[Android 原创] 【逆向实战】Cocos2d-Lua 手游从资源解密到打包破解 (下)

> find repository/ -iname "*.mp4" -printf "%p  %s bytes\n"
repository/buzhen2/hero_jinshuguaic5ab.mp4      52708070 bytes
repository/img_fz3/fishing_book3cf9.mp4         45835592 bytes

[26] request
HEAD /subpackage/pkm/video/video_b_1 HTTP/1.1
Host: xn--xxxxxxx.com
Connection: Keep-Alive
Accept-Encoding: gzip

[26] response
HTTP/1.1 200 OK
Last-Modified: Thu, 19 Mar 2026 03:31:13 GMT
Etag: "9cda1ec0a9a3bab9d443718b95aecf2d"
x-amz-server-side-encryption: AES256
Content-Type: application/octet-stream
Server: AmazonS3
Content-Length: 95813803
Accept-Ranges: bytes

[27] request
GET /subpackage/pkm/video/video_b_1 HTTP/1.1
Content-Length: 0
Host: xn--xxxxxxx.com

> python3 -c "print('xn--xxxxxxx.com'.encode().decode('idna'))"
XX.com

base = "cocosTianJi,pkm" + "TianJi Information Technology Inc."

> xxd video_b_1 | head -1
00000000: 74 6a 65 bd 4b a1 4e 47 85 8a e5  c9 15 c6 07 37 ...

for i in 1..11:
    for x in [a, b, c]:
        GET /subpackage/pkm/video/video_{x}_{i}

> grep -rl "xn--xxxxxxx" repository/
repository/box_gg/gljo2908.subpackage
repository/box_wddw2/logo_bxys2ae8

{
  "res/resources/city/pvp/cross_mine/buff/icon_buff5.png": {
    "reposize": 4747,                                  
    "mapping": "repository/txt_xuanze/txt_swksjqqd8eb3.png",
    "size": 4718                                      
  },
  "src/app.views.city.house.fereView": {
    "reposize": 7995,
    "mapping": "repository/hunting/logo_ytz42a3.fereView",
    "size": 7995
  },
  ...
}

import json, sys

m = json.load(open('repository/repo.mapping'))

for k, v in m.items():
    if v['mapping'] == sys.argv[1] or v['mapping'].endswith(sys.argv[1]):
        print(f"{k}\n   reposize={v['reposize']} size={v['size']}\n   {v['mapping']}")

> python3 find.py gljo2908.subpackage
src/app.subpackage
   reposize=4375 size=4375
   repository/box_gg/gljo2908.subpackage

> python3 find.py logo_bxys2ae8
updater/main
   reposize=10563 size=10563
   repository/box_wddw2/logo_bxys2ae8

-- 分包 下载
local SubPackDownload = class("SubPackage")

local subPackUrl = {
--cn = "https://r-bkm.xxx.com/subpackage/pkm/video/",
    cn = "http://xn--xxxxxxx.com/subpackage/pkm/video/",
}

function SubPackDownload:init()
    self.fileInfo = {}
    self:setSubpackUrl()

    self.tarPackPath = writablePath .. "package/video/xiaowu/"
    self.tempPackPath = writablePath .. "package/_temp/"

    local videoList = {}
    for k, v in csvPairs(csv.banlvxiaowu) do      -- 就是它！
        for i = 1, 3 do
             -- 第一个伴侣不下载
            if v.id == 1 and i == 1 then
            else
                local videoname = v["video"..i]
                if videoname and videoname ~= "" then
                    table.insert(videoList, videoname)
                end
            end
        end
    end
    ...
end

local basename = string.match(v, "([^/]+)%.%w+>")   -- 从 'xiaowu/video_a_1.mp4' 取出 'video_a_1'
local targetFile = self.tarPackPath .. basename .. ".mp4"

-- 拼下载地址
local fileUrl = self.subPackUrl .. self.downInfo.file   -- http://.com/subpackage/pkm/video/video_a_1

-- 第一个伴侣不下载
if v.id == 1 and i == 1 then

> python3 find.py fishing_book3cf9.mp4
res/video/xiaowu/video_a_1.mp4
   reposize=45835592 size=45835592
   repository/img_fz3/fishing_book3cf9.mp4

local videoFullPath = cc.FileUtils:getInstance():fullPathForFilename(path)
if #videoFullPath == 0 then
    local writablePath = cc.FileUtils:getInstance():getWritablePath()
    videoFullPath = writablePath .. "package/video/" .. path
end

> grep -rl "banlvxiaowu" repository/ | head
repository/icon_bb_4/icon_bb_15e344.banlvxiaowu
...

> python3 find.py icon_bb_15e344.banlvxiaowu
src/config.banlvxiaowu
   reposize=1943 size=1943
   repository/icon_bb_4/icon_bb_15e344.banlvxiaowu

-- auto generated by csv2lua
-- DON'T EDIT THIS FILE !!!
csv['banlvxiaowu'] = {
        [1] = {
                id = 1, loveID = 1001, attrType = 9, gateID = 10102,
                name = '物防大师·雪绫',
                icon = 'config/xiaowu/icon_touxiang1.png',
                image1 = 'spine/xiaowu/image1_1.skel',
                video1 = 'xiaowu/video_a_1.mp4',
                video2 = 'xiaowu/video_b_1.mp4',
                video3 = 'xiaowu/video_c_1.mp4'
        },
        [2] = { id = 2, ..., gateID = 10205, name = '特防大师·夏音',
                video1 = 'xiaowu/video_a_2.mp4', video2 = 'xiaowu/video_b_2.mp4' },
        ...
}

BASE_HOST = "xn--xxxxxxx.com"          # punycode: XX.com
BASE_PATH = "/subpackage/pkm/video"
BASE_URL  = f"http://{BASE_HOST}{BASE_PATH}"

COMPANIONS = [
    (1,  1001, 10102, "物防大师·雪绫", ["video_a_1",  "video_b_1",  "video_c_1"]),
    (2,  1002, 10205, "特防大师·夏音", ["video_a_2",  "video_b_2",  None]),
    (3,  1003, 10407, "生命大师·夜莉", ["video_3",    "video_b_3",  "video_c_3"]),
    ...
]   # 共 11 个伴侣、29 段视频

USER_AGENT = "Dalvik/2.1.0 (Linux; U; Android 13; sdk_gphone64_arm64 Build/TE1A.220804.005)"

cmd = [decryptor, "-o"] + downloaded_files     # -o 原地覆盖
subprocess.run(cmd)

.../神奇宝贝/Tools $$$$ python video_fetcher.py --help
usage: video_fetcher.py [-h] [-o OUTDIR] [--no-decrypt] [--decryptor DECRYPTOR]
                        [--no-head] [-l]
                        [selections ...]

神奇宝贝 伴侣视频下载解密器

positional arguments:
  selections            选择，如: all / 1 / 1,3 / 1:2 / 1:2,3 8:1

options:
  -h, --help            show this help message and exit
  -o, --outdir OUTDIR   下载目录（默认 videos/，按伴侣名分子目录）
  --no-decrypt          只下载，不解密
  --decryptor DECRYPTOR
                        解密器路径（默认 ./decrypt）
  --no-head             跳过 HEAD 探活
  -l, --list            打印伴侣视频对照表后退出

神奇宝贝 伴侣视频下载解密器
=========================================
内置完整伴侣-视频对照表（csv.banlvxiaowu 提取），支持：

  1. 按伴侣下载：一个或多个伴侣，每个伴侣自由选择 video1/2/3
  2. 全量下载：一次下载所有伴侣的所有视频
  3. 下载完成后自动补 .mp4 后缀，并调用编译好的解密器 ./decrypt 批量解密
     视频按伴侣名存放在子目录：videos/<伴侣名>/video_a_1.mp4
     解密使用 -o 覆盖选项，解密结果写回原文件（原地替换为可播放 MP4）

两种调用方式：
  - 纯命令行：python3 video_fetcher.py <选择>...
  - 交互模式：python3 video_fetcher.py   （不带参数，逐项询问）

选择语法：
  all                     下载所有伴侣的全部视频
  1                       下载伴侣1的全部视频
  1,3,8                   下载伴侣1/3/8的全部视频
  1:2                     下载伴侣1的 video2
  1:2,3 8:1               下载伴侣1的 video2/3 + 伴侣8的 video1
  1:all                   下载伴侣1的全部视频

选项：
  -o, --outdir <目录>     下载保存目录（默认 videos/，按伴侣名分子目录）
      --no-decrypt        只下载不解密
      --decryptor <路径>  解密器路径（默认 ./decrypt）
      --no-head           跳过 HEAD 探活
      --list              列出全部伴侣视频对照表后退出
.../神奇宝贝/Tools $$$$

videos/
├── 物防大师·雪绫/
│   ├── video_a_1.mp4
│   ├── video_b_1.mp4
│   └── video_c_1.mp4
├── 特防大师·夏音/
│   └── ...
└── 闪避大师·晴雨/
    └── ...

gGameUI:stackUI("city.house.fereRoom", nil, {full = true}, ...)

> grep -rn "game/lover" repository/
fereView: gGameApp:requestServer("/game/lover/add/feels", ...)     -- 加好感度（喂花）
fereView: gGameApp:requestServer("/game/lover/bless/card", ...)    -- 伴侣祝福绑卡

> grep -rl "该玩法需好感度" repository/
repository/icon_wsj/ring_5_7_10_2b940.language

> grep -n -A3 "该玩法需好感度" ring_5_7_10_2b940.language

4728:        [8732] = {
4729-                id = 8732,
4730:                key = 'yijiejiesuo',
4731-                text = '该玩法需好感度一阶满级时解锁'
4732-        },

[8732] = { id = 8732, key = 'yijiejiesuo',  text = '该玩法需好感度一阶满级时解锁' },
[8733] = { id = 8733, key = 'erjiejiesuo', text = '该玩法需好感度二阶满级时解锁' },
[8734] = { id = 8734, key = 'sanjiejiesuo', text = '该玩法需好感度三阶满级时解锁' },

gGameUI:showTip(gLanguageCsv.yijiejiesuo)

> grep -rln "yijiejiesuo" repository/
repository/hunting/logo_ytz42a3.fereView
repository/icon_wsj/ring_5_7_10_2b940.language

> python3 find.py logo_ytz42a3.fereView
src/app.views.city.house.fereView
   reposize=7995 size=7995
   repository/hunting/logo_ytz42a3.fereView

local FERE_FEEL_DATAS = {100, 200, 300}

HousefereView.RESOURCE_BINDING = {
    ...
    ["rightPanel.btn_ty"] = {                      -- ← “互动”按钮
        varname = "btnTY",
        binds = {
            event = "touch",
            methods = {
                ended = bindHelper.self("onClickFereRoom")   -- 点它 → onClickFereRoom
            }
        }
    },
    ["rightPanel.btn_zf"] = {                      -- ← “祝福”按钮
        varname = "btnZF",
        binds = {
            event = "touch",
            methods = {
                ended = bindHelper.self("onClickFereCard")   -- 点它 → onClickFereCard
            }
        }
    },
    ...
}

function HousefereView:onClickFereRoom()
    if self.currPoints:read() < FERE_FEEL_DATAS[1] then     -- 好感度 < 100 ?
        gGameUI:showTip(gLanguageCsv.yijiejiesuo)           -- 弹“需一阶满级时解锁”
        return                                              -- 直接返回
    end

    gGameUI:stackUI("city.house.fereRoom", nil, {
        full = true
    }, self.curSelFere:read(), self.currPoints:read(), self.proData)   -- 达标才进房间
end

function HousefereView:onClickFereCard()
    if self.currPoints:read() < FERE_FEEL_DATAS[3] then     -- 好感度 < 300 ?
        gGameUI:showTip(gLanguageCsv.sanjiejiesuo)          -- 弹“需三阶满级时解锁”
        return
    end

    gGameUI:stackUI("city.house.fereCard", nil, nil, self.curSelFere:read(), self:createHandler("onSelectCard"))
end

for k, v in csvPairs(csv.banlvxiaowu) do
    local lockState = false
    if not feres[k] then                                     -- 如果你还没拥有这个伴侣
        lockState = not dataEasy.isGateFinished(v.gateID)    -- 且对应关卡没通关
    end
    tData[k] = {
        id = v.id,
        icon = v.icon,
        gateId = v.gateID,
        isLock = lockState,                                  -- → 列表里显示“锁定”
        ...
    }
end

> python3 find.py fereRoom
src/app.views.city.house.fereRoom
   reposize=2231 size=2231
   repository/txt_xuanze/icon_bq_hql5b9c.fereRoom

function FereRoomView:onClickPlayVideo()
--  if self.currPoints:read() < 200 then          ← 看这里
--      gGameUI:showTip(gLanguageCsv.erjiejiesuo)
--      return
--  end

    if #self.menuDatas > 1 then
        gGameUI:createView("city.house.fereMenu", self):init(self.menuDatas)
    else
        ...
        gGameUI:stackUI("city.house.fereVideo", nil, {full = true}, self.menuDatas[1].path)
    end
end

{ "name": "btnPlay", "visible": true, "tag": 727831538 }

function FereMenuView:onClickPlayVideo(index)
    if self.listData[index] then
        local needDown = gGameApp.subPack:checkNeedDownload(self.listData[index].path)
        if needDown then
            gGameUI:stackUI("city.house.fereDown", nil, nil, self.listData[index].path)
        else
            gGameUI:stackUI("city.house.fereVideo", nil, {full = true}, self.listData[index].path)
        end
    end
    ViewBase.onClose(self)
end

function FereDownView:onCreate(path, cb)
    ...
    gGameApp.subPack:downloadOneFile(path, function()
        performWithDelay(self, function()
            self:onClose()
            gGameUI:stackUI("city.house.fereVideo", nil, {full = true}, path)
        end, 1)
    end)
end

function FereVideoView:onCreate(path, cb)
    ...
    local videoFullPath = cc.FileUtils:getInstance():fullPathForFilename(path)
    if #videoFullPath == 0 then
        local writablePath = cc.FileUtils:getInstance():getWritablePath()
        videoFullPath = writablePath .. "package/video/" .. path
    end
    ...
    videoPlayer:setFileName(videoFullPath)
    videoPlayer:play()
end

static void xxtea_encrypt_core(uint32_t *v, int n, const uint32_t *k) {
    int q = 6 + 52 / n;
    uint32_t s = 0, e, y, z, ki;
    while (q--) {
        s = (s + DELTA) & MASK32;
        e = (s >> 2) & 3;
        z = v[n - 1];
        y = v[1];
        mx = ((z>>5 ^ y<<2) + (y>>3 ^ z<<4)) ^ ((y^s) + (k[e]^z));
        v[0] = (v[0] + mx) & MASK32;          // 解密是减，加密是加
        for (p = 1; p < n; p++) {             // 解密倒着走，加密正着走
            z = v[p - 1];
            y = (p == n - 1) ? v[0] : v[p + 1];
            mx = ((z>>5 ^ y<<2) + (y>>3 ^ z<<4)) ^ ((y^s) + (k[(p&3)^e]^z));
            v[p] = (v[p] + mx) & MASK32;
        }
    }
}

mkdir -p Modify/hunting
cp repository/hunting/logo_ytz42a3.fereView Modify/hunting/logo_ytz42a3.fereView
cmp repository/hunting/logo_ytz42a3.fereView Modify/hunting/logo_ytz42a3.fereView   # 校验一致

-- 改前
local FERE_FEEL_DATAS = {100, 200, 300}
-- 改后
local FERE_FEEL_DATAS = {0, 0, 0}   -- MOD: 好感度阈值清零, 直接解锁全部伴侣玩法

function HousefereView:onClickFereRoom()
    -- MOD: 好感度一阶 gate 已移除, 直接进入小屋
    -- if self.currPoints:read() < FERE_FEEL_DATAS[1] then
    --     gGameUI:showTip(gLanguageCsv.yijiejiesuo)
    --     return
    -- end

    gGameUI:stackUI("city.house.fereRoom", nil, {full = true},
        self.curSelFere:read(), self.currPoints:read(), self.proData)
end

for k, v in csvPairs(csv.banlvxiaowu) do
    local lockState = false
    -- MOD: 强制全伴侣解锁, 不再依赖 gateID 通关
    -- if not feres[k] then
    --     lockState = not dataEasy.isGateFinished(v.gateID)
    -- end
    ...
end

> luac -p Modify/hunting/logo_ytz42a3.fereView
> echo >?
0

> python3 -c "
import json;m=json.load(open('repository/repo.mapping'))
print(m['src/app.views.city.house.fereView'])"

{'reposize': 7995, 'mapping': 'repository/hunting/logo_ytz42a3.fereView', 'size': 7995}

> ls -l repository/hunting/logo_ytz42a3.fereView
-rw-rw-r-- 1 ... 8435 repository/hunting/logo_ytz42a3.fereView

> ./encrypt mapsize ./Modify/repository/repo.mapping.mod ./repo.mapping.new src/app.views.city.house.fereView 8435 8435
已更新

> python3 -c "
import json;m=json.load(open('repo.mapping.new'))
print(m['src/app.views.city.house.fereView'])"
{'reposize': 8435, 'mapping': 'repository/hunting/logo_ytz42a3.fereView', 'size': 8435}

> ./encrypt enc 'tj!' repo.mapping.new -d encrypt_out/
==> 处理: repo.mapping.new (2.8 MB)
[√] 加密成功

-- updater入口

local updateUrls = {
        ...
        js={
                [1]="http://xn--xxxxxxx.com/r_"..APP_CHANNEL.."/"..APP_CHANNEL.."_version.json",
                [2]="http://px5jyv.xxxxx.com/r_"..APP_CHANNEL.."/"..APP_CHANNEL.."_version.json",
                [3]="https://xxxxxx.xxx.cn-south-1.myhuaweicloud.com/r_"..APP_CHANNEL.."/"..APP_CHANNEL.."_version.json",
        },
        ...
}
local updateUrl=updateUrls[APP_CHANNEL] or updateUrls["js"]