struct Elf64_Rela
{
  unsigned __int64 r_offset;
  unsigned __int64 r_info;
  __int64 r_addend;
};

0x549504 // init1
0x5495B4 // init2
0x549D08 // init3
0

#pragma pack(push, 2)
struct loader_meta_t
{
  unsigned __int64 image_header_off;
  unsigned __int64 program_headers_off;
  unsigned __int64 dynsym_off;
  unsigned __int64 dynstr_off;
  unsigned __int64 unknown_table_20_off;
  unsigned __int64 rela_off;
  unsigned __int64 jmprel_off;
  unsigned __int64 optional_table_off;
  unsigned __int64 dynamic_off;
  unsigned __int64 aux_src_off;
  unsigned __int64 callback_or_code_off;
  unsigned __int64 loader_entry_off;
  unsigned __int64 android_reloc_off;
  unsigned int phnum;
  unsigned int unknown_6C;
  unsigned int rela_count;
  unsigned int jmprel_count;
  unsigned int android_reloc_size;
  unsigned int payload_seed0;
  unsigned int flags;
  unsigned int packed_size;
  unsigned int aux_size;
  unsigned int init_stage;
  unsigned int dynsym_seed0;
  unsigned int sym_index_begin;
  unsigned int sym_index_end;
  unsigned int dynsym_seed3;
  unsigned int resource_flags;
  unsigned int loader_word_A4;
  int gate_beg;
  int gate_end;
  unsigned int split_begin;
  unsigned int split_end;
};
#pragma pack(pop)

.data:000000000063BF68 ; loader_meta_t loader_meta
.data:000000000063BF68 loader_meta     DCQ 0                   ; image_header_off
.data:000000000063BF70                 DCQ 0                   ; program_headers_off
.data:000000000063BF78                 DCQ 0x150               ; dynsym_off
.data:000000000063BF80                 DCQ 0x5BA5E8            ; dynstr_off
.data:000000000063BF88                 DCQ 0xE70               ; unknown_table_20_off
.data:000000000063BF90                 DCQ 0xE70               ; rela_off
.data:000000000063BF98                 DCQ 0x6CB58             ; jmprel_off
.data:000000000063BFA0                 DCQ 0                   ; optional_table_off
.data:000000000063BFA8                 DCQ 0x6CB58             ; dynamic_off
.data:000000000063BFB0                 DCQ 0xB8                ; aux_src_off
.data:000000000063BFB8                 DCQ 0x4B8290            ; callback_or_code_off
.data:000000000063BFC0                 DCQ 0x5A68F8            ; loader_entry_off
.data:000000000063BFC8                 DCQ 0                   ; android_reloc_off
.data:000000000063BFD0                 DCD 6                   ; phnum
.data:000000000063BFD4                 DCD 0                   ; unknown_6C
.data:000000000063BFD8                 DCD 0x47DF              ; rela_count
.data:000000000063BFDC                 DCD 0                   ; jmprel_count
.data:000000000063BFE0                 DCD 0                   ; android_reloc_size
.data:000000000063BFE4                 DCD 0x80B35FC2          ; payload_seed0
.data:000000000063BFE8                 DCD 3                   ; flags
.data:000000000063BFEC                 DCD 0x5062E0            ; packed_size
.data:000000000063BFF0                 DCD 0x6CC18             ; aux_size
.data:000000000063BFF4                 DCD 5                   ; init_stage
.data:000000000063BFF8                 DCD 0                   ; dynsym_seed0
.data:000000000063BFFC                 DCD 0x3A                ; sym_index_begin
.data:000000000063C000                 DCD 0x2F28              ; sym_index_end
.data:000000000063C004                 DCD 0x815C0             ; dynsym_seed3
.data:000000000063C008                 DCD 0                   ; resource_flags
.data:000000000063C00C                 DCD 0                   ; loader_word_A4
.data:000000000063C010                 DCD 0xFFFFFFFF          ; gate_beg
.data:000000000063C014                 DCD 0xFFFFFFFF          ; gate_end
.data:000000000063C018                 DCD 0                   ; split_begin
.data:000000000063C01C                 DCD 0                   ; split_end

// Decodes runtime .dynstr (dword-XOR stream) and patches Elf64_Sym entries by XOR-adjusting st_value/st_size for a selected symbol range.
__int64 __fastcall dynstr_dynsym_decode_Impl(
        _BYTE *dynsym_base,
        unsigned int i_1,
        unsigned int i_2,
        _DWORD *pDynStr,
        unsigned int dynstrLen,
        int a6)
{
  __int64 i; // x4
  int key; // w6
  int v9; // w5
  Elf64_Sym *sym; // x0
  __int64 v11; // x4
  __int64 v12; // x8
  Elf64_Sym *endSym; // x2
  unsigned __int64 st_value; // x1
  unsigned __int64 st_value_1; // x3
  unsigned __int64 st_size; // x1

  if ( a6 == 0 )
  {
    if ( dynstrLen != 0 )
    {
      i = 0;
      key = 0x56312342;
      do
      {
        v9 = pDynStr[i] ^ key;
        key += i * 4;
        pDynStr[i++] = v9;
      }
      while ( dynstrLen > (unsigned int)(i * 4) );
    }
    sym = (Elf64_Sym *)&dynsym_base[24 * i_1];
    if ( i_1 < i_2 )
    {
      v11 = i_1 + 0x151;
      v12 = i_1 + 0x15B;
      endSym = &sym[i_2 - 1 - i_1 + 1];
      do
      {
        st_value = sym->st_value;
        st_value_1 = st_value ^ v11;
        if ( st_value != 0 )
        {
          st_size = sym->st_size;
          sym->st_value = st_value_1;
          sym->st_size = st_size ^ v12;
        }
        ++sym;
      }
      while ( sym != endSym );
    }
  }
  return 1;
}

// load2_load_packed_segments @ 0x54C944
uint32_t load2_load_packed_segments(
    elf_parse_ctx_t *ctx,
    loader_meta_t *meta,
    uint8_t *image_base
) {
    uint32_t flags = meta->flags;
    uint32_t packed_size = meta->packed_size;
    uint32_t meta_block_size = meta->meta_block_size;

    ctx->image_header = image_base + meta->image_header_off;
    ctx->phnum = meta->phnum;
    ctx->dynsym_seed0 = meta->dynsym_seed0;

    const uint8_t *meta_block_src = (const uint8_t *)meta + meta->meta_block_off;
    uint8_t *meta_block_dst = RuntimeMalloc(meta_block_size);
    PrepareResourceState(meta->resource_flags);

    uint64_t payload_off = sizeof(Elf64_Ehdr) +
                           image_ehdr(image_base)->e_phnum * sizeof(Elf64_Phdr);
    uint8_t *packed_src = image_base + payload_off;
    uint64_t *trailer = (uint64_t *)align_up(
        (uintptr_t)packed_src + packed_size,
        8
    );

    uint8_t *packed_dst = packed_src;
    if ((flags & 0x01) != 0) {
        packed_dst = RuntimeMalloc(packed_size);
        ctx->owns_packed_buffer = true;
    }

    // X23 = align_up(packed_src + packed_size, 8)。
    // 当前样本 X23 = 0x506470，且 *(uint64_t *)X23 == 0。
    uint64_t descriptor_rel = *(uint64_t *)trailer;
    const char *descriptor = descriptor_rel != 0
        ? (const char *)trailer + descriptor_rel
        : NULL;

    ReleaseOldDescriptorCache(ctx);
    if (descriptor != NULL) {
        ctx->descriptor_len = RuntimeStrlen(descriptor);
        ctx->descriptor_copy = RuntimeMalloc(ctx->descriptor_len + 1);
        RuntimeMemcpy(ctx->descriptor_copy, descriptor, ctx->descriptor_len + 1);
    }

    // X21/X26/X28 是三个受 flags bit2/bit3/bit4 控制的可选字符串。
    // 当前 flags=3，三个分支均不执行，因此三者静态结果都为 NULL。
    const char *key_source_bit2 = NULL; // X21
    const char *key_source_bit3 = NULL; // X26
    const char *key_source_bit4 = NULL; // X28

    if ((flags & 0x04) != 0) {
        key_source_bit2 = AcquireFlag4String();
        if (!ValidateFlag4String(key_source_bit2)) {
            key_source_bit2 = NULL;
        }
    }

    if ((flags & 0x08) != 0) {
        key_source_bit3 = AcquireFlag8String();
    }

    if ((flags & 0x10) != 0) {
        key_source_bit4 = AcquireFlag10String(ctx->descriptor_copy);
        if (!ValidateFlag10String(key_source_bit4)) {
            key_source_bit4 = NULL;
        }
    }

    size_t ext_key_len =
        SafeStrlen(key_source_bit2) +
        SafeStrlen(key_source_bit3) +
        SafeStrlen(key_source_bit4);

    if (RuntimeFallbackKeyEnabled()) {
        ext_key = RuntimeMalloc(11);
        RuntimeMemset(ext_key, 0, 11);
        RuntimeMemset(ext_key, 0x5C, 8);
    } else if (ext_key_len != 0) {
        ext_key = RuntimeMalloc(ext_key_len + 1);
        RuntimeMemset(ext_key, 0, ext_key_len + 1);
        AppendString(ext_key, key_source_bit2);
        AppendString(ext_key, key_source_bit3);
        AppendString(ext_key, key_source_bit4);
    }

    // meta+0x48 指向的数据块始终先通过 core_decode。
    // 这是 load3 的第一个 decode callsite，不受主 packed payload 的 bit1/bit5 分流控制。
    if (core_decode_dispatcher(
            meta_block_src,
            meta_block_size,
            meta_block_dst,
            meta_block_size,
            -1,
            -1,
            ext_key
        ) != meta_block_size) {
        RuntimeFree(ext_key);
        return 0;
    }

    ctx->decoded_meta_block = meta_block_dst;
    ctx->decoded_meta_block_size = meta_block_size;

    if ((flags & 0x01) != 0) {
        // 独立目标缓冲路径：packed_src -> packed_dst。
        if ((flags & 0x20) != 0) {
            xor_decode_fixed_key_blocks(
                packed_dst,
                packed_src,
                packed_size
            );
        } else if ((flags & 0x02) != 0) {
            if (NeedsSplitSourceRebuild(meta, payload_off, packed_size)) {
                uint8_t *joined_src = RuntimeMalloc(packed_size);
                uint32_t joined_len = RebuildSplitSource(
                    joined_src,
                    image_base,
                    meta,
                    payload_off,
                    packed_size
                );

                core_decode_dispatcher(
                    joined_src,
                    joined_len,
                    packed_dst,
                    packed_size,
                    -1,
                    -1,
                    ext_key
                );
                RuntimeFree(joined_src);
            } else {
                core_decode_dispatcher(
                    packed_src,
                    packed_size,
                    packed_dst,
                    packed_size,
                    meta->gate_beg,
                    meta->gate_end,
                    ext_key
                );
            }
        } else {
            // 未设置解码标志，不保留刚分配的目标，直接使用原始 packed 段。
            RuntimeFree(packed_dst);
            packed_dst = packed_src;
            ctx->owns_packed_buffer = false;
        }

        // packed payload 前 8 字节是后续解压/加载需要的头字段。
        uint32_t unpacked_size = *(uint32_t *)(packed_dst + 0x00);
        uint32_t compressed_size = *(uint32_t *)(packed_dst + 0x04);
        uint64_t adjusted_size = unpacked_size;

        ctx->decompressed_buffer = AllocatePayloadOutput(meta, unpacked_size);
        CalcPayloadSeed(packed_dst + 8, compressed_size);

        if (zlib_uncompress2_wrapper(
                ctx->decompressed_buffer,
                &adjusted_size,
                packed_dst + 8,
                compressed_size
            ) != 0) {
            RuntimeFree(ctx->decompressed_buffer);
            RuntimeFree(packed_dst);
            RuntimeFree(ext_key);
            return 0;
        }

        RuntimeFree(packed_dst);
        ctx->loaded_image_size = AdjustOutputSize(meta, adjusted_size);
    } else {
        // 原映射路径：先将覆盖范围改为 RWX，再原地处理 packed_src。
        RuntimeMprotect(
            image_base,
            PageAlign(payload_off + packed_size),
            RuntimeExecMapFlags() | PROT_READ | PROT_WRITE
        );

        if ((flags & 0x20) != 0) {
            xor_decode_fixed_key_blocks(
                packed_src,
                packed_src,
                packed_size
            );
        } else if ((flags & 0x02) != 0) {
            core_decode_dispatcher(
                packed_src,
                packed_size,
                packed_src,
                packed_size,
                meta->gate_beg,
                meta->gate_end,
                ext_key
            );
        }

        ctx->parsed_dynstr = (const char *)image_base;
        ctx->loaded_image_size = packed_size;
    }

    // 解码完成后，按恢复出的 image base 回填 ELF 运行时视图。
    uint8_t *loaded_base = ctx->loaded_base;
    ctx->parsed_dynsym = loaded_base + meta->dynsym_off;
    ctx->load_bias = loaded_base + meta->load_bias_off;
    ctx->rela = loaded_base + meta->rela_off;
    ctx->jmprel = loaded_base + meta->jmprel_off;
    ctx->rela_count = meta->rela_size / sizeof(Elf64_Rela);

    if (meta->android_reloc_off != 0) {
        ctx->android_reloc = loaded_base + meta->android_reloc_off;
    }

    if (meta->dynamic_off == 0) {
        RuntimeFree(ext_key);
        return 0;
    }

    ctx->dynamic = loaded_base + meta->dynamic_off;
    elf_compute_load_bias(ctx);
    ctx->image_base = ctx->image_end;
    ctx->sym_index_begin = meta->sym_index_begin;
    ctx->sym_index_end = meta->sym_index_end;
    ctx->dynsym_seed3 = meta->dynsym_seed3;

    Elf64_Dyn *dynamic = FindFirstDynamicTag(trailer, 1);
    FinalizeLoadedImage(ctx, trailer, dynamic);

    RuntimeFree(ext_key);
    return 1;
}

// core_decode @ 0x54B7EC
uint32_t core_decode(
    uint8_t *src_ptr,       // X0
    int src_copy_len,       // W1
    uint8_t *decode_buf,    // X2
    uint32_t decode_len,    // W3
    int gate_beg,           // W4
    int gate_end,           // W5
    uint8_t *ext_key        // X6
) {
    uint8_t head_mask[0x40];
    uint8_t saved_0x80[0x80];

    if (src_ptr == NULL) return 0;              // 0x54B808
    if (src_copy_len <= 0x3F) return 0;         // 0x54B80C..0x54B814

    memcpy(decode_buf, src_ptr, src_copy_len);  // 0x54B840..0x54B844
    if (decode_len <= 0x3F) return 0;           // 0x54B848..0x54B850

    uint32_t seed_input[5];
    seed_input[0] = *(uint32_t *)(decode_buf + 0x0C);
    seed_input[1] = *(uint32_t *)(decode_buf + 0x04);
    seed_input[2] = *(uint32_t *)(decode_buf + 0x30);
    seed_input[3] = decode_len;
    seed_input[4] = *(uint32_t *)(decode_buf + 0x08);

    uint32_t seed_main = CalcPayloadSeed(seed_input, 0x14);  // 0x54B8A8

    memset(head_mask, 0xD7, 0x40);              // 0x54B8AC..0x54B8C0
    BuildHeadMask(ext_key, head_mask);          // 0x54B8C4..0x54B8CC

    uint32_t body_len = decode_len - 0x40;

    if (body_len <= 0x7F) {                     // 0x54B8D4..0x54B8D8
        Rc4VariantXor(decode_buf + 0x40, body_len, seed_main);

        for (int i = 0; i < 0x40; ++i) {
            decode_buf[i] ^= head_mask[i];
        }

        return decode_len;
    }

    memcpy(saved_0x80, decode_buf + 0x40, 0x80);    // 0x54B960..0x54B978
    Rc4VariantXor(decode_buf + 0x40, 0x80, seed_main);

    uint32_t k0 = (seed_main ^ *(uint32_t *)(decode_buf + 0x34)) + 8217;
    uint32_t k1 = (seed_main ^ *(uint32_t *)(decode_buf + 0x3C)) + 6502;
    uint32_t k2 = (seed_main ^ decode_len) + 8213;
    uint32_t k3 = (seed_main ^ *(uint32_t *)(decode_buf + 0x38)) + 6534;
    uint32_t key4[4] = { k0, k1, k2, k3 };

    for (int i = 0; i < 0x40; ++i) {            // 0x54B9E4..0x54BA3C
        decode_buf[i] ^= head_mask[i];
    }

    Rc4VariantXor(saved_0x80, 0x80, k2);        // 0x54BA40

    uint32_t sched[9] = {
        21605, k3, 17477, 1383, k0, k1, 309, k2, 26740
    };

    uint32_t *saved32 = (uint32_t *)saved_0x80;
    uint32_t block_count = (decode_len - 0xC0) >> 7;

    if (block_count != 0) {                     // 0x54BA8C
        int quarter = block_count >> 2;         // 0x54BA90
        int range1_beg = quarter;
        int range1_end = quarter * 2;
        int range0_beg = quarter * 2;
        int range0_end = quarter * 3;
        int range3_beg = quarter * 3;

        uint8_t *block = decode_buf + 0xC0;
        int block_pos = 0x120;                  // 注意：gate 比较用 0x120 起步

        for (uint32_t block_index = 0;
             block_index < block_count;
             ++block_index, block += 0x80, block_pos += 0x80) {

            // 0x54BAF4..0x54BB0C：gate 判断直接内联在 core_decode 里
            if (!(block_pos < gate_beg ||
                  gate_beg <= 0x7F ||
                  (gate_end != -1 && block_pos >= gate_end))) {
                continue;
            }

            uint32_t *block32 = (uint32_t *)block;
            uint32_t mode = sched[block_index % 9] & 3;  // 0x54BB10..0x54BB24

            switch (mode) {                    // 0x54BB28..0x54BB3C
            default:
                // mode 0/default: 0x54BB40 / 0x54BB58..0x54BB80
                if (block_index >= range0_beg && block_index <= range0_end) {
                    // 0x54BDC4..0x54BE24
                    for (int i = 0; i < 0x80; ++i) {
                        block[i] ^= 0xB2;
                    }
                } else {
                    for (int i = 0; i < 32; ++i) {
                        uint32_t x = saved32[i];
                        block32[i] ^= x ^ key4[x & 3];
                    }
                }
                break;

            case 1:
                // mode 1: loc_54BC70 / 0x54BC84..0x54BCCC
                if (block_index >= range1_beg && block_index <= range1_end) {
                    // 0x54BE28..0x54BE88
                    for (int i = 0; i < 0x80; ++i) {
                        block[i] ^= 0xA1;
                    }
                } else {
                    for (int i = 0; i < 32; ++i) {
                        uint32_t counter = 32 - i;
                        uint32_t rotating = sched[i % 9];
                        block32[i] ^= saved32[i] ^ counter ^ rotating;
                    }
                }
                break;

            case 2:
                // mode 2: loc_54BD10 / 0x54BD10..0x54BD5C
                for (int i = 0; i < 32; ++i) {
                    uint32_t rolling = key4[sched[i % 9] & 3];
                    block32[i] ^= saved32[i] ^ i ^ rolling;
                }
                break;

            case 3:
                // mode 3: loc_54BCD0 / 0x54BCDC..0x54BD0C
                if (block_index >= range3_beg) {
                    // 0x54BD60..0x54BDC0
                    for (int i = 0; i < 0x80; ++i) {
                        block[i] ^= 0xC3;
                    }
                } else {
                    for (int i = 0; i < 32; ++i) {
                        uint32_t x = saved32[i];
                        block32[i] ^= x ^ i ^ key4[x & 3];
                    }
                }
                break;
            }
        }
    }

    uint32_t tail = (decode_len + 0x40) & 0x7F; // 0x54BBB4..0x54BBBC
    if (tail == 0) {
        return decode_len;
    }

    uint32_t tail_pos = decode_len - tail;

    for (uint32_t i = 0; i < tail; ++i) {       // 0x54BBD4..0x54BC64
        uint32_t pos = tail_pos + i;

        if (gate_beg > (int)pos ||
            gate_beg <= 0x7F ||
            (gate_end != -1 && gate_end <= (int)pos)) {
            uint32_t v = sched[key4[i & 3] % 9];
            decode_buf[pos] ^= (v + v / 0xFF) ^ saved_0x80[i] ^ i;
        }
    }

    return decode_len;
}

int zlib_uncompress2_wrapper(
    void *dst,
    uint64_t *dst_len,
    const void *src,
    uint64_t src_len
);

int ZMCoreUnzip_executeCVS(Context context) {
    String packageName = context.getPackageName();
    if (!packageName.equals("com.fileunzip.zxwknight")) {
        return -300;
    }

    PackageManager pm = context.getPackageManager();
    int flags = (SDK_INT >= 28) ? 0x08000000 : 0x40;

    PackageInfo pi = pm.getPackageInfo(packageName, flags);

    // Android 9+ 走 signingInfo，旧版本走 PackageInfo.signatures
    Signature[] signatures = GetApkSignatures(pi);

    // 当前样本最终取第一个签名对象的 hashCode()
    return signatures[0].hashCode();
}

jstring NativeGetQPWATImpl(JNIEnv *env, jclass clazz, jstring input, jobject context) {
    String packageName = context.getPackageName();          // 当前样本 = "com.fileunzip.zxwknight"
    int ctxValue = ZMCoreUnzip_executeCVS(context);         // 当前样本静态复现 = 516622220

    int tail = 2 * ((ctxValue >> 2) - 169) + 127;          // 见 0x4B9008-0x4B9030

    String data =
        String.valueOf(ctxValue) +                          // 前缀1：签名 hashCode
        packageName +                                       // 前缀2：包名
        input +                                             // 中间：Java 侧传来的 fileName + fileSize
        String.valueOf(tail);                               // 后缀：由 ctxValue 推导

    byte[] key = "gwFG#9P!ad+*PMUnisapps$Rs#L!_1G9".getBytes("utf-8");
    byte[] body = data.getBytes("utf-8");

    Mac mac = Mac.getInstance("HmacSHA1");                 // 算法固定为 HMAC-SHA1
    mac.init(new SecretKeySpec(key, "HmacSHA1"));
    byte[] digest = mac.doFinal(body);

    return ZMCoreUnZip_BXF_encode(digest);                 // Base64 编码别名，编码表为 A-Z a-z 0-9 + / =
}