released :P

2026-07-16 02:34:23 +02:00 · 2026-06-15 19:27:01 +08:00
parent bdfb40b130
commit d5e3b0a38a
3 changed files with 9 additions and 0 deletions
@@ -0,0 +1,115 @@
+# REST API Reference
+
+All API endpoints are served from the web UI port. Authentication uses a JWT token passed via the `o11-token` localStorage key or `?token=` query parameter.
+
+## Authentication
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| POST | `/api/login` | Login with username/password, returns JWT token |
+| POST | `/account/login` | Account login (provider script account) |
+| POST | `/account/pairstart` | Start device pairing flow |
+| POST | `/account/pairinput` | Submit pairing input |
+| GET | `/account/pairstatus` | Check pairing status |
+| POST | `/account/pairstop` | Stop pairing flow |
+
+## Providers
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| GET | `/providers` | List all providers |
+| GET | `/provider/get` | Get provider details |
+| POST | `/provider/add` | Add a new provider |
+| POST | `/provider/edit` | Edit provider configuration |
+| POST | `/provider/delete` | Delete a provider |
+| POST | `/provider/import` | Import provider config |
+| GET | `/provider/export` | Export provider config |
+| GET | `/provider/exportkeys` | Export decryption keys |
+| GET | `/provider/exportmanifestandkeys` | Export manifest + keys |
+| POST | `/provider/pushkeys` | Push decryption keys to streams |
+| POST | `/provider/rescan` | Rescan provider scripts |
+| POST | `/provider/backup` | Backup provider data |
+| POST | `/provider/cachelogos` | Cache provider logos |
+| POST | `/provider/massupdate` | Bulk update providers |
+| GET | `/provider/config` | Get provider configuration |
+
+## Accounts
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| GET | `/account/get` | Get account details |
+| POST | `/account/add` | Add a script account |
+| POST | `/account/edit` | Edit account |
+| POST | `/account/disableall` | Disable all accounts |
+
+## Streams
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| GET | `/stream/status` | Get all stream statuses |
+| GET | `/stream/get` | Get stream details |
+| POST | `/stream/start` | Start a stream |
+| POST | `/stream/add` | Add a new stream |
+| POST | `/stream/refresh` | Refresh stream |
+| POST | `/stream/refreshkeys` | Refresh decryption keys |
+| POST | `/stream/flushkeys` | Flush key cache |
+| POST | `/stream/stoprefresh` | Stop refreshing a stream |
+
+## EPG
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| GET | `/epg` | EPG overview |
+| GET | `/epg/:provider?/:stream?` | EPG for specific provider/stream |
+| GET | `/epg/get` | Get EPG data |
+| POST | `/epg/refresh` | Trigger EPG refresh |
+| POST | `/epg/refreshapply` | Refresh and apply EPG |
+
+## Events & Recordings
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| GET | `/events/:provider?` | List events for provider |
+| GET | `/recordings/:provider?` | List recordings for provider |
+| POST | `/recording/add` | Schedule a recording |
+| POST | `/recording/edit` | Edit a recording |
+| POST | `/recording/delete` | Delete a recording |
+| POST | `/recording/stop` | Stop an active recording |
+| GET | `/recording/get` | Get recording details |
+| POST | `/replay/delete` | Delete a replay |
+
+## Users & Servers
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| GET | `/users` | List all users |
+| POST | `/user/add` | Add a new user |
+| POST | `/user/edit` | Edit user |
+| POST | `/user/delete` | Delete user |
+| GET | `/user/get` | Get user details |
+| GET | `/servers` | List remote servers |
+| POST | `/server/add` | Add a remote server |
+
+## Jobs
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| GET | `/jobs` | List all jobs |
+| POST | `/job/add` | Add a job |
+| POST | `/job/edit` | Edit a job |
+| POST | `/job/delete` | Delete a job |
+| POST | `/job/run` | Run a job |
+
+## System
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| GET | `/config` | Get server configuration |
+| GET | `/bootstrap` | Bootstrap/init data for UI |
+| GET | `/logos` | List available logos |
+| GET | `/logos/:name` | Get logo image |
+| POST | `/log/clean` | Clean old logs |
+| GET | `/log/export` | Export logs |
+| GET | `/search` | Search across streams |
+| POST | `/refreshrequest` | Request data refresh |
+| POST | `/shutdown` | Shutdown the server |
@@ -0,0 +1,119 @@
+# Reverse Engineering
+
+## Frontend Deobfuscation Analysis
+
+The web UI JavaScript (`resources/index-BX-yLeHZ.js`) is obfuscated using **obfuscator.io** with the following techniques:
+
+### Obfuscation Method
+- **String Array**: 6,922 encoded strings stored in `o11_0xf6cf()` array
+- **Decoder Function**: `o11_0x3b01(index)` — performs base64 decode followed by RC4 decryption
+- **Control Flow Flattening**: All string references replaced with `o11_0x3b01(0xHEX)` calls
+- **Dead Code Injection**: Anti-debug traps with `debugger` statements and `parseInt` chains
+- **Self-Defending**: Checksum validation that crashes if the code is modified
+
+### Deobfuscated Vue Components
+
+| Component | Purpose |
+|-----------|---------|
+| `LoginView` | Authentication page |
+| `ProvidersView` | Provider list and management |
+| `LinearView` | Live stream channel grid |
+| `EventsView` | Scheduled event streams |
+| `VodView` | Video-on-demand browser |
+| `RecordingsView` | Recording scheduler and manager |
+| `MonitoringView` | Real-time stream monitoring |
+| `LogsView` | Log viewer |
+| `UsersView` | User administration |
+| `ServerView` | Remote server management |
+| `ConfigView` | Provider configuration |
+| `StreamPlayer` | HLS.js embedded video player |
+| `Mp4VideoPlayer` | MP4 playback for VOD downloads |
+| `DropdownProviderSelector` | Provider dropdown filter |
+| `StreamTypeSelector` | Stream type filter (linear/event/VOD) |
+| `EpgTimezoneSelector` | EPG timezone picker |
+| `DropdownTrackSelector` | Audio/subtitle track selector |
+| `ItemProvider` | Provider list item |
+| `ItemProviderAccount` | Script account item |
+| `ItemStream` | Stream list item |
+| `ItemStreamCompact` | Compact stream row |
+| `ItemStreamConfig` | Stream configuration editor |
+| `ItemEpg` | EPG program entry |
+| `ItemVod` | VOD title entry |
+| `ItemJob` | Scheduled job entry |
+| `ItemServer` | Remote server entry |
+| `ItemUser` | User management entry |
+| `ItemMonitoring` | Monitoring status card |
+| `ItemTableStreams` | Stream data table row |
+| `ItemTableEpg` | EPG data table row |
+| `ItemTableEvent` | Event data table row |
+| `ItemTableRecording` | Recording data table row |
+| `CheckBoxConfig` | Toggle config option |
+| `ButtonDanger` | Destructive action button |
+| `ButtonText` | Text-style action button |
+| `ConfirmationModal` | Confirm dialog |
+| `InformationModal` | Info dialog |
+| `ServerInfoModal` | Server details dialog |
+| `ServerSelector` | Remote server picker |
+
+### Deobfuscated Config Sections
+
+| Section ID | Purpose |
+|------------|---------|
+| `config-page` | Main config page |
+| `config-script` | Provider script settings |
+| `config-script-accounts` | Script account management |
+| `config-update-channels` | Channel update/refresh settings |
+| `config-epg-timezone` | EPG timezone configuration |
+| `config-network-parameters` | Network/proxy settings |
+| `config-additional-parameters` | Extra provider parameters |
+| `config-stream-config` | Stream type and output mode |
+| `config-stream-options` | Stream start/stop options |
+| `config-manifest-script` | Manifest download script |
+| `config-cdm-script` | CDM/DRM script settings |
+| `config-modal-cdm-mode` | CDM mode selector |
+| `config-modal-cdm-type` | CDM type selector |
+| `config-events-channels-script` | Events/channels script settings |
+| `config-channels` | Channel list editor |
+| `config-hw-accel` | Hardware acceleration toggle |
+
+### Provider JSON Schema (Deobfuscated)
+
+```json
+{
+  "ManifestUrl": "<manifest url>",
+  "Cdn": [
+    {
+      "Name": "akamai",
+      "ManifestUrl": "http://..."
+    }
+  ],
+  "Headers": {
+    "manifest": {
+      "user-agent": "mozilla/5.0 ...",
+      "custom-header": "value"
+    },
+    "media": {
+      "user-agent": "mozilla/5.0 ...",
+      "custom-header": "value"
+    }
+  },
+  "Heartbeat": {
+    "Url": "<heartbeat url>",
+    "Params": ["param1", "param2"],
+    "PeriodMs": 300000
+  }
+}
+```
+
+---
+
+## TODO
+
+- [ ] Full deobfuscation of `resources/index-BX-yLeHZ.js` — replace all `o11_0x3b01(0xHEX)` calls with decoded string literals for readability
+- [ ] Reconstruct Vue SFC components from the flattened render functions
+- [ ] Map all API endpoint handlers to their backend Go functions
+- [ ] Reverse engineer the Go backend API handler routing logic
+- [ ] Deobfuscate and document the provider script Python API (`scripts/o11.py`)
+- [ ] Extract and analyze embedded Go symbol names (obfuscated with `ha4dhe`, `ijo4VwtOa`, etc.)
+- [ ] Document the CDM integration flow (Widevine/PlayReady/Verimatrix)
+- [ ] Analyze the internal remuxer pipeline (HLS → FMP4 conversion)