求助,學園默示錄 HIGH SCHOOL OF THE DEAD DAY 0解包拿Spine问题

學園默示錄 HIGH SCHOOL OF THE DEAD DAY 0

解包看是Unity WebGL,F12 Network 初次切换夥伴角色时,会载入类似以下命名的档案:
show_partner_shaye01_low.bytes
show_partner_shaye02_low.bytes
show_partner_shaye03_low.bytes
show_partner_shaye04_low.bytes

show_partner_li01_low.bytes
show_partner_li02_low.bytes
show_partner_li03_low.bytes
show_partner_li04_low.bytes

show_partner_jingxiang01_low.bytes
show_partner_jingxiang02_low.bytes
show_partner_jingxiang03_low.bytes
show_partner_jingxiang04_low.bytes

show_partner_yazi01_low.bytes
show_partner_yazi02_low.bytes
show_partner_yazi03_low.bytes
show_partner_yazi04_low.bytes

我用简单的 binary string scan 检查后,发现部分 .bytes 内可以看到 Spine / atlas 相关内容,感觉应该是 Spine 资源。但没成功还原 skeleton / atlas / png。现在有点卡住了

求懂 Spine / Unity 资源分析的大佬指点一下方向,感谢:folded_hands:

我猜这个bytes应该是UnityWebGL序列化的产物,同时做过了处理
找到了一点可能有用的东西
platform-sc.g123.jp/micro-app/auxin/1.16.92/assets/index.js
发现了下面这么一段

window.loadSpineAnimationData=loadSpineAnimationData;function initAnimate(_e,$,et){const{onComplete:tt}=et;let nt="";_e.base_path?nt=_e.base_path:nt="https://platform-sc.g123.jp/micro-app/auxin/",nt.endsWith("/")||(nt+="/");let it;_e.overrideLang==="ja"?it="ja":_e.overrideLang==="zh-TW"?it="zh-TW":_e.overrideLang==="ko"?it="ko":it="en";const{animeName:rt,animation:at}=_e,st=$.current,ot={};ot[`${rt}.json`]=`${nt}${it}/${rt}.json`,ot[`${rt}.atlas`]=`${nt}${it}/${rt}.atlas`,ot[`${rt}.webp`]=`${nt}${it}/${rt}.webp`,new SpinePlayer(st,{binaryUrl:`${nt}${it}/${rt}.json`,atlasUrl:`${nt}${it}/${rt}.atlas`,premultipliedAlpha:!1,alpha:!0,backgroundColor:"#00000000",animation:at,rawDataURIs:ot

如果知道模型名称,就可以得到

  1. https://platform-sc.g123.jp/micro-app/auxin/{lang}/{animeName}.json
  2. https://platform-sc.g123.jp/micro-app/auxin/{lang}/{animeName}.atlas
  3. https://platform-sc.g123.jp/micro-app/auxin/{lang}/{animeName}.webp

这里的lang可以从"ja" / "zh-TW" / "ko" / "en"选一个,但是这个名称就不知道了,尝试了show_partner_yazi01_lowyazi01以及show_partner_yazi01,也就是上面的bytes文件的名称,都不太行

感谢大佬提供 auxin 方向,我照这个方向继续测了一下。

我后来把 hook 改成在 page.goto 前用 add_init_script 注入,避免手动贴 Console 太晚漏掉早期请求。这次有确认到:

  1. auxin micro-app 确实有载入:
    g123-ma-auxin

  2. auxin 也有初始化、mount 成功,而且 window.loadSpineAnimationData 也成功被 hook 到。

  3. 但是在实际进入 HOTD Unity 游戏、切换夥伴角色时,没有看到 auxin 的:
    {animeName}.json
    {animeName}.atlas
    {animeName}.webp

  4. 反而实际抓到的是 Unity WebGL 内的 XHR 请求:

    /StreamingAssets/webgl/spine/show_partner_shaye01_low.bytes
    /StreamingAssets/webgl/spine/show_partner_shaye02_low.bytes
    /StreamingAssets/webgl/spine/show_partner_shaye03_low.bytes
    /StreamingAssets/webgl/spine/show_partner_shaye04_low.bytes

    /StreamingAssets/webgl/spine/show_partner_li01_low.bytes
    /StreamingAssets/webgl/spine/show_partner_jingxiang01_low.bytes
    /StreamingAssets/webgl/spine/show_partner_yazi01_low.bytes
    /StreamingAssets/webgl/spine/show_partner_baihezi01_low.bytes

    这些请求都是 xhr-load 200。我补一份log 从log可以看到:

Hook 是在早期注入成功的:[SPINE DEBUG V2] installed early

auxin 确实有载入与初始化:[MA Auxin]: app version 1.16.92[SPINE DEBUG V2] fetch [MA Auxin]: app initialized[MA Auxin]: app mounted[SPINE DEBUG V2] loadSpineAnimationData hooked

但实际切换夥伴角色时,抓到的是 Unity WebGL 的 XHR bytes:/StreamingAssets/webgl/spine/show_partner_shaye01_low.bytes/StreamingAssets/webgl/spine/show_partner_shaye02_low.bytes/StreamingAssets/webgl/spine/show_partner_li01_low.bytes/StreamingAssets/webgl/spine/show_partner_yazi01_low.bytes…

这些都是 xhr-load 200。

所以目前看起来,auxin 有载入,但 HOTD 夥伴角色这一块没有走 auxin 的 {animeName}.json/.atlas/.webp,而是 Unity 直接 XHR 载入 /StreamingAssets/webgl/spine/*.bytes。但还是没成功还原 skeleton / atlas / png

[19:32:05] [SPINE DEBUG V2] installed early
[19:32:06] [SPINE DEBUG V2] installed early
[19:32:06] [SPINE DEBUG V2] installed early
[19:32:06] [SPINE DEBUG V2] installed early
[19:32:07] [SPINE DEBUG V2] installed early
[19:32:07] [SPINE DEBUG V2] installed early
[19:32:07] [SPINE DEBUG V2] installed early
[19:32:07] [SPINE DEBUG V2] img.src TemplateData/splash_tw.webp
[19:32:07] [SPINE DEBUG V2] installed early
[19:32:08] [SPINE DEBUG V2] installed early
[19:32:08] [MA Auxin]: reloading the existing app
[19:32:08] [MA Auxin]: initializing the app
[19:32:10] [MA Auxin]: app version 1.16.92
[19:32:10] [SPINE DEBUG V2] fetch g123-ma-auxin
[19:32:10] [MA Auxin]: app initialized {mount: , unmount: , getStatus: , loadPromise: Promise, bootstrapPromise: Promise}
[19:32:10] [SPINE DEBUG V2] fetch-response 200 g123-ma-auxin
[19:32:10] [SPINE DEBUG V2] fetch https://platform-sc.g123.jp/micro-app/auxin/1.16.92/assets/style.css
[19:32:10] [SPINE DEBUG V2] fetch-response 200 https://platform-sc.g123.jp/micro-app/auxin/1.16.92/assets/style.css
[19:32:10] [MA Auxin]: app mounted
[19:32:10] [SPINE DEBUG V2] loadSpineAnimationData hooked
[19:32:12] [SPINE DEBUG V2] installed early
[19:32:12] [SPINE DEBUG V2] installed early
[19:32:14] [SPINE DEBUG V2] installed early
[19:32:14] [SPINE DEBUG V2] installed early
[19:32:22] [SPINE DEBUG V2] installed early
[19:32:31] Loading player data from data.unity3d
[19:32:31] Initialize engine version: 2022.3.62f1 (4af31df58517)
[19:32:53] [MA Auxin] [Event] post auxin_game_loaded
[19:36:21] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/textures/partnerheadicon.bytes
[19:36:21] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_shaye01_low.bytes
[19:36:21] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/textures/partnerheadicon.bytes
[19:36:21] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_shaye01_low.bytes
[19:36:24] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/textures/partner/defalutmodel.bytes
[19:36:24] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/textures/partnerflagicon.bytes
[19:36:24] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_shaye02_low.bytes
[19:36:24] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/textures/partner/defalutmodel.bytes
[19:36:24] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_shaye02_low.bytes
[19:36:24] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/textures/partnerflagicon.bytes
[19:36:25] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_shaye03_low.bytes
[19:36:25] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_shaye03_low.bytes
[19:36:26] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_shaye04_low.bytes
[19:36:26] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_shaye04_low.bytes
[19:36:30] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_li01_low.bytes
[19:36:30] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_li01_low.bytes
[19:36:32] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_li02_low.bytes
[19:36:32] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_li02_low.bytes
[19:36:33] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_li03_low.bytes
[19:36:33] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_li03_low.bytes
[19:36:34] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_li04_low.bytes
[19:36:34] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_li04_low.bytes
[19:36:36] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_jingxiang01_low.bytes
[19:36:37] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_jingxiang01_low.bytes
[19:36:38] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_jingxiang02_low.bytes
[19:36:38] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_jingxiang02_low.bytes
[19:36:39] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_jingxiang03_low.bytes
[19:36:39] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_jingxiang03_low.bytes
[19:36:40] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_jingxiang04_low.bytes
[19:36:40] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_jingxiang04_low.bytes
[19:36:43] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_yazi01_low.bytes
[19:36:43] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_yazi01_low.bytes
[19:36:44] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_yazi02_low.bytes
[19:36:44] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_yazi02_low.bytes
[19:36:46] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_yazi03_low.bytes
[19:36:46] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_yazi03_low.bytes
[19:36:46] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_yazi04_low.bytes
[19:36:46] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_yazi04_low.bytes
[19:36:50] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_baihezi01_low.bytes
[19:36:50] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_baihezi01_low.bytes
[19:36:50] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_baihezi02_low.bytes
[19:36:50] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_baihezi02_low.bytes
[19:36:51] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_baihezi03_low.bytes
[19:36:52] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_baihezi03_low.bytes
[19:36:52] [SPINE DEBUG V2] xhr-open GET https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_baihezi04_low.bytes
[19:36:52] [SPINE DEBUG V2] xhr-load 200 https://g123-jp-hotd.pro.g123-cpp.com/v.1.0.0.38318/StreamingAssets/webgl/spine/show_partner_baihezi04_low.bytes

有什么进展吗?感觉贴图是加密流式加载,不会暴露独立下载链接,也没有独立的游戏主包

我尝试过丢给GROK去解包,但是GROK通过暴力去解不行,它给出最大的问题是需要签名,我一个只懂皮毛的菜鸟咋会看签名