tianmo
2e7ab7c33c
目标：在 Spine 编辑器窗口内部加一个自己的视图面板（按钮 + 文字显示）， 点击读取场景对象，并像原生面板一样出现在 Views 菜单、可停靠可折叠。 本轮打通： 1. 编辑器在我们自己的进程里完整启动 - 类加载器必须是 URLClassLoader 本身（自检要求） - Editor.main 必须在 AWT EDT 上调用 - jvm.cfg 第 21 行要以两个空格结尾 + -DSpineJava - Editor.D:I 版本号、fonts/、/tzax 资源、Java8 版 launcher.Launcher 替身 2. 3.8.99 全量解密 → 可读源码 - 字符串 17251/17461（伪造同名调用帧对齐 key） - 混淆动态派发还原 53871 处（调引导方法取 MemberName） 3. 自建视图 - agent 在内存里给 us 枚举加 spineView 常量（不改磁盘，避开完整性自检） - 面板 Actor 由外部反射填进 us.spineView.D - 复用已有图标做别名（不新建图片资源） 最终 "Spine View" 出现在 Views 菜单，可与 Tree 并排停靠、折叠展开 另外： - ViewPatcher/ViewAgent：视图枚举与面板挂载的字节码插桩 - DecAll/ObMap/rewrite_source：字符串解密、派发还原、可读源码生成 - 阶段四-视图面板挂载.md：完整记录做法与踩过的坑 不纳入版本管理：rea/（独立仓库）、tools 下的 JDK/Ghidra 工具链、 Spine.app 与 spine-lab 副本、从载荷派生的批量产物。
2 lines
15 KiB
JSON
2 lines
15 KiB
JSON
{"binding":{"analysis_profile":{"digest":"966e6016724421ad282356f583a9d5bf24577db4ac77a75c7099d236b88bcc28","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"arm64","available_architectures":["arm64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","no_return_repair":"returning-imports-decoded-return-v2","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"mach-o","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.4"}},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.4"}},"entries":[],"evidence_bundle":{"artifacts":[{"architecture":"arm64","digest":{"sha256":"2549d0b07be0926995628e0e887e72cf0812c80438a7cfb9d1935c88cad28c57"},"format":"mach-o"}],"captures":[],"environments":[],"providers":[{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}],"records":[{"analysis_profile":{"digest":"36e03fb12d9b7fb24826a311c442f39020ecdc72441154c33bf99b49256605a8","parameters":{"upstream_analysis_profile":{"digest":"966e6016724421ad282356f583a9d5bf24577db4ac77a75c7099d236b88bcc28","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"arm64","available_architectures":["arm64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","no_return_repair":"returning-imports-decoded-return-v2","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"mach-o","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.4"}},"workflow_revision":3},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_e367b51c6019f1891f6453ad38ede6785bbe937bb983126847ece3b99ae05bd3","evidence_links":[],"limitations":["Derived by an REA composed workflow.","A headless Ghidra session contains exactly one imported Program, unlike Hopper's multi-document GUI session.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Charset is reported, while a non-missing terminator cannot distinguish a present terminator from a fixed or Pascal layout.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.","External functions and local thunks are distinct; procedure metadata identifies both and preserves a thunk target when Ghidra resolves one.","Memory-block end addresses are exclusive; permissions come from Ghidra MemoryBlock flags rather than inference from section names.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","macOS sessions require a matching executable Ghidra native decompiler; REA checks for it but does not build native components or change Gatekeeper quarantine state."],"locations":[],"normalized_result":{"document":"target-2549d0b07be0.dylib","image_base":"0x0","procedure_count":17006,"segment_count":23,"segments":[{"address_space":"ram","end":"0x1d70","image_base":"0x0","length":7536,"name":"__TEXT","start":"0x0"},{"address_space":"ram","end":"0xb6f74","image_base":"0x0","length":741892,"name":"__text","start":"0x1d70"},{"address_space":"ram","end":"0xc40f0","image_base":"0x0","length":53628,"name":"__stubs","start":"0xb6f74"},{"address_space":"ram","end":"0xc4420","image_base":"0x0","length":816,"name":"__stub_helper","start":"0xc40f0"},{"address_space":"ram","end":"0xc45a0","image_base":"0x0","length":384,"name":"__objc_stubs","start":"0xc4420"},{"address_space":"ram","end":"0xc6ca0","image_base":"0x0","length":9984,"name":"__gcc_except_tab","start":"0xc45a0"},{"address_space":"ram","end":"0xc6dd8","image_base":"0x0","length":312,"name":"__const","start":"0xc6ca0"},{"address_space":"ram","end":"0xc739a","image_base":"0x0","length":1474,"name":"__cstring","start":"0xc6dd8"},{"address_space":"ram","end":"0xc7458","image_base":"0x0","length":190,"name":"__objc_methname","start":"0xc739a"},{"address_space":"ram","end":"0xcc1e0","image_base":"0x0","length":19848,"name":"__unwind_info","start":"0xc7458"},{"address_space":"ram","end":"0x118000","image_base":"0x0","length":310816,"name":"__eh_frame","start":"0xcc1e0"},{"address_space":"ram","end":"0x118118","image_base":"0x0","length":280,"name":"__got","start":"0x118000"},{"address_space":"ram","end":"0x120cc0","image_base":"0x0","length":35752,"name":"__la_symbol_ptr","start":"0x118118"},{"address_space":"ram","end":"0x120e30","image_base":"0x0","length":368,"name":"__const","start":"0x120cc0"},{"address_space":"ram","end":"0x120e38","image_base":"0x0","length":8,"name":"__objc_imageinfo","start":"0x120e30"},{"address_space":"ram","end":"0x120e98","image_base":"0x0","length":96,"name":"__objc_selrefs","start":"0x120e38"},{"address_space":"ram","end":"0x120ea0","image_base":"0x0","length":8,"name":"__objc_classrefs","start":"0x120e98"},{"address_space":"ram","end":"0x120f18","image_base":"0x0","length":120,"name":"__data","start":"0x120ea0"},{"address_space":"ram","end":"0x120f1c","image_base":"0x0","length":4,"name":"__bss","start":"0x120f18"},{"address_space":"ram","end":"0x124000","image_base":"0x0","length":12516,"name":"__DATA","start":"0x120f1c"},{"address_space":"ram","end":"0x2e8010","image_base":"0x0","length":1851408,"name":"__LINKEDIT","start":"0x124000"},{"address_space":"ram","end":"0x2ec000","image_base":"0x0","length":16368,"name":"__LINKEDIT","start":"0x2e8010"},{"address_space":"ram","end":"0x2edf00","image_base":"0x0","length":7936,"name":"EXTERNAL","start":"0x2ec000"}],"string_count":16920},"operation":"binary_overview","parameters":{},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"arm64","digest":{"sha256":"2549d0b07be0926995628e0e887e72cf0812c80438a7cfb9d1935c88cad28c57"},"format":"mach-o","local_path":"/private/var/folders/jl/m50cxy0d7zzfd0448wzhj2bc0000gn/T/.spine/tianmokeji/4.3.26/libspine-editorarm64.dylib","name":"libspine-editorarm64.dylib"}}],"scenarios":[],"unknowns":[]},"target":{"architecture":"arm64","format":"mach-o","kind":"executable","sha256":"2549d0b07be0926995628e0e887e72cf0812c80438a7cfb9d1935c88cad28c57"},"workflow_entries":[{"execution":{"analysis_profile":{"digest":"36e03fb12d9b7fb24826a311c442f39020ecdc72441154c33bf99b49256605a8","parameters":{"upstream_analysis_profile":{"digest":"966e6016724421ad282356f583a9d5bf24577db4ac77a75c7099d236b88bcc28","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"arm64","available_architectures":["arm64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","no_return_repair":"returning-imports-decoded-return-v2","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"mach-o","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.4"}},"workflow_revision":3},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"limitations":["Derived by an REA composed workflow.","A headless Ghidra session contains exactly one imported Program, unlike Hopper's multi-document GUI session.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Charset is reported, while a non-missing terminator cannot distinguish a present terminator from a fixed or Pascal layout.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.","External functions and local thunks are distinct; procedure metadata identifies both and preserves a thunk target when Ghidra resolves one.","Memory-block end addresses are exclusive; permissions come from Ghidra MemoryBlock flags rather than inference from section names.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","macOS sessions require a matching executable Ghidra native decompiler; REA checks for it but does not build native components or change Gatekeeper quarantine state."],"locations":[],"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"result":{"document":"target-2549d0b07be0.dylib","image_base":"0x0","procedure_count":17006,"segment_count":23,"segments":[{"address_space":"ram","end":"0x1d70","image_base":"0x0","length":7536,"name":"__TEXT","start":"0x0"},{"address_space":"ram","end":"0xb6f74","image_base":"0x0","length":741892,"name":"__text","start":"0x1d70"},{"address_space":"ram","end":"0xc40f0","image_base":"0x0","length":53628,"name":"__stubs","start":"0xb6f74"},{"address_space":"ram","end":"0xc4420","image_base":"0x0","length":816,"name":"__stub_helper","start":"0xc40f0"},{"address_space":"ram","end":"0xc45a0","image_base":"0x0","length":384,"name":"__objc_stubs","start":"0xc4420"},{"address_space":"ram","end":"0xc6ca0","image_base":"0x0","length":9984,"name":"__gcc_except_tab","start":"0xc45a0"},{"address_space":"ram","end":"0xc6dd8","image_base":"0x0","length":312,"name":"__const","start":"0xc6ca0"},{"address_space":"ram","end":"0xc739a","image_base":"0x0","length":1474,"name":"__cstring","start":"0xc6dd8"},{"address_space":"ram","end":"0xc7458","image_base":"0x0","length":190,"name":"__objc_methname","start":"0xc739a"},{"address_space":"ram","end":"0xcc1e0","image_base":"0x0","length":19848,"name":"__unwind_info","start":"0xc7458"},{"address_space":"ram","end":"0x118000","image_base":"0x0","length":310816,"name":"__eh_frame","start":"0xcc1e0"},{"address_space":"ram","end":"0x118118","image_base":"0x0","length":280,"name":"__got","start":"0x118000"},{"address_space":"ram","end":"0x120cc0","image_base":"0x0","length":35752,"name":"__la_symbol_ptr","start":"0x118118"},{"address_space":"ram","end":"0x120e30","image_base":"0x0","length":368,"name":"__const","start":"0x120cc0"},{"address_space":"ram","end":"0x120e38","image_base":"0x0","length":8,"name":"__objc_imageinfo","start":"0x120e30"},{"address_space":"ram","end":"0x120e98","image_base":"0x0","length":96,"name":"__objc_selrefs","start":"0x120e38"},{"address_space":"ram","end":"0x120ea0","image_base":"0x0","length":8,"name":"__objc_classrefs","start":"0x120e98"},{"address_space":"ram","end":"0x120f18","image_base":"0x0","length":120,"name":"__data","start":"0x120ea0"},{"address_space":"ram","end":"0x120f1c","image_base":"0x0","length":4,"name":"__bss","start":"0x120f18"},{"address_space":"ram","end":"0x124000","image_base":"0x0","length":12516,"name":"__DATA","start":"0x120f1c"},{"address_space":"ram","end":"0x2e8010","image_base":"0x0","length":1851408,"name":"__LINKEDIT","start":"0x124000"},{"address_space":"ram","end":"0x2ec000","image_base":"0x0","length":16368,"name":"__LINKEDIT","start":"0x2e8010"},{"address_space":"ram","end":"0x2edf00","image_base":"0x0","length":7936,"name":"EXTERNAL","start":"0x2ec000"}],"string_count":16920},"subject":{"architecture":"arm64","format":"mach-o","path":"/private/var/folders/jl/m50cxy0d7zzfd0448wzhj2bc0000gn/T/.spine/tianmokeji/4.3.26/libspine-editorarm64.dylib","sha256":"2549d0b07be0926995628e0e887e72cf0812c80438a7cfb9d1935c88cad28c57"}},"operation":"binary_overview","parameters":{},"query_id":"query_79cc050df9d977d35d455f410cac7cc01edca2bfe9e6eca3c203f70363b42fcc"}]}
|