feat(VM): 吃透 Chaos VM 程序结构层 —— 模块注册表 + collect 槽位表可静态导出
补上 VM_SPEC §5/§6 自己点出的缺口（"不是 VM 的问题, 而是模块系统 + 宿主调用序列"）。
新增 tools/tdc_program.py（程序结构分析器）:
* closures / entries / 字面串折叠 / 边界感知的函数体切分
* module_registry(): 识别顶层 "registry[id] = factory" 装配模式 -> 62 个模块工厂
* call_graph / shared_bodies / find_strings / --func 导出自身指令
修掉两个真 bug:
* tdc_disasm: RET_TRUE / THROW 未当终结符 -> 控制流穿过函数结尾线性走下去,
把父函数续段误判给夹在中间的兄弟函数（@4940 曾误归 @4362, 实为 @4160）
* tdc_lift: 终结符判定写死 opcode 数值 19/49 -> 改为按语义名
新增 tools/tdc_layout.py（静态导出 cd 槽位表）:
装配链已完全厘清:
顶层 = 62 个模块工厂的注册表（工厂形参 (module, exports, require)）
-> 清单模块 arr[arr.length] = require(N) <<< 这串 require 的顺序就是 cd 槽位序
-> 分发模块按 .on/.reset/.get 分三数组
-> 装配模块 r3='{"cd":[' + for(...) r3 += r8.get() + '],"sd":{...}'
跨构建实测: core_js 的 require 串与线上构建的串**不同**（槽位序按构建随机化, 与 #31 一致）;
语义对位已验证若干槽（userAgent->cd[3], href->cd[4], languages->cd[5] 命中）。
VM_SPEC 新增 §9 程序结构层（模块系统 / 入口 / collect 装配 / 为何决定 12）。
selftest 全绿。
This commit is contained in:
yml2213
@@ -254,6 +254,10 @@ def disassemble_cfg(z: List[int], entry: int = 0, follow_closures: bool = True,
|
||||
op_jump_if = next((o for o, n in names.items() if n == "JUMP_IF_TRUE"), OP_JUMP_IF_TRUE)
|
||||
op_push_try = next((o for o, n in names.items() if n == "PUSH_TRY"), OP_PUSH_TRY)
|
||||
op_closure = next((o for o, n in names.items() if n == "CREATE_CLOSURE"), OP_CREATE_CLOSURE)
|
||||
# 终结符: 返回/抛出之后**没有 fall-through**。
|
||||
# 漏掉这一步会让控制流"穿过函数结尾"线性走下去, 把所有后续代码都算进当前子程序
|
||||
# (实测会把父函数的初始化序列误判成子函数自己的代码)。
|
||||
op_terminators = {o for o, n in names.items() if n in ("RET_TRUE", "THROW")}
|
||||
|
||||
visited: Dict[int, dict] = {}
|
||||
work = [entry]
|
||||
@@ -282,6 +286,8 @@ def disassemble_cfg(z: List[int], entry: int = 0, follow_closures: bool = True,
|
||||
# 操作数 [0] 是闭包体入口: 该段代码在闭包被调用时才执行, 但它是**代码**,
|
||||
# 必须作为遍历根加入, 否则大半个程序都算不到。
|
||||
work.append(z[pc + 1])
|
||||
if op in op_terminators: # RET_TRUE / THROW: 无 fall-through
|
||||
continue
|
||||
work.append(nxt)
|
||||
return [visited[k] for k in sorted(visited)]
|
||||
|
||||
|
||||
@@ -0,0 +1,158 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
"""
|
||||
tdc_layout.py —— 静态导出 `collect` 明文的 **cd 槽位表**（纯算, 不跑 JS, 不跑环境）。
|
||||
|
||||
背景（这条链是 2026-10-11 排查 errorCode=12 时打通的, 见 har/1ms_dianxuan/PROGRESS.md #31/#32）:
|
||||
真机成功会话的 collect 明文解出来后, 发现 **5 份同日样本的 `cd` 槽位数(38)、取值集合、`sd`
|
||||
全都一样, 但槽位顺序 5/5 互不相同** —— 也就是"哪些字段排在哪一槽"是**按构建随机化**的。
|
||||
仓库里的 success_collect_template.b64 是**某一次**的顺序, 拿它发的 collect 会被服务端
|
||||
按"本次构建的槽位表"读成自相矛盾的环境 -> errorCode=12。
|
||||
|
||||
槽位序从哪来（程序结构, 见 tools/tdc_program.py）:
|
||||
1. 顶层 @0 先把 62 个**模块工厂**按 id 填进一个数组 (registry[id] = function(module, exports, require));
|
||||
2. 其中一个模块（下称"清单模块"）返回一个**数组**, 它的构造方式是一串
|
||||
r6[r6.length] = require(N)
|
||||
也就是 **`cd` 的槽位顺序 = 这串 require 的顺序**;
|
||||
3. 另一个模块负责把这些采集器按 `.on` / `.reset` / `.get` 分到三个数组, 再另有一个模块
|
||||
遍历"有 .get() 的那些", 依次取 `get()` 的值拼成 `{"cd":[...],"sd":{...}}`。
|
||||
|
||||
所以本工具做的事:
|
||||
* 找清单模块（= push(require(N)) 次数最多的那个模块）;
|
||||
* 读出它的 require 序列 -> 槽位表 [(槽位号, 模块 id, 工厂 entry), ...];
|
||||
* 把每个槽位子模块（含其内部闭包）里的**环境属性字面量**列出来, 作为该槽的语义线索;
|
||||
* 可选: 读一份已解密的真机 collect 明文, 与槽位表并排打印, 人工/程序核对。
|
||||
|
||||
用法:
|
||||
# 只看槽位表
|
||||
.venv/bin/python tools/tdc_layout.py tcaptcha/core_js/tdc_sample.js
|
||||
|
||||
# 和真机明文并排核对 (明文是怎么来的: 同会话 tdc.js 密钥解密 verify 的 collect)
|
||||
.venv/bin/python tools/tdc_layout.py <tdc.js> --plain /tmp/real_collect_plain.txt
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import sys
|
||||
from pathlib import Path
|
||||
from typing import Dict, List, Optional, Tuple
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
if str(ROOT) not in sys.path:
|
||||
sys.path.insert(0, str(ROOT))
|
||||
if str(ROOT / "tools") not in sys.path:
|
||||
sys.path.insert(0, str(ROOT / "tools"))
|
||||
|
||||
import tdc_program as tp # noqa: E402
|
||||
|
||||
# 采集器用来读环境的属性名（用于给槽位打语义标签, 不是判定依据）
|
||||
ENV_KEYS = [
|
||||
"userAgent", "platform", "languages", "language", "hardwareConcurrency", "deviceMemory",
|
||||
"colorDepth", "pixelDepth", "availHeight", "availWidth", "deviceXDPI", "logicalXDPI",
|
||||
"fontSmoothingEnabled", "appVersion", "appName", "vendor", "cookieEnabled", "timezone",
|
||||
"getTimezoneOffset", "toDataURL", "getParameter", "getExtension", "TCaptchaReferrer",
|
||||
"webdriver", "referrer", "href", "width", "height", "innerWidth", "innerHeight",
|
||||
"devicePixelRatio", "characterSet", "MAX_TEXTURE_SIZE", "WEBGL_debug_renderer_info",
|
||||
]
|
||||
|
||||
|
||||
def find_manifest_module(p: tp.Program) -> Tuple[int, int, List[int]]:
|
||||
"""找"清单模块": 体内 `push(require(N))` 次数最多者。
|
||||
|
||||
返回 (模块 id, 工厂 entry, require 序列)。
|
||||
"""
|
||||
reg = dict(p.module_registry(0))
|
||||
best = (0, -1, [])
|
||||
for mid, entry in reg.items():
|
||||
code = p.function_code(entry)
|
||||
seq: List[int] = []
|
||||
for k, inst in enumerate(code):
|
||||
if inst["name"] != "PUSH_IMM" or not inst["operands"]:
|
||||
continue
|
||||
if k >= 1 and code[k - 1]["name"] == "LOAD_REG_IMM" \
|
||||
and k + 1 < len(code) and code[k + 1]["name"] == "CALL_FUNC":
|
||||
seq.append(int(inst["operands"][0]))
|
||||
if len(seq) > len(best[2]):
|
||||
best = (mid, entry, seq)
|
||||
return best
|
||||
|
||||
|
||||
def transitive_strings(p: tp.Program, entry: int, depth: int = 3) -> List[str]:
|
||||
"""模块自身 + 它内部创建的闭包（递归 depth 层）里的字面串。"""
|
||||
seen, out = set(), []
|
||||
frontier = {entry}
|
||||
for _ in range(depth):
|
||||
nxt = set()
|
||||
for e in frontier:
|
||||
if e in seen:
|
||||
continue
|
||||
seen.add(e)
|
||||
for pc, s in p.strings:
|
||||
if p.owner(pc) == e:
|
||||
out.append(s)
|
||||
for c in p.closures:
|
||||
if p.owner(c.pc) == e:
|
||||
nxt.add(c.target)
|
||||
frontier = nxt
|
||||
return out
|
||||
|
||||
|
||||
def env_hints(strings: List[str]) -> List[str]:
|
||||
hits = []
|
||||
for s in strings:
|
||||
for k in ENV_KEYS:
|
||||
if k.lower() in s.lower() and k not in hits:
|
||||
hits.append(k)
|
||||
return hits
|
||||
|
||||
|
||||
def main() -> int:
|
||||
ap = argparse.ArgumentParser(description="静态导出 collect 的 cd 槽位表")
|
||||
ap.add_argument("path")
|
||||
ap.add_argument("--plain", default=None, help="已解密的真机 collect 明文 (json 文本)")
|
||||
ap.add_argument("--json", default=None, help="把槽位表写成 JSON")
|
||||
args = ap.parse_args()
|
||||
|
||||
p = tp.load(args.path)
|
||||
reg = dict(p.module_registry(0))
|
||||
mid, entry, seq = find_manifest_module(p)
|
||||
print(f"文件 : {args.path}")
|
||||
print(f"模块总数 : {len(reg)}")
|
||||
print(f"清单模块 : registry[{mid}] = @{entry}")
|
||||
print(f"槽位序列长度 : {len(seq)} (真机 cd 槽数 = 38, 差的部分是字面量槽)")
|
||||
print(f"require 序列 : {seq}")
|
||||
|
||||
plain_cd: Optional[list] = None
|
||||
if args.plain:
|
||||
txt = open(args.plain, encoding="latin1").read().rstrip("\x00").strip()
|
||||
obj = json.loads(txt)
|
||||
plain_cd = obj.get("cd")
|
||||
print(f"真机明文 cd 槽数: {len(plain_cd)}")
|
||||
|
||||
table = []
|
||||
print("\n槽位 模块id 工厂entry 语义线索 真机值")
|
||||
print("-" * 108)
|
||||
for i, m in enumerate(seq):
|
||||
tgt = reg.get(m)
|
||||
strs = transitive_strings(p, tgt) if tgt else []
|
||||
hints = env_hints(strs)
|
||||
val = ""
|
||||
if plain_cd is not None and i < len(plain_cd):
|
||||
v = repr(plain_cd[i])
|
||||
val = v if len(v) <= 34 else v[:34] + "..."
|
||||
table.append({"slot": i, "module": m, "entry": tgt, "hints": hints})
|
||||
print(f" {i:2d} {m:4d} @{tgt:<7} {str(hints)[:34]:<34} {val}")
|
||||
|
||||
if plain_cd is not None:
|
||||
print(f"\n(真机 cd 里还有 {len(plain_cd) - len(seq)} 个槽不来自 require —— "
|
||||
f"通常是字面量, 例如 cd[0] 的空串)")
|
||||
if args.json:
|
||||
Path(args.json).write_text(json.dumps({"manifestModule": mid, "entry": entry,
|
||||
"slots": table}, ensure_ascii=False, indent=1),
|
||||
encoding="utf-8")
|
||||
print(f"槽位表 -> {args.json}")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
+1
-1
@@ -118,7 +118,7 @@ class Lifter:
|
||||
succ = [ops[0]]
|
||||
elif op == OP_JUMP_IF_TRUE:
|
||||
succ = [ops[0], nxt]
|
||||
elif op in (19, 49): # RET_TRUE / THROW
|
||||
elif ins["name"] in ("RET_TRUE", "THROW"): # 按语义名, 不写死 opcode 数值
|
||||
succ = []
|
||||
else:
|
||||
succ = [nxt]
|
||||
|
||||
@@ -0,0 +1,323 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
"""
|
||||
tdc_program.py —— TDC Chaos VM 「程序结构层」分析器。
|
||||
|
||||
它补的是 VM_SPEC.md §5/§6 自己点出的缺口:
|
||||
opcode 表 / 闭包调用约定 早已吃透, 但**模块系统 + 宿主调用序列**一直没被静态说明:
|
||||
顶层只"装配模块", 真正干活的代码在闭包被宿主调用时才跑。
|
||||
|
||||
本工具把这些做出确定规格:
|
||||
* `closures` —— 全部 CREATE_CLOSURE 站点: (pc, target, caps[(dst,src)], params[reg])
|
||||
* `entries` —— 子程序入口集合 = {0} ∪ {所有 closure target}
|
||||
* `strings` —— 从字节码折叠出的字面串 (PUSH_EMPTY_STR + 连续 PUSH_STR_CHAR)
|
||||
* `owner(pc)` —— 某 pc 属于哪个子程序 (启发式: 覆盖它的、且 ≤pc 的最大入口)
|
||||
* `call_graph` —— 子程序 → 它在自己体内创建的闭包 target (静态调用图的"创建边")
|
||||
* `xfuncs` —— 同一 target 被多个站点创建的"共享体" (VM 里的复用函数)
|
||||
|
||||
注意 (踩过的坑):
|
||||
`_decode_one` 对 CREATE_CLOSURE 的 `operands` **不含 target**(target 只写在 note 里),
|
||||
必须自己按 `target = z[pc+1]` 取, 否则会把 cap 寄存器号当成 target。
|
||||
|
||||
用法:
|
||||
.venv/bin/python tools/tdc_program.py tcaptcha/core_js/tdc_sample.js --summary
|
||||
.venv/bin/python tools/tdc_program.py <js> --seq --max 30
|
||||
.venv/bin/python tools/tdc_program.py <js> --find getData
|
||||
.venv/bin/python tools/tdc_program.py <js> --at 1725
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import re
|
||||
import sys
|
||||
from dataclasses import dataclass, field
|
||||
from pathlib import Path
|
||||
from typing import Dict, List, Optional, Sequence, Tuple
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1]
|
||||
if str(ROOT) not in sys.path:
|
||||
sys.path.insert(0, str(ROOT))
|
||||
|
||||
from tcaptcha.tdc_opcodes import derive_opcode_table # noqa: E402
|
||||
from tools.tdc_disasm import disassemble_cfg, extract_bytecode # noqa: E402
|
||||
|
||||
MIN_STR_LEN = 3
|
||||
|
||||
|
||||
@dataclass
|
||||
class ClosureSite:
|
||||
pc: int
|
||||
target: int
|
||||
caps: List[Tuple[int, int]] = field(default_factory=list) # (新闭包寄存器, 父闭包寄存器)
|
||||
params: List[int] = field(default_factory=list) # 形参落到的寄存器号
|
||||
|
||||
|
||||
@dataclass
|
||||
class Program:
|
||||
path: str
|
||||
z: List[int]
|
||||
names: Dict[int, str]
|
||||
arity: Dict[int, int]
|
||||
dynamic: set
|
||||
insts: Dict[int, dict]
|
||||
closures: List[ClosureSite]
|
||||
strings: List[Tuple[int, str]]
|
||||
entries: List[int]
|
||||
_owner: Dict[int, int] = field(default_factory=dict)
|
||||
|
||||
# -------------------------------------------------------------- 基本查询
|
||||
def name(self, pc: int) -> str:
|
||||
i = self.insts.get(pc)
|
||||
return i["name"] if i else "?"
|
||||
|
||||
def owner(self, pc: int) -> int:
|
||||
"""pc 属于哪个子程序入口。
|
||||
|
||||
注意: 代码布局是「函数体之间夹着父函数的初始化序列 + 内联的子函数体」,
|
||||
所以**不能**用"覆盖它的最大入口 ≤pc"来判 (会把父函数续段误判给夹在中间的兄弟函数)。
|
||||
这里用**边界感知走法**: 从入口开始走控制流, 一旦走到**另一个函数入口**就停下
|
||||
(函数只能被调用进入, 不会被穿过)。
|
||||
"""
|
||||
if not self._owner:
|
||||
self._build_owners()
|
||||
return self._owner.get(pc, 0)
|
||||
|
||||
def _next_pc(self, pc: int, inst: dict) -> int:
|
||||
"""下一条 fall-through 指令的 pc。CREATE_CLOSURE 是动态长度, 不能用固定 arity。"""
|
||||
if inst["name"] == "CREATE_CLOSURE":
|
||||
capn, parn = self.z[pc + 2], self.z[pc + 3]
|
||||
return pc + 1 + 3 + 2 * capn + parn
|
||||
return pc + 1 + self.arity.get(inst["op"], 0)
|
||||
|
||||
def function_code(self, entry: int) -> List[dict]:
|
||||
"""边界感知地取某个子程序**自己的**指令序列。"""
|
||||
starts = set(self.entries)
|
||||
out: Dict[int, dict] = {}
|
||||
work = [entry]
|
||||
while work:
|
||||
pc = work.pop()
|
||||
if pc in out or pc >= len(self.z) or pc < 0:
|
||||
continue
|
||||
if pc != entry and pc in starts: # 进入别的函数体 -> 不跨越
|
||||
continue
|
||||
inst = self.insts.get(pc)
|
||||
if inst is None:
|
||||
continue
|
||||
out[pc] = inst
|
||||
name = inst["name"]
|
||||
ops = inst["operands"] or []
|
||||
if name == "JUMP":
|
||||
work.append(ops[0])
|
||||
continue
|
||||
if name == "JUMP_IF_TRUE":
|
||||
work.append(ops[0])
|
||||
work.append(self._next_pc(pc, inst))
|
||||
continue
|
||||
if name == "PUSH_TRY" and self.arity.get(inst["op"], 0) == 2:
|
||||
work.append(ops[0])
|
||||
if name == "CREATE_CLOSURE":
|
||||
work.append(self.z[pc + 1])
|
||||
if name in ("RET_TRUE", "THROW"):
|
||||
continue
|
||||
work.append(self._next_pc(pc, inst))
|
||||
return [out[k] for k in sorted(out)]
|
||||
|
||||
def _build_owners(self) -> None:
|
||||
for e in self.entries:
|
||||
for inst in self.function_code(e):
|
||||
self._owner.setdefault(inst["pc"], e)
|
||||
|
||||
def closures_of(self, entry: int) -> List[ClosureSite]:
|
||||
return [c for c in self.closures if self.owner(c.pc) == entry]
|
||||
|
||||
def call_graph(self) -> Dict[int, List[int]]:
|
||||
g: Dict[int, List[int]] = {}
|
||||
for c in self.closures:
|
||||
g.setdefault(self.owner(c.pc), []).append(c.target)
|
||||
return {k: sorted(set(v)) for k, v in g.items()}
|
||||
|
||||
def shared_bodies(self) -> Dict[int, List[int]]:
|
||||
"""target -> 创建它的站点列表 (长度>1 说明这些站点共用同一个代码体)。"""
|
||||
m: Dict[int, List[int]] = {}
|
||||
for c in self.closures:
|
||||
m.setdefault(c.target, []).append(c.pc)
|
||||
return {k: v for k, v in m.items() if len(v) > 1}
|
||||
|
||||
def module_registry(self, entry: int = 0) -> List[Tuple[int, int]]:
|
||||
"""识别顶层「模块注册表装配」模式, 返回 [(模块 id, 工厂闭包 entry), ...]。
|
||||
|
||||
模式 (源码级 `registry[id] = function(module, exports, require){...}` 的编译产物):
|
||||
DUP; PUSH_IMM [id]; REVERSE_TOP2; JUMP -> @F; @F: CREATE_CLOSURE ...; SET_PROP
|
||||
|
||||
这是整个程序的骨架: 顶层只把 228 个模块工厂按 id 填进一个数组, 入口再 drive 它。
|
||||
"""
|
||||
code = self.function_code(entry)
|
||||
pairs: List[Tuple[int, int]] = []
|
||||
for k, inst in enumerate(code):
|
||||
if inst["name"] != "CREATE_CLOSURE":
|
||||
continue
|
||||
for j in range(k - 1, max(-1, k - 4), -1):
|
||||
if code[j]["name"] != "JUMP":
|
||||
continue
|
||||
ops = code[j]["operands"] or []
|
||||
if not ops or ops[0] != inst["pc"]:
|
||||
continue
|
||||
for m in range(j - 1, max(-1, j - 6), -1):
|
||||
if code[m]["name"] == "PUSH_IMM" and code[m]["operands"]:
|
||||
# 记的是**工厂函数体入口** (CREATE_CLOSURE 的 target), 不是创建站点
|
||||
pairs.append((int(code[m]["operands"][0]), self.z[inst["pc"] + 1]))
|
||||
break
|
||||
break
|
||||
seen, out = set(), []
|
||||
for mid, tgt in sorted(pairs):
|
||||
if mid in seen:
|
||||
continue
|
||||
seen.add(mid)
|
||||
out.append((mid, tgt))
|
||||
return out
|
||||
|
||||
def find_strings(self, pattern: str) -> List[Tuple[int, str, int]]:
|
||||
"""返回 (pc, 串, 所属子程序入口)。"""
|
||||
rx = re.compile(pattern, re.I)
|
||||
return [(pc, s, self.owner(pc)) for pc, s in self.strings if rx.search(s)]
|
||||
|
||||
|
||||
def _fold_strings(insts: Dict[int, dict]) -> List[Tuple[int, str]]:
|
||||
"""PUSH_EMPTY_STR 后跟一串 PUSH_STR_CHAR -> 还原字面串 (tdc_disasm 不做这步)。"""
|
||||
out: List[Tuple[int, str]] = []
|
||||
cur_pc: Optional[int] = None
|
||||
buf: List[str] = []
|
||||
for pc in sorted(insts):
|
||||
i = insts[pc]
|
||||
n = i["name"]
|
||||
if n == "PUSH_EMPTY_STR":
|
||||
cur_pc, buf = pc, []
|
||||
continue
|
||||
if n == "PUSH_STR_CHAR" and cur_pc is not None:
|
||||
ops = i["operands"] or []
|
||||
if ops:
|
||||
buf.append(chr(ops[0] & 0xFF))
|
||||
continue
|
||||
if cur_pc is not None:
|
||||
if len(buf) >= MIN_STR_LEN:
|
||||
out.append((cur_pc, "".join(buf)))
|
||||
cur_pc, buf = None, []
|
||||
if cur_pc is not None and len(buf) >= MIN_STR_LEN:
|
||||
out.append((cur_pc, "".join(buf)))
|
||||
return out
|
||||
|
||||
|
||||
def load(js_path: str) -> Program:
|
||||
js = open(js_path, encoding="utf-8", errors="replace").read()
|
||||
z = extract_bytecode(js)
|
||||
names, arity, dynamic, _diag = derive_opcode_table(js)
|
||||
insts = {i["pc"]: i for i in
|
||||
disassemble_cfg(z, 0, True, names=names, arity=arity, dynamic=dynamic)
|
||||
if i["op"] is not None}
|
||||
|
||||
closures: List[ClosureSite] = []
|
||||
for pc, i in insts.items():
|
||||
if i["name"] != "CREATE_CLOSURE":
|
||||
continue
|
||||
target, cap, par = z[pc + 1], z[pc + 2], z[pc + 3]
|
||||
base = pc + 4
|
||||
caps = [(z[base + 2 * k], z[base + 2 * k + 1]) for k in range(cap)]
|
||||
params = [z[base + 2 * cap + k] for k in range(par)]
|
||||
closures.append(ClosureSite(pc=pc, target=target, caps=caps, params=params))
|
||||
|
||||
strings = _fold_strings(insts)
|
||||
entries = sorted({0} | {c.target for c in closures})
|
||||
return Program(path=js_path, z=z, names=names, arity=arity, dynamic=dynamic,
|
||||
insts=insts, closures=sorted(closures, key=lambda c: c.pc),
|
||||
strings=strings, entries=entries)
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- CLI
|
||||
def main() -> int:
|
||||
ap = argparse.ArgumentParser(description="TDC Chaos VM 程序结构分析")
|
||||
ap.add_argument("path", nargs="?", default=str(ROOT / "tcaptcha/core_js/tdc_sample.js"))
|
||||
ap.add_argument("--summary", action="store_true", help="总体规模")
|
||||
ap.add_argument("--seq", action="store_true", help="按子程序列出闭包站点")
|
||||
ap.add_argument("--max", type=int, default=40, help="--seq/--find 的截断条数")
|
||||
ap.add_argument("--find", default=None, help="按正则找字面串")
|
||||
ap.add_argument("--at", type=int, default=None, help="看某个 pc 属于谁")
|
||||
ap.add_argument("--shared", action="store_true", help="列出被多个站点共享的闭包体")
|
||||
ap.add_argument("--func", type=int, default=None, help="打印某个子程序**自己的**指令序列")
|
||||
ap.add_argument("--asm-out", default=None, help="--func 时把反汇编写到该文件")
|
||||
ap.add_argument("--modules", action="store_true", help="导出模块注册表 (id -> 工厂 entry)")
|
||||
args = ap.parse_args()
|
||||
|
||||
p = load(args.path)
|
||||
shown = False
|
||||
|
||||
if args.summary or not any([args.seq, args.find is not None, args.at is not None,
|
||||
args.shared, args.func is not None]):
|
||||
shown = True
|
||||
print(f"file : {p.path}")
|
||||
print(f"bytecode : {len(p.z)} ints")
|
||||
print(f"reachable instrs: {len(p.insts)}")
|
||||
print(f"closure sites : {len(p.closures)}")
|
||||
print(f"subprograms : {len(p.entries)} (0 为顶层)")
|
||||
print(f"distinct bodies : {len({c.target for c in p.closures})}")
|
||||
print(f"literal strings : {len(p.strings)} (>= {MIN_STR_LEN} 字符)")
|
||||
|
||||
if args.seq:
|
||||
shown = True
|
||||
g = p.call_graph()
|
||||
print(f"\n--- 子程序与它们创建的闭包 (前 {args.max} 个入口) ---")
|
||||
for e in p.entries[: args.max]:
|
||||
kids = g.get(e, [])
|
||||
st = [s for pc, s in p.strings if p.owner(pc) == e]
|
||||
head = ", ".join(f"{s[:22]!r}" for s in st[:4])
|
||||
print(f" @{e:05d} -> {kids}")
|
||||
if head:
|
||||
print(f" 串: {head}")
|
||||
|
||||
if args.find is not None:
|
||||
shown = True
|
||||
hits = p.find_strings(args.find)
|
||||
print(f"\n--- 字面串匹配 {args.find!r}: {len(hits)} 条 ---")
|
||||
for pc, s, own in hits[: args.max]:
|
||||
print(f" @{pc:05d} [子程序 @{own:05d}] {s[:90]!r}")
|
||||
|
||||
if args.at is not None:
|
||||
shown = True
|
||||
pc = args.at
|
||||
print(f"\n--- pc @{pc} ---")
|
||||
print(f" 指令 : {p.insts.get(pc)}")
|
||||
print(f" 所属 : @{p.owner(pc)}")
|
||||
|
||||
if args.func is not None:
|
||||
shown = True
|
||||
code = p.function_code(args.func)
|
||||
lines = []
|
||||
for x in code:
|
||||
extra = (" " + " ".join(x["note"])) if x["note"] else (
|
||||
(" " + str(x["operands"])) if x["operands"] else "")
|
||||
lines.append(f"@{x['pc']:05d}: {x['name']:<18}{extra}")
|
||||
print(f"\n--- 子程序 @{args.func} 自身指令: {len(lines)} 条 ---")
|
||||
print("\n".join(lines[: args.max]))
|
||||
if args.asm_out:
|
||||
Path(args.asm_out).write_text("\n".join(lines), encoding="utf-8")
|
||||
print(f" -> {args.asm_out}")
|
||||
|
||||
if args.modules:
|
||||
shown = True
|
||||
reg = p.module_registry(0)
|
||||
print(f"\n--- 模块注册表: {len(reg)} 个模块 (registry[id] = 工厂闭包) ---")
|
||||
for mid, tgt in reg[: args.max]:
|
||||
print(f" registry[{mid:3d}] = 工厂 @{tgt}")
|
||||
if len(reg) > args.max:
|
||||
print(f" ... 共 {len(reg)} 个")
|
||||
|
||||
if args.shared:
|
||||
shown = True
|
||||
sh = p.shared_bodies()
|
||||
print(f"\n--- 共享闭包体: {len(sh)} 个 target 被多处创建 ---")
|
||||
for t, sites in sorted(sh.items(), key=lambda kv: -len(kv[1]))[: args.max]:
|
||||
print(f" target @{t:05d} x{len(sites)} sites={sites[:8]}{'...' if len(sites) > 8 else ''}")
|
||||
|
||||
return 0 if shown else 1
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
Reference in New Issue
Block a user