extract_config.js

// Execute-and-observe extractor for OnlyFans 2313.js signing config.
//
// Design goal: survive OF's routine re-obfuscation, which only ever RENAMES
// identifiers and REORDERS/rewrites decoder-call arguments (e.g. i(n-744,W)
// becomes i(W- -290,n)). Those changes break any extractor that pattern-matches
// a specific variable layout or argument order.
//
// So we do the opposite of pattern-matching: we bootstrap the script's OWN
// string decoder, then carve the ops object / decoder wrapper / checksum
// function out of the source by BRACE MATCHING (structure, not names), rebuild
// the checksum as a live function, and BLACK-BOX PROBE it (finite differences)
// to recover the indexes + constant — then self-verify that against the real
// function on random inputs before writing anything out.
//
// Identifier names and argument orders are irrelevant because we reuse the
// original source substrings and let the JS engine resolve them. No value is
// ever parsed textually; every value comes from running the site's own code.

const fs = require("fs");
const path = require("path");

const scriptPath = process.argv[2] || path.join(__dirname, "_2313.js");
const outPath = process.argv[3] || path.join(__dirname, "result.json");
const code = fs.readFileSync(scriptPath, "utf8").replace(/\r\n/g, "\n");

function fail(msg) {
  console.error(`[extract_config] ${msg}`);
  process.exit(1);
}

// Indirect eval → runs in global scope, so `function i(){}` / `function k(){}`
// from the bootstrap become globals we can call later.
const run = (0, eval);

// --- string-aware bracket matcher --------------------------------------------
// Returns the index of the bracket that closes the one at `openIdx`, skipping
// over string literals (the obfuscated code embeds "(", ")", "[", "#", etc.
// inside decoder-key strings, so a naive counter would miscount).
function findMatch(src, openIdx) {
  const open = src[openIdx];
  const close = open === "{" ? "}" : open === "(" ? ")" : open === "[" ? "]" : null;
  if (!close) throw new Error(`findMatch: '${open}' is not an opening bracket`);
  let depth = 0;
  let quote = null;
  for (let i = openIdx; i < src.length; i++) {
    const ch = src[i];
    if (quote) {
      if (ch === "\\") i++;
      else if (ch === quote) quote = null;
      continue;
    }
    if (ch === '"' || ch === "'" || ch === "`") quote = ch;
    else if (ch === open) depth++;
    else if (ch === close && --depth === 0) return i;
  }
  throw new Error("findMatch: no matching bracket");
}

// Given the index of a `function` keyword, return the span of its body braces.
function functionBody(src, fnIdx) {
  let i = fnIdx + "function".length;
  while (/\s/.test(src[i])) i++;
  while (/\w/.test(src[i])) i++; // optional name
  while (/\s/.test(src[i])) i++;
  if (src[i] !== "(") return null;
  let j = findMatch(src, i) + 1; // after param list
  while (/\s/.test(src[j])) j++;
  if (src[j] !== "{") return null;
  return { start: fnIdx, open: j, close: findMatch(src, j) };
}

function allIndexesOf(src, needle, until = src.length) {
  const out = [];
  for (let i = src.indexOf(needle); i >= 0 && i < until; i = src.indexOf(needle, i + 1)) out.push(i);
  return out;
}

// --- 1. bootstrap the decoder ------------------------------------------------
// Eval everything from the decoder function through the array-shuffle IIFE, so
// the live decoder + rotated string table exist as globals. We locate the
// decoder by its base64 alphabet (a semantic constant that never changes) and
// the shuffle by its `}(<arrayFn>, <bigNumber>)` tail.
const ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";
const alphaIdx = code.indexOf(ALPHABET);
if (alphaIdx < 0) fail("Could not find base64 alphabet — not a 2313.js decoder script.");

// Decoder function: the last `function <name>(a,b){` whose body contains the alphabet.
let decoderIdx = -1;
let decoderName = null;
for (const m of code.matchAll(/function\s+(\w+)\s*\(\s*\w+\s*,\s*\w+\s*\)\s*\{/g)) {
  if (m.index > alphaIdx) break;
  const body = functionBody(code, m.index);
  if (body && body.open < alphaIdx && body.close > alphaIdx) {
    decoderIdx = m.index;
    decoderName = m[1];
  }
}
if (decoderIdx < 0) fail("Could not locate the decoder function around the alphabet.");

// Array function: `function <name>(){...["...","..."]...}` — the string table.
// Shuffle IIFE: `!function(a,b){...}(<arrayFn>, <number>)`. We eval from the
// earliest of {decoder, arrayFn} through the end of the shuffle.
const shuffleMatch = code.match(/!\s*function\s*\(\s*\w+\s*,\s*\w+\s*\)\s*\{/g)
  ? code.slice(decoderIdx).match(/!\s*function\s*\(\s*\w+\s*,\s*\w+\s*\)\s*\{/)
  : null;
if (!shuffleMatch) fail("Could not find the array-shuffle IIFE.");
const shuffleFnIdx = decoderIdx + shuffleMatch.index; // index of '!'
const shuffleBody = functionBody(code, code.indexOf("function", shuffleFnIdx));
if (!shuffleBody) fail("Could not parse the shuffle IIFE body.");
// consume the trailing `(<arrayFn>, <number>)`
let p = shuffleBody.close + 1;
while (/\s/.test(code[p])) p++;
if (code[p] !== "(") fail("Shuffle IIFE is not immediately invoked.");
const shuffleCallEnd = findMatch(code, p);
const arrayFnName = (code.slice(p + 1, shuffleCallEnd).match(/^\s*(\w+)\s*,/) || [])[1];

// Array function declaration (named arrayFnName) — find it so we can include it.
let arrayFnIdx = -1;
if (arrayFnName) {
  const am = code.match(new RegExp(`function\\s+${arrayFnName}\\s*\\(\\s*\\)\\s*\\{`));
  if (am) arrayFnIdx = am.index;
}

const bootStart = arrayFnIdx >= 0 ? Math.min(decoderIdx, arrayFnIdx) : decoderIdx;
run(code.slice(bootStart, shuffleCallEnd + 1) + ";");

// Sanity: decoder must now be callable.
const decode = globalThis[decoderName] || run(decoderName);
if (typeof decode !== "function") fail(`Decoder ${decoderName}() did not bootstrap.`);

// --- 2. isolate the n.A signing body -----------------------------------------
const nAStart = code.indexOf(".A=");
if (nAStart < 0) fail("Could not find the .A signing export.");
const nAArrow = code.indexOf("{", code.indexOf("=>", nAStart));
const nA = code.slice(nAStart, findMatch(code, nAArrow) + 1);

// ops object: first `const/let/var <name> = { ... }` inside n.A.
const opsDeclMatch = nA.match(/(?:const|let|var)\s+(\w+)\s*=\s*\{/);
if (!opsDeclMatch) fail("Could not find the ops object in n.A.");
const opsName = opsDeclMatch[1];
const opsOpen = nA.indexOf("{", opsDeclMatch.index);
const opsBody = nA.slice(opsOpen + 1, findMatch(nA, opsOpen));

// decoder wrapper(s): every `function <name>(a,b){return <decoder>(...)}` in n.A.
// (There can be more than one; include them all in the eval preamble.)
const wrapperSrcs = [];
for (const m of nA.matchAll(/function\s+\w+\s*\(\s*\w+\s*,\s*\w+\s*\)\s*\{\s*return\s+\w+\s*\(/g)) {
  const body = functionBody(nA, m.index);
  if (body) wrapperSrcs.push(nA.slice(body.start, body.close + 1));
}
if (!wrapperSrcs.length) fail("Could not find any decoder wrapper in n.A.");
const preamble = wrapperSrcs.join("\n") + "\n";

// checksum function: the `function(hash){ ... Math[...] ... }` invoked on the hash.
const mathIdx = nA.indexOf("Math[");
if (mathIdx < 0) fail("Could not find the checksum (no Math[...] in n.A).");
let checksumSrc = null;
let hashVar = null;
for (const fnIdx of allIndexesOf(nA, "function", mathIdx).reverse()) {
  const body = functionBody(nA, fnIdx);
  if (body && body.open < mathIdx && body.close > mathIdx) {
    checksumSrc = nA.slice(body.start, body.close + 1);
    hashVar = (checksumSrc.match(/^function\s*\w*\s*\(\s*(\w+)\s*\)/) || [])[1];
    break;
  }
}
if (!checksumSrc || !hashVar) fail("Could not carve out the checksum function.");

// --- 3. recover staticParam / start / end by executing the decoder -----------
// The 32-char RC4 key, the 5-char start segment and the 8-char end segment are
// decoded strings. Depending on the build they live either as ops-object values
// or as direct decoder calls in the return array — so we collect EVERY decoded
// string in n.A (ops values + every wrapper call) and select by length, which
// is a semantic property that survives renaming.
let opsLive;
try {
  opsLive = new Function(decoderName, `${preamble}return {${opsBody}};`)(decode);
} catch (e) {
  fail(`Could not evaluate ops object: ${e.message}`);
}
const strSet = new Set(Object.values(opsLive).filter((v) => typeof v === "string"));

// Evaluate every `wrapper(...)` call appearing in n.A and keep the strings.
const wrapperNames = wrapperSrcs.map((s) => s.match(/function\s+(\w+)/)[1]);
for (const wname of wrapperNames) {
  const callRe = new RegExp(`\\b${wname}\\s*\\(`, "g");
  for (let m; (m = callRe.exec(nA)); ) {
    const openParen = nA.indexOf("(", m.index);
    const argsSrc = nA.slice(openParen, findMatch(nA, openParen) + 1);
    try {
      const val = new Function(decoderName, `${preamble}return ${wname}${argsSrc};`)(decode);
      if (typeof val === "string") strSet.add(val);
    } catch {
      /* not a constant-foldable call; ignore */
    }
  }
}
const strVals = [...strSet];

const pick = (len, prefer) => {
  const cands = strVals.filter((v) => v.length === len);
  return (prefer && cands.find(prefer)) || cands[0] || null;
};
const staticParam = pick(32);
const start = pick(5, (v) => /^\d+$/.test(v)); // numeric-looking
const end = pick(8, (v) => /^[0-9a-f]+$/i.test(v)); // hex-looking

if (typeof staticParam !== "string") fail("Could not find staticParam (32-char value).");
if (typeof start !== "string") fail("Could not find start (5-char value).");
if (typeof end !== "string") fail("Could not find end (8-char value).");

// --- 4. rebuild the checksum as a LIVE function ------------------------------
// ops + decoder wrappers in scope; source substrings reused verbatim so renamed
// identifiers and reordered decoder args resolve themselves.
let checksumFn;
try {
  checksumFn = new Function(
    decoderName,
    `${preamble}const ${opsName}={${opsBody}};return (${checksumSrc});`,
  )(decode);
} catch (e) {
  fail(`Could not build live checksum function: ${e.message}`);
}
// The live fn returns Math.abs(<linear combination of char codes> + C).toString(16).
const evalChecksum = (s) => {
  const v = parseInt(checksumFn(s), 16);
  if (!Number.isFinite(v)) throw new Error("checksum did not return a hex number");
  return v;
};

// --- 5. recover checksumIndexes + checksumConstant by BLACK-BOX probing -------
// Don't parse the arithmetic at all — the checksum is a linear function of the
// 40 hash chars, so recover each per-position coefficient by finite differences
// against the real function, then encode multiplicity as repeated indexes. This
// is immune to +/- reordering and to how terms are named, and (unlike counting
// charCodeAt occurrences textually) it cannot miss or double-count a term.
const HASH_LEN = 40; // sha1 hex length
const BASE = 250; // high baseline keeps the inner sum >0 so abs() is identity
const baseStr = String.fromCharCode(BASE).repeat(HASH_LEN);
let f0;
try {
  f0 = evalChecksum(baseStr);
} catch (e) {
  fail(`Live checksum threw on baseline input: ${e.message}`);
}

const coeffs = [];
for (let i = 0; i < HASH_LEN; i++) {
  const arr = baseStr.split("");
  arr[i] = String.fromCharCode(BASE + 1);
  coeffs.push(evalChecksum(arr.join("")) - f0); // = coefficient of position i
}
if (coeffs.some((a) => a < 0)) {
  fail(`Checksum has a negative coefficient — additive index model invalid: [${coeffs}]`);
}

const sumCoeff = coeffs.reduce((s, a) => s + a, 0);
const checksumConstant = f0 - BASE * sumCoeff;
const checksumIndexes = [];
coeffs.forEach((a, i) => {
  for (let j = 0; j < a; j++) checksumIndexes.push(i);
});
if (!checksumIndexes.length) fail("Recovered an empty checksum index set.");

// --- 5b. self-verify against the real function on random hashes --------------
// The emitted (indexes, constant) MUST reproduce the site's own checksum for
// every input, or we refuse to write a result that would be silently rejected.
const HEX = "0123456789abcdef";
for (let t = 0; t < 512; t++) {
  let h = "";
  for (let j = 0; j < HASH_LEN; j++) h += HEX[(j * 7 + t * 13 + 5) % 16];
  const model = Math.abs(
    checksumIndexes.reduce((s, idx) => s + h.charCodeAt(idx), 0) + checksumConstant,
  );
  const real = evalChecksum(h);
  if (model !== real) {
    fail(`Checksum self-check failed (sample ${t}): model=${model} real=${real}.`);
  }
}

// --- 6. emit -----------------------------------------------------------------
const result = {
  staticParam,
  start,
  end,
  checksumConstant,
  checksumIndexes,
  generatedAt: new Date().toISOString(),
};

fs.writeFileSync(outPath, JSON.stringify(result, null, 2));
console.log(JSON.stringify(result, null, 2));