Qt6 bindings for Python GUI
├── cv2/                         # OpenCV computer vision
├── numpy/                       # Numerical computing
├── PIL/                         # Image processing (Pillow)
├── cryptography/                # Crypto libraries
├── M2Crypto/                    # OpenSSL wrapper
├── Crypto/                      # PyCryptodome
├── tcl/, tk/                    # Tcl/Tk for GUI elements
└── ... (Windows DLLs, .pyd extensions)

---

3. Runtime & Technology Stack

Layer	Technology	Version / Detail
Language	Python	3.10
GUI Framework	PyQt6	Qt6 bindings
Image Recognition	OpenCV (cv2)	Template matching
Image Processing	Pillow (PIL)	Template preprocessing
Math/Arrays	NumPy	Array operations for CV
Bundling	PyInstaller	2.1+ (one-file mode)
Obfuscation	PyArmor	Modern (observed: PY000000 header signature)
Installer	NSIS	v3.09
Emulator Interface	libusb-1.0.dll	Likely for BlueStacks USB/adb bridge
Scheduling	APScheduler	3.10.4 (observed in dist-info)
Timezones	pytz / tzdata / tzlocal	For bot scheduling logic

---

4. Main Executable Analysis

4.1 PyInstaller Archive

ClashFarmer.exe is a PyInstaller one-file executable containing an embedded CArchive.

Archive Signatures Detected:

Signature	Offset	Description
_MEIPASS2	175,920	PyInstaller temp folder env var
PyInstaller archive	175,980	CArchive header string
PYZ\x00	336,371	Python Zlib archive (compiled modules)
PYZ-00.pyz	7,089,037	PYZ entry in CArchive TOC
PY000000	311,792	PyArmor payload signature

Extraction Stats:

• CArchive entries: 18 files (bootloaders, runtime hooks, entry point)
• PYZ archive entries: 1,341 compiled Python modules
• Entry point module: qt_gui.pyc

4.2 Entry Point — qt_gui.pyc

The decompiled entry point is a PyArmor loader stub, not actual application logic:

# Reconstructed from bytecode analysis
from pyarmor_runtime_000000 import __pyarmor__
__pyarmor__(__name__, __file__, b'PY000000\x00\x03\n\x00...')

Key Observations:

• The .pyc file contains a minimal wrapper (28 bytes of bytecode)
• Real application logic is encrypted/obfuscated inside the PyArmor payload
• The payload is decrypted at runtime by pyarmor_runtime.pyd
• This is consistent with PyArmor modern mode (v7.x or v8.x)

4.3 PyArmor Runtime

Attribute	Detail
Runtime File	pyarmor_runtime_000000/pyarmor_runtime.pyd
Size	~634 KB (634,368 bytes)
Type	Python C extension (CPython 3.10, amd64)
Function	Decrypts and executes obfuscated Python bytecode at runtime
Protection Level	High — modern PyArmor uses dynamic code generation + C-extension binding

Deobfuscation Feasibility:

• ❌ Static extraction of source code: Not feasible with current public tools
• ⚠️ Dynamic analysis (memory dump): Theoretically possible but requires advanced reverse engineering
• ⚠️ PyArmor version detection: Inconclusive without runtime hooking; payload structure suggests v7+ or v8

---

5. Configuration Analysis — config.db

5.1 Database Schema

Column	Type	Purpose
id	INTEGER	Row identifier
key_type	INTEGER	Category / namespace of config
key	BLOB	Pickle-serialized config key
value	BLOB	Pickle-serialized config value

5.2 Observed Configuration Keys (Row 1, key_type=0)

The bot stores its entire configuration as a single pickled Python dict. Observed keys include:

Config Key	Sample Value	Purpose
save_atleast_gold	"1000000"	Minimum gold to keep
minimum_elixir	"100000"	Minimum elixir threshold
troop_deploy_speed	"7"	Attack deployment speed
wave_deploy_speed	"8"	Wave deployment speed
hero_activation_method	"time"	Hero activation trigger
barracks_1_troop	"Archer"	Troop trained in barracks 1
find_deadbases	1	Enable dead base search
maximum_townhall_search	"10"	Max TH level to attack
collect-gold	"1"	Auto-collect gold
enable_telegram	"0"	Telegram notifications
use_king	1	Use Barbarian King
use_queen	1	Use Archer Queen

5.3 Config Data Format

Both keys and values are serialized using Python's pickle protocol.

---

6. Computer Vision Template Library

The images/ directory contains the bot's "eyes" — template images used for OpenCV matchTemplate() operations.

6.1 Template Categories

Folder	Purpose	Detection Method
buttons/	UI buttons (Attack, Next, End Battle, etc.)	Template matching
armyCampTroops/	Troop icons in army camp	OCR / template matching
barracksTroops/	Troop training icons	Template matching
battleTroops/	Deployable troops during battle	Template matching
buildingFont/	Building level numbers	OCR
lootScreenFont/	Resource digits on loot screen	OCR
deadBaseIndicators/	Signs of inactive bases	Template matching
walls/	Wall segment templates	Template matching
THs/	Town Hall levels	Template matching

---

7. Network & Communication

Observed libraries that suggest external communication capabilities:

Library	Purpose
cryptography	HTTPS/TLS encryption
M2Crypto	Additional SSL/OpenSSL bindings
requests	HTTP client
_ssl.pyd, libssl-1_1.dll	OpenSSL runtime

Telegram Bot Integration: Config keys exist for telegram_token_key.

Pushbullet Integration: Config keys exist for pushbullet_api_key.

---

8. Anti-Detection Measures

Technique	Evidence
Image-based automation	Uses OpenCV template matching instead of memory injection
Human-like delays	Configurable troop_deploy_speed, wave_deploy_speed
Randomization	wave_delay and multiple zoom detection templates
Background mode	References to BlueStacks minimization; PyQt6 GUI can run detached
PyArmor obfuscation	Protects bot logic from static analysis
Scheduled timeouts	bot_timeout_at_* configs allow human-like offline periods

---

9. Reverse Engineering Difficulty Assessment

Objective	Difficulty	Notes
Extract installer contents	✅ Easy	NSIS silent install works
Identify tech stack	✅ Easy	Standard tools
Modify config parameters	🟡 Medium	Requires SQLite + pickle knowledge
Replace template images	🟡 Medium	Must match exact resolution/format
Extract source code	🔴 Very Hard	PyArmor modern blocks static extraction
Add new logic/features	🔴 Nearly Impossible	Requires source code or full rewrite

---

10. Open-Source Bot Landscape

Comparative Feature Matrix

Feature	ClashFarmer	ClAsHbOt	MBR	pyAutoYoloCOC	coc-attack-bot
Language	Python	AutoIt	AutoIt	Python	Python
CV Method	Template Matching	Template Matching	Pixel/OCR	YOLOv11	Coordinate-based
Background Mode	✅	✅	✅	❓	❌
Auto Train	✅	✅	✅	✅	❌
Auto Attack	✅	✅	✅	✅	✅
Dead Base Filter	✅	✅	✅	❓	❌
Donation	✅ Configurable	✅	✅	❌	❌
Hero Ability	✅ Time-based	✅	✅	❌	❌
Anti-Detection	✅ PyArmor + delays	✅	✅	❓	❌
Active Maintenance	✅ Commercial	❌ 2016	✅ 2025	🟡 2024	🟡 2025
Open Source	❌ Obfuscated	✅	✅ GPL v3	✅	✅

---

Report compiled for private research purposes. No proprietary files or copyrighted assets are distributed herein.