chuanqi/cq2_sdk/scripts/bruteforce_sig.py

"""Brute-force the exact HMAC input format by trying variants.

Takes ONE captured request (session 762 — smallest body) and tries dozens
of combinations: url with/without scheme, body with/without trailing newline,
token placement, deviceType value, etc. Prints any MATCH.
"""
import hashlib
import hmac
import json
import re
from pathlib import Path
from urllib.parse import unquote, urlparse

SAZ_RAW = Path(r"C:\Users\ADMINI~1\AppData\Local\Temp\opencode\saz_dec\raw")
SID = "762"  # riskCheck: small clean body
KEY = "BB0AAAC906FC4B7CADB116A213D46689"
UA = "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) 996Box/5.1.1 Chrome/108.0.5359.215 Electron/22.3.4 Safari/537.36"
DEVICE_ID = "00:15:5d:0a:04:00"

raw = (SAZ_RAW / f"{SID}_c.txt").read_bytes().decode("utf-8", errors="replace")
first = raw.split("\n", 1)[0]
method, full_url = re.match(r"(GET|POST)\s+(\S+)", first).groups()
auth = re.search(r"NONCE=([^;]+);TIMESTAMP=(\d+);SIGNATURE=([0-9a-f]+)", raw)
NONCE, TS, EXPECTED = auth.group(1), auth.group(2), auth.group(3)
token_m = re.search(r"^token:\s*(\S+)", raw, re.MULTILINE)
TOKEN = token_m.group(1) if token_m else ""
sep = "\r\n\r\n" if "\r\n\r\n" in raw else "\n\n"
WIRE_BODY = raw.split(sep, 1)[1].strip() if sep in raw else ""

print(f"target sig: {EXPECTED}")
print(f"body: {WIRE_BODY[:200]}")
print()

parsed = urlparse(full_url)
path_with_qs = parsed.path + ("?" + parsed.query if parsed.query else "")

# Body variants
body_variants = {
    "wire_body": WIRE_BODY,
    "wire_body_trailing_nl": WIRE_BODY + "\n",
    "parsed_json_compact": None,
    "empty": "",
    "none": None,
}
try:
    d = json.loads(WIRE_BODY)
    body_variants["parsed_json_compact"] = json.dumps(d, separators=(",", ":"))
except Exception:
    pass

url_variants = {
    "full": full_url,
    "path_qs": path_with_qs,
    "path_only": parsed.path,
}

token_variants = {"real": TOKEN, "empty": ""}

results = []
for uname, url in url_variants.items():
    for bname, body in body_variants.items():
        for tname, tok in token_variants.items():
            for devtype in ("pc", "PC", "windows"):
                lines = [method, url, TS, NONCE, devtype, DEVICE_ID, "5.1.1.9007", tok, UA]
                if body is None:
                    lines.append("")
                else:
                    lines.append(body)
                for joiner_tail in ("\n",):
                    value = "\n".join(lines) + joiner_tail
                    sig = hmac.new(KEY.encode(), value.encode(), hashlib.sha256).hexdigest()
                    if sig == EXPECTED:
                        results.append((uname, bname, tname, devtype, "FOUND", value))
                        print(f"*** MATCH: url={uname} body={bname} token={tname} devtype={devtype}")
                        print(f"value repr:\n{repr(value)}")

if not results:
    print("no match in variant space; try body-order or UA differences")
    # extra: maybe UA differs? try box-agent header value
    print("Expected:", EXPECTED)