@ecopoesis/homebridge-dmx 0.1.0

package/tools/try-hardcoded-key.ts

@@ -0,0 +1,103 @@
+// Try decrypting a captured 576-byte DMX frame using the hardcoded 33-byte
+// secret discovered by Ghidra static RE.
+//
+// Background:
+//   Ghidra found a deobfuscator (cipher vtable's vt[7], at FUN_100180E90 +
+//   FUN_100180D40 — byte-identical compiler dupes). It reads 33 obfuscated
+//   bytes at 0x1007B0490 and XORs them with the mask 0x51..0x71 to produce a
+//   33-byte hardcoded secret. We decoded that secret offline:
+//
+//     hex: 527a5b46c56f3a5e670b4f0e338727d9
+//          4737ec0fc4af0dba93a51d93965191d0
+//          8f
+//
+//   It MIGHT be: 16-byte AES-128 key + 16-byte IV + 1-byte flag (33 total),
+//   used directly by the cipher without any per-session handshake.
+//
+//   To verify, capture a 576-byte UDP frame from the Stick (UDP→192.168.96.2:2431,
+//   live DMX from Hardware Manager) and try to decrypt its 544-byte body
+//   (offset +0x20..+0x240) using AES-128-CBC and AES-128-CFB with these key/IV.
+//   If either yields plaintext that looks like DMX (mostly 0s with a few
+//   non-zero channel values), the hardcoded secret IS the key.
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+
+const KEY = Buffer.from('527a5b46c56f3a5e670b4f0e338727d9', 'hex');
+const IV  = Buffer.from('4737ec0fc4af0dba93a51d93965191d0', 'hex');
+// 33rd byte (0x8f) — meaning TBD; might be a mode flag or version byte.
+
+if (process.argv.length < 3) {
+  console.error('usage: tsx tools/try-hardcoded-key.ts <captured-576B-frame.bin>');
+  console.error('  (capture with: tcpdump -i en0 -w stick.pcap udp port 2431,');
+  console.error('   then extract the first 576-byte UDP payload as a raw .bin file)');
+  process.exit(1);
+}
+
+const frame = fs.readFileSync(process.argv[2]);
+if (frame.length !== 576) {
+  console.error(`expected exactly 576 bytes, got ${frame.length}`);
+  process.exit(1);
+}
+
+const header = frame.subarray(0, 0x20);     // 32 bytes clear
+const body   = frame.subarray(0x20, 0x240); // 544 bytes encrypted
+
+console.log('clear header (32B):');
+console.log(' ', header.toString('hex').match(/../g)!.join(' '));
+console.log(`  session_magic[0..8]    = ${header.subarray(0, 8).toString('hex')}`);
+console.log(`  opcode/version[8..a]   = 0x${header.readUInt16LE(8).toString(16)}`);
+console.log(`  field[a..12]           = ${header.subarray(0x0a, 0x12).toString('hex')}`);
+console.log(`  field[12..14]          = 0x${header.readUInt16LE(0x12).toString(16)}`);
+console.log(`  channel count[14..16]  = ${header.readUInt16LE(0x14)}`);
+console.log(`  const100[16]           = 0x${header[0x16].toString(16)}`);
+console.log(`  seq_counter[17]        = ${header[0x17]}`);
+console.log(`  nonce[18..20]          = ${header.subarray(0x18, 0x20).toString('hex')}`);
+console.log();
+console.log('encrypted body length:', body.length, 'bytes (= 34 × 16B blocks)');
+console.log();
+
+function score(buf: Buffer): { zeroRatio: number; sample: string } {
+  let zeros = 0;
+  for (const b of buf) if (b === 0) zeros++;
+  return {
+    zeroRatio: zeros / buf.length,
+    sample: buf.subarray(0, 32).toString('hex'),
+  };
+}
+
+function tryDecrypt(label: string, algo: string, key: Buffer, iv: Buffer): void {
+  try {
+    const d = crypto.createDecipheriv(algo, key, iv);
+    d.setAutoPadding(false);
+    const out = Buffer.concat([d.update(body), d.final()]);
+    const s = score(out);
+    console.log(`${label}:`);
+    console.log(`  zero ratio: ${(s.zeroRatio * 100).toFixed(1)}%   (DMX with mostly off lights should be high)`);
+    console.log(`  first 32B:  ${s.sample}`);
+  } catch (e: any) {
+    console.log(`${label}: error: ${e.message}`);
+  }
+}
+
+console.log('=== Trying hardcoded key, hardcoded IV ===');
+tryDecrypt('AES-128-CBC', 'aes-128-cbc', KEY, IV);
+tryDecrypt('AES-128-CFB', 'aes-128-cfb', KEY, IV);
+
+console.log();
+console.log('=== Trying hardcoded key, nonce-as-IV (frame[+0x18..+0x20] zero-padded to 16B) ===');
+const nonceIv = Buffer.concat([header.subarray(0x18, 0x20), Buffer.alloc(8)]);
+tryDecrypt('AES-128-CBC', 'aes-128-cbc', KEY, nonceIv);
+tryDecrypt('AES-128-CFB', 'aes-128-cfb', KEY, nonceIv);
+
+console.log();
+console.log('=== Trying hardcoded key, full clear-header[16..32] as IV ===');
+const headerTailIv = header.subarray(0x10, 0x20);
+tryDecrypt('AES-128-CBC', 'aes-128-cbc', KEY, headerTailIv);
+tryDecrypt('AES-128-CFB', 'aes-128-cfb', KEY, headerTailIv);
+
+console.log();
+console.log('If any variant above shows >85% zeros + sensible DMX channel values,');
+console.log('the hardcoded secret IS the key/IV — the plugin can encrypt without');
+console.log('any per-session handshake. If none works, the handshake derives the');
+console.log('key (see cipher vt[4]/[5]/[6] = opcodes 0xF/0x10/0x11).');

package/tools/try-key.mjs

@@ -0,0 +1,103 @@
+// Verify a recovered AES key against a captured 576-byte DMX frame.
+//
+// Generalises try-hardcoded-key.mjs: takes the key (and optionally IV / mode)
+// on the command line, so it works with keys extracted by the Path A lldb
+// scan (tools/lldb-pathA-scan.py).
+//
+// Usage:
+//   node tools/try-key.mjs <frame.bin> <key-hex> [iv-hex] [cbc|cfb]
+//
+// Key insight: with the CORRECT key, AES-CBC and AES-CFB both decrypt blocks
+// 1..33 correctly regardless of the IV (only block 0 depends on the IV). So
+// a high zero-ratio here confirms the key even if the IV is unknown/wrong.
+//
+// Examples:
+//   node tools/try-key.mjs /tmp/frame.bin $(xxd -p -c256 /tmp/stick-pathA-key-0.bin)
+//   node tools/try-key.mjs /tmp/frame.bin 527a5b46...  0011..  cfb
+
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+
+const [, , framePath, keyHex, ivHex, modeArg] = process.argv;
+if (!framePath || !keyHex) {
+  console.error('usage: node tools/try-key.mjs <frame.bin> <key-hex> [iv-hex] [cbc|cfb]');
+  process.exit(1);
+}
+
+const frame = fs.readFileSync(framePath);
+if (frame.length !== 576) {
+  console.error(`expected exactly 576 bytes, got ${frame.length}`);
+  process.exit(1);
+}
+
+const key = Buffer.from(keyHex.replace(/\s/g, ''), 'hex');
+if (key.length !== 16) {
+  console.error(`key must be 16 bytes (32 hex chars), got ${key.length}`);
+  process.exit(1);
+}
+
+const header = frame.subarray(0, 0x20);
+const body   = frame.subarray(0x20, 0x240);   // 544 bytes = 34 AES blocks
+
+// candidate IVs to try (block 0 only depends on this; blocks 1..33 don't)
+const ivs = [];
+if (ivHex) {
+  ivs.push(['cli', Buffer.from(ivHex.replace(/\s/g, ''), 'hex')]);
+} else {
+  ivs.push(['zero',      Buffer.alloc(16)]);
+  ivs.push(['nonce|0',   Buffer.concat([header.subarray(0x18, 0x20), Buffer.alloc(8)])]);
+  ivs.push(['hdr16..32', Buffer.from(header.subarray(0x10, 0x20))]);
+}
+
+const modes = modeArg ? [modeArg.toLowerCase()] : ['cbc', 'cfb'];
+
+console.log('clear header (32B):', header.toString('hex').match(/../g).join(' '));
+console.log(`  session_magic = ${header.subarray(0, 8).toString()}`);
+console.log(`  channels      = ${header.readUInt16LE(0x14)}`);
+console.log(`  seq           = ${header[0x17]}`);
+console.log(`  nonce         = ${header.subarray(0x18, 0x20).toString('hex')}`);
+console.log(`  key           = ${key.toString('hex')}`);
+console.log();
+
+function analyse(out) {
+  let zeros = 0, max = 0, nonzero = [];
+  for (let i = 0; i < out.length; i++) {
+    if (out[i] === 0) zeros++;
+    else { if (out[i] > max) max = out[i]; if (nonzero.length < 24) nonzero.push(`${i}:${out[i]}`); }
+  }
+  return { zeroRatio: zeros / out.length, max, nonzero };
+}
+
+let best = null;
+for (const algo of modes) {
+  const cipherName = algo === 'cbc' ? 'aes-128-cbc' : 'aes-128-cfb';
+  for (const [ivLabel, iv] of ivs) {
+    if (iv.length !== 16) { console.log(`  skip ${algo}/${ivLabel}: bad iv len`); continue; }
+    try {
+      const d = crypto.createDecipheriv(cipherName, key, iv);
+      d.setAutoPadding(false);
+      const out = Buffer.concat([d.update(body), d.final()]);
+      const a = analyse(out);
+      const pct = (a.zeroRatio * 100).toFixed(1);
+      const verdict = a.zeroRatio > 0.80 ? '  <<< LOOKS LIKE VALID DMX' : '';
+      console.log(`${algo.toUpperCase()} iv=${ivLabel.padEnd(10)} zero=${pct}%  max=${a.max}${verdict}`);
+      console.log(`   first 32B: ${out.subarray(0, 32).toString('hex')}`);
+      if (a.nonzero.length) console.log(`   nonzero[idx:val]: ${a.nonzero.join(' ')}`);
+      if (!best || a.zeroRatio > best.zeroRatio) best = { algo, ivLabel, ...a };
+    } catch (e) {
+      console.log(`${algo.toUpperCase()} iv=${ivLabel}: error ${e.message}`);
+    }
+  }
+}
+
+console.log();
+if (best && best.zeroRatio > 0.80) {
+  console.log(`✅ KEY VERIFIED — best: ${best.algo.toUpperCase()} iv=${best.ivLabel} ` +
+              `zero=${(best.zeroRatio * 100).toFixed(1)}%`);
+  console.log('   (block 0 may differ until the real IV is known — that is expected)');
+  process.exit(0);
+} else {
+  console.log('❌ key did not produce DMX-shaped plaintext.');
+  console.log('   Either the key is wrong, or the cipher/mode differs from AES-128.');
+  process.exit(3);
+}

package/tools/verify-011c-key.mjs

@@ -0,0 +1,121 @@
+// Verify the recovered AES-256 key by decrypting every 0x011c reply across
+// multiple pcaps + locate the key's address in the HardwareManager binary.
+//
+//   node tools/verify-011c-key.mjs
+
+import fs from 'node:fs';
+import crypto from 'node:crypto';
+
+const KEY = Buffer.from('ea079afbbdd859719322e3f6e3c670223da627f9b6146e4ba6eb0f4a18739205', 'hex');
+const HWM = '/Applications/ESA2/HardwareManager/HardwareManager.app/Contents/MacOS/HardwareManager';
+const PCAPS = ['/tmp/hwm-A.pcap', '/tmp/hwm-B.pcap', '/tmp/sd-xhl.pcap'];
+
+function ipFromEth(p){if(p.length<14)return null;let o=12,e=p.readUInt16BE(o);for(let i=0;i<2&&e===0x8100;i++){o+=4;if(o+2>p.length)return null;e=p.readUInt16BE(o);}return e===0x0800?p.subarray(o+2):null;}
+
+function extractReplies(pcap) {
+  const buf = fs.readFileSync(pcap);
+  const le = buf.readUInt32LE(0) === 0xa1b2c3d4;
+  const streams = new Map();
+  let off = 24;
+  while (off + 16 <= buf.length) {
+    const capLen = le ? buf.readUInt32LE(off+8) : buf.readUInt32BE(off+8);
+    off += 16; if (off + capLen > buf.length) break;
+    const pkt = buf.subarray(off, off+capLen); off += capLen;
+    const ip = ipFromEth(pkt); if (!ip || ip.length<20 || ((ip[0]>>4)&0xf)!==4) continue;
+    const ihl = (ip[0]&0xf)*4; if (ip[9]!==6) continue;
+    const tcp = ip.subarray(ihl);
+    if (tcp.readUInt16BE(0) !== 2431) continue;
+    const seq = tcp.readUInt32BE(4); const dataOff = (tcp[12]>>4)*4;
+    const payload = tcp.subarray(dataOff); if (!payload.length) continue;
+    const k = `${ip[12]}.${ip[13]}.${ip[14]}.${ip[15]}<->${ip[16]}.${ip[17]}.${ip[18]}.${ip[19]}`;
+    if (!streams.has(k)) streams.set(k, []);
+    streams.get(k).push({ seq, payload });
+  }
+  const out = [];
+  for (const [k, segs] of streams) {
+    segs.sort((a,b)=>(a.seq-b.seq+0x100000000)%0x100000000);
+    const seen = new Set(); const arr = [];
+    const base = segs[0].seq;
+    for (const s of segs) {
+      const kk = `${s.seq}:${s.payload.length}`; if (seen.has(kk)) continue; seen.add(kk);
+      const o = (s.seq - base + 0x100000000) % 0x100000000;
+      while (arr.length < o + s.payload.length) arr.push(0);
+      for (let i = 0; i < s.payload.length; i++) arr[o+i] = s.payload[i];
+    }
+    const r = Buffer.from(arr);
+    for (let i = 0; i + 24 <= r.length; i++) {
+      if (r.subarray(i,i+8).toString() !== 'Stick_3A') continue;
+      if (r.readUInt16LE(i+8) !== 0x011c) continue;
+      if (r.readUInt32LE(i+0x14) !== 284) continue;
+      const msg = r.subarray(i, i+284);
+      out.push({ pcap, stream: k, token: msg.readUInt32LE(0x0a),
+                 iv: msg.subarray(0x1a, 0x2a),
+                 ct: msg.subarray(0x2c, 0x2c+240) });
+    }
+  }
+  return out;
+}
+
+function dec(iv, ct) {
+  const d = crypto.createDecipheriv('aes-256-cbc', KEY, iv);
+  d.setAutoPadding(false);
+  return Buffer.concat([d.update(ct), d.final()]);
+}
+
+console.log('=== verify key against captured replies ===\n');
+let constMap = null;
+const allPlaintexts = [];
+for (const p of PCAPS) {
+  for (const r of extractReplies(p)) {
+    const pt = dec(r.iv, r.ct);
+    allPlaintexts.push(pt);
+    console.log(`${p}  stream ${r.stream}  token=${r.token}`);
+    console.log(`  pt[  0:32 ] = ${pt.subarray(0,32).toString('hex')}`);
+    console.log(`  pt[ 32:64 ] = ${pt.subarray(32,64).toString('hex')}`);
+    console.log(`  pt[ 64:96 ] = ${pt.subarray(64,96).toString('hex')}`);
+    console.log(`  pt[ 96:128] = ${pt.subarray(96,128).toString('hex')}`);
+    console.log(`  pt[128:160] = ${pt.subarray(128,160).toString('hex')}`);
+    console.log(`  pt[160:192] = ${pt.subarray(160,192).toString('hex')}`);
+    console.log(`  pt[192:224] = ${pt.subarray(192,224).toString('hex')}`);
+    console.log(`  pt[224:240] = ${pt.subarray(224,240).toString('hex')}`);
+    console.log(`  ascii      : ${pt.toString('binary').replace(/[^\x20-\x7e]/g,'.').slice(0,160)}`);
+    // self-consistency check
+    let comp = 0;
+    for (let i = 0; i < 4; i++) if (((pt[i] ^ pt[0x64+i]) & 0xff) === 0xff) comp++;
+    console.log(`  complement-check pt[0..4] vs ~pt[0x64..0x68] : ${comp}/4 bytes`);
+    console.log();
+  }
+}
+
+// Constant-byte map across all plaintexts
+if (allPlaintexts.length >= 2) {
+  console.log('=== byte-by-byte CONST/VAR map across all decrypted replies ===');
+  const ranges = []; let cur = null;
+  for (let i = 0; i < 240; i++) {
+    const vals = new Set(allPlaintexts.map(p => p[i]));
+    const kind = vals.size === 1 ? 'const' : 'var';
+    if (!cur || cur.kind !== kind) { if (cur) ranges.push(cur); cur = { start: i, end: i, kind }; }
+    else cur.end = i;
+  }
+  if (cur) ranges.push(cur);
+  for (const r of ranges) {
+    const slice = allPlaintexts[0].subarray(r.start, r.end+1).toString('hex');
+    console.log(`  +0x${r.start.toString(16).padStart(3,'0')}..+0x${r.end.toString(16).padStart(3,'0')}  (${(r.end-r.start+1).toString().padStart(3)}B)  ${r.kind}${r.kind==='const'?'  = '+slice:''}`);
+  }
+}
+
+// Find the key in the binary
+console.log('\n=== locate key in HardwareManager binary ===');
+const bin = fs.readFileSync(HWM);
+let off = 0, hits = [];
+while (true) {
+  const idx = bin.indexOf(KEY, off);
+  if (idx === -1) break;
+  hits.push(idx);
+  off = idx + 1;
+}
+for (const h of hits) {
+  const vmaddr = h + 0x100000000;       // assume the standard Mach-O 64-bit base
+  console.log(`  file 0x${h.toString(16)}  (vmaddr ≈ 0x${vmaddr.toString(16)})`);
+}
+if (!hits.length) console.log('  NOT found in binary -- might be assembled at runtime');

package/tools/verify-kdf.mjs

@@ -0,0 +1,142 @@
+// Verify the recovered KDF against a real session — no hardware needed.
+//
+// Inputs (all from one captured session, 2026-05-21 20:48-20:51):
+//   • the ephemeral private `d`  — Path D lldb watchpoint dumped the stack at
+//     key-install time; d = FUN_100107650's local_48 = rsi-blob[0x40:0x60].
+//   • the installed AES key      — Path D log + rsi-blob[0x00:0x20].
+//   • the handshake pcap         — the TCP/2431 0x0F exchange of that session.
+//
+// The KDF claim:  key = LE( X(d·S) XOR X(d·Q) )
+//   S = hardcoded static point, Q = Stick's pubkey from the handshake.
+// We have d and key; we extract Q from the pcap and recompute. If the
+// recomputed key equals the dumped key, the KDF is proven end-to-end.
+//
+// Usage: node tools/verify-kdf.mjs [rsi-blob] [pcap]
+
+import fs from 'node:fs';
+import { P256, STATIC_POINT_COMPRESSED } from './derive-dmx-key.mjs';
+
+const RSI_BLOB = process.argv[2] || '/tmp/stick-pathD-blob-rsi_0x30a968b50.bin';
+const PCAP     = process.argv[3] || 'tools/captures/handshake-20260521-204953.pcap';
+const KNOWN_KEY = '01bb3e12b9f2081ee0a0100fcd4f1ad3e716b453b9c1a69c41ce63e9af8ad087';
+
+// ── P-256 affine arithmetic (independent bigint impl) ───────────────────────
+const { p, a, b, Gx, Gy } = P256;
+const mod = (x) => ((x % p) + p) % p;
+const inv = (x) => modpow(mod(x), p - 2n, p);
+function modpow(base, e, m) {
+  let r = 1n; base %= m;
+  while (e > 0n) { if (e & 1n) r = r * base % m; base = base * base % m; e >>= 1n; }
+  return r;
+}
+const onCurve = (P) => P && mod(P.y * P.y) === mod(P.x * P.x * P.x + a * P.x + b);
+function dbl(P) {
+  if (!P) return null;
+  const l = mod((3n * P.x * P.x + a) * inv(2n * P.y));
+  const x = mod(l * l - 2n * P.x);
+  return { x, y: mod(l * (P.x - x) - P.y) };
+}
+function add(P, Q) {
+  if (!P) return Q; if (!Q) return P;
+  if (P.x === Q.x) return P.y === Q.y ? dbl(P) : null;
+  const l = mod((Q.y - P.y) * inv(Q.x - P.x));
+  const x = mod(l * l - P.x - Q.x);
+  return { x, y: mod(l * (P.x - x) - P.y) };
+}
+function mul(k, P) {
+  let R = null;
+  for (let i = 255n; i >= 0n; i--) { R = dbl(R); if ((k >> i) & 1n) R = add(R, P); }
+  return R;
+}
+
+// ── helpers ─────────────────────────────────────────────────────────────────
+const G = { x: Gx, y: Gy };
+const beHex = (v) => v.toString(16).padStart(64, '0');
+const toLE = (v) => Buffer.from(beHex(v), 'hex').reverse();   // 32-byte LE limbs
+const fromLE = (buf) => BigInt('0x' + Buffer.from(buf).reverse().toString('hex'));
+
+function recoverY(x, evenParity) {
+  const rhs = mod(x * x * x + a * x + b);
+  let y = modpow(rhs, (p + 1n) / 4n, p);
+  if (mod(y * y) !== rhs) return null;       // x not on the curve
+  if ((y & 1n) !== (evenParity ? 0n : 1n)) y = p - y;
+  return y;
+}
+
+// static point S — SEC1-decompress the raw 33-byte compressed point
+const Sx = BigInt('0x' + STATIC_POINT_COMPRESSED.subarray(1, 33).toString('hex'));
+const S = { x: Sx, y: recoverY(Sx, (STATIC_POINT_COMPRESSED[0] & 1) === 0) };
+
+console.log('Stick-DE3 KDF — end-to-end verification\n');
+let pass = true;
+const t = (name, ok) => { console.log(`  ${ok ? 'PASS' : 'FAIL'}  ${name}`); pass &&= ok; };
+
+t('static point S is on P-256', onCurve(S));
+t('generator G is on P-256', onCurve(G));
+
+// ── load d, the ephemeral private ───────────────────────────────────────────
+const blob = fs.readFileSync(RSI_BLOB);
+const dumpedKey = blob.subarray(0, 32);
+const d = fromLE(blob.subarray(0x40, 0x60));   // local_48, stored little-endian
+t('dumped key matches Path D log', dumpedKey.toString('hex') === KNOWN_KEY);
+console.log(`    d         = ${beHex(d)}`);
+t('d is a valid scalar (0 < d < n)', d > 0n && d < P256.n);
+
+// ── our public key = d·G ────────────────────────────────────────────────────
+const ourPub = mul(d, G);
+t('d·G is on P-256', onCurve(ourPub));
+console.log(`    our pub.x = ${beHex(ourPub.x)}`);
+
+// ── scan the pcap for every valid 64-byte P-256 point (X‖Y) ──────────────────
+const pcap = fs.readFileSync(PCAP);
+function scanPoints(endian) {
+  const hits = [];
+  for (let o = 0; o + 64 <= pcap.length; o++) {
+    const xb = pcap.subarray(o, o + 32), yb = pcap.subarray(o + 32, o + 64);
+    const x = endian === 'le' ? fromLE(xb) : BigInt('0x' + xb.toString('hex'));
+    if (x === 0n || x >= p) continue;
+    const y = endian === 'le' ? fromLE(yb) : BigInt('0x' + yb.toString('hex'));
+    if (y === 0n || y >= p) continue;
+    if (onCurve({ x, y })) hits.push({ o, x, y, endian });
+  }
+  return hits;
+}
+let hits = scanPoints('le');
+let wireEndian = 'little-endian';
+if (!hits.some((h) => h.x === ourPub.x)) {
+  const be = scanPoints('be');
+  if (be.some((h) => h.x === ourPub.x)) { hits = be; wireEndian = 'big-endian'; }
+}
+t('our pubkey d·G is present in the handshake pcap', hits.some((h) => h.x === ourPub.x));
+console.log(`    wire point encoding = ${wireEndian}`);
+console.log(`    valid P-256 points found in pcap: ${hits.length}`);
+
+// ── candidate Stick pubkeys = pcap points that aren't ours ──────────────────
+const candidates = hits.filter((h) => h.x !== ourPub.x);
+
+// ── recompute the key for each candidate Q ──────────────────────────────────
+function deriveKey(Q) {
+  const xdS = toLE(mul(d, S).x);
+  const xdQ = toLE(mul(d, Q).x);
+  const k = Buffer.alloc(32);
+  for (let i = 0; i < 32; i++) k[i] = xdS[i] ^ xdQ[i];
+  return k;
+}
+let matchedQ = null;
+for (const Q of candidates) {
+  if (deriveKey(Q).toString('hex') === KNOWN_KEY) { matchedQ = Q; break; }
+}
+t('a pcap pubkey Q reproduces the exact installed key', matchedQ !== null);
+
+if (matchedQ) {
+  console.log(`\n  Stick pubkey Q (from pcap @ offset 0x${matchedQ.o.toString(16)}):`);
+  console.log(`    Q.x = ${beHex(matchedQ.x)}`);
+  console.log(`    Q.y = ${beHex(matchedQ.y)}`);
+  console.log(`\n  key = LE( X(d·S) XOR X(d·Q) )`);
+  console.log(`    recomputed = ${deriveKey(matchedQ).toString('hex')}`);
+  console.log(`    installed  = ${KNOWN_KEY}`);
+}
+
+console.log(`\n${pass && matchedQ ? '✅ KDF VERIFIED END-TO-END — recovery is correct'
+                                  : '❌ verification failed'}`);
+process.exit(pass && matchedQ ? 0 : 1);

package/tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "nodenext",
+    "lib": ["ES2022"],
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "noImplicitAny": false
+  },
+  "include": ["src/"],
+  "exclude": ["**/*.spec.ts"]
+}