#!/usr/bin/env python3
"""Find who reads the encrypted classes of the remake.

The class files inside game.jar start with DE AD C0 DE and are not readable
after that.  Something has to decrypt them at runtime, and that something
lives in the launcher, in one of the jars or in the java directory.  This
script looks for the marker and for the words that go with it.

Usage:  find-decryptor.py <file or folder> [...]
"""

import sys
from pathlib import Path

MARKER = b"\xde\xad\xc0\xde"
WORDS = [b"deadcode", b"DEADC0DE", b"decrypt", b"Decrypt", b"cipher", b"Cipher",
         b"ClassLoader", b"defineClass", b"xload", b"scramble", b"obfus"]


def scan(path):
    hits = []
    try:
        data = path.read_bytes()
    except OSError:
        return hits
    pos = data.find(MARKER)
    if pos >= 0:
        hits.append(("marker", pos))
    for word in WORDS:
        pos = data.find(word)
        if pos >= 0:
            hits.append((word.decode("ascii", "replace"), pos))
    return hits


def main(argv):
    if len(argv) < 2:
        print(__doc__)
        return 1
    for name in argv[1:]:
        path = Path(name)
        if path.is_dir():
            for child in path.rglob("*"):
                if child.is_file() and child.stat().st_size < 200_000_000:
                    hits = scan(child)
                    for what, where in hits:
                        print("%-70s %s at %d" % (str(child)[-70:], what, where))
        elif path.is_file():
            for what, where in scan(path):
                print("%-70s %s at %d" % (str(path)[-70:], what, where))
    return 0


if __name__ == "__main__":
    sys.exit(main(sys.argv))