School_of_Lust_x0.9.6a解包技术报告

52 50 47 4D 56 00 00 00 00 03 01 00 00 00 00 00

plain[0..15]  = field[0..15] XOR M
plain[16..]   = blob[32..]
M = 0B A9 E8 88 58 EB 6F 1D 2B 52 1C A7 05 9F 96 BF

data  len=9369   first16=5b0a6e756c6c2c0a7b226964223a312c   （JSON 开头）
image len=742715 first16=89504e470d0a1a0a0000000d49484452   （PNG 开头）

IV_correct = IV_from_name XOR P_got[0..15] XOR PNG_HEAD[0..15]

#!/usr/bin/env node
// Unpacker / verifier for School of Lust x0.9.6a (NW.js + RPG Maker MV repack)
// Usage:
//   node unpack_sol.js --www <www dir> --out <output dir> [--mode encrypted|full]
//   node unpack_sol.js --www <www dir> --check    (read-only, writes nothing)

const fs = require('fs');
const path = require('path');
const vm = require('vm');
const crypto = require('crypto');

const IMG_KEY = Buffer.from('HARDmae0qBokfe91IvTiTSQBWDAnoPOEPmr5938C0RE'.replace(/-/g, '+').replace(/_/g, '/') + '=', 'base64');
const DATA_KEY = Buffer.from('XXXXmae0qBokfe91IvZZZZQBWDAnoDV8QQQQ938XXXX'.replace(/-/g, '+').replace(/_/g, '/') + '=', 'base64');
const RPGMV_MASK = Buffer.from('0ba9e88858eb6f1d2b521ca7059f96bf', 'hex');
const PNG_SIG = Buffer.from('89504e470d0a1a0a', 'hex');
const PNG_HEAD = Buffer.from('89504e470d0a1a0a0000000d49484452', 'hex');

function usage() {
  console.log('Usage: node unpack_sol.js --www <www dir> --out <output dir> [options]');
  console.log('       node unpack_sol.js --www <www dir> --check');
  console.log('  --mode encrypted|full   encrypted = decrypted assets only (default); full = also copy plaintext assets');
  console.log('  --filter <substr>       only process relative paths containing this text');
  console.log('  --limit <N>             stop after N files');
  console.log('  --overwrite             overwrite existing output files');
  console.log('  --check                 verify everything in memory; writes nothing');
  process.exit(1);
}

function parseArgs(argv) {
  const o = { mode: 'encrypted', filter: null, limit: Infinity, overwrite: false, check: false };
  for (let i = 2; i < argv.length; i++) {
    const a = argv[i];
    if (a === '--www') o.www = argv[++i];
    else if (a === '--out') o.out = argv[++i];
    else if (a === '--mode') o.mode = argv[++i];
    else if (a === '--filter') o.filter = argv[++i];
    else if (a === '--limit') o.limit = parseInt(argv[++i], 10);
    else if (a === '--overwrite') o.overwrite = true;
    else if (a === '--check') o.check = true;
    else usage();
  }
  if (!o.www || !['encrypted', 'full'].includes(o.mode)) usage();
  if (!o.check && !o.out) usage();
  return o;
}

function loadLZString(www) {
  const p = path.join(www, 'js', 'libs', 'lz-string.js');
  if (!fs.existsSync(p)) throw new Error('missing ' + p);
  const ctx = {};
  ctx.window = ctx;
  ctx.global = ctx;
  vm.createContext(ctx);
  vm.runInContext(fs.readFileSync(p, 'utf8'), ctx);
  if (!ctx.LZString) throw new Error('LZString not exported by ' + p);
  return ctx.LZString;
}

function ivFor(stem, lower) {
  const b = Buffer.alloc(16);
  b.write((lower ? stem.toLowerCase() : stem).slice(0, 16), 'latin1');
  return b;
}

function aesDecrypt(buf, key, iv) {
  const d = crypto.createDecipheriv('aes-256-cbc', key, iv);
  return Buffer.concat([d.update(buf), d.final()]);
}

function sniff(buf) {
  if (buf.length >= 8 && buf.slice(0, 8).equals(Buffer.from('89504e470d0a1a0a', 'hex'))) return { kind: 'png', ext: '.png' };
  if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) return { kind: 'jpg', ext: '.jpg' };
  if (buf.length >= 12 && buf.slice(0, 4).toString() === 'RIFF' && buf.slice(8, 12).toString() === 'WEBP') return { kind: 'webp', ext: '.webp' };
  if (buf.length >= 3 && buf.slice(0, 3).toString() === 'GIF') return { kind: 'gif', ext: '.gif' };
  if (buf.length >= 4 && buf.slice(0, 4).toString() === 'OggS') return { kind: 'ogg', ext: '.ogg' };
  if (buf.length >= 8 && buf.slice(4, 8).toString() === 'ftyp') return { kind: 'm4a', ext: '.m4a' };
  if (buf.length >= 3 && buf.slice(0, 3).toString() === 'ID3') return { kind: 'mp3', ext: '.mp3' };
  if (buf.length >= 1 && (buf[0] === 0x5b || buf[0] === 0x7b)) return { kind: 'json', ext: '.json' };
  return { kind: 'bin', ext: '.bin' };
}

function validatePng(buf) {
  if (buf.length < 33) return { ok: false, error: 'too short' };
  if (!buf.slice(0, 8).equals(Buffer.from('89504e470d0a1a0a', 'hex'))) return { ok: false, error: 'bad signature' };
  const len = buf.readUInt32BE(8);
  const type = buf.slice(12, 16).toString('latin1');
  if (len !== 13 || type !== 'IHDR') return { ok: false, error: 'no IHDR' };
  const width = buf.readUInt32BE(16);
  const height = buf.readUInt32BE(20);
  const crcStored = buf.readUInt32BE(29);
  const crcCalc = crc32(Buffer.concat([buf.slice(12, 16), buf.slice(16, 29)]));
  if (crcStored >>> 0 !== crcCalc >>> 0) return { ok: false, error: 'IHDR CRC' };
  return { ok: true, width, height };
}

const CRC_TABLE = (() => {
  const t = new Int32Array(256);
  for (let n = 0; n < 256; n++) {
    let c = n;
    for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
    t[n] = c;
  }
  return t;
})();

function crc32(buf) {
  let c = 0xffffffff;
  for (let i = 0; i < buf.length; i++) c = CRC_TABLE[(c ^ buf[i]) & 0xff] ^ (c >>> 8);
  return (c ^ 0xffffffff) >>> 0;
}

function validateOgg(buf) {
  if (buf.length < 27) return { ok: false, error: 'too short' };
  if (buf.slice(0, 4).toString() !== 'OggS') return { ok: false, error: 'bad signature' };
  if (buf[4] !== 0) return { ok: false, error: 'bad version' };
  return { ok: true };
}

function walk(dir, root, acc, filter) {
  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
    const p = path.join(dir, e.name);
    const rel = path.relative(root, p).replace(/\\/g, '/');
    if (e.isDirectory()) walk(p, root, acc, filter);
    else if (!filter || rel.includes(filter)) acc.files.push(p);
  }
  return acc;
}

function main() {
  const opt = parseArgs(process.argv);
  const www = path.resolve(opt.www);
  const LZ = loadLZString(www);
  const acc = { files: [] };
  walk(www, www, acc, opt.filter);
  const files = acc.files;

  let out = null;
  if (!opt.check) {
    out = path.resolve(opt.out);
    fs.mkdirSync(out, { recursive: true });
  }

  const report = {
    mode: opt.check ? 'check' : opt.mode,
    www,
    counts: {
      soldataJson: 0, soldataImage: 0, rpgmvp: 0, rpgmvo: 0,
      copied: 0, skippedExisting: 0, failed: 0, ivRecovered: 0,
      duplicateIdentical: 0, duplicateDifferent: 0
    },
    shapes: { jsonArray: 0, jsonObject: 0, pngDims: {}, ogg: 0 },
    failures: [],
    recoveredIv: [],
    samples: []
  };

  const written = new Map();
  let processed = 0;

  function sha(buf) {
    return crypto.createHash('sha256').update(buf).digest('hex');
  }

  function altName(relPath, tag) {
    const ext = path.posix.extname(relPath);
    return relPath.slice(0, -ext.length) + '.' + tag + ext;
  }

  function writeOut(relPath, buf) {
    if (opt.check) {
      if (report.samples.length < 12) report.samples.push(relPath + ' (' + buf.length + ' B)');
      return true;
    }
    const dest = path.join(out, relPath);
    fs.mkdirSync(path.dirname(dest), { recursive: true });
    if (fs.existsSync(dest)) {
      const old = sha(fs.readFileSync(dest));
      if (old === sha(buf)) {
        report.counts.skippedExisting++;
        return false;
      }
      if (!opt.overwrite) {
        report.counts.duplicateDifferent++;
        report.failures.push({ file: relPath, error: 'existing file differs' });
        return false;
      }
    }
    fs.writeFileSync(dest, buf);
    return true;
  }

  function emit(relPath, buf, label) {
    const h = sha(buf);
    const prev = written.get(relPath);
    if (!prev) {
      written.set(relPath, { hash: h, label });
      return writeOut(relPath, buf);
    }
    if (prev.hash === h) {
      report.counts.duplicateIdentical++;
      return true;
    }
    report.counts.duplicateDifferent++;
    if (prev.label === 'rpgmvp' && label === 'soldata') {
      const alt = altName(relPath, 'rpgmvp');
      if (!opt.check) {
        const dest = path.join(out, relPath);
        const altDest = path.join(out, alt);
        if (fs.existsSync(dest)) {
          fs.mkdirSync(path.dirname(altDest), { recursive: true });
          if (!fs.existsSync(altDest)) fs.renameSync(dest, altDest);
        }
      }
      written.set(alt, { hash: prev.hash, label: prev.label });
      written.set(relPath, { hash: h, label });
      report.failures.push({ file: relPath, error: 'duplicate content differs', resolution: 'soldata wins; rpgmvp -> ' + alt });
      if (opt.check) return true;
      fs.writeFileSync(path.join(out, relPath), buf);
      return true;
    }
    let alt = altName(relPath, label);
    let n = 2;
    while (written.has(alt)) {
      alt = altName(relPath, label + '_' + n);
      n++;
    }
    written.set(alt, { hash: h, label });
    report.failures.push({ file: relPath, error: 'duplicate content differs', resolution: 'kept ' + prev.label + '; ' + label + ' -> ' + alt });
    return writeOut(alt, buf);
  }

  for (const f of files) {
    if (processed >= opt.limit) break;
    const rel = path.relative(www, f).replace(/\\/g, '/');
    const ext = path.extname(f).toLowerCase();
    try {
      if (ext === '.soldata') {
        const isData = rel.startsWith('data/');
        const stem = isData ? path.basename(f, ext) : LZ.decompressFromBase64(path.basename(f, ext));
        if (typeof stem !== 'string' || !stem) throw new Error('name decode failed');
        const blob = fs.readFileSync(f);
        const iv = ivFor(stem, isData);
        let pt = aesDecrypt(blob, isData ? DATA_KEY : IMG_KEY, iv);
        let sig = sniff(pt);
        let outStem = stem;
        if (isData) {
          if (sig.kind !== 'json') throw new Error('data payload is ' + sig.kind);
          const parsed = JSON.parse(pt.toString('utf8'));
          if (Array.isArray(parsed)) report.shapes.jsonArray++;
          else report.shapes.jsonObject++;
          report.counts.soldataJson++;
          emit(path.posix.join(path.posix.dirname(rel), stem + '.json'), pt, 'data');
        } else {
          if (sig.kind === 'png') {
            let v = validatePng(pt);
            if (!v.ok && pt.slice(0, 8).equals(PNG_SIG)) {
              const ivCorr = Buffer.alloc(16);
              for (let i = 0; i < 16; i++) ivCorr[i] = iv[i] ^ pt[i] ^ PNG_HEAD[i];
              const pt2 = aesDecrypt(blob, IMG_KEY, ivCorr);
              const v2 = validatePng(pt2);
              if (v2.ok) {
                pt = pt2;
                v = v2;
                const recPrefix = ivCorr.toString('latin1').replace(/\0.*$/, '');
                outStem = stem.length <= 16 ? recPrefix : recPrefix + stem.slice(16);
                report.counts.ivRecovered++;
                report.recoveredIv.push({
                  file: rel, diskStem: stem, trueStem: outStem,
                  ivPrefix: ivCorr.toString('latin1').replace(/[^\x20-\x7e]/g, '.')
                });
              }
            }
            if (!v.ok) throw new Error('png ' + v.error);
            const key = v.width + 'x' + v.height;
            report.shapes.pngDims[key] = (report.shapes.pngDims[key] || 0) + 1;
          } else if (!['jpg', 'webp', 'gif'].includes(sig.kind)) {
            throw new Error('image payload is ' + sig.kind);
          }
          report.counts.soldataImage++;
          emit(path.posix.join(path.posix.dirname(rel), outStem + sig.ext), pt, 'soldata');
        }
        processed++;
      } else if (ext === '.rpgmvp' || ext === '.rpgmvo' || ext === '.rpgmvm') {
        const blob = fs.readFileSync(f);
        if (blob.length < 32) throw new Error('truncated RPGMV container');
        const first = Buffer.alloc(16);
        for (let i = 0; i < 16; i++) first[i] = blob[16 + i] ^ RPGMV_MASK[i];
        const pt = Buffer.concat([first, blob.slice(32)]);
        const sig = sniff(pt);
        if (ext === '.rpgmvp') {
          const v = validatePng(pt);
          if (!v.ok) throw new Error('png ' + v.error);
          const key = v.width + 'x' + v.height;
          report.shapes.pngDims[key] = (report.shapes.pngDims[key] || 0) + 1;
          report.counts.rpgmvp++;
        } else if (ext === '.rpgmvo') {
          const v = validateOgg(pt);
          if (!v.ok) throw new Error('ogg ' + v.error);
          report.shapes.ogg++;
          report.counts.rpgmvo++;
        }
        emit(rel.slice(0, -ext.length) + sig.ext, pt, ext === '.rpgmvp' ? 'rpgmvp' : 'rpgmvo');
        processed++;
      } else if (opt.mode === 'full') {
        emit(rel, fs.readFileSync(f), 'copy');
        report.counts.copied++;
        processed++;
      }
      if (processed % 500 === 0) console.error('processed', processed);
    } catch (e) {
      report.counts.failed++;
      report.failures.push({ file: rel, error: String(e && e.message || e) });
    }
  }

  const dims = Object.entries(report.shapes.pngDims).sort((a, b) => b[1] - a[1]);
  report.shapes.pngDims = Object.fromEntries(dims.slice(0, 12));
  if (!opt.check) fs.writeFileSync(path.join(out, '_unpack_report.json'), JSON.stringify(report, null, 2));
  console.log(JSON.stringify(report, null, 2));
}

main();