Momoko-Ayase/Senbei
1
1
Fork 0
mirror of https://github.com/Momoko-Ayase/Senbei.git synced 2026-09-19 03:57:59 -04:00
Code Issues Activity

refactor: consolidate platform engines into senbei-engine

Browse Source
This commit is contained in:
bfloat16
2026-09-06 19:31:19 +08:00
parent cbfacbc31f
commit d436a200ba
66 changed files with 1148 additions and 1012 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+33 -66
View File
@@ -1,89 +1,56 @@
# Senbei
A static unpacker for Crackproof-protected 64-bit and 32-bit PE files and
protected Android (AArch64) shared libraries. Point it at a file, an app
package, or a folder and it writes decrypted copies — no launch of the
protected program, no kernel driver, no code runs out of the protected binary.
A static unpacker for Crackproof-protected 64-bit and 32-bit PE files and protected Android AArch64 shared libraries. Point it at a file, an app package, or a folder and it writes decrypted copies without launching the protected program.
> _"Crackproof"? It's senbei (煎餅 — rice cracker). Cracks itself._
Senbei reads protected input bytes and replays the unpacking algorithm statically. The command-line tool adds filesystem scanning, progress reporting, and logs; `senbei-wasm` provides the browser binding.
Senbei reads a protected `.exe` or `.dll`, replays the unpacking algorithm
entirely in memory, and writes the recovered image to a new file. The core is a
pure, panic-free library with no file I/O; the CLI wraps it with scanning, a
progress bar, and a run log. A browser version (WebAssembly, fully client-side)
lives in [`web/`](web/).
## Crates
## Legal notice and intended use
The workspace contains eight crates: `senbei-cli`, `senbei-crypto`, `senbei-io`, `senbei-metadata`, `senbei-pe`, `senbei-elf`, `senbei-engine`, and `senbei-wasm`.
**Read this before using Senbei.**
`senbei-pe` and `senbei-elf` contain only basic format parsing and address mapping. Protection-specific code is in `senbei-engine/src/windows/` and `senbei-engine/src/android/`. Platform-specific crypto and metadata code is grouped under `senbei-crypto/src/android/`, `senbei-metadata/src/windows/`, and `senbei-metadata/src/android/`.
- Senbei is a research and interoperability tool. It exists to enable lawful
reverse engineering, security research, preservation, and interoperability
with software you already legitimately possess.
- **Only process binaries you own or are explicitly authorized to analyze.**
Depending on your jurisdiction and license agreements, circumventing
technological protection measures may be restricted (for example under
DMCA §1201 in the United States, which contains exemptions for security
research and interoperability). It is your responsibility to ensure your use
is lawful.
- Senbei does not bypass any access control for you: it performs a purely
static transformation of a file already on your disk. It derives everything
it needs from the input file itself, contains no vendor code, and
distributes no cracks or copyrighted content. (One Android packaging
variant's embedded metadata layer is unwrapped with an XOR keystream
recovered from a ciphertext/plaintext pair during analysis of a single
build; that keystream is research output shipped with the unpacker, not a
vendor-distributed key, and builds it doesn't match are left alone.)
- Senbei does not enable online play, license fraud, or cheating, and must not
be used to redistribute decrypted binaries. Do not upload outputs anywhere.
- The authors provide this software "as is", without warranty of any kind, and
accept no liability for misuse. See [LICENSE](LICENSE) (AGPL-3.0).
- "Crackproof" is a trademark of its respective owner; this project is not
affiliated with or endorsed by the protection vendor or any software
publisher. Names are used for identification only.
## Supported Inputs
## What it handles
- Protected Windows `.exe` and `.dll` files, including external `<name>.exe._` and `<name>.dll._` payloads.
- `global-metadata.dat` files with supported method-token layouts.
- Protected Android `.so` files and Android `.apk`, `.apks`, and `.xapk` packages.
| Kind | Description |
| --- | --- |
| `NativeExe` | Crackproof-protected native executable (PE32+ and PE32). |
| `ManagedExe` | Protected .NET executable (has a CLR data directory). |
| `NativeDll` | Protected native (unmanaged) DLL. |
| `ManagedDll` | Protected .NET assembly (has a CLR data directory). |
| `._` companion | Stub + external encrypted payload layout, spliced automatically. |
| `global-metadata.dat` | il2cpp metadata with obfuscated method tokens, de-obfuscated in place. |
| Android `.so` | Protected AArch64 shared library, statically restored (hollowed sections + stripped dynamic tables rebuilt). |
| `.apk` / `.apks` / `.xapk` | App packages; protected entries inside are restored, preserving the package's internal layout. |
Windows scanning probes only `.exe`, `.dll`, and `global-metadata.dat`; companion payloads are consumed through their matching stub and are not counted as skipped files. Android scanning probes only `.so` and `global-metadata.dat`. Android packages are inspected from their ZIP manifests and only matching `.so` and metadata entries are extracted.
Detection is content-based (header key-table at offset 4096, magic `KONN`),
not extension-based — app packages are the one exception, recognised by
extension plus the zip magic because they are containers. Anything
unrecognized is left untouched.
## Quick start
## Quick Start
```cmd
cargo build --release
senbei protected.exe
:: -> unpack\protected.unpack.exe
senbei game.apk
:: -> unpack\game.apk\lib\arm64-v8a\libil2cpp.unpack.so
senbei "C:\Games\MyGame"
:: -> C:\Games\MyGame\unpack\... (recursive, skips non-targets)
```
Every output is sanity-checked statically; structurally broken results are
flagged as suspect rather than silently trusted.
Outputs are written below an `unpack` directory unless `--out` is supplied. Every restored PE or ELF image passes a structural validation step before it is reported as successful.
## Documentation
## Tests
- [Usage reference](docs/usage.md) — CLI flags, exit codes, integrity check
- [Design](docs/design.md) — architecture, routing, and error model
- [Development](docs/development.md) — building, testing, environment variables
- [Web version](web/README.md) — run Senbei in a browser
```cmd
cargo test --release --workspace
cargo clippy --workspace --all-targets -- -D warnings
cargo fmt --all -- --check
```
The local `test/` corpus can be passed to the CLI for real sample verification. The tracked `samples/` corpus is optional and remains user-managed.
## Web Build
```cmd
cd senbei-wasm
wasm-pack build --target web --release --out-dir ../web/pkg
```
The generated package is written to the ignored `web/pkg/` directory and can be served with any static HTTP server.
## Legal Notice
Use Senbei only for software you own or are authorized to analyze. The project is intended for lawful reverse engineering, security research, preservation, and interoperability.
## License