1
import sys
2

3

4
def main():
5
    if len(sys.argv) != 4:
6
        print(f"Usage: python {sys.argv[0]} <file1> <file2> <output>")
7
        raise SystemExit(1)
8

9
    file1, file2, output = sys.argv[1], sys.argv[2], sys.argv[3]
10
    chunk_size = 1024 * 1024
11

12
    with open(file1, "rb") as f1, open(file2, "rb") as f2, open(output, "wb") as out:
13
        while True:
14
            b1 = f1.read(chunk_size)
15
            b2 = f2.read(chunk_size)
16

17
            if not b1 or not b2:
18
                break
19

20
            n = min(len(b1), len(b2))
21
            out.write(bytes(x ^ y for x, y in zip(b1[:n], b2[:n])))
22

23

24
if __name__ == "__main__":
25
    main()

1
import "frida-il2cpp-bridge";
2

3
declare namespace console {
4
    function log(...args: any[]): void;
5
}
6

7
Il2Cpp.perform(() => {
8

9
    Il2Cpp.domain.assemblies.forEach((i)=>{
10
        console.log(i.name);
11
    })
12

13
    console.log("started")
14
    const game = Il2Cpp.domain.assembly("Assembly-CSharp").image;
15
    const apiManager = game.class("Sekai.APIManager");
16
    Il2Cpp.gc.choose(apiManager).forEach((instance: Il2Cpp.Object) => {
17
        console.log("instance found")
18
        const crypt = instance.method<Il2Cpp.Object>("get_Crypt").invoke();
19
        const aes = crypt.field<Il2Cpp.Object>("aesAlgo");
20
        const key = aes.value.method("get_Key").invoke();
21
        const iv = aes.value.method("get_IV").invoke();
22
        console.log(key);
23
        console.log(iv);
24
    });
25
});

1
import json
2
import msgpack
3
from Crypto.Cipher import AES
4
from Crypto.Util.Padding import pad, unpad
5

6
# get key and iv from frida-il2cpp-bridge first
7
key = b'g2fcC0ZczN9MTJ61'
8
iv = b'msx3IV0i9XE5uYZ1'
9

10
def decrypt_aes_cbc(data: bytes) -> bytes:
11
    cipher = AES.new(key, AES.MODE_CBC, iv)
12
    decrypted_data = unpad(cipher.decrypt(data), AES.block_size)
13
    return decrypted_data
14

15
def encrypt_aes_cbc(data: bytes) -> bytes:
16
    cipher = AES.new(key, AES.MODE_CBC, iv)
17
    padded_data = pad(data, AES.block_size)
18
    encrypted_data = cipher.encrypt(padded_data)
19
    return encrypted_data
20

21
def encode_msgpack(data: dict) -> bytes:
22
    if data is None:
23
        raise ValueError("Input data for encode_msgpack cannot be None")
24
    packed = msgpack.packb(data, use_bin_type=True)
25
    if not isinstance(packed, bytes):
26
        raise TypeError("msgpack.packb did not return bytes")
27
    return packed
28

29
def decode_msgpack(data: bytes) -> dict:
30
    return msgpack.unpackb(data, raw=False)
31

32
def pjsk_encode_msgpack(data: dict) -> bytes:
33
    packed = encode_msgpack(data)
34
    encrypted = encrypt_aes_cbc(packed)
35
    return encrypted
36

37
def pjsk_decode_msgpack(data: bytes) -> dict:
38
    decrypted = decrypt_aes_cbc(data)
39
    decoded = decode_msgpack(decrypted)
40
    return decoded

1
"obtainPrizes": [
2
    {
3
        "card": {
4
            "resourceId": 1236,
5
            "resourceType": "card",
6
            "resourceLevel": 1,
7
            "quantity": 1
8
        },
9
        "newFlg": true,
10
        "gachaLotteryType": "normal",
11
        "costume3d": [
12
            {
13
                "resourceId": 844137,
14
                "resourceType": "costume_3d",
15
                "resourceLevel": 0,
16
                "quantity": 1
17
            },
18
            {
19
                "resourceId": 844138,
20
                "resourceType": "costume_3d",
21
                "resourceLevel": 0,
22
                "quantity": 1
23
            },
24
            {
25
                "resourceId": 844161,
26
                "resourceType": "costume_3d",
27
                "resourceLevel": 0,
28
                "quantity": 1
29
            }
30
        ],
31
        "cardExtra": []
32
    },
33
    {
34
        "card": {
35
            "resourceId": 972,
36
            "resourceType": "card",
37
            "resourceLevel": 1,
38
            "quantity": 1
39
        },
40
        "newFlg": false,
41
        "gachaLotteryType": "normal",
42
        "costume3d": [],
43
        "cardExtra": []
44
    },
45
    {
46
        "card": {
47
            "resourceId": 127,
48
            "resourceType": "card",
49
            "resourceLevel": 1,
50
            "quantity": 1
51
        },
52
        "newFlg": false,
53
        "gachaLotteryType": "normal",
54
        "costume3d": [],
55
        "cardExtra": []
56
    },
57
    {
58
        "card": {
59
            "resourceId": 10,
60
            "resourceType": "card",
61
            "resourceLevel": 1,
62
            "quantity": 1
63
        },
64
        "newFlg": false,
65
        "gachaLotteryType": "normal",
66
        "costume3d": [],
67
        "cardExtra": []
68
    },
69
    {
70
        "card": {
71
            "resourceId": 316,
72
            "resourceType": "card",
73
            "resourceLevel": 1,
74
            "quantity": 1
75
        },
76
        "newFlg": false,
77
        "gachaLotteryType": "normal",
78
        "costume3d": [],
79
        "cardExtra": []
80
    },
81
    {
82
        "card": {
83
            "resourceId": 26,
84
            "resourceType": "card",
85
            "resourceLevel": 1,
86
            "quantity": 1
87
        },
88
        "newFlg": false,
89
        "gachaLotteryType": "normal",
90
        "costume3d": [],
91
        "cardExtra": []
92
    },
93
    {
94
        "card": {
95
            "resourceId": 431,
96
            "resourceType": "card",
97
            "resourceLevel": 1,
98
            "quantity": 1
99
        },
100
        "newFlg": false,
101
        "gachaLotteryType": "normal",
102
        "costume3d": [],
103
        "cardExtra": []
104
    },
105
    {
106
        "card": {
107
            "resourceId": 431,
108
            "resourceType": "card",
109
            "resourceLevel": 1,
110
            "quantity": 1
111
        },
112
        "newFlg": false,
113
        "gachaLotteryType": "normal",
114
        "costume3d": [],
115
        "cardExtra": []
116
    },
117
    {
118
        "card": {
119
            "resourceId": 401,
120
            "resourceType": "card",
121
            "resourceLevel": 1,
122
            "quantity": 1
123
        },
124
        "newFlg": false,
125
        "gachaLotteryType": "normal",
126
        "costume3d": [],
127
        "cardExtra": []
128
    },
129
    {
130
        "card": {
131
            "resourceId": 148,
132
            "resourceType": "card",
133
            "resourceLevel": 1,
134
            "quantity": 1
135
        },
136
        "newFlg": false,
137
        "gachaLotteryType": "normal",
138
        "costume3d": [],
139
        "cardExtra": []
140
    }
141
],

1
# the more miku the better!
2
# author: [MetaMiku](https://github.com/MetaMikuAI)
3

4
from mitmproxy import http
5
from Crypto.Cipher import AES
6
from Crypto.Util.Padding import pad, unpad
7
import msgpack
8
import json
9

10

11
# get key and iv from frida-il2cpp-bridge first
12
key = b'g2fcC0ZczN9MTJ61'
13
iv = b'msx3IV0i9XE5uYZ1'
14

15

16
target_url_list = [
17
    "https://production-game-api.sekai.colorfulpalette.org",
18
]
19

20

21
def decrypt_aes_cbc(data: bytes) -> bytes:
22
    cipher = AES.new(key, AES.MODE_CBC, iv)
23
    decrypted_data = unpad(cipher.decrypt(data), AES.block_size)
24
    return decrypted_data
25

26
def encrypt_aes_cbc(data: bytes) -> bytes:
27
    cipher = AES.new(key, AES.MODE_CBC, iv)
28
    padded_data = pad(data, AES.block_size)
29
    encrypted_data = cipher.encrypt(padded_data)
30
    return encrypted_data
31

32

33
def encode_msgpack(data: dict) -> bytes:
34
    if data is None:
35
        raise ValueError("Input data for encode_msgpack cannot be None")
36
    packed = msgpack.packb(data, use_bin_type=True)
37
    if not isinstance(packed, bytes):
38
        raise TypeError("msgpack.packb did not return bytes")
39
    return packed
40

41
def decode_msgpack(data: bytes) -> dict:
42
    return msgpack.unpackb(data, raw=False)
43

44

45
def dict_to_pretty_json(data: dict) -> str:
46
    return json.dumps(data, ensure_ascii=False, indent=2)
47

48

49
def pjsk_encrypt_msgpack(data: dict) -> bytes:
50
    packed = encode_msgpack(data)
51
    encrypted = encrypt_aes_cbc(packed)
52
    return encrypted
53

54

55
def pjsk_decrypt_msgpack(data: bytes) -> dict:
56
    decrypted = decrypt_aes_cbc(data)
57
    decoded = decode_msgpack(decrypted)
58
    return decoded
59

60

61
def hack_gacha_results(data: dict) -> dict:
62
    target_data = {
63
        "card": {
64
            "resourceId": 1235,
65
            "resourceType": "card",
66
            "resourceLevel": 1,
67
            "quantity": 1
68
        },
69
        "newFlg": False,
70
        "gachaLotteryType": "normal",
71
        "costume3d": [],
72
        "cardExtra": []
73
    }
74

75

76
    gacha_results = data["obtainPrizes"]
77
    for idx, result in enumerate(gacha_results):
78
        id = result["card"]["resourceId"]
79
        print(f"Gacha ID: {id}")
80
        gacha_results[idx] = target_data
81

82
    data["obtainPrizes"] = gacha_results
83
    return data
84

85
def request(flow: http.HTTPFlow) -> None: # type: ignore
86
    for target_url in target_url_list:
87
        print(flow.request.pretty_url)
88
        if flow.request.pretty_url.startswith(target_url):
89
            pass
90

91

92
def response(flow: http.HTTPFlow) -> None: # type: ignore
93
    for target_url in target_url_list:
94
        print(flow.request.pretty_url)
95
        if flow.request.pretty_url.startswith(target_url):
96
            if "gachaBehaviorId" in flow.request.pretty_url:
97
                original_data = pjsk_decrypt_msgpack(flow.response.content)
98
                modified_data = hack_gacha_results(original_data)
99
                re_encrypted = pjsk_encrypt_msgpack(modified_data)
100
                flow.response.content = re_encrypted
101

102
# mitmweb -m wireguard --no-http2 -s ./mitmproxy.py --set termlog_verbosity=info --ignore 127.0.0.1

1
from mitmproxy import http
2

3
LOG_FILE = "analyze_jwt.txt"
4

5
targets = [
6
    "https://production-game-api.sekai.colorfulpalette.org"
7
]
8

9
def request(flow: http.HTTPFlow) -> None:
10
    for target in targets:
11
        if flow.request.pretty_url.startswith(target):
12
            with open(LOG_FILE, "a") as f:
13
                f.write(f"Request: {flow.request.method} {flow.request.pretty_url}\n")
14
                if "X-Session-Token" in flow.request.headers:
15
                    f.write(f"X-Session-Token: {flow.request.headers['X-Session-Token']}\n")
16
                if flow.request.content:
17
                    if len(flow.request.content) == 16:
18
                        return
19

20
                    try:
21
                        data = pjsk_decode_msgpack(flow.request.content)
22
                        jwt_fields = detect_jwt_in_json(data)
23
                        if jwt_fields:
24
                            f.write("Detected JWT fields in JSON payload:\n")
25
                            f.write(json.dumps(jwt_fields, indent=2) + "\n")
26
                    except json.JSONDecodeError:
27
                        pass
28
                f.write("\n")
29

30
def response(flow: http.HTTPFlow) -> None:
31
    for target in targets:
32
        if flow.request.pretty_url.startswith(target):
33
            with open(LOG_FILE, "a") as f:
34
                f.write(f"Response: {flow.request.method} {flow.request.pretty_url}\n")
35
                if "X-Session-Token" in flow.response.headers:
36
                    f.write(f"X-Session-Token: {flow.response.headers['X-Session-Token']}\n")
37
                if flow.response.content:
38
                    if len(flow.request.content) == 16:
39
                        return
40
                    try:
41
                        data = pjsk_decode_msgpack(flow.response.content)
42
                        jwt_fields = detect_jwt_in_json(data)
43
                        if jwt_fields:
44
                            f.write("Detected JWT fields in JSON payload:\n")
45
                            f.write(json.dumps(jwt_fields, indent=2) + "\n")
46
                    except json.JSONDecodeError:
47
                        pass
48
                f.write("\n\n")
49

50
# 毕竟是临时的脚本, 嵌套多了一点就多一点吧 -- MetaMiku
51

52
def is_jwt(token: str) -> bool:
53
    parts = token.split('.')
54
    return len(parts) == 3 and all(part.isascii() for part in parts) and not parts[0].startswith('http') and len(token) > 32
55

56
def detect_jwt_in_json(data: dict) -> dict:
57
    jwt_fields = {}
58
    for key, value in data.items():
59
        if isinstance(value, str) and is_jwt(value):
60
            jwt_fields[key] = value
61
        elif isinstance(value, dict):
62
            nested_jwt = detect_jwt_in_json(value)
63
            if nested_jwt:
64
                jwt_fields[key] = nested_jwt
65
        elif isinstance(value, list):
66
            for item in value:
67
                if isinstance(item, dict):
68
                    nested_jwt = detect_jwt_in_json(item)
69
                    if nested_jwt:
70
                        jwt_fields[key] = nested_jwt
71
    return jwt_fields

1
{
2
    "sessionToken": "脱敏",
3
    "appVersion": "5.6.0",
4
    "multiPlayVersion": "miku",
5
    "dataVersion": "5.6.0.30",
6
    "assetVersion": "5.6.0.30",
7
    "removeAssetVersion": "1.13.0.30",
8
    "assetHash": "5242f35c-e32d-bafb-a488-74b247052713",
9
    "appVersionStatus": "available",
10
    "isStreamingVirtualLiveForceOpenUser": false,
11
    "deviceId": "c8b6d5f1-f96a-4588-b650-c2a7452e4bd6",
12
    "updatedResources": {},
13
    "suiteMasterSplitPath": [
14
        "suitemasterfile/5.6.0.30/00_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
15
        "suitemasterfile/5.6.0.30/01_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
16
        "suitemasterfile/5.6.0.30/02_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
17
        "suitemasterfile/5.6.0.30/03_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
18
        "suitemasterfile/5.6.0.30/04_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
19
        "suitemasterfile/5.6.0.30/05_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41",
20
        "suitemasterfile/5.6.0.30/06_bb2194a8ea47722555dd056f8cc2a2d4563ea2041d4a3657b427285dca156e41"
21
    ],
22
    "obtainedBondsRewardIds": []
23
}

1
from mitmproxy import http
2
from time import time
3
from crypto import prsk_dec, prsk_enc
4
import json
5
from random import randint
6

7

8
def request(flow: http.HTTPFlow) -> None:
9
    # /api/user/<userId>/live/<userLiveId>
10
    if "/api/user/" in flow.request.pretty_url and "/live/" in flow.request.pretty_url:
11
        if flow.request.content is None:
12
            return
13
        body = prsk_dec(flow.request.content)
14
        if "score" in body:
15
            body["score"] = randint(90000, 120000)
16
            body["life"] = 1000
17
            perfectCount = body["perfectCount"]
18
            greatCount = body["greatCount"]
19
            goodCount = body["goodCount"]
20
            badCount = body["badCount"]
21
            missCount = body["missCount"]
22
            maxCombo = body["maxCombo"]
23
            total = perfectCount + greatCount + goodCount + badCount + missCount
24
            body["perfectCount"] = total
25
            body["greatCount"] = 0
26
            body["goodCount"] = 0
27
            body["badCount"] = 0
28
            body["missCount"] = 0
29
            body["maxCombo"] = total
30
            body["tapCount"] = total*2 + randint(0, 100)
31
            flow.request.content = prsk_enc(body)
32
            print(f"Modified live data: {body}")

1
{
2
    "thumbnail": "此处为图片的预览图，格式为 JFIF base64，大小为 1190w * 528h",
3
    "customProfileCard": {
4
        "version": 3,
5
        "generals": [],
6
        "generalBackgrounds": [],
7
        "storyBackgrounds": [],
8
        "standMembers": [],
9
        "cardMembers": [],
10
        "honors": [],
11
        "bondsHonors": [],
12
        "texts": [
13
            {
14
                "objectData": {
15
                    "position": {
16
                        "x": -18.276344299316406,
17
                        "y": -13.701630592346191,
18
                        "z": 0
19
                    },
20
                    "scale": {
21
                        "x": 1,
22
                        "y": 1,
23
                        "z": 1
24
                    },
25
                    "rotation": {
26
                        "x": 0,
27
                        "y": 0,
28
                        "z": 0,
29
                        "w": 1
30
                    },
31
                    "layer": 0,
32
                    "lock": false,
33
                    "visible": true
34
                },
35
                "text": "hello",
36
                "fontId": 1,
37
                "type": 513,
38
                "colorId": 1,
39
                "size": 24,
40
                "outlineColorId": 1,
41
                "outlineSize": 0,
42
                "lineSpacing": 0
43
            }
44
        ],
45
        "collections": [],
46
        "others": [],
47
        "shapes": [],
48
        "stamps": []
49
    }
50
}

1
from mitmproxy import http
2
from base64 import b64encode
3
from crypto import prsk_dec, prsk_enc # type: ignore
4

5
target_dir_path = '~/prsk/test/patchimages/'
6

7

8
# POST/PUT https://production-game-api.sekai.colorfulpalette.org/api/user/{user_id}/custom-profile/1/custom-profile-card/{card_id}
9
def request(flow: http.HTTPFlow) -> None:
10
    if flow.request.method in ["POST", "PUT"] and "custom-profile-card" in flow.request.pretty_url:
11
        if flow.request.content is None:
12
            return
13
        card_id = flow.request.pretty_url.split("/")[-1]
14
        request_data = prsk_dec(flow.request.content)
15
        target_image_path = target_dir_path + str(card_id) + '.jpg'
16
        with open(target_image_path, 'rb') as f:
17
            image = f.read()
18

19
        request_data['thumbnail'] = b64encode(image).decode('utf-8')
20
        flow.request.content = prsk_enc(request_data)
21
        # print(request_data) # check the modified request data but not actually send it
22
        print(f"Replaced thumbnail for card_id {card_id} from {target_image_path}")