From 8f40299adc47f144547818ad8c3ef290c7466dd7 Mon Sep 17 00:00:00 2001 From: Pari Malam Date: Mon, 15 Jun 2026 19:22:35 +0800 Subject: [PATCH] released :P --- API.md | 115 ++++++++++++++++++++++++++++++++++++++++++++++++++++ RE.md | 119 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ README.md | 95 +++++++++++++++++++++++++++++++++++++------ 3 files changed, 316 insertions(+), 13 deletions(-) create mode 100644 API.md create mode 100644 RE.md diff --git a/API.md b/API.md new file mode 100644 index 0000000..317d380 --- /dev/null +++ b/API.md @@ -0,0 +1,115 @@ +# REST API Reference + +All API endpoints are served from the web UI port. Authentication uses a JWT token passed via the `o11-token` localStorage key or `?token=` query parameter. + +## Authentication + +| Method | Endpoint | Description | +|--------|----------|-------------| +| POST | `/api/login` | Login with username/password, returns JWT token | +| POST | `/account/login` | Account login (provider script account) | +| POST | `/account/pairstart` | Start device pairing flow | +| POST | `/account/pairinput` | Submit pairing input | +| GET | `/account/pairstatus` | Check pairing status | +| POST | `/account/pairstop` | Stop pairing flow | + +## Providers + +| Method | Endpoint | Description | +|--------|----------|-------------| +| GET | `/providers` | List all providers | +| GET | `/provider/get` | Get provider details | +| POST | `/provider/add` | Add a new provider | +| POST | `/provider/edit` | Edit provider configuration | +| POST | `/provider/delete` | Delete a provider | +| POST | `/provider/import` | Import provider config | +| GET | `/provider/export` | Export provider config | +| GET | `/provider/exportkeys` | Export decryption keys | +| GET | `/provider/exportmanifestandkeys` | Export manifest + keys | +| POST | `/provider/pushkeys` | Push decryption keys to streams | +| POST | `/provider/rescan` | Rescan provider scripts | +| POST | `/provider/backup` | Backup provider data | +| POST | `/provider/cachelogos` | Cache provider logos | +| POST | `/provider/massupdate` | Bulk update providers | +| GET | `/provider/config` | Get provider configuration | + +## Accounts + +| Method | Endpoint | Description | +|--------|----------|-------------| +| GET | `/account/get` | Get account details | +| POST | `/account/add` | Add a script account | +| POST | `/account/edit` | Edit account | +| POST | `/account/disableall` | Disable all accounts | + +## Streams + +| Method | Endpoint | Description | +|--------|----------|-------------| +| GET | `/stream/status` | Get all stream statuses | +| GET | `/stream/get` | Get stream details | +| POST | `/stream/start` | Start a stream | +| POST | `/stream/add` | Add a new stream | +| POST | `/stream/refresh` | Refresh stream | +| POST | `/stream/refreshkeys` | Refresh decryption keys | +| POST | `/stream/flushkeys` | Flush key cache | +| POST | `/stream/stoprefresh` | Stop refreshing a stream | + +## EPG + +| Method | Endpoint | Description | +|--------|----------|-------------| +| GET | `/epg` | EPG overview | +| GET | `/epg/:provider?/:stream?` | EPG for specific provider/stream | +| GET | `/epg/get` | Get EPG data | +| POST | `/epg/refresh` | Trigger EPG refresh | +| POST | `/epg/refreshapply` | Refresh and apply EPG | + +## Events & Recordings + +| Method | Endpoint | Description | +|--------|----------|-------------| +| GET | `/events/:provider?` | List events for provider | +| GET | `/recordings/:provider?` | List recordings for provider | +| POST | `/recording/add` | Schedule a recording | +| POST | `/recording/edit` | Edit a recording | +| POST | `/recording/delete` | Delete a recording | +| POST | `/recording/stop` | Stop an active recording | +| GET | `/recording/get` | Get recording details | +| POST | `/replay/delete` | Delete a replay | + +## Users & Servers + +| Method | Endpoint | Description | +|--------|----------|-------------| +| GET | `/users` | List all users | +| POST | `/user/add` | Add a new user | +| POST | `/user/edit` | Edit user | +| POST | `/user/delete` | Delete user | +| GET | `/user/get` | Get user details | +| GET | `/servers` | List remote servers | +| POST | `/server/add` | Add a remote server | + +## Jobs + +| Method | Endpoint | Description | +|--------|----------|-------------| +| GET | `/jobs` | List all jobs | +| POST | `/job/add` | Add a job | +| POST | `/job/edit` | Edit a job | +| POST | `/job/delete` | Delete a job | +| POST | `/job/run` | Run a job | + +## System + +| Method | Endpoint | Description | +|--------|----------|-------------| +| GET | `/config` | Get server configuration | +| GET | `/bootstrap` | Bootstrap/init data for UI | +| GET | `/logos` | List available logos | +| GET | `/logos/:name` | Get logo image | +| POST | `/log/clean` | Clean old logs | +| GET | `/log/export` | Export logs | +| GET | `/search` | Search across streams | +| POST | `/refreshrequest` | Request data refresh | +| POST | `/shutdown` | Shutdown the server | diff --git a/RE.md b/RE.md new file mode 100644 index 0000000..e765e3f --- /dev/null +++ b/RE.md @@ -0,0 +1,119 @@ +# Reverse Engineering + +## Frontend Deobfuscation Analysis + +The web UI JavaScript (`resources/index-BX-yLeHZ.js`) is obfuscated using **obfuscator.io** with the following techniques: + +### Obfuscation Method +- **String Array**: 6,922 encoded strings stored in `o11_0xf6cf()` array +- **Decoder Function**: `o11_0x3b01(index)` — performs base64 decode followed by RC4 decryption +- **Control Flow Flattening**: All string references replaced with `o11_0x3b01(0xHEX)` calls +- **Dead Code Injection**: Anti-debug traps with `debugger` statements and `parseInt` chains +- **Self-Defending**: Checksum validation that crashes if the code is modified + +### Deobfuscated Vue Components + +| Component | Purpose | +|-----------|---------| +| `LoginView` | Authentication page | +| `ProvidersView` | Provider list and management | +| `LinearView` | Live stream channel grid | +| `EventsView` | Scheduled event streams | +| `VodView` | Video-on-demand browser | +| `RecordingsView` | Recording scheduler and manager | +| `MonitoringView` | Real-time stream monitoring | +| `LogsView` | Log viewer | +| `UsersView` | User administration | +| `ServerView` | Remote server management | +| `ConfigView` | Provider configuration | +| `StreamPlayer` | HLS.js embedded video player | +| `Mp4VideoPlayer` | MP4 playback for VOD downloads | +| `DropdownProviderSelector` | Provider dropdown filter | +| `StreamTypeSelector` | Stream type filter (linear/event/VOD) | +| `EpgTimezoneSelector` | EPG timezone picker | +| `DropdownTrackSelector` | Audio/subtitle track selector | +| `ItemProvider` | Provider list item | +| `ItemProviderAccount` | Script account item | +| `ItemStream` | Stream list item | +| `ItemStreamCompact` | Compact stream row | +| `ItemStreamConfig` | Stream configuration editor | +| `ItemEpg` | EPG program entry | +| `ItemVod` | VOD title entry | +| `ItemJob` | Scheduled job entry | +| `ItemServer` | Remote server entry | +| `ItemUser` | User management entry | +| `ItemMonitoring` | Monitoring status card | +| `ItemTableStreams` | Stream data table row | +| `ItemTableEpg` | EPG data table row | +| `ItemTableEvent` | Event data table row | +| `ItemTableRecording` | Recording data table row | +| `CheckBoxConfig` | Toggle config option | +| `ButtonDanger` | Destructive action button | +| `ButtonText` | Text-style action button | +| `ConfirmationModal` | Confirm dialog | +| `InformationModal` | Info dialog | +| `ServerInfoModal` | Server details dialog | +| `ServerSelector` | Remote server picker | + +### Deobfuscated Config Sections + +| Section ID | Purpose | +|------------|---------| +| `config-page` | Main config page | +| `config-script` | Provider script settings | +| `config-script-accounts` | Script account management | +| `config-update-channels` | Channel update/refresh settings | +| `config-epg-timezone` | EPG timezone configuration | +| `config-network-parameters` | Network/proxy settings | +| `config-additional-parameters` | Extra provider parameters | +| `config-stream-config` | Stream type and output mode | +| `config-stream-options` | Stream start/stop options | +| `config-manifest-script` | Manifest download script | +| `config-cdm-script` | CDM/DRM script settings | +| `config-modal-cdm-mode` | CDM mode selector | +| `config-modal-cdm-type` | CDM type selector | +| `config-events-channels-script` | Events/channels script settings | +| `config-channels` | Channel list editor | +| `config-hw-accel` | Hardware acceleration toggle | + +### Provider JSON Schema (Deobfuscated) + +```json +{ + "ManifestUrl": "", + "Cdn": [ + { + "Name": "akamai", + "ManifestUrl": "http://..." + } + ], + "Headers": { + "manifest": { + "user-agent": "mozilla/5.0 ...", + "custom-header": "value" + }, + "media": { + "user-agent": "mozilla/5.0 ...", + "custom-header": "value" + } + }, + "Heartbeat": { + "Url": "", + "Params": ["param1", "param2"], + "PeriodMs": 300000 + } +} +``` + +--- + +## TODO + +- [ ] Full deobfuscation of `resources/index-BX-yLeHZ.js` — replace all `o11_0x3b01(0xHEX)` calls with decoded string literals for readability +- [ ] Reconstruct Vue SFC components from the flattened render functions +- [ ] Map all API endpoint handlers to their backend Go functions +- [ ] Reverse engineer the Go backend API handler routing logic +- [ ] Deobfuscate and document the provider script Python API (`scripts/o11.py`) +- [ ] Extract and analyze embedded Go symbol names (obfuscated with `ha4dhe`, `ijo4VwtOa`, etc.) +- [ ] Document the CDM integration flow (Widevine/PlayReady/Verimatrix) +- [ ] Analyze the internal remuxer pipeline (HLS → FMP4 conversion) diff --git a/README.md b/README.md index b03b571..4fee334 100644 --- a/README.md +++ b/README.md @@ -4,6 +4,19 @@ --- +## Tech Stack + +| Layer | Technology | Details | +|-------|-----------|---------| +| **Backend** | **Golang** (Go) | ELF64 binary, CGo-linked (`libc`, `libpthread`, `libresolv`), statically compiled runtime with dynamic libc linking | +| **Frontend** | **Vue.js 3** | Composition API, `