将函数名改为Python命名规范,去掉参数中的类型声明

def a2_crypto_hash_hash_string(text, max_length): ''' 将文本字符串进行哈希运算,并截取指定长度的子字符串

Args:
    text: 要进行哈希运算的文本字符串
    max_length: 截取的子字符串长度

Returns:
    截取后的子字符串
'''
v5 = a2_crypto_hash_hash_bytes(text, max_length)
v6 = system_convert_to_base64_string(v5, 0)
v7 = v6
if max_length < 1:
    return v7
if not v6:
    sub_153CD44()
if system_string_get_length(v6, 0) <= max_length:
    return v7
if not v7:
    sub_153CD44()
v8 = system_string_get_length(v7, 0) - max_length
return system_string_substring_40088876(v7, v8 // 2, max_length, 0)

def a2_http_pokke_msg_pack_api_display_class8_0_object_object_on_request_finish_b_0(this, o): ''' 处理 HTTP 请求完成事件

Args:
    this: 当前类的实例
    o: 请求完成事件对象
'''
v5 = A2_Common_DefaultContainer__Resolve_object_((const MethodInfo_2450F58 *)Method_A2_Common_DefaultContainer_Resolve_IMsgPackConfig___)
v6 = v5
if not v5:
    sub_153CD44()
v7 = v5.klass
if v5.klass._2.interface_offsets_count:
    v8 = 0
    v9 = &v7._1.interfaceOffsets.offset
    while *((A2_Http_IMsgPackConfig_c **)v9 - 1) != A2_Http_IMsgPackConfig_TypeInfo:
        v8 += 1
        v9 += 4
        if v8 >= v5.klass._2.interface_offsets_count:
            break
    v10 = v7.vtable[*v9]
else:
    v10 = sub_1509B58(v5, (__int64)A2_Http_IMsgPackConfig_TypeInfo, 0)
v11 = system_convert_to_base64_string(v10, 0)
v12 = a2_crypto_hash_hash_string(v11, 16)
v13 = a2_crypto_basic_crypto_decrypt_32630132(v12, this.fields.bytes)
v14 = this.fields.__4__this
v15 = MsgPack_ObjectPacker_o(sub_154ACB8(MsgPack_ObjectPacker_TypeInfo))
MsgPack_ObjectPacker___ctor(v15, 0)
if not v15:
    sub_153CD44()
v16 = v15.unpack(v13)
if not v14:
    sub_153CD44()
v14.set_response_container(v16)
v17 = this.fields.__4__this
if not v17:
    sub_153CD44()
v18 = v17.get_response_container()
if not v18:
    sub_153CD44()
v17.set_response_payload(v18.response_payload)
v19 = this.fields.__9__1
if not v19:
    v19 = System_Action_o(sub_154ACB8(System_Action_TypeInfo))
    System_Action___ctor(v19, this, a2_http_pokke_msg_pack_api_display_class8_0_t_req_t_res_on_request_finish_b_1, 0)
    this.fields.__9__1 = v19
A2_Coroutines_AriesCoroutine__RunInMainThread(v19, 0)

def a2_crypto_basic_crypto_decrypt_32629204(crypto_key, data): ''' 使用 Rijndael 算法解密数据

Args:
    crypto_key: 解密密钥
    data: 要解密的数据

Returns:
    解密后的数据
'''
if data and data.max_length:
    if not crypto_key:
        sub_153CD44()
    v5 = il2cpp_array_new_specific_0(byte___TypeInfo, len(crypto_key), method)
    v6 = v5
    if not v5:
        sub_153CD44()
    System_Array__Copy_44358760(data, v5, len(crypto_key), 0)
    if not v6:
        sub_153CD44()
    v8 = il2cpp_array_new_specific_0(byte___TypeInfo, len(data) - len(crypto_key))
    System_Array__Copy_44354660(data, len(crypto_key), v8, 0, len(data) - len(crypto_key))
    v9 = System_Security_Cryptography_RijndaelManaged_o(sub_154ACB8(System_Security_Cryptography_RijndaelManaged_TypeInfo))
    System_Security_Cryptography_RijndaelManaged___ctor(v9, 0)
    v9.set_BlockSize(len(crypto_key) * 8)
    v9.set_KeySize(len(crypto_key) * 8)
    v9.set_IV(v6)
    v9.set_Key(crypto_key)
    v9.set_Mode(1)
    v9.set_Padding(2)
    v10 = v9.CreateDecryptor()
    v11 = v10
    if not v8:
        sub_153CD44()
    if not v10:
        sub_153CD44()
    v12 = v10
    v13 = len(v8)
    if v10._2.interface_offsets_count:
        v14 = 0
        v15 = v10._1.interfaceOffsets
        while v15[0] != System_Security_Cryptography_ICryptoTransform_TypeInfo:
            v14 += 1
            v15 += 2
            if v14 >= v10._2.interface_offsets_count:
                break
        v16 = v12 + 16 * v15[0] + 296
    else:
        v16 = sub_1509B58(v10, System_Security_Cryptography_ICryptoTransform_TypeInfo, 4)
    data = v10.TransformFinalBlock(v8, 0, v13)
    if v11:
        v17 = v11
        if v11._2.interface_offsets_count:
            v18 = 0
            v19 = v11._1.interfaceOffsets
            while v19[0] != System_IDisposable_TypeInfo:
                v18 += 1
                v19 += 4
                if v18 >= v11._2.interface_offsets_count:
                    break
            v20 = v17 + 16 * v19[0] + 296
        else:
            v20 = sub_1509B58(v11, System_IDisposable_TypeInfo, 0)
        v11.Dispose()
return data

def a2_crypto_basic_crypto_decrypt_32630132(crypto_key, data): ''' 使用 Rijndael 算法解密数据,密钥为字符串

Args:
    crypto_key: 解密密钥字符串
    data: 要解密的数据

Returns:
    解密后的数据
'''
v5 = System_Text_Encoding__get_UTF8()
if not v5:
    sub_153CD44()
v6 = v5.GetBytes(crypto_key)
return a2_crypto_basic_crypto_decrypt_32629204(v6, data)

定义加密密钥

crypto_key = '0123456789abcdef'.encode('utf-8')

示例:解密数据

首先获取要解密的数据,例如从文件中读取

data = ...

使用 decrypt_data 函数进行解密

decrypted_data = a2_crypto_basic_crypto_decrypt_32630132(crypto_key, data)

打印解密后的数据

print(decrypted_data)

TODO: 将 sub_153CD44()、system_string_get_length()、system_string_substring_40088876()、

a2_crypto_hash_hash_bytes()、system_convert_to_base64_string()、il2cpp_array_new_specific_0()、

System_Array__Copy_44358760()、System_Array__Copy_44354660()、

System_Text_Encoding__get_UTF8() 等函数替换为相应的 Python 代码

TODO: 完善 a2_http_pokke_msg_pack_api_display_class8_0_object_object_on_request_finish_b_0() 函数,

实现事件处理逻辑

TODO: 处理异常情况,例如解密密钥错误或数据格式错误

以上代码仅供参考,实际使用时需要根据具体情况进行修改和完善。

IDA 伪代码到 Python3 解密脚本转换:使用 cryptoKey '0123456789abcdef' 解密二进制字符串

原文地址: https://www.cveoy.top/t/topic/n6Ce 著作权归作者所有。请勿转载和采集!

免费AI点我,无需注册和登录