feat(qs): PC 签名改双模式供给，签名工具链迁出独立仓库 qs-signer
- mssdk.ts：进程内 bdms.node 加载移除；优先 QS_SIGN_SERVER 调签名服务 （兼容 qs-signer 仓库 server.mjs 与 mssdk-sign 两个实现，/sign 契约互通）， 无服务时 QS_HELIOS/QS_MEDUSA 或 data/qs-sign.json 固定值兜底，都没有走安卓自签 - musicSearch：PC 通道签名失败/请求异常/风控空结果自动降级安卓通道（原为同通道重试） - signer/、tools/mssdk-sign/、scripts/qs-local-login.mjs 迁至 qs-signer （gitea.4i.hk/hhhge/qs-signer），soda-mssdk/ 二进制目录一并挪走
This commit is contained in:
snowy-yang committed
1 parent
1b972ec4dd
commit
ecca1b8458
14 files changed
+197
-1674
No files matched your search
@@ -42,6 +42,3 @@ coverage/
|
|||||||
# 以下规则仅作保险，防止旧的发射产物被误生成后提交。
|
# 以下规则仅作保险，防止旧的发射产物被误生成后提交。
|
||||||
src/**/*.js
|
src/**/*.js
|
||||||
sdk/**/*.js
|
sdk/**/*.js
|
||||||
|
|
||||||
# 汽水官方签名原生模块（专有二进制，不入库；QS_MSSDK_DIR 亦可指向别处）
|
|
||||||
soda-mssdk/
|
|
||||||
@@ -129,6 +129,19 @@ X-Server-Key: <AUTH_KEY> # 统一验证头（全部路径）
|
|||||||
|
|
||||||
per-IP 滑动窗口限流，`RATE_LIMIT` 为每 IP 每分钟允许的请求数（默认 120，设 0 关闭）。超限返回 429 + Retry-After；鉴权失败的请求同样计数（防秘钥爆破）。
|
per-IP 滑动窗口限流，`RATE_LIMIT` 为每 IP 每分钟允许的请求数（默认 120，设 0 关闭）。超限返回 429 + Retry-After；鉴权失败的请求同样计数（防秘钥爆破）。
|
||||||
|
|
||||||
|
## 汽水 PC 签名（可选增强）
|
||||||
|
|
||||||
|
汽水（`qs`）的 PC 通道（搜索优先走、取流降级走）依赖 `X-Helios`/`X-Medusa` 两个加密签名头，按优先级两种供给方式；都没有时 PC 通道自动关闭，只走安卓自签通道（匿名搜索/试听不受影响）：
|
||||||
|
|
||||||
|
1. **签名服务器**：环境变量 `QS_SIGN_SERVER`（如 `http://127.0.0.1:8899`，可选 `QS_SIGN_TOKEN` 配 Bearer 鉴权）。契约兼容独立仓库 **qs-signer**（`gitea.4i.hk/hhhge/qs-signer`，本地与 MusicServer 同级）的两个服务——`server.mjs`（Wine + bdms.node）与 `mssdk-sign`（metasecml.dll 独立进程，见其 README），跨平台部署无需在本机安装官方客户端。
|
||||||
|
2. **固定值**：无签名服务器时，两个加密头直接用抓包固定值，写入 `data/qs-sign.json`（已 gitignore）：
|
||||||
|
|
||||||
|
```json
|
||||||
|
{ "helios": "…", "medusa": "…", "device_id": "…", "install_id": "…" }
|
||||||
|
```
|
||||||
|
|
||||||
|
`device_id`/`install_id` 必须与抓包时同一套（签名与设备绑定，会自动对齐 URL 参数）；也可用环境变量 `QS_HELIOS`/`QS_MEDUSA`（配套 `QS_SIGN_DEVICE_ID`/`QS_SIGN_INSTALL_ID`）。固定值时效自负，被风控时搜索/取流自动回落安卓通道。
|
||||||
|
|
||||||
## 外部音源
|
## 外部音源
|
||||||
|
|
||||||
设置 `SOURCE_ENABLED=1` 后取流优先走外部音源（默认未设置时直接走 SDK 官方直连接口；是否启用由服务端在 `src/server.ts` 决策）。两种脚本都放 `sources/` 目录（不入库），按文件名混排成候选链：取流失败自动切换下一个，某平台连续失败 3 次的脚本降权冷却 5 分钟；整条音源链失败后回落 SDK 直连、再失败走酷我兜底（见上文取流链）。音源候选链只覆盖 kw/kg/tx/wy（音源脚本协议无 qs 平台，`/url/qs` 始终走 SDK）。音源模式下登录态不参与取流，登录自动续期不会启动（手动 `POST /login/refresh` 仍可用）。详见 [docs/source-ivm.md](docs/source-ivm.md) 与 [docs/source-simple.md](docs/source-simple.md)。
|
设置 `SOURCE_ENABLED=1` 后取流优先走外部音源（默认未设置时直接走 SDK 官方直连接口；是否启用由服务端在 `src/server.ts` 决策）。两种脚本都放 `sources/` 目录（不入库），按文件名混排成候选链：取流失败自动切换下一个，某平台连续失败 3 次的脚本降权冷却 5 分钟；整条音源链失败后回落 SDK 直连、再失败走酷我兜底（见上文取流链）。音源候选链只覆盖 kw/kg/tx/wy（音源脚本协议无 qs 平台，`/url/qs` 始终走 SDK）。音源模式下登录态不参与取流，登录自动续期不会启动（手动 `POST /login/refresh` 仍可用）。详见 [docs/source-ivm.md](docs/source-ivm.md) 与 [docs/source-simple.md](docs/source-simple.md)。
|
||||||
|
|||||||
@@ -1,157 +0,0 @@
|
|||||||
#!/usr/bin/env node
|
|
||||||
// 汽水音乐「本机客户端登录」独立脚本 —— 不参与服务运行，需要时手动跑一次
|
|
||||||
//
|
|
||||||
// 做什么：官方 SodaMusic PC 客户端是 Chromium，登录态就存在本机
|
|
||||||
// %APPDATA%\SodaMusic\Network\Cookies（SQLite）里，设备身份在 %APPDATA%\SodaMusic\DeviceV1
|
|
||||||
// （gzip JSON，含 did/iid）。本脚本直接读出来写进 data/auth.json 的 qs 字段，
|
|
||||||
// 免去扫码登录。参考实现：YYF1337/PopDownloader（SaKongA/PopDownloader 的 fork）。
|
|
||||||
//
|
|
||||||
// 用法：
|
|
||||||
// node scripts/qs-local-login.mjs # 读取 + 校验 + 写入 data/auth.json
|
|
||||||
// node scripts/qs-local-login.mjs --print # 只打印 sessionid，不落盘
|
|
||||||
// node scripts/qs-local-login.mjs --no-verify # 跳过 /luna/pc/me 校验
|
|
||||||
// node scripts/qs-local-login.mjs --dir <目录> # 指定客户端数据目录（默认 %APPDATA%\SodaMusic）
|
|
||||||
// node scripts/qs-local-login.mjs --auth <文件> # 指定 auth.json（默认 <仓库>/data/auth.json）
|
|
||||||
//
|
|
||||||
// 校验需要官方签名模块（soda-mssdk/bdms.node 或 QS_MSSDK_DIR），没有就跳过校验只写入。
|
|
||||||
// 注意：服务在跑时 auth.json 已缓存，写完需重启服务才生效（脚本会提示）。
|
|
||||||
import { copyFileSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
|
|
||||||
import { createRequire } from 'node:module'
|
|
||||||
import { tmpdir } from 'node:os'
|
|
||||||
import { dirname, join, resolve } from 'node:path'
|
|
||||||
import { fileURLToPath } from 'node:url'
|
|
||||||
import { gunzipSync } from 'node:zlib'
|
|
||||||
|
|
||||||
const require = createRequire(import.meta.url)
|
|
||||||
const root = resolve(dirname(fileURLToPath(import.meta.url)), '..')
|
|
||||||
|
|
||||||
const argv = process.argv.slice(2)
|
|
||||||
const flag = (name) => argv.includes(name)
|
|
||||||
const value = (name) => {
|
|
||||||
const i = argv.indexOf(name)
|
|
||||||
return i >= 0 ? argv[i + 1] : ''
|
|
||||||
}
|
|
||||||
|
|
||||||
const dataDir = resolve(value('--dir') || process.env.QS_SODA_DATA_DIR || join(process.env.APPDATA || '', 'SodaMusic'))
|
|
||||||
const authPath = resolve(value('--auth') || join(root, 'data', 'auth.json'))
|
|
||||||
const printOnly = flag('--print')
|
|
||||||
const skipVerify = flag('--no-verify')
|
|
||||||
const DEVICE_FILE = join(dataDir, 'DeviceV1')
|
|
||||||
const COOKIE_DB = join(dataDir, 'Network', 'Cookies')
|
|
||||||
|
|
||||||
const die = (msg) => {
|
|
||||||
console.error(`✗ ${msg}`)
|
|
||||||
process.exit(1)
|
|
||||||
}
|
|
||||||
|
|
||||||
// —— 1. 客户端设备身份（DeviceV1：gzip JSON 的 {did,iid}）——
|
|
||||||
const readDevice = () => {
|
|
||||||
if (!existsSync(DEVICE_FILE)) return null
|
|
||||||
const raw = readFileSync(DEVICE_FILE)
|
|
||||||
let text
|
|
||||||
try {
|
|
||||||
text = gunzipSync(raw).toString('utf8')
|
|
||||||
} catch {
|
|
||||||
text = raw.toString('utf8')
|
|
||||||
}
|
|
||||||
const data = JSON.parse(text)
|
|
||||||
return data?.did && data?.iid ? { did: String(data.did), iid: String(data.iid) } : null
|
|
||||||
}
|
|
||||||
|
|
||||||
// —— 2. 客户端登录态（Chromium cookie 库，复制副本后只读查询）——
|
|
||||||
const readSessionId = () => {
|
|
||||||
if (!existsSync(COOKIE_DB)) die(`未找到客户端登录数据：${COOKIE_DB}\n 请先安装并登录官方汽水音乐 PC 客户端，或用 --dir 指定数据目录`)
|
|
||||||
const tempDir = mkdtempSync(join(tmpdir(), 'qs-cookies-'))
|
|
||||||
try {
|
|
||||||
const copy = join(tempDir, 'Cookies')
|
|
||||||
copyFileSync(COOKIE_DB, copy)
|
|
||||||
for (const side of ['-wal', '-shm']) {
|
|
||||||
if (existsSync(COOKIE_DB + side)) copyFileSync(COOKIE_DB + side, copy + side)
|
|
||||||
}
|
|
||||||
const { DatabaseSync } = require('node:sqlite')
|
|
||||||
const db = new DatabaseSync(copy, { readOnly: true })
|
|
||||||
try {
|
|
||||||
const row = db.prepare(
|
|
||||||
"SELECT value FROM cookies WHERE host_key IN ('.qishui.com', 'qishui.com') AND name = 'sessionid' LIMIT 1",
|
|
||||||
).get()
|
|
||||||
return String(row?.value ?? '').trim()
|
|
||||||
} finally {
|
|
||||||
db.close()
|
|
||||||
}
|
|
||||||
} catch (err) {
|
|
||||||
if (/EBUSY|locked|busy|unable to open/i.test(String(err?.message))) {
|
|
||||||
die('客户端正在运行且 cookie 库被占用，请退出汽水音乐客户端后重试')
|
|
||||||
}
|
|
||||||
die(`读取 cookie 库失败: ${err?.message ?? err}`)
|
|
||||||
} finally {
|
|
||||||
rmSync(tempDir, { recursive: true, force: true })
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// —— 3. 可选：签名打 /luna/pc/me 校验（status_code === 0 视为有效）——
|
|
||||||
const findSigner = () => {
|
|
||||||
const dirs = [process.env.QS_MSSDK_DIR, join(root, 'soda-mssdk')].filter(Boolean)
|
|
||||||
for (const dir of dirs) {
|
|
||||||
if (existsSync(join(dir, 'bdms.node'))) return join(dir, 'bdms.node')
|
|
||||||
}
|
|
||||||
return ''
|
|
||||||
}
|
|
||||||
|
|
||||||
const verify = async (sessionid, device) => {
|
|
||||||
const modulePath = findSigner()
|
|
||||||
if (!modulePath) return null
|
|
||||||
try {
|
|
||||||
const bdms = require(modulePath)
|
|
||||||
bdms.init({ deviceId: device.did })
|
|
||||||
const query = new URLSearchParams({
|
|
||||||
aid: '386088', app_name: 'luna_pc', region: 'cn', geo_region: 'cn', os_region: 'cn', sim_region: '',
|
|
||||||
device_id: device.did, cdid: '', iid: device.iid, version_name: '3.7.0', version_code: '30070000',
|
|
||||||
channel: 'official', build_mode: 'master', network_carrier: '', ac: 'wifi', tz_name: 'Asia/Shanghai',
|
|
||||||
resolution: '', device_platform: 'windows', device_type: 'Windows', os_version: 'Windows 11', fp: device.did,
|
|
||||||
})
|
|
||||||
const url = `https://api.qishui.com/luna/pc/me?${query}`
|
|
||||||
const headers = { 'user-agent': 'LunaPC/3.7.0(452316191)', cookie: `sessionid=${sessionid}` }
|
|
||||||
const lines = Object.entries(headers).map(([k, v]) => `${k}\r\n${v}`).join('\r\n')
|
|
||||||
const parts = String(bdms.generateHttpSignatureHeaders(url, lines)).split('\r\n').filter(t => t.trim())
|
|
||||||
for (let i = 0; i + 1 < parts.length; i += 2) headers[parts[i]] = parts[i + 1]
|
|
||||||
const res = await fetch(url, { headers })
|
|
||||||
if (res.status !== 200) return null
|
|
||||||
const body = await res.json().catch(() => null)
|
|
||||||
const code = body?.status_code
|
|
||||||
if (code === 0) return true
|
|
||||||
return code == null ? null : false
|
|
||||||
} catch (err) {
|
|
||||||
console.log(`! 校验失败（按未校验处理）: ${err?.message ?? err}`)
|
|
||||||
return null
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
const main = async () => {
|
|
||||||
const device = readDevice()
|
|
||||||
if (!device) console.log(`! 未读到客户端设备身份（${DEVICE_FILE}），校验时将跳过`)
|
|
||||||
else console.log(`· 客户端设备: did=${device.did} iid=${device.iid}`)
|
|
||||||
|
|
||||||
const sessionid = readSessionId()
|
|
||||||
if (!sessionid) die('客户端未登录（cookie 库中没有 .qishui.com 的 sessionid），请先在客户端登录')
|
|
||||||
|
|
||||||
let verified = null
|
|
||||||
if (!skipVerify && device) {
|
|
||||||
verified = await verify(sessionid, device)
|
|
||||||
if (verified === false) die('客户端登录态已失效，请在汽水音乐客户端重新登录后再跑本脚本')
|
|
||||||
}
|
|
||||||
console.log(`· sessionid: ${sessionid.slice(0, 6)}…${sessionid.slice(-4)}（${sessionid.length} 字符）`)
|
|
||||||
console.log(`· 校验: ${verified === true ? '有效' : verified === false ? '已失效' : skipVerify ? '已跳过（--no-verify）' : '无法判定（缺签名模块或网络异常）'}`)
|
|
||||||
|
|
||||||
if (printOnly) {
|
|
||||||
console.log(sessionid)
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
const auth = existsSync(authPath) ? JSON.parse(readFileSync(authPath, 'utf8')) : {}
|
|
||||||
auth.qs = { ...(auth.qs || {}), sessionid, cookie: `sessionid=${sessionid}`, source: 'local-client', updatedAt: new Date().toISOString() }
|
|
||||||
writeFileSync(authPath, `${JSON.stringify(auth, null, 2)}\n`)
|
|
||||||
console.log(`✓ 已写入 ${authPath}（qs.sessionid）`)
|
|
||||||
console.log(' 服务在运行的话需要重启才生效（凭据已缓存）；之后 /login/status 的 qs.logged 应为 true')
|
|
||||||
}
|
|
||||||
|
|
||||||
main().catch(err => die(err?.message ?? String(err)))
|
|
||||||
+4
-4
@@ -8,7 +8,7 @@
|
|||||||
// 统一接口约定：apis('qs').getMusicUrl(songInfo, type) → { promise, cancelHttp }
|
// 统一接口约定：apis('qs').getMusicUrl(songInfo, type) → { promise, cancelHttp }
|
||||||
// promise resolve → { type, url }
|
// promise resolve → { type, url }
|
||||||
|
|
||||||
import { httpFetch } from '../request.ts'
|
import { httpFetch } from '../common/request.ts'
|
||||||
import { createHash, randomBytes } from 'node:crypto'
|
import { createHash, randomBytes } from 'node:crypto'
|
||||||
import musicInfo from '../qs/musicInfo.ts'
|
import musicInfo from '../qs/musicInfo.ts'
|
||||||
import { getDevice } from '../qs/device.ts'
|
import { getDevice } from '../qs/device.ts'
|
||||||
@@ -156,10 +156,10 @@ const fetchTrackPlayerByApp = async (trackId: string) => {
|
|||||||
}, requestBody)
|
}, requestBody)
|
||||||
}
|
}
|
||||||
|
|
||||||
// 通道 B（降级）：官方 PC 客户端签名 X-Helios/X-Medusa（需 sdk/qs/mssdk.ts 的签名模块）
|
// 通道 B（降级）：官方 PC 客户端签名 X-Helios/X-Medusa（签名服务器或固定值，见 sdk/qs/mssdk.ts）
|
||||||
const fetchTrackPlayerByPc = async (trackId: string) => {
|
const fetchTrackPlayerByPc = async (trackId: string) => {
|
||||||
const sessionId = getSessionId()
|
const sessionId = getSessionId()
|
||||||
if (!mssdkAvailable()) throw new Error('官方签名模块不可用')
|
if (!mssdkAvailable()) throw new Error('PC 签名不可用')
|
||||||
const url = `${TRACK_V2_URL}?${new URLSearchParams(pcCommonParams()).toString()}`
|
const url = `${TRACK_V2_URL}?${new URLSearchParams(pcCommonParams()).toString()}`
|
||||||
const requestBody = TRACK_V2_BODY(trackId)
|
const requestBody = TRACK_V2_BODY(trackId)
|
||||||
const headers: Record<string, string> = {
|
const headers: Record<string, string> = {
|
||||||
@@ -172,7 +172,7 @@ const fetchTrackPlayerByPc = async (trackId: string) => {
|
|||||||
'x-ss-stub': createHash('md5').update(requestBody).digest('hex').toUpperCase(),
|
'x-ss-stub': createHash('md5').update(requestBody).digest('hex').toUpperCase(),
|
||||||
...(sessionId ? { cookie: getCookie() || `sessionid=${sessionId}` } : {}),
|
...(sessionId ? { cookie: getCookie() || `sessionid=${sessionId}` } : {}),
|
||||||
}
|
}
|
||||||
const signed = signQishuiRequest(url, headers)
|
const signed = await signQishuiRequest(url, headers, requestBody)
|
||||||
if (!signed) throw new Error('官方签名失败')
|
if (!signed) throw new Error('官方签名失败')
|
||||||
return fetchTrackPlayer(url, { ...headers, ...signed }, requestBody)
|
return fetchTrackPlayer(url, { ...headers, ...signed }, requestBody)
|
||||||
}
|
}
|
||||||
|
|||||||
+123
-84
@@ -1,107 +1,141 @@
|
|||||||
// 汽水官方 PC 客户端签名（X-Helios / X-Medusa）—— 可选增强，缺原生模块时整体降级
|
// 汽水 PC 通道签名（X-Helios / X-Medusa）—— 两种供给方式，按优先级：
|
||||||
//
|
// 1) 签名服务器：环境变量 QS_SIGN_SERVER 指向签名服务（如 http://127.0.0.1:8899，
|
||||||
// 原理：直接复用官方客户端自带的原生模块 bdms.node（官方 main 进程就是
|
// 可选 QS_SIGN_TOKEN 配 Bearer 鉴权），HTTP POST /sign。
|
||||||
// bdms.init({ deviceId }) → generateHttpSignatureHeaders(url, "名字\r\n值\r\n…")，
|
// 契约同时兼容独立仓库 qs-signer（gitea.4i.hk/hhhge/qs-signer，本地与 MusicServer 同级）
|
||||||
// 把返回的 name/value 成对写回请求头）。与 sodahub-org/libmssdk 同一套做法，
|
// 的两个服务（请求 {url, headers, body?}，响应 {ok, headers, added?}）：
|
||||||
// 区别是我们进程内加载，不另起 HTTP 签名服务。
|
// - server.mjs （Wine + bdms.node）
|
||||||
|
// - mssdk-sign/ （metasecml.dll 独立进程，见其 README）
|
||||||
|
// 2) 固定值兜底：无签名服务器时，两个加密头直接用抓包固定值 ——
|
||||||
|
// 环境变量 QS_HELIOS / QS_MEDUSA，或 data/qs-sign.json：
|
||||||
|
// { "helios": "…", "medusa": "…", "device_id": "…", "install_id": "…" }
|
||||||
|
// 签名与设备/URL 绑定：固定值必须搭配抓包时的同一套 device_id/install_id
|
||||||
|
// （json 里带上即自动对齐 URL 参数），时效自负，被风控时走安卓通道兜底。
|
||||||
|
// 两者都没有：PC 通道不可用，搜索/取流自动走安卓自签通道。
|
||||||
// 官方只对 qishui.com 且 **非** /passport/、非 /ttwid/ 的请求签名 —— 登录链路用不到本模块。
|
// 官方只对 qishui.com 且 **非** /passport/、非 /ttwid/ 的请求签名 —— 登录链路用不到本模块。
|
||||||
// 签名覆盖 URL + 全部请求头；POST 的 x-ss-stub（body 的 MD5 大写）既是签名输入也要随请求发出。
|
// 签名覆盖 URL + 全部请求头；POST 的 x-ss-stub（body 的 MD5 大写）既是签名输入也要随请求发出。
|
||||||
//
|
import { existsSync, readFileSync } from 'node:fs'
|
||||||
// 原生文件（官方客户端二进制，专有、不入库、不再分发）放置位置任选其一：
|
|
||||||
// 1) 环境变量 QS_MSSDK_DIR 指向同时含 bdms.node 与 metasecml.dll 的目录
|
|
||||||
// 2) 仓库根 soda-mssdk/（已 gitignore）
|
|
||||||
// 3) 本机已安装的官方客户端：%LOCALAPPDATA%\Programs\Soda Music\<版本>\resources\app.asar.unpacked
|
|
||||||
// 从安装包提取：官方 SodaMusic-v*-official-win32_x64.exe → Bandizip 解 NSIS →
|
|
||||||
// $Var31/app.7z → resources/app.asar.unpacked/{bdms.node, metasecml.dll}
|
|
||||||
import { createRequire } from 'node:module'
|
|
||||||
import { existsSync, readdirSync } from 'node:fs'
|
|
||||||
import { dirname, join } from 'node:path'
|
import { dirname, join } from 'node:path'
|
||||||
import { fileURLToPath } from 'node:url'
|
import { fileURLToPath } from 'node:url'
|
||||||
import { getDeviceIds } from './device.ts'
|
import { getDeviceIds } from './device.ts'
|
||||||
|
|
||||||
const require = createRequire(import.meta.url)
|
|
||||||
|
|
||||||
const MODULE_NAME = 'bdms.node'
|
|
||||||
const CLIENT_DIR_NAMES = ['Soda Music', 'SodaMusic', '汽水音乐']
|
|
||||||
// 仓库根（本文件在 sdk/qs/ 下）——不依赖 process.cwd()，从任何目录启动都能找到
|
// 仓库根（本文件在 sdk/qs/ 下）——不依赖 process.cwd()，从任何目录启动都能找到
|
||||||
const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..')
|
const REPO_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..')
|
||||||
|
const FIXED_SIGN_FILE = join(REPO_ROOT, 'data', 'qs-sign.json')
|
||||||
|
const SIGN_TIMEOUT = 5000
|
||||||
|
|
||||||
const findModuleDir = (): string | null => {
|
/** 固定值配置（helios/medusa 必填；device_id/install_id 应与抓包时同一套） */
|
||||||
const candidates: string[] = []
|
interface FixedSignConfig {
|
||||||
if (process.env.QS_MSSDK_DIR) candidates.push(process.env.QS_MSSDK_DIR)
|
helios: string
|
||||||
candidates.push(join(REPO_ROOT, 'soda-mssdk'))
|
medusa: string
|
||||||
const localAppData = process.env.LOCALAPPDATA
|
deviceId: string
|
||||||
if (localAppData) {
|
installId: string
|
||||||
for (const name of CLIENT_DIR_NAMES) {
|
}
|
||||||
const root = join(localAppData, 'Programs', name)
|
|
||||||
if (!existsSync(root)) continue
|
let fixedConfigWarned = false
|
||||||
try {
|
|
||||||
for (const ver of readdirSync(root)) candidates.push(join(root, ver, 'resources', 'app.asar.unpacked'))
|
/** 读固定值：环境变量 QS_HELIOS/QS_MEDUSA 优先，其次 data/qs-sign.json；没有返回 null */
|
||||||
} catch {
|
const readFixedConfig = (): FixedSignConfig | null => {
|
||||||
// 读不到目录就跳过
|
const envHelios = process.env.QS_HELIOS?.trim()
|
||||||
|
const envMedusa = process.env.QS_MEDUSA?.trim()
|
||||||
|
if (envHelios && envMedusa) {
|
||||||
|
return {
|
||||||
|
helios: envHelios,
|
||||||
|
medusa: envMedusa,
|
||||||
|
deviceId: process.env.QS_SIGN_DEVICE_ID?.trim() ?? '',
|
||||||
|
installId: process.env.QS_SIGN_INSTALL_ID?.trim() ?? '',
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (!existsSync(FIXED_SIGN_FILE)) return null
|
||||||
|
try {
|
||||||
|
const data = JSON.parse(readFileSync(FIXED_SIGN_FILE, 'utf8')) as Record<string, unknown>
|
||||||
|
const helios = String(data.helios ?? '').trim()
|
||||||
|
const medusa = String(data.medusa ?? '').trim()
|
||||||
|
if (helios && medusa) {
|
||||||
|
return {
|
||||||
|
helios,
|
||||||
|
medusa,
|
||||||
|
deviceId: String(data.device_id ?? '').trim(),
|
||||||
|
installId: String(data.install_id ?? '').trim(),
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
if (!fixedConfigWarned) {
|
||||||
return candidates.find(dir => dir && existsSync(join(dir, MODULE_NAME))) ?? null
|
fixedConfigWarned = true
|
||||||
}
|
console.log(`[qs/mssdk] ${FIXED_SIGN_FILE} 缺少 helios/medusa 字段，固定值模式不启用`)
|
||||||
|
|
||||||
interface BdmsModule {
|
|
||||||
init: (options: { deviceId: string }) => unknown
|
|
||||||
generateHttpSignatureHeaders: (url: string, headersLines: string) => string
|
|
||||||
}
|
|
||||||
|
|
||||||
let signer: { module: BdmsModule; deviceId: string; dir: string } | null | undefined
|
|
||||||
|
|
||||||
/** 懒加载官方签名模块（失败只提示一次，之后一律按不可用处理） */
|
|
||||||
const loadSigner = () => {
|
|
||||||
if (signer !== undefined) return signer
|
|
||||||
signer = null
|
|
||||||
try {
|
|
||||||
const dir = findModuleDir()
|
|
||||||
if (!dir) return signer
|
|
||||||
const mod = require(join(dir, MODULE_NAME)) as BdmsModule
|
|
||||||
if (typeof mod?.init !== 'function' || typeof mod?.generateHttpSignatureHeaders !== 'function') {
|
|
||||||
console.log(`[qs/mssdk] ${MODULE_NAME} 导出不符合预期，按不可用处理`)
|
|
||||||
return signer
|
|
||||||
}
|
}
|
||||||
const { deviceId } = getDeviceIds()
|
|
||||||
mod.init({ deviceId })
|
|
||||||
signer = { module: mod, deviceId, dir }
|
|
||||||
console.log(`[qs/mssdk] 官方签名模块已加载: ${dir} (device_id=${deviceId})`)
|
|
||||||
} catch (err: any) {
|
} catch (err: any) {
|
||||||
console.log(`[qs/mssdk] 官方签名模块不可用，降级: ${err?.message ?? err}`)
|
if (!fixedConfigWarned) {
|
||||||
|
fixedConfigWarned = true
|
||||||
|
console.log(`[qs/mssdk] 固定值配置解析失败: ${err?.message ?? err}`)
|
||||||
|
}
|
||||||
}
|
}
|
||||||
return signer
|
return null
|
||||||
}
|
}
|
||||||
|
|
||||||
/** 官方签名是否可用（不影响主流程，仅决定走 PC 通道还是安卓通道） */
|
type SignMode =
|
||||||
export const mssdkAvailable = (): boolean => Boolean(loadSigner())
|
| { kind: 'server'; server: string; token: string }
|
||||||
|
| { kind: 'fixed'; fixed: FixedSignConfig }
|
||||||
|
|
||||||
/** 签名时绑定的设备（与请求 URL 里的 device_id/iid 必须一致） */
|
/** 当前签名供给方式：签名服务器 > 固定值 > 不可用（null） */
|
||||||
export const mssdkDeviceId = (): string => loadSigner()?.deviceId ?? ''
|
const loadSignMode = (): SignMode | null => {
|
||||||
|
const server = process.env.QS_SIGN_SERVER?.trim().replace(/\/+$/, '')
|
||||||
|
if (server) return { kind: 'server', server, token: process.env.QS_SIGN_TOKEN?.trim() ?? '' }
|
||||||
|
const fixed = readFixedConfig()
|
||||||
|
return fixed ? { kind: 'fixed', fixed } : null
|
||||||
|
}
|
||||||
|
|
||||||
|
/** PC 签名是否可用（只看配置；服务器宕机等运行期失败由签名调用返回 null、调用方降级处理） */
|
||||||
|
export const mssdkAvailable = (): boolean => Boolean(loadSignMode())
|
||||||
|
|
||||||
|
const signViaServer = async (
|
||||||
|
server: string,
|
||||||
|
token: string,
|
||||||
|
url: string,
|
||||||
|
headers: Record<string, string>,
|
||||||
|
body?: string,
|
||||||
|
): Promise<Record<string, string> | null> => {
|
||||||
|
try {
|
||||||
|
const res = await fetch(`${server}/sign`, {
|
||||||
|
method: 'POST',
|
||||||
|
headers: {
|
||||||
|
'content-type': 'application/json',
|
||||||
|
...(token ? { authorization: `Bearer ${token}` } : {}),
|
||||||
|
},
|
||||||
|
body: JSON.stringify({ url, headers, body }),
|
||||||
|
signal: AbortSignal.timeout(SIGN_TIMEOUT),
|
||||||
|
})
|
||||||
|
const json = await res.json().catch(() => null) as any
|
||||||
|
if (!res.ok || !json?.ok) {
|
||||||
|
console.log(`[qs/mssdk] 签名服务返回异常: HTTP ${res.status} ${json?.error ?? ''}`.trim())
|
||||||
|
return null
|
||||||
|
}
|
||||||
|
// signer/server.mjs 把 x-ss-stub 并进 headers，mssdk-sign 放 added —— 合并即可
|
||||||
|
const signed: Record<string, string> = { ...(json.headers ?? {}), ...(json.added ?? {}) }
|
||||||
|
if (!signed['X-Helios'] && !signed['x-helios']) {
|
||||||
|
console.log('[qs/mssdk] 签名结果缺少 X-Helios')
|
||||||
|
return null
|
||||||
|
}
|
||||||
|
return signed
|
||||||
|
} catch (err: any) {
|
||||||
|
console.log(`[qs/mssdk] 签名服务不可达: ${err?.message ?? err}`)
|
||||||
|
return null
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* 给一个 qishui.com 请求签名
|
* 给一个 qishui.com 请求签名
|
||||||
* @param headers 必须是「真实要发出去的那一份」（含 cookie / x-ss-stub）
|
* @param headers 必须是「真实要发出去的那一份」（含 cookie / x-ss-stub）
|
||||||
* @returns 需追加的头；不可用时返回 null（调用方走原通道）
|
* @param body POST body（给了且 headers 没带 x-ss-stub 时服务端会自动补）
|
||||||
|
* @returns 需追加的头；不可用时返回 null（调用方走安卓通道）
|
||||||
*/
|
*/
|
||||||
export const signQishuiRequest = (url: string, headers: Record<string, string>): Record<string, string> | null => {
|
export const signQishuiRequest = async (
|
||||||
const current = loadSigner()
|
url: string,
|
||||||
if (!current) return null
|
headers: Record<string, string>,
|
||||||
try {
|
body?: string,
|
||||||
const lines = Object.entries(headers)
|
): Promise<Record<string, string> | null> => {
|
||||||
.filter(([name, value]) => name && value != null)
|
const mode = loadSignMode()
|
||||||
.map(([name, value]) => `${name}\r\n${value}`)
|
if (!mode) return null
|
||||||
.join('\r\n')
|
if (mode.kind === 'fixed') return { 'X-Helios': mode.fixed.helios, 'X-Medusa': mode.fixed.medusa }
|
||||||
const fields = String(current.module.generateHttpSignatureHeaders(url, lines)).split('\r\n').filter(Boolean)
|
return signViaServer(mode.server, mode.token, url, headers, body)
|
||||||
const signed: Record<string, string> = {}
|
|
||||||
for (let i = 0; i + 1 < fields.length; i += 2) signed[fields[i]] = fields[i + 1]
|
|
||||||
if (!signed['X-Helios'] && !signed['x-helios']) return null
|
|
||||||
return signed
|
|
||||||
} catch (err: any) {
|
|
||||||
console.log(`[qs/mssdk] 签名失败，本次降级: ${err?.message ?? err}`)
|
|
||||||
return null
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/** 官方 PC 端 UA（签名与 UA 绑定同一客户端版本） */
|
/** 官方 PC 端 UA（签名与 UA 绑定同一客户端版本） */
|
||||||
@@ -109,7 +143,12 @@ export const PC_UA = 'LunaPC/3.7.0(452316191)'
|
|||||||
|
|
||||||
/** 官方 PC 端公共查询参数（与签名设备成套；track_v2 / search 等 luna_pc 接口共用） */
|
/** 官方 PC 端公共查询参数（与签名设备成套；track_v2 / search 等 luna_pc 接口共用） */
|
||||||
export const pcCommonParams = (): Record<string, string> => {
|
export const pcCommonParams = (): Record<string, string> => {
|
||||||
const { deviceId, installId } = getDeviceIds()
|
const mode = loadSignMode()
|
||||||
|
// 固定值是针对抓包设备签的，必须用配套设备；服务器现签则用本地设备（URL 带什么签什么）
|
||||||
|
const fixedDevice = mode?.kind === 'fixed' && mode.fixed.deviceId ? mode.fixed : null
|
||||||
|
const { deviceId, installId } = fixedDevice
|
||||||
|
? { deviceId: fixedDevice.deviceId, installId: fixedDevice.installId }
|
||||||
|
: getDeviceIds()
|
||||||
return {
|
return {
|
||||||
aid: '386088',
|
aid: '386088',
|
||||||
app_name: 'luna_pc',
|
app_name: 'luna_pc',
|
||||||
@@ -135,4 +174,4 @@ export const pcCommonParams = (): Record<string, string> => {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
export default { mssdkAvailable, mssdkDeviceId, signQishuiRequest, pcCommonParams, PC_UA }
|
export default { mssdkAvailable, signQishuiRequest, pcCommonParams, PC_UA }
|
||||||
+57
-34
@@ -1,11 +1,12 @@
|
|||||||
// 汽水音乐搜索（App 搜索接口直连）
|
// 汽水音乐搜索（App 搜索接口直连）
|
||||||
// 接口: https://api.qishui.com/luna/search/track?<公共参数>&q=<关键词>&cursor=
|
// 接口: https://api.qishui.com/luna/search/track?<公共参数>&q=<关键词>&cursor=
|
||||||
// 两条通道（同一接口，差在公共参数与签名，返回结构一致）：
|
// 两条通道（同一接口，差在公共参数与签名，返回结构一致）：
|
||||||
// 官方 PC 通道: 装好官方签名模块（sdk/qs/mssdk.ts）时优先——luna_pc 参数 + X-Helios/X-Medusa；
|
// 官方 PC 通道: PC 签名可用（签名服务器或固定值，见 sdk/qs/mssdk.ts）时优先——
|
||||||
// 安卓指纹通道: 未装签名模块时回退——静态安卓设备参数，缺参数或用 PC 参数不签名会被静默风控
|
// luna_pc 参数 + X-Helios/X-Medusa；签名失败/被风控自动降级安卓通道；
|
||||||
// （200 + 空 body）；被风控时需换新指纹。
|
// 安卓指纹通道: 静态安卓设备参数，缺参数或用 PC 参数不签名会被静默风控（200 + 空 body）；
|
||||||
|
// 被风控时需换新指纹。
|
||||||
import { sizeFormate, formatPlayTime } from '../index.ts'
|
import { sizeFormate, formatPlayTime } from '../index.ts'
|
||||||
import { httpFetch } from '../request.ts'
|
import { httpFetch } from '../common/request.ts'
|
||||||
import { coverUrl } from './musicInfo.ts'
|
import { coverUrl } from './musicInfo.ts'
|
||||||
import { mssdkAvailable, signQishuiRequest, pcCommonParams, PC_UA } from './mssdk.ts'
|
import { mssdkAvailable, signQishuiRequest, pcCommonParams, PC_UA } from './mssdk.ts'
|
||||||
|
|
||||||
@@ -59,9 +60,9 @@ const SEARCH_DEVICE_PARAMS = {
|
|||||||
const SEARCH_UA = 'Luna/19.8.0 (com.luna.music/100198030);Android 15;ABR-AL80'
|
const SEARCH_UA = 'Luna/19.8.0 (com.luna.music/100198030);Android 15;ABR-AL80'
|
||||||
const PC_PAGE_SIZE = 20
|
const PC_PAGE_SIZE = 20
|
||||||
|
|
||||||
// 有官方签名模块时走官方 PC 通道（PC 参数必须配 X-Helios/X-Medusa，否则上游 200 + 空 body）
|
// PC 通道必须配 X-Helios/X-Medusa（否则上游 200 + 空 body）；安卓通道用静态设备指纹
|
||||||
const buildSearchUrl = (str: string, cursor: number, count: number) => {
|
const buildSearchUrl = (str: string, cursor: number, count: number, pcChannel: boolean) => {
|
||||||
const params = mssdkAvailable()
|
const params = pcChannel
|
||||||
? new URLSearchParams({
|
? new URLSearchParams({
|
||||||
...pcCommonParams(),
|
...pcCommonParams(),
|
||||||
q: str,
|
q: str,
|
||||||
@@ -118,34 +119,56 @@ export default {
|
|||||||
}
|
}
|
||||||
}).filter(Boolean)
|
}).filter(Boolean)
|
||||||
},
|
},
|
||||||
search(str, page = 1, limit, retryNum = 0) {
|
handleSearchBody(rawBody, cursor, page) {
|
||||||
|
const group = rawBody.result_groups.find(g => g?.data?.length) || { data: [], has_more: false }
|
||||||
|
const list = this.handleResult(group.data)
|
||||||
|
const total = group.has_more ? cursor + list.length + 1 : cursor + list.length
|
||||||
|
this.total = total
|
||||||
|
this.page = page
|
||||||
|
this.allPage = group.has_more ? page + 1 : page
|
||||||
|
return {
|
||||||
|
list,
|
||||||
|
allPage: this.allPage,
|
||||||
|
limit: this.limit,
|
||||||
|
total,
|
||||||
|
source: 'qs',
|
||||||
|
}
|
||||||
|
},
|
||||||
|
async search(str, page = 1, limit, retryNum = 0, forceAndroid = false) {
|
||||||
if (++retryNum > 3) return Promise.reject(new Error('try max num'))
|
if (++retryNum > 3) return Promise.reject(new Error('try max num'))
|
||||||
const pcChannel = mssdkAvailable()
|
const pcChannel = !forceAndroid && mssdkAvailable()
|
||||||
// PC 通道每页固定 20 条（上游默认、不接受 count），cursor 必须按 20 步进，否则翻页与 limit 错位重叠
|
if (pcChannel) {
|
||||||
const pageSize = pcChannel ? PC_PAGE_SIZE : (limit ?? this.limit)
|
// PC 通道每页固定 20 条（上游默认、不接受 count），cursor 必须按 20 步进，否则翻页与 limit 错位重叠
|
||||||
const cursor = pageSize * (page - 1)
|
const pageSize = PC_PAGE_SIZE
|
||||||
const url = buildSearchUrl(str, cursor, pageSize)
|
const cursor = pageSize * (page - 1)
|
||||||
// 签名覆盖真实发出的头：先定头、再签、再发
|
const url = buildSearchUrl(str, cursor, pageSize, true)
|
||||||
const headers: Record<string, string> = { 'User-Agent': pcChannel ? PC_UA : SEARCH_UA }
|
// 签名覆盖真实发出的头：先定头、再签、再发
|
||||||
const signed = signQishuiRequest(url, headers)
|
const headers: Record<string, string> = { 'User-Agent': PC_UA }
|
||||||
if (signed) Object.assign(headers, signed)
|
const fallbackToAndroid = (reason: string) => {
|
||||||
const searchRequest = httpFetch(url, { method: 'get', headers, timeout: 15000 })
|
console.log(`[qs/search] PC 通道${reason}，降级安卓通道`)
|
||||||
return searchRequest.promise.then(({ body }) => {
|
return this.search(str, page, limit, retryNum, true)
|
||||||
// 被风控/无结果时上游不返回 result_groups（200 + {"extra":{"empty_search":1}}），重试
|
|
||||||
if (!body?.result_groups) return this.search(str, page, limit, retryNum)
|
|
||||||
const group = body.result_groups.find(g => g?.data?.length) || { data: [], has_more: false }
|
|
||||||
const list = this.handleResult(group.data)
|
|
||||||
const total = group.has_more ? cursor + list.length + 1 : cursor + list.length
|
|
||||||
this.total = total
|
|
||||||
this.page = page
|
|
||||||
this.allPage = group.has_more ? page + 1 : page
|
|
||||||
return {
|
|
||||||
list,
|
|
||||||
allPage: this.allPage,
|
|
||||||
limit: this.limit,
|
|
||||||
total,
|
|
||||||
source: 'qs',
|
|
||||||
}
|
}
|
||||||
})
|
let body: any = null
|
||||||
|
try {
|
||||||
|
// 签名失败（服务器宕机/固定值被风控）与请求异常都降级安卓通道
|
||||||
|
const signed = await signQishuiRequest(url, headers)
|
||||||
|
if (!signed) return fallbackToAndroid('签名不可用')
|
||||||
|
const searchRequest = await httpFetch(url, { method: 'get', headers: { ...headers, ...signed }, timeout: 15000 }).promise
|
||||||
|
body = searchRequest.body
|
||||||
|
} catch (err: any) {
|
||||||
|
return fallbackToAndroid(`请求失败: ${err?.message ?? err}`)
|
||||||
|
}
|
||||||
|
// 被风控/无结果时上游不返回 result_groups（200 + {"extra":{"empty_search":1}}）
|
||||||
|
if (!body?.result_groups) return fallbackToAndroid('空结果（疑似风控）')
|
||||||
|
return this.handleSearchBody(body, cursor, page)
|
||||||
|
}
|
||||||
|
// 安卓指纹通道：无签名直发，空结果时换 _rticket 重试
|
||||||
|
const pageSize = limit ?? this.limit
|
||||||
|
const cursor = pageSize * (page - 1)
|
||||||
|
const url = buildSearchUrl(str, cursor, pageSize, false)
|
||||||
|
const headers: Record<string, string> = { 'User-Agent': SEARCH_UA }
|
||||||
|
const { body } = await httpFetch(url, { method: 'get', headers, timeout: 15000 }).promise
|
||||||
|
if (!body?.result_groups) return this.search(str, page, limit, retryNum)
|
||||||
|
return this.handleSearchBody(body, cursor, page)
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
@@ -1,247 +0,0 @@
|
|||||||
#!/usr/bin/env node
|
|
||||||
// 汽水音乐外部签名服务 —— 在 Linux 上用 Wine 跑官方 bdms.node，对外只提供签名
|
|
||||||
//
|
|
||||||
// 为什么需要它：bdms.node 是 Windows PE 原生模块，只能由 Windows 版 Node/Electron 加载。
|
|
||||||
// 把「加载官方模块」这件事单独关进一个容器（Wine + Windows Node），主服务就能跑在任何平台，
|
|
||||||
// 通过 HTTP 拿 X-Helios / X-Medusa —— 契约与 sodahub-org/libmssdk、libresoda、
|
|
||||||
// Meting-API 的远程签名服务互通（三者 JSON 可互换）。
|
|
||||||
//
|
|
||||||
// 路由：
|
|
||||||
// GET /healthz → { ok, service, version, bdmsAvailable, deviceId(脱敏), auth, platform }
|
|
||||||
// GET /config → 需鉴权：设备身份（调用方据此对齐 URL 里的 device_id/iid）
|
|
||||||
// POST /sign → { url, method?, headers, body?, device_id? } → { ok, headers:{X-Helios,X-Medusa}, device_id, elapsed_ms }
|
|
||||||
// POST /selftest → 用样例请求自检（不联网）
|
|
||||||
//
|
|
||||||
// 鉴权：QS_SIGNER_TOKEN（Authorization: Bearer <token>）。未设 token 时除非
|
|
||||||
// QS_SIGNER_ALLOW_ANONYMOUS=1，否则拒绝启动 —— 签名能力等价于账号取流能力，别裸奔。
|
|
||||||
// 环境变量：QS_SIGNER_BIND(127.0.0.1) / QS_SIGNER_PORT(8899) / QS_SIGNER_TOKEN /
|
|
||||||
// QS_SIGNER_DEVICE_ID / QS_SIGNER_BDMS_MODULE(默认 ./vendor/bdms.node) / QS_SIGNER_MAX_BODY
|
|
||||||
// 日志只记请求形状与耗时：Cookie、X-Helios、X-Medusa 一律不落盘。
|
|
||||||
'use strict'
|
|
||||||
|
|
||||||
const http = require('node:http')
|
|
||||||
const crypto = require('node:crypto')
|
|
||||||
const fs = require('node:fs')
|
|
||||||
const path = require('node:path')
|
|
||||||
|
|
||||||
const VERSION = '0.1.0'
|
|
||||||
const SERVICE = 'qs-signer'
|
|
||||||
const BIND = process.env.QS_SIGNER_BIND || '127.0.0.1'
|
|
||||||
const PORT = Number(process.env.QS_SIGNER_PORT) || 8899
|
|
||||||
const TOKEN = process.env.QS_SIGNER_TOKEN || ''
|
|
||||||
const ALLOW_ANONYMOUS = process.env.QS_SIGNER_ALLOW_ANONYMOUS === '1'
|
|
||||||
const DEFAULT_DEVICE_ID = process.env.QS_SIGNER_DEVICE_ID || ''
|
|
||||||
const MAX_BODY = Number(process.env.QS_SIGNER_MAX_BODY) || 256 * 1024
|
|
||||||
const MODULE_PATH = path.resolve(process.env.QS_SIGNER_BDMS_MODULE || path.join(__dirname, 'vendor', 'bdms.node'))
|
|
||||||
|
|
||||||
if (!TOKEN && !ALLOW_ANONYMOUS) {
|
|
||||||
console.error('[qs-signer] 拒绝启动：未设置 QS_SIGNER_TOKEN（本机调试可显式 QS_SIGNER_ALLOW_ANONYMOUS=1）')
|
|
||||||
process.exit(1)
|
|
||||||
}
|
|
||||||
|
|
||||||
const maskDevice = (id) => {
|
|
||||||
const value = String(id || '')
|
|
||||||
return value.length <= 6 ? value : `${value.slice(0, 3)}***${value.slice(-3)}`
|
|
||||||
}
|
|
||||||
|
|
||||||
// —— 官方模块加载：一次 require，按设备 init（换设备要重新 init）——
|
|
||||||
let bdms = null
|
|
||||||
let loadError = ''
|
|
||||||
let initedDevice = ''
|
|
||||||
const loadBdms = () => {
|
|
||||||
if (bdms) return bdms
|
|
||||||
if (loadError) return null
|
|
||||||
try {
|
|
||||||
if (!fs.existsSync(MODULE_PATH)) throw new Error(`找不到 ${MODULE_PATH}`)
|
|
||||||
const mod = require(MODULE_PATH)
|
|
||||||
if (typeof mod.init !== 'function' || typeof mod.generateHttpSignatureHeaders !== 'function') {
|
|
||||||
throw new Error('导出不符合预期（需要 init / generateHttpSignatureHeaders）')
|
|
||||||
}
|
|
||||||
bdms = mod
|
|
||||||
console.log(`[qs-signer] bdms 模块已加载: ${MODULE_PATH}`)
|
|
||||||
return bdms
|
|
||||||
} catch (err) {
|
|
||||||
loadError = String((err && err.message) || err)
|
|
||||||
console.error(`[qs-signer] bdms 模块加载失败: ${loadError}（/sign 将返回 503，/healthz 仍可用）`)
|
|
||||||
return null
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
const deviceIdFromRequest = (url, headers, explicit) => {
|
|
||||||
if (explicit) return String(explicit).trim()
|
|
||||||
try {
|
|
||||||
const parsed = new URL(String(url))
|
|
||||||
for (const key of ['device_id', 'did', 'fp']) {
|
|
||||||
const value = parsed.searchParams.get(key)
|
|
||||||
if (value) return value.trim()
|
|
||||||
}
|
|
||||||
} catch {
|
|
||||||
// URL 不合法就继续往下找
|
|
||||||
}
|
|
||||||
for (const name of ['x-device-id', 'device-id', 'device_id']) {
|
|
||||||
if (headers && headers[name]) return String(headers[name]).trim()
|
|
||||||
}
|
|
||||||
return DEFAULT_DEVICE_ID
|
|
||||||
}
|
|
||||||
|
|
||||||
const ensureInit = (deviceId) => {
|
|
||||||
const mod = loadBdms()
|
|
||||||
if (!mod) throw new Error(loadError || 'bdms 模块不可用')
|
|
||||||
const target = String(deviceId || DEFAULT_DEVICE_ID || '').trim()
|
|
||||||
if (!target) throw new Error('缺少 device_id：请求里带 device_id（或 URL 查询参数 device_id/did/fp），或设置 QS_SIGNER_DEVICE_ID')
|
|
||||||
if (initedDevice !== target) {
|
|
||||||
mod.init({ deviceId: target })
|
|
||||||
initedDevice = target
|
|
||||||
console.log(`[qs-signer] 已绑定设备 ${maskDevice(target)}`)
|
|
||||||
}
|
|
||||||
return mod
|
|
||||||
}
|
|
||||||
|
|
||||||
const flattenHeaders = (headers) => {
|
|
||||||
const lines = []
|
|
||||||
for (const [name, value] of Object.entries(headers || {})) {
|
|
||||||
if (!name || value === undefined || value === null) continue
|
|
||||||
const items = Array.isArray(value) ? value : [value]
|
|
||||||
for (const item of items) lines.push(`${name}\r\n${item}`)
|
|
||||||
}
|
|
||||||
return lines.join('\r\n')
|
|
||||||
}
|
|
||||||
|
|
||||||
const parseSignaturePairs = (raw) => {
|
|
||||||
const fields = String(raw || '').split('\r\n').filter((t) => t.trim())
|
|
||||||
const signed = {}
|
|
||||||
for (let i = 0; i + 1 < fields.length; i += 2) signed[fields[i]] = fields[i + 1]
|
|
||||||
return signed
|
|
||||||
}
|
|
||||||
|
|
||||||
/** 签名一次请求：返回需追加/覆盖的请求头（含服务端补的 x-ss-stub） */
|
|
||||||
const signRequest = ({ url, headers = {}, body, deviceId }) => {
|
|
||||||
if (!url) throw new Error('url 不能为空')
|
|
||||||
const target = ensureInit(deviceIdFromRequest(url, headers, deviceId))
|
|
||||||
const outgoing = { ...headers }
|
|
||||||
// 有 body 却没给 x-ss-stub 时补上（它是签名输入，也要随请求发出），大小写保持官方写法
|
|
||||||
if (body && !Object.keys(outgoing).some((k) => k.toLowerCase() === 'x-ss-stub')) {
|
|
||||||
outgoing['x-ss-stub'] = crypto.createHash('md5').update(String(body)).digest('hex').toUpperCase()
|
|
||||||
}
|
|
||||||
const signed = parseSignaturePairs(target.generateHttpSignatureHeaders(String(url), flattenHeaders(outgoing)))
|
|
||||||
if (!signed['X-Helios'] && !signed['x-helios']) throw new Error('签名结果缺少 X-Helios')
|
|
||||||
return { signed: { ...signed, ...(body ? { 'x-ss-stub': outgoing['x-ss-stub'] } : {}) }, deviceId: initedDevice }
|
|
||||||
}
|
|
||||||
|
|
||||||
const json = (res, status, payload) => {
|
|
||||||
const text = JSON.stringify(payload)
|
|
||||||
res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Content-Length': Buffer.byteLength(text) })
|
|
||||||
res.end(text)
|
|
||||||
}
|
|
||||||
|
|
||||||
const readBody = (req) => new Promise((resolve, reject) => {
|
|
||||||
let size = 0
|
|
||||||
const chunks = []
|
|
||||||
req.on('data', (chunk) => {
|
|
||||||
size += chunk.length
|
|
||||||
if (size > MAX_BODY) {
|
|
||||||
reject(Object.assign(new Error('请求体过大'), { status: 413 }))
|
|
||||||
req.destroy()
|
|
||||||
return
|
|
||||||
}
|
|
||||||
chunks.push(chunk)
|
|
||||||
})
|
|
||||||
req.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')))
|
|
||||||
req.on('error', reject)
|
|
||||||
})
|
|
||||||
|
|
||||||
const authorized = (req) => {
|
|
||||||
if (!TOKEN) return true
|
|
||||||
const header = String(req.headers.authorization || '')
|
|
||||||
const bearer = header.toLowerCase().startsWith('bearer ') ? header.slice(7).trim() : ''
|
|
||||||
const alt = String(req.headers['x-signer-token'] || '')
|
|
||||||
return bearer === TOKEN || alt === TOKEN
|
|
||||||
}
|
|
||||||
|
|
||||||
const server = http.createServer(async (req, res) => {
|
|
||||||
const started = Date.now()
|
|
||||||
const url = String(req.url || '')
|
|
||||||
const pathname = url.split('?')[0]
|
|
||||||
|
|
||||||
const log = (status) => console.log(`[qs-signer] ${req.method} ${pathname} → ${status} (${Date.now() - started}ms)`)
|
|
||||||
|
|
||||||
try {
|
|
||||||
if (pathname === '/healthz') {
|
|
||||||
log(200)
|
|
||||||
return json(res, 200, {
|
|
||||||
ok: true,
|
|
||||||
service: SERVICE,
|
|
||||||
version: VERSION,
|
|
||||||
bdmsAvailable: Boolean(bdms) || (!loadError && fs.existsSync(MODULE_PATH)),
|
|
||||||
deviceId: maskDevice(initedDevice || DEFAULT_DEVICE_ID),
|
|
||||||
auth: Boolean(TOKEN),
|
|
||||||
platform: `${process.platform} ${process.arch}`,
|
|
||||||
node: process.version,
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
if (!authorized(req)) {
|
|
||||||
log(401)
|
|
||||||
return json(res, 401, { ok: false, error: 'unauthorized', code: 'unauthorized' })
|
|
||||||
}
|
|
||||||
|
|
||||||
if (pathname === '/config') {
|
|
||||||
log(200)
|
|
||||||
return json(res, 200, {
|
|
||||||
ok: true,
|
|
||||||
service: SERVICE,
|
|
||||||
version: VERSION,
|
|
||||||
bdmsModule: MODULE_PATH,
|
|
||||||
bdmsLoaded: Boolean(bdms),
|
|
||||||
loadError,
|
|
||||||
deviceId: maskDevice(initedDevice || DEFAULT_DEVICE_ID),
|
|
||||||
identity: { device_id: initedDevice || DEFAULT_DEVICE_ID, source: initedDevice ? 'request' : (DEFAULT_DEVICE_ID ? 'env' : 'unset') },
|
|
||||||
})
|
|
||||||
}
|
|
||||||
|
|
||||||
if (pathname === '/selftest') {
|
|
||||||
try {
|
|
||||||
const sampleUrl = 'https://api.qishui.com/luna/pc/track_v2?aid=386088&device_id=1&iid=2'
|
|
||||||
const { signed } = signRequest({ url: sampleUrl, headers: { 'user-agent': 'LunaPC/selftest' }, deviceId: DEFAULT_DEVICE_ID || '1' })
|
|
||||||
log(200)
|
|
||||||
return json(res, 200, { ok: true, headers: Object.keys(signed), lengths: Object.fromEntries(Object.entries(signed).map(([k, v]) => [k, String(v).length])) })
|
|
||||||
} catch (err) {
|
|
||||||
log(503)
|
|
||||||
return json(res, 503, { ok: false, error: String((err && err.message) || err), code: 'signer_error' })
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if (pathname === '/sign' && req.method === 'POST') {
|
|
||||||
const raw = await readBody(req)
|
|
||||||
let payload
|
|
||||||
try {
|
|
||||||
payload = JSON.parse(raw || '{}')
|
|
||||||
} catch {
|
|
||||||
log(400)
|
|
||||||
return json(res, 400, { ok: false, error: 'invalid JSON', code: 'bad_request' })
|
|
||||||
}
|
|
||||||
const { url: target, headers = {}, body = '', device_id: deviceId } = payload
|
|
||||||
try {
|
|
||||||
const { signed } = signRequest({ url: target, headers, body, deviceId })
|
|
||||||
log(200)
|
|
||||||
// headers 嵌套给标准调用方；顶层扁平给 Meting 风格调用方
|
|
||||||
return json(res, 200, { ok: true, headers: signed, ...signed, device_id: initedDevice, elapsed_ms: Date.now() - started })
|
|
||||||
} catch (err) {
|
|
||||||
log(503)
|
|
||||||
return json(res, 503, { ok: false, error: String((err && err.message) || err), code: 'signer_error' })
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
log(404)
|
|
||||||
return json(res, 404, { ok: false, error: 'not found' })
|
|
||||||
} catch (err) {
|
|
||||||
const status = err && err.status ? err.status : 500
|
|
||||||
log(status)
|
|
||||||
return json(res, status, { ok: false, error: String((err && err.message) || err) })
|
|
||||||
}
|
|
||||||
})
|
|
||||||
|
|
||||||
server.listen(PORT, BIND, () => {
|
|
||||||
console.log(`[qs-signer] 监听 http://${BIND}:${PORT}（鉴权: ${TOKEN ? 'Bearer token' : '匿名（仅调试）'}）`)
|
|
||||||
loadBdms()
|
|
||||||
})
|
|
||||||
@@ -1,5 +0,0 @@
|
|||||||
# 专有二进制与构建产物不入库
|
|
||||||
metasecml.dll
|
|
||||||
*.exe
|
|
||||||
*.log
|
|
||||||
*.obj
|
|
||||||
@@ -1,186 +0,0 @@
|
|||||||
# mssdk-sign —— 汽水音乐 metasec 签名 HTTP 服务
|
|
||||||
|
|
||||||
把汽水 PC 客户端自带的 `metasecml.dll`(字节 metasec,官方签名主体 *Douyin Vision Co., Ltd.*)
|
|
||||||
关在一个进程里,对外只暴露一个 HTTP `/sign`。于是:
|
|
||||||
|
|
||||||
- **Windows**:直接跑。
|
|
||||||
- **Linux**:丢进 **Wine** 跑,宿主机的服务(MusicServer 等)用 HTTP 调它 —— 专有 DLL 不出 Wine 前缀,宿主机不需要 Windows 运行时。
|
|
||||||
|
|
||||||
对应地,MusicServer 侧 `sdk/qs/mssdk.ts` 里那套「进程内 require bdms.node」可以换成「HTTP 调本服务」,
|
|
||||||
跨平台部署就不用装官方客户端了(二进制仍需自己从官方客户端里取,不入库、不再分发)。
|
|
||||||
|
|
||||||
## 文件
|
|
||||||
|
|
||||||
| 文件 | 说明 |
|
|
||||||
|---|---|
|
|
||||||
| `mssdk-sign.cpp` | 全部实现(单文件,无第三方依赖:Win32 + Winsock + 自带 MD5/JSON) |
|
|
||||||
| `build.bat` | Windows/MSVC 构建 |
|
|
||||||
| `build-mingw.sh` | Linux 交叉编译成 exe(给 Wine 跑) |
|
|
||||||
| `client.mjs` | Node 客户端示例(可直接 `node client.mjs --send` 验证) |
|
|
||||||
| `REVERSE.md` | **逆向记录**:DLL 身份/壳/真实调用 ABI/行为规则/升级后如何重新定位偏移 |
|
|
||||||
|
|
||||||
## 构建
|
|
||||||
|
|
||||||
Windows(MSVC,需要 VS BuildTools):
|
|
||||||
|
|
||||||
```bat
|
|
||||||
build.bat
|
|
||||||
:: 生成 mssdk-sign.exe
|
|
||||||
mssdk-sign.exe --selftest --dll .\metasecml.dll
|
|
||||||
```
|
|
||||||
|
|
||||||
Linux → Wine(MinGW-w64 交叉编译,静态链接,不依赖 libstdc++/winpthread DLL):
|
|
||||||
|
|
||||||
```bash
|
|
||||||
sudo apt install mingw-w64
|
|
||||||
./build-mingw.sh # 生成 mssdk-sign.exe
|
|
||||||
```
|
|
||||||
|
|
||||||
> 注意:源码含中文注释/字符串,**MSVC 必须带 `/utf-8`**(`build.bat` 已带),否则会报一堆莫名其妙的语法错误。
|
|
||||||
|
|
||||||
## 运行
|
|
||||||
|
|
||||||
Windows:
|
|
||||||
|
|
||||||
```bat
|
|
||||||
mssdk-sign.exe --port 16889 --dll .\metasecml.dll --token 你的口令 -v
|
|
||||||
```
|
|
||||||
|
|
||||||
Wine(建议放在自己的 prefix 里,和 DLL 同目录):
|
|
||||||
|
|
||||||
```bash
|
|
||||||
mkdir -p /opt/mssdk-sign && cd /opt/mssdk-sign
|
|
||||||
cp mssdk-sign.exe metasecml.dll .
|
|
||||||
WINEPREFIX=/opt/wine-mssdk wine mssdk-sign.exe --selftest --dll ./metasecml.dll # 先自检
|
|
||||||
WINEPREFIX=/opt/wine-mssdk wine mssdk-sign.exe --port 16889 --bind 0.0.0.0 --token 你的口令 -v
|
|
||||||
```
|
|
||||||
|
|
||||||
systemd 单元示例:
|
|
||||||
|
|
||||||
```ini
|
|
||||||
[Unit]
|
|
||||||
Description=mssdk-sign (metasec signer in Wine)
|
|
||||||
After=network.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
Environment=WINEPREFIX=/opt/wine-mssdk
|
|
||||||
Environment=WINEDEBUG=-all
|
|
||||||
WorkingDirectory=/opt/mssdk-sign
|
|
||||||
ExecStart=/usr/bin/wine /opt/mssdk-sign/mssdk-sign.exe --port 16889 --bind 127.0.0.1 --token CHANGE_ME
|
|
||||||
Restart=always
|
|
||||||
RestartSec=3
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
```
|
|
||||||
|
|
||||||
参数:
|
|
||||||
|
|
||||||
| 参数 | 说明 |
|
|
||||||
|---|---|
|
|
||||||
| `--port <n>` | 监听端口,默认 16889 |
|
|
||||||
| `--bind <addr>` | 默认 `127.0.0.1`;容器/跨机调用才用 `0.0.0.0`(务必配 token) |
|
|
||||||
| `--dll <path>` | `metasecml.dll` 路径,默认 exe 同目录 |
|
|
||||||
| `--token <t>` | 启用鉴权(`Authorization: Bearer <t>` 或 `X-Auth-Token: <t>`) |
|
|
||||||
| `--sign-rva <hex>` | 手动指定签名函数偏移(默认按 DLL 版本表,见下) |
|
|
||||||
| `--selftest` | 只做「加载 DLL + 签名自检」后退出(部署前必跑) |
|
|
||||||
| `-v` | 打印每个请求的签名耗时 |
|
|
||||||
|
|
||||||
## 接口
|
|
||||||
|
|
||||||
### `GET /healthz`(免鉴权)
|
|
||||||
|
|
||||||
```json
|
|
||||||
{"ok":true,"service":"mssdk-sign","version":"0.1.0",
|
|
||||||
"signer":"D:/MusicServer/soda-mssdk/metasecml.dll",
|
|
||||||
"dllVersion":"4.6.1.0","signRva":"0x52af0","auth":true}
|
|
||||||
```
|
|
||||||
|
|
||||||
### `POST /sign`
|
|
||||||
|
|
||||||
```jsonc
|
|
||||||
{
|
|
||||||
"url": "https://api.qishui.com/luna/pc/track_v2?aid=386088&…", // 必填,带完整 query
|
|
||||||
"body": "{\"track_id\":\"…\"}", // 可选:给了且没带 x-ss-stub 时,服务端自动补
|
|
||||||
"headers": { // 必填:真实要发出去的那一份
|
|
||||||
"content-type": "application/json; charset=utf-8",
|
|
||||||
"user-agent": "LunaPC/3.7.0(452316191)",
|
|
||||||
"x-luna-background-type": "foreground",
|
|
||||||
"x-tt-trace-id": "00-…-…-01"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
```json
|
|
||||||
{
|
|
||||||
"ok": true,
|
|
||||||
"headers": {"X-Helios":"…","X-Medusa":"…","X-Neptune":"…"},
|
|
||||||
"added": {"x-ss-stub":"DBA20AB94302CB03AC25A216DD953258"},
|
|
||||||
"elapsed_ms": 43
|
|
||||||
}
|
|
||||||
```
|
|
||||||
|
|
||||||
失败时:`{"ok":false,"error":"…"}` + 400(入参错)/ 401(token)/ 500(签名失败)。
|
|
||||||
|
|
||||||
### 三条硬性约定(踩过坑)
|
|
||||||
|
|
||||||
1. **`headers` 必须是真实要发出的那一份**,一个都不能少(尤其 `cookie`、`x-ss-stub`)。签名覆盖 URL + 全部请求头,
|
|
||||||
少一个服务端就回 `HTTP 200 + 空 body`。
|
|
||||||
2. **`x-ss-stub` = body 的 MD5(大写)**,既是签名输入也要随请求发出。本服务在你传了 `body` 时会自动算并回传
|
|
||||||
(`added.x-ss-stub`),记得把它一起发出去。
|
|
||||||
3. **设备要成套**:URL 里的 `device_id` / `iid` / `fp` 必须是你自己的设备;签名和 URL 里的 `device_id` 绑死,
|
|
||||||
改了 URL 设备号 → 服务端 `200 + 空 body`(实测)。
|
|
||||||
|
|
||||||
### 客户端(Node)
|
|
||||||
|
|
||||||
```js
|
|
||||||
import { signRequest } from './client.mjs'
|
|
||||||
|
|
||||||
const { headers, added } = await signRequest(url, headersToSend, body)
|
|
||||||
await fetch(url, { method: 'POST', headers: { ...headersToSend, ...headers, ...added }, body })
|
|
||||||
```
|
|
||||||
|
|
||||||
集成到 MusicServer 时,把 `sdk/qs/mssdk.ts` 的 `signQishuiRequest()` 换成上面这次 HTTP 调用即可
|
|
||||||
(签名覆盖的 headers 与请求实际发出的 headers 保持同一份、同一顺序)。
|
|
||||||
|
|
||||||
自检:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
node client.mjs # healthz + 签一次(不发真实请求)
|
|
||||||
node client.mjs --send # 顺带发给 api.qishui.com 验证签名被接受
|
|
||||||
```
|
|
||||||
|
|
||||||
## 它是怎么调 DLL 的(逆向结论,2026-10-02)
|
|
||||||
|
|
||||||
- 导出表里的 `MSBridgeML` / `MSBridgeOV` / `o0o0` 都是幌子(桩 / 线程状态初始化),
|
|
||||||
**真正的签名函数在 `image base + 0x52af0`**,原型:
|
|
||||||
|
|
||||||
```c
|
|
||||||
char* sign(const char* url, const char* headers_lines); // headers: "名\r\n值\r\n…"
|
|
||||||
```
|
|
||||||
|
|
||||||
- 返回 `"名\r\n值\r\n…"` 的签名头串,由 DLL 自己的释放函数(`base + 0x1d8c0`)回收。
|
|
||||||
- **不需要 init**;DLL 版本(本机样本)= `metasecbaseml 4.6.1.0`。
|
|
||||||
- 调用是**串行**的(内部有全局/TLS 状态),服务端用互斥锁包住,实测 20 并发全部成功。
|
|
||||||
|
|
||||||
## 客户端升级了怎么办(DLL 换了,偏移会变)
|
|
||||||
|
|
||||||
`--selftest` 会**大声失败**,不会静默出错。定位新偏移:
|
|
||||||
|
|
||||||
1. 从新版客户端里取 `metasecml.dll`(解包方式见 MusicServer 的 `sdk/qs/mssdk.ts` 注释)。
|
|
||||||
2. 拿真实请求自检,确认签名是否被接受(`node client.mjs --send`)。
|
|
||||||
3. 找新偏移:
|
|
||||||
- 先在 `KNOWN_VERSIONS` 里加版本,用旧偏移试;不行就:
|
|
||||||
- 用 MusicServer 仓库里的脚本脱壳 + 定位:`tmp/metasec-rebuild.py`(内存脱壳 + 重建 PE)、
|
|
||||||
`tmp/metasec-call-test.py`(直接调用试偏移)、`tmp/bdms-abi.py`(读 `bdms.node` 运行时 IAT 槽,
|
|
||||||
那里躺着真实地址)。找到后用 `--sign-rva 0xXXXXX` 验证,再写进 `KNOWN_VERSIONS`。
|
|
||||||
|
|
||||||
## 已知限制 / 未验证项
|
|
||||||
|
|
||||||
- **Wine 下未实测**(本机没有 Wine):DLL 依赖的都是 Wine 常规实现的 Win32 API(kernel32/advapi32/ole32/
|
|
||||||
winhttp/ws2_32/imm32/…),但 metasec 有设备指纹采集,行为可能和原生不同。部署前请先在目标机跑
|
|
||||||
`wine mssdk-sign.exe --selftest` 和 `node client.mjs --send`。若加载失败,先看 `WINEDEBUG=+loaddll`
|
|
||||||
的缺失依赖,必要时 `winetricks corefonts vcrun2019`、`winecfg` 里把 Windows 版本设为 Win10。
|
|
||||||
- `metasecml.dll` 是**官方专有二进制**(签名主体抖音视界),不入库、不再分发;本目录只放源码与构建脚本,
|
|
||||||
DLL 自己从官方客户端取,放 exe 同目录即可。
|
|
||||||
- 签名服务本身不联网、不存 cookie;但仍建议只监听 `127.0.0.1` 并设置 `--token`,不要暴露公网。
|
|
||||||
@@ -1,97 +0,0 @@
|
|||||||
# metasec 签名组件逆向记录
|
|
||||||
|
|
||||||
> 面向维护者:**汽水客户端升级后签名失效时,先看这里。**
|
|
||||||
> 相关代码:`mssdk-sign.cpp`(签名服务);构建与接口用法见同目录 `README.md`。
|
|
||||||
> 记录时间:2026-10-02,样本:`soda-mssdk/{metasecml.dll, bdms.node}`。
|
|
||||||
|
|
||||||
## 1. 速览
|
|
||||||
|
|
||||||
| 项 | 结论 |
|
|
||||||
|---|---|
|
|
||||||
| 组件身份 | 字节 metasec 官方组件,内部名 `metasecbaseml` **4.6.1.0**(2024-09-04) |
|
|
||||||
| 数字签名 | Authenticode 主体 **Douyin Vision Co., Ltd.**(DigiCert G4 Code Signing) |
|
|
||||||
| 保护 | 自解密壳 + 运行期解密字符串表;`LoadLibrary` 后内存里即为明文镜像 |
|
|
||||||
| 真实签名入口 | `metasecml.dll + 0x52af0`(**本版本**),`char* sign(const char* url, const char* headers)` |
|
|
||||||
| 需要 init 吗 | **不需要**,冷进程直接调即可出有效签名 |
|
|
||||||
| 有效性 | 已端到端验证:签名被 `api.qishui.com` 接受;不签名 / 设备不匹配 → `HTTP 200 + 0 字节` |
|
|
||||||
| 产出能力 | `X-Helios` + `X-Medusa`(部分场景附 `X-Neptune`);**不含** Argus/Ladon/Khronos/Gorgon/a_bogus |
|
|
||||||
|
|
||||||
## 2. 两个文件的关系
|
|
||||||
|
|
||||||
- `metasecml.dll`(8.8MB):算法本体。导出表只有 3 个符号,且**都是幌子**:
|
|
||||||
- `o0o0`(0x191c0):线程局部状态初始化(读 TEB→TLS 槽,条件成立时 memset 一个 0x148 字节结构)。
|
|
||||||
- `MSBridgeML` / `MSBridgeOV`(同为 0x1d010):同一个桩 —— 调一次内部函数后**无条件返回 true**,签名结果不经它返回。
|
|
||||||
- `bdms.node`(164KB):官方客户端的 N-API 胶水。对 JS 暴露 `init` / `generateHttpSignatureHeaders` / `report`;
|
|
||||||
通过**延迟导入** `metasecml.dll` 的 `o0o0`、`MSBridgeML` 来用 DLL。
|
|
||||||
|
|
||||||
## 3. 真实调用 ABI(核心)
|
|
||||||
|
|
||||||
```c
|
|
||||||
// headers: 官方展平形式 —— 每行 "名字\r\n值",行间也用 "\r\n" 连接
|
|
||||||
char* sign(const char* url, const char* headers_lines);
|
|
||||||
```
|
|
||||||
|
|
||||||
- 地址:`image base + 0x52af0`(该处是 `jmp` 跳板,实体在 0x52b00)。
|
|
||||||
- 返回:`"名字\r\n值\r\n…"` 的签名头串,堆分配;释放函数 = `image base + 0x1d8c0`。
|
|
||||||
- 线程:内部有全局/TLS 状态,**串行调用**(服务端已加互斥锁)。
|
|
||||||
- addon 是怎么拿到这个地址的:运行时 DLL 改写了它的 IAT 槽(`bdms.node` 的 `.data` 偏移 `0x25e38`),
|
|
||||||
槽里躺着的就是 `base+0x52af0` —— 这解释了「导出表说是 0x1d010,实际却在 0x52af0」的矛盾。
|
|
||||||
- 壳的形态:磁盘上只有 PE 头 + 单个 8.8MB 加密节 `.xs2`(熵≈8.0),`.text/.rdata/.data/.xs0` 均无 raw 数据;
|
|
||||||
加载时解密进内存 → **内存 dump 即得完整镜像**(重定位已修好)。
|
|
||||||
|
|
||||||
## 4. 行为规则(实测)
|
|
||||||
|
|
||||||
| 场景 | 服务端反应 |
|
|
||||||
|---|---|
|
|
||||||
| 不带签名 | `HTTP 200 + 0 字节` |
|
|
||||||
| 带正确签名 | `HTTP 200` + 正常 JSON(曲名/时长/档位齐全) |
|
|
||||||
| 签名后改 URL 里的 `device_id` | `HTTP 200 + 0 字节` → **签名与 URL 设备参数绑死** |
|
|
||||||
| headers 少一个(尤其 `cookie`、`x-ss-stub`) | `HTTP 200 + 0 字节` → 签名覆盖**全部**请求头 |
|
|
||||||
|
|
||||||
- **`x-ss-stub` = body 的 MD5(大写)**,既是签名输入也必须随请求发出。
|
|
||||||
- **场景决定头集合**:传完整真实头 → `X-Helios` + `X-Medusa`(有时附 `X-Neptune`);
|
|
||||||
只传一个 `user-agent` 这类极简头 → **只给 `X-Neptune`**(网页兜底场景)。
|
|
||||||
所以调用方必须把「真实要发出的那一份头」整套传进来。
|
|
||||||
- 输出含时间戳/nonce,**每次不同**属正常。
|
|
||||||
- 签名有效 ≠ 能拿整曲:匿名仍只有 30 秒试听(实测 236.6s 曲目 `stream_duration=30`),
|
|
||||||
**瓶颈是登录 sessionid,不是签名**。
|
|
||||||
|
|
||||||
## 5. 内部结构(RTTI 符号泄漏)
|
|
||||||
|
|
||||||
| 类 / 符号 | 作用 |
|
|
||||||
|---|---|
|
|
||||||
| `IMSHttpReqSignModule` / `MSHttpReqSignModule` | HTTP 请求签名(本服务的调用目标) |
|
|
||||||
| `IMSWebsocketReqSignModule` | WebSocket 请求签名 |
|
|
||||||
| `MSBlackBox` / `IMSBlackBoxItem` | 黑盒数据采集 |
|
|
||||||
| `IMSSecDeviceIDModule` | 设备指纹(device id) |
|
|
||||||
| `IMSRiskInspectModule` / `IMSRiskInspector` | 风控检测 |
|
|
||||||
| `IMSReportModule` | 数据上报 |
|
|
||||||
| `MSPBSInt32/64`、`MSPBString(List)`(`__ms__`) | protobuf 序列化 |
|
|
||||||
| `MSNetInterceptor::FuncInterceptor` + `Cronet_UrlRequest_Create`、`Cronet_Engine_SetMD5Header` | 注入 Chromium Cronet 网络栈(`x-ss-stub` 的 MD5 由它算) |
|
|
||||||
| `MSConfig` / `MSJSON` / `MSHttpClient` / `MSTaskManager` | 基础设施;日志用 spdlog,源路径 `utils/matrix/os/windows/ms_log.cc` |
|
|
||||||
|
|
||||||
## 6. 保护强度评估
|
|
||||||
|
|
||||||
- 壳是「自解密 + 字符串按需解密」,**没有代码虚拟化**;脱壳后是正常的 MSVC x64 代码,可读可跟。
|
|
||||||
- 敏感字符串(如 `X-Helios`)静态搜不到,运行期才解密;镜像里没找到明文标准 AES S-box
|
|
||||||
(只有 CRC32 表、Base64 表、TEA/Blowfish 类常量)。
|
|
||||||
- 结论:**算法级复刻不划算**——黑盒调用的集成成本≈0,而且能随官方升级同步。
|
|
||||||
|
|
||||||
## 7. 客户端升级后怎么重新定位偏移
|
|
||||||
|
|
||||||
`--selftest` 会**大声失败**,不会静默签出无效头。定位步骤:
|
|
||||||
|
|
||||||
1. 从新版客户端取 `metasecml.dll`(解包方式见 `sdk/qs/mssdk.ts` 头部注释)。
|
|
||||||
2. 跑 `mssdk-sign.exe --selftest --dll <新dll>`:会打印它读到的 DLL 版本;失败即偏移变了。
|
|
||||||
3. 找新偏移(仓库 `tmp/` 下现成脚本):
|
|
||||||
- `tmp/metasec-rebuild.py` —— 内存脱壳 + 重建可分析 PE;
|
|
||||||
- `tmp/bdms-abi.py` —— 读 `bdms.node` 运行时 IAT 槽,直接拿到真实签名函数地址(**最省事**);
|
|
||||||
- `tmp/metasec-call-test.py` —— 用候选偏移直接调用,看返回是否形如 `X-…\r\n…`。
|
|
||||||
4. 用 `--sign-rva 0xXXXXX` 验证,通过后写进 `mssdk-sign.cpp` 的 `KNOWN_VERSIONS`。
|
|
||||||
5. 复验:`node client.mjs --send` 应得到 `HTTP 200` + 非空 body。
|
|
||||||
|
|
||||||
## 8. 边界
|
|
||||||
|
|
||||||
- `metasecml.dll` / `bdms.node` 是**官方专有二进制**,不入库、不随代码分发;各自从自己的官方客户端取,放 exe 同目录。
|
|
||||||
- 用途限于个人自用/互操作性研究;不要对外提供签名服务,也不要用于批量刷接口。
|
|
||||||
- 签名服务本身不联网、不落 cookie;部署仍建议只监听 `127.0.0.1` 并设置 `--token`。
|
|
||||||
@@ -1,14 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
# Linux 上交叉编译成 Windows exe(给 Wine 跑)。
|
|
||||||
# 依赖: apt install mingw-w64 (Debian/Ubuntu)
|
|
||||||
set -euo pipefail
|
|
||||||
CXX=${CXX:-x86_64-w64-mingw32-g++}
|
|
||||||
command -v "$CXX" >/dev/null || { echo "[x] 找不到 $CXX,请先装 mingw-w64"; exit 1; }
|
|
||||||
|
|
||||||
"$CXX" -std=c++17 -O2 -Wno-unknown-pragmas \
|
|
||||||
-static -static-libgcc -static-libstdc++ \
|
|
||||||
-o mssdk-sign.exe mssdk-sign.cpp \
|
|
||||||
-pthread -lws2_32 -lversion
|
|
||||||
|
|
||||||
echo "[ok] 生成 mssdk-sign.exe(静态链接,不依赖 libstdc++/winpthread DLL)"
|
|
||||||
echo " 自检: wine ./mssdk-sign.exe --selftest --dll ./metasecml.dll"
|
|
||||||
@@ -1,16 +0,0 @@
|
|||||||
@echo off
|
|
||||||
rem MSVC native build (Windows). Source has UTF-8 Chinese comments -> /utf-8 is required.
|
|
||||||
setlocal
|
|
||||||
set VCVARS=C:\Program Files (x86)\Microsoft Visual Studio\18\BuildTools\VC\Auxiliary\Build\vcvars64.bat
|
|
||||||
if not exist "%VCVARS%" (
|
|
||||||
echo [x] vcvars64.bat not found, edit VCVARS in this script
|
|
||||||
exit /b 1
|
|
||||||
)
|
|
||||||
call "%VCVARS%" >nul
|
|
||||||
cl /nologo /O2 /EHsc /std:c++17 /utf-8 /W3 mssdk-sign.cpp /link /out:mssdk-sign.exe ws2_32.lib version.lib
|
|
||||||
if errorlevel 1 (
|
|
||||||
echo [x] build failed
|
|
||||||
exit /b 1
|
|
||||||
)
|
|
||||||
echo [ok] built mssdk-sign.exe
|
|
||||||
echo selftest: mssdk-sign.exe --selftest --dll .\metasecml.dll
|
|
||||||
@@ -1,73 +0,0 @@
|
|||||||
// mssdk-sign 的 Node 客户端示例(免依赖,Node 18+)
|
|
||||||
//
|
|
||||||
// 用法:
|
|
||||||
// node client.mjs # 自检:打 /healthz + 签一次 track_v2(不发真实请求)
|
|
||||||
// node client.mjs --send # 顺带把签名后的请求发给 api.qishui.com 验证
|
|
||||||
//
|
|
||||||
// 集成到 MusicServer 时,把 signQishuiRequest() 换成这个 HTTP 调用即可
|
|
||||||
// (签名输入必须与真实发出的头完全一致,含 x-ss-stub)。
|
|
||||||
|
|
||||||
const BASE = process.env.MSSDK_SIGN_URL ?? 'http://127.0.0.1:16889'
|
|
||||||
const TOKEN = process.env.MSSDK_SIGN_TOKEN ?? ''
|
|
||||||
|
|
||||||
const headers0 = (extra = {}) => (TOKEN ? { authorization: `Bearer ${TOKEN}`, ...extra } : extra)
|
|
||||||
|
|
||||||
/** 调本地签名服务;返回需要追加到请求上的头 */
|
|
||||||
export async function signRequest(url, headers, body) {
|
|
||||||
const res = await fetch(`${BASE}/sign`, {
|
|
||||||
method: 'POST',
|
|
||||||
headers: headers0({ 'content-type': 'application/json' }),
|
|
||||||
body: JSON.stringify({ url, headers, body }),
|
|
||||||
})
|
|
||||||
const json = await res.json().catch(() => ({ ok: false, error: `HTTP ${res.status}` }))
|
|
||||||
if (!json.ok) throw new Error(json.error ?? `签名失败 HTTP ${res.status}`)
|
|
||||||
return { headers: json.headers, added: json.added ?? {}, elapsed_ms: json.elapsed_ms }
|
|
||||||
}
|
|
||||||
|
|
||||||
export async function healthz() {
|
|
||||||
const res = await fetch(`${BASE}/healthz`)
|
|
||||||
return res.json()
|
|
||||||
}
|
|
||||||
|
|
||||||
import { pathToFileURL } from 'node:url'
|
|
||||||
|
|
||||||
if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
|
|
||||||
const health = await healthz()
|
|
||||||
console.log('healthz:', health)
|
|
||||||
|
|
||||||
// 与 sdk/qs/mssdk.ts 的 PC 通道同构:URL 带 device_id,headers 是真实要发出的那份
|
|
||||||
const deviceId = process.env.QS_DEVICE_ID ?? '1219822735468811019'
|
|
||||||
const iid = process.env.QS_IID ?? '1219822735468829019'
|
|
||||||
const body = JSON.stringify({ track_id: '7501674235158431760', media_type: 'track', queue_type: 'search_one_track', scene_name: 'search' })
|
|
||||||
const q = new URLSearchParams({
|
|
||||||
aid: '386088', app_name: 'luna_pc', region: 'cn', geo_region: 'cn', os_region: 'cn', sim_region: '',
|
|
||||||
device_id: deviceId, cdid: '', iid, version_name: '3.7.0', version_code: '30070000',
|
|
||||||
channel: 'official', build_mode: 'master', network_carrier: '', ac: 'wifi', tz_name: 'Asia/Shanghai',
|
|
||||||
resolution: '', device_platform: 'windows', device_type: 'Windows', os_version: 'Windows 11', fp: deviceId,
|
|
||||||
})
|
|
||||||
const url = `https://api.qishui.com/luna/pc/track_v2?${q}`
|
|
||||||
const headers = {
|
|
||||||
'content-type': 'application/json; charset=utf-8',
|
|
||||||
'user-agent': 'LunaPC/3.7.0(452316191)',
|
|
||||||
'x-luna-background-type': 'foreground',
|
|
||||||
'x-luna-is-background-req': '0',
|
|
||||||
'x-luna-is-local-user': '0',
|
|
||||||
'x-tt-trace-id': `00-${'0'.repeat(16)}-${'0'.repeat(16)}-01`,
|
|
||||||
}
|
|
||||||
|
|
||||||
const signed = await signRequest(url, headers, body)
|
|
||||||
console.log('签名头:', Object.keys(signed.headers), `(${signed.elapsed_ms}ms)`, signed.added)
|
|
||||||
|
|
||||||
if (process.argv.includes('--send')) {
|
|
||||||
const r = await fetch(url, { method: 'POST', headers: { ...headers, ...signed.headers, ...signed.added }, body })
|
|
||||||
const t = await r.text()
|
|
||||||
console.log(`真实请求: HTTP ${r.status} ${t.length} 字节`)
|
|
||||||
if (t) {
|
|
||||||
const j = JSON.parse(t)
|
|
||||||
const vm = typeof j?.track_player?.video_model === 'string' ? JSON.parse(j.track_player.video_model) : j?.track_player?.video_model
|
|
||||||
console.log(` 曲目: ${j?.track?.name} 曲长 ${j?.track?.duration}ms 试听 ${vm?.video_duration}s`)
|
|
||||||
} else {
|
|
||||||
console.log(' 空 body = 签名没被接受')
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@@ -1,754 +0,0 @@
|
|||||||
// mssdk-sign —— 汽水音乐(metasec)签名 HTTP 服务
|
|
||||||
//
|
|
||||||
// 为什么是它:汽水 PC 客户端自带的 metasecml.dll 提供应用级签名(X-Helios/X-Medusa,
|
|
||||||
// 部分场景附 X-Neptune)。本程序把该 DLL 关在一个进程里,对外只暴露一个 HTTP /sign,
|
|
||||||
// 于是:Windows 上直接跑;Linux 上丢进 Wine 跑,宿主机的服务(如 MusicServer)用 HTTP 调。
|
|
||||||
//
|
|
||||||
// 关于 DLL 的调用方式(2026-10-02 逆向确认,版本 metasecbaseml 4.6.1.0):
|
|
||||||
// * 导出表里的 MSBridgeML / MSBridgeOV / o0o0 都是幌子(桩/初始化),
|
|
||||||
// 真正的签名函数在 image base + 0x52af0,原型 char* f(const char* url, const char* headers)。
|
|
||||||
// * headers 是官方展平形式:每个头 "名字\r\n值",头与头之间也用 "\r\n" 连接。
|
|
||||||
// * 返回 "名字\r\n值\r\n..." 的签名头串,由 DLL 自己的释放函数(base + 0x1d8c0)回收。
|
|
||||||
// * 不需要 init;签名覆盖 URL + 全部请求头,且与 URL 里的 device_id 绑死
|
|
||||||
// (改 URL 设备号 → 服务端 200 + 空 body)。
|
|
||||||
// * 偏移随客户端版本变化:内置版本表 + 启动自检,不匹配会明确报错(见 README「升级怎么办」)。
|
|
||||||
//
|
|
||||||
// 构建(任选其一):
|
|
||||||
// Windows/MSVC : build.bat
|
|
||||||
// Linux/MinGW : x86_64-w64-mingw32-g++ -std=c++17 -O2 -static -static-libgcc -static-libstdc++ \
|
|
||||||
// -o mssdk-sign.exe mssdk-sign.cpp -lws2_32 -lversion -lwinpthread
|
|
||||||
// 运行:
|
|
||||||
// mssdk-sign.exe --port 16889 --dll .\metasecml.dll
|
|
||||||
// wine mssdk-sign.exe --port 16889 --dll ./metasecml.dll
|
|
||||||
//
|
|
||||||
// 依赖:仅 Win32 API + Winsock(无第三方库,无 C++ 异常跨模块问题)。
|
|
||||||
|
|
||||||
#include <winsock2.h>
|
|
||||||
#include <ws2tcpip.h>
|
|
||||||
#include <windows.h>
|
|
||||||
#include <winver.h>
|
|
||||||
|
|
||||||
#include <atomic>
|
|
||||||
#include <cctype>
|
|
||||||
#include <chrono>
|
|
||||||
#include <cstdint>
|
|
||||||
#include <cstdio>
|
|
||||||
#include <cstring>
|
|
||||||
#include <functional>
|
|
||||||
#include <mutex>
|
|
||||||
#include <string>
|
|
||||||
#include <thread>
|
|
||||||
#include <vector>
|
|
||||||
|
|
||||||
#ifdef _MSC_VER
|
|
||||||
#pragma comment(lib, "ws2_32.lib")
|
|
||||||
#pragma comment(lib, "version.lib")
|
|
||||||
#endif
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------- 工具
|
|
||||||
|
|
||||||
static std::string toLower(std::string s) {
|
|
||||||
for (auto &c : s) c = (char)tolower((unsigned char)c);
|
|
||||||
return s;
|
|
||||||
}
|
|
||||||
|
|
||||||
static std::string trim(const std::string &s) {
|
|
||||||
size_t a = s.find_first_not_of(" \t\r\n");
|
|
||||||
if (a == std::string::npos) return "";
|
|
||||||
size_t b = s.find_last_not_of(" \t\r\n");
|
|
||||||
return s.substr(a, b - a + 1);
|
|
||||||
}
|
|
||||||
|
|
||||||
static std::string jsonEscape(const std::string &s) {
|
|
||||||
std::string o;
|
|
||||||
o.reserve(s.size() + 8);
|
|
||||||
for (unsigned char c : s) {
|
|
||||||
switch (c) {
|
|
||||||
case '"': o += "\\\""; break;
|
|
||||||
case '\\': o += "\\\\"; break;
|
|
||||||
case '\n': o += "\\n"; break;
|
|
||||||
case '\r': o += "\\r"; break;
|
|
||||||
case '\t': o += "\\t"; break;
|
|
||||||
default:
|
|
||||||
if (c < 0x20) {
|
|
||||||
char b[8];
|
|
||||||
snprintf(b, sizeof b, "\\u%04x", c);
|
|
||||||
o += b;
|
|
||||||
} else {
|
|
||||||
o += (char)c;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return o;
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------- MD5(用于 x-ss-stub = body 的 MD5 大写)
|
|
||||||
|
|
||||||
namespace md5impl {
|
|
||||||
struct Ctx {
|
|
||||||
uint32_t a = 0x67452301, b = 0xefcdab89, c = 0x98badcfe, d = 0x10325476;
|
|
||||||
uint64_t len = 0;
|
|
||||||
uint8_t buf[64];
|
|
||||||
size_t n = 0;
|
|
||||||
};
|
|
||||||
|
|
||||||
static const uint32_t K[64] = {
|
|
||||||
0xd76aa478, 0xe8c7b756, 0x242070db, 0xc1bdceee, 0xf57c0faf, 0x4787c62a, 0xa8304613, 0xfd469501,
|
|
||||||
0x698098d8, 0x8b44f7af, 0xffff5bb1, 0x895cd7be, 0x6b901122, 0xfd987193, 0xa679438e, 0x49b40821,
|
|
||||||
0xf61e2562, 0xc040b340, 0x265e5a51, 0xe9b6c7aa, 0xd62f105d, 0x02441453, 0xd8a1e681, 0xe7d3fbc8,
|
|
||||||
0x21e1cde6, 0xc33707d6, 0xf4d50d87, 0x455a14ed, 0xa9e3e905, 0xfcefa3f8, 0x676f02d9, 0x8d2a4c8a,
|
|
||||||
0xfffa3942, 0x8771f681, 0x6d9d6122, 0xfde5380c, 0xa4beea44, 0x4bdecfa9, 0xf6bb4b60, 0xbebfbc70,
|
|
||||||
0x289b7ec6, 0xeaa127fa, 0xd4ef3085, 0x04881d05, 0xd9d4d039, 0xe6db99e5, 0x1fa27cf8, 0xc4ac5665,
|
|
||||||
0xf4292244, 0x432aff97, 0xab9423a7, 0xfc93a039, 0x655b59c3, 0x8f0ccc92, 0xffeff47d, 0x85845dd1,
|
|
||||||
0x6fa87e4f, 0xfe2ce6e0, 0xa3014314, 0x4e0811a1, 0xf7537e82, 0xbd3af235, 0x2ad7d2bb, 0xeb86d391};
|
|
||||||
static const uint8_t S[64] = {7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22,
|
|
||||||
5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
|
|
||||||
4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23,
|
|
||||||
6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21};
|
|
||||||
|
|
||||||
static inline uint32_t rotl(uint32_t x, int c) { return (x << c) | (x >> (32 - c)); }
|
|
||||||
|
|
||||||
static void block(Ctx &ctx, const uint8_t *p) {
|
|
||||||
uint32_t m[16];
|
|
||||||
for (int i = 0; i < 16; i++)
|
|
||||||
m[i] = (uint32_t)p[i * 4] | ((uint32_t)p[i * 4 + 1] << 8) | ((uint32_t)p[i * 4 + 2] << 16) |
|
|
||||||
((uint32_t)p[i * 4 + 3] << 24);
|
|
||||||
uint32_t a = ctx.a, b = ctx.b, c = ctx.c, d = ctx.d;
|
|
||||||
for (int i = 0; i < 64; i++) {
|
|
||||||
uint32_t f, g;
|
|
||||||
if (i < 16) { f = (b & c) | (~b & d); g = (uint32_t)i; }
|
|
||||||
else if (i < 32) { f = (d & b) | (~d & c); g = (uint32_t)(5 * i + 1) & 15; }
|
|
||||||
else if (i < 48) { f = b ^ c ^ d; g = (uint32_t)(3 * i + 5) & 15; }
|
|
||||||
else { f = c ^ (b | ~d); g = (uint32_t)(7 * i) & 15; }
|
|
||||||
uint32_t t = d;
|
|
||||||
d = c;
|
|
||||||
c = b;
|
|
||||||
b = b + rotl(a + f + K[i] + m[g], S[i]);
|
|
||||||
a = t;
|
|
||||||
}
|
|
||||||
ctx.a += a; ctx.b += b; ctx.c += c; ctx.d += d;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void update(Ctx &ctx, const void *data, size_t len) {
|
|
||||||
const uint8_t *p = (const uint8_t *)data;
|
|
||||||
ctx.len += len;
|
|
||||||
while (len) {
|
|
||||||
size_t take = 64 - ctx.n;
|
|
||||||
if (take > len) take = len;
|
|
||||||
memcpy(ctx.buf + ctx.n, p, take);
|
|
||||||
ctx.n += take; p += take; len -= take;
|
|
||||||
if (ctx.n == 64) { block(ctx, ctx.buf); ctx.n = 0; }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
static std::string hex(const Ctx &in) {
|
|
||||||
Ctx ctx = in;
|
|
||||||
uint64_t bits = ctx.len * 8;
|
|
||||||
uint8_t pad = 0x80;
|
|
||||||
update(ctx, &pad, 1);
|
|
||||||
uint8_t zero = 0;
|
|
||||||
while (ctx.n != 56) update(ctx, &zero, 1);
|
|
||||||
uint8_t lenb[8];
|
|
||||||
for (int i = 0; i < 8; i++) lenb[i] = (uint8_t)(bits >> (8 * i));
|
|
||||||
update(ctx, lenb, 8);
|
|
||||||
uint32_t v[4] = {ctx.a, ctx.b, ctx.c, ctx.d};
|
|
||||||
static const char *H = "0123456789abcdef";
|
|
||||||
std::string out;
|
|
||||||
out.reserve(32);
|
|
||||||
for (int i = 0; i < 4; i++)
|
|
||||||
for (int j = 0; j < 4; j++) {
|
|
||||||
out += H[(v[i] >> (8 * j + 4)) & 0xf];
|
|
||||||
out += H[(v[i] >> (8 * j)) & 0xf];
|
|
||||||
}
|
|
||||||
return out;
|
|
||||||
}
|
|
||||||
} // namespace md5impl
|
|
||||||
|
|
||||||
static std::string md5HexUpper(const std::string &data) {
|
|
||||||
md5impl::Ctx ctx;
|
|
||||||
md5impl::update(ctx, data.data(), data.size());
|
|
||||||
std::string h = md5impl::hex(ctx);
|
|
||||||
for (auto &c : h) c = (char)toupper((unsigned char)c);
|
|
||||||
return h;
|
|
||||||
}
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------- 极简 JSON(只支持本服务需要的子集)
|
|
||||||
|
|
||||||
struct JVal {
|
|
||||||
enum T { Nul, Bool, Num, Str, Arr, Obj } t = Nul;
|
|
||||||
std::string s; // Str / Num / Bool 的原始文本
|
|
||||||
std::vector<JVal> a; // Arr
|
|
||||||
std::vector<std::pair<std::string, JVal>> o; // Obj(保序)
|
|
||||||
const JVal *get(const std::string &k) const {
|
|
||||||
for (auto &kv : o)
|
|
||||||
if (kv.first == k) return &kv.second;
|
|
||||||
return nullptr;
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
namespace json {
|
|
||||||
struct P {
|
|
||||||
const std::string &s;
|
|
||||||
size_t i = 0;
|
|
||||||
explicit P(const std::string &src) : s(src) {}
|
|
||||||
void ws() { while (i < s.size() && (s[i] == ' ' || s[i] == '\t' || s[i] == '\n' || s[i] == '\r')) i++; }
|
|
||||||
bool lit(const char *w) {
|
|
||||||
size_t n = strlen(w);
|
|
||||||
if (s.compare(i, n, w) == 0) { i += n; return true; }
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
void utf8(uint32_t cp, std::string &out) {
|
|
||||||
if (cp < 0x80) out += (char)cp;
|
|
||||||
else if (cp < 0x800) { out += (char)(0xC0 | (cp >> 6)); out += (char)(0x80 | (cp & 0x3F)); }
|
|
||||||
else if (cp < 0x10000) {
|
|
||||||
out += (char)(0xE0 | (cp >> 12));
|
|
||||||
out += (char)(0x80 | ((cp >> 6) & 0x3F));
|
|
||||||
out += (char)(0x80 | (cp & 0x3F));
|
|
||||||
} else {
|
|
||||||
out += (char)(0xF0 | (cp >> 18));
|
|
||||||
out += (char)(0x80 | ((cp >> 12) & 0x3F));
|
|
||||||
out += (char)(0x80 | ((cp >> 6) & 0x3F));
|
|
||||||
out += (char)(0x80 | (cp & 0x3F));
|
|
||||||
}
|
|
||||||
}
|
|
||||||
bool hex4(uint32_t &v) {
|
|
||||||
v = 0;
|
|
||||||
for (int k = 0; k < 4; k++) {
|
|
||||||
if (i >= s.size()) return false;
|
|
||||||
char c = s[i++];
|
|
||||||
v <<= 4;
|
|
||||||
if (c >= '0' && c <= '9') v |= (uint32_t)(c - '0');
|
|
||||||
else if (c >= 'a' && c <= 'f') v |= (uint32_t)(c - 'a' + 10);
|
|
||||||
else if (c >= 'A' && c <= 'F') v |= (uint32_t)(c - 'A' + 10);
|
|
||||||
else return false;
|
|
||||||
}
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
bool str(std::string &out) {
|
|
||||||
if (i >= s.size() || s[i] != '"') return false;
|
|
||||||
i++;
|
|
||||||
out.clear();
|
|
||||||
while (i < s.size()) {
|
|
||||||
char c = s[i++];
|
|
||||||
if (c == '"') return true;
|
|
||||||
if (c != '\\') { out += c; continue; }
|
|
||||||
if (i >= s.size()) return false;
|
|
||||||
char e = s[i++];
|
|
||||||
switch (e) {
|
|
||||||
case '"': out += '"'; break;
|
|
||||||
case '\\': out += '\\'; break;
|
|
||||||
case '/': out += '/'; break;
|
|
||||||
case 'b': out += '\b'; break;
|
|
||||||
case 'f': out += '\f'; break;
|
|
||||||
case 'n': out += '\n'; break;
|
|
||||||
case 'r': out += '\r'; break;
|
|
||||||
case 't': out += '\t'; break;
|
|
||||||
case 'u': {
|
|
||||||
uint32_t cp;
|
|
||||||
if (!hex4(cp)) return false;
|
|
||||||
if (cp >= 0xD800 && cp <= 0xDBFF && i + 1 < s.size() && s[i] == '\\' && s[i + 1] == 'u') {
|
|
||||||
size_t save = i;
|
|
||||||
i += 2;
|
|
||||||
uint32_t lo;
|
|
||||||
if (hex4(lo) && lo >= 0xDC00 && lo <= 0xDFFF)
|
|
||||||
cp = 0x10000 + ((cp - 0xD800) << 10) + (lo - 0xDC00);
|
|
||||||
else
|
|
||||||
i = save;
|
|
||||||
}
|
|
||||||
utf8(cp, out);
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
default: return false;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
bool val(JVal &v) {
|
|
||||||
ws();
|
|
||||||
if (i >= s.size()) return false;
|
|
||||||
char c = s[i];
|
|
||||||
if (c == '{') {
|
|
||||||
v.t = JVal::Obj;
|
|
||||||
i++;
|
|
||||||
ws();
|
|
||||||
if (i < s.size() && s[i] == '}') { i++; return true; }
|
|
||||||
while (true) {
|
|
||||||
ws();
|
|
||||||
std::string k;
|
|
||||||
if (!str(k)) return false;
|
|
||||||
ws();
|
|
||||||
if (i >= s.size() || s[i] != ':') return false;
|
|
||||||
i++;
|
|
||||||
JVal cv;
|
|
||||||
if (!val(cv)) return false;
|
|
||||||
v.o.emplace_back(std::move(k), std::move(cv));
|
|
||||||
ws();
|
|
||||||
if (i < s.size() && s[i] == ',') { i++; continue; }
|
|
||||||
if (i < s.size() && s[i] == '}') { i++; return true; }
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (c == '[') {
|
|
||||||
v.t = JVal::Arr;
|
|
||||||
i++;
|
|
||||||
ws();
|
|
||||||
if (i < s.size() && s[i] == ']') { i++; return true; }
|
|
||||||
while (true) {
|
|
||||||
JVal cv;
|
|
||||||
if (!val(cv)) return false;
|
|
||||||
v.a.push_back(std::move(cv));
|
|
||||||
ws();
|
|
||||||
if (i < s.size() && s[i] == ',') { i++; continue; }
|
|
||||||
if (i < s.size() && s[i] == ']') { i++; return true; }
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (c == '"') { v.t = JVal::Str; return str(v.s); }
|
|
||||||
if (lit("true")) { v.t = JVal::Bool; v.s = "true"; return true; }
|
|
||||||
if (lit("false")) { v.t = JVal::Bool; v.s = "false"; return true; }
|
|
||||||
if (lit("null")) { v.t = JVal::Nul; return true; }
|
|
||||||
size_t b = i;
|
|
||||||
while (i < s.size() && (isdigit((unsigned char)s[i]) || s[i] == '-' || s[i] == '+' || s[i] == '.' ||
|
|
||||||
s[i] == 'e' || s[i] == 'E'))
|
|
||||||
i++;
|
|
||||||
if (i == b) return false;
|
|
||||||
v.t = JVal::Num;
|
|
||||||
v.s = s.substr(b, i - b);
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
};
|
|
||||||
} // namespace json
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------- 签名器
|
|
||||||
|
|
||||||
typedef char *(*SignFn)(const char *, const char *);
|
|
||||||
typedef void (*FreeFn)(void *);
|
|
||||||
|
|
||||||
// SEH 必须放在不含 C++ 析构对象的函数里(否则 MSVC 报 C2712)
|
|
||||||
#ifdef _MSC_VER
|
|
||||||
static char *callSignRaw(SignFn fn, const char *url, const char *headers) {
|
|
||||||
__try {
|
|
||||||
return fn(url, headers);
|
|
||||||
} __except (EXCEPTION_EXECUTE_HANDLER) {
|
|
||||||
return nullptr;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
|
|
||||||
struct RvaPair {
|
|
||||||
uint64_t sign;
|
|
||||||
uint64_t freefn;
|
|
||||||
};
|
|
||||||
|
|
||||||
// 已知版本 → 偏移(客户端升级后新增一行;见 README)
|
|
||||||
static const struct {
|
|
||||||
const char *version;
|
|
||||||
RvaPair rva;
|
|
||||||
} KNOWN_VERSIONS[] = {
|
|
||||||
{"4.6.1.0", {0x52af0, 0x1d8c0}},
|
|
||||||
};
|
|
||||||
static const RvaPair DEFAULT_RVA = {0x52af0, 0x1d8c0};
|
|
||||||
|
|
||||||
class Signer {
|
|
||||||
public:
|
|
||||||
bool load(const std::string &dllPath, uint64_t rvaOverride, std::string &err) {
|
|
||||||
dllPath_ = dllPath;
|
|
||||||
HMODULE m = LoadLibraryExW(toWide(dllPath).c_str(), nullptr, LOAD_WITH_ALTERED_SEARCH_PATH);
|
|
||||||
if (!m) {
|
|
||||||
char b[256];
|
|
||||||
snprintf(b, sizeof b, "LoadLibraryExW 失败(错误码 %lu): %s", GetLastError(), dllPath.c_str());
|
|
||||||
err = b;
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
mod_ = m;
|
|
||||||
version_ = readVersion(dllPath);
|
|
||||||
|
|
||||||
RvaPair use = DEFAULT_RVA;
|
|
||||||
if (rvaOverride) {
|
|
||||||
use = {rvaOverride, rvaOverride + (DEFAULT_RVA.freefn - DEFAULT_RVA.sign)};
|
|
||||||
err.clear();
|
|
||||||
} else {
|
|
||||||
bool found = false;
|
|
||||||
for (auto &kv : KNOWN_VERSIONS) {
|
|
||||||
if (version_ == kv.version) { use = kv.rva; found = true; break; }
|
|
||||||
}
|
|
||||||
if (!found) {
|
|
||||||
char b[256];
|
|
||||||
snprintf(b, sizeof b,
|
|
||||||
"DLL 版本 %s 不在已知表内(已知: 4.6.1.0)。将按默认偏移 %#llx 试跑,"
|
|
||||||
"失败请用 --sign-rva 指定(见 README)",
|
|
||||||
version_.empty() ? "(读不到)" : version_.c_str(), (unsigned long long)DEFAULT_RVA.sign);
|
|
||||||
warn_ = b;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
sign_ = (SignFn)((uint8_t *)mod_ + use.sign);
|
|
||||||
free_ = (FreeFn)((uint8_t *)mod_ + use.freefn);
|
|
||||||
rva_ = use;
|
|
||||||
|
|
||||||
// 启动自检:签一个探针,确认偏移正确(不发网络请求)
|
|
||||||
if (!selfTest()) {
|
|
||||||
err = "签名自检失败:偏移 " + hexStr(use.sign) + " 处不是有效的签名函数。"
|
|
||||||
"客户端升级后请重新定位(README「升级怎么办」)";
|
|
||||||
sign_ = nullptr;
|
|
||||||
free_ = nullptr;
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
bool ready() const { return sign_ != nullptr; }
|
|
||||||
std::string version() const { return version_; }
|
|
||||||
std::string warn() const { return warn_; }
|
|
||||||
std::string dllPath() const { return dllPath_; }
|
|
||||||
uint64_t signRva() const { return rva_.sign; }
|
|
||||||
|
|
||||||
// 返回 "名字\r\n值\r\n..." 的签名头串;失败返回空
|
|
||||||
std::string sign(const std::string &url, const std::string &headersFlat) {
|
|
||||||
if (!sign_) return "";
|
|
||||||
std::lock_guard<std::mutex> lk(mu_); // DLL 内部有全局/TLS 状态,串行调用最稳
|
|
||||||
#ifdef _MSC_VER
|
|
||||||
char *r = callSignRaw(sign_, url.c_str(), headersFlat.c_str());
|
|
||||||
#else
|
|
||||||
// MinGW 无 MSVC 式 __try/__except;调用异常会直接终止进程(签名偏移错时会立刻暴露)
|
|
||||||
char *r = sign_(url.c_str(), headersFlat.c_str());
|
|
||||||
#endif
|
|
||||||
if (!r) return "";
|
|
||||||
std::string out = r;
|
|
||||||
if (free_) free_(r);
|
|
||||||
return out;
|
|
||||||
}
|
|
||||||
|
|
||||||
private:
|
|
||||||
static std::wstring toWide(const std::string &s) {
|
|
||||||
int n = MultiByteToWideChar(CP_UTF8, 0, s.c_str(), -1, nullptr, 0);
|
|
||||||
std::wstring w(n > 0 ? n - 1 : 0, L'\0');
|
|
||||||
if (n > 0) MultiByteToWideChar(CP_UTF8, 0, s.c_str(), -1, &w[0], n);
|
|
||||||
return w;
|
|
||||||
}
|
|
||||||
static std::string hexStr(uint64_t v) {
|
|
||||||
char b[32];
|
|
||||||
snprintf(b, sizeof b, "0x%llx", (unsigned long long)v);
|
|
||||||
return b;
|
|
||||||
}
|
|
||||||
static std::string readVersion(const std::string &path) {
|
|
||||||
DWORD dummy = 0;
|
|
||||||
DWORD sz = GetFileVersionInfoSizeW(toWide(path).c_str(), &dummy);
|
|
||||||
if (!sz) return "";
|
|
||||||
std::vector<char> buf(sz);
|
|
||||||
if (!GetFileVersionInfoW(toWide(path).c_str(), 0, sz, buf.data())) return "";
|
|
||||||
VS_FIXEDFILEINFO *fi = nullptr;
|
|
||||||
UINT len = 0;
|
|
||||||
if (!VerQueryValueW(buf.data(), L"\\", (void **)&fi, &len) || !fi) return "";
|
|
||||||
char b[64];
|
|
||||||
snprintf(b, sizeof b, "%u.%u.%u.%u", HIWORD(fi->dwFileVersionMS), LOWORD(fi->dwFileVersionMS),
|
|
||||||
HIWORD(fi->dwFileVersionLS), LOWORD(fi->dwFileVersionLS));
|
|
||||||
return b;
|
|
||||||
}
|
|
||||||
bool selfTest() {
|
|
||||||
const char *probeUrl =
|
|
||||||
"https://api.qishui.com/luna/pc/track_v2?aid=386088&app_name=luna_pc&device_id=1";
|
|
||||||
const char *probeHdr = "user-agent\r\nLunaPC/3.7.0(452316191)";
|
|
||||||
std::string r = sign(probeUrl, probeHdr);
|
|
||||||
return r.find("X-") != std::string::npos && r.find("\r\n") != std::string::npos;
|
|
||||||
}
|
|
||||||
|
|
||||||
HMODULE mod_ = nullptr;
|
|
||||||
SignFn sign_ = nullptr;
|
|
||||||
FreeFn free_ = nullptr;
|
|
||||||
RvaPair rva_{};
|
|
||||||
std::string dllPath_, version_, warn_;
|
|
||||||
std::mutex mu_;
|
|
||||||
};
|
|
||||||
|
|
||||||
// ---------------------------------------------------------------- HTTP 服务
|
|
||||||
|
|
||||||
struct Config {
|
|
||||||
std::string bind = "127.0.0.1";
|
|
||||||
int port = 16889;
|
|
||||||
std::string dll;
|
|
||||||
std::string token; // 非空则要求 Bearer / X-Auth-Token
|
|
||||||
uint64_t signRva = 0; // 0 = 用版本表
|
|
||||||
bool selftestOnly = false;
|
|
||||||
bool verbose = false;
|
|
||||||
};
|
|
||||||
|
|
||||||
static std::string httpDate() {
|
|
||||||
SYSTEMTIME st;
|
|
||||||
GetSystemTime(&st);
|
|
||||||
char b[64];
|
|
||||||
snprintf(b, sizeof b, "%04d-%02d-%02dT%02d:%02d:%02dZ", st.wYear, st.wMonth, st.wDay, st.wHour, st.wMinute,
|
|
||||||
st.wSecond);
|
|
||||||
return b;
|
|
||||||
}
|
|
||||||
|
|
||||||
static std::string respJson(int code, const std::string &body) {
|
|
||||||
const char *reason = code == 200 ? "OK" : (code == 400 ? "Bad Request" : (code == 401 ? "Unauthorized" : (code == 404 ? "Not Found" : "Internal Server Error")));
|
|
||||||
char head[512];
|
|
||||||
snprintf(head, sizeof head,
|
|
||||||
"HTTP/1.1 %d %s\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: %zu\r\n"
|
|
||||||
"Connection: close\r\nServer: mssdk-sign/0.1.0\r\n\r\n",
|
|
||||||
code, reason, body.size());
|
|
||||||
return std::string(head) + body;
|
|
||||||
}
|
|
||||||
|
|
||||||
static std::string errBody(const std::string &msg) { return "{\"ok\":false,\"error\":\"" + jsonEscape(msg) + "\"}"; }
|
|
||||||
|
|
||||||
static bool sendAll(SOCKET s, const std::string &data) {
|
|
||||||
size_t sent = 0;
|
|
||||||
while (sent < data.size()) {
|
|
||||||
int n = send(s, data.data() + sent, (int)(data.size() - sent), 0);
|
|
||||||
if (n <= 0) return false;
|
|
||||||
sent += (size_t)n;
|
|
||||||
}
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
// 读一个完整请求(headers + body)
|
|
||||||
static bool readRequest(SOCKET s, std::string &method, std::string &path, std::string &headersRaw,
|
|
||||||
std::string &body) {
|
|
||||||
std::string buf;
|
|
||||||
char tmp[4096];
|
|
||||||
size_t headEnd = std::string::npos;
|
|
||||||
while ((headEnd = buf.find("\r\n\r\n")) == std::string::npos) {
|
|
||||||
int n = recv(s, tmp, sizeof tmp, 0);
|
|
||||||
if (n <= 0) return false;
|
|
||||||
buf.append(tmp, n);
|
|
||||||
if (buf.size() > 256 * 1024) return false;
|
|
||||||
}
|
|
||||||
headersRaw = buf.substr(0, headEnd);
|
|
||||||
size_t lineEnd = headersRaw.find("\r\n");
|
|
||||||
std::string reqLine = headersRaw.substr(0, lineEnd == std::string::npos ? headersRaw.size() : lineEnd);
|
|
||||||
size_t sp1 = reqLine.find(' '), sp2 = reqLine.rfind(' ');
|
|
||||||
if (sp1 == std::string::npos || sp2 == std::string::npos || sp2 <= sp1) return false;
|
|
||||||
method = reqLine.substr(0, sp1);
|
|
||||||
path = reqLine.substr(sp1 + 1, sp2 - sp1 - 1);
|
|
||||||
|
|
||||||
size_t contentLength = 0;
|
|
||||||
{
|
|
||||||
std::string h = toLower(headersRaw);
|
|
||||||
size_t p = h.find("content-length:");
|
|
||||||
if (p != std::string::npos) contentLength = (size_t)strtoul(headersRaw.c_str() + p + 15, nullptr, 10);
|
|
||||||
}
|
|
||||||
if (contentLength > 4 * 1024 * 1024) return false;
|
|
||||||
body = buf.substr(headEnd + 4);
|
|
||||||
while (body.size() < contentLength) {
|
|
||||||
int n = recv(s, tmp, sizeof tmp, 0);
|
|
||||||
if (n <= 0) break;
|
|
||||||
body.append(tmp, n);
|
|
||||||
}
|
|
||||||
if (body.size() > contentLength) body.resize(contentLength);
|
|
||||||
return true;
|
|
||||||
}
|
|
||||||
|
|
||||||
static bool authorized(const Config &cfg, const std::string &headersRaw) {
|
|
||||||
if (cfg.token.empty()) return true;
|
|
||||||
std::string h = toLower(headersRaw);
|
|
||||||
std::string want = toLower(cfg.token);
|
|
||||||
if (h.find("authorization: bearer " + want) != std::string::npos) return true;
|
|
||||||
if (h.find("x-auth-token: " + want) != std::string::npos) return true;
|
|
||||||
if (h.find("?token=" + want) != std::string::npos) return true;
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
static std::string handleSign(Signer &signer, const std::string &body, bool verbose) {
|
|
||||||
JVal root;
|
|
||||||
json::P p(body);
|
|
||||||
if (!p.val(root) || root.t != JVal::Obj) return respJson(400, errBody("请求体不是 JSON 对象"));
|
|
||||||
|
|
||||||
const JVal *jurl = root.get("url");
|
|
||||||
if (!jurl || jurl->t != JVal::Str || jurl->s.empty()) return respJson(400, errBody("缺少 url 字段"));
|
|
||||||
|
|
||||||
// 保序收集 headers
|
|
||||||
std::vector<std::pair<std::string, std::string>> headers;
|
|
||||||
bool hasStub = false;
|
|
||||||
if (const JVal *jh = root.get("headers")) {
|
|
||||||
if (jh->t != JVal::Obj) return respJson(400, errBody("headers 必须是对象"));
|
|
||||||
for (auto &kv : jh->o) {
|
|
||||||
if (kv.second.t != JVal::Str) continue; // 只签名字符串头
|
|
||||||
headers.emplace_back(kv.first, kv.second.s);
|
|
||||||
if (toLower(kv.first) == "x-ss-stub") hasStub = true;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
if (headers.empty()) return respJson(400, errBody("headers 不能为空(签名覆盖全部请求头,必须传真实要发出的那一份)"));
|
|
||||||
|
|
||||||
// 给了 body 且没带 x-ss-stub → 补上(body 的 MD5 大写),与官方客户端一致
|
|
||||||
std::string addedStub;
|
|
||||||
if (const JVal *jb = root.get("body")) {
|
|
||||||
if (jb->t == JVal::Str && !hasStub) {
|
|
||||||
addedStub = md5HexUpper(jb->s);
|
|
||||||
headers.emplace_back("x-ss-stub", addedStub);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
std::string flat;
|
|
||||||
for (size_t i = 0; i < headers.size(); i++) {
|
|
||||||
if (i) flat += "\r\n";
|
|
||||||
flat += headers[i].first + "\r\n" + headers[i].second;
|
|
||||||
}
|
|
||||||
|
|
||||||
auto t0 = std::chrono::steady_clock::now();
|
|
||||||
std::string raw = signer.sign(jurl->s, flat);
|
|
||||||
auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(std::chrono::steady_clock::now() - t0).count();
|
|
||||||
|
|
||||||
if (raw.empty())
|
|
||||||
return respJson(500, errBody("签名失败(DLL 未返回内容;检查 headers 是否与将要发出的完全一致)"));
|
|
||||||
|
|
||||||
// 解析 "名字\r\n值\r\n..." 成对
|
|
||||||
std::vector<std::string> f;
|
|
||||||
{
|
|
||||||
size_t b = 0;
|
|
||||||
while (b <= raw.size()) {
|
|
||||||
size_t e = raw.find("\r\n", b);
|
|
||||||
if (e == std::string::npos) { f.push_back(raw.substr(b)); break; }
|
|
||||||
f.push_back(raw.substr(b, e - b));
|
|
||||||
b = e + 2;
|
|
||||||
}
|
|
||||||
while (!f.empty() && f.back().empty()) f.pop_back();
|
|
||||||
}
|
|
||||||
if (f.size() < 2 || (f.size() % 2) != 0) return respJson(500, errBody("DLL 返回格式异常"));
|
|
||||||
|
|
||||||
std::string out = "{\"ok\":true,\"headers\":{";
|
|
||||||
for (size_t i = 0; i + 1 < f.size(); i += 2) {
|
|
||||||
if (i) out += ",";
|
|
||||||
out += "\"" + jsonEscape(f[i]) + "\":\"" + jsonEscape(f[i + 1]) + "\"";
|
|
||||||
}
|
|
||||||
out += "},\"elapsed_ms\":" + std::to_string(ms);
|
|
||||||
if (!addedStub.empty()) out += ",\"added\":{\"x-ss-stub\":\"" + addedStub + "\"}";
|
|
||||||
out += "}";
|
|
||||||
if (verbose) printf("[sign] %s -> %zu 个签名头, %lldms\n", jurl->s.substr(0, 80).c_str(), f.size() / 2, (long long)ms);
|
|
||||||
return respJson(200, out);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void handleConn(SOCKET s, const Config &cfg, Signer &signer) {
|
|
||||||
std::string method, path, headersRaw, body;
|
|
||||||
if (!readRequest(s, method, path, headersRaw, body)) { closesocket(s); return; }
|
|
||||||
std::string route = path;
|
|
||||||
size_t q = route.find('?');
|
|
||||||
if (q != std::string::npos) route = route.substr(0, q);
|
|
||||||
|
|
||||||
std::string resp;
|
|
||||||
if (route == "/healthz") {
|
|
||||||
std::string j = "{\"ok\":true,\"service\":\"mssdk-sign\",\"version\":\"0.1.0\",\"signer\":\"" +
|
|
||||||
jsonEscape(signer.dllPath()) + "\",\"dllVersion\":\"" + jsonEscape(signer.version()) +
|
|
||||||
"\",\"signRva\":\"" + [&] {
|
|
||||||
char b[32];
|
|
||||||
snprintf(b, sizeof b, "0x%llx", (unsigned long long)signer.signRva());
|
|
||||||
return std::string(b);
|
|
||||||
}() + "\",\"auth\":" + (cfg.token.empty() ? "false" : "true") + "}";
|
|
||||||
resp = respJson(200, j);
|
|
||||||
} else if (route == "/config") {
|
|
||||||
if (!authorized(cfg, headersRaw)) {
|
|
||||||
resp = respJson(401, errBody("缺少或错误的 token"));
|
|
||||||
} else {
|
|
||||||
resp = respJson(200, "{\"ok\":true,\"signRva\":\"" + std::string("see /healthz") +
|
|
||||||
"\",\"headersOrder\":\"按请求里的顺序签名,响应里的 headers 需原样发出\"}");
|
|
||||||
}
|
|
||||||
} else if (route == "/sign") {
|
|
||||||
if (method != "POST") resp = respJson(400, errBody("请用 POST /sign"));
|
|
||||||
else if (!authorized(cfg, headersRaw)) resp = respJson(401, errBody("缺少或错误的 token"));
|
|
||||||
else resp = handleSign(signer, body, cfg.verbose);
|
|
||||||
} else if (route == "/") {
|
|
||||||
resp = respJson(200, "{\"ok\":true,\"usage\":\"POST /sign {url,headers,body?} | GET /healthz\"}");
|
|
||||||
} else {
|
|
||||||
resp = respJson(404, errBody("未知路径"));
|
|
||||||
}
|
|
||||||
sendAll(s, resp);
|
|
||||||
closesocket(s);
|
|
||||||
}
|
|
||||||
|
|
||||||
static void printUsage() {
|
|
||||||
printf(
|
|
||||||
"mssdk-sign —— 汽水音乐 metasec 签名服务\n"
|
|
||||||
"用法: mssdk-sign [选项]\n"
|
|
||||||
" --port <n> 监听端口(默认 16889)\n"
|
|
||||||
" --bind <addr> 绑定地址(默认 127.0.0.1;容器内跨机调用用 0.0.0.0)\n"
|
|
||||||
" --dll <path> metasecml.dll 路径(默认 exe 同目录 metasecml.dll)\n"
|
|
||||||
" --token <t> 启用鉴权(Bearer / X-Auth-Token)\n"
|
|
||||||
" --sign-rva <hex> 手动指定签名函数偏移(默认按 DLL 版本表)\n"
|
|
||||||
" --selftest 只做加载+签名自检后退出\n"
|
|
||||||
" -v 打印每个请求的签名日志\n"
|
|
||||||
"接口:\n"
|
|
||||||
" GET /healthz\n"
|
|
||||||
" POST /sign {\"url\":\"https://...\",\"body\":\"可选\",\"headers\":{\"user-agent\":\"...\"}}\n"
|
|
||||||
" → {\"ok\":true,\"headers\":{\"X-Helios\":\"...\",\"X-Medusa\":\"...\"}}\n");
|
|
||||||
}
|
|
||||||
|
|
||||||
static std::string exeDir() {
|
|
||||||
char b[MAX_PATH];
|
|
||||||
DWORD n = GetModuleFileNameA(nullptr, b, MAX_PATH);
|
|
||||||
std::string p(b, n);
|
|
||||||
size_t s = p.find_last_of("\\/");
|
|
||||||
return s == std::string::npos ? "." : p.substr(0, s);
|
|
||||||
}
|
|
||||||
|
|
||||||
int main(int argc, char **argv) {
|
|
||||||
Config cfg;
|
|
||||||
for (int i = 1; i < argc; i++) {
|
|
||||||
std::string a = argv[i];
|
|
||||||
auto next = [&]() -> std::string { return (i + 1 < argc) ? argv[++i] : ""; };
|
|
||||||
if (a == "--port") cfg.port = atoi(next().c_str());
|
|
||||||
else if (a == "--bind") cfg.bind = next();
|
|
||||||
else if (a == "--dll") cfg.dll = next();
|
|
||||||
else if (a == "--token") cfg.token = next();
|
|
||||||
else if (a == "--sign-rva") cfg.signRva = strtoull(next().c_str(), nullptr, 16);
|
|
||||||
else if (a == "--selftest") cfg.selftestOnly = true;
|
|
||||||
else if (a == "-v") cfg.verbose = true;
|
|
||||||
else if (a == "-h" || a == "--help") { printUsage(); return 0; }
|
|
||||||
}
|
|
||||||
if (cfg.dll.empty()) cfg.dll = exeDir() + "\\metasecml.dll";
|
|
||||||
|
|
||||||
// MD5 自检(防止 x-ss-stub 算错)
|
|
||||||
if (md5HexUpper("abc") != "900150983CD24FB0D6963F7D28E17F72") {
|
|
||||||
fprintf(stderr, "MD5 自检失败,拒绝启动\n");
|
|
||||||
return 2;
|
|
||||||
}
|
|
||||||
|
|
||||||
Signer signer;
|
|
||||||
std::string err;
|
|
||||||
if (!signer.load(cfg.dll, cfg.signRva, err)) {
|
|
||||||
fprintf(stderr, "签名器加载失败: %s\n", err.c_str());
|
|
||||||
return 3;
|
|
||||||
}
|
|
||||||
if (!signer.warn().empty()) fprintf(stderr, "警告: %s\n", signer.warn().c_str());
|
|
||||||
printf("签名器就绪: %s (DLL 版本 %s, 签名偏移 0x%llx)\n", cfg.dll.c_str(),
|
|
||||||
signer.version().empty() ? "未知" : signer.version().c_str(), (unsigned long long)signer.signRva());
|
|
||||||
if (cfg.selftestOnly) {
|
|
||||||
printf("自检通过。\n");
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
WSADATA wsa;
|
|
||||||
if (WSAStartup(MAKEWORD(2, 2), &wsa) != 0) {
|
|
||||||
fprintf(stderr, "WSAStartup 失败\n");
|
|
||||||
return 4;
|
|
||||||
}
|
|
||||||
SOCKET srv = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
|
|
||||||
if (srv == INVALID_SOCKET) {
|
|
||||||
fprintf(stderr, "socket 失败\n");
|
|
||||||
return 4;
|
|
||||||
}
|
|
||||||
BOOL yes = TRUE;
|
|
||||||
setsockopt(srv, SOL_SOCKET, SO_REUSEADDR, (const char *)&yes, sizeof yes);
|
|
||||||
sockaddr_in addr{};
|
|
||||||
addr.sin_family = AF_INET;
|
|
||||||
addr.sin_port = htons((u_short)cfg.port);
|
|
||||||
inet_pton(AF_INET, cfg.bind.c_str(), &addr.sin_addr);
|
|
||||||
if (bind(srv, (sockaddr *)&addr, sizeof addr) != 0 || listen(srv, 32) != 0) {
|
|
||||||
fprintf(stderr, "bind/listen %s:%d 失败(错误码 %d)\n", cfg.bind.c_str(), cfg.port, WSAGetLastError());
|
|
||||||
return 4;
|
|
||||||
}
|
|
||||||
printf("监听 http://%s:%d (/healthz, POST /sign)%s\n", cfg.bind.c_str(), cfg.port,
|
|
||||||
cfg.token.empty() ? "" : " [已启用 token 鉴权]");
|
|
||||||
fflush(stdout);
|
|
||||||
|
|
||||||
for (;;) {
|
|
||||||
SOCKET c = accept(srv, nullptr, nullptr);
|
|
||||||
if (c == INVALID_SOCKET) continue;
|
|
||||||
DWORD tv = 15000;
|
|
||||||
setsockopt(c, SOL_SOCKET, SO_RCVTIMEO, (const char *)&tv, sizeof tv);
|
|
||||||
setsockopt(c, SOL_SOCKET, SO_SNDTIMEO, (const char *)&tv, sizeof tv);
|
|
||||||
std::thread(handleConn, c, std::cref(cfg), std::ref(signer)).detach();
|
|
||||||
}
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
Reference in new issue
Block a user