yml/hello_js_reverse_skill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(账本)+feat(神谕): 完全还原 XTEA 密钥构造算法 (纯 Python 复算与 Node 逐字一致)

Browse Source 
做了什么:
- tdc_probe.js 神谕增强: 逐字追踪"某值首次出现的 PC"(__WP), DUMP_PC 支持记录多次命中
- PROGRESS.md 已知表新增 14-18 条: 密钥字构造算法 / 盐折叠 / 纯Python复算一致 /
  运行时链路位置 / extract_xtea_key 正确性验证

为什么:
- 用"运行时神谕 + 反汇编阅读"替代逐条模拟(打地鼠), 定位并读懂密钥构造

怎么验证(硬结果):
- 密钥字算法(反汇编读出 + 运行时寄存器佐证):
    word = Σ ((charCodeAt(src,k) + off) & 0xFF) << (8k)
  四个 (源串, 偏移) = ("IA_t",-8) ("9:%!",+49) ("nTLS",-9) ("7XYf",+3)
- 运行时逐字首次出现: 7740/7526/7895/8852; 数组组装 @8886; 进XTEA @9030; 入口 @9109
- 纯 Python 复算 base=[1817655617,1381395306,1245924197,1767660346]
  + 折盐(855311->word0, 723726->word3)
  = [1818510928,1381395306,1245924197,1768384072] == extract_xtea_key  ✅
This commit is contained in:
yml2213
2026-10-11 22:27:29 +08:00
parent 74d478050c
commit 9286f77661
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/tdc_probe.js
+8 -3
View File
@@ -91,6 +91,10 @@ function probeTdc(tdcFilePath, options = {}) {
+ "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
+ "if(v&&v.length===4&&v[0]===window.__W[0]&&v[1]===window.__W[1]&&v[2]===window.__W[2]&&v[3]===window.__W[3])"
+ "{window.__ARR={at:H,reg:i,prev:window.__PC.slice(-120)};break;}}}"
+ "if(!window.__WP){window.__WP=[null,null,null,null];}"
+ "for(var q=0;q<4;q++){if(window.__WP[q])continue;"
+ "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
+ "if(typeof v==='number'&&v===window.__W[q]){window.__WP[q]={at:H,reg:i};break;}}}"
+ "if(H<=" + TARGET_PC + "&&!window.__WRD){var f=-1;"
+ "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
+ "if(typeof v==='number'&&v===window.__W[0]){f=i;break;}}"
@@ -99,11 +103,11 @@ function probeTdc(tdcFilePath, options = {}) {
// 可选: 在指定 PC dump 全部寄存器 (神谕二分/定位用)
const DUMP_PC = parseInt(process.env.DUMP_PC || "-1", 10);
if (DUMP_PC >= 0) {
tdcCode = "window.__DPC=" + DUMP_PC + ";window.__DUMP=null;(function(){var _h=window.__H;"
+ "window.__H=function(H,E){_h(H,E);if(H===window.__DPC&&!window.__DUMP){var o=[];"
tdcCode = "window.__DPC=" + DUMP_PC + ";window.__DUMP=[];(function(){var _h=window.__H;"
+ "window.__H=function(H,E){_h(H,E);if(H===window.__DPC&&window.__DUMP.length<8){var o=[];"
+ "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
+ "o.push(typeof v==='string'?'str:'+v:(typeof v==='number'?'num:'+v:String(v)));}"
+ "window.__DUMP=o;}}})();" + tdcCode;
+ "window.__DUMP.push(o);}}})();" + tdcCode;
}
const NEEDLE = "M=G[z[H++]]()";
if (tdcCode.includes(NEEDLE)) {
@@ -328,6 +332,7 @@ function probeTdc(tdcFilePath, options = {}) {
__arr: sandbox.__ARR || null,
__wrd: sandbox.__WRD || null,
__dump: sandbox.__DUMP || null,
__wp: sandbox.__WP || null,
};
return result;