refactor: split node agent and Go control plane

2026-09-11 16:57:31 +08:00
parent 078c22c73b
commit c86ba9c4d7
129 changed files with 654 additions and 77 deletions
@@ -0,0 +1,51 @@
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.RegularExpressions;
+
+namespace WxAgent.Core;
+
+/// <summary>Decodes bounded Windows WCDB Config.Cipher blobs. Candidates still require page HMAC verification.</summary>
+public static class WcdbConfigCipher
+{
+    public const string TypeName = "com.Tencent.WCDB.Config.Cipher";
+    public const int MaximumBlobLength = 1024;
+    // Windows 4.1.x storage layout, independently verified against each target DB before use.
+    private static readonly byte[] Mask = Convert.FromHexString("d2c7442458020000004889442450488b450048844c2448488944254048584c24");
+
+    public static IReadOnlyList<WcdbKeyCandidate> Decode(ReadOnlySpan<byte> blob)
+    {
+        if (blob.Length is 0 or > MaximumBlobLength) return [];
+        var decoded = blob.ToArray();
+        try
+        {
+            for (var i = 0; i < decoded.Length; i++) decoded[i] ^= Mask[i % Mask.Length];
+            var candidates = new HashSet<WcdbKeyCandidate>();
+            foreach (Match match in Regex.Matches(Encoding.ASCII.GetString(decoded), "[xX]'([0-9a-fA-F]{64,192})'", RegexOptions.None, TimeSpan.FromSeconds(1)))
+            {
+                var run = match.Groups[1].Value.ToLowerInvariant();
+                var starts = new HashSet<int> { 0 };
+                if (run.Length > 96)
+                {
+                    for (var start = 0; start + 64 <= run.Length; start += 32) starts.Add(start);
+                    starts.Add(run.Length - 64);
+                }
+                foreach (var start in starts)
+                {
+                    var keyHex = run.Substring(start, 64);
+                    var key = Convert.FromHexString(keyHex);
+                    var distinct = key.Distinct().Count();
+                    var allZero = key.All(byteValue => byteValue == 0);
+                    var allOne = key.All(byteValue => byteValue == 0xff);
+                    if (distinct < 15 || allZero || allOne) continue;
+                    candidates.Add(new WcdbKeyCandidate(keyHex,
+                        start + 96 <= run.Length ? run.Substring(start + 64, 32) : null));
+                }
+            }
+            return candidates.ToArray();
+        }
+        finally
+        {
+            CryptographicOperations.ZeroMemory(decoded);
+        }
+    }
+}