我的御剑日记

此游戏23-5-28上线公测，我在bilibili上刷到的铺天盖地的广告。于是下载过来看看，到底美术素材有多牛逼。

游戏使用creator进行开发，应该是比较新的creator版本，估计是2.4版本

每一个游戏都拥有相同的头数据，起码AB是固定的开头，然后街上5个0。

毫无疑问素材进行了加密，固定的开头起到了通知作用，通知游戏引擎在读取此文件的时候需要进行解密操作。

此加密似乎对所有的文件进行了加密操作。

接下来将对cocos2djs.so进行初步反编译操作。

找到解密函数 cocos2d::FileUtils::decryptYF

v5 = *a2;
v6 = a2;
v7 = a3;
v8 = v5 == 0x41;
if ( v5 == 0x41 )
  v8 = a2[1] == 0x42;
if ( v8 )
{
  v9 = a2[5] | (a2[4] << 8);
  v10 = (a2[11] | (a2[10] << 8) | (v9 << 16)) % (a2[15] | (a2[14] << 8)) + (a2[11] | (a2[10] << 8) | (v9 << 16));
  v11 = v6[13] | ((v6[3] | (v6[2] << 8)) << 16) | (v6[12] << 8);
  v12 = v11 % 3;
  if ( !(v10 & 3) )
    v12 = 3;
  if ( v10 >= v7 )
    v10 = v7;
  if ( v10 >= 1 )
  {
    v13 = 0;
    do
    {
      v6[v11 + 16 + v13] ^= byte_1AED1BB[33 * v12 + (v11 + v13) % 33];
      ++v13;
    }
    while ( v13 < v10 );
  }
  result = v6 + 16;
  if ( a4 )
    *a4 = v7 - 16;
}

附上python解密代码

import os  

code = [
    0x11, 0x2B, 0x65, 0x78, 0x17, 0xC, 0xD, 0x17, 0x15,0x35, 0x62, 0x65, 0x7B, 0x62, 0x15, 0x7F, 0x11, 0x2C,0x63, 0x17, 0x4D, 0x57, 0xC, 0x59, 0xB, 0x20, 0x65,0x21, 0x20, 0x63, 0xC, 0x7F, 0x12, 0x75, 4, 0xA, 0xC
    ,0x7B, 0x15, 0x10, 0x21, 0x36, 0x37, 0x1B, 0x23, 0x65,0x64, 0xB, 0xF, 0x47, 0x2F, 0x5A, 0x24, 0x11, 0x59,0x41, 0x4C, 0x5B, 0x21, 0x66, 0x5A, 0x31, 0x40, 0x51,0x7E, 0xD, 0x15, 0x43, 0x2D, 0x27, 0x58, 0x51, 0xF
    ,0x57, 0x15, 0x13, 0x24, 0x14, 0xE, 0x2B, 0x25, 0x16,0x1F, 0xE, 0x4E, 0xE, 0x3F, 0x29, 0x42, 0x52, 0x10,0x29, 0xF, 0x69, 0x65, 0x49, 0x1C, 0x20, 0x42, 0x54,0x22, 0x3D, 0x4A, 7, 0x37, 0x4D, 0x11, 0x63, 0x69,
    0x65, 0x13, 0x4A, 0x2D, 0x2D, 0x4B, 0x41, 0x59, 0xE,0x73, 0x24, 0x4E, 0x15, 0x62, 0x77, 0x10, 0x32, 0x3C,0x46, 0x50, 0x5A, 0x64, 0x6E
]

for dir,dirs,files in os.walk("assets"):
    for file in files:
        path = os.path.join(dir,file)

        f = open(path,"rb")
        info = bytearray(f.read()) 
        f.close()

        size = len(info)

        if size >= 2 and info[0:2] == b"AB":
            v5 = info[0]
            v6 = info
            v7 = size
 
            v9 = info[5] | (info[4] << 8)
            v10 = (info[11] | (info[10] << 8) | (v9 << 16)) % (info[15] | (info[14] << 8)) + (info[11] | (info[10] << 8) | (v9 << 16))
            v11 = (v6[13] | ((v6[3] | (v6[2] << 8)) << 16) | (v6[12] << 8))
            v12 = v11 % 3
            if not(v10 & 3):
                v12 = 3
            if v10 >= v7:
                v10 = v7
            if v10 >= 1:
                v13 = 0
                while v13 < v10:
                    v6[v11 + 16 + v13] ^= code[33 * v12 + (v11 + v13) % 33]
                    v13 += 1

            f = open(path,'wb')
            f.write(v6[16:])
            f.close()
            print(path) 

最后修改于 2023-05-20