titanium-apk-recover 2.2.2 → 2.3.1

package/dist/index.cjs

@@ -35,14 +35,17 @@ __export(src_exports, {
   buildInfo: () => buildInfo,
   buildReconstruct: () => reconstruct,
   buildTiappXml: () => buildTiappXml,
+  cloakKeyCandidates: () => cloakKeyCandidates,
   decodeJavaInt: () => decodeJavaInt,
   decryptCloakAsset: () => decryptCloakAsset,
   decryptRange: () => decryptRange,
   decryptRanges: () => decryptRanges,
   deriveCloakKey: () => deriveCloakKey,
+  deriveKeyFromBlock: () => deriveKeyFromBlock,
   detectAlloy: () => detectAlloy,
   extractByteArrayFields: () => extractByteArrayFields,
   extractCloakSalt: () => extractCloakSalt,
+  extractKeyBlock: () => extractKeyBlock,
   extractRanges: () => extractRanges,
   extractStringChunks: () => extractStringChunks,
   instructionWidth: () => instructionWidth,
@@ -629,26 +632,109 @@ function readAssetCrypt(dexBuffers, packageHint) {
 var import_node_crypto2 = require("crypto");
 var import_node_zlib = require("zlib");
 var KEY_LEN2 = 16;
-var BLOCK_BASE = 8200;
-function deriveCloakKey(so, salt) {
-  if (salt.length !== KEY_LEN2) return null;
+var BLOCK_LEN = 64;
+var FALLBACK_BLOCK_OFFSETS = [8200, 8196, 8208, 12292, 16388];
+function extractKeyBlock(so) {
   try {
-    if (so.length < BLOCK_BASE + 64) return null;
-    const randomOffset = so.readUInt8(BLOCK_BASE + 62);
-    const xor = Buffer.concat([
-      so.subarray(BLOCK_BASE + 1, BLOCK_BASE + 5),
-      so.subarray(BLOCK_BASE + randomOffset, BLOCK_BASE + randomOffset + 4),
-      so.subarray(BLOCK_BASE + 15, BLOCK_BASE + 15 + 4),
-      so.subarray(BLOCK_BASE + 30, BLOCK_BASE + 30 + 4)
-    ]);
-    if (xor.length < KEY_LEN2) return null;
-    const key = Buffer.alloc(KEY_LEN2);
-    for (let i = 0; i < KEY_LEN2; i++) key[i] = (salt[i] ?? 0) ^ (xor[i] ?? 0);
-    return key;
+    if (so.length < 64) return null;
+    if (so[0] !== 127 || so[1] !== 69 || so[2] !== 76 || so[3] !== 70) return null;
+    const is64 = so[4] === 2;
+    const le = so[5] !== 2;
+    const u16 = (o) => le ? so.readUInt16LE(o) : so.readUInt16BE(o);
+    const u32 = (o) => le ? so.readUInt32LE(o) : so.readUInt32BE(o);
+    const u64 = (o) => Number(le ? so.readBigUInt64LE(o) : so.readBigUInt64BE(o));
+    const shoff = is64 ? u64(40) : u32(32);
+    const shentsize = u16(is64 ? 58 : 46);
+    const shnum = u16(is64 ? 60 : 48);
+    if (shoff === 0 || shnum === 0 || shentsize === 0) return null;
+    const secs = [];
+    for (let i = 0; i < shnum; i++) {
+      const b = shoff + i * shentsize;
+      if (b + shentsize > so.length) return null;
+      secs.push(
+        is64 ? {
+          type: u32(b + 4),
+          addr: u64(b + 16),
+          offset: u64(b + 24),
+          size: u64(b + 32),
+          link: u32(b + 40),
+          entsize: u64(b + 56)
+        } : {
+          type: u32(b + 4),
+          addr: u32(b + 12),
+          offset: u32(b + 16),
+          size: u32(b + 20),
+          link: u32(b + 24),
+          entsize: u32(b + 36)
+        }
+      );
+    }
+    const SHT_SYMTAB = 2;
+    const SHT_DYNSYM = 11;
+    const symSec = secs.find((s) => s.type === SHT_DYNSYM) ?? secs.find((s) => s.type === SHT_SYMTAB);
+    const strSec = symSec ? secs[symSec.link] : void 0;
+    if (!symSec || !strSec) return null;
+    const symEnt = is64 ? 24 : 16;
+    const count = Math.floor(symSec.size / (symSec.entsize || symEnt));
+    for (let i = 0; i < count; i++) {
+      const s = symSec.offset + i * symEnt;
+      if (s + symEnt > so.length) break;
+      const nameOff = strSec.offset + u32(s);
+      if (nameOff <= 0 || nameOff >= so.length) continue;
+      let end = nameOff;
+      while (end < so.length && so[end] !== 0) end++;
+      if (so.toString("latin1", nameOff, end) !== "KEY_BLOCK") continue;
+      const value = is64 ? u64(s + 8) : u32(s + 4);
+      const shndx = u16(s + (is64 ? 6 : 14));
+      const host = secs[shndx]?.addr && value >= secs[shndx].addr && value < secs[shndx].addr + secs[shndx].size ? secs[shndx] : secs.find((x) => x.addr !== 0 && x.size > 0 && value >= x.addr && value < x.addr + x.size);
+      if (!host) return null;
+      const fileOff = value - host.addr + host.offset;
+      if (fileOff < 0 || fileOff + BLOCK_LEN > so.length) return null;
+      return so.subarray(fileOff, fileOff + BLOCK_LEN);
+    }
+    return null;
   } catch {
     return null;
   }
 }
+function deriveKeyFromBlock(block, salt) {
+  if (salt.length !== KEY_LEN2 || block.length < BLOCK_LEN) return null;
+  const randomOffset = block.readUInt8(62);
+  if (randomOffset + 4 > BLOCK_LEN) return null;
+  const xor = Buffer.concat([
+    block.subarray(1, 5),
+    block.subarray(randomOffset, randomOffset + 4),
+    block.subarray(15, 15 + 4),
+    block.subarray(30, 30 + 4)
+  ]);
+  if (xor.length < KEY_LEN2) return null;
+  const key = Buffer.alloc(KEY_LEN2);
+  for (let i = 0; i < KEY_LEN2; i++) key[i] = (salt[i] ?? 0) ^ (xor[i] ?? 0);
+  return key;
+}
+function cloakKeyCandidates(so, salt) {
+  if (salt.length !== KEY_LEN2) return [];
+  const blocks = [];
+  const elf = extractKeyBlock(so);
+  if (elf) blocks.push(elf);
+  for (const off of FALLBACK_BLOCK_OFFSETS) {
+    if (off + BLOCK_LEN <= so.length) blocks.push(so.subarray(off, off + BLOCK_LEN));
+  }
+  const keys = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const block of blocks) {
+    const key = deriveKeyFromBlock(block, salt);
+    if (!key) continue;
+    const hex = key.toString("hex");
+    if (seen.has(hex)) continue;
+    seen.add(hex);
+    keys.push(key);
+  }
+  return keys;
+}
+function deriveCloakKey(so, salt) {
+  return cloakKeyCandidates(so, salt)[0] ?? null;
+}
 function decryptCloakAsset(bin, key, salt) {
   if (key.length !== KEY_LEN2 || salt.length !== KEY_LEN2) return null;
   try {
@@ -678,10 +764,10 @@ function isProbablyText(buf) {
 }
 function pickCloakKey(cloakLibs, salt, sampleBin) {
   for (const so of cloakLibs) {
-    const key = deriveCloakKey(so, salt);
-    if (!key) continue;
-    const decrypted = decryptCloakAsset(sampleBin, key, salt);
-    if (decrypted && isProbablyText(decrypted)) return key;
+    for (const key of cloakKeyCandidates(so, salt)) {
+      const decrypted = decryptCloakAsset(sampleBin, key, salt);
+      if (decrypted && isProbablyText(decrypted)) return key;
+    }
   }
   return null;
 }
@@ -1103,14 +1189,17 @@ async function readSourceFiles(base) {
   buildInfo,
   buildReconstruct,
   buildTiappXml,
+  cloakKeyCandidates,
   decodeJavaInt,
   decryptCloakAsset,
   decryptRange,
   decryptRanges,
   deriveCloakKey,
+  deriveKeyFromBlock,
   detectAlloy,
   extractByteArrayFields,
   extractCloakSalt,
+  extractKeyBlock,
   extractRanges,
   extractStringChunks,
   instructionWidth,