"""Decode the .dat launch config (session 755, 62 bytes) + urlCreator.jsc strings. The .dat is likely the launch-parameter template cq.exe consumes.""" import gzip import json from pathlib import Path import brotli def decode_response_bytes(path: Path) -> bytes: raw = path.read_bytes() idx = raw.find(b"\r\n\r\n") head = raw[:idx].decode("latin1") body = raw[idx + 4 :] enc = "br" if "Content-Encoding: br" in head else ("gzip" if "gzip" in head else "") chunked = "chunked" in head if chunked: out = b"" rest = body while rest: le = rest.find(b"\r\n") if le < 0: break try: sz = int(rest[:le].split(b";")[0], 16) except ValueError: break if sz == 0: break out += rest[le + 2 : le + 2 + sz] rest = rest[le + 2 + sz + 2 :] body = out if enc == "br": body = brotli.decompress(body) elif enc == "gzip": body = gzip.decompress(body) return body raw_dir = Path(r"C:\Users\ADMINI~1\AppData\Local\Temp\opencode\saz_dec\raw") # 1. the .dat file (session 755) print("=== session 755: 20260804_cq.dat (62B) ===") dat = decode_response_bytes(raw_dir / "755_s.txt") print(f" raw hex: {dat.hex()}") print(f" raw repr: {dat!r}") try: print(f" as text: {dat.decode('utf-8')}") j = json.loads(dat) print(f" as json: {json.dumps(j, indent=2)}") except Exception: pass # try xxtea with the known key print() print("=== try XXTEA-decrypt the .dat ===") import struct import sys sys.path.insert(0, ".") from cq2_sdk.utils.encoding import encode6bit # noqa # maybe it's encoded with Encode6BitBuf try: dec = encode6bit(dat) print(f" encode6bit: {dec[:80]}") except Exception as e: print(f" encode6bit err: {e}") # simple XOR/reverse checks print(f" reversed hex: {dat[::-1].hex()}") print(f" as int32s: {list(struct.unpack('<' + 'i' * (len(dat) // 4), dat[:len(dat) // 4 * 4]))}") # 2. urlCreator.jsc strings print() print("=== urlCreator.jsc extractable strings ===") jsc = Path(r"C:\Users\ADMINI~1\AppData\Local\Temp\opencode\asar2\src\libs\urlCreator.jsc") if jsc.exists(): data = jsc.read_bytes() import re for m in re.finditer(rb"[\x20-\x7e]{4,80}", data): print(f" {m.group().decode('ascii')}") else: print(" urlCreator.jsc missing")