Skip to content

Commit

Permalink
Merge pull request #49 from alive4ever/fix-signature-regex
Browse files Browse the repository at this point in the history
Fix signature regex
  • Loading branch information
techmetx11 authored Dec 24, 2024
2 parents 74e879b + 6045b56 commit 7809bed
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 38 deletions.
20 changes: 4 additions & 16 deletions src/consts.rs
Original file line number Diff line number Diff line change
Expand Up @@ -13,28 +13,16 @@ pub static NSIG_FUNCTION_ARRAYS: &[&str] = &[
];

pub static NSIG_FUNCTION_ENDINGS: &[&str] = &[
r#"=\s*function(\([\w]+\)\{\s*var\s+[\w\s]+=[\w\.\s]+?\.call\s*\([\w\s$]+?,[\(\)\",\s]+\)[\S\s]*?\}\s*return [\w\.\s$]+?\.call\s*\([\w\s$]+?\s*,[\(\)\",\s]+\)\s*\}\s*;)"#,
r#"\s*=function\s*(\(\w\)\s*\{\s*var\s+\w=\w.split.*?\{\s*return"[a-zA-Z0-9_]+.?_w8_".*?\}\s*return\s+\w+\.join\(""\)\s*\}\s*;)"#,
r#"=\s*function([\S\s]*?\}\s*return \w+?\.join\(\"\"\)\s*\};)"#,
r#"=\s*function([\S\s]*?\}\s*return [\W\w$]+?\.call\([\w$]+?,\"\"\)\s*\};)"#,
];

pub static REGEX_SIGNATURE_TIMESTAMP: &Lazy<Regex> = regex!("signatureTimestamp[=:](\\d+)");

pub static REGEX_SIGNATURE_FUNCTION: Lazy<Regex> = Lazy::new(|| {
Regex::new(concat!(
r#"(?:"#,
// Pattern 1
r#"\b[a-zA-Z0-9$]+&&\([a-zA-Z0-9$]+=([a-zA-Z0-9$]{2,})\(decodeURIComponent\([a-zA-Z0-9$]+\)\)\)"#,
r#"|"#,
// Pattern 2
r#"([a-zA-Z0-9$]+)\s*=\s*function\(\s*[a-zA-Z0-9$]+\s*\)\s*\{\s*[^}]+?\.split\(\s*""\s*\)[^}]+?\.join\(\s*""\s*\)"#,
r#"|"#,
// Pattern 3
r#"(?:\b|[^a-zA-Z0-9$])([a-zA-Z0-9$]{2,})\s*=\s*function\(\s*a\s*\)\s*\{\s*a\s*=\s*a\.split\(\s*""\s*\)"#,
r#")"#
)).unwrap()
});
pub static REGEX_HELPER_OBJ_NAME: &Lazy<Regex> = regex!(r"function\(([a-zA-Z_$][a-zA-Z0-9_$]*)\)|([a-zA-Z_$][a-zA-Z0-9_$]*)\.[A-Za-z_$]");
pub static REGEX_SIGNATURE_FUNCTION: &Lazy<Regex> =
regex!(r#"\s*?([a-zA-Z0-9_]{1,})=function\([a-zA-Z]{1}\)\{(.{1}=.{1}\.split\(""\)[^\}{]+)return .{1}\.join\(""\)\}"#);
pub static REGEX_HELPER_OBJ_NAME: &Lazy<Regex> = regex!(";([A-Za-z0-9_\\$]{2,})\\...\\(");

pub static NSIG_FUNCTION_NAME: &str = "decrypt_nsig";
pub static SIG_FUNCTION_NAME: &str = "decrypt_sig";
46 changes: 24 additions & 22 deletions src/player.rs
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,19 @@ pub enum FetchUpdateStatus {
CannotFetchPlayerJS,
NsigRegexCompileFailed,
PlayerAlreadyUpdated,
CannotMatchSignature
}

fn fixup_n_function_code(code: &str) -> String {
let re = regex::Regex::new(r#";\s*if\s*\(\s*typeof\s+[a-zA-Z0-9_$]+\s*===?\s*["']undefined["']\s*\)\s*return\s+[a-zA-Z0-9_$]+;"#).unwrap();
re.replace_all(code, ";").to_string()
fn fixup_nsig_jscode(jscode: &str) -> String {
let fixup_re = Regex::new(r#";\s*if\s*\(\s*typeof\s+[a-zA-Z0-9_$]+\s*===?\s*"undefined"\s*\)\s*return\s+\w+;"#).unwrap();

// Replace the matched pattern with just ";"
if fixup_re.is_match(jscode) {
info!("Fixing up nsig_func_body.");
return fixup_re.replace_all(jscode, ";").to_string();
} else {
info!("nsig_func returned with no fixup");
return jscode.to_string();
}
}

pub async fn fetch_update(state: Arc<GlobalState>) -> Result<(), FetchUpdateStatus> {
Expand Down Expand Up @@ -128,6 +135,7 @@ pub async fn fetch_update(state: Arc<GlobalState>) -> Result<(), FetchUpdateStat
// Extract nsig function code
for (index, ending) in NSIG_FUNCTION_ENDINGS.iter().enumerate() {
let mut nsig_function_code_regex_str: String = String::new();
nsig_function_code_regex_str += "(?ms)";
nsig_function_code_regex_str += &nsig_function_name.replace("$", "\\$");
nsig_function_code_regex_str += ending;

Expand All @@ -146,26 +154,19 @@ pub async fn fetch_update(state: Arc<GlobalState>) -> Result<(), FetchUpdateStat
i.get(1).unwrap().as_str()
}
};
nsig_function_code = fixup_n_function_code(&nsig_function_code);
nsig_function_code = fixup_nsig_jscode(&nsig_function_code);
debug!("got nsig fn code: {}", nsig_function_code);
break;
}

// Extract signature function name
let sig_function_name = match REGEX_SIGNATURE_FUNCTION.captures(&player_javascript) {
Some(captures) => {
// Try groups 1, 2, and 3 which contain the signature function name
[1, 2, 3].iter()
.find_map(|&i| captures.get(i))
.map(|m| m.as_str())
.ok_or(FetchUpdateStatus::CannotMatchSignature)?
}
None => {
error!("Could not match signature function pattern");
return Err(FetchUpdateStatus::CannotMatchSignature);
}
};
debug!("sig function name: {}", sig_function_name);
let sig_function_name = REGEX_SIGNATURE_FUNCTION
.captures(&player_javascript)
.unwrap()
.get(1)
.unwrap()
.as_str();

let mut sig_function_body_regex_str: String = String::new();
sig_function_body_regex_str += &sig_function_name.replace("$", "\\$");
sig_function_body_regex_str += "=function\\([a-zA-Z0-9_]+\\)\\{.+?\\}";
Expand All @@ -182,9 +183,10 @@ pub async fn fetch_update(state: Arc<GlobalState>) -> Result<(), FetchUpdateStat
// Get the helper object
let helper_object_name = REGEX_HELPER_OBJ_NAME
.captures(sig_function_body)
.and_then(|cap| cap.get(1).or_else(|| cap.get(2)))
.map(|m| m.as_str())
.unwrap_or_default();
.unwrap()
.get(1)
.unwrap()
.as_str();

let mut helper_object_body_regex_str = String::new();
helper_object_body_regex_str += "(var ";
Expand Down

0 comments on commit 7809bed

Please sign in to comment.