From 74d478050c5748e235923f306cee6c234b5bff11 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Sun, 11 Oct 2026 22:24:19 +0800
Subject: [PATCH] =?UTF-8?q?feat(=E7=A5=9E=E8=B0=95):=20PC=20=E4=BA=8C?=
 =?UTF-8?q?=E5=88=86=E5=AE=9A=E4=BD=8D=20+=20=E4=BB=BB=E6=84=8F=20PC=20?=
 =?UTF-8?q?=E5=85=A8=E5=AF=84=E5=AD=98=E5=99=A8=20dump,=20=E7=A0=B4?=
 =?UTF-8?q?=E8=AF=91=E5=AF=86=E9=92=A5=E5=AD=97=E7=AE=97=E6=B3=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

做了什么:
- tdc_probe.js 钩子增强:
  * 扫描 E, 报告"基字数组"与"基字[0]"首次出现的 PC (二分定位构造点)
  * DUMP_PC=<pc> 时 dump 该 PC 的全部寄存器 (类型+值)
  * report 回传 __arr / __wrd / __dump

为什么:
- 需要"某个值在哪段字节码诞生"的运行时神谕(AGENTS.md §3.2 第3条), 而不是逐条猜

怎么验证(本轮硬结果):
- 基字[0] 首次出现 @7740 reg9; 基字数组首次出现 @8886 reg7;
  XTEA 闭包在 @9030 CALL_FUNC[2] 被调用, 入口 @9109
- DUMP_PC=7726 显示 E[3]="IA_t", E[10]=ref("IA_t","charCodeAt"), E[4]=0(i)
- 反汇编 @7712..@7740 读出的算法:
      word |= (str.charCodeAt(i) - 8) << (8*i)        // 小端打包
  验证: LE_pack('IA_t' 各字符-8) = 1817655617 == 基字[0]  ✅
- extract_xtea_key 交叉验证: 其密钥可把 probe 的 collect 解成 {"cd":[0,10,"top",... 真明文
  且 real[i]-base[i] 在 i=0/3 恰等于 XTEA 轮里的可见立即数 855311 / 723726
---
 tools/tdc_probe.js | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/tools/tdc_probe.js b/tools/tdc_probe.js
index 7ac51a5..f1db10f 100644
--- a/tools/tdc_probe.js
+++ b/tools/tdc_probe.js
@@ -84,9 +84,27 @@ function probeTdc(tdcFilePath, options = {}) {
 
   // ---- 神谕钩子(自包含, 写在沙箱内的 window 上): 记录 PC, 并在进入 XTEA 例程时 dump 密钥寄存器 ----
   const TARGET_PC = parseInt(process.env.XTEA_PC || "9109", 10);
-  const HOOK = "window.__PC=window.__PC||[];window.__H=function(H,E){window.__PC.push(H);"
-    + "if(H===" + TARGET_PC + "&&!window.__XT){var c=E[7];window.__XT={at:H,"
-    + "r7:Array.isArray(c)?JSON.stringify(c).slice(0,300):String(c),prev:window.__PC.slice(-260)};}};";
+  const BASE = (process.env.BASE_KEY || "1817655617,1381395306,1245924197,1767660346");
+  const HOOK = "window.__PC=window.__PC||[];window.__W=[" + BASE + "];"
+    + "window.__H=function(H,E){window.__PC.push(H);"
+    + "if(H<=" + TARGET_PC + "&&!window.__ARR){"
+    + "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
+    + "if(v&&v.length===4&&v[0]===window.__W[0]&&v[1]===window.__W[1]&&v[2]===window.__W[2]&&v[3]===window.__W[3])"
+    + "{window.__ARR={at:H,reg:i,prev:window.__PC.slice(-120)};break;}}}"
+    + "if(H<=" + TARGET_PC + "&&!window.__WRD){var f=-1;"
+    + "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
+    + "if(typeof v==='number'&&v===window.__W[0]){f=i;break;}}"
+    + "if(f>=0)window.__WRD={at:H,reg:f,prev:window.__PC.slice(-120)};}"
+    + "};";
+  // 可选: 在指定 PC dump 全部寄存器 (神谕二分/定位用)
+  const DUMP_PC = parseInt(process.env.DUMP_PC || "-1", 10);
+  if (DUMP_PC >= 0) {
+    tdcCode = "window.__DPC=" + DUMP_PC + ";window.__DUMP=null;(function(){var _h=window.__H;"
+      + "window.__H=function(H,E){_h(H,E);if(H===window.__DPC&&!window.__DUMP){var o=[];"
+      + "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
+      + "o.push(typeof v==='string'?'str:'+v:(typeof v==='number'?'num:'+v:String(v)));}"
+      + "window.__DUMP=o;}}})();" + tdcCode;
+  }
   const NEEDLE = "M=G[z[H++]]()";
   if (tdcCode.includes(NEEDLE)) {
     tdcCode = HOOK + tdcCode.replace(NEEDLE, "M=(window.__H(H,E),G[z[H++]]())");
@@ -307,6 +325,9 @@ function probeTdc(tdcFilePath, options = {}) {
     accesses: Array.from(accesses).sort(),
     __pc_len: (sandbox.__PC || []).length,
     __xtea: sandbox.__XT || null,
+    __arr: sandbox.__ARR || null,
+    __wrd: sandbox.__WRD || null,
+    __dump: sandbox.__DUMP || null,
   };
 
   return result;