comixto 0.3.0__tar.gz

comixto-0.3.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

comixto-0.3.0/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: comixto
+Version: 0.3.0
+Summary: Pure-Python comix.to client: request signing, x-enc decrypt, WAF solver
+Author-email: fratboys <fratboys@users.noreply.github.com>
+License: MIT
+Project-URL: Homepage, https://github.com/lmaohi7181828/comix
+Project-URL: Repository, https://github.com/lmaohi7181828/comix
+Project-URL: Issues, https://github.com/lmaohi7181828/comix/issues
+Project-URL: Documentation, https://github.com/lmaohi7181828/comix/tree/main/docs
+Keywords: comix,comix.to,manga,api,crypto,waf
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.31
+Requires-Dist: orjson>=3.9
+Requires-Dist: numpy>=1.26
+Requires-Dist: Pillow>=10.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pytest-timeout>=2.0; extra == "dev"
+Dynamic: license-file
+
+# comixto
+
+Pure-Python toolkit for [comix.to](https://comix.to) by [@fratboys](https://github.com/fratboys).
+
+- **Request signing** — `1k4.*` tokens, no browser required  
+- **Response decrypt** — `x-enc: 1|2` chapter lists and protected payloads  
+- **WAF rotation captcha** — NCC-based angle solver  
+
+**Docs:** [Reverse engineering](docs/REVERSE_ENGINEERING.md) · [Crypto](docs/crypto.md) · [WAF](docs/waf.md)
+
+## Install
+
+```bash
+pip install comixto
+```
+
+## Quick start
+
+```python
+from comixto import Client
+
+# Public endpoints (no signature)
+with Client(crypto=False) as c:
+    print(c.comments(limit=3))
+
+# Signed + encrypted endpoints
+with Client() as c:
+    chapters = c.chapters("zgk6j", limit=5)
+    print(chapters["items"][0]["number"])
+    print(c.manga("zgk6j")["title"])
+```
+
+When `crypto=True` and you hit a public route, the client warns once and still
+sends the request unsigned.
+
+## Manual crypto
+
+```python
+from comixto.crypto import Crypto
+
+c = Crypto()
+params = c.sign("/manga/zgk6j/chapters", {
+    "page": 1, "limit": 2, "order[number]": "desc", "v": 0, "w": 0,
+})
+# params["_"] == "1k4...."
+```
+
+## WAF
+
+```python
+from comixto import solve_waf
+
+r = solve_waf(source="/")
+assert r["success"]
+```
+
+## License
+
+MIT

comixto-0.3.0/README.md

@@ -0,0 +1,59 @@
+# comixto
+
+Pure-Python toolkit for [comix.to](https://comix.to) by [@fratboys](https://github.com/fratboys).
+
+- **Request signing** — `1k4.*` tokens, no browser required  
+- **Response decrypt** — `x-enc: 1|2` chapter lists and protected payloads  
+- **WAF rotation captcha** — NCC-based angle solver  
+
+**Docs:** [Reverse engineering](docs/REVERSE_ENGINEERING.md) · [Crypto](docs/crypto.md) · [WAF](docs/waf.md)
+
+## Install
+
+```bash
+pip install comixto
+```
+
+## Quick start
+
+```python
+from comixto import Client
+
+# Public endpoints (no signature)
+with Client(crypto=False) as c:
+    print(c.comments(limit=3))
+
+# Signed + encrypted endpoints
+with Client() as c:
+    chapters = c.chapters("zgk6j", limit=5)
+    print(chapters["items"][0]["number"])
+    print(c.manga("zgk6j")["title"])
+```
+
+When `crypto=True` and you hit a public route, the client warns once and still
+sends the request unsigned.
+
+## Manual crypto
+
+```python
+from comixto.crypto import Crypto
+
+c = Crypto()
+params = c.sign("/manga/zgk6j/chapters", {
+    "page": 1, "limit": 2, "order[number]": "desc", "v": 0, "w": 0,
+})
+# params["_"] == "1k4...."
+```
+
+## WAF
+
+```python
+from comixto import solve_waf
+
+r = solve_waf(source="/")
+assert r["success"]
+```
+
+## License
+
+MIT

comixto-0.3.0/comixto/__init__.py

@@ -0,0 +1,24 @@
+"""comixto — pure-Python comix.to client: signing, x-enc decrypt, WAF solver."""
+
+from .client import Client
+from .crypto import Crypto, CryptoSession, canonical_message, b64url_encode, b64url_decode
+from .exceptions import APIError, ComixError, CryptoError, WAFError
+from .waf import ComixSolver, solve as solve_waf
+
+__all__ = [
+    "Client",
+    "Crypto",
+    "CryptoSession",
+    "ComixSolver",
+    "canonical_message",
+    "b64url_encode",
+    "b64url_decode",
+    "solve_waf",
+    "ComixError",
+    "CryptoError",
+    "WAFError",
+    "APIError",
+]
+
+__version__ = "0.3.0"
+__author__ = "fratboys"

comixto-0.3.0/comixto/client.py

@@ -0,0 +1,262 @@
+"""High-level HTTP client for the comix.to API."""
+
+from __future__ import annotations
+
+import warnings
+from typing import Any, Optional
+
+import orjson
+import requests
+
+from .crypto import CryptoSession
+from .exceptions import APIError
+
+
+_UNSIGNED_PREFIXES = (
+    "/user",
+    "/comments",
+    "/collections",
+    "/community",
+    "/groups",
+    "/tags",
+    "/threads",
+)
+
+
+class Client:
+    """
+    Typed, session-based client for comix.to.
+
+    When ``crypto=True`` (default), signed endpoints automatically receive a
+    ``_`` token and x-enc responses are decrypted. Public endpoints are still
+    called without a token; a short warning is emitted the first time so you
+    know crypto can be disabled for those routes.
+    """
+
+    __slots__ = (
+        "base",
+        "api",
+        "timeout",
+        "session",
+        "_crypto",
+        "_warned_unsigned",
+    )
+
+    def __init__(
+        self,
+        base: str = "https://comix.to",
+        *,
+        crypto: bool = True,
+        timeout: float = 20.0,
+        user_agent: Optional[str] = None,
+    ) -> None:
+        self.base = base.rstrip("/")
+        self.api = f"{self.base}/api/v1"
+        self.timeout = timeout
+        self.session = requests.Session()
+        self._warned_unsigned: set[str] = set()
+
+        ua = user_agent or (
+            "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 "
+            "(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+        )
+
+        self.session.headers.update(
+            {
+                "User-Agent": ua,
+                "Accept": "application/json",
+                "X-Requested-With": "XMLHttpRequest",
+            }
+        )
+
+        self._crypto: Optional[CryptoSession] = (
+            CryptoSession(self.base) if crypto else None
+        )
+
+    def close(self) -> None:
+        """Release the underlying HTTP session and crypto resources."""
+        if self._crypto is not None:
+            self._crypto.close()
+            self._crypto = None
+
+        self.session.close()
+
+    def __enter__(self) -> "Client":
+        return self
+
+    def __exit__(self, *args: object) -> None:
+        self.close()
+
+    @staticmethod
+    def _needs_sign(path: str, sign: Optional[bool]) -> bool:
+        if sign is False:
+            return False
+
+        if sign is True:
+            return True
+
+        for prefix in _UNSIGNED_PREFIXES:
+            if path == prefix or path.startswith(prefix + "/"):
+                return False
+
+        return True
+
+    def request(
+        self,
+        method: str,
+        path: str,
+        *,
+        params: Optional[dict[str, Any]] = None,
+        json_body: Any = None,
+        sign: Optional[bool] = None,
+        raw: bool = False,
+    ) -> Any:
+        """
+        Perform an API request.
+
+        ``sign``:
+          - ``None`` (default): auto — sign only when the path looks protected
+          - ``True``: always attach a ``_`` token when crypto is enabled
+          - ``False``: never sign
+
+        When crypto is enabled but the chosen endpoint does not need a token,
+        a one-time warning is emitted and the request continues unsigned.
+        """
+        if not path.startswith("/"):
+            path = f"/{path}"
+
+        params = dict(params or {})
+        do_sign = self._needs_sign(path, sign)
+
+        if do_sign and self._crypto is not None:
+            params = self._crypto.sign(method, path, params)
+        elif not do_sign and self._crypto is not None and sign is not False:
+            key = path.split("?")[0]
+            if key not in self._warned_unsigned:
+                self._warned_unsigned.add(key)
+                warnings.warn(
+                    f"crypto is enabled but {key} is a public endpoint — "
+                    f"request sent without signature (crypto can be off for this ep)",
+                    UserWarning,
+                    stacklevel=2,
+                )
+
+        url = f"{self.api}{path}"
+        kwargs: dict[str, Any] = {
+            "params": params,
+            "timeout": self.timeout,
+        }
+
+        if json_body is not None:
+            kwargs["data"] = orjson.dumps(json_body)
+            kwargs["headers"] = {"Content-Type": "application/json"}
+
+        response = self.session.request(method.upper(), url, **kwargs)
+
+        try:
+            body = orjson.loads(response.content)
+        except Exception:
+            response.raise_for_status()
+            return response.text
+
+        if raw:
+            return {
+                "status_code": response.status_code,
+                "headers": dict(response.headers),
+                "body": body,
+            }
+
+        if self._crypto is not None and response.headers.get("x-enc") in ("1", "2"):
+            body = self._crypto.decrypt(body, dict(response.headers))
+
+        if isinstance(body, dict) and body.get("status") == "ok" and "result" in body:
+            body = body["result"]
+
+        if response.status_code >= 400:
+            raise APIError(response.status_code, body)
+
+        return body
+
+    def get(self, path: str, **kwargs: Any) -> Any:
+        return self.request("GET", path, **kwargs)
+
+    def post(self, path: str, **kwargs: Any) -> Any:
+        return self.request("POST", path, **kwargs)
+
+    def me(self) -> Any:
+        return self.get("/user", sign=False)
+
+    def manga_list(self, **params: Any) -> Any:
+        return self.get("/manga", params=params)
+
+    def manga_top(
+        self,
+        type: str = "trending",
+        days: int = 1,
+        limit: int = 20,
+        **params: Any,
+    ) -> Any:
+        return self.get(
+            "/manga/top",
+            params={"type": type, "days": days, "limit": limit, **params},
+        )
+
+    def manga(self, id_or_hid: str | int) -> Any:
+        return self.get(f"/manga/{id_or_hid}")
+
+    def chapters(
+        self,
+        id_or_hid: str | int,
+        page: int = 1,
+        limit: int = 20,
+        order_number: str = "desc",
+        **params: Any,
+    ) -> Any:
+        query = {
+            "page": page,
+            "limit": limit,
+            "order[number]": order_number,
+            **params,
+        }
+        return self.get(f"/manga/{id_or_hid}/chapters", params=query)
+
+    def chapter(self, chapter_id: int | str) -> Any:
+        return self.get(f"/chapters/{chapter_id}")
+
+    def comments(self, page: int = 1, limit: int = 20) -> Any:
+        return self.get(
+            "/comments",
+            params={"page": page, "limit": limit},
+            sign=False,
+        )
+
+    def collections(self, sort: str = "newest", limit: int = 20, **params: Any) -> Any:
+        return self.get(
+            "/collections",
+            params={"sort": sort, "limit": limit, **params},
+            sign=False,
+        )
+
+    def community_posts(self, limit: int = 20, **params: Any) -> Any:
+        return self.get(
+            "/community/posts",
+            params={"limit": limit, **params},
+            sign=False,
+        )
+
+    def groups(self, limit: int = 20, **params: Any) -> Any:
+        return self.get(
+            "/groups",
+            params={"limit": limit, **params},
+            sign=False,
+        )
+
+    def search(self, keyword: str, limit: int = 20, **params: Any) -> Any:
+        return self.manga_list(keyword=keyword, limit=limit, **params)
+
+    def tags_search(self, q: str, type: str = "genre") -> Any:
+        return self.get(
+            "/tags/search",
+            params={"q": q, "type": type},
+            sign=False,
+        )

comixto-0.3.0/comixto/crypto.py

@@ -0,0 +1,252 @@
+"""Request signing and x-enc response decryption for comix.to."""
+
+from __future__ import annotations
+
+import base64
+import struct
+from pathlib import Path
+from typing import Any, Mapping, Optional
+from urllib.parse import quote, urlencode
+
+import orjson
+
+from .exceptions import CryptoError
+
+_DIR = Path(__file__).resolve().parent
+_MATERIAL_PATH = _DIR / "material.bin"
+from .material_data import _MATERIAL_B64
+
+_KID = "1k4"
+_SHA_K = (
+    0x428A2F98, 0x71374491, 0xB5C0FBCF, 0xE9B5DBA5, 0x3956C25B, 0x59F111F1, 0x923F82A4, 0xAB1C5ED5,
+    0xD807AA98, 0x12835B01, 0x243185BE, 0x550C7DC3, 0x72BE5D74, 0x80DEB1FE, 0x9BDC06A7, 0xC19BF174,
+    0xE49B69C1, 0xEFBE4786, 0x0FC19DC6, 0x240CA1CC, 0x2DE92C6F, 0x4A7484AA, 0x5CB0A9DC, 0x76F988DA,
+    0x983E5152, 0xA831C66D, 0xB00327C8, 0xBF597FC7, 0xC6E00BF3, 0xD5A79147, 0x06CA6351, 0x14292967,
+    0x27B70A85, 0x2E1B2138, 0x4D2C6DFC, 0x53380D13, 0x650A7354, 0x766A0ABB, 0x81C2C92E, 0x92722C85,
+    0xA2BFE8A1, 0xA81A664B, 0xC24B8B70, 0xC76C51A3, 0xD192E819, 0xD6990624, 0xF40E3585, 0x106AA070,
+    0x19A4C116, 0x1E376C08, 0x2748774C, 0x34B0BCB5, 0x391C0CB3, 0x4ED8AA4A, 0x5B9CCA4F, 0x682E6FF3,
+    0x748F82EE, 0x78A5636F, 0x84C87814, 0x8CC70208, 0x90BEFFFA, 0xA4506CEB, 0xBEF9A3F7, 0xC67178F2,
+)
+
+
+def b64url_encode(data: bytes) -> str:
+    """URL-safe base64 without padding."""
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def b64url_decode(s: str) -> bytes:
+    """Decode URL-safe base64 (padding restored automatically)."""
+    s = s.replace("-", "+").replace("_", "/")
+    s += "=" * (-len(s) % 4)
+    return base64.b64decode(s)
+
+
+def canonical_message(path: str, params: Optional[Mapping[str, Any]] = None) -> str:
+    """
+    Build the exact string that must be signed.
+
+    Path is normalized to start with /. Query keys are sorted alphabetically.
+    The underscore token itself is excluded.
+    """
+    if not path.startswith("/"):
+        path = f"/{path}"
+
+    if not params:
+        return path
+
+    items: list[tuple[str, Any]] = []
+
+    for key in sorted(params):
+        if key == "_":
+            continue
+
+        value = params[key]
+
+        if value is None:
+            continue
+
+        items.append((key, value))
+
+    if not items:
+        return path
+
+    def _q(s: str, *args: object, **kwargs: object) -> str:
+        return quote(str(s), safe="[]()")
+
+    return f"{path}?{urlencode(items, quote_via=_q)}"
+
+
+def _rotr(x: int, n: int) -> int:
+    return ((x >> n) | (x << (32 - n))) & 0xFFFFFFFF
+
+
+def _sha256_keyed(iv32: bytes, data: bytes, length_extra: int = 0) -> bytes:
+    """SHA-256 with custom 32-byte IV and optional length offset (site Kj)."""
+    h = list(struct.unpack(">8I", iv32[:32]))
+    bit_len = 8 * (length_extra + len(data))
+    msg = data + b"\x80"
+
+    while (len(msg) + 8) % 64 != 0:
+        msg += b"\x00"
+
+    msg += struct.pack(">Q", bit_len)
+
+    for off in range(0, len(msg), 64):
+        w = list(struct.unpack(">16I", msg[off : off + 64]))
+
+        for i in range(16, 64):
+            s0 = _rotr(w[i - 15], 7) ^ _rotr(w[i - 15], 18) ^ (w[i - 15] >> 3)
+            s1 = _rotr(w[i - 2], 17) ^ _rotr(w[i - 2], 19) ^ (w[i - 2] >> 10)
+            w.append((w[i - 16] + s0 + w[i - 7] + s1) & 0xFFFFFFFF)
+
+        a, b, c, d, e, f, g, hh = h
+
+        for i in range(64):
+            s1 = _rotr(e, 6) ^ _rotr(e, 11) ^ _rotr(e, 25)
+            ch = (e & f) ^ ((~e) & g)
+            t1 = (hh + s1 + ch + _SHA_K[i] + w[i]) & 0xFFFFFFFF
+            s0 = _rotr(a, 2) ^ _rotr(a, 13) ^ _rotr(a, 22)
+            maj = (a & b) ^ (a & c) ^ (b & c)
+            t2 = (s0 + maj) & 0xFFFFFFFF
+            hh, g, f, e, d, c, b, a = (
+                g,
+                f,
+                e,
+                (d + t1) & 0xFFFFFFFF,
+                c,
+                b,
+                a,
+                (t1 + t2) & 0xFFFFFFFF,
+            )
+
+        h = [(x + y) & 0xFFFFFFFF for x, y in zip(h, (a, b, c, d, e, f, g, hh))]
+
+    return struct.pack(">8I", *h)
+
+
+def _load_material() -> bytes:
+    if _MATERIAL_PATH.exists():
+        data = _MATERIAL_PATH.read_bytes()
+    else:
+        data = base64.b64decode(_MATERIAL_B64)
+
+    if len(data) != 1088:
+        raise CryptoError(f"material must be 1088 bytes, got {len(data)}")
+
+    return data
+
+
+class Crypto:
+    """
+    Pure-Python request signer and x-enc decryptor for the current comix.to build.
+
+    Sign: ``kid + "." + b64url(SHA256_keyed(key1, SHA256_keyed(key0, msg)))[:16]``
+    Decrypt: rotate material[64:] by header word, XOR stream, JSON from offset 4.
+    """
+
+    __slots__ = ("_material", "_kid")
+
+    def __init__(self, cfg: Optional[str] = None) -> None:
+        self._material = _load_material()
+        self._kid = _KID
+
+    def sign(self, path: str, params: Optional[Mapping[str, Any]] = None) -> dict[str, Any]:
+        """Return a new params dict with a valid ``_`` token."""
+        message = canonical_message(path, params)
+        token = self.encrypt_message(message)
+        out = dict(params or {})
+        out.pop("_", None)
+        out["_"] = token
+        return out
+
+    def encrypt_message(self, message: str) -> str:
+        """Produce ``kid.token`` for a canonical message string."""
+        data = message.encode("utf-8")
+        key0 = self._material[0:32]
+        key1 = self._material[32:64]
+        inner = _sha256_keyed(key0, data, length_extra=64)
+        outer = _sha256_keyed(key1, inner, length_extra=64)
+        return f"{self._kid}.{b64url_encode(outer)[:16]}"
+
+    def decrypt_body(self, body: Any, headers: Optional[Mapping[str, str]] = None) -> Any:
+        """
+        Decrypt an x-enc response body when the header is present.
+
+        Supports ``x-enc: 1`` and ``x-enc: 2``. Returns the original body
+        unchanged when the header is absent or not an encrypted envelope.
+        """
+        if headers is None:
+            return body
+
+        lower = {str(k).lower(): v for k, v in headers.items()}
+        xenc = lower.get("x-enc")
+
+        if xenc not in ("1", "2"):
+            return body
+
+        if not isinstance(body, dict) or "e" not in body:
+            return body
+
+        plain = self.decrypt_xenc(str(body["e"]))
+        return orjson.loads(plain)
+
+    def decrypt_xenc(self, ciphertext_b64: str) -> bytes:
+        """Decrypt an x-enc ``e`` field to plaintext JSON bytes."""
+        pad = "=" * (-len(ciphertext_b64) % 4)
+        raw = base64.b64decode(ciphertext_b64 + pad)
+
+        buf = bytearray(2) + bytearray(raw)
+        length = len(buf)
+
+        if length < 4:
+            raise CryptoError("protected response is too short")
+
+        rot = ((buf[2] << 8) | buf[3]) % 1024
+        keystream_src = self._material[64:1088]
+        keystream = bytearray(1024)
+        keystream[: 1024 - rot] = keystream_src[rot:]
+        keystream[1024 - rot :] = keystream_src[:rot]
+
+        nwords = length >> 2
+
+        for i in range(1, nwords):
+            off = i * 4
+            word = struct.unpack_from("<I", buf, off)[0]
+            ks = struct.unpack_from("<I", keystream, ((i - 1) % 256) * 4)[0]
+            struct.pack_into("<I", buf, off, word ^ ks)
+
+        for i in range(nwords << 2, length):
+            buf[i] ^= keystream[(i - 4) % 1024]
+
+        return bytes(buf[4:])
+
+    @property
+    def has_sign_table(self) -> bool:
+        return True
+
+    @property
+    def has_xenc_table(self) -> bool:
+        return True
+
+
+class CryptoSession:
+    """Session wrapper used by Client."""
+
+    __slots__ = ("base", "_crypto")
+
+    def __init__(self, base: str = "https://comix.to") -> None:
+        self.base = base.rstrip("/")
+        self._crypto = Crypto()
+
+    @property
+    def cfg(self) -> str:
+        return ""
+
+    def sign(self, method: str, path: str, params: Optional[dict[str, Any]] = None) -> dict[str, Any]:
+        return self._crypto.sign(path, params)
+
+    def decrypt(self, body: Any, headers: Optional[dict[str, str]] = None) -> Any:
+        return self._crypto.decrypt_body(body, headers)
+
+    def close(self) -> None:
+        pass

comixto-0.3.0/comixto/exceptions.py

@@ -0,0 +1,22 @@
+"""Package-level exceptions."""
+
+
+class ComixError(Exception):
+    """Base exception for all comix errors."""
+
+
+class CryptoError(ComixError):
+    """Raised when signing or decryption fails."""
+
+
+class WAFError(ComixError):
+    """Raised when the WAF solver cannot complete."""
+
+
+class APIError(ComixError):
+    """Raised for non-success API responses."""
+
+    def __init__(self, status_code: int, body: object) -> None:
+        self.status_code = status_code
+        self.body = body
+        super().__init__(f"{status_code}: {body}")

comixto-0.3.0/comixto/material_data.py

@@ -0,0 +1,23 @@
+"""Embedded session material for comixto crypto."""
+
+_MATERIAL_B64 = (
+    "BorGeUzYWG5eB8ZlHDhFzlT4VrIdLIRX4yA1JmlmZik+hGNbF4kZ/hUNYJRcryif3zMBMkv3KU+95F7h"
+    "ttX236nSeDR9cIUzSQ92pUbtHSszhBrNOb/gk6PhbuG3ku2DHHZtU5kZbcOK+x1MR8qM1Y0yoOCwSLqA"
+    "4LJi3WBTe3HQD1JJtZIbrHPyXaCLv5QirlnNnTuz+PmlkajITGpzktwz3PQU0qPHno83n1Rmwsw6XrJ1"
+    "h87KBRw16rqgDb39EgFeTH2tQzGT8W5QupWCthzbbABFlHZBk7LUCbqTzVAWX7M0OmkRJTFa6/a8yIw4"
+    "p99LeX9oRrHNlPRbCF1R+LAnWKmxqcT/r4mqy8ANq6xp8e+jdprkY3NG9lskqHwl+dvaDtoODiSsqwYI"
+    "w4XwvuMspZGu7JKxMQ0HMzg5HV+K88a3yssGfnLS+Z3rZ+rNOSl/L0glI90+JfY0RuZLl/eWhc5AIpl3"
+    "iH44TM6kqdAKS0DyzGJ3nJpRcViwq+ZvVC2FXYfPpGP8NRNlX9GPuZ4plhKoLRv50WG1P+oUtnl7BYJM"
+    "IBIUE/XAak7LrG+hex9vyE/MSVMyqQmF1cO3wYNAiMdu1Lc6MpZak58DeC8NQdiLqxC8zS1dQSmS4rBM"
+    "7oxFZDNspk1E9hIe+ystBdZrbf6y1kiGgBirZefQHxTnYU9N2xvDmaxTTVAY8ZsOtyirE5v5mq8q22uY"
+    "hpZlns4f1VASilqCHI1zZgz8Sq5vB/iWTdI0ulhRZgN1rc/8AhQ8B/9ldRGDNsyEnxxVF5eqD/kk9xe+"
+    "dAkC4sABPFY7/YB3XrzZjhMEv/roYJSiAA/ahhqExQO1bywBjMc5DVsc6KdAUK5LdvfpEdmsKkADzr70"
+    "Q0LYjRz2Qb44K1AcAV4qjgEnX2TFb7RjC6EZHo1wrjDVy0rN3rnNmQzCgFELpCcfNYpntDzUzx++qZhd"
+    "UPkpTMkZVYe7Tdiu7ujG1yLPdrlzzFFbjiKyLKy2yNgKDtUiNXRKPuIiNvMNHLqpjJwU1GTQTaWgfVll"
+    "Wx8GLx/MxtDtJEOSD+dmjoFWGY8jMcKAvDO/cZA3ALEr7tNLnVw9czgal3tMjQiaK1JMxpM6gePWbEe3"
+    "ep1tTC3q/gC/qyhDMO2U8iCJWFF4tNpXK/OuBO8OjgsLC70W/K27G5LK/N6IZXYLaVv8duMk12ydlkgq"
+    "PaLWwvZBzfeXolAPwnTtImp7QhzgYSfKryb1J6gHAmVGYvkFl0WEMKMnQru9s4uci5eNKFkbO7488vuO"
+    "EW88X7J0IGXC6WB80L+UVznqSWGjB0zV7SWQ5R9Ke8wrJhSprElChmcLqOHzdVjMke3ye985wjBr4Kxo"
+    "SkAn+IPiQAu+wepntpiUML0r2S9LudYmc+YeO/ChKBI/aV4qpOf89q2A3CZ7gB+2J5uKuirnOQCCjoSW"
+    "gIvDPIpj84Y="
+)

comixto-0.3.0/comixto/waf.py

@@ -0,0 +1,237 @@
+"""WAF rotation captcha solver for comix.to."""
+
+from __future__ import annotations
+
+import base64
+import io
+import time
+from typing import Any, Optional
+
+import numpy as np
+import orjson
+import requests
+from PIL import Image
+
+from .exceptions import WAFError
+
+
+class ComixSolver:
+    """
+    Pure-Python rotation captcha solver.
+
+    Uses normalized cross-correlation on the alpha-masked inner disk
+    to recover the correct CSS clockwise rotation angle.
+    """
+
+    __slots__ = ("base", "verbose", "timeout", "session")
+
+    def __init__(
+        self,
+        base: str = "https://comix.to",
+        *,
+        verbose: bool = True,
+        timeout: float = 12.0,
+    ) -> None:
+        self.base = base.rstrip("/")
+        self.verbose = verbose
+        self.timeout = timeout
+        self.session = requests.Session()
+        self.session.headers.update(
+            {
+                "User-Agent": "Mozilla/5.0 (Linux; Android 10) AppleWebKit/537.36",
+                "Accept": "application/json, text/html, */*",
+            }
+        )
+
+    def _log(self, msg: str) -> None:
+        if self.verbose:
+            print(msg)
+
+    @staticmethod
+    def _decode(b64: str) -> Image.Image:
+        if "," in b64:
+            b64 = b64.split(",", 1)[1]
+
+        return Image.open(io.BytesIO(base64.b64decode(b64))).convert("RGBA")
+
+    def _score(
+        self,
+        thumb: Image.Image,
+        gray: np.ndarray,
+        mask0: np.ndarray,
+        angle: float,
+        resample: int,
+        min_pix: int,
+    ) -> float:
+        rot = thumb.rotate(-angle, resample=resample, expand=False, fillcolor=(0, 0, 0, 0))
+        ra = np.asarray(rot, dtype=np.float32)
+        tg = ra[:, :, 0] * 0.299 + ra[:, :, 1] * 0.587 + ra[:, :, 2] * 0.114
+        ta = ra[:, :, 3]
+        mask = mask0 & (ta > 114.75)
+
+        if int(mask.sum()) < min_pix:
+            return -1.0
+
+        a = gray[mask]
+        a = a - a.mean()
+        b = (tg * (ta / 255.0))[mask]
+        b = b - b.mean()
+        denom = float(np.sqrt((a * a).sum() * (b * b).sum())) + 1e-12
+        return float((a * b).sum() / denom)
+
+    def find_angle(self, main: Image.Image, thumb: Image.Image) -> tuple[float, float]:
+        """
+        Recover the rotation angle of ``thumb`` relative to the center of ``main``.
+
+        Returns ``(angle_degrees, ncc_score)``.
+        """
+        mw, mh = main.size
+        tw, th = thumb.size
+
+        sm = main.resize((max(1, mw // 2), max(1, mh // 2)), Image.BILINEAR)
+        st = thumb.resize((max(1, tw // 2), max(1, th // 2)), Image.BILINEAR)
+
+        sma = np.asarray(sm, dtype=np.float32)
+        sth, stw = st.size[1], st.size[0]
+        sy0 = (sma.shape[0] - sth) // 2
+        sx0 = (sma.shape[1] - stw) // 2
+        sc = sma[sy0 : sy0 + sth, sx0 : sx0 + stw]
+
+        smg = (
+            (sc[:, :, 0] * 0.299 + sc[:, :, 1] * 0.587 + sc[:, :, 2] * 0.114)
+            * (sc[:, :, 3] / 255.0)
+        )
+        smask = sc[:, :, 3] > 114.75
+
+        best = -1.0
+        ba = 0
+
+        for a in range(0, 360, 5):
+            s = self._score(st, smg, smask, float(a), Image.NEAREST, 40)
+
+            if s > best:
+                best = s
+                ba = a
+
+        ma = np.asarray(main, dtype=np.float32)
+        y0 = (ma.shape[0] - th) // 2
+        x0 = (ma.shape[1] - tw) // 2
+        center = ma[y0 : y0 + th, x0 : x0 + tw]
+
+        mg = (
+            (center[:, :, 0] * 0.299 + center[:, :, 1] * 0.587 + center[:, :, 2] * 0.114)
+            * (center[:, :, 3] / 255.0)
+        )
+        mask0 = center[:, :, 3] > 114.75
+
+        best2 = -1.0
+        ba2 = float(ba)
+
+        for a in range(ba - 7, ba + 8):
+            for f in (0.0, 0.5):
+                ang = (a + f) % 360.0
+                s = self._score(thumb, mg, mask0, ang, Image.BILINEAR, 80)
+
+                if s > best2:
+                    best2 = s
+                    ba2 = ang
+
+        return ba2, best2
+
+    def solve(
+        self,
+        source: str = "/",
+        *,
+        max_attempts: int = 12,
+        min_score: float = 0.85,
+    ) -> dict[str, Any]:
+        """
+        Solve the WAF challenge and return cookies + session.
+
+        Returns a dict with ``success`` flag; does not raise on failure.
+        """
+        out: dict[str, Any] = {
+            "success": False,
+            "angle": None,
+            "captcha_id": None,
+            "score": None,
+            "attempts": 0,
+            "verify": None,
+            "response": None,
+            "cookies": {},
+            "session": self.session,
+            "source": source,
+        }
+
+        self.session.get(
+            f"{self.base}/@waf/challenge",
+            params={"return": source},
+            timeout=self.timeout,
+        )
+
+        for attempt in range(1, max_attempts + 1):
+            out["attempts"] = attempt
+
+            gr = self.session.get(
+                f"{self.base}/@waf/generate",
+                headers={"Accept": "application/json"},
+                timeout=self.timeout,
+            )
+
+            try:
+                data = orjson.loads(gr.content)
+            except Exception:
+                self._log(f"generate non-json status={gr.status_code}")
+                time.sleep(0.3)
+                continue
+
+            cid = data.get("captcha_id")
+
+            if not cid:
+                continue
+
+            main = self._decode(data["image_base64"])
+            thumb = self._decode(data["thumb_base64"])
+            angle, score = self.find_angle(main, thumb)
+
+            out["angle"] = angle
+            out["score"] = score
+            out["captcha_id"] = cid
+            self._log(f"angle={angle:.2f} score={score:.4f}")
+
+            vr = self.session.post(
+                f"{self.base}/@waf/verify",
+                data=orjson.dumps({"captcha_id": cid, "angle": int(round(angle))}),
+                headers={"Content-Type": "application/json"},
+                timeout=self.timeout,
+            )
+            body = orjson.loads(vr.content)
+            out["verify"] = body
+
+            if body.get("success"):
+                out["success"] = True
+                out["response"] = self.session.get(
+                    f"{self.base}{source}",
+                    timeout=self.timeout,
+                )
+                out["cookies"] = dict(self.session.cookies)
+                return out
+
+            time.sleep(0.2)
+
+        out["cookies"] = dict(self.session.cookies)
+        return out
+
+
+def solve(
+    source: str = "/",
+    *,
+    base: str = "https://comix.to",
+    verbose: bool = True,
+    max_attempts: int = 12,
+) -> dict[str, Any]:
+    """Convenience wrapper around ``ComixSolver.solve``."""
+    return ComixSolver(base=base, verbose=verbose).solve(
+        source=source,
+        max_attempts=max_attempts,
+    )

comixto-0.3.0/comixto.egg-info/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: comixto
+Version: 0.3.0
+Summary: Pure-Python comix.to client: request signing, x-enc decrypt, WAF solver
+Author-email: fratboys <fratboys@users.noreply.github.com>
+License: MIT
+Project-URL: Homepage, https://github.com/lmaohi7181828/comix
+Project-URL: Repository, https://github.com/lmaohi7181828/comix
+Project-URL: Issues, https://github.com/lmaohi7181828/comix/issues
+Project-URL: Documentation, https://github.com/lmaohi7181828/comix/tree/main/docs
+Keywords: comix,comix.to,manga,api,crypto,waf
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.31
+Requires-Dist: orjson>=3.9
+Requires-Dist: numpy>=1.26
+Requires-Dist: Pillow>=10.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pytest-timeout>=2.0; extra == "dev"
+Dynamic: license-file
+
+# comixto
+
+Pure-Python toolkit for [comix.to](https://comix.to) by [@fratboys](https://github.com/fratboys).
+
+- **Request signing** — `1k4.*` tokens, no browser required  
+- **Response decrypt** — `x-enc: 1|2` chapter lists and protected payloads  
+- **WAF rotation captcha** — NCC-based angle solver  
+
+**Docs:** [Reverse engineering](docs/REVERSE_ENGINEERING.md) · [Crypto](docs/crypto.md) · [WAF](docs/waf.md)
+
+## Install
+
+```bash
+pip install comixto
+```
+
+## Quick start
+
+```python
+from comixto import Client
+
+# Public endpoints (no signature)
+with Client(crypto=False) as c:
+    print(c.comments(limit=3))
+
+# Signed + encrypted endpoints
+with Client() as c:
+    chapters = c.chapters("zgk6j", limit=5)
+    print(chapters["items"][0]["number"])
+    print(c.manga("zgk6j")["title"])
+```
+
+When `crypto=True` and you hit a public route, the client warns once and still
+sends the request unsigned.
+
+## Manual crypto
+
+```python
+from comixto.crypto import Crypto
+
+c = Crypto()
+params = c.sign("/manga/zgk6j/chapters", {
+    "page": 1, "limit": 2, "order[number]": "desc", "v": 0, "w": 0,
+})
+# params["_"] == "1k4...."
+```
+
+## WAF
+
+```python
+from comixto import solve_waf
+
+r = solve_waf(source="/")
+assert r["success"]
+```
+
+## License
+
+MIT

comixto-0.3.0/comixto.egg-info/SOURCES.txt

@@ -0,0 +1,15 @@
+LICENSE
+README.md
+pyproject.toml
+comixto/__init__.py
+comixto/client.py
+comixto/crypto.py
+comixto/exceptions.py
+comixto/material_data.py
+comixto/waf.py
+comixto.egg-info/PKG-INFO
+comixto.egg-info/SOURCES.txt
+comixto.egg-info/dependency_links.txt
+comixto.egg-info/requires.txt
+comixto.egg-info/top_level.txt
+tests/test_smoke.py

comixto-0.3.0/comixto.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

comixto-0.3.0/comixto.egg-info/requires.txt

@@ -0,0 +1,8 @@
+requests>=2.31
+orjson>=3.9
+numpy>=1.26
+Pillow>=10.0
+
+[dev]
+pytest>=8.0
+pytest-timeout>=2.0

comixto-0.3.0/comixto.egg-info/top_level.txt

@@ -0,0 +1 @@
+comixto

comixto-0.3.0/pyproject.toml

@@ -0,0 +1,52 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "comixto"
+version = "0.3.0"
+description = "Pure-Python comix.to client: request signing, x-enc decrypt, WAF solver"
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+authors = [
+  { name = "fratboys", email = "fratboys@users.noreply.github.com" },
+]
+keywords = ["comix", "comix.to", "manga", "api", "crypto", "waf"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Topic :: Internet :: WWW/HTTP",
+  "Topic :: Security :: Cryptography",
+]
+dependencies = [
+  "requests>=2.31",
+  "orjson>=3.9",
+  "numpy>=1.26",
+  "Pillow>=10.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/lmaohi7181828/comix"
+Repository = "https://github.com/lmaohi7181828/comix"
+Issues = "https://github.com/lmaohi7181828/comix/issues"
+Documentation = "https://github.com/lmaohi7181828/comix/tree/main/docs"
+
+[project.optional-dependencies]
+dev = ["pytest>=8.0", "pytest-timeout>=2.0"]
+
+[tool.setuptools.packages.find]
+include = ["comixto*"]
+
+[tool.setuptools.package-data]
+comixto = ["*.json", "*.txt", "*.b64", "*.zlib", "*.bin"]
+
+[tool.pytest.ini_options]
+markers = [
+  "integration: hits the live comix.to API",
+]

comixto-0.3.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

comixto-0.3.0/tests/test_smoke.py

@@ -0,0 +1,132 @@
+"""Unit + integration tests."""
+
+from __future__ import annotations
+
+import warnings
+
+import pytest
+from PIL import Image
+
+from comixto import (
+    Client,
+    Crypto,
+    ComixSolver,
+    canonical_message,
+    b64url_encode,
+    b64url_decode,
+    CryptoError,
+    APIError,
+)
+
+
+def test_imports() -> None:
+    import comixto
+
+    assert hasattr(comixto, "Client")
+    assert hasattr(comixto, "Crypto")
+    assert comixto.__version__
+    assert comixto.__author__ == "fratboys"
+
+
+def test_canonical_message() -> None:
+    assert canonical_message("/manga/x") == "/manga/x"
+    assert (
+        canonical_message("/manga/x", {"page": 1, "limit": 2})
+        == "/manga/x?limit=2&page=1"
+    )
+
+
+def test_b64url_roundtrip() -> None:
+    raw = b"hello\x00world"
+    assert b64url_decode(b64url_encode(raw)) == raw
+
+
+def test_crypto_sign_known() -> None:
+    c = Crypto()
+    token = c.encrypt_message(
+        "/manga/zgk6j/chapters?limit=20&order[number]=desc&page=1&v=0&w=0"
+    )
+    assert token == "1k4.633XftayfTmyntJo"
+
+
+def test_crypto_sign_params() -> None:
+    c = Crypto()
+    params = c.sign(
+        "/manga/zgk6j/chapters",
+        {"page": 1, "limit": 20, "order[number]": "desc", "v": 0, "w": 0},
+    )
+    assert params["_"] == "1k4.633XftayfTmyntJo"
+
+
+def test_client_unsigned_warning() -> None:
+    with Client(crypto=True) as client:
+        with warnings.catch_warnings(record=True) as w:
+            warnings.simplefilter("always")
+            data = client.comments(limit=1)
+            assert data is not None
+
+
+def test_client_context() -> None:
+    with Client(crypto=False) as client:
+        assert client.session is not None
+
+
+@pytest.mark.integration
+def test_public_comments() -> None:
+    with Client(crypto=False, timeout=15) as client:
+        data = client.comments(limit=2)
+        assert data is not None
+
+
+@pytest.mark.integration
+def test_signed_chapters_decrypt() -> None:
+    with Client(crypto=True, timeout=20) as client:
+        data = client.chapters("zgk6j", page=1, limit=3, v=0, w=0)
+        assert data is not None
+        items = data.get("items") if isinstance(data, dict) else data
+        assert items
+        assert "number" in items[0] or "id" in items[0]
+
+
+@pytest.mark.integration
+def test_manga_detail() -> None:
+    with Client(crypto=True, timeout=20) as client:
+        data = client.manga("zgk6j")
+        assert data is not None
+
+
+def test_waf_score_synthetic() -> None:
+    size = 80
+    base = Image.new("RGBA", (size, size), (0, 0, 0, 0))
+    cx = cy = size // 2
+    r = size // 3
+
+    for y in range(size):
+        for x in range(size):
+            dx, dy = x - cx, y - cy
+            if dx * dx + dy * dy < r * r:
+                base.putpixel((x, y), (180, 90, 40, 230))
+
+    for y in range(cy - 5, cy + 5):
+        for x in range(cx + r // 2 - 3, cx + r // 2 + 3):
+            if 0 <= x < size and 0 <= y < size:
+                base.putpixel((x, y), (255, 255, 255, 255))
+
+    angle_true = 42.0
+    thumb = base.rotate(
+        -angle_true,
+        resample=Image.BILINEAR,
+        expand=False,
+        fillcolor=(0, 0, 0, 0),
+    )
+    main = Image.new("RGBA", (size + 40, size + 40), (40, 40, 40, 255))
+    main.paste(base, (20, 20), base)
+
+    solver = ComixSolver(verbose=False)
+    angle, score = solver.find_angle(main, thumb)
+    assert score > 0.8
+
+
+def test_api_error() -> None:
+    err = APIError(403, {"msg": "forbidden"})
+    assert err.status_code == 403