titanium-apk-recover 2.2.0

package/dist/index.cjs

@@ -0,0 +1,1126 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  TiRecover: () => TiRecover,
+  UnsupportedEncryptionError: () => UnsupportedEncryptionError,
+  buildInfo: () => buildInfo,
+  buildReconstruct: () => reconstruct,
+  buildTiappXml: () => buildTiappXml,
+  decodeJavaInt: () => decodeJavaInt,
+  decryptCloakAsset: () => decryptCloakAsset,
+  decryptRange: () => decryptRange,
+  decryptRanges: () => decryptRanges,
+  deriveCloakKey: () => deriveCloakKey,
+  detectAlloy: () => detectAlloy,
+  extractByteArrayFields: () => extractByteArrayFields,
+  extractCloakSalt: () => extractCloakSalt,
+  extractRanges: () => extractRanges,
+  extractStringChunks: () => extractStringChunks,
+  instructionWidth: () => instructionWidth,
+  isProbablyText: () => isProbablyText,
+  parseAssetBuffer: () => parseAssetBuffer,
+  parseBinaryManifest: () => parseBinaryManifest,
+  parseManifest: () => parseManifest,
+  parseRanges: () => parseRanges,
+  pickCloakKey: () => pickCloakKey,
+  readAssetCrypt: () => readAssetCrypt,
+  recover: () => recover
+});
+module.exports = __toCommonJS(src_exports);
+
+// node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
+
+// src/index.ts
+var import_node_path4 = __toESM(require("path"), 1);
+var import_promises6 = require("fs/promises");
+
+// src/apk.ts
+var import_node_path2 = __toESM(require("path"), 1);
+var import_promises4 = require("fs/promises");
+
+// src/zip.ts
+var import_promises = require("fs/promises");
+var import_fflate = require("fflate");
+async function readApkEntries(apkPath, filter) {
+  const buf = await (0, import_promises.readFile)(apkPath);
+  const u8 = new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+  return await new Promise((resolve, reject) => {
+    (0, import_fflate.unzip)(u8, { filter: filter ?? (() => true) }, (err, data) => {
+      if (err) reject(err);
+      else resolve(data);
+    });
+  });
+}
+function isDexEntry(name) {
+  return /^classes\d*\.dex$/.test(name);
+}
+
+// src/manifest.ts
+var import_promises3 = require("fs/promises");
+var import_node_path = __toESM(require("path"), 1);
+var import_node_module = require("module");
+var import_cheerio = require("cheerio");
+
+// src/fs-utils.ts
+var import_promises2 = require("fs/promises");
+async function fileExists(filePath) {
+  try {
+    return (await (0, import_promises2.stat)(filePath)).isFile();
+  } catch {
+    return false;
+  }
+}
+async function dirExists(dirPath) {
+  try {
+    return (await (0, import_promises2.stat)(dirPath)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+// src/manifest.ts
+var require2 = (0, import_node_module.createRequire)(importMetaUrl);
+var BinaryXmlParser = require2(
+  "adbkit-apkreader/lib/apkreader/parser/binaryxml"
+);
+var ANDROID_NS = "http://schemas.android.com/apk/res/android";
+function isBinaryManifest(bytes) {
+  return bytes.length >= 4 && bytes[0] === 3 && bytes[1] === 0;
+}
+function attr(node, name) {
+  return node.attributes?.find((a) => a.name === name);
+}
+function attrString(node, name) {
+  const a = attr(node, name);
+  if (!a) return void 0;
+  if (a.value != null) return a.value;
+  const tv = a.typedValue?.value;
+  return tv == null ? void 0 : String(tv);
+}
+function parseBinaryManifest(bytes, dir) {
+  const doc = new BinaryXmlParser(bytes).parse();
+  const application = doc.childNodes?.find((n) => n.nodeName === "application");
+  const info = {
+    package: attrString(doc, "package"),
+    versionCode: attrString(doc, "versionCode"),
+    versionName: attrString(doc, "versionName"),
+    appName: application ? attrString(application, "label") : void 0,
+    dir
+  };
+  const xml = `<?xml version="1.0" encoding="utf-8"?>
+${serialize(doc)}
+`;
+  return { info, xml };
+}
+function parseManifest(xml, dir) {
+  const $ = (0, import_cheerio.load)(xml, { xml: true });
+  return {
+    package: $("manifest[package]").attr("package"),
+    versionCode: $("manifest").attr("android:versionCode"),
+    versionName: $("manifest").attr("android:versionName"),
+    appName: $("manifest application").attr("android:label"),
+    dir
+  };
+}
+async function readManifest(apkDir) {
+  const manifestPath = import_node_path.default.join(apkDir, "AndroidManifest.xml");
+  if (!await fileExists(manifestPath)) return null;
+  const bytes = await (0, import_promises3.readFile)(manifestPath);
+  if (isBinaryManifest(bytes)) {
+    return parseBinaryManifest(bytes, apkDir).info;
+  }
+  return parseManifest(bytes.toString("utf8"), apkDir);
+}
+function prefixFor(namespaceURI) {
+  if (!namespaceURI) return "";
+  return namespaceURI === ANDROID_NS ? "android:" : "";
+}
+function escapeXml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function serialize(node, depth = 0) {
+  const indent = "    ".repeat(depth);
+  const attrs = [];
+  if (depth === 0) attrs.push(`xmlns:android="${ANDROID_NS}"`);
+  for (const a of node.attributes ?? []) {
+    const raw = a.value ?? (a.typedValue?.value == null ? "" : String(a.typedValue.value));
+    attrs.push(`${prefixFor(a.namespaceURI)}${a.name}="${escapeXml(raw)}"`);
+  }
+  const attrText = attrs.length ? " " + attrs.join(" ") : "";
+  const children = (node.childNodes ?? []).filter((c) => c.nodeType === 1);
+  if (children.length === 0) {
+    return `${indent}<${node.nodeName}${attrText} />`;
+  }
+  const inner = children.map((c) => serialize(c, depth + 1)).join("\n");
+  return `${indent}<${node.nodeName}${attrText}>
+${inner}
+${indent}</${node.nodeName}>`;
+}
+
+// src/apk.ts
+var ASSETS_PREFIX = "assets/Resources/";
+var CLOAK_LIB_SUFFIX = "/libti.cloak.so";
+function isCloakLib(name) {
+  return name.startsWith("lib/") && name.endsWith(CLOAK_LIB_SUFFIX);
+}
+async function unpackApk(apkPath, tmpDir, debug = false) {
+  if (!await fileExists(apkPath)) {
+    throw new Error(`The given APK file doesn't exist: ${apkPath}`);
+  }
+  if (debug) console.log("preparing -> reading APK entries");
+  const entries = await readApkEntries(
+    apkPath,
+    (f) => f.name === "AndroidManifest.xml" || isDexEntry(f.name) || f.name.startsWith(ASSETS_PREFIX) || isCloakLib(f.name)
+  );
+  const apkDir = import_node_path2.default.join(process.cwd(), tmpDir) + import_node_path2.default.sep;
+  await (0, import_promises4.mkdir)(apkDir, { recursive: true });
+  const dexBuffers = Object.keys(entries).filter(isDexEntry).sort().map((name) => entries[name]);
+  const cloakLibs = Object.keys(entries).filter(isCloakLib).sort().map((name) => Buffer.from(entries[name]));
+  let manifest = null;
+  const manifestBytes = entries["AndroidManifest.xml"];
+  if (manifestBytes) {
+    const { info, xml } = parseBinaryManifest(Buffer.from(manifestBytes), apkDir);
+    manifest = info;
+    await (0, import_promises4.writeFile)(import_node_path2.default.join(apkDir, "AndroidManifest.xml"), xml);
+  }
+  for (const [name, data] of Object.entries(entries)) {
+    if (!name.startsWith(ASSETS_PREFIX) || name.endsWith("/")) continue;
+    const dest = import_node_path2.default.join(apkDir, name);
+    await (0, import_promises4.mkdir)(import_node_path2.default.dirname(dest), { recursive: true });
+    await (0, import_promises4.writeFile)(dest, Buffer.from(data));
+  }
+  if (debug) console.log("preparing -> ready");
+  return { apkDir, manifest, dexBuffers, cloakLibs };
+}
+
+// src/decrypt.ts
+var import_node_crypto = require("crypto");
+function decodeJavaInt(literal) {
+  let s = literal.trim();
+  let sign = 1;
+  if (s.startsWith("+")) {
+    s = s.slice(1);
+  } else if (s.startsWith("-")) {
+    sign = -1;
+    s = s.slice(1);
+  }
+  let value;
+  if (s.startsWith("0x") || s.startsWith("0X")) {
+    value = parseInt(s.slice(2), 16);
+  } else if (s.startsWith("#")) {
+    value = parseInt(s.slice(1), 16);
+  } else if (s.length > 1 && s.startsWith("0")) {
+    value = parseInt(s.slice(1), 8);
+  } else {
+    value = parseInt(s, 10);
+  }
+  return sign * value;
+}
+function parseRanges(javaContent) {
+  const ranges = {};
+  const re = /hashMap\.put\(\s*"((?:[^"\\]|\\.)*)"\s*,\s*new Range\(\s*([^,]+?)\s*,\s*([^)]+?)\s*\)\s*\)/g;
+  let match;
+  while ((match = re.exec(javaContent)) !== null) {
+    const file = match[1];
+    const offset = match[2];
+    const length = match[3];
+    if (file === void 0 || offset === void 0 || length === void 0) continue;
+    ranges[file] = {
+      offset: decodeJavaInt(offset),
+      bytes: decodeJavaInt(length)
+    };
+  }
+  return ranges;
+}
+function parseAssetBuffer(smaliContent) {
+  const lines = smaliContent.split(/\r?\n/);
+  let started = false;
+  let titaniumVersion = "unknown";
+  let bufferLen = -1;
+  const chunks = [];
+  for (const line of lines) {
+    if (line.indexOf("private static initAssetsBytes()Ljava/nio/CharBuffer") !== -1) {
+      started = true;
+      continue;
+    }
+    if (!started) continue;
+    if (line.indexOf("const v0, ") !== -1) {
+      titaniumVersion = "<5";
+      bufferLen = decodeJavaInt(line.split("const v0, ").join("").trim());
+    } else if (line.indexOf("const/16 v0, ") !== -1) {
+      titaniumVersion = "5.x";
+      bufferLen = decodeJavaInt(line.split("const/16 v0, ").join("").trim());
+    } else if (line.indexOf("const-string v1") !== -1) {
+      let content = line.split('const-string v1, "').join("").trim();
+      content = content.slice(0, -1);
+      chunks.push(content);
+    } else if (line.indexOf("rewind()Ljava/nio/Buffer;") !== -1) {
+      break;
+    }
+  }
+  return { titaniumVersion, bufferLen, escaped: chunks.join("") };
+}
+function detectAlloy(files) {
+  return Object.keys(files).some(
+    (name) => name === "alloy.js" || name.startsWith("alloy/") || name.includes("/alloy/") || name === "_app_props_.json"
+  );
+}
+var KEY_LEN = 16;
+function decryptRange(blob, offset, length) {
+  for (const total of [blob.length - 1, blob.length]) {
+    if (total - KEY_LEN < 0) continue;
+    const key = blob.subarray(total - KEY_LEN, total);
+    for (const start of [offset, offset - 1]) {
+      if (start < 0 || start + length > blob.length) continue;
+      try {
+        const decipher = (0, import_node_crypto.createDecipheriv)("aes-128-ecb", key, null);
+        decipher.setAutoPadding(true);
+        const out = Buffer.concat([
+          decipher.update(blob.subarray(start, start + length)),
+          decipher.final()
+        ]);
+        const text = out.toString("utf8");
+        if (text !== "") return text;
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function decryptRanges(blob, ranges, debug = false) {
+  const files = {};
+  let totalBytes = 0;
+  for (const range of ranges) {
+    const content = decryptRange(blob, range.offset, range.bytes);
+    if (content === null) continue;
+    files[range.file] = { offset: range.offset, bytes: range.bytes, content };
+    totalBytes += range.bytes;
+    if (debug) console.log(`file:${range.file}, decrypted !`);
+  }
+  return { files, totalBytes };
+}
+
+// src/dex.ts
+var import_libdex_ts = require("libdex-ts");
+var WIDTHS = buildWidthTable();
+function buildWidthTable() {
+  const w = new Uint8Array(256).fill(1);
+  const set = (from, to, units) => {
+    for (let op = from; op <= to; op++) w[op] = units;
+  };
+  set(2, 3, 2);
+  w[3] = 3;
+  set(5, 6, 2);
+  w[6] = 3;
+  set(8, 9, 2);
+  w[9] = 3;
+  w[19] = 2;
+  w[20] = 3;
+  w[21] = 2;
+  w[22] = 2;
+  w[23] = 3;
+  w[24] = 5;
+  w[25] = 2;
+  w[26] = 2;
+  w[27] = 3;
+  w[28] = 2;
+  w[31] = 2;
+  w[32] = 2;
+  w[34] = 2;
+  w[35] = 2;
+  w[36] = 3;
+  w[37] = 3;
+  w[38] = 3;
+  w[41] = 2;
+  w[42] = 3;
+  w[43] = 3;
+  w[44] = 3;
+  set(45, 49, 2);
+  set(50, 55, 2);
+  set(56, 61, 2);
+  set(68, 81, 2);
+  set(82, 95, 2);
+  set(96, 109, 2);
+  set(110, 114, 3);
+  set(116, 120, 3);
+  set(144, 175, 2);
+  set(208, 215, 2);
+  set(216, 226, 2);
+  w[250] = 4;
+  w[251] = 4;
+  w[252] = 3;
+  w[253] = 3;
+  w[254] = 2;
+  w[255] = 2;
+  return w;
+}
+function instructionWidth(insns, idx) {
+  const unit = insns[idx] ?? 0;
+  const op = unit & 255;
+  if (op === 0 && unit !== 0) {
+    switch (unit) {
+      case 256: {
+        const size = insns[idx + 1] ?? 0;
+        return size * 2 + 4;
+      }
+      case 512: {
+        const size = insns[idx + 1] ?? 0;
+        return size * 4 + 2;
+      }
+      case 768: {
+        const elementWidth = insns[idx + 1] ?? 0;
+        const size = (insns[idx + 2] ?? 0) + (insns[idx + 3] ?? 0) * 65536;
+        return 4 + Math.ceil(size * elementWidth / 2);
+      }
+      default:
+        return 1;
+    }
+  }
+  return WIDTHS[op] ?? 1;
+}
+var s16 = (v) => v > 32767 ? v - 65536 : v;
+function extractStringChunks(dex, insns) {
+  const chunks = [];
+  let idx = 0;
+  while (idx < insns.length) {
+    const unit = insns[idx] ?? 0;
+    const op = unit & 255;
+    if (op === 26) {
+      chunks.push(dex.getStringById(insns[idx + 1] ?? 0));
+    } else if (op === 27) {
+      chunks.push(dex.getStringById((insns[idx + 1] ?? 0) + (insns[idx + 2] ?? 0) * 65536));
+    }
+    idx += instructionWidth(insns, idx);
+  }
+  return chunks;
+}
+function extractRanges(dex, insns) {
+  const regInt = /* @__PURE__ */ new Map();
+  const regStr = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Map();
+  const ranges = [];
+  const resolveInvoke = (methodIdx, args) => {
+    const mid = dex.getMethodId(methodIdx);
+    const cls = dex.getTypeDescriptorByIdx(mid.classIdx);
+    const name = dex.getStringById(mid.nameIdx);
+    if (name === "<init>" && /[/$]Range;$/.test(cls) && args.length >= 3) {
+      const offset = regInt.get(args[1]);
+      const length = regInt.get(args[2]);
+      if (offset !== void 0 && length !== void 0) {
+        pending.set(args[0], { offset, length });
+      }
+    } else if (name === "put" && args.length >= 3) {
+      const key = regStr.get(args[1]);
+      const range = pending.get(args[2]);
+      if (key !== void 0 && range) {
+        ranges.push({ file: key, offset: range.offset, bytes: range.length });
+      }
+    }
+  };
+  let idx = 0;
+  while (idx < insns.length) {
+    const unit = insns[idx] ?? 0;
+    const op = unit & 255;
+    switch (op) {
+      case 18: {
+        const a = unit >> 8 & 15;
+        let v = unit >> 12 & 15;
+        if (v > 7) v -= 16;
+        regInt.set(a, v);
+        break;
+      }
+      case 19: {
+        regInt.set(unit >> 8 & 255, s16(insns[idx + 1] ?? 0));
+        break;
+      }
+      case 20: {
+        const v = (insns[idx + 1] ?? 0) | (insns[idx + 2] ?? 0) << 16 | 0;
+        regInt.set(unit >> 8 & 255, v);
+        break;
+      }
+      case 21: {
+        regInt.set(unit >> 8 & 255, (insns[idx + 1] ?? 0) << 16 | 0);
+        break;
+      }
+      case 26: {
+        regStr.set(unit >> 8 & 255, dex.getStringById(insns[idx + 1] ?? 0));
+        break;
+      }
+      case 27: {
+        regStr.set(
+          unit >> 8 & 255,
+          dex.getStringById((insns[idx + 1] ?? 0) + (insns[idx + 2] ?? 0) * 65536)
+        );
+        break;
+      }
+      case 110:
+      case 111:
+      case 112:
+      case 113:
+      case 114: {
+        const a = unit >> 12 & 15;
+        const g = unit >> 8 & 15;
+        const methodIdx = insns[idx + 1] ?? 0;
+        const regsWord = insns[idx + 2] ?? 0;
+        const args = [
+          regsWord & 15,
+          regsWord >> 4 & 15,
+          regsWord >> 8 & 15,
+          regsWord >> 12 & 15,
+          g
+        ].slice(0, a);
+        resolveInvoke(methodIdx, args);
+        break;
+      }
+      case 116:
+      case 117:
+      case 118:
+      case 119:
+      case 120: {
+        const count = unit >> 8 & 255;
+        const methodIdx = insns[idx + 1] ?? 0;
+        const first = insns[idx + 2] ?? 0;
+        const args = [];
+        for (let i = 0; i < count; i++) args.push(first + i);
+        resolveInvoke(methodIdx, args);
+        break;
+      }
+    }
+    idx += instructionWidth(insns, idx);
+  }
+  return ranges;
+}
+function detectVersion(insns) {
+  let idx = 0;
+  while (idx < insns.length) {
+    const op = (insns[idx] ?? 0) & 255;
+    if (op === 20) return "<5";
+    if (op === 19) return "5.x";
+    if (op === 26 || op === 27) break;
+    idx += instructionWidth(insns, idx);
+  }
+  return "unknown";
+}
+var s32 = (lo, hi) => lo | hi << 16 | 0;
+function readFillArrayBytes(insns, payloadIdx) {
+  if (payloadIdx < 0 || (insns[payloadIdx] ?? 0) !== 768) return null;
+  const elementWidth = insns[payloadIdx + 1] ?? 0;
+  if (elementWidth !== 1) return null;
+  const size = (insns[payloadIdx + 2] ?? 0) + (insns[payloadIdx + 3] ?? 0) * 65536;
+  const out = Buffer.alloc(size);
+  const dataStart = payloadIdx + 4;
+  for (let j = 0; j < size; j++) {
+    const unit = insns[dataStart + (j >> 1)] ?? 0;
+    out[j] = (j & 1) === 1 ? unit >> 8 & 255 : unit & 255;
+  }
+  return out;
+}
+function extractByteArrayFields(dex, insns) {
+  const pending = /* @__PURE__ */ new Map();
+  const fields = {};
+  let idx = 0;
+  while (idx < insns.length) {
+    const unit = insns[idx] ?? 0;
+    const op = unit & 255;
+    if (op === 38) {
+      const reg = unit >> 8 & 255;
+      const off = s32(insns[idx + 1] ?? 0, insns[idx + 2] ?? 0);
+      const bytes = readFillArrayBytes(insns, idx + off);
+      if (bytes) pending.set(reg, bytes);
+    } else if (op === 105) {
+      const reg = unit >> 8 & 255;
+      const bytes = pending.get(reg);
+      if (bytes) {
+        const fieldId = dex.getFieldId(insns[idx + 1] ?? 0);
+        fields[dex.getStringById(fieldId.nameIdx)] = bytes;
+      }
+    }
+    idx += instructionWidth(insns, idx);
+  }
+  return fields;
+}
+function extractCloakSalt(dex, classDef) {
+  const clinit = methodCode(dex, classDef, "<clinit>");
+  if (!clinit) return null;
+  const fields = extractByteArrayFields(dex, clinit.insns);
+  if (fields.salt) return fields.salt;
+  const sixteen = Object.values(fields).filter((b) => b.length === 16);
+  return sixteen.length === 1 ? sixteen[0] : null;
+}
+function findAssetCryptClassDef(dex, packageHint) {
+  if (packageHint) {
+    const descriptor = `L${packageHint.split(".").join("/")}/AssetCryptImpl;`;
+    const byHint = dex.getClassDefByDescriptor(descriptor);
+    if (byHint) return byHint;
+  }
+  for (let i = 0; i < dex.header.classDefsSize; i++) {
+    const classDef = dex.getClassDef(i);
+    const descriptor = dex.getTypeDescriptorByIdx(classDef.classIdx);
+    if (descriptor.endsWith("/AssetCryptImpl;")) return classDef;
+  }
+  return null;
+}
+function methodCode(dex, classDef, methodName) {
+  const classData = dex.getClassData(classDef);
+  for (const list of [classData.directMethods, classData.virtualMethods]) {
+    let methodIdx = 0;
+    for (const method of list) {
+      methodIdx += method.methodIdx;
+      const name = dex.getStringById(dex.getMethodId(methodIdx).nameIdx);
+      if (name === methodName) return dex.getDexCode(method);
+    }
+  }
+  return null;
+}
+function readAssetCrypt(dexBuffers, packageHint) {
+  for (const bytes of dexBuffers) {
+    let dex;
+    try {
+      dex = new import_libdex_ts.DexFile(bytes);
+    } catch {
+      continue;
+    }
+    const classDef = findAssetCryptClassDef(dex, packageHint);
+    if (!classDef) continue;
+    const bytesCode = methodCode(dex, classDef, "initAssetsBytes");
+    if (!bytesCode) return { kind: "newscheme", salt: extractCloakSalt(dex, classDef) };
+    const assetsCode = methodCode(dex, classDef, "initAssets");
+    const chunks = extractStringChunks(dex, bytesCode.insns);
+    const blob = Buffer.from(chunks.join(""), "latin1");
+    const ranges = assetsCode ? extractRanges(dex, assetsCode.insns) : [];
+    const titaniumVersion = detectVersion(bytesCode.insns);
+    return { kind: "classic", data: { blob, ranges, titaniumVersion } };
+  }
+  return { kind: "none" };
+}
+
+// src/cloak.ts
+var import_node_crypto2 = require("crypto");
+var import_node_zlib = require("zlib");
+var KEY_LEN2 = 16;
+var BLOCK_BASE = 8200;
+function deriveCloakKey(so, salt) {
+  if (salt.length !== KEY_LEN2) return null;
+  try {
+    if (so.length < BLOCK_BASE + 64) return null;
+    const randomOffset = so.readUInt8(BLOCK_BASE + 62);
+    const xor = Buffer.concat([
+      so.subarray(BLOCK_BASE + 1, BLOCK_BASE + 5),
+      so.subarray(BLOCK_BASE + randomOffset, BLOCK_BASE + randomOffset + 4),
+      so.subarray(BLOCK_BASE + 15, BLOCK_BASE + 15 + 4),
+      so.subarray(BLOCK_BASE + 30, BLOCK_BASE + 30 + 4)
+    ]);
+    if (xor.length < KEY_LEN2) return null;
+    const key = Buffer.alloc(KEY_LEN2);
+    for (let i = 0; i < KEY_LEN2; i++) key[i] = (salt[i] ?? 0) ^ (xor[i] ?? 0);
+    return key;
+  } catch {
+    return null;
+  }
+}
+function decryptCloakAsset(bin, key, salt) {
+  if (key.length !== KEY_LEN2 || salt.length !== KEY_LEN2) return null;
+  try {
+    const decipher = (0, import_node_crypto2.createDecipheriv)("aes-128-cbc", key, salt);
+    decipher.setAutoPadding(true);
+    let out = Buffer.concat([decipher.update(bin), decipher.final()]);
+    if (out.length >= 2 && out[0] === 31 && out[1] === 139) {
+      try {
+        out = (0, import_node_zlib.gunzipSync)(out);
+      } catch {
+      }
+    }
+    return out;
+  } catch {
+    return null;
+  }
+}
+function isProbablyText(buf) {
+  if (buf.length === 0) return false;
+  const sample = buf.subarray(0, Math.min(buf.length, 512));
+  let control = 0;
+  for (const b of sample) {
+    if (b === 9 || b === 10 || b === 13) continue;
+    if (b < 32 || b === 127) control++;
+  }
+  return control / sample.length < 0.1;
+}
+function pickCloakKey(cloakLibs, salt, sampleBin) {
+  for (const so of cloakLibs) {
+    const key = deriveCloakKey(so, salt);
+    if (!key) continue;
+    const decrypted = decryptCloakAsset(sampleBin, key, salt);
+    if (decrypted && isProbablyText(decrypted)) return key;
+  }
+  return null;
+}
+
+// src/info.ts
+function buildInfo(input) {
+  const { manifest, memorySource, meta, developmentMode } = input;
+  const files = Object.entries(memorySource).map(([name, file]) => ({
+    name,
+    bytes: file.bytes
+  }));
+  const totalBytes = meta ? meta.totalBytes : files.reduce((sum, f) => sum + (f.bytes || 0), 0);
+  return {
+    package: manifest?.package,
+    versionCode: manifest?.versionCode,
+    versionName: manifest?.versionName,
+    appName: manifest?.appName,
+    dir: manifest?.dir,
+    developmentMode,
+    titaniumVersion: meta?.titaniumVersion ?? "unknown",
+    alloy: meta?.alloy ?? detectAlloy(memorySource),
+    files,
+    totalBytes
+  };
+}
+
+// src/reconstruct.ts
+var import_node_crypto3 = require("crypto");
+var RESOURCES_PREFIX = "Resources/";
+function reconstruct(memorySource, info) {
+  const remapped = {};
+  for (const [relPath, file] of Object.entries(memorySource)) {
+    const normalized = relPath.replace(/^[/\\]+/, "").split("\\").join("/");
+    const key = normalized.startsWith(RESOURCES_PREFIX) ? normalized : RESOURCES_PREFIX + normalized;
+    remapped[key] = file;
+  }
+  const tiappXml = buildTiappXml(info);
+  const tiappFile = {
+    offset: 0,
+    bytes: Buffer.byteLength(tiappXml, "utf8"),
+    content: tiappXml
+  };
+  remapped["tiapp.xml"] = tiappFile;
+  return { memorySource: remapped, tiappXml, alloy: info.alloy, restructured: true };
+}
+function buildTiappXml(info) {
+  const id = escapeXml2(info.package || "com.recovered.app");
+  const name = escapeXml2(info.appName || info.package || "RecoveredApp");
+  const version = escapeXml2(info.versionName || "1.0.0");
+  const guid = (0, import_node_crypto3.randomUUID)();
+  const alloyNote = info.alloy ? "\n    <!-- Reconstructed from an Alloy build: files under Resources/ are the\n         compiled output. Original app/ sources (views/styles) are not\n         recoverable from a distribution APK. -->" : "";
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!-- Reconstructed by ti_recover. Review before building. -->
+<ti:app xmlns:ti="http://ti.appcelerator.org">${alloyNote}
+    <id>${id}</id>
+    <name>${name}</name>
+    <version>${version}</version>
+    <guid>${guid}</guid>
+    <deployment-targets>
+        <target device="android">true</target>
+    </deployment-targets>
+    <android xmlns:android="http://schemas.android.com/apk/res/android"/>
+</ti:app>
+`;
+}
+function escapeXml2(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+}
+
+// src/write.ts
+var import_node_path3 = __toESM(require("path"), 1);
+var import_promises5 = require("fs/promises");
+var import_js_beautify = __toESM(require("js-beautify"), 1);
+function prettyCode(code) {
+  return import_js_beautify.default.js(code, { indent_with_tabs: true });
+}
+async function writeToDisk(memorySource, outDir) {
+  const written = [];
+  await (0, import_promises5.mkdir)(outDir, { recursive: true });
+  for (const [relPath, file] of Object.entries(memorySource)) {
+    const target = import_node_path3.default.join(outDir, relPath);
+    await (0, import_promises5.mkdir)(import_node_path3.default.dirname(target), { recursive: true });
+    let data = file.content;
+    if (typeof data === "string" && relPath.endsWith(".js")) {
+      data = prettyCode(data);
+    }
+    await (0, import_promises5.writeFile)(target, data);
+    const bytes = typeof data === "string" ? Buffer.byteLength(data, "utf8") : data.length;
+    written.push({ name: relPath, bytes });
+  }
+  return written;
+}
+async function copyAssets(apkDir, outDir, restructured = false) {
+  const manifestSrc = import_node_path3.default.join(apkDir, "AndroidManifest.xml");
+  if (await fileExists(manifestSrc)) {
+    await (0, import_promises5.mkdir)(outDir, { recursive: true });
+    await (0, import_promises5.copyFile)(manifestSrc, import_node_path3.default.join(outDir, "AndroidManifest.xml"));
+  }
+  const resourcesSrc = import_node_path3.default.join(apkDir, "assets", "Resources");
+  if (await dirExists(resourcesSrc)) {
+    const dest = restructured ? import_node_path3.default.join(outDir, "Resources") : outDir;
+    await (0, import_promises5.mkdir)(dest, { recursive: true });
+    await (0, import_promises5.cp)(resourcesSrc, dest, {
+      recursive: true,
+      filter: (src) => !src.endsWith(".bin")
+    });
+  }
+}
+
+// src/index.ts
+var UnsupportedEncryptionError = class extends Error {
+  constructor(reason) {
+    super(
+      "This APK uses Titanium's newer ti.cloak asset encryption (.bin assets). " + (reason ?? "Its AES key could not be derived from the bundled native library, so the sources could not be recovered.")
+    );
+    this.name = "UnsupportedEncryptionError";
+  }
+};
+var DEV_SOURCE_EXTENSIONS = [".js", ".json", ".xml", ".tss", ".rjss", ".jss", ".css"];
+var DEFAULT_CONFIG = {
+  tmpDir: "_tmp",
+  debug: false
+};
+var TiRecover = class {
+  cwd = process.cwd();
+  config;
+  apkDir = "";
+  tmpUsed = false;
+  manifest = null;
+  dexBuffers = [];
+  cloakLibs = [];
+  assetCrypt = { kind: "none" };
+  developmentMode = false;
+  tested = false;
+  isTitanium = false;
+  memorySource = {};
+  meta;
+  restructured = false;
+  constructor(config = {}) {
+    this.config = { ...DEFAULT_CONFIG, ...config };
+  }
+  /** Absolute output directory (resolved against cwd for relative paths). */
+  get outDir() {
+    const out = this.config.outDir ?? "";
+    return import_node_path4.default.isAbsolute(out) ? out : import_node_path4.default.resolve(this.cwd, out);
+  }
+  log(message) {
+    if (this.config.debug) console.log(message);
+  }
+  /**
+   * Prepares the working directory. If `apkDir` is supplied it is used directly
+   * (reading any `classes*.dex` and manifest found there); otherwise the
+   * configured `apk` is unzipped into `tmpDir`.
+   */
+  async init() {
+    if (this.config.apkDir) {
+      this.apkDir = this.config.apkDir.endsWith(import_node_path4.default.sep) ? this.config.apkDir : this.config.apkDir + import_node_path4.default.sep;
+      this.dexBuffers = await readDexBuffersFromDir(this.apkDir);
+      this.cloakLibs = await readCloakLibsFromDir(this.apkDir);
+      this.manifest = await readManifest(this.apkDir);
+      return;
+    }
+    if (!this.config.apk) {
+      throw new Error("init() requires either 'apk' or 'apkDir' in the config.");
+    }
+    const apkResolved = import_node_path4.default.isAbsolute(this.config.apk) ? this.config.apk : import_node_path4.default.resolve(this.cwd, this.config.apk);
+    const result = await unpackApk(apkResolved, this.config.tmpDir, this.config.debug);
+    this.apkDir = result.apkDir;
+    this.manifest = result.manifest;
+    this.dexBuffers = result.dexBuffers;
+    this.cloakLibs = result.cloakLibs;
+    this.tmpUsed = true;
+  }
+  /**
+   * Returns `true` if the prepared APK was built with Titanium (in either
+   * distribution or development mode), populating internal detection state.
+   */
+  async test() {
+    if (!this.apkDir) {
+      throw new Error("Call init() before test().");
+    }
+    if (!this.manifest) {
+      this.manifest = await readManifest(this.apkDir);
+    }
+    this.tested = true;
+    this.assetCrypt = readAssetCrypt(this.dexBuffers, this.manifest?.package);
+    if (this.assetCrypt.kind !== "none") {
+      this.developmentMode = false;
+      this.isTitanium = true;
+      return true;
+    }
+    const appDev = import_node_path4.default.join(this.apkDir, "assets", "Resources", "app.js");
+    if (await fileExists(appDev)) {
+      this.developmentMode = true;
+      this.isTitanium = true;
+      return true;
+    }
+    this.isTitanium = false;
+    return false;
+  }
+  /**
+   * Extracts recovered sources into memory. For distribution builds this
+   * decrypts the AES asset blob (from data lifted out of the DEX); for
+   * development builds it reads the plain `assets/Resources` tree.
+   */
+  async extract() {
+    if (!this.tested) await this.test();
+    if (!this.isTitanium) {
+      throw new Error("The given APK was not created using Appcelerator Titanium.");
+    }
+    if (!this.developmentMode) {
+      if (this.assetCrypt.kind === "newscheme") {
+        const files2 = await this.recoverCloak(this.assetCrypt.salt);
+        if (!files2) throw new UnsupportedEncryptionError();
+        this.memorySource = files2;
+        return files2;
+      }
+      if (this.assetCrypt.kind !== "classic") {
+        throw new Error("No recoverable Titanium asset data was found in the APK.");
+      }
+      const { blob, ranges, titaniumVersion } = this.assetCrypt.data;
+      const { files, totalBytes } = decryptRanges(blob, ranges, this.config.debug);
+      this.memorySource = files;
+      this.meta = { totalBytes, titaniumVersion, alloy: detectAlloy(files) };
+      return files;
+    }
+    const baseAssets = import_node_path4.default.join(this.apkDir, "assets", "Resources");
+    const relFiles = await readSourceFiles(baseAssets);
+    const source = {};
+    for (const rel of relFiles) {
+      const content = await (0, import_promises6.readFile)(import_node_path4.default.join(baseAssets, rel));
+      source[rel.split(import_node_path4.default.sep).join("/")] = {
+        offset: 0,
+        bytes: content.length,
+        content
+      };
+    }
+    this.memorySource = source;
+    return source;
+  }
+  /**
+   * Attempts ti.cloak (.bin) recovery: derive the AES key from a bundled
+   * `libti.cloak.so` + the `salt` lifted from `AssetCryptImpl`, then AES-128-CBC
+   * decrypt every `Resources/*.bin` asset. Returns the recovered sources, or
+   * `null` when the salt/native lib is missing or no key validates.
+   */
+  async recoverCloak(salt) {
+    if (!salt) {
+      this.log("ti.cloak-> no salt found in AssetCryptImpl; cannot derive key");
+      return null;
+    }
+    if (this.cloakLibs.length === 0) {
+      this.log("ti.cloak-> no libti.cloak.so bundled in the APK; cannot derive key");
+      return null;
+    }
+    const baseAssets = import_node_path4.default.join(this.apkDir, "assets", "Resources");
+    const bins = await readCloakBinFiles(baseAssets);
+    if (bins.length === 0) {
+      this.log("ti.cloak-> no .bin assets found under assets/Resources");
+      return null;
+    }
+    const sample = bins.find((b) => b.rel.endsWith(".js")) ?? bins[0];
+    const key = pickCloakKey(this.cloakLibs, salt, await (0, import_promises6.readFile)(sample.abs));
+    if (!key) {
+      this.log("ti.cloak-> could not derive a valid AES key from libti.cloak.so");
+      return null;
+    }
+    const source = {};
+    let totalBytes = 0;
+    for (const bin of bins) {
+      const decrypted = decryptCloakAsset(await (0, import_promises6.readFile)(bin.abs), key, salt);
+      if (!decrypted) continue;
+      const isText = DEV_SOURCE_EXTENSIONS.includes(import_node_path4.default.extname(bin.rel).toLowerCase());
+      source[bin.rel] = {
+        offset: 0,
+        bytes: decrypted.length,
+        content: isText ? decrypted.toString("utf8") : decrypted
+      };
+      totalBytes += decrypted.length;
+      this.log(`ti.cloak-> decrypted ${bin.rel}`);
+    }
+    if (Object.keys(source).length === 0) return null;
+    this.meta = { totalBytes, titaniumVersion: "unknown", alloy: detectAlloy(source) };
+    return source;
+  }
+  /**
+   * Returns Titanium metadata for the current APK. Must be called after
+   * {@link extract} to include the recovered file list.
+   */
+  async info() {
+    if (!this.manifest && this.apkDir) {
+      this.manifest = await readManifest(this.apkDir);
+    }
+    return buildInfo({
+      manifest: this.manifest,
+      memorySource: this.memorySource,
+      meta: this.meta,
+      developmentMode: this.developmentMode
+    });
+  }
+  /**
+   * Rebuilds the in-memory sources into a Titanium-openable project structure
+   * (everything under `Resources/`, plus a synthesised `tiapp.xml`).
+   */
+  async reconstruct() {
+    if (Object.keys(this.memorySource).length === 0) {
+      throw new Error("Call extract() before reconstruct().");
+    }
+    const info = await this.info();
+    const result = reconstruct(this.memorySource, info);
+    this.memorySource = result.memorySource;
+    this.restructured = result.restructured;
+    return this.memorySource;
+  }
+  /** Writes the in-memory sources to the configured `outDir`. */
+  async writeToDisk() {
+    if (!this.config.outDir) {
+      throw new Error("writeToDisk() requires 'outDir' in the config.");
+    }
+    if (Object.keys(this.memorySource).length === 0) {
+      throw new Error("Call extract() before writeToDisk().");
+    }
+    const written = await writeToDisk(this.memorySource, this.outDir);
+    for (const file of written) {
+      const size = file.bytes > 1e3 ? `${Math.round(file.bytes / 1024)} KB` : `${file.bytes} Bytes`;
+      this.log(`writeToDisk-> file ${file.name} written (${size}).`);
+    }
+    return written;
+  }
+  /** Copies the APK's static assets and manifest into `outDir`. */
+  async copyAssets() {
+    if (!this.config.outDir) {
+      throw new Error("copyAssets() requires 'outDir' in the config.");
+    }
+    await copyAssets(this.apkDir, this.outDir, this.restructured);
+  }
+  /** Removes the temporary directory created during {@link init}. */
+  async clean() {
+    if (!this.tmpUsed || !this.apkDir) return;
+    try {
+      await (0, import_promises6.rm)(this.apkDir, { recursive: true, force: true });
+      this.log("clean->ok");
+    } catch {
+    }
+  }
+};
+async function recover(options) {
+  const { reconstruct: reconstruct2 = false, clean = true, ...config } = options;
+  const ti = new TiRecover(config);
+  try {
+    await ti.init();
+    if (!await ti.test()) {
+      return { recovered: false };
+    }
+    await ti.extract();
+    const info = await ti.info();
+    if (reconstruct2) {
+      await ti.reconstruct();
+    }
+    const files = await ti.writeToDisk();
+    await ti.copyAssets();
+    return { recovered: true, info, files };
+  } finally {
+    if (clean) await ti.clean();
+  }
+}
+async function readDexBuffersFromDir(dir) {
+  if (!await dirExists(dir)) return [];
+  const names = (await (0, import_promises6.readdir)(dir)).filter(isDexEntry).sort();
+  const buffers = [];
+  for (const name of names) {
+    buffers.push(await (0, import_promises6.readFile)(import_node_path4.default.join(dir, name)));
+  }
+  return buffers;
+}
+async function readCloakLibsFromDir(dir) {
+  const libDir = import_node_path4.default.join(dir, "lib");
+  if (!await dirExists(libDir)) return [];
+  const entries = await (0, import_promises6.readdir)(libDir, { recursive: true, withFileTypes: true });
+  const libs = [];
+  for (const entry of entries) {
+    if (!entry.isFile() || entry.name !== "libti.cloak.so") continue;
+    const parent = entry.parentPath ?? entry.path ?? libDir;
+    libs.push(await (0, import_promises6.readFile)(import_node_path4.default.join(parent, entry.name)));
+  }
+  return libs;
+}
+async function readCloakBinFiles(base) {
+  if (!await dirExists(base)) return [];
+  const entries = await (0, import_promises6.readdir)(base, { recursive: true, withFileTypes: true });
+  const bins = [];
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith(".bin")) continue;
+    const parent = entry.parentPath ?? entry.path ?? base;
+    const abs = import_node_path4.default.join(parent, entry.name);
+    const rel = import_node_path4.default.relative(base, abs).split(import_node_path4.default.sep).join("/").replace(/\.bin$/, "");
+    bins.push({ rel, abs });
+  }
+  return bins;
+}
+async function readSourceFiles(base) {
+  if (!await dirExists(base)) return [];
+  const entries = await (0, import_promises6.readdir)(base, { recursive: true, withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const ext = import_node_path4.default.extname(entry.name).toLowerCase();
+    if (!DEV_SOURCE_EXTENSIONS.includes(ext)) continue;
+    const parentPath = entry.parentPath ?? entry.path ?? base;
+    const abs = import_node_path4.default.join(parentPath, entry.name);
+    files.push(import_node_path4.default.relative(base, abs));
+  }
+  return files;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  TiRecover,
+  UnsupportedEncryptionError,
+  buildInfo,
+  buildReconstruct,
+  buildTiappXml,
+  decodeJavaInt,
+  decryptCloakAsset,
+  decryptRange,
+  decryptRanges,
+  deriveCloakKey,
+  detectAlloy,
+  extractByteArrayFields,
+  extractCloakSalt,
+  extractRanges,
+  extractStringChunks,
+  instructionWidth,
+  isProbablyText,
+  parseAssetBuffer,
+  parseBinaryManifest,
+  parseManifest,
+  parseRanges,
+  pickCloakKey,
+  readAssetCrypt,
+  recover
+});
+//# sourceMappingURL=index.cjs.map