First public commit

.gitattributes

@@ -0,0 +1,52 @@
+# Default: detect text, store LF, check out LF.
+* text=auto eol=lf
+
+# Explicit text types (defense in depth over the auto detector).
+*.rs            text eol=lf diff=rust
+*.toml          text eol=lf diff=toml
+*.lock          text eol=lf -diff
+*.md            text eol=lf diff=markdown linguist-detectable
+*.yml           text eol=lf
+*.yaml          text eol=lf
+*.json          text eol=lf
+*.js            text eol=lf
+*.css           text eol=lf diff=css
+*.html          text eol=lf diff=html
+*.svg           text eol=lf
+*.txt           text eol=lf
+.gitignore      text eol=lf
+.gitattributes  text eol=lf
+LICENSE         text eol=lf
+
+# Shell scripts must stay LF even on Windows checkouts.
+*.sh            text eol=lf
+
+# Windows-native scripts.
+*.bat           text eol=crlf
+*.cmd           text eol=crlf
+*.ps1           text eol=crlf
+
+# Binaries — never subject to line-ending conversion.
+*.exe           binary
+*.dll           binary
+*.sys           binary
+*.pdb           binary
+*.wasm          binary
+*.png           binary
+*.jpg           binary
+*.jpeg          binary
+*.gif           binary
+*.ico           binary
+*.woff          binary
+*.woff2         binary
+*.ttf           binary
+*.otf           binary
+*.eot           binary
+*.zip           binary
+*.7z            binary
+*.gz            binary
+*.xz            binary
+*.dat           binary
+
+# wasm-pack output is generated.
+web/pkg/**      linguist-generated=true

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,48 @@
+name: Bug report
+description: Report a file that fails to unpack, unpacks incorrectly, or crashes senbei
+title: "[Bug]: "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. Attaching the protected input file helps us
+        better diagnose the issue. Please only attach files you are
+        authorized to share.
+  - type: textarea
+    id: symptom
+    attributes:
+      label: What happened?
+      description: The command you ran and the output/error you got. Use -v/--verbose and paste the stage log if unpacking failed midway.
+      placeholder: "senbei app.exe -> error: ..."
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect?
+      placeholder: "A runnable unpacked image at unpack\\app.unpack.exe"
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Senbei version
+      description: Output of `senbei -V`
+    validations:
+      required: true
+  - type: textarea
+    id: fileinfo
+    attributes:
+      label: About the input file
+      description: |
+        Without attaching it: is it an EXE or DLL? 32-bit or 64-bit? Managed
+        (.NET) or native? Roughly how large? Does it have a `._` companion
+        file next to it?
+  - type: checkboxes
+    id: legal
+    attributes:
+      label: Confirmation
+      options:
+        - label: I am authorized to analyze and share the attached file(s), and I understand attachments are removed after investigation.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,25 @@
+name: Feature request
+description: Suggest an improvement or support for a new layout
+title: "[Feature]: "
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        For a new Crackproof layout, attaching a sample protected file helps
+        us better understand the request. Please only attach files you are
+        authorized to share.
+  - type: textarea
+    id: idea
+    attributes:
+      label: What would you like?
+      description: The problem it solves for you, and any layout details you can share.
+    validations:
+      required: true
+  - type: checkboxes
+    id: legal
+    attributes:
+      label: Confirmation
+      options:
+        - label: This request is for lawful research/interoperability use, and I am authorized to share any file I attach.
+          required: true

.github/workflows/ci.yml

@@ -0,0 +1,99 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  fmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: cargo fmt --all -- --check
+
+  clippy:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: cargo clippy --all-targets -- -D warnings
+
+  test:
+    # The test suite exercises Windows path semantics, so it runs on Windows.
+    # The golden corpus (samples/) is user-managed and absent on CI; the
+    # samples test is a no-op pass there by design.
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: cargo test --release
+
+  check-portable:
+    # Build-only portability gate: non-Windows host and the wasm target the
+    # web build uses. Clippy runs here too, not just on Windows: the platform
+    # `cfg` branches (the POSIX `localtime_r` path, the non-Windows stubs) are
+    # invisible to the Windows clippy job, so without this they are never
+    # linted at all.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: cargo clippy --all-targets -- -D warnings
+      - run: cargo check --target wasm32-unknown-unknown
+
+  cli:
+    strategy:
+      matrix:
+        include:
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            bin: senbei.exe
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            bin: senbei
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - run: cargo build --release --locked
+      - name: Package senbei-<version>-<target>
+        shell: bash
+        run: |
+          set -euo pipefail
+          version=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2)
+          name="senbei-$version-${{ matrix.target }}"
+          mkdir -p "stage/$name"
+          cp "target/release/${{ matrix.bin }}" "stage/$name/"
+          cp LICENSE "stage/$name/"
+          awk '/^## Legal notice and intended use/{f=1} f && /^## / && !/Legal notice/{exit} f' \
+            README.md > "stage/$name/LEGAL-NOTICE.md"
+          echo "package=$name" >> "$GITHUB_ENV"
+      # upload-artifact always wraps the upload in its own zip, so the staged
+      # directory is uploaded loose — pre-compressing here would nest archives.
+      # The download is already <package>.zip with the folder inside.
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ env.package }}
+          path: stage/
+          retention-days: 14
+
+  web:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: cargo install wasm-pack --locked
+      # `-- --locked` forwards to cargo: web/Cargo.lock is committed on
+      # purpose, so the wasm build must be pinned by it rather than silently
+      # re-resolving (which is how it drifted out of sync with the manifest).
+      - run: wasm-pack build --target web --release -- --locked
+        working-directory: web
+      - uses: actions/upload-artifact@v4
+        with:
+          name: senbei-web
+          path: |
+            web/index.html
+            web/app.js
+            web/worker.js
+            web/style.css
+            web/pkg/
+          retention-days: 14

.github/workflows/release.yml

@@ -0,0 +1,79 @@
+name: Release
+
+# Publishing a GitHub release:
+#  - cli-assets builds the Windows and Linux CLI binaries and attaches
+#    senbei-<version>-<target>.zip (binary + LICENSE + the legal
+#    notice extracted from README.md) to the release.
+#  - deploy-web rebuilds the browser app and pushes it to Cloudflare Pages
+#    (https://senbei.pages.dev). Requires two repository secrets:
+#    CLOUDFLARE_API_TOKEN (Pages:Edit) and CLOUDFLARE_ACCOUNT_ID. The Pages
+#    project is `senbei`; direct-upload projects default to `main` as the
+#    production branch, which `--branch=main` targets.
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  cli-assets:
+    permissions:
+      contents: write # attach assets to the release
+    strategy:
+      matrix:
+        include:
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            bin: senbei.exe
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            bin: senbei
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - run: cargo build --release --locked
+      - name: Package senbei-<version>-<target>
+        shell: bash
+        run: |
+          set -euo pipefail
+          version=$(grep -m1 '^version' Cargo.toml | cut -d'"' -f2)
+          name="senbei-$version-${{ matrix.target }}"
+          mkdir -p "stage/$name"
+          cp "target/release/${{ matrix.bin }}" "stage/$name/"
+          cp LICENSE "stage/$name/"
+          awk '/^## Legal notice and intended use/{f=1} f && /^## / && !/Legal notice/{exit} f' \
+            README.md > "stage/$name/LEGAL-NOTICE.md"
+          # Release assets are served as-is (unlike CI artifacts, which the
+          # upload action always re-zips), so the archive is created here.
+          # Zip on every OS, matching the CI artifacts; 7z is preinstalled on
+          # both windows-latest and ubuntu-latest.
+          (cd stage && 7z a "$name.zip" "$name" > /dev/null)
+          echo "package=$name" >> "$GITHUB_ENV"
+      - name: Attach to release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release upload "${{ github.event.release.tag_name }}" "stage/${{ env.package }}".* --clobber
+
+  deploy-web:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: cargo install wasm-pack --locked
+      # `-- --locked` forwards to cargo: web/Cargo.lock is committed on
+      # purpose, so the wasm build must be pinned by it rather than silently
+      # re-resolving (which is how it drifted out of sync with the manifest).
+      - run: wasm-pack build --target web --release -- --locked
+        working-directory: web
+      - name: Stage static site
+        run: |
+          mkdir dist
+          cp web/index.html web/app.js web/worker.js web/style.css dist/
+          cp -r web/pkg dist/pkg
+      - uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          command: pages deploy dist --project-name=senbei --branch=main

.gitignore

@@ -0,0 +1,158 @@
+### Intellij ###
+# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
+# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
+
+# User-specific stuff
+.idea/**/workspace.xml
+.idea/**/tasks.xml
+.idea/**/usage.statistics.xml
+.idea/**/dictionaries
+.idea/**/shelf
+
+# AWS User-specific
+.idea/**/aws.xml
+
+# Generated files
+.idea/**/contentModel.xml
+
+# Sensitive or high-churn files
+.idea/**/dataSources/
+.idea/**/dataSources.ids
+.idea/**/dataSources.local.xml
+.idea/**/sqlDataSources.xml
+.idea/**/dynamic.xml
+.idea/**/uiDesigner.xml
+.idea/**/dbnavigator.xml
+
+# Gradle
+.idea/**/gradle.xml
+.idea/**/libraries
+
+# Gradle and Maven with auto-import
+# When using Gradle or Maven with auto-import, you should exclude module files,
+# since they will be recreated, and may cause churn.  Uncomment if using
+# auto-import.
+# .idea/artifacts
+# .idea/compiler.xml
+# .idea/jarRepositories.xml
+# .idea/modules.xml
+# .idea/*.iml
+# .idea/modules
+# *.iml
+# *.ipr
+
+# CMake
+cmake-build-*/
+
+# Mongo Explorer plugin
+.idea/**/mongoSettings.xml
+
+# File-based project format
+*.iws
+
+# IntelliJ
+out/
+
+# mpeltonen/sbt-idea plugin
+.idea_modules/
+
+# JIRA plugin
+atlassian-ide-plugin.xml
+
+# Cursive Clojure plugin
+.idea/replstate.xml
+
+# SonarLint plugin
+.idea/sonarlint/
+
+# Crashlytics plugin (for Android Studio and IntelliJ)
+com_crashlytics_export_strings.xml
+crashlytics.properties
+crashlytics-build.properties
+fabric.properties
+
+# Editor-based Rest Client
+.idea/httpRequests
+
+# Android studio 3.1+ serialized cache file
+.idea/caches/build_file_checksums.ser
+
+### Intellij Patch ###
+# Comment Reason: https://github.com/joeblau/gitignore.io/issues/186#issuecomment-215987721
+
+# *.iml
+# modules.xml
+# .idea/misc.xml
+# *.ipr
+
+# Sonarlint plugin
+# https://plugins.jetbrains.com/plugin/7973-sonarlint
+.idea/**/sonarlint/
+
+# SonarQube Plugin
+# https://plugins.jetbrains.com/plugin/7238-sonarqube-community-plugin
+.idea/**/sonarIssues.xml
+
+# Markdown Navigator plugin
+# https://plugins.jetbrains.com/plugin/7896-markdown-navigator-enhanced
+.idea/**/markdown-navigator.xml
+.idea/**/markdown-navigator-enh.xml
+.idea/**/markdown-navigator/
+
+# Cache file creation bug
+# See https://youtrack.jetbrains.com/issue/JBR-2257
+.idea/$CACHE_FILE$
+
+# CodeStream plugin
+# https://plugins.jetbrains.com/plugin/12206-codestream
+.idea/codestream.xml
+
+# Azure Toolkit for IntelliJ plugin
+# https://plugins.jetbrains.com/plugin/8053-azure-toolkit-for-intellij
+.idea/**/azureSettings.xml
+
+### Rust ###
+# Generated by Cargo
+# will have compiled files and executables
+debug/
+target/
+
+# Cargo.lock is committed on purpose: senbei is a binary, and CI builds with
+# --locked (web/Cargo.lock likewise, for the wasm build).
+
+# These are backup files generated by rustfmt
+**/*.rs.bk
+
+# MSVC Windows builds of rustc generate these, which store debugging information
+*.pdb
+
+### VisualStudioCode ###
+.vscode/*
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json
+!.vscode/*.code-snippets
+
+# Local History for Visual Studio Code
+.history/
+
+# Built Visual Studio Code Extensions
+*.vsix
+
+### VisualStudioCode Patch ###
+# Ignore all local history of files
+.history
+.ionide
+
+### senbei test corpus ###
+# The samples folder holds local-only Crackproof binaries; only its README is
+# tracked. Ignore the folder's contents (not the folder itself, or git won't
+# descend into it to find the re-included README). See senbei/samples/README.md.
+/samples/*
+!/samples/README.md
+
+### senbei web build ###
+/web/pkg/
+/web/target/
+/web/.playwright-cli

AGENTS.md

@@ -0,0 +1,79 @@
+# AGENTS.md
+
+Guidance for AI coding agents (and human contributors) working in this repo.
+
+## Project
+
+Senbei is a static unpacker for Crackproof-protected PE files: a pure,
+panic-free, no-I/O unpacker core (`src/unpacker/`) plus a thin CLI shell
+(`src/`), an il2cpp metadata de-obfuscator (`src/metadata.rs`), and a
+WebAssembly browser frontend (`web/`). Read `docs/design.md` first.
+
+## Commands
+
+```cmd
+cargo build --release            :: CLI
+cargo test --release             :: full suite (golden corpus: samples/, git-ignored)
+cargo clippy --all-targets -- -D warnings
+cargo fmt --all
+cd web && wasm-pack build --target web --release   :: browser build
+```
+
+The `samples/` corpus is user-managed and absent on CI; without it the
+samples test is a no-op pass. `SENBEI_REQUIRE_SAMPLES=1` makes an absent
+corpus fail (use this on a private CI that *does* have the corpus). Do not
+delete `samples/` with `rm -rf` — it may be a junction; use git
+worktree-aware cleanup.
+
+## Hard rules
+
+- **The unpacker core stays pure**: no file I/O, no `unsafe`, no panics across
+  the public boundary, no platform-specific code. It must keep compiling to
+  `wasm32-unknown-unknown` (`cargo check --target wasm32-unknown-unknown`).
+- **`catch_unwind` does not work on wasm** (the prebuilt std can't unwind; a
+  caught panic becomes a fatal `unreachable` trap). Native code may rely on
+  `catch_unpack`, but any routing decision must also work without a catchable
+  panic: spliced companion inputs route straight to the EXE pipeline, and the
+  web app isolates every unpack in a disposable Web Worker, retrying trapped
+  DLLs with `job::unpack_bytes_force_exe`. Never make correctness on wasm
+  depend on catching a panic.
+- **Byte-identical output is the contract.** Any pipeline change must re-run
+  the full golden corpus; a byte mismatch on any golden is a regression.
+- **Trial-and-validate, never trust a heuristic.** A silently wrong offset
+  produces a silently broken binary — worse than an error. Every layout
+  candidate must be validated (checksum / structural oracle) with fall-through
+  to the next candidate.
+- **Determinism under parallelism.** Block fan-out must stay byte-identical
+  regardless of thread count (`SENBEI_THREADS=1` is the sequential reference).
+- **Folder scanning: deny-list, never allow-list.** Targets are recognised by
+  content, not extension, and can carry arbitrary names — there is no closed
+  set of target extensions an allow-list could enumerate. Only known
+  bulk-asset formats are excluded.
+- **No binaries in the repo** — not as fixtures, not in commits. The only
+  corpus is the local git-ignored `samples/`. (Issue attachments of
+  protected inputs are fine when the user is authorized to share them, but
+  never commit them.)
+
+## Public-repo hygiene (important)
+
+This is a public research repository. In code comments, docs, tests, and
+commit messages:
+
+- **Never name specific games, publishers, or product codenames.** Refer to
+  build families generically ("older EXE-64 builds", "the marker-less
+  layout", "external-companion builds"). Keep offsets/numbers — drop names.
+- **Never name specific protected filenames** from real distributions. Test
+  fixtures use generic names (`app.exe`, `managed.dll`, `daemon.exe`).
+  Exceptions (platform-standard technology names, allowed): `il2cpp`,
+  `Unity`, `global-metadata.dat`, the Crackproof magic `KONN`.
+- **Never reference other tools, projects, implementations, or paths outside
+  this repo.** Describe behavior and layout directly; do not mention prior
+  art, porting, or where any algorithm came from.
+
+## Conventions
+
+- Comments explain *why* (layout rationale, observed variants, failure modes),
+  not *what*.
+- Rust 2024 edition; clippy-clean at `-D warnings`; rustfmt default style.
+- CLI behavior (flags, exit codes, output naming) is documented in
+  `docs/usage.md` — update the doc when changing behavior.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

Cargo.lock

@@ -0,0 +1,494 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "console"
+version = "0.16.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fe5f465a4f6fee88fad41b85d990f84c835335e85b5d9e6e63e0d06d28cba7c"
+dependencies = [
+ "encode_unicode",
+ "libc",
+ "unicode-width",
+ "windows-sys",
+]
+
+[[package]]
+name = "encode_unicode"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "futures-core"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
+
+[[package]]
+name = "futures-task"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
+
+[[package]]
+name = "futures-util"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+]
+
+[[package]]
+name = "indicatif"
+version = "0.18.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9433806cd6b4ec1aba79c021c7e4c58fb4c3b9977c085062e611ac929998fb0c"
+dependencies = [
+ "console",
+ "portable-atomic",
+ "unicode-width",
+ "unit-prefix",
+ "web-time",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "owo-colors"
+version = "4.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "portable-atomic"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "senbei"
+version = "1.0.0"
+dependencies = [
+ "anyhow",
+ "indicatif",
+ "libc",
+ "owo-colors",
+ "tempfile",
+ "thiserror",
+ "walkdir",
+ "windows",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom",
+ "once_cell",
+ "rustix",
+ "windows-sys",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "unit-prefix"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81e544489bf3d8ef66c953931f56617f423cd4b5494be343d9b9d3dda037b9a3"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "windows"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
+dependencies = [
+ "windows-collections",
+ "windows-core",
+ "windows-future",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
+dependencies = [
+ "windows-core",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
+dependencies = [
+ "windows-core",
+ "windows-link",
+ "windows-threading",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-numerics"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
+dependencies = [
+ "windows-core",
+ "windows-link",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
+dependencies = [
+ "windows-link",
+]

Cargo.toml

@@ -0,0 +1,42 @@
+[package]
+name = "senbei"
+version = "1.0.0"
+edition = "2024"
+description = "Static unpacker for Crackproof-protected PE files"
+license = "AGPL-3.0-only"
+keywords = ["unpacker", "reverse-engineering", "pe", "security-research"]
+categories = ["command-line-utilities"]
+
+[lib]
+name = "senbei"
+path = "src/lib.rs"
+
+[[bin]]
+name = "senbei"
+path = "src/main.rs"
+
+[dependencies]
+anyhow = "1"
+thiserror = "2"
+walkdir = "2"
+indicatif = "0.18"
+owo-colors = "4"
+
+[target.'cfg(windows)'.dependencies]
+windows = { version = "0.62", features = [
+    "Win32_Foundation",
+    "Win32_System_Console",
+    "Win32_System_SystemInformation",
+] }
+
+[target.'cfg(all(not(windows), not(target_arch = "wasm32")))'.dependencies]
+libc = "0.2"
+
+[dev-dependencies]
+tempfile = "3"
+
+[profile.release]
+opt-level = 3
+lto = true
+codegen-units = 1
+strip = true

LICENSE

@@ -0,0 +1,662 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published
+    by the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
+

README.md

@@ -0,0 +1,77 @@
+# Senbei
+
+A static unpacker for Crackproof-protected 64-bit and 32-bit PE files. Point it
+at a file or a folder and it writes decrypted copies — no launch of the
+protected program, no kernel driver, no code runs out of the protected binary.
+
+> _"Crackproof"? It's senbei (煎餅 — rice cracker). Cracks itself._
+
+Senbei reads a protected `.exe` or `.dll`, replays the unpacking algorithm
+entirely in memory, and writes the recovered image to a new file. The core is a
+pure, panic-free library with no file I/O; the CLI wraps it with scanning, a
+progress bar, and a run log. A browser version (WebAssembly, fully client-side)
+lives in [`web/`](web/).
+
+## Legal notice and intended use
+
+**Read this before using Senbei.**
+
+- Senbei is a research and interoperability tool. It exists to enable lawful
+  reverse engineering, security research, preservation, and interoperability
+  with software you already legitimately possess.
+- **Only process binaries you own or are explicitly authorized to analyze.**
+  Depending on your jurisdiction and license agreements, circumventing
+  technological protection measures may be restricted (for example under
+  DMCA §1201 in the United States, which contains exemptions for security
+  research and interoperability). It is your responsibility to ensure your use
+  is lawful.
+- Senbei does not bypass any access control for you: it performs a purely
+  static transformation of a file already on your disk. It derives everything
+  it needs from the input file itself, contains no vendor code or secrets, and
+  distributes no keys, cracks, or copyrighted content.
+- Senbei does not enable online play, license fraud, or cheating, and must not
+  be used to redistribute decrypted binaries. Do not upload outputs anywhere.
+- The authors provide this software "as is", without warranty of any kind, and
+  accept no liability for misuse. See [LICENSE](LICENSE) (AGPL-3.0).
+- "Crackproof" is a trademark of its respective owner; this project is not
+  affiliated with or endorsed by the protection vendor or any software
+  publisher. Names are used for identification only.
+
+## What it handles
+
+| Kind | Description |
+| --- | --- |
+| `Exe` | Crackproof-protected executable (PE32+ and PE32). |
+| `NativeDll` | Protected native (unmanaged) DLL. |
+| `ManagedDll` | Protected .NET assembly (has a CLR data directory). |
+| `._` companion | Stub + external encrypted payload layout, spliced automatically. |
+| `global-metadata.dat` | il2cpp metadata with obfuscated method tokens, de-obfuscated in place. |
+
+Detection is content-based (header key-table at offset 4096, magic `KONN`),
+not extension-based. Anything unrecognized is left untouched.
+
+## Quick start
+
+```cmd
+cargo build --release
+
+senbei protected.exe
+:: -> unpack\protected.unpack.exe
+
+senbei "C:\Games\MyGame"
+:: -> C:\Games\MyGame\unpack\...  (recursive, skips non-targets)
+```
+
+Every output is sanity-checked statically; structurally broken results are
+flagged as suspect rather than silently trusted.
+
+## Documentation
+
+- [Usage reference](docs/usage.md) — CLI flags, exit codes, integrity check
+- [Design](docs/design.md) — architecture, routing, and error model
+- [Development](docs/development.md) — building, testing, environment variables
+- [Web version](web/README.md) — run Senbei in a browser
+
+## License
+
+[GNU Affero General Public License v3.0](LICENSE) (AGPL-3.0-only).

docs/design.md

@@ -0,0 +1,137 @@
+# Design
+
+Senbei is a fully static unpacker: it replays the unpacking algorithm on the
+file bytes in memory and writes the recovered PE image. No code from the
+protected binary is ever executed, no process is launched or attached to, and
+no driver or proxy DLL is involved.
+
+## Crate layout
+
+The crate is split into a pure core and a thin CLI shell:
+
+- **`src/unpacker/`** — the core. Pure functions over byte slices: no file
+  I/O, no environment access (beyond a few debugging overrides, see
+  [development.md](development.md)), panic-free at the public boundary (all
+  internal panics are trapped and converted to `UnpackError::Corrupt`). This
+  is what the WebAssembly build embeds.
+- **`src/` (top level)** — the CLI shell: argument parsing, recursive folder
+  scanning, per-run log file, progress bar, Explorer-friendly exit pause, and
+  the single-file/folder orchestration in `job.rs`.
+- **`src/metadata.rs`** — il2cpp `global-metadata.dat` method-token
+  de-obfuscation (format version 31; other versions are left untouched).
+
+```
+src/
+├── main.rs                argument parsing + dispatch
+├── lib.rs                 module roots
+├── job.rs                 single-file + folder orchestration, out-naming,
+│                          companion splice, stub overlay/TLS restore,
+│                          pipeline routing (incl. the wasm-safe byte API)
+├── scan.rs                recursive Crackproof + metadata discovery
+├── metadata.rs            il2cpp global-metadata.dat de-obfuscation
+├── logfile.rs             per-run timestamped log
+├── ui.rs                  progress bar + status lines
+├── pause.rs               Explorer-friendly exit pause
+└── unpacker/              pure, panic-free, no-I/O core
+    ├── mod.rs             detection + unpack_auto dispatch
+    ├── exe.rs             EXE pipeline (PE32+ and PE32)
+    ├── dll.rs             native + managed DLL pipeline
+    ├── integrity.rs       static post-unpack sanity check
+    ├── primitives.rs      decrypt_data* steps, key/shift selection
+    ├── bytecode.rs        bytecode VM
+    ├── parallel.rs        deterministic block-parallel fan-out
+    ├── tables.rs          constant tables
+    └── crc32.rs           checksum
+```
+
+## Detection and routing
+
+Detection is content-based (`unpacker::detect`), never extension-based: the
+key table is derived from the file header and checked against the format
+magic, then the PE characteristics classify the input as EXE, native DLL, or
+managed DLL.
+
+`unpack_auto` then dispatches:
+
+- `Exe` → the EXE pipeline (handles both PE32+ and PE32).
+- `NativeDll` / `ManagedDll` → the DLL pipeline first; on failure, the EXE
+  pipeline as a fallback. Two DLL layouts exist in the wild: an older layout
+  the DLL pipeline parses, and a newer one that protects DLLs with the
+  EXE-style shell layout instead. The DLL-first order keeps old-layout outputs
+  byte-identical (the EXE pipeline also "succeeds" on old-layout DLLs but
+  produces different bytes); the fallback handles the new layout (including
+  the managed-DLL .NET metadata restore).
+
+One routing shortcut bypasses `unpack_auto`: inputs spliced from an external
+companion (`job.rs`, both the CLI and the wasm byte API) go **straight to the
+EXE pipeline**. The companion layout is definitionally the EXE-style shell,
+so the DLL probe can never be right for it — and the probe's rejection of
+EXE-shell DLLs relies on a caught panic, which is a fatal trap on targets
+without unwinding (WebAssembly). Output bytes are identical to the
+probe-then-fallback route.
+
+## External-companion inputs
+
+Some builds split a protected module into an on-disk loader stub plus an
+encrypted `._` companion. When a `<name>._` sibling matches the stub's header
+region, `job.rs` splices the two before unpacking and afterwards overlays the
+export table and TLS directory from the stub — pieces the encrypted companion
+does not carry. All overlay steps are best-effort no-ops when their inputs
+can't be mapped, so a malformed stub can never corrupt an otherwise-good
+unpack.
+
+## Pipelines
+
+Both pipelines are **heuristic with trial-and-validate**: where a layout
+leaves ambiguity (e.g. which block is the real file decryptor, or a page-XOR
+shift), the pipeline tries candidates and validates the result structurally
+(an entry-stub oracle, checksum stamps, cluster stamps) instead of trusting
+the first match. A validation failure falls through to the next candidate
+rather than producing silently wrong output.
+
+Several protected stages are themselves little bytecode programs. The core
+includes a small VM (`bytecode.rs`) that generates and interprets those
+programs rather than hardcoding each variant's constants.
+
+## Integrity check
+
+Every produced image passes through `integrity::check` — a static, execution-
+free sanity check that only flags defects impossible in a correctly unpacked
+image (malformed headers, unmapped/non-executable/all-zero/all-int3 entry
+point, a native DLL with no base-relocation directory, any import descriptor
+whose DLL name is still ciphertext, a managed image whose COR20 header or BSJB
+metadata did not survive). See [usage.md](usage.md#integrity-check).
+A clean report is not a proof of correctness; a non-clean report is a reliable
+"broken" signal.
+
+## Parallelism
+
+Section decrypt/decompress blocks write disjoint output spans and read only
+immutable input plus snapshotted key tables, so `parallel.rs` fans them out
+across worker threads with **byte-identical** output regardless of thread
+count. There is no `unsafe`: the buffer is carved with safe `split_at_mut`
+chains so the borrow checker proves spans never alias. Overlapping spans (only
+possible on corrupt input) degrade to the sequential whole-buffer pass,
+preserving the deterministic last-writer-wins behavior of the serial
+pipeline. `SENBEI_THREADS=1` forces the sequential path; on targets without
+threads (WebAssembly) the sequential path is used automatically.
+
+## Error model
+
+The public API never panics: every pipeline runs under a `catch_unwind`
+wrapper (`catch_unpack`) that converts a trapped panic to
+`UnpackError::Corrupt`, with the default panic hook transiently suppressed.
+Size requests are bounds-checked against a 1 GiB `MAX_IMAGE_SIZE` before
+allocation so a crafted header cannot abort the process with a huge
+allocation. In folder mode each file is isolated: one file's failure is logged
+and counted, never fatal to the run.
+
+**WebAssembly caveat:** the prebuilt wasm std cannot unwind, so a caught
+panic becomes a fatal `unreachable` trap there. The DLL-routing probe relies
+on this mechanism to reject EXE-shell-layout DLLs, so the web build routes
+around it instead of through it: spliced companion inputs skip the probe
+entirely (see "Detection and routing"), and the web app isolates every unpack
+in a disposable Web Worker — a trapped DLL is retried once in a fresh worker
+with the forced-EXE pipeline (`job::unpack_bytes_force_exe`), reproducing the
+probe-then-fallback outcome without a catchable panic. A trap on any other
+input is reported as a clean error rather than freezing the page.

docs/development.md

@@ -0,0 +1,116 @@
+# Development
+
+## Building
+
+Requires a Rust toolchain (MSVC backend is the default on Windows;
+`rustup-init.exe` from <https://rustup.rs> installs it). The pinned toolchain
+and targets are in `rust-toolchain.toml`.
+
+```cmd
+cargo build --release
+```
+
+Output: `target\release\senbei.exe`. The binary is self-contained — no driver,
+no proxy DLL, no external assets.
+
+The library and CLI also build for Linux/macOS (`cfg`-gated platform code
+only) and for `wasm32-unknown-unknown` (see the [web version](../web/README.md)).
+
+## Testing
+
+```cmd
+cargo test --release
+```
+
+The suite covers CLI behavior, detection, the folder driver, the run log, and
+byte-exact golden tests over `samples/` — a user-managed corpus (git-ignored,
+see `samples/README.md`) of real Crackproof inputs plus `<base>.golden.<ext>`
+reference outputs. Every input goes through `job::unpack_bytes` — the same
+routing the CLI uses, so an `<input>._` companion in the corpus is spliced and
+the stub export/TLS overlays run — and is gated on **two** checks: the static
+integrity check (catches runtime-broken outputs even when a stale golden would
+still byte-match) and, when a golden exists, a bit-for-bit comparison. il2cpp
+`*.dat` inputs are routed through `metadata::deobfuscate` instead. An empty or
+absent corpus is a no-op pass; set `SENBEI_REQUIRE_SAMPLES` to make it fail
+instead (useful on a private CI that has the corpus — public CI never does,
+since binaries are not committed).
+
+> **Note:** goldens encode expected *bytes*, not runtime behavior. A golden
+> produced before a pipeline fix may byte-match while still being wrong — the
+> integrity check is the second gate for exactly this reason. Re-verify
+> goldens against real runs when touching the affected pipeline stages.
+>
+> **The corpus only protects what it contains.** Wire the test to the routing
+> the CLI actually takes (it is), and keep a sample for every layout family —
+> marker-based, marker-less, external-companion, PE32, PE32+, native, managed,
+> metadata. An unrepresented family has no regression gate at all, which is
+> how a "re-run the golden corpus" rule can pass while silently covering
+> nothing.
+
+## Debugging levers (environment variables)
+
+- `DD8_SHIFT` — override the `decrypt_data8` page-XOR shift (`99` skips dd8
+  entirely).
+- `SEL_DIAG` — print the dd8 selector's scores: the per-shift `0xCC` counts and
+  the plaintext baseline they are compared against (PE32+), and the per-formula
+  counts, baseline and net gain (PE32).
+- `SENBEI_THREADS` — cap the block-parallel fan-out (`1` forces the fully
+  sequential path).
+- `SENBEI_SCAN_ALL` — same as `--scan-all` (probe every file in a folder).
+
+## Conventions
+
+- The `src/unpacker/` core is pure: no file I/O, no panics across the public
+  boundary, no `unsafe`. Keep it that way — it is what the WebAssembly build
+  embeds.
+- Layout heuristics must **trial-and-validate**: never pick a candidate offset
+  on shape alone and trust it; validate by decryption/checksum and fall
+  through to the next candidate on failure. A silent wrong offset produces a
+  silently broken output, which is worse than an error.
+- Output must remain byte-identical against the golden corpus for every
+  supported layout. When fixing one build family, re-run the full golden
+  corpus to prove no other family regressed.
+- Folder scanning uses a size floor plus an extension **deny**-list, never an
+  allow-list: targets are recognised by content, not extension, and can carry
+  arbitrary names, so only known bulk-asset extensions are excluded. The
+  pre-filter exists because folder-scan cost is per-file I/O latency, not the
+  walk — probe fewer files, don't parallelize the probe loop.
+- `cargo fmt` and `cargo clippy` must stay clean (CI enforces both).
+
+## Repository layout
+
+```
+senbei/
+├── Cargo.toml                 senbei lib + bin package
+├── rust-toolchain.toml        pinned toolchain + targets
+├── src/                       CLI shell + pure unpacker core (see docs/design.md)
+├── tests/                     CLI, detection, golden, and folder tests
+├── samples/                   local-only test corpus (git-ignored)
+├── web/                       WebAssembly browser build
+├── docs/                      usage, design, and development documentation
+└── .github/                   CI workflows and issue templates
+```
+
+## Web build
+
+See [web/README.md](../web/README.md). In short:
+
+```cmd
+cd web
+wasm-pack build --target web --release
+```
+
+then serve `web/` statically and open `index.html`. Everything runs
+client-side; no file leaves the browser.
+
+## Contributing
+
+Issues and pull requests are welcome. A few ground rules:
+
+- **Never commit binaries** (protected or decrypted) to the repository —
+  the only corpus is the local git-ignored `samples/`. Attaching a protected
+  input file to an issue is welcome if it helps diagnose the problem; only
+  attach files you are authorized to share.
+- Run `cargo test --release`, `cargo clippy`, and `cargo fmt` before
+  submitting.
+- Keep the unpacker core free of I/O, `unsafe`, and platform-specific code.

docs/usage.md

@@ -0,0 +1,126 @@
+# Usage
+
+```
+senbei <file|folder> [--out DIR] [-v|--verbose] [-q|--quiet]... [--scan-all]
+                     [--no-log] [--no-pause] [-V|--version] [-h|--help]
+```
+
+Real runs print `Senbei <version>` once at start. Use `-V` / `--version` to
+print the version and exit.
+
+## Single file
+
+The decrypted image is written under `<parent>/unpack/` with `.unpack` inserted
+before the extension. A `senbei-<timestamp>.log` is written in the same
+directory. With `--out DIR`, both the output and the log go into `DIR` instead:
+
+```cmd
+senbei app.exe
+:: -> unpack\app.unpack.exe
+:: -> unpack\senbei-YYYYMMDD-HHMMSS.log
+
+senbei app.exe --out C:\out
+:: -> C:\out\app.unpack.exe
+:: -> C:\out\senbei-YYYYMMDD-HHMMSS.log
+```
+
+Pointing senbei directly at an il2cpp `global-metadata.dat` rewrites its
+obfuscated method tokens back to the contiguous per-module range il2cpp
+expects; the output is `global-metadata.unpack.dat`, written only when tokens
+actually changed. Only metadata format version 31 is rewritten; other versions
+are reported and left untouched.
+
+## Folder mode
+
+Senbei walks the directory recursively, skips any subdirectory literally named
+`unpack`, and unpacks every file it recognises as Crackproof-protected (by
+content, not extension — renamed files and `.bak` backups are still found).
+Results land under `<root>/unpack/` (or `--out DIR`), mirroring the input
+tree's relative paths. The run log is written **in that same out directory**:
+
+```cmd
+senbei "C:\Games\MyGame"
+:: -> C:\Games\MyGame\unpack\...
+:: -> C:\Games\MyGame\unpack\senbei-YYYYMMDD-HHMMSS.log
+```
+
+Folder mode also picks up `global-metadata.dat` files and external-companion
+`._` payloads: a module whose `<name>._` sibling matches its header region is
+spliced with the companion automatically (no flag needed) and unpacked as one
+image, with the output named for the stub.
+
+Each file is processed in isolation: an error or panic on one file is caught,
+counted, and logged, and the run continues. Folder mode finishes with a summary
+line, then duration:
+
+```
+12 unpacked · 3 skipped · 0 errors · 1 suspect · 2 metadata
+done in 1234 ms
+```
+
+## Integrity check
+
+A successful unpack is not always a runnable one: a layout heuristic can pick
+the wrong offset and leave the entry-point stub or import strings encrypted, so
+the pipeline reports success but the OS loader faults at runtime (typically
+`0xC0000005`, STATUS_ACCESS_VIOLATION). To catch this, senbei runs a static
+sanity check over every output it produces — inspecting the bytes alone, with
+no reference image and no execution.
+
+It flags only defects that cannot occur in a correctly unpacked image:
+
+- malformed DOS/PE headers, bad optional-header magic, implausible section
+  count, zero `SizeOfImage`, or section raw-data ranges that run past EOF;
+- an entry point that doesn't map into a section, isn't in an executable
+  section, or whose stub is all zeros or all `0xCC` int3 padding (the classic
+  left-encrypted symptom);
+- a native (unmanaged) DLL with no base-relocation directory — it cannot
+  survive being mapped at a non-preferred base;
+- **any** import descriptor whose DLL name doesn't resolve or isn't readable
+  ASCII (imports left encrypted) — the whole table is walked, not just the
+  first entry;
+- for a managed assembly, a COR20 header whose `cb` isn't `0x48` or a
+  MetaData stream missing its `BSJB` signature (the CLR would reject the
+  image outright).
+
+The entry-point and import checks are skipped for managed assemblies, whose
+native EP and import stub are legitimately not what the native loader expects.
+
+The check is deliberately conservative: a clean report is **not** a proof of
+correctness, but a non-clean report is a reliable "this is broken" signal. A
+suspect file is still written (the bytes are the best available) and flagged —
+single-file mode prints a warning to stderr, folder mode prints a yellow `!`
+line, adds a `SUSPECT` entry to the run log, and counts it in the summary's
+`suspect` total (which is additive to `unpacked`).
+
+## Flags
+
+| Flag | Behavior |
+| --- | --- |
+| `--out DIR` | Write outputs (and the log, unless `--no-log`) under `DIR`. |
+| `-v`, `--verbose` | Print detailed `[N/9]` per-stage unpack progress (and the destination path) for each file. In folder mode this replaces the progress bar. |
+| `-q`, `--quiet` | Once: hide progress bar and per-file lines; keep banner, summary, and duration. Twice (`-q -q`): suppress all stdio (exit code only). |
+| `--no-log` | Do not write `senbei-*.log`. Console output is unchanged by this flag alone. |
+| `--scan-all` | Probe every file in a folder, including ones the scan pre-filter skips (under 4128 bytes, or a bulk-asset extension like `.ab`/`.xml`/`.acb`). Much slower on large game trees; finds the same targets in practice. |
+| `--no-pause` | Skip the "Press Enter to exit" prompt (for scripted runs). |
+| `-V`, `--version` | Print `Senbei <version>` and exit. |
+| `-h`, `--help` | Show usage. |
+
+On Windows, when launched from Explorer (the process owns its console) senbei
+pauses for Enter before exiting so the window doesn't vanish. `--no-pause`
+disables this; it has no effect when stdout is piped or run from another
+process.
+
+## Exit codes
+
+| Code | Meaning |
+| --- | --- |
+| `0` | Success (single file unpacked, or folder run with no errors). |
+| `1` | At least one file failed, a scan probe was unreadable, or a single-file unpack errored. |
+| `2` | Usage error: no path given, unknown option, missing `--out` value, or multiple input paths (help printed). |
+
+A folder run also fails with `1` when parts of the tree could not be scanned
+(unreadable directory entries or files that failed the content probe) — those
+are potential missed targets, not clean skips. An il2cpp metadata blob whose
+format version senbei does not handle is *not* an error: it is reported, left
+untouched, and counted as skipped.

rust-toolchain.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "stable"
+targets = ["x86_64-pc-windows-msvc", "wasm32-unknown-unknown"]

samples/README.md

@@ -0,0 +1,84 @@
+# senbei/samples
+
+Drop-in corpus for the `samples` integration test (`tests/samples.rs`).
+
+This folder is **git-ignored** (only this `README.md` is tracked), so it holds
+whatever Crackproof binaries happen to be on your machine. Nothing here is
+committed.
+
+## What to put here
+
+Place protected inputs directly in this folder:
+
+- `*.exe` — Crackproof-protected executables (PE32 or PE32+)
+- `*.dll` — Crackproof-protected DLLs (native or managed)
+- `*.dat` — il2cpp `global-metadata.dat` blobs (method-token de-obfuscation)
+
+For an **external-companion** module, copy the `<name>._` payload in as well,
+keeping the exact `._` suffix on the full file name. The test splices it the
+same way the CLI does; without it the loader stub alone is meaningless and the
+splice / export-overlay / TLS-restore code is never exercised.
+
+Optionally, place a **golden** next to each input — the known-good unpacked
+output, named `<base>.golden.<ext>`:
+
+```
+samples/
+  app.exe                   <- input
+  app.golden.exe            <- golden (optional)
+  managed.dll               <- input
+  managed.golden.dll        <- golden (optional)
+  stub.dll                  <- input  (external-companion layout)
+  stub.dll._                <- its encrypted payload  (NOT an input itself)
+  stub.golden.dll           <- golden
+  global-metadata.dat       <- input
+  global-metadata.golden.dat<- golden
+  mystery.exe               <- input, no golden
+```
+
+The type (EXE vs native/managed DLL vs metadata) is auto-detected from the file
+contents, not the extension, so you don't need to classify anything by hand.
+
+Since the corpus is the only regression gate on byte-identical output, keep it
+broad: each build family, each layout (marker-based and marker-less), and at
+least one external-companion pair. A family with no sample here is a family no
+test protects.
+
+## How the test treats each input
+
+Run with:
+
+```
+cargo test --release --test samples
+```
+
+For every input file, the test runs the same routing the CLI uses
+(`job::unpack_bytes`, so companions splice and the stub overlays run) — or
+`metadata::deobfuscate` for an il2cpp blob — and then:
+
+| Situation                                   | Result                          |
+| ------------------------------------------- | ------------------------------- |
+| Golden present, bytes **identical**         | **pass**                        |
+| Golden present, bytes **differ**            | **fail** (test fails)           |
+| **No golden** found                         | **warning** (needs manual check)|
+| Unpack errored / file unreadable            | **fail**                        |
+
+Warnings are printed but do not fail the test — they flag outputs you should
+eyeball or promote to a golden once verified. Failures fail the test. An empty
+or absent folder is a no-op pass.
+
+To see the per-file warning/pass/fail summary, run with output shown:
+
+```
+cargo test --release --test samples -- --nocapture
+```
+
+## Naming rules
+
+- An **input** is any `*.exe` / `*.dll` / `*.dat` whose name does **not**
+  contain the `.golden.` segment.
+- A **golden** is `<base>.golden.<ext>` sitting next to its input. Files with
+  `.golden.` in the name are never treated as inputs.
+- A **companion** is `<input file name>._` (e.g. `stub.dll._` for `stub.dll`).
+  Its extension is `_`, so it is never picked up as an input of its own; it is
+  read only when its base module is processed.

src/lib.rs

@@ -0,0 +1,7 @@
+pub mod job;
+pub mod logfile;
+pub mod metadata;
+pub mod pause;
+pub mod scan;
+pub mod ui;
+pub mod unpacker;

src/logfile.rs

@@ -0,0 +1,148 @@
+use std::fs::File;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::sync::Mutex;
+
+pub struct Log {
+    path: PathBuf,
+    file: Mutex<File>,
+}
+
+impl Log {
+    pub fn create(dir: &Path) -> std::io::Result<Self> {
+        let ts = local_stamp_compact();
+        // The stamp has one-second granularity and `File::create` truncates, so
+        // two runs into the same out dir within a second would clobber each
+        // other's log. Probe for a free name with create_new instead.
+        let mut path = dir.join(format!("senbei-{ts}.log"));
+        let mut file = File::create_new(&path);
+        for n in 2..100 {
+            if !matches!(&file, Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists) {
+                break;
+            }
+            path = dir.join(format!("senbei-{ts}-{n}.log"));
+            file = File::create_new(&path);
+        }
+        let file = Mutex::new(file?);
+        Ok(Self { path, file })
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+
+    pub fn step(&self, msg: &str) {
+        if let Ok(mut f) = self.file.lock() {
+            let _ = writeln!(f, "{msg}");
+        }
+    }
+}
+
+/// Local wall-clock `YYYYMMDD-HHMMSS` for log filenames.
+pub fn local_stamp_compact() -> String {
+    let t = local_parts();
+    format!(
+        "{:04}{:02}{:02}-{:02}{:02}{:02}",
+        t.year, t.month, t.day, t.hour, t.minute, t.second
+    )
+}
+
+/// Local wall-clock `YYYY-MM-DD HH:MM:SS` for log header.
+pub fn local_stamp_display() -> String {
+    let t = local_parts();
+    format!(
+        "{:04}-{:02}-{:02} {:02}:{:02}:{:02}",
+        t.year, t.month, t.day, t.hour, t.minute, t.second
+    )
+}
+
+struct LocalParts {
+    year: u32,
+    month: u32,
+    day: u32,
+    hour: u32,
+    minute: u32,
+    second: u32,
+}
+
+fn local_parts() -> LocalParts {
+    #[cfg(windows)]
+    {
+        use windows::Win32::System::SystemInformation::GetLocalTime;
+        let st = unsafe { GetLocalTime() };
+        LocalParts {
+            year: st.wYear as u32,
+            month: st.wMonth as u32,
+            day: st.wDay as u32,
+            hour: st.wHour as u32,
+            minute: st.wMinute as u32,
+            second: st.wSecond as u32,
+        }
+    }
+    #[cfg(all(not(windows), not(target_arch = "wasm32")))]
+    {
+        // Local wall clock via POSIX localtime_r — same semantics as Windows GetLocalTime.
+        use std::time::{SystemTime, UNIX_EPOCH};
+        let secs_u = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_secs();
+        let t: libc::time_t = secs_u as libc::time_t;
+        let mut tm = unsafe { std::mem::zeroed::<libc::tm>() };
+        let ok = unsafe { libc::localtime_r(&t, &mut tm) };
+        if ok.is_null() {
+            return utc_parts(secs_u); // emergency only if localtime_r fails
+        }
+        LocalParts {
+            year: (tm.tm_year + 1900) as u32,
+            month: (tm.tm_mon + 1) as u32,
+            day: tm.tm_mday as u32,
+            hour: tm.tm_hour as u32,
+            minute: tm.tm_min as u32,
+            second: tm.tm_sec as u32,
+        }
+    }
+    #[cfg(all(not(windows), target_arch = "wasm32"))]
+    {
+        // wasm has no local timezone database and SystemTime::now() panics
+        // without a JS time source. The run log is a CLI concern — the wasm
+        // build never writes one — so a fixed epoch stamp suffices.
+        utc_parts(0)
+    }
+}
+
+/// Convert Unix UTC seconds to civil Y-M-D h:m:s (Howard Hinnant).
+/// Used as non-Windows fallback; keep pub(crate) if unit-tested.
+fn utc_parts(secs: u64) -> LocalParts {
+    let s = secs as i64;
+    let time_of_day = s.rem_euclid(86400) as u32;
+    let days = s.div_euclid(86400);
+    let z = days + 719468;
+    let era = if z >= 0 { z } else { z - 146096 } / 146097;
+    let doe = (z - era * 146097) as u32;
+    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;
+    let y = yoe as i64 + era * 400;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = doy - (153 * mp + 2) / 5 + 1;
+    let m = if mp < 10 { mp + 3 } else { mp - 9 };
+    let y = if m <= 2 { y + 1 } else { y };
+    LocalParts {
+        year: y as u32,
+        month: m,
+        day: d,
+        hour: time_of_day / 3600,
+        minute: (time_of_day % 3600) / 60,
+        second: time_of_day % 60,
+    }
+}
+
+/// UTC civil stamp helper (used only as emergency fallback path via `utc_parts`).
+#[allow(dead_code)] // retained for unit-style reuse / non-Windows emergency path symmetry
+pub(crate) fn fmt_stamp(secs: u64) -> String {
+    let t = utc_parts(secs);
+    format!(
+        "{:04}{:02}{:02}-{:02}{:02}{:02}",
+        t.year, t.month, t.day, t.hour, t.minute, t.second
+    )
+}

src/main.rs

@@ -0,0 +1,113 @@
+use senbei::{job, pause};
+use std::path::Path;
+
+fn main() -> std::process::ExitCode {
+    let mut args = std::env::args().skip(1);
+    let mut path: Option<String> = None;
+    let mut out: Option<String> = None;
+    let mut quiet: u8 = 0;
+    let mut no_pause = false;
+    let mut no_log = false;
+    let mut verbose = false;
+    let mut scan_all = false;
+
+    while let Some(a) = args.next() {
+        match a.as_str() {
+            "-h" | "--help" => {
+                print_help();
+                return std::process::ExitCode::SUCCESS;
+            }
+            "-V" | "--version" => {
+                println!("Senbei {}", env!("CARGO_PKG_VERSION"));
+                return std::process::ExitCode::SUCCESS;
+            }
+            "-q" | "--quiet" => quiet = quiet.saturating_add(1),
+            "-v" | "--verbose" => verbose = true,
+            "--no-pause" => no_pause = true,
+            "--no-log" => no_log = true,
+            "--scan-all" => scan_all = true,
+            "--out" => match args.next() {
+                // Reject a missing value (and a following flag swallowed as the
+                // value): previously `--out` at end of argv silently fell back
+                // to the default output directory.
+                Some(v) if !v.starts_with('-') => out = Some(v),
+                _ => {
+                    eprintln!("error: --out requires a directory argument");
+                    return std::process::ExitCode::from(2);
+                }
+            },
+            other if other.starts_with('-') => {
+                eprintln!("error: unknown option '{other}'");
+                print_help();
+                return std::process::ExitCode::from(2);
+            }
+            other => {
+                // Previously the last positional silently won.
+                if let Some(prev) = &path {
+                    eprintln!("error: multiple input paths given ('{prev}' and '{other}')");
+                    return std::process::ExitCode::from(2);
+                }
+                path = Some(other.to_string());
+            }
+        }
+    }
+
+    let code = match path {
+        None => {
+            print_help();
+            2
+        }
+        Some(p) => {
+            if quiet < 2 {
+                println!("Senbei {}", env!("CARGO_PKG_VERSION"));
+            }
+            let p = Path::new(&p);
+            let out_path = out.as_deref().map(Path::new);
+            let r = if p.is_dir() {
+                job::run_folder_opts(
+                    p,
+                    out_path,
+                    quiet,
+                    verbose,
+                    no_log,
+                    scan_all || senbei::scan::scan_all_env(),
+                )
+            } else {
+                job::run_file_v(p, out_path, quiet, verbose, no_log)
+            };
+            match r {
+                Ok(s) => {
+                    if quiet < 2 {
+                        println!(
+                            "{} unpacked · {} skipped · {} errors · {} suspect · {} metadata",
+                            s.unpacked, s.skipped, s.errors, s.suspect, s.metadata
+                        );
+                        println!("done in {} ms", s.duration_ms);
+                    }
+                    if s.errors > 0 { 1 } else { 0 }
+                }
+                Err(e) => {
+                    // Fatal: out-dir/log create, etc.
+                    if quiet < 2 {
+                        eprintln!("error: {e:#}");
+                    }
+                    1
+                }
+            }
+        }
+    };
+
+    pause::maybe_pause(no_pause);
+    std::process::ExitCode::from(code as u8)
+}
+
+fn print_help() {
+    println!(
+        "senbei <file|folder> [--out DIR] [-v|--verbose] [-q|--quiet]... [--scan-all] [--no-log] [--no-pause] [-V|--version] [-h|--help]"
+    );
+    println!(
+        "  --scan-all   probe every file in a folder, including ones the scan\n\
+         \x20              pre-filter skips (under 4128 bytes, or a bulk-asset\n\
+         \x20              extension like .ab/.xml/.acb). Much slower on game trees."
+    );
+}

src/metadata.rs

@@ -0,0 +1,348 @@
+//! il2cpp `global-metadata.dat` de-obfuscation.
+//!
+//! Crackproof's `-GMD` option obfuscates the **method-token** field of every
+//! `Il2CppMethodDefinition` in `global-metadata.dat`. il2cpp resolves a method's
+//! compiled function/invoker by indexing the per-module
+//! `Il2CppCodeGenModule.methodPointers` / `invokerIndices` tables — which are
+//! sized to the module's *compiled* method count — by `(token_row - 1)`. That
+//! only works when each module's method tokens are the **contiguous** range
+//! `1..=methodPointerCount`. `-GMD` replaces them with sparse, original-metadata-style
+//! tokens (e.g. mscorlib rows reach ~55k for only ~14k compiled methods) and the
+//! running game's Crackproof loader remaps them back at load time.
+//!
+//! A statically-unpacked il2cpp game assembly run without Crackproof reads the
+//! tokens raw, so `(token_row - 1)` runs off the end of those tables — an
+//! out-of-bounds read that crashes deep in il2cpp init (first hit:
+//! `System.Array`'s interface method setup). See the project notes for the full
+//! trace.
+//!
+//! This module reverses the obfuscation purely from the metadata's own
+//! structure. Methods are laid out grouped by type, and types grouped by image
+//! (module), so a method's correct token row is simply its position within its
+//! module's method range. We re-derive that range from the images/types tables
+//! and rewrite each method token to `0x06000000 | (local_index + 1)`.
+//!
+//! Only method tokens are touched: field tokens are already contiguous and type
+//! tokens resolve correctly. The transform is a no-op on an unobfuscated
+//! metadata (its tokens already equal `local_index + 1`), so it is safe to run on
+//! any il2cpp game — `remapped == 0` then reports that nothing changed.
+
+/// il2cpp `global-metadata.dat` sanity magic (`Il2CppGlobalMetadataHeader.sanity`).
+const MAGIC: u32 = 0xFAB1_1BAF;
+
+/// Metadata format version this de-obfuscator understands. The struct strides
+/// and header field offsets below are specific to it; other versions are left
+/// untouched rather than risk corrupting a layout we have not verified.
+/// (Observed on real games shipping version 31 / Unity 2022.3.)
+const SUPPORTED_VERSION: u32 = 31;
+
+// --- Il2CppGlobalMetadataHeader field byte-offsets (each is an i32 offset/size
+//     pair). Shared layout across recent versions. ---
+const HDR_METHODS: usize = 0x30; // methodsOffset / methodsSize
+const HDR_TYPES: usize = 0xA0; // typeDefinitionsOffset / size
+const HDR_IMAGES: usize = 0xA8; // imagesOffset / size
+
+// --- version-31 struct strides and field offsets ---
+const METHOD_STRIDE: usize = 0x24; // sizeof(Il2CppMethodDefinition)
+const METHOD_TOKEN_OFF: usize = 0x18; // .token (u32)
+const TYPE_STRIDE: usize = 0x58; // sizeof(Il2CppTypeDefinition)
+const TYPE_METHOD_START_OFF: usize = 0x24; // .methodStart (i32)
+const TYPE_METHOD_COUNT_OFF: usize = 0x40; // .method_count (u16)
+const IMAGE_STRIDE: usize = 0x28; // sizeof(Il2CppImageDefinition)
+const IMAGE_TYPE_START_OFF: usize = 0x08; // .typeStart (i32)
+const IMAGE_TYPE_COUNT_OFF: usize = 0x0C; // .typeCount (u32)
+
+/// `IMAGE_CODE_GEN_MODULE` method-definition token table id (`0x06 << 24`).
+const METHOD_TOKEN_TABLE: u32 = 0x0600_0000;
+/// `Il2Cpp*Index` "no value" sentinel (`kTypeIndexInvalid` etc.).
+const NO_METHODS: u32 = 0xFFFF_FFFF;
+
+/// Outcome of a successful [`deobfuscate`] pass.
+#[derive(Debug, Clone, Copy)]
+pub struct Report {
+    pub version: u32,
+    /// Total `Il2CppMethodDefinition` entries.
+    pub methods: usize,
+    /// Number of method tokens actually rewritten (0 ⇒ the input was already
+    /// de-obfuscated, i.e. not `-GMD`-protected).
+    pub remapped: usize,
+    /// Number of modules (images) that own at least one method.
+    pub modules: usize,
+}
+
+/// Why [`deobfuscate`] declined to process the input. None of these mutate the
+/// input; the caller leaves the file untouched.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Error {
+    /// Missing the il2cpp metadata sanity magic — not a `global-metadata.dat`.
+    NotMetadata,
+    /// Recognised metadata, but an unhandled format version.
+    UnsupportedVersion(u32),
+    /// Magic/version matched but the table layout is inconsistent with the
+    /// supported version (truncated, mis-sized, or overlapping ranges).
+    Malformed,
+}
+
+impl std::fmt::Display for Error {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Error::NotMetadata => write!(f, "not an il2cpp global-metadata.dat"),
+            Error::UnsupportedVersion(v) => write!(f, "unsupported metadata version {v}"),
+            Error::Malformed => write!(f, "malformed metadata for version {SUPPORTED_VERSION}"),
+        }
+    }
+}
+impl std::error::Error for Error {}
+
+/// Cheap check for the il2cpp metadata sanity magic, for scanning prefixes.
+pub fn is_metadata(data: &[u8]) -> bool {
+    rd_u32(data, 0) == Some(MAGIC)
+}
+
+/// De-obfuscate the method tokens in an il2cpp `global-metadata.dat`.
+///
+/// On success returns the (possibly-rewritten) file bytes and a [`Report`]. The
+/// transform is idempotent: a metadata that is already de-obfuscated comes back
+/// byte-identical with `report.remapped == 0`.
+pub fn deobfuscate(data: &[u8]) -> Result<(Vec<u8>, Report), Error> {
+    if rd_u32(data, 0) != Some(MAGIC) {
+        return Err(Error::NotMetadata);
+    }
+    let version = rd_u32(data, 4).ok_or(Error::Malformed)?;
+    if version != SUPPORTED_VERSION {
+        return Err(Error::UnsupportedVersion(version));
+    }
+
+    let (m_off, m_size) = table(data, HDR_METHODS)?;
+    let (t_off, t_size) = table(data, HDR_TYPES)?;
+    let (i_off, i_size) = table(data, HDR_IMAGES)?;
+
+    // The strides must divide their tables exactly and the tables must lie
+    // within the file: a mismatch means our version-31 layout is wrong for this
+    // file, so bail without touching it rather than scribble at bad offsets.
+    if m_size % METHOD_STRIDE != 0 || t_size % TYPE_STRIDE != 0 || i_size % IMAGE_STRIDE != 0 {
+        return Err(Error::Malformed);
+    }
+    let method_count = m_size / METHOD_STRIDE;
+    let type_count = t_size / TYPE_STRIDE;
+    let image_count = i_size / IMAGE_STRIDE;
+    if !fits(data, m_off, m_size) || !fits(data, t_off, t_size) || !fits(data, i_off, i_size) {
+        return Err(Error::Malformed);
+    }
+
+    // Map every method to its owning module and record each module's first
+    // (lowest) method index. A method's correct token row is its 1-based offset
+    // from that first index (methods are contiguous & grouped per module).
+    let mut module_of = vec![u32::MAX; method_count];
+    let mut module_first = vec![u32::MAX; image_count];
+    for (img, first_slot) in module_first.iter_mut().enumerate() {
+        let ib = i_off + img * IMAGE_STRIDE;
+        let type_start = rd_u32(data, ib + IMAGE_TYPE_START_OFF).ok_or(Error::Malformed)?;
+        let type_cnt = rd_u32(data, ib + IMAGE_TYPE_COUNT_OFF).ok_or(Error::Malformed)?;
+        let mut first = u32::MAX;
+        for t in type_start..type_start.saturating_add(type_cnt) {
+            if t as usize >= type_count {
+                return Err(Error::Malformed);
+            }
+            let tb = t_off + (t as usize) * TYPE_STRIDE;
+            let ms = rd_u32(data, tb + TYPE_METHOD_START_OFF).ok_or(Error::Malformed)?;
+            let mc = rd_u16(data, tb + TYPE_METHOD_COUNT_OFF).ok_or(Error::Malformed)? as u32;
+            if ms == NO_METHODS || mc == 0 {
+                continue;
+            }
+            first = first.min(ms);
+            for m in ms..ms.saturating_add(mc) {
+                let mi = m as usize;
+                if mi >= method_count {
+                    return Err(Error::Malformed);
+                }
+                if module_of[mi] != u32::MAX {
+                    return Err(Error::Malformed); // a method in two modules — layout is wrong
+                }
+                module_of[mi] = img as u32;
+            }
+        }
+        *first_slot = first;
+    }
+
+    // Rewrite each owned method's token to `0x06000000 | (local_index + 1)`.
+    // Any method NOT owned by an image would keep its original (obfuscated)
+    // token — a silent partial remap that still crashes il2cpp at runtime, so
+    // treat it as a malformed layout instead of shipping it.
+    let mut out = data.to_vec();
+    let mut remapped = 0usize;
+    for (mi, &img) in module_of.iter().enumerate() {
+        if img == u32::MAX {
+            return Err(Error::Malformed); // method outside every image's range
+        }
+        let first = module_first[img as usize];
+        let local = (mi as u32) - first; // mi >= first by construction
+        let new_tok = METHOD_TOKEN_TABLE | ((local + 1) & 0x00FF_FFFF);
+        let off = m_off + mi * METHOD_STRIDE + METHOD_TOKEN_OFF;
+        // `fits` above guarantees this 4-byte write is in bounds.
+        if out[off..off + 4] != new_tok.to_le_bytes() {
+            out[off..off + 4].copy_from_slice(&new_tok.to_le_bytes());
+            remapped += 1;
+        }
+    }
+
+    let modules = module_first.iter().filter(|&&f| f != u32::MAX).count();
+    Ok((
+        out,
+        Report {
+            version,
+            methods: method_count,
+            remapped,
+            modules,
+        },
+    ))
+}
+
+/// Read the (offset, size) i32 pair of a metadata table from the header.
+fn table(data: &[u8], hdr_off: usize) -> Result<(usize, usize), Error> {
+    let off = rd_u32(data, hdr_off).ok_or(Error::Malformed)? as usize;
+    let size = rd_u32(data, hdr_off + 4).ok_or(Error::Malformed)? as usize;
+    Ok((off, size))
+}
+
+/// True if `[off, off+len)` lies within `data`.
+fn fits(data: &[u8], off: usize, len: usize) -> bool {
+    off.checked_add(len).is_some_and(|end| end <= data.len())
+}
+
+fn rd_u32(b: &[u8], o: usize) -> Option<u32> {
+    let s = b.get(o..o + 4)?;
+    Some(u32::from_le_bytes([s[0], s[1], s[2], s[3]]))
+}
+
+fn rd_u16(b: &[u8], o: usize) -> Option<u16> {
+    let s = b.get(o..o + 2)?;
+    Some(u16::from_le_bytes([s[0], s[1]]))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // Build a minimal but structurally valid v31 metadata with two modules:
+    //   image 0: 1 type, 2 methods (global 0,1)
+    //   image 1: 1 type, 3 methods (global 2,3,4)
+    // Method tokens are seeded with *obfuscated* (sparse) values; the correct
+    // de-obfuscated tokens are per-module 1-based: [1,2] and [1,2,3].
+    struct Built {
+        bytes: Vec<u8>,
+        m_off: usize,
+    }
+    fn build(method_tokens: &[u32]) -> Built {
+        // Layout: [header 0x100][images][types][methods]
+        let hdr = 0x100usize;
+        let images = hdr;
+        let i_count = 2;
+        let i_size = i_count * IMAGE_STRIDE;
+        let types = images + i_size;
+        let t_count = 2;
+        let t_size = t_count * TYPE_STRIDE;
+        let methods = types + t_size;
+        let m_count = method_tokens.len();
+        let m_size = m_count * METHOD_STRIDE;
+        let total = methods + m_size;
+        let mut b = vec![0u8; total];
+
+        let put32 = |b: &mut [u8], o: usize, v: u32| b[o..o + 4].copy_from_slice(&v.to_le_bytes());
+        let put16 = |b: &mut [u8], o: usize, v: u16| b[o..o + 2].copy_from_slice(&v.to_le_bytes());
+
+        put32(&mut b, 0, MAGIC);
+        put32(&mut b, 4, SUPPORTED_VERSION);
+        put32(&mut b, HDR_METHODS, methods as u32);
+        put32(&mut b, HDR_METHODS + 4, m_size as u32);
+        put32(&mut b, HDR_TYPES, types as u32);
+        put32(&mut b, HDR_TYPES + 4, t_size as u32);
+        put32(&mut b, HDR_IMAGES, images as u32);
+        put32(&mut b, HDR_IMAGES + 4, i_size as u32);
+
+        // image 0: typeStart=0 typeCount=1 ; image 1: typeStart=1 typeCount=1
+        put32(&mut b, images + IMAGE_TYPE_START_OFF, 0);
+        put32(&mut b, images + IMAGE_TYPE_COUNT_OFF, 1);
+        put32(&mut b, images + IMAGE_STRIDE + IMAGE_TYPE_START_OFF, 1);
+        put32(&mut b, images + IMAGE_STRIDE + IMAGE_TYPE_COUNT_OFF, 1);
+        // type 0: methodStart=0 count=2 ; type 1: methodStart=2 count=3
+        put32(&mut b, types + TYPE_METHOD_START_OFF, 0);
+        put16(&mut b, types + TYPE_METHOD_COUNT_OFF, 2);
+        put32(&mut b, types + TYPE_STRIDE + TYPE_METHOD_START_OFF, 2);
+        put16(&mut b, types + TYPE_STRIDE + TYPE_METHOD_COUNT_OFF, 3);
+        // method tokens
+        for (i, &tok) in method_tokens.iter().enumerate() {
+            put32(&mut b, methods + i * METHOD_STRIDE + METHOD_TOKEN_OFF, tok);
+        }
+        Built {
+            bytes: b,
+            m_off: methods,
+        }
+    }
+    fn tok(b: &[u8], m_off: usize, i: usize) -> u32 {
+        rd_u32(b, m_off + i * METHOD_STRIDE + METHOD_TOKEN_OFF).unwrap()
+    }
+
+    #[test]
+    fn remaps_obfuscated_method_tokens_per_module() {
+        // Obfuscated sparse tokens (rows way past each module's method count).
+        let built = build(&[
+            0x0600_D49F,
+            0x0600_FFFF,
+            0x0600_1234,
+            0x0600_ABCD,
+            0x0600_5555,
+        ]);
+        let (out, r) = deobfuscate(&built.bytes).expect("ok");
+        assert_eq!(r.version, 31);
+        assert_eq!(r.methods, 5);
+        assert_eq!(r.modules, 2);
+        assert_eq!(r.remapped, 5);
+        // module 0 (methods 0,1) -> rows 1,2 ; module 1 (methods 2,3,4) -> rows 1,2,3
+        assert_eq!(tok(&out, built.m_off, 0), 0x0600_0001);
+        assert_eq!(tok(&out, built.m_off, 1), 0x0600_0002);
+        assert_eq!(tok(&out, built.m_off, 2), 0x0600_0001);
+        assert_eq!(tok(&out, built.m_off, 3), 0x0600_0002);
+        assert_eq!(tok(&out, built.m_off, 4), 0x0600_0003);
+    }
+
+    #[test]
+    fn idempotent_on_clean_metadata() {
+        // Already de-obfuscated: per-module contiguous rows.
+        let clean = [
+            0x0600_0001,
+            0x0600_0002,
+            0x0600_0001,
+            0x0600_0002,
+            0x0600_0003,
+        ];
+        let built = build(&clean);
+        let (out, r) = deobfuscate(&built.bytes).expect("ok");
+        assert_eq!(r.remapped, 0, "no rewrites on already-clean metadata");
+        assert_eq!(out, built.bytes, "byte-identical output");
+    }
+
+    #[test]
+    fn rejects_non_metadata() {
+        assert_eq!(
+            deobfuscate(b"not metadata at all....").unwrap_err(),
+            Error::NotMetadata
+        );
+    }
+
+    #[test]
+    fn rejects_unsupported_version() {
+        let mut built = build(&[
+            0x0600_0001,
+            0x0600_0002,
+            0x0600_0001,
+            0x0600_0002,
+            0x0600_0003,
+        ]);
+        built.bytes[4..8].copy_from_slice(&29u32.to_le_bytes());
+        assert_eq!(
+            deobfuscate(&built.bytes).unwrap_err(),
+            Error::UnsupportedVersion(29)
+        );
+    }
+}

src/pause.rs

@@ -0,0 +1,24 @@
+pub fn should_pause() -> bool {
+    #[cfg(windows)]
+    {
+        use windows::Win32::System::Console::GetConsoleProcessList;
+        let mut buf = [0u32; 4];
+        let n = unsafe { GetConsoleProcessList(&mut buf) };
+        n == 1
+    }
+    #[cfg(not(windows))]
+    {
+        false
+    }
+}
+
+pub fn maybe_pause(force_skip: bool) {
+    if force_skip || !should_pause() {
+        return;
+    }
+    use std::io::Write;
+    eprint!("\nPress Enter to exit…");
+    let _ = std::io::stderr().flush();
+    let mut buf = String::new();
+    let _ = std::io::stdin().read_line(&mut buf);
+}

src/scan.rs

@@ -0,0 +1,414 @@
+use crate::unpacker::detect;
+use std::io::Read;
+use std::path::{Path, PathBuf};
+use walkdir::WalkDir;
+
+/// Bytes read per file for content detection. `detect` inspects the DOS/PE
+/// header and the Crackproof key table at offset 4096; its deepest read is the
+/// key-table dword at 4124 (so a candidate must be ≥ 4128 bytes) or the PE
+/// data-directory field at `e_lfanew + 252`, which is far below 8 KiB for any
+/// real PE (`e_lfanew` is a few hundred bytes). `is_metadata` needs only the
+/// first 4 bytes. An 8 KiB prefix therefore yields the same verdict as the whole
+/// file while avoiding pulling multi-gigabyte game assets into memory just to
+/// reject them — the previous 64 KiB was 8× larger than anything detect reads.
+const DETECT_PREFIX: u64 = 8 * 1024;
+
+/// Smallest file that can possibly be a target, so anything shorter is skipped
+/// without ever being opened.
+///
+/// A Crackproof module needs ≥ 4128 bytes for [`crate::unpacker::detect`]'s key
+/// table (it reads the dword at 4124), so the bound is exact for the unpack
+/// path. An il2cpp `global-metadata.dat` only needs 4 bytes to match its magic,
+/// but its header alone runs to offset 0xB0 and the images/types/methods tables
+/// it indexes make every real one megabytes long — a sub-4 KiB "metadata" could
+/// only ever fail [`crate::metadata::deobfuscate`] with `Malformed`, so nothing
+/// processable is lost.
+const MIN_SIZE: u64 = 4128;
+
+/// File extensions that are bulk data by construction and can never be a PE
+/// image or an il2cpp metadata blob.
+///
+/// This is deliberately a **deny**-list, not an allow-list: the default is to
+/// probe, so anything unrecognised is still opened. Targets are recognised by
+/// content, not extension, and can carry arbitrary names — there is no closed
+/// set of target extensions an allow-list of `exe`/`dll` could enumerate.
+/// Only extensions that are bulk asset or text formats by construction appear
+/// here.
+///
+/// Set `SENBEI_SCAN_ALL=1` (or pass `--scan-all`) to probe every file regardless.
+const DENY_EXT: &[&str] = &[
+    // Unity and other engine asset containers
+    "ab",
+    "bundle",
+    "unity3d",
+    "manifest",
+    "resource",
+    "ress",
+    "assets",
+    "sharedassets",
+    // audio / video / image / font
+    "acb",
+    "awb",
+    "usm",
+    "wav",
+    "ogg",
+    "mp3",
+    "mp4",
+    "avi",
+    "png",
+    "jpg",
+    "jpeg",
+    "bmp",
+    "gif",
+    "tga",
+    "dds",
+    "svg",
+    "ttf",
+    "otf",
+    // text, markup, config, logs
+    "xml",
+    "json",
+    "txt",
+    "csv",
+    "md",
+    "toml",
+    "ini",
+    "yml",
+    "yaml",
+    "log",
+    "html",
+    "htm",
+    "css",
+    "aspx",
+    "browser",
+    "config",
+    "sig",
+    "map",
+    "pdb",
+    // rhythm-game chart/score data
+    "ma2",
+    "sr",
+];
+
+/// Whether `path`'s extension is on [`DENY_EXT`]. Extensionless files are never
+/// denied (they could be anything).
+fn denied_ext(path: &Path) -> bool {
+    let Some(ext) = path.extension() else {
+        return false;
+    };
+    let Some(ext) = ext.to_str() else {
+        return false;
+    };
+    // Extensions are ASCII in practice; compare case-insensitively without
+    // allocating for the overwhelmingly common non-match.
+    DENY_EXT
+        .iter()
+        .any(|d| d.len() == ext.len() && d.eq_ignore_ascii_case(ext))
+}
+
+/// Content classification of a single file.
+#[derive(Clone, Copy, PartialEq, Eq)]
+enum Class {
+    /// Neither a Crackproof module nor il2cpp metadata — left untouched.
+    None,
+    /// A Crackproof-protected PE (unpack target).
+    Crackproof,
+    /// An il2cpp `global-metadata.dat` (de-obfuscation target).
+    Metadata,
+}
+
+/// Walk `root` recursively (skipping any directory literally named `"unpack"`)
+/// and return, **in walk order**, the Crackproof candidates and the il2cpp
+/// metadata blobs found — from a *single* traversal that opens each file at
+/// most once.
+///
+/// # Why the cheap pre-filter dominates
+///
+/// The traversal is not the cost. Measured on a 46,446-file / 61 GB game tree,
+/// `readdir` (including each entry's size, which Windows returns from the
+/// directory enumeration for free) takes ~0.2 s and opening all 46,446 files
+/// takes ~1 s — but *reading* from them takes 40 s. Read size is irrelevant: a
+/// 4-byte read costs the same ~900 µs as an 8 KiB one, because the cost is
+/// per-file I/O latency, not bandwidth (that tree lives on a user-mode virtual
+/// disk that tops out near 1,300 IOPS). Thread count barely moves it either.
+///
+/// So the only lever is **probing fewer files**, which is what [`MIN_SIZE`] and
+/// [`DENY_EXT`] do — both decided from the free directory metadata, before any
+/// file is opened. On that tree they cut 46,446 probes to 1,814 and the scan
+/// from ~40 s to ~2 s while still finding every target.
+///
+/// The surviving probes (open + short read + magic test) are fanned out across
+/// worker threads. Directory traversal itself stays serial (one cheap `readdir`
+/// pass, no file opens) because it feeds the parallel probe.
+///
+/// Thread count follows [`crate::unpacker::parallel::thread_cap`] (honoring
+/// `SENBEI_THREADS`, `1` = fully sequential). Output order is independent of
+/// thread count: each worker owns a disjoint contiguous slice of the path list
+/// and writes the matching disjoint slice of the class list, so results are
+/// deterministic.
+pub fn find_targets(root: &Path) -> (Vec<PathBuf>, Vec<PathBuf>, ScanStats) {
+    find_targets_opts(root, scan_all_env())
+}
+
+/// Non-target tallies from a [`find_targets_opts`] walk.
+#[derive(Default, Clone, Copy, Debug)]
+pub struct ScanStats {
+    /// Files that were content-probed but matched neither detector (skipped).
+    pub skipped: usize,
+    /// Directory entries the walker could not read (permissions, transient
+    /// I/O errors). These files were never classified — surface this to the
+    /// user instead of silently reporting a clean scan.
+    pub walk_errors: usize,
+    /// Files selected for probing whose bytes could not be read (open/read
+    /// failure, or a detector panic). Unlike `skipped`, the scan could not
+    /// determine whether these are targets — a locked il2cpp game assembly
+    /// looks exactly like this, so the job layer counts them as errors.
+    pub probe_errors: usize,
+}
+
+/// [`find_targets`], but with the pre-filter explicitly controlled. When
+/// `scan_all` is true every regular file is probed, restoring the exhaustive
+/// (and on asset-heavy trees, far slower) behavior.
+pub fn find_targets_opts(root: &Path, scan_all: bool) -> (Vec<PathBuf>, Vec<PathBuf>, ScanStats) {
+    // Phase 1: serial traversal collecting regular-file paths only. No file is
+    // opened here; `readdir` is fast relative to the content probe that follows,
+    // and `entry.metadata()` is served from the directory entry on Windows, so
+    // the size test below costs nothing.
+    let mut paths: Vec<PathBuf> = Vec::new();
+    let mut stats = ScanStats::default();
+    for entry in WalkDir::new(root).into_iter().filter_entry(|e| {
+        if !e.file_type().is_dir() {
+            return true;
+        }
+        // The root itself is always walked, even if it is named "unpack" or is
+        // a junction the user pointed us at deliberately.
+        if e.depth() == 0 {
+            return true;
+        }
+        // Never descend into a previous output tree ("unpack", any case: NTFS
+        // is case-insensitive, so `Unpack` from an older run is still ours).
+        if e.file_name().eq_ignore_ascii_case("unpack") {
+            return false;
+        }
+        // Skip reparse-point directories (junctions, symlink-dirs): they point
+        // outside the scanned tree — walking one would silently unpack an
+        // entire foreign tree (e.g. a `samples` junction into the golden corpus).
+        !is_reparse_point(e)
+    }) {
+        let entry = match entry {
+            Ok(e) => e,
+            Err(_) => {
+                stats.walk_errors += 1;
+                continue;
+            }
+        };
+        if !entry.file_type().is_file() {
+            continue;
+        }
+        if !scan_all {
+            // Skip on directory metadata alone — never open these.
+            let too_small = entry
+                .metadata()
+                .map(|m| m.len() < MIN_SIZE)
+                .unwrap_or(false);
+            if too_small || denied_ext(entry.path()) {
+                continue;
+            }
+        }
+        paths.push(entry.into_path());
+    }
+
+    // Phase 2: parallel content probe over disjoint chunks (no synchronization).
+    // `classify` yields `None` for unreadable/panicking probes (see ScanStats);
+    // `Some(Class::None)` means "probed, matched neither detector".
+    let n = paths.len();
+    let mut class: Vec<Option<Class>> = vec![Some(Class::None); n];
+    let workers = crate::unpacker::parallel::thread_cap().clamp(1, n.max(1));
+    if workers <= 1 {
+        for (p, c) in paths.iter().zip(class.iter_mut()) {
+            *c = classify(p);
+        }
+    } else {
+        let chunk = n.div_ceil(workers);
+        std::thread::scope(|scope| {
+            for (pc, cc) in paths.chunks(chunk).zip(class.chunks_mut(chunk)) {
+                scope.spawn(move || {
+                    for (p, c) in pc.iter().zip(cc.iter_mut()) {
+                        *c = classify(p);
+                    }
+                });
+            }
+        });
+    }
+
+    let mut candidates = Vec::new();
+    let mut metadata = Vec::new();
+    for (p, c) in paths.into_iter().zip(class) {
+        match c {
+            Some(Class::Crackproof) => candidates.push(p),
+            Some(Class::Metadata) => metadata.push(p),
+            Some(Class::None) => stats.skipped += 1,
+            // Unreadable / panicking probe: NOT skipped — the scan could not
+            // classify it, so it may be a target we failed to unpack.
+            None => stats.probe_errors += 1,
+        }
+    }
+    (candidates, metadata, stats)
+}
+
+/// True if a walked directory entry is a reparse point (junction or symlink).
+///
+/// `DirEntry::file_type` only flags true symlinks; NTFS junctions report as
+/// ordinary directories, so without this check the walker descends into them.
+/// Off-Windows there are no junctions — symlink dirs are already excluded
+/// because `follow_links` is off (their `file_type().is_dir()` is false).
+#[cfg(windows)]
+fn is_reparse_point(e: &walkdir::DirEntry) -> bool {
+    use std::os::windows::fs::MetadataExt;
+    const FILE_ATTRIBUTE_REPARSE_POINT: u32 = 0x400;
+    e.metadata()
+        .map(|m| m.file_attributes() & FILE_ATTRIBUTE_REPARSE_POINT != 0)
+        .unwrap_or(false)
+}
+
+#[cfg(not(windows))]
+fn is_reparse_point(_e: &walkdir::DirEntry) -> bool {
+    false
+}
+
+/// Whether the scan pre-filter is disabled via `SENBEI_SCAN_ALL`. Any value
+/// other than `0`/empty turns exhaustive scanning on. The `--scan-all` flag is
+/// ORed with this.
+pub fn scan_all_env() -> bool {
+    match std::env::var("SENBEI_SCAN_ALL") {
+        Ok(v) => !matches!(v.trim(), "" | "0"),
+        Err(_) => false,
+    }
+}
+
+/// Classify one file by content. Reads a short prefix once and tests the
+/// Crackproof detector first, then the il2cpp metadata magic. Returns `None`
+/// when the file could not be classified at all — an I/O error opening it
+/// (locked, permissions) or a panic inside a detector — so the caller counts
+/// it as a probe error rather than a clean "not a target" skip.
+///
+/// The detector is wrapped in `catch_unwind` because a panic in a scan worker
+/// thread would otherwise abort the whole folder run (a scoped-thread panic
+/// re-raises on join, before any per-file isolation exists). The default panic
+/// hook still prints the message, keeping the bug diagnosable.
+///
+/// A Crackproof PE never matches the metadata magic (it is a PE, not a
+/// metadata blob) and vice versa, so the order is immaterial.
+fn classify(path: &Path) -> Option<Class> {
+    let head = read_prefix(path, DETECT_PREFIX)?;
+    let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        if detect(&head).is_some() {
+            Class::Crackproof
+        } else if crate::metadata::is_metadata(&head) {
+            Class::Metadata
+        } else {
+            Class::None
+        }
+    }));
+    r.ok()
+}
+
+/// Read up to `max` bytes from the start of `path`. Returns `None` on any I/O
+/// error (the file is simply not treated as a candidate).
+fn read_prefix(path: &Path, max: u64) -> Option<Vec<u8>> {
+    let file = std::fs::File::open(path).ok()?;
+    let mut buf = Vec::with_capacity(max as usize);
+    file.take(max).read_to_end(&mut buf).ok()?;
+    Some(buf)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn denies_bulk_asset_extensions_case_insensitively() {
+        for p in ["a.ab", "a.XML", "a.Acb", "a.ma2", "a.manifest", "a.PNG"] {
+            assert!(denied_ext(Path::new(p)), "{p} should be denied");
+        }
+    }
+
+    #[test]
+    fn never_denies_what_a_target_can_be_named() {
+        // Targets are recognised by content, not name — a protected module
+        // can carry any extension, or none — so names like these must always
+        // be probed. An allow-list would have skipped them.
+        for p in [
+            "app.exe.bak",
+            "managed.dll.bak",
+            "daemon.exe",
+            "GameLib.dll",
+            "global-metadata.dat",
+            "noextension",
+            "a.so",
+            "a.bin",
+        ] {
+            assert!(!denied_ext(Path::new(p)), "{p} must still be probed");
+        }
+    }
+
+    /// A file below the Crackproof key-table bound is skipped without being
+    /// opened, but a large non-asset file is still probed.
+    #[test]
+    fn prefilter_skips_small_and_denied_files_only() {
+        let td = tempfile::tempdir().unwrap();
+        let root = td.path();
+        std::fs::write(root.join("tiny.dll"), vec![0u8; 100]).unwrap();
+        std::fs::write(root.join("assets.ab"), vec![0u8; 100_000]).unwrap();
+        std::fs::write(root.join("plain.dll"), vec![0u8; 100_000]).unwrap();
+
+        // None of them are Crackproof, so both modes find nothing; the point is
+        // that the filtered walk does not panic and honors `scan_all`.
+        let (c, m, _) = find_targets_opts(root, false);
+        assert!(c.is_empty() && m.is_empty());
+        let (c, m, _) = find_targets_opts(root, true);
+        assert!(c.is_empty() && m.is_empty());
+    }
+
+    /// An il2cpp metadata blob is found by the filtered scan: `.dat` is not on
+    /// the deny-list and a real one is far above `MIN_SIZE`.
+    #[test]
+    fn finds_metadata_through_the_prefilter() {
+        let td = tempfile::tempdir().unwrap();
+        let root = td.path();
+        let mut blob = vec![0u8; MIN_SIZE as usize + 1];
+        blob[..4].copy_from_slice(&0xFAB1_1BAFu32.to_le_bytes());
+        std::fs::write(root.join("global-metadata.dat"), &blob).unwrap();
+        // Same magic but too small to be processable — skipped by the size floor.
+        std::fs::write(root.join("stub.dat"), &blob[..64]).unwrap();
+
+        let (_, m, _) = find_targets_opts(root, false);
+        assert_eq!(m.len(), 1);
+        assert!(m[0].ends_with("global-metadata.dat"));
+    }
+
+    /// Review regression: a previous output tree is pruned case-insensitively
+    /// (NTFS is case-insensitive, so `UNPACK` from an older run is still our
+    /// output), and probed non-targets are counted as skipped.
+    #[test]
+    fn prunes_unpack_dir_case_insensitively_and_counts_skipped() {
+        let td = tempfile::tempdir().unwrap();
+        let root = td.path();
+        let out_dir = root.join("UNPACK");
+        std::fs::create_dir(&out_dir).unwrap();
+        // A metadata-magic file inside the old output tree: must NOT be found.
+        let mut blob = vec![0u8; MIN_SIZE as usize + 1];
+        blob[..4].copy_from_slice(&0xFAB1_1BAFu32.to_le_bytes());
+        std::fs::write(out_dir.join("global-metadata.dat"), &blob).unwrap();
+        // A big non-target file at the root: probed, then skipped.
+        std::fs::write(root.join("plain.dll"), vec![0u8; 100_000]).unwrap();
+
+        let (c, m, stats) = find_targets_opts(root, false);
+        assert!(
+            c.is_empty() && m.is_empty(),
+            "old output tree must be pruned"
+        );
+        assert_eq!(stats.skipped, 1, "the probed non-target counts as skipped");
+        assert_eq!(stats.walk_errors, 0);
+    }
+}

src/ui.rs

@@ -0,0 +1,73 @@
+use crate::unpacker::{IntegrityReport, Kind};
+use indicatif::{ProgressBar, ProgressStyle};
+use owo_colors::OwoColorize;
+use std::path::Path;
+
+/// Create a progress bar for `n` items. Hidden when `quiet` is true.
+pub fn progress(n: u64, quiet: bool) -> ProgressBar {
+    if quiet || n == 0 {
+        return ProgressBar::hidden();
+    }
+    let bar = ProgressBar::new(n);
+    bar.set_style(
+        ProgressStyle::default_bar()
+            .template("[{elapsed_precise}] {bar:40.cyan/blue} {pos}/{len} {msg}")
+            .unwrap_or_else(|_| ProgressStyle::default_bar()),
+    );
+    bar
+}
+
+/// Print a green success line, suspending the progress bar.
+pub fn ok(bar: &ProgressBar, quiet: bool, rel: &Path, kind: Kind, dest: &Path) {
+    if quiet {
+        return;
+    }
+    let msg = format!(
+        "{} {:?}  {}  ->  {}",
+        "✓".green(),
+        kind,
+        rel.display(),
+        dest.display()
+    );
+    bar.suspend(|| println!("{msg}"));
+}
+
+/// Print a green success line for a de-obfuscated il2cpp `global-metadata.dat`,
+/// reporting how many method tokens were remapped.
+pub fn metadata(bar: &ProgressBar, quiet: bool, rel: &Path, remapped: usize, dest: &Path) {
+    if quiet {
+        return;
+    }
+    let msg = format!(
+        "{} metadata  {}  ->  {}  ({} method tokens remapped)",
+        "✓".green(),
+        rel.display(),
+        dest.display(),
+        remapped
+    );
+    bar.suspend(|| println!("{msg}"));
+}
+
+/// Print a red error line, suspending the progress bar.
+pub fn err(bar: &ProgressBar, quiet: bool, rel: &Path, e: &anyhow::Error) {
+    if quiet {
+        return;
+    }
+    let msg = format!("{} {}  {e:#}", "✗".red(), rel.display());
+    bar.suspend(|| eprintln!("{msg}"));
+}
+
+/// Print a yellow warning line for a file that unpacked but failed the static
+/// integrity check (likely to crash at runtime), suspending the progress bar.
+pub fn suspect(bar: &ProgressBar, quiet: bool, rel: &Path, report: &IntegrityReport) {
+    if quiet {
+        return;
+    }
+    let msg = format!(
+        "{} {}  integrity check failed: {}",
+        "!".yellow(),
+        rel.display(),
+        report.issues.join("; ")
+    );
+    bar.suspend(|| eprintln!("{msg}"));
+}

src/unpacker/bytecode.rs

@@ -0,0 +1,119 @@
+// Bytecode interpreter for the custom-decryptor stages. Those stages are tiny
+// instruction programs embedded in the decrypted buffer; we compile each
+// program down to a Vec<Op> and interpret it.
+
+#[derive(Clone, Copy)]
+pub enum Op {
+    Add(u8),
+    Sub(u8),
+    Xor(u8),
+    Rol(u32),
+    Ror(u32),
+    Inc,
+    Dec,
+}
+
+pub fn apply(ops: &[Op], mut x: u8) -> u8 {
+    for &op in ops {
+        x = match op {
+            Op::Add(n) => x.wrapping_add(n),
+            Op::Sub(n) => x.wrapping_sub(n),
+            Op::Xor(n) => x ^ n,
+            Op::Rol(n) => x.rotate_left(n & 7),
+            Op::Ror(n) => x.rotate_right(n & 7),
+            Op::Inc => x.wrapping_add(1),
+            Op::Dec => x.wrapping_sub(1),
+        };
+    }
+    x
+}
+
+/// A precomputed 256-entry byte→byte translation table for a fixed op list.
+///
+/// `apply` is a pure function of a single byte, but the hot decrypt paths run it
+/// over multi-megabyte regions. Building the full table once and translating
+/// each byte with a single lookup turns an O(region × ops) walk into O(region) —
+/// a large constant-factor win on those paths.
+pub struct OpsLut {
+    t: [u8; 256],
+}
+
+impl OpsLut {
+    pub fn new(ops: &[Op]) -> Self {
+        let mut t = [0u8; 256];
+        let mut i = 0;
+        while i < 256 {
+            t[i] = apply(ops, i as u8);
+            i += 1;
+        }
+        Self { t }
+    }
+
+    /// Translate `d[off .. off + n]` in place through the table.
+    #[inline]
+    pub fn map_region(&self, d: &mut [u8], off: usize, n: usize) {
+        for b in &mut d[off..off + n] {
+            *b = self.t[*b as usize];
+        }
+    }
+}
+
+pub fn generate(data: &[u8], offset: u32) -> Option<Vec<Op>> {
+    // Bounds-checked cursor: a corrupt `data_offset` (bad decrypt_data6 / the
+    // alignment fallback) must yield `None`, not an out-of-bounds panic — the
+    // panic path would surface as a misleading `UnpackError::Corrupt` instead
+    // of the precise `BytecodeGenFailed`, and any future caller without a
+    // `catch_unwind` wrapper would abort outright.
+    let mut pos = offset as usize;
+    let mut next = move || {
+        let b = data.get(pos).copied()?;
+        pos += 1;
+        Some(b)
+    };
+    let mut ops = Vec::new();
+    loop {
+        match next()? {
+            4 => ops.push(Op::Add(next()?)),
+            44 => ops.push(Op::Sub(next()?)),
+            52 => ops.push(Op::Xor(next()?)),
+            144 => {} // nop
+            192 => {
+                let mb = next()?;
+                let rm = mb & 7;
+                let reg = (mb >> 3) & 7;
+                let mod_ = (mb >> 6) & 3;
+                if mod_ != 3 || rm != 0 {
+                    return None;
+                }
+                let imm = next()? as u32;
+                match reg {
+                    0 => ops.push(Op::Rol(imm)),
+                    1 => ops.push(Op::Ror(imm)),
+                    _ => {
+                        return None;
+                    }
+                }
+            }
+            254 => {
+                let mb = next()?;
+                let rm = mb & 7;
+                let reg = (mb >> 3) & 7;
+                let mod_ = (mb >> 6) & 3;
+                if mod_ != 3 || rm != 0 {
+                    return None;
+                }
+                match reg {
+                    0 => ops.push(Op::Inc),
+                    1 => ops.push(Op::Dec),
+                    _ => {
+                        return None;
+                    }
+                }
+            }
+            195 => return Some(ops),
+            _ => {
+                return None;
+            }
+        }
+    }
+}

src/unpacker/crc32.rs

@@ -0,0 +1,33 @@
+const fn build_table() -> [u32; 256] {
+    let mut table = [0u32; 256];
+    let mut i = 0;
+    while i < 256 {
+        let mut c = i as u32;
+        let mut k = 0;
+        while k < 8 {
+            c = if c & 1 != 0 {
+                0xEDB8_8320 ^ (c >> 1)
+            } else {
+                c >> 1
+            };
+            k += 1;
+        }
+        table[i] = c;
+        i += 1;
+    }
+    table
+}
+
+const TABLE: [u32; 256] = build_table();
+
+pub fn append(initial: u32, data: &[u8]) -> u32 {
+    let mut crc = !initial;
+    for &b in data {
+        crc = TABLE[((crc ^ b as u32) & 0xFF) as usize] ^ (crc >> 8);
+    }
+    !crc
+}
+
+pub fn compute(data: &[u8]) -> u32 {
+    append(0, data)
+}

src/unpacker/dll.rs

@@ -0,0 +1,745 @@
+//! Native/managed-DLL unpack pipeline for the older protected-DLL layout.
+//!
+//! Naming note: the stage names used by this layout do NOT line up 1:1 with the
+//! shared primitives. Mapping used here:
+//!   DecryptData1 (XOR+ROR over dwords)  -> primitives::decrypt_data3
+//!   DecryptData3 (shift-5 byte rotate)  -> local `decrypt_data3_shift5`
+//!   DecryptData4/5 (AES+XORROR+huff)    -> local `decrypt_data4`
+//!   DecryptData6 (shift-6 byte rotate)  -> local `decrypt_data6_shift6`
+//!   DecryptData7 (nibble-swap rolling)  -> primitives::decrypt_data7
+//!   Decompress (LFSR keystream)         -> primitives::decrypt_data6
+//!   HuffmanDecompress                   -> primitives::decompress
+//!   AesDecrypt                          -> primitives::aes_decrypt
+//!   CalculateChecksumWithSizeXor        -> primitives::calculate_checksum
+//!   CalculateCrc32                      -> crc32::compute (via above)
+
+use super::UnpackError;
+use super::bytecode::{Op, OpsLut, generate};
+use super::primitives::{self, *};
+
+/// Read a signed 32-bit little-endian value.
+fn get_i32(d: &[u8], offset: i32) -> i32 {
+    get_u32(d, offset as u32) as i32
+}
+
+/// Write a signed 32-bit little-endian value.
+fn write_i32(d: &mut [u8], offset: i32, value: i32) {
+    write_u32(d, offset as u32, value as u32);
+}
+
+/// `DecryptData3` (shift-5): byte-level bit rotation over a (addr,size) pair.
+fn decrypt_data3_shift5(d: &mut [u8], offset: i32) {
+    let addr = get_i32(d, offset);
+    let size = get_i32(d, offset + 4);
+    let mut key1: u8 = (addr as u8).wrapping_add((addr >> 8) as u8);
+    let mut key2: u8 = key1.wrapping_add(1);
+    for i in 0..size {
+        let idx = (addr + i) as usize;
+        let val = d[idx];
+        let step1 = key2 ^ val.rotate_left(3);
+        let step2 = key1 ^ step1.rotate_left(3);
+        d[idx] = step2.rotate_left(3);
+        key1 = key1.wrapping_add(1);
+        key2 = key2.wrapping_add(1);
+    }
+}
+
+/// `DecryptData6` (shift-6): byte-level bit rotation over an explicit
+/// (offset, size) range, with the low byte of `offset` as the rolling key.
+fn decrypt_data6_shift6(d: &mut [u8], offset: i32, size: i32) {
+    let mut key1: u8 = offset as u8;
+    let mut key2: u8 = (offset as u8).wrapping_add(1);
+    for i in 0..size {
+        let idx = (offset + i) as usize;
+        let val = d[idx];
+        let step1 = key2 ^ val.rotate_left(2);
+        let step2 = key1 ^ step1.rotate_left(2);
+        d[idx] = step2.rotate_left(2);
+        key1 = key1.wrapping_add(1);
+        key2 = key2.wrapping_add(1);
+    }
+}
+
+/// `DecryptData4`/`DecryptData5`: AES-CBC decrypt + XOR/ROR (DecryptData1
+/// with rotate 19) + optional per-byte transform + Huffman decompress.
+fn decrypt_data4(
+    d: &mut [u8],
+    offset: i32,
+    key: i32,
+    decomp_params: &[i32; 4],
+    transform: Option<&[Op]>,
+) -> Result<(), UnpackError> {
+    let addr = get_i32(d, offset);
+    let size = get_i32(d, offset + 4);
+    let compressed_addr = get_i32(d, offset + 8);
+    let decompressed_size = get_i32(d, offset + 12);
+
+    aes_decrypt(d, addr as u32, size as u32, decomp_params[3] as u32);
+    // DecryptData1(offset, key, 19) == primitives::decrypt_data3 with shift 19
+    decrypt_data3(d, offset as u32, key as u32, 19);
+
+    if let Some(ops) = transform
+        && size > 0
+    {
+        OpsLut::new(ops).map_region(d, addr as usize, size as usize);
+    }
+
+    if size != decompressed_size {
+        // decompress reports corruption (after partial writes) via its bool;
+        // surface it instead of shipping a garbage block.
+        if !decompress(
+            d,
+            addr as u32,
+            compressed_addr as u32,
+            decomp_params[1] as u32,
+            size as u32,
+            decompressed_size as u32,
+        ) {
+            return Err(UnpackError::DecompressFailed);
+        }
+    }
+    Ok(())
+}
+
+/// `InitializeKeys`.
+fn initialize_keys(file_data: &[u8]) -> [i32; 8] {
+    let mut keys = [0i32; 8];
+    keys[0] = get_i32(file_data, 4096);
+    let mut prev_key = keys[0];
+    for i in 0..7i32 {
+        let val = get_i32(file_data, 4 * i + 4100);
+        keys[(i + 1) as usize] = val ^ prev_key;
+        prev_key = (i * i) ^ (val.wrapping_add(prev_key).wrapping_sub(i));
+    }
+    keys
+}
+
+/// `ProcessRelocBlock`.
+fn process_reloc_block(d: &mut [u8], mut pos: i32) {
+    loop {
+        decrypt_data6_shift6(d, pos, 16);
+        let src_addr = get_i32(d, pos);
+        let size = get_i32(d, pos + 4);
+        let dst_addr = get_i32(d, pos + 8);
+        let verify = get_i32(d, pos + 12);
+        pos += 16;
+
+        if src_addr != 0 && size != 0 && dst_addr != 0 && verify == size {
+            let s = src_addr as usize;
+            let dd = dst_addr as usize;
+            let n = size as usize;
+            d.copy_within(s..s + n, dd);
+        }
+        if size == 0 {
+            break;
+        }
+    }
+}
+
+/// Number of section headers to walk, and the guard the walks share.
+///
+/// The section table has no sentinel entry, so "iterate until VirtualSize is 0"
+/// silently truncates the walk at the first section with a legitimately zero
+/// VirtualSize (or a corrupt early field) — the later sections then keep the
+/// packer's raw pointers and the image is broken with no error. Walk by
+/// `NumberOfSections` instead, capped, with an all-zero-name break to guard the
+/// other direction (a corrupt, overstated count): real sections always have a
+/// name, header padding is all zero.
+const MAX_SECTIONS: i32 = 96;
+
+fn section_count(file_data: &[u8], pe_offset: i32) -> i32 {
+    (get_u16(file_data, (pe_offset + 6) as u32) as i32).min(MAX_SECTIONS)
+}
+
+fn section_header_blank(file_data: &[u8], off: i32) -> bool {
+    let s = off as usize;
+    match file_data.get(s..s + 8) {
+        Some(name) => name.iter().all(|&b| b == 0),
+        None => true,
+    }
+}
+
+/// `ProcessImportTable`.
+fn process_import_table(d: &mut [u8], mut import_table_offset: i32) {
+    while get_i32(d, import_table_offset + 12) != 0 {
+        let name_offset = get_i32(d, import_table_offset + 12);
+        decrypt_data7(d, name_offset as u32, name_offset as u8);
+
+        let thunk_addr0 = get_i32(d, import_table_offset);
+        let orig_thunk_addr = get_i32(d, import_table_offset + 16);
+        let mut thunk_addr = if thunk_addr0 == 0 {
+            orig_thunk_addr
+        } else {
+            thunk_addr0
+        };
+
+        loop {
+            // PE32+ thunks are 8 bytes: an ordinal import carries bit 63 with
+            // the ordinal in the low word; only a by-name thunk holds a
+            // hint/name RVA (in the low dword). Reading just the low dword
+            // would mistake an ordinal for a tiny RVA and scribble over the
+            // image header.
+            let v = get_u64(d, thunk_addr as u32);
+            if v == 0 {
+                break;
+            }
+            if (v & 0x8000_0000_0000_0000) == 0 {
+                let entry = v as u32;
+                decrypt_data7(d, entry.wrapping_add(2), entry as u8);
+                d[entry as usize] = 0;
+                d[entry.wrapping_add(1) as usize] = 0;
+            }
+            thunk_addr += 8;
+        }
+        import_table_offset += 20;
+    }
+}
+
+/// `DecryptAndDecompressData`.
+fn decrypt_and_decompress_data(
+    d: &mut [u8],
+    clean: &[u8],
+    section_image_base: i32,
+    mut section_data_offset: i32,
+    decrypt_func: &[Op],
+    decomp_params: &[i32; 4],
+) -> Result<(), UnpackError> {
+    // Entry loop — Pass 1 (sequential): the 16-byte descriptors are decrypted
+    // in a position-keyed chain (decrypt_data6_shift6) terminated by a zero-size
+    // record, so collection cannot be parallelized.
+    struct Blk {
+        dest_offset: i32,
+        size: i32,
+        src_offset: i32,
+        expected_crc: i32,
+    }
+    let mut blocks: Vec<Blk> = Vec::new();
+    loop {
+        // Guard: need 16 bytes at section_data_offset in `d`
+        let off = section_data_offset as usize;
+        if off.saturating_add(16) > d.len() {
+            return Err(UnpackError::OutOfBounds(off));
+        }
+        decrypt_data6_shift6(d, section_data_offset, 16);
+        let dest_offset = get_i32(d, section_data_offset);
+        let size = get_i32(d, section_data_offset + 4);
+        let src_offset = get_i32(d, section_data_offset + 8);
+        let expected_crc = get_i32(d, section_data_offset + 12);
+        section_data_offset += 16;
+
+        if size == 0 {
+            break;
+        }
+        blocks.push(Blk {
+            dest_offset,
+            size,
+            src_offset,
+            expected_crc,
+        });
+    }
+    // Pass 2: each block writes only [src_offset, src_offset+max(size,crc)) and
+    // reads only immutable input + the (snapshotted) key tables, so blocks with
+    // disjoint write spans are independent. `parallel_for` carves the spans
+    // into safe disjoint &mut slices (these blocks are only ever laid out
+    // disjointly; overlapping spans degrade to a sequential pass).
+    {
+        let lut = OpsLut::new(decrypt_func);
+        let ko0 = decomp_params[0];
+        let ko2 = decomp_params[2];
+        let ks_snap =
+            primitives::aes_schedule_snapshot(d, ko2 as u32).ok_or(UnpackError::Corrupt)?;
+        let tab_snap = primitives::huffman_table_snapshot(d, ko0 as u32)
+            .ok_or(UnpackError::DecompressFailed)?;
+        let spans: Vec<(usize, usize)> = blocks
+            .iter()
+            .map(|b| {
+                let s = b.src_offset as usize;
+                (s, s + b.size.max(b.expected_crc) as usize)
+            })
+            .collect();
+        let do_block = |i: usize, base: usize, span: &mut [u8]| -> Result<(), UnpackError> {
+            let b = &blocks[i];
+            let src = (b.dest_offset as i64 + section_image_base as i64) as usize;
+            let rel = (b.src_offset as usize) - base;
+            let n = b.size as usize;
+            // Bounds-checked copy from `clean` (potentially truncated input).
+            primitives::try_copy_from_slice(span, rel, n, clean, src)?;
+            aes_decrypt_ks(&ks_snap, span, rel as u32, b.size as u32);
+            lut.map_region(span, rel, n);
+            if b.size != b.expected_crc {
+                // decompress reports corruption (after partial writes) via its
+                // bool; surface it instead of shipping a garbage block.
+                if !decompress_tbl(
+                    &tab_snap,
+                    span,
+                    rel as u32,
+                    rel as u32,
+                    b.size as u32,
+                    b.expected_crc as u32,
+                ) {
+                    return Err(UnpackError::DecompressFailed);
+                }
+            }
+            Ok(())
+        };
+        super::parallel::parallel_for(d, &spans, 1, do_block)?;
+    }
+
+    // Zero-fill loop.
+    loop {
+        let off = section_data_offset as usize;
+        // The entry block loop above correctly requires 16 bytes; this loop
+        // decrypts 16 too, so guard 16 (an 8-byte guard would let
+        // decrypt_data6_shift6 index past the end of a truncated descriptor).
+        if off.saturating_add(16) > d.len() {
+            return Err(UnpackError::OutOfBounds(off));
+        }
+        decrypt_data6_shift6(d, section_data_offset, 16);
+        let zero_offset = get_i32(d, section_data_offset);
+        let zero_size = get_i32(d, section_data_offset + 4);
+        section_data_offset += 16;
+
+        if zero_size == 0 {
+            break;
+        }
+        for i in 0..zero_size {
+            let idx = (zero_offset + i) as usize;
+            if idx >= d.len() {
+                return Err(UnpackError::OutOfBounds(idx));
+            }
+            d[idx] = 0;
+        }
+    }
+    Ok(())
+}
+
+/// Unpack a native/managed DLL in the older protected-DLL layout. Returns the
+/// unpacked image bytes.
+pub fn unpack_dll(input: &[u8]) -> Result<Vec<u8>, UnpackError> {
+    unpack_dll_v(input, false)
+}
+
+/// Like [`unpack_dll`], but prints detailed `[N/9]` step progress to stdout when
+/// `verbose` is true. Output bytes are identical regardless.
+pub fn unpack_dll_v(input: &[u8], verbose: bool) -> Result<Vec<u8>, UnpackError> {
+    // Trap any out-of-bounds panic from a truncated/garbled file and report it
+    // as a clean error so the public API stays panic-free.
+    super::catch_unpack(move || unpack_dll_inner(input, verbose))
+}
+
+fn unpack_dll_inner(input: &[u8], verbose: bool) -> Result<Vec<u8>, UnpackError> {
+    if input.len() < 4096 {
+        return Err(UnpackError::InputTooShort(input.len()));
+    }
+
+    // `file_data` and `original_file_data` both borrow the same protected input.
+    let file_data = input;
+    let original_file_data = input;
+
+    let keys = initialize_keys(file_data);
+    if verbose {
+        println!("[1/9] Initializing keys...");
+        println!("  keys[0] key       = 0x{:08X}", keys[0] as u32);
+        println!("  keys[1] signature = 0x{:08X}", keys[1] as u32);
+        println!("  keys[3] base      = 0x{:08X}", keys[3] as u32);
+        println!("  keys[4] src_off   = 0x{:08X}", keys[4] as u32);
+        println!("  keys[5] size      = 0x{:08X}", keys[5] as u32);
+        println!("  keys[6] anchor    = 0x{:08X}", keys[6] as u32);
+    }
+
+    if !super::is_supported_magic(keys[1] as u32) {
+        return Err(UnpackError::DllUnpack(
+            "Not a Crackproof protected file (KONN magic mismatch)".into(),
+        ));
+    }
+
+    let pe_offset = get_i32(file_data, 60);
+    if pe_offset < 0 || (pe_offset as usize).saturating_add(84) > file_data.len() {
+        return Err(UnpackError::DllUnpack("implausible PE offset".into()));
+    }
+    // This pipeline is PE32+-only: its header fixups write the data
+    // directories at PE32+ offsets (pe+144..180, pe+136 for the DD blob). On a
+    // PE32 image those land in the wrong optional-header fields and produce a
+    // structurally plausible but unloadable file. Reject early with a clear
+    // error so `unpack_auto`'s EXE-pipeline fallback handles PE32 DLLs (that
+    // path is PE32-aware — see run_pe32), instead of us mangling them here.
+    if get_i32(file_data, pe_offset + 24) & 0xFFFF != 0x20B {
+        return Err(UnpackError::DllUnpack(
+            "not a PE32+ image (the DLL pipeline handles 64-bit only)".into(),
+        ));
+    }
+    let size_of_image = get_i32(file_data, pe_offset + 80);
+    if size_of_image <= 0 || size_of_image as u64 > super::MAX_IMAGE_SIZE {
+        return Err(UnpackError::DllUnpack("implausible SizeOfImage".into()));
+    }
+    let mut out = vec![0u8; size_of_image as usize];
+    let base_offset = keys[6] - keys[3] + 0x2000;
+    if verbose {
+        println!("[2/9] Decrypting key table...");
+        println!("  size_of_image = 0x{:08X}", size_of_image as u32);
+        println!("  base_offset   = 0x{:08X}", base_offset as u32);
+    }
+
+    // DecryptKeyTable.
+    {
+        let src_base = keys[4] + 4096;
+        let mut scramble = (!base_offset).wrapping_add(keys[0]);
+        let count = base_offset >> 2;
+        for i in 0..count {
+            let dst_offset = keys[3] + 4 * i;
+            let src_val = get_i32(file_data, src_base + 4 * i);
+            write_i32(&mut out, dst_offset, src_val ^ scramble);
+            scramble = (i * i) ^ (i.wrapping_add(src_val).wrapping_add(scramble));
+        }
+    }
+
+    // Array.Copy(fileData, keys[4]+baseOffset+4096, outputData, keys[3]+baseOffset, keys[5]-baseOffset)
+    {
+        let src = (keys[4] + base_offset + 4096) as usize;
+        let dst = (keys[3] + base_offset) as usize;
+        let n = (keys[5] - base_offset) as usize;
+        primitives::try_copy_from_slice(&mut out, dst, n, file_data, src)?;
+    }
+    write_i32(&mut out, keys[3], 4096);
+    out[..4096].copy_from_slice(&file_data[..4096]);
+
+    let v144 = get_i32(&out, keys[6] + 5600);
+    let v148 = get_i32(&out, keys[6] + 5596);
+    let v152 = get_i32(&out, keys[6] + 5632);
+    let v156 = get_i32(&out, keys[6] + 5636);
+    write_i32(&mut out, pe_offset + 144, v144);
+    write_i32(&mut out, pe_offset + 148, v148);
+    write_i32(&mut out, pe_offset + 152, v152);
+    write_i32(&mut out, pe_offset + 156, v156);
+    write_i32(&mut out, pe_offset + 176, 0);
+    write_i32(&mut out, pe_offset + 180, 0);
+
+    let mut checksum_offset1 = keys[6] + 5776;
+    let mut xor_accumulator: u32 = 0;
+    while get_i32(&out, checksum_offset1 + 4) != 0 {
+        xor_accumulator ^= calculate_checksum(&out, checksum_offset1 as u32);
+        checksum_offset1 += 8;
+    }
+
+    let checksum1 = calculate_checksum(&out, (keys[6] + 5648) as u32) as i32;
+    let enc_key = get_u32(&out, (keys[6] + 5612) as u32);
+    let decrypt_offset1 = keys[6] + 5712;
+    decrypt_data3(
+        &mut out,
+        decrypt_offset1 as u32,
+        xor_accumulator ^ (checksum1 as u32) ^ enc_key,
+        21,
+    );
+
+    let decrypted_addr1 = get_i32(&out, decrypt_offset1);
+    if verbose {
+        println!("[3/9] Decrypting primary descriptor...");
+        println!("  xor_accumulator = 0x{:08X}", xor_accumulator);
+        println!("  checksum1       = 0x{:08X}", checksum1 as u32);
+        println!("  decrypted_addr1 = 0x{:08X}", decrypted_addr1 as u32);
+    }
+    let import_offset = get_i32(&out, decrypted_addr1 + 3444);
+    let decrypted_addr2_size = get_i32(&out, decrypted_addr1 + 3632);
+    decrypt_data3(
+        &mut out,
+        (decrypted_addr1 + 3632) as u32,
+        import_offset as u32,
+        19,
+    );
+
+    let addr2 = decrypted_addr2_size;
+    let reloc_block_offset = addr2 + 9248;
+    let reloc_type = get_i32(&out, reloc_block_offset);
+
+    if (reloc_type & 0x0F) == 1 {
+        decrypt_data3_shift5(&mut out, addr2 + 9252);
+    } else if reloc_type == 2 {
+        let p = get_i32(&out, addr2 + 9252);
+        process_reloc_block(&mut out, p);
+    }
+
+    let reloc_block_offset2 = reloc_block_offset + 16;
+    let reloc_type2 = get_i32(&out, reloc_block_offset2);
+
+    if (reloc_type2 & 0x0F) == 1 {
+        decrypt_data3_shift5(&mut out, reloc_block_offset2 + 4);
+    } else if reloc_type2 == 2 {
+        let p = get_i32(&out, reloc_block_offset2 + 4);
+        process_reloc_block(&mut out, p);
+    }
+
+    let mut decomp_params = [0i32; 4];
+    let param_base = addr2 + 9160;
+    decrypt_data3_shift5(&mut out, param_base);
+    decomp_params[0] = get_i32(&out, param_base);
+    decrypt_data3_shift5(&mut out, param_base + 8);
+    decomp_params[1] = get_i32(&out, param_base + 8);
+    decrypt_data3_shift5(&mut out, param_base + 32);
+    decomp_params[2] = get_i32(&out, param_base + 32);
+    decrypt_data3_shift5(&mut out, param_base + 40);
+    decomp_params[3] = get_i32(&out, param_base + 40);
+    if verbose {
+        println!("[4/9] Processing relocations & decomp params...");
+        println!("  addr2          = 0x{:08X}", addr2 as u32);
+        println!(
+            "  decomp_params  = [0x{:08X}, 0x{:08X}, 0x{:08X}, 0x{:08X}]",
+            decomp_params[0] as u32,
+            decomp_params[1] as u32,
+            decomp_params[2] as u32,
+            decomp_params[3] as u32
+        );
+    }
+
+    let checksum2 = calculate_checksum(&out, (keys[6] + 5640) as u32) as i32;
+    let mut table_val = get_i32(&out, decrypted_addr1 + 3448);
+    for k in 1..=100 {
+        table_val = table_val.wrapping_add(k);
+    }
+    for k in 1..=200 {
+        table_val = table_val.wrapping_add(k);
+    }
+    for k in 1..=300 {
+        table_val = table_val.wrapping_add(k);
+    }
+    for k in 1..=400 {
+        table_val = table_val.wrapping_add(k);
+    }
+
+    let addr3_offset = decrypted_addr1 + 3712;
+    decrypt_data4(
+        &mut out,
+        addr3_offset,
+        table_val ^ checksum2 ^ (xor_accumulator as i32),
+        &decomp_params,
+        None,
+    )?;
+
+    let addr3b = get_i32(&out, decrypted_addr1 + 3728);
+    if verbose {
+        println!("[5/9] Decrypting code block 1 (addr3)...");
+        println!("  checksum2 = 0x{:08X}", checksum2 as u32);
+        println!("  addr3b    = 0x{:08X}", addr3b as u32);
+    }
+
+    let crc_data_offset = decrypted_addr1 + 3488;
+    let crc_data_addr = get_i32(&out, crc_data_offset);
+    let crc_data_size = get_i32(&out, crc_data_offset + 4);
+    let crc_val = {
+        let a = crc_data_addr as usize;
+        let n = crc_data_size as usize;
+        super::crc32::compute(&out[a..a + n]) as i32
+    };
+    let crc_xored = crc_data_size ^ crc_val;
+    let trailing_val = get_i32(&out, crc_data_addr + crc_data_size - 4);
+    decrypt_data4(
+        &mut out,
+        decrypted_addr1 + 3728,
+        crc_xored ^ (xor_accumulator as i32) ^ trailing_val,
+        &decomp_params,
+        None,
+    )?;
+
+    let checksum3 = calculate_checksum(&out, (decrypted_addr1 + 3480) as u32) as i32;
+    let not_val = !get_u32(&out, (addr3b + 1968) as u32);
+    let addr4_offset = decrypted_addr1 + 3760;
+    let xor_key = (xor_accumulator as i32) ^ checksum3;
+    decrypt_data4(
+        &mut out,
+        addr4_offset,
+        (not_val ^ (xor_key as u32)) as i32,
+        &decomp_params,
+        None,
+    )?;
+
+    let addr4 = get_i32(&out, addr4_offset);
+    let lfsr = addr4 + 3200;
+    // Decompress == primitives::decrypt_data6 (LFSR keystream, len at +95).
+    decrypt_data6(&mut out, lfsr as u32);
+    if verbose {
+        println!("[6/9] Decrypting code blocks 2-3 (addr3b, addr4)...");
+        println!("  crc_val   = 0x{:08X}", crc_val as u32);
+        println!("  checksum3 = 0x{:08X}", checksum3 as u32);
+        println!("  addr4     = 0x{:08X}", addr4 as u32);
+    }
+
+    let checksum4 = calculate_checksum(&out, (decrypted_addr1 + 3472) as u32) as i32;
+    let mut lfsr_seed_val = get_i32(&out, addr4 + 3160);
+    for k in 1..=100 {
+        lfsr_seed_val = lfsr_seed_val.wrapping_add(k);
+    }
+    for k in 1..=200 {
+        lfsr_seed_val = lfsr_seed_val.wrapping_add(k);
+    }
+    for k in 1..=300 {
+        lfsr_seed_val = lfsr_seed_val.wrapping_add(k);
+    }
+
+    let decrypt_func = generate(&out, lfsr as u32)
+        .ok_or_else(|| UnpackError::DllUnpack("Failed to build decryption expression".into()))?;
+
+    let addr5_offset = decrypted_addr1 + 3840;
+    let addr5 = get_i32(&out, addr5_offset);
+    decrypt_data4(
+        &mut out,
+        addr5_offset,
+        lfsr_seed_val ^ xor_key ^ checksum4,
+        &decomp_params,
+        Some(&decrypt_func),
+    )?;
+    if verbose {
+        println!("[7/9] Decrypting code block 4 (addr5)...");
+        println!("  checksum4 = 0x{:08X}", checksum4 as u32);
+        println!("  addr5     = 0x{:08X}", addr5 as u32);
+    }
+
+    let metadata_offset = addr5 + 12312;
+    let mut metadata_addr = get_i32(&out, metadata_offset);
+
+    while get_i32(&out, metadata_addr + 4) != 0 {
+        decrypt_data6_shift6(&mut out, metadata_addr, 16);
+        metadata_addr += 16;
+    }
+
+    let lfsr2 = metadata_offset + 88;
+    decrypt_data6(&mut out, lfsr2 as u32);
+
+    let decrypt_func2 = generate(&out, lfsr2 as u32).ok_or_else(|| {
+        UnpackError::DllUnpack("Failed to build second decryption expression".into())
+    })?;
+
+    let section_image_base = 4095 - get_i32(original_file_data, 4224);
+    let section_data_offset = get_i32(&out, addr5 + 11976);
+    if verbose {
+        println!("[8/9] Decrypting & decompressing sections...");
+        println!(
+            "  section_image_base  = 0x{:08X}",
+            section_image_base as u32
+        );
+        println!(
+            "  section_data_offset = 0x{:08X}",
+            section_data_offset as u32
+        );
+    }
+
+    // Managed-only pre-fill of .text (Task 3.2). No-op for native (clr_rva == 0).
+    // Data directories start at optional-header +96 on PE32, +112 on PE32+ —
+    // hardcoding +112 misreads the CLR RVA on a 32-bit image.
+    let dd_base = if get_u16(file_data, (pe_offset + 24) as u32) == 0x20B {
+        112
+    } else {
+        96
+    };
+    let clr_dir_rva = get_i32(file_data, pe_offset + 24 + dd_base + 14 * 8);
+    if clr_dir_rva != 0 {
+        let sh_start = get_u16(file_data, (pe_offset + 20) as u32) as i32 + pe_offset + 24;
+        for i in 0..section_count(file_data, pe_offset) {
+            let off = sh_start + i * 40;
+            if section_header_blank(file_data, off) {
+                break;
+            }
+            let sec_va = get_i32(file_data, off + 12);
+            let sec_vsize = get_i32(file_data, off + 8);
+            let sec_raw = get_i32(file_data, off + 20);
+            let sec_raw_size = get_i32(file_data, off + 16);
+            if clr_dir_rva >= sec_va && clr_dir_rva < sec_va + sec_vsize {
+                let avail = sec_raw_size.min(file_data.len() as i32 - sec_raw);
+                let copy_len = avail.min(out.len() as i32 - sec_va);
+                if copy_len > 0 {
+                    let s = sec_raw as usize;
+                    let dd = sec_va as usize;
+                    let n = copy_len as usize;
+                    out[dd..dd + n].copy_from_slice(&file_data[s..s + n]);
+                }
+                break;
+            }
+        }
+    }
+
+    decrypt_and_decompress_data(
+        &mut out,
+        original_file_data,
+        section_image_base,
+        section_data_offset,
+        &decrypt_func2,
+        &decomp_params,
+    )?;
+
+    let import_table_offset = get_i32(&out, addr5 + 12016);
+    if import_table_offset != 0 {
+        process_import_table(&mut out, import_table_offset);
+    }
+
+    out[..4096].copy_from_slice(&file_data[..4096]);
+    if verbose {
+        println!("[9/9] Fixing up PE header & section table...");
+    }
+
+    let section_header_base = get_u16(file_data, (pe_offset + 20) as u32) as i32 + pe_offset;
+    let section_start = section_header_base + 24;
+    let image_data_addr = get_i32(original_file_data, section_start - 128);
+    let image_data_size = get_i32(original_file_data, section_start - 124);
+
+    let mut entry_point_adjustment = 0i32;
+    {
+        for i in 0..section_count(file_data, pe_offset) {
+            let offset = section_start + i * 40;
+            if section_header_blank(file_data, offset) {
+                break;
+            }
+            let virtual_size = get_i32(file_data, offset + 8);
+            let virtual_addr = get_i32(file_data, offset + 12);
+            let raw_data_offset = get_i32(file_data, offset + 20);
+
+            if image_data_addr >= virtual_addr
+                && image_data_addr + image_data_size <= virtual_addr + virtual_size
+            {
+                entry_point_adjustment = raw_data_offset + image_data_addr - virtual_addr;
+            }
+
+            write_i32(&mut out, offset + 16, virtual_size);
+            write_i32(&mut out, offset + 20, virtual_addr);
+        }
+    }
+
+    if image_data_size != 0 {
+        let s = entry_point_adjustment as usize;
+        let dd = image_data_addr as usize;
+        let n = image_data_size as usize;
+        out[dd..dd + n].copy_from_slice(&file_data[s..s + n]);
+    }
+
+    // Managed-only CLR header recopy (Task 3.2). No-op for native.
+    let clr_rva = get_i32(file_data, pe_offset + 24 + dd_base + 14 * 8);
+    let clr_size = get_i32(file_data, pe_offset + 24 + dd_base + 14 * 8 + 4);
+    if clr_rva != 0 && clr_size != 0 {
+        for i in 0..section_count(file_data, pe_offset) {
+            let offset = section_start + i * 40;
+            if section_header_blank(file_data, offset) {
+                break;
+            }
+            let sec_va = get_i32(file_data, offset + 12);
+            let sec_raw = get_i32(file_data, offset + 20);
+            let sec_vsize = get_i32(file_data, offset + 8);
+            if clr_rva >= sec_va && clr_rva + clr_size <= sec_va + sec_vsize {
+                let clr_file_off = sec_raw + (clr_rva - sec_va);
+                let s = clr_file_off as usize;
+                let dd = clr_rva as usize;
+                let n = clr_size as usize;
+                out[dd..dd + n].copy_from_slice(&file_data[s..s + n]);
+                break;
+            }
+        }
+    }
+
+    decrypt_data6_shift6(&mut out, keys[3] + 16, 656);
+    let pe_offset2 = get_i32(&out, 60);
+    let final_size_of_image = get_i32(&out, keys[3] + 32);
+    write_i32(&mut out, pe_offset2 + 40, final_size_of_image);
+    {
+        let s = (keys[3] + 48) as usize;
+        let dd = (pe_offset2 + 136) as usize;
+        out.copy_within(s..s + 128, dd);
+    }
+
+    Ok(out)
+}

src/unpacker/integrity.rs

@@ -0,0 +1,365 @@
+//! Static sanity check for unpacked PE images.
+//!
+//! The unpack pipelines can succeed structurally (no error, no panic) yet emit
+//! a binary the OS loader rejects at runtime with `0xC0000005`
+//! (STATUS_ACCESS_VIOLATION) — e.g. when the entry-point stub or import strings
+//! were left encrypted because a layout heuristic picked the wrong offset. This
+//! module inspects the *output* bytes alone (no reference, no execution) and
+//! reports defects that are near-certain runtime crashes.
+//!
+//! It is intentionally conservative: it only flags conditions that cannot occur
+//! in a correctly unpacked image, so a clean report is not a guarantee of
+//! correctness, but a non-clean report is a reliable "this is broken" signal.
+//!
+//! All reads are bounds-checked; the check never panics on any input.
+
+/// Result of a static integrity check over an unpacked image.
+#[derive(Debug, Clone, Default)]
+pub struct IntegrityReport {
+    /// Each entry describes one detected defect. Empty means no defect found.
+    pub issues: Vec<String>,
+}
+
+impl IntegrityReport {
+    /// True when no defects were detected.
+    pub fn ok(&self) -> bool {
+        self.issues.is_empty()
+    }
+}
+
+// `checked_add`, not `+`: `usize` is 32-bit on wasm32, so a header-derived
+// offset near `u32::MAX` would wrap the range and panic (`start > end`) in a
+// module documented never to panic on any input.
+fn rd_u16(d: &[u8], off: u32) -> Option<u16> {
+    let i = off as usize;
+    d.get(i..i.checked_add(2)?)
+        .map(|s| u16::from_le_bytes([s[0], s[1]]))
+}
+
+fn rd_u32(d: &[u8], off: u32) -> Option<u32> {
+    let i = off as usize;
+    d.get(i..i.checked_add(4)?)
+        .map(|s| u32::from_le_bytes([s[0], s[1], s[2], s[3]]))
+}
+
+/// A parsed section-table entry (only the fields we translate against).
+struct Section {
+    va: u32,
+    vsize: u32,
+    raw_ptr: u32,
+    raw_size: u32,
+    chars: u32,
+}
+
+/// Walk the output's own section table and translate an RVA to a file offset.
+/// Works for both memory-image output (raw_ptr == va) and compacted disk
+/// output (real raw pointers), because it consults whatever the output declares.
+/// Returns the offset only if the translated range `[off, off+need)` lies inside
+/// the file.
+fn rva_to_off(secs: &[Section], file_len: usize, rva: u32, need: u32) -> Option<u32> {
+    for s in secs {
+        // The mapped span is the larger of virtual and raw size, so an RVA that
+        // falls in the virtual tail of a section still resolves.
+        let span = s.vsize.max(s.raw_size);
+        if span == 0 {
+            continue;
+        }
+        if rva >= s.va && rva < s.va.wrapping_add(span) {
+            let delta = rva - s.va;
+            let off = s.raw_ptr.checked_add(delta)?;
+            let end = off.checked_add(need)?;
+            if (end as usize) <= file_len {
+                return Some(off);
+            }
+            return None;
+        }
+    }
+    None
+}
+
+/// Inspect an unpacked PE image and report any defect that would make the OS
+/// loader fault at runtime. `out` is the bytes the unpacker produced.
+pub fn check(out: &[u8]) -> IntegrityReport {
+    let mut r = IntegrityReport::default();
+    let file_len = out.len();
+
+    // --- DOS + PE headers ---------------------------------------------------
+    if rd_u16(out, 0) != Some(0x5A4D) {
+        r.issues.push("missing 'MZ' DOS signature".into());
+        return r; // nothing else is meaningful
+    }
+    let pe_off = match rd_u32(out, 0x3C) {
+        Some(v) => v,
+        None => {
+            r.issues.push("truncated DOS header (no e_lfanew)".into());
+            return r;
+        }
+    };
+    if rd_u32(out, pe_off) != Some(0x0000_4550) {
+        r.issues
+            .push(format!("missing 'PE\\0\\0' signature at 0x{pe_off:X}"));
+        return r;
+    }
+
+    let num_sections = match rd_u16(out, pe_off.wrapping_add(6)) {
+        Some(v) => v as u32,
+        None => {
+            r.issues.push("truncated COFF header".into());
+            return r;
+        }
+    };
+    let opt_hdr_size = rd_u16(out, pe_off.wrapping_add(20)).unwrap_or(0) as u32;
+    let opt = pe_off.wrapping_add(24);
+    let magic = match rd_u16(out, opt) {
+        Some(v) => v,
+        None => {
+            r.issues.push("truncated optional header".into());
+            return r;
+        }
+    };
+    let is64 = match magic {
+        0x20B => true,
+        0x10B => false,
+        other => {
+            r.issues
+                .push(format!("bad optional-header magic 0x{other:X}"));
+            return r;
+        }
+    };
+
+    if num_sections == 0 || num_sections > 96 {
+        r.issues
+            .push(format!("implausible section count {num_sections}"));
+    }
+
+    let size_of_image = rd_u32(out, pe_off.wrapping_add(80)).unwrap_or(0);
+    if size_of_image == 0 {
+        r.issues.push("SizeOfImage is zero".into());
+    }
+
+    // --- Section table ------------------------------------------------------
+    let sec_table = opt.wrapping_add(opt_hdr_size);
+    let mut secs: Vec<Section> = Vec::new();
+    for i in 0..num_sections {
+        let base = sec_table.wrapping_add(i * 40);
+        // If the table runs past EOF the image is structurally broken.
+        let (vsize, va, raw_size, raw_ptr, chars) = match (
+            rd_u32(out, base.wrapping_add(8)),
+            rd_u32(out, base.wrapping_add(12)),
+            rd_u32(out, base.wrapping_add(16)),
+            rd_u32(out, base.wrapping_add(20)),
+            rd_u32(out, base.wrapping_add(36)),
+        ) {
+            (Some(a), Some(b), Some(c), Some(d), Some(e)) => (a, b, c, d, e),
+            _ => {
+                r.issues
+                    .push("section table extends past end of file".into());
+                return r;
+            }
+        };
+        // Raw data must lie within the file for compacted (disk-layout) output.
+        if raw_size != 0 {
+            let end = raw_ptr.wrapping_add(raw_size) as usize;
+            if end > file_len {
+                r.issues.push(format!(
+                    "section #{i} raw data [0x{raw_ptr:X}..0x{end:X}] exceeds file size 0x{file_len:X}"
+                ));
+            }
+        }
+        secs.push(Section {
+            va,
+            vsize,
+            raw_ptr,
+            raw_size,
+            chars,
+        });
+    }
+
+    // --- Managed (CLR) detection ------------------------------------------
+    // The COR20 (CLR) data directory, when present and non-zero, marks a managed
+    // assembly. Such images are dispatched through the CLR (via the COR20 header
+    // + BSJB metadata), not the native loader, so the native-loader heuristics
+    // below (zeroed EP stub, encrypted first import name) do NOT apply: CrackProof
+    // legitimately leaves a managed DLL's native EP and import strings in a state
+    // the native loader would reject, and that state is preserved here.
+    // Detect it before the EP / import checks so we can scope them to native
+    // images only.
+    let clr_rva = rd_u32(
+        out,
+        opt.wrapping_add(if is64 { 112 } else { 96 })
+            .wrapping_add(14 * 8),
+    )
+    .unwrap_or(0);
+    let is_managed = clr_rva != 0;
+
+    // --- Native DLL relocatability ------------------------------------------
+    // A native DLL is almost always loaded at a non-preferred base, so a
+    // missing base-relocation directory (DD[5]) is a guaranteed crash on
+    // rebase — exactly the failure mode produced when an unpacker wrongly
+    // applies the /FIXED-EXE fixup (zero BaseReloc + DllCharacteristics) to a
+    // DLL. Managed assemblies are exempt: the CLR rebases nothing through the
+    // native table, and their golden outputs legitimately carry no DD[5].
+    let dd_base = opt.wrapping_add(if is64 { 112 } else { 96 });
+    let chars_coff = rd_u16(out, pe_off.wrapping_add(22)).unwrap_or(0);
+    let is_dll = (chars_coff & 0x2000) != 0;
+    if is_dll && !is_managed {
+        let reloc_rva = rd_u32(out, dd_base.wrapping_add(5 * 8)).unwrap_or(0);
+        if reloc_rva == 0 {
+            r.issues.push(
+                "native DLL has no base relocation table (DD[5] is zero) — will crash when loaded at a non-preferred base"
+                    .into(),
+            );
+        }
+    }
+
+    // --- Entry point --------------------------------------------------------
+    // An entry RVA that does not resolve to a section, or whose target bytes are
+    // all zero, is a guaranteed access violation the instant the loader jumps to
+    // it. A zeroed/encrypted entry stub is the classic broken-unpack symptom.
+    let ep = rd_u32(out, pe_off.wrapping_add(40)).unwrap_or(0);
+    if ep == 0 {
+        // A DLL may legitimately have no entry point; an EXE never does.
+        if !is_dll {
+            r.issues.push("entry point RVA is zero".into());
+        }
+    } else if !is_managed {
+        match rva_to_off(&secs, file_len, ep, 16) {
+            None => {
+                r.issues.push(format!(
+                    "entry point RVA 0x{ep:X} does not map into any section"
+                ));
+            }
+            Some(off) => {
+                let stub = &out[off as usize..off as usize + 16];
+                if stub.iter().all(|&b| b == 0) {
+                    r.issues.push(format!(
+                        "entry point at RVA 0x{ep:X} is all zeros (stub not recovered)"
+                    ));
+                } else if stub.iter().all(|&b| b == 0xCC) {
+                    // 16 bytes of int3 padding where the entry stub should be:
+                    // the stub region was never recovered, the loader walks
+                    // straight into a debug-break wall.
+                    r.issues.push(format!(
+                        "entry point at RVA 0x{ep:X} is all int3 padding (stub not recovered)"
+                    ));
+                }
+                // The entry must live in an executable section.
+                let exec = secs.iter().any(|s| {
+                    let span = s.vsize.max(s.raw_size);
+                    ep >= s.va && ep < s.va.wrapping_add(span) && (s.chars & 0x2000_0000) != 0
+                });
+                if !exec {
+                    r.issues.push(format!(
+                        "entry point RVA 0x{ep:X} is not in an executable section"
+                    ));
+                }
+            }
+        }
+    }
+
+    // --- Import table -------------------------------------------------------
+    // If an import directory is present, every descriptor's DLL name must be
+    // readable printable ASCII. Encrypted/garbage names mean import-string
+    // decryption failed, and the loader faults resolving them — checking only
+    // the first descriptor misses later ones still left as ciphertext. Skipped
+    // for managed assemblies (their import table is a CLR bootstrap stub the
+    // native loader doesn't resolve the same way). Note this no longer gates
+    // on NumberOfRvaAndSizes: a corrupt optional header shrinking that field
+    // must not silence the walk while a bogus import RVA still points at
+    // ciphertext.
+    if !is_managed {
+        let imp_rva = rd_u32(out, dd_base.wrapping_add(8)).unwrap_or(0);
+        if imp_rva != 0 {
+            match rva_to_off(&secs, file_len, imp_rva, 20) {
+                None => r.issues.push(format!(
+                    "import directory RVA 0x{imp_rva:X} does not map into any section"
+                )),
+                Some(desc_off) => {
+                    // 256 descriptors is far beyond any real import table; the
+                    // cap keeps a corrupt, never-null table from walking on.
+                    for i in 0..256u32 {
+                        let d_off = desc_off.wrapping_add(i.wrapping_mul(20));
+                        let name_rva = rd_u32(out, d_off.wrapping_add(12)).unwrap_or(0);
+                        // name_rva == 0 is the terminating null descriptor (or
+                        // a read past the table) — done.
+                        if name_rva == 0 {
+                            break;
+                        }
+                        match rva_to_off(&secs, file_len, name_rva, 1) {
+                            None => r.issues.push(format!(
+                                "import descriptor {i} DLL name RVA 0x{name_rva:X} does not map into any section"
+                            )),
+                            Some(noff) => {
+                                if !looks_like_dll_name(out, noff) {
+                                    r.issues.push(format!(
+                                        "import descriptor {i} DLL name at RVA 0x{name_rva:X} is not readable ASCII (imports left encrypted?)"
+                                    ));
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    // --- Managed (CLR) header + metadata ------------------------------------
+    // For a managed assembly the COR20 (CLR) header and the BSJB MetaData stream
+    // it points at must survive unpacking intact, or the runtime rejects the
+    // image with BadImageFormatException ("Invalid COR20 header signature" /
+    // bad metadata) before any code runs. CrackProof copies both regions through
+    // verbatim; a unpacker that lets the .text dd8 pass scribble over them (they
+    // live inside .text) produces a structurally-valid-looking PE that the CLR
+    // still refuses to load. Validate: COR20 cb == 0x48, and the MetaData stream
+    // begins with the "BSJB" signature.
+    if is_managed {
+        match rva_to_off(&secs, file_len, clr_rva, 0x48) {
+            None => r.issues.push(format!(
+                "CLR (COR20) directory RVA 0x{clr_rva:X} does not map into any section"
+            )),
+            Some(coff) => {
+                let cb = rd_u32(out, coff).unwrap_or(0);
+                if cb != 0x48 {
+                    r.issues.push(format!(
+                        "COR20 header at RVA 0x{clr_rva:X} has cb 0x{cb:X} (expected 0x48) — CLR header corrupt"
+                    ));
+                } else {
+                    // MetaData RVA/size live at COR20 + 0x08 / + 0x0C.
+                    let md_rva = rd_u32(out, coff.wrapping_add(8)).unwrap_or(0);
+                    if md_rva != 0 {
+                        match rva_to_off(&secs, file_len, md_rva, 4) {
+                            None => r.issues.push(format!(
+                                "CLR MetaData RVA 0x{md_rva:X} does not map into any section"
+                            )),
+                            Some(moff) => {
+                                let sig = out.get(moff as usize..moff as usize + 4);
+                                if sig != Some(b"BSJB") {
+                                    r.issues.push(format!(
+                                        "CLR MetaData at RVA 0x{md_rva:X} lacks 'BSJB' signature (metadata corrupt — managed image will not load)"
+                                    ));
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    r
+}
+
+/// True if the NUL-terminated string starting at `off` looks like a DLL name:
+/// at least one byte, all printable ASCII up to the NUL, within a sane length.
+fn looks_like_dll_name(d: &[u8], off: u32) -> bool {
+    let start = off as usize;
+    let mut end = start;
+    let limit = (start + 256).min(d.len());
+    while end < limit && d[end] != 0 {
+        end += 1;
+    }
+    if end == start || end >= limit {
+        return false; // empty, or no NUL within a sane window
+    }
+    d[start..end].iter().all(|&b| (0x20..0x7F).contains(&b))
+}

src/unpacker/mod.rs

@@ -0,0 +1,210 @@
+//! Pure, panic-free Crackproof unpacker core. No file I/O lives here.
+
+mod bytecode;
+mod crc32;
+pub mod dll;
+pub mod exe;
+pub mod integrity;
+pub(crate) mod parallel;
+pub(crate) mod primitives;
+mod tables;
+
+pub use dll::{unpack_dll, unpack_dll_v};
+pub use exe::{UnpackError, unpack as unpack_exe, unpack_v as unpack_exe_v};
+pub use integrity::{IntegrityReport, check as check_integrity};
+
+/// Maximum plausible PE `SizeOfImage` we are willing to allocate a zero buffer
+/// for. Guards against a corrupt/crafted header requesting a multi-gigabyte
+/// (or, as a sign-extended negative `i32`, multi-exabyte) allocation, which
+/// would abort the process — an abort that `catch_unpack` below cannot trap.
+/// Real protected binaries are far below this.
+pub(crate) const MAX_IMAGE_SIZE: u64 = 1 << 30; // 1 GiB
+
+/// Run an unpack pipeline, converting any internal panic into a clean
+/// [`UnpackError::Corrupt`] so the public API stays panic-free on any input
+/// (truncated/garbled files chase offsets out of bounds). The default panic
+/// hook is suppressed transiently so a trapped panic does not spill a
+/// backtrace to stderr.
+///
+/// Note: allocation *failures* abort the process and are NOT caught here; size
+/// requests are bounds-checked against [`MAX_IMAGE_SIZE`] before allocating.
+pub(crate) fn catch_unpack<F>(f: F) -> Result<Vec<u8>, UnpackError>
+where
+    F: FnOnce() -> Result<Vec<u8>, UnpackError>,
+{
+    // Hook suppression is skipped on wasm: the prebuilt std cannot unwind
+    // there, so a panic traps immediately — and the suppressed hook would
+    // hide the panic message, leaving a bare `unreachable` with no clue.
+    #[cfg(not(target_arch = "wasm32"))]
+    let prev = std::panic::take_hook();
+    #[cfg(not(target_arch = "wasm32"))]
+    std::panic::set_hook(Box::new(|_| {}));
+    let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(f));
+    #[cfg(not(target_arch = "wasm32"))]
+    std::panic::set_hook(prev);
+    r.unwrap_or(Err(UnpackError::Corrupt))
+}
+
+/// Crackproof header magic stored in `keys[1]`/`info[1]`.
+pub(crate) const MAGIC_KONN: u32 = 0x4E4E4F4B; // b"KONN" little-endian (= 1313754955)
+
+/// True if `magic` is the Crackproof magic this unpacker supports.
+pub(crate) fn is_supported_magic(magic: u32) -> bool {
+    magic == MAGIC_KONN
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Kind {
+    Exe,
+    NativeDll,
+    ManagedDll,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct Detected {
+    pub kind: Kind,
+    pub magic: u32,
+}
+
+// ---------------------------------------------------------------------------
+// Content-based detection
+// ---------------------------------------------------------------------------
+
+/// Derive the 8-element Crackproof key table from the header at offset 4096.
+/// Returns `None` if the input is too short or doesn't have a valid PE signature.
+fn key_table(input: &[u8]) -> Option<[u32; 8]> {
+    // Need at least 4128 bytes: the key-table loop below reads dwords up to
+    // offset 4124 (bytes 4124..4127). Guarding only `< 4096` would let a
+    // 4096..4127-byte PE (e.g. a 4 KiB stub) panic in `get_u32`.
+    if input.len() < 4128 {
+        return None;
+    }
+    // Validate PE signature. `checked_add`, not `+`: `usize` is 32-bit on
+    // wasm32, where an `e_lfanew` of 0xFFFF_FFFC..=0xFFFF_FFFF wraps the bound
+    // check, and the slice below then panics with start > end. `detect` runs on
+    // the folder-scan threads and (in the web app) on the main thread outside
+    // the disposable-worker isolation, so it must not panic on any input.
+    let e_lfanew = primitives::get_u32(input, 0x3C);
+    let pe_start = e_lfanew as usize;
+    if pe_start.checked_add(4).is_none_or(|end| end > input.len()) {
+        return None;
+    }
+    if &input[pe_start..pe_start + 4] != b"PE\0\0" {
+        return None;
+    }
+    // Derive 8 keys per the Crackproof header-key formula.
+    let mut keys = [0u32; 8];
+    keys[0] = primitives::get_u32(input, 4096);
+    let mut k = keys[0];
+    for i in 0u32..7 {
+        let cell = primitives::get_u32(input, 4100u32.wrapping_add(i.wrapping_mul(4)));
+        keys[(i + 1) as usize] = k ^ cell;
+        k = i.wrapping_mul(i) ^ (k.wrapping_add(cell).wrapping_sub(i));
+    }
+    Some(keys)
+}
+
+/// Detect whether `input` is a Crackproof-protected binary and classify it.
+/// Returns `None` if the magic doesn't match.
+///
+/// Routing: `keys[1]` must be the Crackproof magic (`KONN`).
+/// The PE IMAGE_FILE_DLL characteristic distinguishes EXE vs DLL;
+/// the CLR data-directory RVA further distinguishes ManagedDll from NativeDll.
+pub fn detect(input: &[u8]) -> Option<Detected> {
+    let keys = key_table(input)?;
+    let magic = keys[1];
+    // Anything whose magic doesn't match is left untouched rather than
+    // detected-then-errored, honoring the "anything that doesn't match is
+    // left untouched" contract.
+    if !is_supported_magic(magic) {
+        return None;
+    }
+    // Use the PE DLL characteristic to distinguish EXE from DLL.
+    // IMAGE_FILE_HEADER.Characteristics is at peOff+4+18; bit 0x2000 = IMAGE_FILE_DLL.
+    let pe_off = primitives::get_u32(input, 0x3C);
+    let chars_offset = pe_off.wrapping_add(4).wrapping_add(18);
+    if (chars_offset as usize)
+        .checked_add(2)
+        .is_none_or(|end| end > input.len())
+    {
+        return None;
+    }
+    let chars =
+        (input[chars_offset as usize] as u16) | ((input[chars_offset as usize + 1] as u16) << 8);
+    let is_dll = (chars & 0x2000) != 0;
+    if !is_dll {
+        return Some(Detected {
+            kind: Kind::Exe,
+            magic,
+        });
+    }
+    // DLL: determine managed vs native via CLR data-directory RVA.
+    // peOff + 24 = start of optional header. The data directories start at a
+    // magic-dependent offset within it: PE32 (0x10B) at +96, PE32+ (0x20B) at
+    // +112. Using the PE32+ offset on a PE32 image reads the wrong dword and
+    // can mis-flag a native DLL as managed.
+    //
+    // `get_u16`/`get_u32` index unchecked, so every read past the already-
+    // checked Characteristics word must be bounds-checked first: a truncated
+    // DLL (e.g. `e_lfanew` pointing at len-24) would otherwise panic here,
+    // and this detector runs on the folder scan threads where a panic aborts
+    // the whole run.
+    let opt_magic_off = pe_off.wrapping_add(24) as usize;
+    let b = input.get(opt_magic_off..opt_magic_off.checked_add(2)?)?;
+    let opt_magic = u16::from_le_bytes([b[0], b[1]]);
+    let dd_off: u32 = if opt_magic == 0x20B { 112 } else { 96 };
+    // + 14*8 = IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
+    let clr_rva_offset = pe_off
+        .wrapping_add(24)
+        .wrapping_add(dd_off)
+        .wrapping_add(14u32.wrapping_mul(8));
+    if (clr_rva_offset as usize)
+        .checked_add(4)
+        .is_none_or(|end| end > input.len())
+    {
+        return None;
+    }
+    let clr_rva = primitives::get_u32(input, clr_rva_offset);
+    let kind = if clr_rva != 0 {
+        Kind::ManagedDll
+    } else {
+        Kind::NativeDll
+    };
+    Some(Detected { kind, magic })
+}
+
+/// Detect the file type and dispatch to the matching pipeline.
+/// Returns the detected `Kind` together with the unpacked image bytes.
+pub fn unpack_auto(input: &[u8]) -> Result<(Kind, Vec<u8>), UnpackError> {
+    unpack_auto_v(input, false)
+}
+
+/// Like [`unpack_auto`], but prints detailed `[N/9]` unpack-step progress to
+/// stdout when `verbose` is true. Output bytes are identical regardless.
+pub fn unpack_auto_v(input: &[u8], verbose: bool) -> Result<(Kind, Vec<u8>), UnpackError> {
+    let detected = detect(input).ok_or(UnpackError::NotCrackproof)?;
+    let out = match detected.kind {
+        Kind::Exe => unpack_exe_v(input, verbose)?,
+        Kind::NativeDll | Kind::ManagedDll => {
+            // Two Crackproof DLL layouts exist. The older one (the byte-identical
+            // DLL goldens) follows the pipeline in `dll.rs`. Newer builds protect
+            // DLLs with the EXE-style shell layout instead — `dll::unpack_dll`
+            // cannot parse them and errors. Try the DLL pipeline first; on
+            // failure, fall back to the EXE pipeline, which handles the new
+            // layout (including managed-DLL CLR metadata restore). The DLL-first
+            // order keeps the old-layout goldens byte-identical (the EXE
+            // pipeline "succeeds" on them but with different bytes).
+            match dll::unpack_dll_v(input, verbose) {
+                Ok(out) => out,
+                Err(dll_err) => match exe::unpack_v(input, verbose) {
+                    Ok(out) => out,
+                    // Surface the DLL-pipeline error, not the EXE one: for a
+                    // genuinely corrupt DLL the DLL error is the more relevant
+                    // diagnostic, and the EXE fallback is best-effort.
+                    Err(_) => return Err(dll_err),
+                },
+            }
+        }
+    };
+    Ok((detected.kind, out))
+}

src/unpacker/parallel.rs

@@ -0,0 +1,227 @@
+//! Deterministic block-parallel fan-out for the section decrypt/decompress
+//! loops.
+//!
+//! Each block writes a disjoint output span and reads only immutable input plus
+//! snapshotted key tables, so distributing blocks across worker threads
+//! produces byte-identical output regardless of thread count or scheduling.
+//!
+//! # Soundness
+//!
+//! This module contains **no `unsafe`**. The output buffer is carved into the
+//! per-block spans with safe `split_at_mut` chains, so Rust itself guarantees
+//! no two workers can hold aliasing `&mut` slices — an earlier version handed
+//! every worker a whole-buffer `&mut [u8]` reconstructed from a raw pointer,
+//! which is UB under Stacked/Tree Borrows even when the concrete writes never
+//! overlap. The shared data the blocks read (AES key schedule, Huffman table)
+//! is copied out by the caller before the fan-out and captured by the closure,
+//! so no shared borrow of the output buffer is needed either.
+
+use std::sync::Mutex;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+/// Worker-thread cap. `SENBEI_THREADS` overrides it (`1` forces the sequential
+/// path); otherwise the host's available parallelism; otherwise 1.
+pub(crate) fn thread_cap() -> usize {
+    if let Ok(v) = std::env::var("SENBEI_THREADS")
+        && let Ok(n) = v.trim().parse::<usize>()
+        && n >= 1
+    {
+        return n;
+    }
+    std::thread::available_parallelism()
+        .map(|n| n.get())
+        .unwrap_or(1)
+}
+
+/// Run `f(i, span_base, span)` for every block `i`, fanning out across worker
+/// threads when the spans are disjoint and worthwhile, else sequentially.
+///
+/// `spans[i]` is the `[start, end)` region of `buf` block `i` writes. The
+/// closure receives `span_base = spans[i].0` and the disjoint
+/// `&mut buf[start..end]`; any shared data it needs must be captured by value
+/// before the call. When the spans overlap (only possible on corrupt input),
+/// the whole thing degrades to a sequential whole-buffer pass (`span_base = 0`,
+/// `span = buf`), which preserves the deterministic last-writer-wins behavior
+/// the pipeline had before parallelization.
+///
+/// Returns the first `Err` any block produces; re-raises the first block panic
+/// on the calling thread (so the pipeline's existing `catch_unpack` still
+/// converts it to `UnpackError::Corrupt`).
+pub(crate) fn parallel_for<E, F>(
+    buf: &mut [u8],
+    spans: &[(usize, usize)],
+    min_per_thread: usize,
+    f: F,
+) -> Result<(), E>
+where
+    E: Send,
+    F: Fn(usize, usize, &mut [u8]) -> Result<(), E> + Sync,
+{
+    let n = spans.len();
+    if n == 0 {
+        return Ok(());
+    }
+
+    // Verify the spans are in-bounds and mutually disjoint. Overlapping spans
+    // only arise from corrupt block descriptors; the sequential whole-buffer
+    // fallback handles them exactly as the pre-parallel pipeline did.
+    let mut sorted: Vec<(u64, u64)> = spans.iter().map(|&(s, e)| (s as u64, e as u64)).collect();
+    let in_bounds = spans.iter().all(|&(s, e)| s <= e && e <= buf.len());
+    let disjoint = in_bounds && spans_disjoint(&mut sorted);
+
+    if !disjoint {
+        for i in 0..n {
+            f(i, 0, &mut *buf)?;
+        }
+        return Ok(());
+    }
+
+    // Carve the disjoint span pieces out of `buf` with safe splits. Rust's
+    // borrow checker proves the pieces never alias.
+    //
+    // Sort by the whole span, not just its start: `spans_disjoint` compares
+    // `(start, end)` tuples, so it accepts an empty span that shares a start
+    // with a non-empty one (`(100,100)` and `(100,200)`). Ordering by start
+    // alone would then carve them in input order, and a `(100,100)` arriving
+    // after `(100,200)` makes `s - base` underflow — a panic instead of the
+    // documented degrade-to-sequential fallback.
+    let mut order: Vec<usize> = (0..n).collect();
+    order.sort_by_key(|&i| spans[i]);
+    let mut pieces: Vec<Option<&mut [u8]>> = Vec::new();
+    pieces.resize_with(n, || None);
+    {
+        let mut rest: &mut [u8] = buf;
+        let mut base = 0usize;
+        for &i in &order {
+            let (s, e) = spans[i];
+            let (_, tail) = rest.split_at_mut(s - base);
+            let (piece, tail2) = tail.split_at_mut(e - s);
+            pieces[i] = Some(piece);
+            rest = tail2;
+            base = e;
+        }
+    }
+
+    let cap = thread_cap();
+    let per = min_per_thread.max(1);
+    let workers = if cap > 1 && n >= per.saturating_mul(2) {
+        cap.min(n / per)
+    } else {
+        1
+    };
+
+    if workers <= 1 {
+        // Fully safe baseline: sequential on the current thread; panics and
+        // `Err`s propagate exactly as they did before parallelization.
+        for (i, piece) in pieces.into_iter().enumerate() {
+            f(i, spans[i].0, piece.unwrap())?;
+        }
+        return Ok(());
+    }
+
+    // Hand each span piece to exactly one worker through a shared iterator:
+    // the `&mut [u8]` is moved, never aliased.
+    let iter = Mutex::new(pieces.into_iter().enumerate());
+    let stop = AtomicBool::new(false);
+    let first_err: Mutex<Option<E>> = Mutex::new(None);
+    let first_panic: Mutex<Option<Box<dyn std::any::Any + Send>>> = Mutex::new(None);
+
+    std::thread::scope(|scope| {
+        for _ in 0..workers {
+            let iter = &iter;
+            let stop = &stop;
+            let first_err = &first_err;
+            let first_panic = &first_panic;
+            let f = &f;
+            scope.spawn(move || {
+                loop {
+                    if stop.load(Ordering::Relaxed) {
+                        break;
+                    }
+                    let next = iter.lock().unwrap().next();
+                    let Some((i, piece)) = next else { break };
+                    let span = piece.unwrap();
+                    let r = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+                        f(i, spans[i].0, span)
+                    }));
+                    match r {
+                        Ok(Ok(())) => {}
+                        Ok(Err(e)) => {
+                            let mut slot = first_err.lock().unwrap();
+                            if slot.is_none() {
+                                *slot = Some(e);
+                            }
+                            stop.store(true, Ordering::Relaxed);
+                            break;
+                        }
+                        Err(panic) => {
+                            let mut slot = first_panic.lock().unwrap();
+                            if slot.is_none() {
+                                *slot = Some(panic);
+                            }
+                            stop.store(true, Ordering::Relaxed);
+                            break;
+                        }
+                    }
+                }
+            });
+        }
+    });
+
+    if let Some(panic) = first_panic.into_inner().unwrap() {
+        std::panic::resume_unwind(panic);
+    }
+    match first_err.into_inner().unwrap() {
+        Some(e) => Err(e),
+        None => Ok(()),
+    }
+}
+
+/// True if the half-open spans are mutually disjoint. Spans are
+/// `[write_base, write_base + max(compressed_len, decompressed_len))` so a block
+/// whose decompressed output exceeds its compressed size is fully covered. A
+/// conservative (larger) span can only push a borderline case onto the safe
+/// sequential path, never the reverse, so it cannot change output.
+pub(crate) fn spans_disjoint(spans: &mut [(u64, u64)]) -> bool {
+    spans.sort_unstable();
+    for w in spans.windows(2) {
+        if w[1].0 < w[0].1 {
+            return false;
+        }
+    }
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Review regression: an empty span sharing a start with a non-empty one
+    /// passes `spans_disjoint` (it genuinely overlaps nothing), so the carve
+    /// runs. Ordering the carve by start alone put `(100,100)` after
+    /// `(100,200)` — `s - base` then underflowed and panicked instead of doing
+    /// the work. Reachable from a corrupt descriptor chain whose block size is
+    /// negative and whose expected length is zero.
+    #[test]
+    fn carves_empty_span_sharing_a_start() {
+        let mut buf = vec![0u8; 512];
+        // Non-empty span first in input order, empty span second: the order
+        // that used to underflow.
+        let spans = [(100usize, 200usize), (100, 100)];
+        let seen: Mutex<Vec<(usize, usize, usize)>> = Mutex::new(Vec::new());
+        let r: Result<(), ()> = parallel_for(&mut buf, &spans, 1, |i, base, span| {
+            seen.lock().unwrap().push((i, base, span.len()));
+            for b in span.iter_mut() {
+                *b = 0xAB;
+            }
+            Ok(())
+        });
+        assert!(r.is_ok());
+        let mut seen = seen.into_inner().unwrap();
+        seen.sort_unstable();
+        assert_eq!(seen, vec![(0, 100, 100), (1, 100, 0)]);
+        assert!(buf[100..200].iter().all(|&b| b == 0xAB));
+        assert!(buf[..100].iter().all(|&b| b == 0));
+        assert!(buf[200..].iter().all(|&b| b == 0));
+    }
+}

src/unpacker/tables.rs

@@ -0,0 +1,161 @@
+//! AES inverse tables (inverse S-box + InvMixColumns "Td" T-tables), generated
+//! at compile time from GF(2^8) arithmetic rather than embedded as a transcribed
+//! blob. These are the standard AES *decryption* tables — not proprietary data —
+//! so we derive them. The generated bytes are verified byte-identical to the
+//! original hand-transcribed arrays (CRC32-locked in the test at the bottom).
+//!
+//! Each table is 1024 bytes = 256 u32 little-endian, read by
+//! `primitives::aes_round` via `get_u32(&TABLE, x * 4)`. The byte layout matches
+//! the original exactly, so `aes_round` is unchanged:
+//!   SBOX[x]       = invsbox(x) broadcast to 4 bytes
+//!   COLUMMIX1[x]  = [0b*s, 0d*s, 09*s, 0e*s], s = invsbox(x)  (Td0, this byte order)
+//!   COLUMMIX2/3/4 = COLUMMIX1's 4-byte group rotated left by 1 / 2 / 3 bytes
+//!
+//! Generated the same way as the existing `const fn` CRC-table generation in
+//! `crc32.rs`.
+
+/// GF(2^8) multiply with the AES reduction polynomial (x^8 + x^4 + x^3 + x + 1).
+const fn gf_mul(mut a: u8, mut b: u8) -> u8 {
+    let mut p: u8 = 0;
+    let mut i = 0;
+    while i < 8 {
+        if b & 1 != 0 {
+            p ^= a;
+        }
+        let hi = a & 0x80;
+        a <<= 1;
+        if hi != 0 {
+            a ^= 0x1B;
+        }
+        b >>= 1;
+        i += 1;
+    }
+    p
+}
+
+/// The AES inverse S-box, derived from the multiplicative inverse in GF(2^8)
+/// followed by inverting the forward S-box's affine transform.
+const fn inv_sbox() -> [u8; 256] {
+    // Multiplicative inverse: inv[a] = b such that a*b == 1 (inv[0] stays 0).
+    let mut inv = [0u8; 256];
+    let mut a = 1usize;
+    while a < 256 {
+        let mut b = 1usize;
+        while b < 256 {
+            if gf_mul(a as u8, b as u8) == 1 {
+                inv[a] = b as u8;
+                break;
+            }
+            b += 1;
+        }
+        a += 1;
+    }
+    // Forward S-box: affine transform over the inverse.
+    let mut sb = [0u8; 256];
+    let mut i = 0usize;
+    while i < 256 {
+        let mut x = inv[i];
+        let mut s = inv[i];
+        let mut r = 0;
+        while r < 4 {
+            s = s.rotate_left(1);
+            x ^= s;
+            r += 1;
+        }
+        sb[i] = x ^ 0x63;
+        i += 1;
+    }
+    // Inverse S-box is the inverse permutation of the forward S-box.
+    let mut isb = [0u8; 256];
+    let mut i = 0usize;
+    while i < 256 {
+        isb[sb[i] as usize] = i as u8;
+        i += 1;
+    }
+    isb
+}
+
+/// The five generated tables (each 1024 bytes = 256 u32 LE).
+struct AesTables {
+    cm1: [u8; 1024],
+    cm2: [u8; 1024],
+    cm3: [u8; 1024],
+    cm4: [u8; 1024],
+    sbox: [u8; 1024],
+}
+
+/// Build all five tables in one compile-time pass.
+const fn build_tables() -> AesTables {
+    let isb = inv_sbox();
+    let mut cm1 = [0u8; 1024];
+    let mut cm2 = [0u8; 1024];
+    let mut cm3 = [0u8; 1024];
+    let mut cm4 = [0u8; 1024];
+    let mut sbox = [0u8; 1024];
+    let mut x = 0usize;
+    while x < 256 {
+        let s = isb[x];
+        // SBOX: invsbox(x) broadcast to all four lanes.
+        let mut j = 0;
+        while j < 4 {
+            sbox[x * 4 + j] = s;
+            j += 1;
+        }
+        // COLUMMIX1 lane bytes; CM2/3/4 are byte-rotations of the same four.
+        let b = [
+            gf_mul(0x0b, s),
+            gf_mul(0x0d, s),
+            gf_mul(0x09, s),
+            gf_mul(0x0e, s),
+        ];
+        let mut j = 0;
+        while j < 4 {
+            cm1[x * 4 + j] = b[j];
+            cm2[x * 4 + j] = b[(j + 1) % 4];
+            cm3[x * 4 + j] = b[(j + 2) % 4];
+            cm4[x * 4 + j] = b[(j + 3) % 4];
+            j += 1;
+        }
+        x += 1;
+    }
+    AesTables {
+        cm1,
+        cm2,
+        cm3,
+        cm4,
+        sbox,
+    }
+}
+
+const TABLES: AesTables = build_tables();
+
+pub static COLUMMIX1: [u8; 1024] = TABLES.cm1;
+pub static COLUMMIX2: [u8; 1024] = TABLES.cm2;
+pub static COLUMMIX3: [u8; 1024] = TABLES.cm3;
+pub static COLUMMIX4: [u8; 1024] = TABLES.cm4;
+pub static SBOX: [u8; 1024] = TABLES.sbox;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Lock the generated tables to the original hand-transcribed bytes. The
+    /// CRC32 oracles were computed from the previously-committed `tables.rs`
+    /// arrays; any drift in the generator (or the GF math) fails here before it
+    /// can reach the byte-identical corpus goldens.
+    #[test]
+    fn generated_tables_match_committed_bytes() {
+        assert_eq!(COLUMMIX1.len(), 1024);
+        assert_eq!(super::super::crc32::compute(&COLUMMIX1), 0x7e8d_5d5f);
+        assert_eq!(super::super::crc32::compute(&COLUMMIX2), 0xfcc4_acfc);
+        assert_eq!(super::super::crc32::compute(&COLUMMIX3), 0x637a_f0cd);
+        assert_eq!(super::super::crc32::compute(&COLUMMIX4), 0x1e7b_c381);
+        assert_eq!(super::super::crc32::compute(&SBOX), 0x10fd_6dc1);
+        // Spot-check the first dword of each (matches the original first row).
+        assert_eq!(&COLUMMIX1[..4], &[0x50, 0xa7, 0xf4, 0x51]);
+        assert_eq!(&COLUMMIX2[..4], &[0xa7, 0xf4, 0x51, 0x50]);
+        assert_eq!(&COLUMMIX3[..4], &[0xf4, 0x51, 0x50, 0xa7]);
+        assert_eq!(&COLUMMIX4[..4], &[0x51, 0x50, 0xa7, 0xf4]);
+        assert_eq!(&SBOX[..4], &[0x52, 0x52, 0x52, 0x52]);
+    }
+}

tests/common/mod.rs

@@ -0,0 +1,10 @@
+//! Shared test fixtures.
+#![allow(dead_code)]
+
+use std::path::PathBuf;
+
+/// Path to `senbei/samples` — the user-managed corpus dropped in by hand.
+/// Git-ignored except its README; tests here run against whatever is present.
+pub fn samples_dir() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("samples")
+}

tests/job.rs

@@ -0,0 +1,31 @@
+use senbei::job::{default_out_root_for_file, out_name};
+use std::path::Path;
+
+#[test]
+fn out_name_inserts_unpack_before_last_dot() {
+    assert_eq!(out_name(Path::new("foo.exe")), Path::new("foo.unpack.exe"));
+    assert_eq!(
+        out_name(Path::new("a/b/bar.dll")),
+        Path::new("a/b/bar.unpack.dll")
+    );
+    assert_eq!(out_name(Path::new("x.y.dll")), Path::new("x.y.unpack.dll"));
+}
+
+#[test]
+fn out_name_no_dot_appends_unpack() {
+    assert_eq!(out_name(Path::new("nodot")), Path::new("nodot.unpack"));
+}
+
+#[test]
+fn default_out_root_for_file_is_parent_unpack() {
+    assert_eq!(
+        default_out_root_for_file(Path::new("a/b/foo.exe")),
+        Path::new("a/b/unpack")
+    );
+}
+
+#[test]
+fn default_out_root_for_file_cwd_when_no_parent() {
+    let p = default_out_root_for_file(Path::new("foo.exe"));
+    assert_eq!(p, Path::new(".").join("unpack"));
+}

tests/logfile.rs

@@ -0,0 +1,47 @@
+use senbei::logfile::{Log, local_stamp_compact, local_stamp_display};
+
+#[test]
+fn local_stamp_compact_matches_shape() {
+    let s = local_stamp_compact();
+    // YYYYMMDD-HHMMSS → 15 chars, digit groups around dash
+    assert_eq!(s.len(), 15, "got {s}");
+    assert_eq!(&s[8..9], "-");
+    assert!(s.as_bytes().iter().enumerate().all(|(i, b)| {
+        if i == 8 {
+            *b == b'-'
+        } else {
+            b.is_ascii_digit()
+        }
+    }));
+}
+
+#[test]
+fn local_stamp_display_matches_shape() {
+    let s = local_stamp_display();
+    // YYYY-MM-DD HH:MM:SS → 19 chars
+    assert_eq!(s.len(), 19, "got {s}");
+    assert_eq!(&s[4..5], "-");
+    assert_eq!(&s[7..8], "-");
+    assert_eq!(&s[10..11], " ");
+    assert_eq!(&s[13..14], ":");
+    assert_eq!(&s[16..17], ":");
+}
+
+#[test]
+fn log_writes_timestamped_file_in_target_dir() {
+    let td = tempfile::tempdir().unwrap();
+    let log = Log::create(td.path()).unwrap();
+    log.step("hello");
+    let path = log.path().to_path_buf();
+    drop(log);
+    assert!(path.starts_with(td.path()));
+    let name = path.file_name().unwrap().to_string_lossy();
+    assert!(
+        name.starts_with("senbei-") && name.ends_with(".log"),
+        "unexpected log name: {name}"
+    );
+    // senbei-YYYYMMDD-HHMMSS.log
+    let core = name.trim_start_matches("senbei-").trim_end_matches(".log");
+    assert_eq!(core.len(), 15, "stamp in name: {name}");
+    assert!(std::fs::read_to_string(&path).unwrap().contains("hello"));
+}

tests/run_log.rs

@@ -0,0 +1,80 @@
+use senbei::job;
+use std::path::Path;
+
+fn list_logs(dir: &Path) -> Vec<std::path::PathBuf> {
+    std::fs::read_dir(dir)
+        .into_iter()
+        .flatten()
+        .filter_map(|e| e.ok())
+        .map(|e| e.path())
+        .filter(|p| {
+            p.file_name()
+                .and_then(|n| n.to_str())
+                .map(|n| n.starts_with("senbei-") && n.ends_with(".log"))
+                .unwrap_or(false)
+        })
+        .collect()
+}
+
+#[test]
+fn run_file_no_log_creates_no_logfile() {
+    let td = tempfile::tempdir().unwrap();
+    let input = td.path().join("not_crackproof.bin");
+    std::fs::write(&input, b"not a pe").unwrap();
+    let out = td.path().join("out");
+    let s = job::run_file_v(&input, Some(&out), 2, false, true).unwrap();
+    assert_eq!(s.errors, 1);
+    // With no_log, no senbei-*.log under out (even if the dir was created).
+    assert!(list_logs(&out).is_empty());
+}
+
+#[test]
+fn run_file_writes_log_under_out_with_header_footer() {
+    let td = tempfile::tempdir().unwrap();
+    let input = td.path().join("not_crackproof.bin");
+    std::fs::write(&input, b"not a pe").unwrap();
+    let out = td.path().join("out");
+    let s = job::run_file_v(&input, Some(&out), 2, false, false).unwrap();
+    assert_eq!(s.errors, 1);
+    let logs = list_logs(&out);
+    assert_eq!(logs.len(), 1, "expected one log under out, got {logs:?}");
+    let text = std::fs::read_to_string(&logs[0]).unwrap();
+    assert!(text.contains("Senbei "), "header version: {text}");
+    assert!(text.contains("started "), "{text}");
+    assert!(text.contains("input "), "{text}");
+    assert!(text.contains("out "), "{text}");
+    assert!(text.contains("ERR "), "{text}");
+    assert!(text.contains("done in "), "{text}");
+    assert!(text.contains("summary:"), "{text}");
+}
+
+#[test]
+fn run_file_default_out_root_is_parent_unpack() {
+    let td = tempfile::tempdir().unwrap();
+    let input = td.path().join("not_crackproof.bin");
+    std::fs::write(&input, b"not a pe").unwrap();
+    let _ = job::run_file_v(&input, None, 2, false, false).unwrap();
+    let unpack = td.path().join("unpack");
+    assert!(unpack.is_dir());
+    assert_eq!(list_logs(&unpack).len(), 1);
+    // log must NOT be next to input's parent root without unpack
+    assert!(list_logs(td.path()).is_empty());
+}
+
+#[test]
+fn run_folder_log_lives_under_out_not_root() {
+    let td = tempfile::tempdir().unwrap();
+    // empty tree: 0 candidates still creates log under unpack
+    let s = job::run_folder_v(td.path(), None, 2, false, false).unwrap();
+    assert_eq!(s.unpacked, 0);
+    let unpack = td.path().join("unpack");
+    assert!(unpack.is_dir());
+    assert_eq!(list_logs(&unpack).len(), 1);
+    assert!(
+        list_logs(td.path()).is_empty(),
+        "log must not sit on input root"
+    );
+    let text = std::fs::read_to_string(&list_logs(&unpack)[0]).unwrap();
+    assert!(text.contains("done in "));
+    assert!(text.contains("summary:"));
+}

tests/samples.rs

@@ -0,0 +1,215 @@
+//! Corpus test over the user-managed `senbei/samples` folder.
+//!
+//! Drop real Crackproof `*.exe` / `*.dll` inputs in there (and/or il2cpp
+//! `*.dat` metadata blobs), optionally alongside a byte-exact golden named
+//! `<base>.golden.<ext>`. Each input is processed and classified:
+//!
+//! - golden present, bytes identical  -> pass (silent)
+//! - golden present, bytes differ     -> FAIL (the test fails)
+//! - no golden                        -> WARNING (printed; needs a manual check)
+//!
+//! Inputs go through [`senbei::job::unpack_bytes`], the same routing the CLI
+//! uses, **not** `unpack_auto` directly. That matters: `unpack_auto` alone
+//! cannot reach the external-companion layout, whose stub is meaningless
+//! without its `<name>._` payload — a corpus wired to `unpack_auto` silently
+//! covers none of the splice / export-overlay / TLS-restore code, nor the
+//! marker-less "new layout" those builds use. A `<input>._` sibling in the
+//! samples folder is picked up automatically, exactly as it is on disk.
+//!
+//! An input whose bytes carry the il2cpp metadata magic is routed through
+//! [`senbei::metadata::deobfuscate`] instead, giving the method-token remap
+//! real-world coverage (its unit tests only build synthetic layouts).
+//!
+//! The folder is git-ignored (see `senbei/samples/README.md`), so the set of
+//! samples is whatever happens to be on the machine. An empty/absent folder is
+//! a no-op pass.
+
+mod common;
+use common::samples_dir;
+use std::path::Path;
+
+/// An input is a `.exe`/`.dll`/`.dat` whose name doesn't carry the `.golden.`
+/// marker — those are goldens, not inputs. External companions (`<name>._`)
+/// have extension `_` and are therefore never inputs in their own right; they
+/// are consumed by their base module.
+fn is_input(path: &Path) -> bool {
+    let Some(ext) = path.extension().and_then(|e| e.to_str()) else {
+        return false;
+    };
+    let ext = ext.to_ascii_lowercase();
+    if ext != "exe" && ext != "dll" && ext != "dat" {
+        return false;
+    }
+    // Reject goldens like `foo.golden.exe`.
+    !path
+        .file_name()
+        .and_then(|n| n.to_str())
+        .map(|n| n.to_ascii_lowercase().contains(".golden."))
+        .unwrap_or(false)
+}
+
+/// Golden path for an input: `<base>.golden.<ext>` next to it.
+fn golden_for(input: &Path) -> std::path::PathBuf {
+    let ext = input.extension().and_then(|e| e.to_str()).unwrap_or("");
+    let stem = input.file_stem().and_then(|s| s.to_str()).unwrap_or("");
+    input.with_file_name(format!("{stem}.golden.{ext}"))
+}
+
+/// External-companion path for an input: `<full file name>._` next to it,
+/// matching what the CLI looks for on disk.
+fn companion_for(input: &Path) -> Option<std::path::PathBuf> {
+    let name = input.file_name()?;
+    let mut n = name.to_os_string();
+    n.push("._");
+    let p = input.with_file_name(n);
+    p.is_file().then_some(p)
+}
+
+#[test]
+fn samples_unpack_against_goldens() {
+    let dir = samples_dir();
+    // An absent/empty corpus fails only when explicitly required — a green
+    // run that unpacked nothing hides every unpack regression, but on public
+    // CI there is no corpus at all (binaries are never committed), so the
+    // gate is opt-in via SENBEI_REQUIRE_SAMPLES rather than implied by CI.
+    // Locally the corpus is the user-managed samples/ folder (see
+    // samples/README.md).
+    let require = std::env::var_os("SENBEI_REQUIRE_SAMPLES").is_some();
+    if !dir.is_dir() {
+        assert!(
+            !require,
+            "samples: {} does not exist — corpus required (CI)",
+            dir.display()
+        );
+        eprintln!("samples: {} does not exist, nothing to test", dir.display());
+        return;
+    }
+
+    let mut inputs: Vec<_> = std::fs::read_dir(&dir)
+        .unwrap_or_else(|e| panic!("read {}: {e}", dir.display()))
+        .filter_map(|e| e.ok().map(|e| e.path()))
+        .filter(|p| p.is_file() && is_input(p))
+        .collect();
+    inputs.sort();
+
+    if inputs.is_empty() {
+        assert!(
+            !require,
+            "samples: no .exe/.dll inputs in {} — corpus required (CI)",
+            dir.display()
+        );
+        eprintln!("samples: no .exe/.dll inputs in {}", dir.display());
+        return;
+    }
+
+    let mut passed = 0usize;
+    let mut warnings: Vec<String> = Vec::new();
+    let mut failures: Vec<String> = Vec::new();
+
+    for input in &inputs {
+        let name = input.file_name().unwrap().to_string_lossy().to_string();
+        let bytes = match std::fs::read(input) {
+            Ok(b) => b,
+            Err(e) => {
+                failures.push(format!("{name}: read error: {e}"));
+                continue;
+            }
+        };
+
+        let got = if senbei::metadata::is_metadata(&bytes) {
+            // il2cpp metadata: method-token de-obfuscation, no PE pipeline and
+            // no integrity check (the output is not a PE image).
+            match senbei::metadata::deobfuscate(&bytes) {
+                Ok((out, _report)) => out,
+                Err(e) => {
+                    failures.push(format!("{name}: de-obfuscation failed: {e}"));
+                    continue;
+                }
+            }
+        } else {
+            // Splice in the external companion when one sits next to the input,
+            // then run the CLI's routing (which also overlays the stub's export
+            // table and TLS directory for spliced inputs).
+            let companion = match companion_for(input) {
+                Some(p) => match std::fs::read(&p) {
+                    Ok(b) => Some(b),
+                    Err(e) => {
+                        failures.push(format!("{name}: companion read error: {e}"));
+                        continue;
+                    }
+                },
+                None => None,
+            };
+            let image = match senbei::job::unpack_bytes(&bytes, companion.as_deref()) {
+                Ok(img) => img,
+                Err(e) => {
+                    failures.push(format!("{name}: unpack failed: {e:?}"));
+                    continue;
+                }
+            };
+            // The static integrity check is a second, golden-independent gate:
+            // it catches an output that is structurally plausible but would
+            // crash at runtime (0xC0000005) even when a stale golden still
+            // byte-matches. (Goldens are byte comparisons only — "matches
+            // golden" ≠ runs.)
+            if !image.integrity.ok() {
+                failures.push(format!(
+                    "{name}: integrity check failed: {}",
+                    image.integrity.issues.join("; ")
+                ));
+                continue;
+            }
+            image.bytes
+        };
+
+        let golden = golden_for(input);
+        if !golden.exists() {
+            warnings.push(format!(
+                "{name}: unpacked OK ({} bytes) but no golden ({}) — MANUAL CHECK",
+                got.len(),
+                golden.file_name().unwrap().to_string_lossy()
+            ));
+            continue;
+        }
+
+        let want = match std::fs::read(&golden) {
+            Ok(b) => b,
+            Err(e) => {
+                failures.push(format!("{name}: golden read error: {e}"));
+                continue;
+            }
+        };
+
+        if got.len() != want.len() {
+            failures.push(format!(
+                "{name}: length differs: got {} want {}",
+                got.len(),
+                want.len()
+            ));
+            continue;
+        }
+        if let Some((i, (a, b))) = got.iter().zip(&want).enumerate().find(|(_, (a, b))| a != b) {
+            failures.push(format!(
+                "{name}: first diff at 0x{i:X}: got {a:02X} want {b:02X}"
+            ));
+            continue;
+        }
+        passed += 1;
+    }
+
+    eprintln!(
+        "samples: {} input(s) — {} pass, {} warning(s), {} failure(s)",
+        inputs.len(),
+        passed,
+        warnings.len(),
+        failures.len()
+    );
+    for w in &warnings {
+        eprintln!("  WARN  {w}");
+    }
+    for f in &failures {
+        eprintln!("  FAIL  {f}");
+    }
+
+    assert!(failures.is_empty(), "{} sample(s) failed", failures.len());
+}

web/Cargo.lock

@@ -0,0 +1,441 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "console"
+version = "0.16.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fe5f465a4f6fee88fad41b85d990f84c835335e85b5d9e6e63e0d06d28cba7c"
+dependencies = [
+ "encode_unicode",
+ "libc",
+ "unicode-width",
+ "windows-sys",
+]
+
+[[package]]
+name = "console_error_panic_hook"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06aeb73f470f66dcdbf7223caeebb85984942f22f1adb2a088cf9668146bbbc"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "encode_unicode"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
+
+[[package]]
+name = "futures-core"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
+
+[[package]]
+name = "futures-task"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
+
+[[package]]
+name = "futures-util"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "indicatif"
+version = "0.18.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9433806cd6b4ec1aba79c021c7e4c58fb4c3b9977c085062e611ac929998fb0c"
+dependencies = [
+ "console",
+ "portable-atomic",
+ "unicode-width",
+ "unit-prefix",
+ "web-time",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.103"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "owo-colors"
+version = "4.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "portable-atomic"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "senbei"
+version = "1.0.0"
+dependencies = [
+ "anyhow",
+ "indicatif",
+ "libc",
+ "owo-colors",
+ "thiserror",
+ "walkdir",
+ "windows",
+]
+
+[[package]]
+name = "senbei-web"
+version = "1.0.0"
+dependencies = [
+ "console_error_panic_hook",
+ "senbei",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
+[[package]]
+name = "unit-prefix"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81e544489bf3d8ef66c953931f56617f423cd4b5494be343d9b9d3dda037b9a3"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "windows"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
+dependencies = [
+ "windows-collections",
+ "windows-core",
+ "windows-future",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
+dependencies = [
+ "windows-core",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
+dependencies = [
+ "windows-core",
+ "windows-link",
+ "windows-threading",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-numerics"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
+dependencies = [
+ "windows-core",
+ "windows-link",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
+dependencies = [
+ "windows-link",
+]

web/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "senbei-web"
+version = "1.0.0"
+edition = "2024"
+description = "WebAssembly browser frontend for senbei"
+license = "AGPL-3.0-only"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+senbei = { path = ".." }
+wasm-bindgen = "0.2"
+console_error_panic_hook = "0.1"
+
+[profile.release]
+opt-level = "z"
+lto = true
+codegen-units = 1

web/LICENSE

@@ -0,0 +1,662 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published
+    by the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
+

web/README.md

@@ -0,0 +1,75 @@
+# Senbei web
+
+Senbei running in the browser: the unpacker core compiled to WebAssembly,
+wrapped in a small static page. Everything is client-side — files are read
+into the page, unpacked locally, and offered back as downloads. Nothing is
+uploaded; there is no server component.
+
+## Features
+
+- A legal notice is shown as a blocking dialog on page open; the tool is
+  unusable until it is acknowledged.
+- Dropped files land in a file list, not unpacked immediately: review the
+  batch, remove mistakes, then press **Unpack**. A module and its `._`
+  companion can be dropped in any order (or in separate drops) — companions
+  auto-pair by name (`Foo.dll._` → `Foo.dll`) and show as a badge on the
+  module's row; removing a module removes its companion too.
+- Rows show state at a glance: black while staged, an animated blue bar
+  while unpacking, green on success (with a download button) and red on
+  failure.
+- Drop one or more protected `.exe` / `.dll` modules → get `<name>.unpack.*`
+  downloads.
+- Drop an il2cpp `global-metadata.dat` → de-obfuscated
+  `global-metadata.unpack.dat` (only when tokens actually change).
+- Each output passes the same static integrity check as the CLI; suspect
+  outputs are flagged with the specific defects found.
+
+## Architecture notes
+
+- Every unpack runs in a **disposable Web Worker** (fresh wasm instance per
+  file): the UI stays responsive on 100 MB+ modules, and a wasm trap is
+  isolated to that worker.
+- **Why workers matter for correctness:** the DLL-first routing probe relies
+  on `catch_unwind` to reject EXE-shell-layout DLLs, and panics cannot be
+  caught in WebAssembly — the probe traps the whole call. When a DLL unpack
+  traps, the app retries once in a new worker with the forced-EXE pipeline
+  (`unpack_file_force_exe`), reproducing the CLI's dll-first/exe-fallback
+  outcome. Spliced companion inputs skip the probe entirely (they are always
+  EXE-shell layout), exactly like the CLI.
+- Rust panic messages are forwarded to the browser console
+  (`console_error_panic_hook`) — check devtools when reporting an issue.
+
+## Building
+
+Requires a Rust toolchain (`rust-toolchain.toml` in the repo root pins one,
+including the `wasm32-unknown-unknown` target) and
+[wasm-pack](https://rustwasm.github.io/wasm-pack/installer/).
+
+```cmd
+cd web
+wasm-pack build --target web --release
+```
+
+This produces `web/pkg/` (git-ignored). Then serve the `web/` directory with
+any static file server and open `index.html`:
+
+```cmd
+python -m http.server -d web 8000
+:: -> http://localhost:8000
+```
+
+(Opening `index.html` via `file://` won't work — ES modules require HTTP.)
+
+## Layout
+
+```
+web/
+├── Cargo.toml     senbei-web cdylib crate (depends on the senbei lib)
+├── src/lib.rs     #[wasm_bindgen] bindings: detect / unpack_file /
+│                  unpack_file_force_exe / deobfuscate_metadata
+├── index.html     the page
+├── app.js         dropzone, file list, worker orchestration, downloads
+├── worker.js      one-shot unpack worker (fresh wasm instance per file)
+├── style.css
+└── pkg/           wasm-pack output (git-ignored)
+```

web/app.js

@@ -0,0 +1,392 @@
+import init, { detect, deobfuscate_metadata } from './pkg/senbei_web.js';
+
+const dropzone = document.getElementById('dropzone');
+const picker = document.getElementById('picker');
+const fileList = document.getElementById('files');
+const actions = document.getElementById('actions');
+const unpackBtn = document.getElementById('unpack-btn');
+const clearBtn = document.getElementById('clear-btn');
+const legalOverlay = document.getElementById('legal-overlay');
+const legalAccept = document.getElementById('legal-accept');
+const legalLink = document.getElementById('legal-link');
+
+await init();
+
+// --- Legal gate: the page is unusable until the notice is acknowledged. ---
+legalAccept.addEventListener('click', () => legalOverlay.remove());
+legalLink.addEventListener('click', (e) => {
+  e.preventDefault();
+  if (!document.getElementById('legal-overlay')) {
+    document.body.appendChild(legalOverlay);
+  }
+});
+
+// --- File list: one row per module. Companions (`X._`) never get their own ---
+// --- row once their base module `X` is present — they show as a badge on   ---
+// --- the base row. Rows are black while staged, show an animated blue      ---
+// --- progress bar while unpacking, and turn green (success) or red         ---
+// --- (failure) at the end; success rows gain a download button.            ---
+
+// --- Row DOM is updated INCREMENTALLY: rows are created once and patched  ---
+// --- in place. Rebuilding the list on every change would restart the      ---
+// --- entrance animation of every row and reset the unpack shimmer.        ---
+
+/** name -> {
+ *   file: File,
+ *   kind: string|undefined,   // detect() result; undefined for `._` files
+ *   state: 'staged'|'working'|'ok'|'err',
+ *   bytes: Uint8Array|null,   // unpacked output (state 'ok')
+ *   note: string,             // status line (kind, suspect issues, error)
+ *   suspect: boolean,
+ * } */
+const files = new Map();
+
+/** name -> row <li> element (companions merged into their base have none) */
+const rowEls = new Map();
+
+const KIND_LABEL = {
+  exe: 'protected EXE',
+  'native-dll': 'protected native DLL',
+  'managed-dll': 'protected managed DLL',
+  metadata: 'il2cpp metadata',
+};
+
+const COMPANION_SVG =
+  '<svg viewBox="0 0 16 16" width="14" height="14" aria-hidden="true">' +
+  '<path d="M6.5 9.5a3 3 0 0 0 4.24 0l2-2a3 3 0 1 0-4.24-4.24l-1 1" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/>' +
+  '<path d="M9.5 6.5a3 3 0 0 0-4.24 0l-2 2a3 3 0 1 0 4.24 4.24l1-1" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/></svg>';
+
+const DOWNLOAD_SVG =
+  '<svg viewBox="0 0 16 16" width="15" height="15" aria-hidden="true">' +
+  '<path d="M8 1v9m0 0L4.5 6.5M8 10l3.5-3.5M2 12.5V14h12v-1.5" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/></svg>';
+
+dropzone.addEventListener('click', () => picker.click());
+dropzone.addEventListener('keydown', (e) => {
+  if (e.key === 'Enter' || e.key === ' ') picker.click();
+});
+picker.addEventListener('change', () => {
+  stageFiles(picker.files);
+  picker.value = '';
+});
+dropzone.addEventListener('dragover', (e) => {
+  e.preventDefault();
+  dropzone.classList.add('over');
+});
+dropzone.addEventListener('dragleave', () => dropzone.classList.remove('over'));
+dropzone.addEventListener('drop', (e) => {
+  e.preventDefault();
+  dropzone.classList.remove('over');
+  stageFiles(e.dataTransfer.files);
+});
+
+async function stageFiles(list) {
+  // Snapshot synchronously: `picker.files` and `dataTransfer.files` are LIVE
+  // lists — clearing the picker or returning from the drop event empties
+  // them, so an await before this point silently drops every file after the
+  // first.
+  const snapshot = [...list];
+  for (const file of snapshot) {
+    // Detection only needs the file header (key table at offset 4096 plus
+    // the PE header fields); read a small slice, not the whole file.
+    const head = new Uint8Array(await file.slice(0, 65536).arrayBuffer());
+    // Companions are ciphertext fragments; detect() only makes sense on the
+    // base module, so skip it for `._` files.
+    const kind = file.name.endsWith('._') ? undefined : detect(head);
+    const old = files.get(file.name);
+    files.set(file.name, {
+      file,
+      kind,
+      state: 'staged',
+      bytes: null,
+      note: '',
+      suspect: false,
+    }); // same name re-dropped: replace
+    // A re-dropped file restarts as staged; drop any stale row/output.
+    if (old) removeRow(file.name, true);
+  }
+  render();
+}
+
+/** Insert `.unpack` before the final extension: `app.exe` -> `app.unpack.exe`. */
+function outName(name) {
+  const dot = name.lastIndexOf('.');
+  return dot > 0 ? `${name.slice(0, dot)}.unpack${name.slice(dot)}` : `${name}.unpack`;
+}
+
+function statusText(name, entry) {
+  if (name.endsWith('._')) {
+    return `companion — needs ${name.slice(0, -2)}`;
+  }
+  switch (entry.state) {
+    case 'staged':
+      return entry.kind === undefined
+        ? 'not recognized — will be skipped'
+        : KIND_LABEL[entry.kind] ?? entry.kind;
+    case 'working':
+      return 'unpacking…';
+    case 'ok':
+    case 'err':
+      return entry.note;
+  }
+}
+
+function buildRow(name) {
+  const li = document.createElement('li');
+  li.className = 'file staged';
+  li.dataset.name = name;
+
+  const bar = document.createElement('div');
+  bar.className = 'bar';
+  li.appendChild(bar);
+
+  const row = document.createElement('div');
+  row.className = 'row';
+
+  const label = document.createElement('span');
+  label.className = 'name';
+  label.textContent = name;
+  row.appendChild(label);
+
+  const badge = document.createElement('span');
+  badge.className = 'badge companion';
+  badge.innerHTML = COMPANION_SVG;
+  badge.hidden = true;
+  row.appendChild(badge);
+
+  const status = document.createElement('span');
+  status.className = 'status';
+  row.appendChild(status);
+
+  const dl = document.createElement('a');
+  dl.className = 'dl';
+  dl.innerHTML = DOWNLOAD_SVG;
+  dl.hidden = true;
+  row.appendChild(dl);
+
+  const rm = document.createElement('button');
+  rm.type = 'button';
+  rm.className = 'remove';
+  rm.textContent = '×';
+  rm.title = `Remove ${name}`;
+  rm.addEventListener('click', () => {
+    // A companion belongs to its base module: removing the base removes the
+    // companion too.
+    files.delete(name);
+    if (!name.endsWith('._')) files.delete(`${name}._`);
+    render();
+  });
+  row.appendChild(rm);
+
+  li.appendChild(row);
+  return li;
+}
+
+function updateRow(li, name, entry) {
+  const isCompanion = name.endsWith('._');
+  li.className =
+    `file ${entry.state}` + (entry.suspect && entry.state === 'ok' ? ' suspect' : '');
+
+  const badge = li.querySelector('.badge');
+  const hasCompanion = isCompanion || files.has(`${name}._`);
+  badge.hidden = !hasCompanion;
+  if (hasCompanion) {
+    badge.title = isCompanion
+      ? 'external companion (._)'
+      : `companion loaded: ${name}._`;
+  }
+
+  li.querySelector('.status').textContent = statusText(name, entry);
+
+  const dl = li.querySelector('.dl');
+  const downloadable = entry.state === 'ok' && entry.bytes;
+  dl.hidden = !downloadable;
+  if (downloadable) {
+    if (dl._bytesFor !== entry.bytes) {
+      if (dl.href) URL.revokeObjectURL(dl.href);
+      dl.href = URL.createObjectURL(
+        new Blob([entry.bytes], { type: 'application/octet-stream' }),
+      );
+      dl._bytesFor = entry.bytes;
+    }
+    dl.download = outName(name);
+    dl.title = `Download ${outName(name)}`;
+  }
+}
+
+function removeRow(name, instant) {
+  const li = rowEls.get(name);
+  if (!li) return;
+  rowEls.delete(name);
+  // Release the download blob. Object URLs are roots: without this an unpacked
+  // 100 MB image stays resident for the life of the page every time a row is
+  // removed or the list is cleared.
+  const dl = li.querySelector('.dl');
+  if (dl?.href) {
+    URL.revokeObjectURL(dl.href);
+    dl.removeAttribute('href');
+    dl._bytesFor = null;
+  }
+  if (instant) {
+    li.remove();
+    return;
+  }
+  // Fade AND collapse: without the height/margin transition the rows below
+  // would hold position during the fade and then snap up on removal. The
+  // end state must be inline too — an inline start value would otherwise
+  // beat the stylesheet's `.leaving { max-height: 0 }`.
+  li.style.maxHeight = `${li.offsetHeight}px`;
+  void li.offsetHeight; // reflow: give the transition a concrete start value
+  li.classList.add('leaving');
+  li.style.maxHeight = '0px';
+  setTimeout(() => li.remove(), 230);
+}
+
+function render() {
+  // Create/update rows in Map order; companions whose base is staged merge
+  // into the base row (no row of their own).
+  const wanted = [];
+  for (const [name] of files) {
+    if (name.endsWith('._') && files.has(name.slice(0, -2))) continue;
+    wanted.push(name);
+  }
+  const wantedSet = new Set(wanted);
+
+  // Removals first: departed rows are marked leaving (and dropped from
+  // rowEls) BEFORE the ordering loop, so the loop treats them as transparent
+  // and never reorders siblings around them (that would snap, not slide).
+  for (const name of [...rowEls.keys()]) {
+    if (!wantedSet.has(name)) removeRow(name, false);
+  }
+
+  // In-place ordering: only rows that are out of position are moved, so
+  // running animations (entrance, shimmer) are never restarted by a render.
+  // Rows mid-leave-animation (no longer in rowEls) are skipped and keep
+  // their spot — reordering siblings around them would make them snap
+  // instead of sliding with the collapse.
+  let cursor = fileList.firstChild;
+  for (const name of wanted) {
+    let li = rowEls.get(name);
+    if (!li) {
+      li = buildRow(name);
+      rowEls.set(name, li);
+    }
+    updateRow(li, name, files.get(name));
+    while (cursor && !rowEls.has(cursor.dataset.name)) {
+      cursor = cursor.nextSibling;
+    }
+    if (li === cursor) {
+      cursor = cursor.nextSibling;
+    } else {
+      fileList.insertBefore(li, cursor);
+    }
+  }
+
+  const unpackable = [...files].some(
+    ([name, e]) =>
+      !name.endsWith('._') && e.kind !== undefined && e.state === 'staged',
+  );
+  unpackBtn.disabled = !unpackable;
+  actions.hidden = files.size === 0;
+}
+
+clearBtn.addEventListener('click', () => {
+  files.clear();
+  render();
+});
+
+/**
+ * Run one unpack in a disposable Web Worker (fresh wasm instance per call —
+ * see worker.js). Buffers are transferred, so the inputs are neutered on the
+ * main thread afterwards; callers re-read from the File for a retry.
+ */
+function runUnpack(inputBytes, compBytes, forceExe) {
+  return new Promise((resolve) => {
+    const w = new Worker('worker.js', { type: 'module' });
+    w.onmessage = (e) => {
+      w.terminate();
+      resolve(e.data);
+    };
+    w.onerror = (e) => {
+      w.terminate();
+      resolve({ ok: false, trap: true, message: e.message || 'worker error' });
+    };
+    const transfer = [inputBytes.buffer, ...(compBytes ? [compBytes.buffer] : [])];
+    w.postMessage({ input: inputBytes, companion: compBytes ?? null, forceExe }, transfer);
+  });
+}
+
+async function unpackModule(name, entry) {
+  const compEntry = files.get(`${name}._`);
+  const read = (f) => f.arrayBuffer().then((b) => new Uint8Array(b));
+
+  let input = await read(entry.file);
+  let comp = compEntry ? await read(compEntry.file) : undefined;
+  let r = await runUnpack(input, comp, false);
+
+  if (!r.ok && r.trap && entry.kind !== 'exe') {
+    // The DLL-routing probe trapped (panics can't be caught in wasm). Retry
+    // once with the forced-EXE pipeline in a fresh worker — this mirrors the
+    // CLI's dll-first/exe-fallback outcome for EXE-shell-layout DLLs.
+    input = await read(entry.file);
+    comp = compEntry ? await read(compEntry.file) : undefined;
+    r = await runUnpack(input, comp, true);
+  }
+
+  if (!r.ok) {
+    entry.state = 'err';
+    entry.note = r.trap
+      ? 'unpack failed (internal trap) — this Crackproof layout may be unsupported'
+      : r.message;
+    return;
+  }
+  entry.state = 'ok';
+  entry.bytes = r.bytes;
+  entry.suspect = r.suspect;
+  entry.note =
+    (r.companion ? 'spliced from ._ companion; ' : '') +
+    `kind: ${r.kind}` +
+    (r.suspect ? ` — SUSPECT: ${r.issues.join('; ')}` : '');
+}
+
+unpackBtn.addEventListener('click', async () => {
+  unpackBtn.disabled = true;
+  clearBtn.disabled = true;
+  try {
+    for (const [name, entry] of files) {
+      if (name.endsWith('._') || entry.state !== 'staged') continue;
+
+      if (entry.kind === undefined) {
+        entry.state = 'err';
+        entry.note = 'not recognized as Crackproof-protected — skipped';
+        render();
+        continue;
+      }
+
+      entry.state = 'working';
+      render();
+      try {
+        if (entry.kind === 'metadata') {
+          const bytes = new Uint8Array(await entry.file.arrayBuffer());
+          const r = deobfuscate_metadata(bytes);
+          if (r.remapped === 0) {
+            entry.state = 'err';
+            entry.note = `metadata already clean (v${r.version}, ${r.methods} methods) — nothing to do`;
+          } else {
+            entry.state = 'ok';
+            entry.bytes = r.bytes;
+            entry.note = `${r.remapped}/${r.methods} method tokens remapped across ${r.modules} modules`;
+          }
+        } else {
+          await unpackModule(name, entry);
+        }
+      } catch (e) {
+        entry.state = 'err';
+        entry.note = e instanceof Error ? e.message : String(e);
+      }
+      render();
+    }
+  } finally {
+    clearBtn.disabled = false;
+    render();
+  }
+});

web/index.html

@@ -0,0 +1,78 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Senbei — static Crackproof unpacker</title>
+<link rel="stylesheet" href="style.css">
+</head>
+<body>
+<div id="legal-overlay" role="dialog" aria-modal="true" aria-labelledby="legal-title">
+  <div class="legal-box">
+    <h2 id="legal-title">Legal notice — read before use</h2>
+    <p>
+      Senbei is a research and interoperability tool for lawful reverse
+      engineering, security research, and preservation of software you already
+      legitimately possess. <strong>Only process binaries you own or are
+      explicitly authorized to analyze.</strong>
+    </p>
+    <p>
+      Circumventing technological protection measures may be restricted in
+      your jurisdiction (for example under DMCA §1201 in the United States,
+      which contains exemptions for security research and interoperability).
+      Ensuring your use is lawful is <strong>your</strong> responsibility.
+    </p>
+    <p>
+      Senbei performs a purely static transformation of files on your device:
+      it bypasses no access control by itself, ships no keys and no vendor
+      code, and uploads nothing — everything runs locally in your browser.
+      Do not redistribute decrypted outputs. This software is provided
+      “as is”, without warranty of any kind; the authors accept no liability
+      for misuse. “Crackproof” is a trademark of its owner; this project is
+      not affiliated with or endorsed by the vendor or any publisher.
+    </p>
+    <button id="legal-accept" type="button">I understand and accept</button>
+  </div>
+</div>
+
+<main>
+  <header class="topbar">
+    <h1>Senbei <span class="tag">web</span></h1>
+    <a class="github-link" href="https://github.com/Momoko-Ayase/Senbei" target="_blank" rel="noopener"
+       title="Senbei on GitHub" aria-label="Senbei on GitHub">
+      <svg viewBox="0 0 16 16" width="22" height="22" aria-hidden="true">
+        <path fill="currentColor" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8Z"/>
+      </svg>
+    </a>
+  </header>
+  <p class="lede">
+    Static unpacker for Crackproof-protected PE files, running entirely in
+    your browser. <strong>No file ever leaves your device.</strong>
+  </p>
+
+  <div id="dropzone" tabindex="0" role="button"
+       aria-label="Drop protected files here or press Enter to browse">
+    <p><strong>Drop files here</strong> or click to browse</p>
+    <p class="hint">
+      Protected <code>.exe</code> / <code>.dll</code> modules, optional
+      <code>._</code> companions, or an il2cpp
+      <code>global-metadata.dat</code>.
+    </p>
+    <input type="file" id="picker" multiple hidden>
+  </div>
+
+  <ul id="files"></ul>
+
+  <div class="actions" id="actions" hidden>
+    <button id="unpack-btn" type="button">Unpack</button>
+    <button id="clear-btn" type="button" class="secondary">Clear</button>
+  </div>
+
+  <footer>
+    <p><a href="#" id="legal-link">Legal notice</a> ·
+      Senbei is free software under the AGPL-3.0 license.</p>
+  </footer>
+</main>
+<script type="module" src="app.js"></script>
+</body>
+</html>

web/src/lib.rs

@@ -0,0 +1,180 @@
+//! WebAssembly bindings for the senbei unpacker core.
+//!
+//! Everything here is I/O-free: the browser hands in file bytes and gets
+//! unpacked file bytes back. No network, no filesystem, no uploads.
+
+use wasm_bindgen::prelude::*;
+
+/// Install a panic hook that forwards Rust panic messages to the browser
+/// console (and to the JS error), instead of a bare `unreachable` trap.
+#[wasm_bindgen(start)]
+pub fn init_panic_hook() {
+    console_error_panic_hook::set_once();
+}
+
+/// Result of unpacking one protected module.
+#[wasm_bindgen]
+pub struct UnpackResult {
+    kind: String,
+    bytes: Vec<u8>,
+    suspect: bool,
+    issues: Vec<String>,
+    companion: bool,
+}
+
+#[wasm_bindgen]
+impl UnpackResult {
+    /// Detected module kind: `"exe"`, `"native-dll"`, or `"managed-dll"`.
+    #[wasm_bindgen(getter)]
+    pub fn kind(&self) -> String {
+        self.kind.clone()
+    }
+
+    /// The unpacked image bytes.
+    #[wasm_bindgen(getter)]
+    pub fn bytes(&self) -> Vec<u8> {
+        self.bytes.clone()
+    }
+
+    /// True when the static integrity check flagged the output as likely
+    /// broken at runtime. The bytes are still the best available.
+    #[wasm_bindgen(getter)]
+    pub fn suspect(&self) -> bool {
+        self.suspect
+    }
+
+    /// Human-readable integrity defects (empty when the check is clean).
+    #[wasm_bindgen(getter)]
+    pub fn issues(&self) -> Vec<String> {
+        self.issues.clone()
+    }
+
+    /// True when the input was spliced from an external-companion (`._`)
+    /// payload.
+    #[wasm_bindgen(getter)]
+    pub fn companion(&self) -> bool {
+        self.companion
+    }
+}
+
+/// Result of de-obfuscating an il2cpp `global-metadata.dat`.
+#[wasm_bindgen]
+pub struct MetadataResult {
+    bytes: Vec<u8>,
+    version: u32,
+    methods: usize,
+    remapped: usize,
+    modules: usize,
+}
+
+#[wasm_bindgen]
+impl MetadataResult {
+    /// The (possibly rewritten) metadata bytes.
+    #[wasm_bindgen(getter)]
+    pub fn bytes(&self) -> Vec<u8> {
+        self.bytes.clone()
+    }
+
+    #[wasm_bindgen(getter)]
+    pub fn version(&self) -> u32 {
+        self.version
+    }
+
+    /// Total method-definition entries in the metadata.
+    #[wasm_bindgen(getter)]
+    pub fn methods(&self) -> usize {
+        self.methods
+    }
+
+    /// Method tokens actually rewritten (0 means the input was already
+    /// de-obfuscated and the bytes are unchanged).
+    #[wasm_bindgen(getter)]
+    pub fn remapped(&self) -> usize {
+        self.remapped
+    }
+
+    /// Modules (images) owning at least one method.
+    #[wasm_bindgen(getter)]
+    pub fn modules(&self) -> usize {
+        self.modules
+    }
+}
+
+fn kind_str(kind: senbei::unpacker::Kind) -> &'static str {
+    match kind {
+        senbei::unpacker::Kind::Exe => "exe",
+        senbei::unpacker::Kind::NativeDll => "native-dll",
+        senbei::unpacker::Kind::ManagedDll => "managed-dll",
+    }
+}
+
+/// Classify a file's bytes without unpacking.
+///
+/// Returns `"exe"`, `"native-dll"`, `"managed-dll"`, `"metadata"` (an il2cpp
+/// `global-metadata.dat`), or `undefined` for anything unrecognized.
+#[wasm_bindgen]
+pub fn detect(input: &[u8]) -> Option<String> {
+    if senbei::metadata::is_metadata(input) {
+        return Some("metadata".to_string());
+    }
+    senbei::unpacker::detect(input).map(|d| kind_str(d.kind).to_string())
+}
+
+/// Unpack a protected module.
+///
+/// `input` is the protected `.exe`/`.dll`; `companion` is the optional
+/// `<input>._` external-companion payload (pass `null`/`undefined` when there
+/// is none). Throws a string error when the input is not a supported
+/// Crackproof file or is corrupt.
+#[wasm_bindgen]
+pub fn unpack_file(
+    input: &[u8],
+    companion: Option<Vec<u8>>,
+) -> Result<UnpackResult, JsError> {
+    let r = senbei::job::unpack_bytes(input, companion.as_deref())
+        .map_err(|e| JsError::new(&e.to_string()))?;
+    Ok(UnpackResult {
+        kind: kind_str(r.kind).to_string(),
+        bytes: r.bytes,
+        suspect: !r.integrity.ok(),
+        issues: r.integrity.issues,
+        companion: r.companion,
+    })
+}
+
+/// De-obfuscate the method tokens of an il2cpp `global-metadata.dat`.
+///
+/// The transform is idempotent: an already-clean metadata comes back
+/// byte-identical with `remapped == 0`. Throws a string error for non-metadata
+/// input, an unsupported format version, or a malformed layout.
+#[wasm_bindgen]
+pub fn deobfuscate_metadata(data: &[u8]) -> Result<MetadataResult, JsError> {
+    let (bytes, report) =
+        senbei::metadata::deobfuscate(data).map_err(|e| JsError::new(&e.to_string()))?;
+    Ok(MetadataResult {
+        bytes,
+        version: report.version,
+        methods: report.methods,
+        remapped: report.remapped,
+        modules: report.modules,
+    })
+}
+
+/// Unpack a protected module, forcing the EXE pipeline (no DLL-pipeline
+/// probe). See [`senbei::job::unpack_bytes_force_exe`] for why the web app
+/// needs this recovery path.
+#[wasm_bindgen]
+pub fn unpack_file_force_exe(
+    input: &[u8],
+    companion: Option<Vec<u8>>,
+) -> Result<UnpackResult, JsError> {
+    let r = senbei::job::unpack_bytes_force_exe(input, companion.as_deref())
+        .map_err(|e| JsError::new(&e.to_string()))?;
+    Ok(UnpackResult {
+        kind: kind_str(r.kind).to_string(),
+        bytes: r.bytes,
+        suspect: !r.integrity.ok(),
+        issues: r.integrity.issues,
+        companion: r.companion,
+    })
+}

web/style.css

@@ -0,0 +1,369 @@
+:root {
+  color-scheme: dark;
+  --bg: #14161a;
+  --panel: #1d2026;
+  --black: #0c0e11;
+  --border: #2e323b;
+  --text: #e4e7ec;
+  --dim: #9aa3b0;
+  --accent: #e8b64c;
+  --blue: #3b82f6;
+  --blue-deep: #1d4ed8;
+  --ok: #1e6b34;
+  --ok-bright: #6fcf7c;
+  --err: #7a2828;
+  --err-bright: #e06c6c;
+  --warn: #e8b64c;
+}
+
+* { box-sizing: border-box; }
+
+/* display rules below (inline-flex etc.) would otherwise beat the hidden
+   attribute's UA display:none — the badge/download icons must stay hidden. */
+[hidden] { display: none !important; }
+
+body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--text);
+  font: 16px/1.55 system-ui, "Segoe UI", sans-serif;
+}
+
+main {
+  max-width: 720px;
+  margin: 0 auto;
+  padding: 2.5rem 1.25rem 3rem;
+}
+
+.topbar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+}
+
+h1 { margin-bottom: 0.25rem; }
+
+.tag {
+  font-size: 0.45em;
+  vertical-align: super;
+  color: var(--accent);
+  letter-spacing: 0.08em;
+}
+
+.github-link {
+  color: var(--dim);
+  transition: color 0.2s, transform 0.2s;
+}
+
+.github-link:hover {
+  color: var(--text);
+  transform: scale(1.12);
+}
+
+.lede { color: var(--dim); }
+.lede strong { color: var(--text); }
+
+/* --- legal modal --- */
+
+#legal-overlay {
+  position: fixed;
+  inset: 0;
+  z-index: 10;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 1.25rem;
+  background: rgba(10, 11, 13, 0.82);
+  backdrop-filter: blur(3px);
+  animation: fadeIn 0.25s ease-out;
+}
+
+.legal-box {
+  max-width: 560px;
+  max-height: 85vh;
+  overflow-y: auto;
+  padding: 1.75rem 2rem;
+  background: var(--panel);
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  animation: popIn 0.3s cubic-bezier(0.2, 1.4, 0.4, 1);
+}
+
+.legal-box h2 { margin-top: 0; }
+.legal-box p { color: var(--dim); font-size: 0.95rem; }
+.legal-box strong { color: var(--text); }
+
+button {
+  font: inherit;
+  padding: 0.55rem 1.2rem;
+  border: 1px solid var(--accent);
+  border-radius: 8px;
+  background: var(--accent);
+  color: #14161a;
+  font-weight: 600;
+  cursor: pointer;
+  transition: transform 0.15s, box-shadow 0.15s, opacity 0.15s;
+}
+
+button:not(:disabled):hover {
+  transform: translateY(-1px);
+  box-shadow: 0 3px 12px rgba(232, 182, 76, 0.25);
+}
+
+button:not(:disabled):active { transform: translateY(0); }
+
+button:disabled {
+  opacity: 0.45;
+  cursor: default;
+}
+
+button.secondary {
+  background: transparent;
+  color: var(--dim);
+  border-color: var(--border);
+}
+
+button.secondary:not(:disabled):hover {
+  box-shadow: none;
+  color: var(--text);
+}
+
+#legal-accept { width: 100%; margin-top: 0.5rem; }
+
+/* --- dropzone --- */
+
+#dropzone {
+  margin: 1.5rem 0;
+  padding: 2.25rem 1.5rem;
+  text-align: center;
+  background: var(--panel);
+  border: 2px dashed var(--border);
+  border-radius: 12px;
+  cursor: pointer;
+  transition: border-color 0.2s, background 0.2s, transform 0.2s;
+}
+
+#dropzone:hover, #dropzone:focus-visible {
+  border-color: var(--accent);
+  outline: none;
+}
+
+#dropzone.over {
+  border-color: var(--accent);
+  background: #232730;
+  transform: scale(1.01);
+  animation: pulse 1s ease-in-out infinite;
+}
+
+#dropzone p { margin: 0.25rem 0; }
+.hint { color: var(--dim); font-size: 0.9rem; }
+code {
+  background: var(--bg);
+  padding: 0.1em 0.35em;
+  border-radius: 4px;
+  font-size: 0.9em;
+}
+
+/* --- file list --- */
+
+#files {
+  list-style: none;
+  margin: 0 0 0.75rem;
+  padding: 0;
+}
+
+.file {
+  position: relative;
+  margin-bottom: 0.45rem;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  overflow: hidden;
+  background: var(--black);           /* staged */
+  transition: background-color 0.5s ease;
+  animation: slideIn 0.25s ease-out;
+}
+
+.file.leaving {
+  opacity: 0;
+  transform: translateX(12px);
+  margin-bottom: 0;
+  border-width: 0;
+  transition:
+    opacity 0.13s ease-in,
+    transform 0.13s ease-in,
+    max-height 0.17s ease-in 0.03s,
+    margin-bottom 0.17s ease-in 0.03s,
+    border-width 0.17s ease-in 0.03s;
+}
+
+.file .bar {
+  position: absolute;
+  inset: 0;
+  opacity: 0;
+  transition: opacity 0.3s;
+}
+
+.file.working { background: var(--black); }
+
+/* The gradient's left and right edge colors match, so the 200%-sized image
+   tiles seamlessly and the position loop has no visible restart. */
+.file.working .bar {
+  opacity: 1;
+  background: linear-gradient(
+    100deg,
+    var(--blue-deep) 0%,
+    var(--blue) 25%,
+    #7fb3ff 50%,
+    var(--blue) 75%,
+    var(--blue-deep) 100%
+  );
+  background-size: 200% 100%;
+  animation: shimmer 1.6s linear infinite;
+}
+
+.file.ok { background: var(--ok); }
+.file.ok.suspect { background: #6b5a1e; }
+.file.err { background: var(--err); }
+
+.file .row {
+  position: relative;
+  display: flex;
+  align-items: center;
+  gap: 0.6rem;
+  padding: 0.55rem 0.85rem;
+}
+
+.file .name {
+  overflow-wrap: anywhere;
+  font-weight: 600;
+}
+
+.file.working .name { color: #fff; }
+.file.ok .name, .file.err .name { color: #fff; }
+
+.badge.companion {
+  flex: none;
+  display: inline-flex;
+  align-items: center;
+  padding: 0.15rem 0.35rem;
+  border-radius: 5px;
+  background: rgba(59, 130, 246, 0.18);
+  color: #7fb3ff;
+}
+
+.file.ok .badge.companion,
+.file.err .badge.companion,
+.file.working .badge.companion {
+  background: rgba(255, 255, 255, 0.15);
+  color: #fff;
+}
+
+.file .status {
+  flex: 1;
+  text-align: right;
+  font-size: 0.85rem;
+  color: var(--dim);
+  overflow-wrap: anywhere;
+}
+
+.file.ok .status { color: #cfe9d5; }
+.file.ok.suspect .status { color: #f0e3b2; }
+.file.err .status { color: #f0c8c8; }
+.file.working .status { color: #dbe7ff; }
+
+.file .dl {
+  flex: none;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.9rem;
+  height: 1.9rem;
+  border-radius: 6px;
+  background: rgba(255, 255, 255, 0.16);
+  color: #fff;
+  transition: background 0.15s, transform 0.15s;
+  animation: popIn 0.3s cubic-bezier(0.2, 1.4, 0.4, 1);
+}
+
+.file .dl:hover {
+  background: rgba(255, 255, 255, 0.32);
+  transform: scale(1.1);
+}
+
+.file .remove {
+  flex: none;
+  padding: 0.1rem 0.55rem;
+  background: transparent;
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  color: var(--dim);
+  font-weight: 400;
+}
+
+.file .remove:hover {
+  color: var(--err-bright);
+  border-color: var(--err-bright);
+  box-shadow: none;
+  transform: none;
+}
+
+.file.ok .remove,
+.file.err .remove,
+.file.working .remove {
+  border-color: rgba(255, 255, 255, 0.3);
+  color: rgba(255, 255, 255, 0.75);
+}
+
+.file.ok .remove:hover,
+.file.err .remove:hover {
+  color: #fff;
+  border-color: #fff;
+}
+
+.actions {
+  display: flex;
+  gap: 0.6rem;
+  animation: fadeIn 0.25s ease-out;
+}
+
+footer {
+  margin-top: 2rem;
+  color: var(--dim);
+  font-size: 0.85rem;
+}
+footer a { color: var(--dim); }
+
+/* --- animations --- */
+
+@keyframes fadeIn {
+  from { opacity: 0; }
+  to { opacity: 1; }
+}
+
+@keyframes popIn {
+  from { opacity: 0; transform: scale(0.85); }
+  to { opacity: 1; transform: scale(1); }
+}
+
+@keyframes slideIn {
+  from { opacity: 0; transform: translateY(-6px); }
+  to { opacity: 1; transform: translateY(0); }
+}
+
+@keyframes shimmer {
+  from { background-position: 0 0; }
+  to { background-position: -200% 0; }
+}
+
+@keyframes pulse {
+  0%, 100% { box-shadow: 0 0 0 0 rgba(232, 182, 76, 0.25); }
+  50% { box-shadow: 0 0 0 6px rgba(232, 182, 76, 0); }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  *, *::before, *::after {
+    animation-duration: 0.01ms !important;
+    animation-iteration-count: 1 !important;
+    transition-duration: 0.01ms !important;
+  }
+}

web/worker.js

@@ -0,0 +1,41 @@
+// One-shot unpack worker: each unpack runs in a fresh worker with its own
+// wasm instance. Two reasons:
+//
+// 1. UI stays responsive — unpacking a 100 MB+ module blocks for seconds.
+// 2. Trap isolation — the senbei DLL-first routing probe relies on
+//    catch_unwind to reject EXE-shell-layout DLLs, and panics cannot be
+//    caught in WebAssembly: the probe traps the whole call. A trap kills
+//    this worker's message handler, which the main thread observes and
+//    retries with the forced-EXE pipeline in a NEW worker (the trapped
+//    instance is never reused). That reproduces the CLI's
+//    dll-first/exe-fallback routing without a catchable panic.
+
+import init, { unpack_file, unpack_file_force_exe } from './pkg/senbei_web.js';
+
+let ready = null;
+
+self.onmessage = async (e) => {
+  const { input, companion, forceExe } = e.data;
+  try {
+    ready ??= init();
+    await ready;
+    const r = forceExe
+      ? unpack_file_force_exe(input, companion ?? undefined)
+      : unpack_file(input, companion ?? undefined);
+    const bytes = r.bytes;
+    self.postMessage(
+      {
+        ok: true,
+        kind: r.kind,
+        suspect: r.suspect,
+        issues: r.issues,
+        companion: r.companion,
+        bytes,
+      },
+      [bytes.buffer],
+    );
+  } catch (err) {
+    const trap = err instanceof WebAssembly.RuntimeError;
+    self.postMessage({ ok: false, trap, message: String(err?.message ?? err) });
+  }
+};