DUNGEON REBORN 逆向 - 筆記歸檔

    function Run() {
        return (typeof G !== "undefined" && G && G.player) ? G : null;
    }

    const OrigHurt = window.hurtPlayer;
    window.hurtPlayer = function (...Args) {
        if (Cfg.God && Run()) return;
        return OrigHurt.apply(this, Args);
    };

typeof window.hurtPlayer   // "undefined"
typeof G                   // "undefined"

const prelude = code.slice(decFn.start, decFn.end) + ';' + code.slice(arrFn.start, arrFn.end) + ';(' + code.slice(rot.start, rot.end) + ');';
const ctx = vm.createContext({});
vm.runInContext(prelude, ctx, { timeout: 5000 });

function _0x4b15d0(a, b) { return _0x550d(b - 0x1ee, a); }
function _0x490513(a, b) { return _0x550d(a - -0xc7, b); }

let changed = true, defs = [];
while (changed) {
  changed = false;
  traverse(ast, {
    Function(path) {
      const n = path.node;
      if (n.body.type !== 'BlockStatement' || n.body.body.length !== 1) return;
      const r = n.body.body[0];
      if (!t.isReturnStatement(r) || !t.isCallExpression(r.argument)) return;
      const params = new Set(n.params.map(p => p.name));
      if (n.params.some(p => !t.isIdentifier(p))) return;
      const target = calleeId(path.get('body.body.0.argument'), r.argument.callee);
      if (!target) return;
      if (!r.argument.arguments.every(a => isSimple(a, params))) return;
      let b;
      if (t.isFunctionDeclaration(n)) b = path.parentPath.scope.getBinding(n.id.name);
      else if (t.isVariableDeclarator(path.parent) && t.isIdentifier(path.parent.id)) b = path.parentPath.scope.getBinding(path.parent.id.name);
      if (!b || wrappers.has(b)) return;
      const name = 'W' + (uid++);
      wrappers.set(b, name);
      const args = r.argument.arguments.map(a => generate(a).code).join(',');
      defs.push(`function ${name}(${n.params.map(p=>p.name).join(',')}){return ${target}(${args});}`);
      changed = true;
    }
  });
}
vm.runInContext(defs.join('\n'), ctx);

// 原本
function itemLv(id) { return (G && G.items[id]) || 0; }
const speed = base * (1 + itemLv("boots") * 0.06);
 
// 內聯後：_0x528f3b 是 itemLv 的參數名，已經沒有定義了
const speed = base * (1 + (G && G.items[_0x528f3b] || 0) * 0.06);

function pureOfParams(fn) {
  const params = new Set(fn.params.map(p => p.name));
  const body = t.isBlockStatement(fn.body) ? fn.body.body[0]?.argument : fn.body;
  if (!body) return true;
  const seen = new Map(); let ok = true;
  (function walk(n, parent, key) {
    if (!ok || !n || typeof n.type !== 'string') return;
    if (t.isIdentifier(n)) {
      const isProp = (t.isMemberExpression(parent) && key === 'property' && !parent.computed) || (t.isObjectProperty(parent) && key === 'key');
      if (!isProp) {
        if (!params.has(n.name)) { ok = false; return; }
        seen.set(n.name, (seen.get(n.name) || 0) + 1);
        if (seen.get(n.name) > 1) ok = false;
      }
      return;
    }
    for (const k of t.VISITOR_KEYS[n.type] || []) {
      const v = n[k];
      if (Array.isArray(v)) v.forEach(c => walk(c, n, k)); else walk(v, n, k);
    }
  })(body, null, null);
  return ok;
}
// 主 IIFE 頂層的函式宣告是遊戲自己的函式 (例如 svgIcon、upgradeGain)，混淆器產生的 proxy 不會出現在這一層
const topLevel = new WeakSet();
pf.isProxyFunctionExpression = node => !topLevel.has(node) && orig(node) && pureOfParams(node);

export function align(refSigs, curSigs) {
  const n = refSigs.length, m = curSigs.length;
  const L = Array.from({ length: n + 1 }, () => new Int32Array(m + 1));
  for (let i = n - 1; i >= 0; i--) for (let j = m - 1; j >= 0; j--)
    L[i][j] = refSigs[i] === curSigs[j] ? L[i + 1][j + 1] + 1 : Math.max(L[i + 1][j], L[i][j + 1]);
  const map = new Map(); let i = 0, j = 0;
  while (i < n && j < m) {
    if (refSigs[i] === curSigs[j]) { map.set(j, i); i++; j++; }
    else if (L[i + 1][j] >= L[i][j + 1]) i++; else j++;
  }
  // 兩個錨點之間，兩邊剩下的數量一樣就照順序補上 (指紋只差在算式寫法，例如 80*x 與 x*80)
  const pairs = [[-1, -1], ...[...map.entries()].map(([c, r]) => [r, c]).sort((a, b) => a[1] - b[1]), [n, m]];
  for (let k = 0; k + 1 < pairs.length; k++) {
    const [r0, c0] = pairs[k], [r1, c1] = pairs[k + 1];
    if (r1 - r0 === c1 - c0) for (let d = 1; r0 + d < r1; d++) map.set(c0 + d, r0 + d);
  }
  return map;
}

function hurtPlayer(raw, fromX, fromY) {
  if (G.player.shieldT > 0) {                    // 10/15 新增
    addNumber(G.player.x, G.player.y - 56, "免疫", "heal");
    return;
  }
  if (tryBlock()) return;
  const p = G.player;
  const dmg = Math.max(1, Math.round(raw * (1 - damageReduction())));
  p.hp -= dmg;
  …
}

    const body = fn.node.body.body;
    for (const [id, b] of Object.entries(fn.scope.bindings)) {
      const stmt = b.path.isFunctionDeclaration() ? b.path.node : b.path.parentPath?.node;
      if (!stmt || !body.includes(stmt)) continue;
      const self = norm(generate(stmt).code);
      const uses = new Set();
      for (const r of b.referencePaths.concat(b.constantViolations)) {
        let q = r.parentPath; if (!q) continue;
        if (q.isMemberExpression() && q.parentPath) q = q.parentPath;
        let s = generate(q.node).code;
        s = s.split(id).join('@');
        uses.add('u:' + norm(s).slice(0, 80));
      }
      const toks = tokens(self);
      for (const u of uses) { toks.add(u); for (const t of tokens(u.slice(2))) toks.add('u.' + t); }

-      hp: 2,
+      hp: 1,

    // 在閉包內定義 window 上的存取子；setter 直接改閉包裡的綁定，遊戲之後的呼叫就會走到新函式
    const Lines = [];
    for (const [Obf, [Name, Writable]] of Object.entries(Names)) {
        Lines.push("if(!(" + JSON.stringify(Name) + " in window))Object.defineProperty(window," + JSON.stringify(Name) +
            ",{configurable:true,get:function(){return " + Obf + "}" + (Writable ? ",set:function(v){" + Obf + "=v}" : "") + "});");
    }
    Game = Game.slice(0, Cut + 1) + "try{" + Lines.join("") + "}catch(e){console.error('[DUNGEON REBORN 外掛 v3] 匯出失敗',e)}" + Game.slice(Cut + 1);

Object.defineProperty(window, "hurtPlayer", {
  get: function () { return _0x3106b7 },
  set: function (v) { _0x3106b7 = v }    // 直接改閉包裡的綁定
});

if (window.__DR_V3__) return;
window.__DR_V3__ = true;
// document-start 時同步呼叫 document.open()，中止原本的 HTML 解析，換成拿掉 game.js 的版本。
// 不能用 window.stop()：它會把 parser 標成 aborted，之後的 document.open() 依規範會被忽略，Chrome 也不會開始渲染。
// 注意：Tampermonkey 注入時 parser 多半已經讀到 index.html 的 CSP meta，CSP 一旦套用，document.open() 也清不掉，
// 頁面裡的 inline script / eval 都會被擋。所以遊戲與外掛本體不能用一般的 <script> 插入，見 RunCode()。
document.open();

// 依序嘗試：
// 1. GM_addElement 插入頁面：Tampermonkey 以擴充功能權限插入，不受頁面 CSP 限制，遊戲與外掛跑在頁面裡，Console 也摸得到 G。
// 2. 在 Tampermonkey 的沙盒裡用 new Function 執行：沙盒的 CSP 是擴充功能自己的，允許 eval。
// 兩個都不行就回傳 false，由呼叫端退回原版遊戲。
async function RunCode(Code, Url) {
    const Text = Code + "\n//# sourceURL=" + Url;
    if (Mode !== "sandbox") {
        try {
            if (Mode === null) Root().setAttribute("data-dr-run", "page");
            // 執行成功的話，程式會把標記改成 page-ok
            const Probe = Mode === null ? "document.documentElement.setAttribute('data-dr-run','page-ok');" : "";
            GM_addElement(document.body || Root(), "script", { textContent: (Mode === null ? Guard : "") + Probe + Text });
            if (Mode === null) {
                for (let I = 0; I < 20 && Root().getAttribute("data-dr-run") !== "page-ok"; I++) await new Promise(R => setTimeout(R, 25));
                if (Root().getAttribute("data-dr-run") === "page-ok") { Mode = "page"; return true; }
            } else return true;
        } catch (Err) { console.warn("[DUNGEON REBORN 外掛 v3] GM_addElement 無法執行", Err); }
        // 頁面那份可能晚到：先把標記改掉，晚到的那份會在 Guard 停下
        Root().setAttribute("data-dr-run", "sandbox");
    }
    try {
        new Function(Text)();
        Mode = "sandbox";
        return true;
    } catch (Err) {
        if (Err instanceof EvalError) { console.warn("[DUNGEON REBORN 外掛 v3] 沙盒也不允許 eval", Err); return false; }
        throw Err;
    }
}

    // 劇毒詛咒直接扣 hp、時限到直接把 hp 設成 0，不經過 hurtPlayer，所以無敵還要擋 die
    if (Has("die")) {
        const OrigDie = window.die;
        window.die = function () {
            const Game = Run();
            if (Cfg.God && Game) {
                Game.player.hp = Game.player.maxHp;
                Game.deathNote = "";
                return;
            }
            return OrigDie.apply(this, arguments);
        };
    }

            P.dmgMult = Nat.Dmg;
            P.pickupMult = Nat.Pickup;
            P.crit = Nat.Crit;
            // 劇毒詛咒直接扣 hp (最多扣到 1，不會觸發 die)，無敵時把這一幀少掉的血補回來
            if (Cfg.God && P.hp < Nat.Hp) P.hp = Nat.Hp;
            // 時限在原版 updateArena 裡扣，所以這一幀結束後再補滿
            if (Cfg.BossNoCurse && Game.fight) Game.fight.timeLeft = Game.fight.limit;
        }

    // ---------- 分身 ----------
    // 原版固定 2 個，站位角度是 anim*0.9 + k*π；k 取 2i/N 就能讓 N 個分身平均繞著玩家
    function ResizeClones(Game, N) {
        const P = Game.player;
        const Old = Game.clones;
        if (!Old.length || Old.length === N) return;
        const Tpl = Old[0];
        Game.clones = [];
        for (let I = 0; I < N; I++) {
            const Prev = Old[I];
            Game.clones.push(Object.assign({}, Tpl, Prev || {
                x: P.x, y: P.y, attacking: false, hitDone: true, attackTime: 0, cd: 0.1 + Math.random() * 0.4
            }, { k: 2 * I / N }));
        }
    }

        // Boss 詛咒。開無敵時時限停在 5 秒，不然時限到了 die 會每幀被叫一次
        const Fight = Game.fight;
        if (Fight) {
            if (Cfg.BossNoCurse) {
                Fight.poison = false;
                Fight.confuse = false;
            }
            if (Cfg.God) Fight.timeLeft = Math.max(Fight.timeLeft, Math.min(Fight.limit, 5));
        }
 
        // 寶箱
        if (Game.chests) {
            if (!Game.arena) {
                if (Cfg.ChestRate > 1) Game.chestTimer -= Dt * (Cfg.ChestRate - 1);
                // 原版場上滿 2 個就不刷，上限調高時由這裡補刷 (計時器照樣由原版重設)
                if (Cfg.ChestMax > 2 && Game.chestTimer - Dt <= 0 && Game.chests.length >= 2 && Game.chests.length < Cfg.ChestMax && Has("spawnChest")) window.spawnChest();
            }
            if (Cfg.AutoChest && Has("openChest")) for (let I = Game.chests.length - 1; I >= 0; I--) window.openChest(I);
        }
 
        // 塔盾、分身
        if (Cfg.KeepShield && "shieldT" in P) P.shieldT = Math.max(P.shieldT, 5); // 3 秒以下會開始閃爍
        if (Game.clones) {
            if (Cfg.KeepClones && Has("spawnClones")) KeepClones(Game);
            ResizeClones(Game, Math.max(1, Math.min(12, Math.round(Cfg.CloneCount))));
        }

const SALT = "dr::7f3a91c2e8b04d65::v2";
export function saveSignature(json) {
  let h1 = 0xdeadbeef, h2 = 0x41c6ce57;
  const s = SALT + json + SALT;
  for (let i = 0; i < s.length; i++) {
    const c = s.charCodeAt(i);
    h1 = Math.imul(h1 ^ c, 2654435761);
    h2 = Math.imul(h2 ^ c, 1597334677);
  }
  h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^ Math.imul(h2 ^ (h2 >>> 13), 3266489909);
  h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^ Math.imul(h1 ^ (h1 >>> 13), 3266489909);
  return ((h2 & 0x1fffff) * 4294967296 + (h1 >>> 0)).toString(36);
}