crypto-recon-building

name	crypto-recon-building
description	Builds a complete, clean, standalone Python script for a full API flow (login, register, place bet, etc). Accepts input from reconstruct_*.py files AND from APK flow mappers (Retrofit catalog, auth chain trace, API endpoint list). Called automatically after analysis — no user prompting needed. Uses superpowers executing-plans and verification-before-completion.

Crypto Recon — Flow Builder

Purpose

Turn individual reconstructed crypto functions into a complete, working Python script that demonstrates the full flow — from first HTTP request to final authenticated action. Clean code, real requests, real output.

This is the deliverable the user can actually run.

When to Use

• Reconstructed functions exist in output/[domain]/final/reconstruct_*.py
• APK flow mappers have returned: Retrofit endpoint catalog, auth chain trace, API URL list
• User wants a complete flow script, not just individual functions
• Example goals: "bikin script register akun", "script login sampe bisa hit API bet", "full flow dari awal"
• Called AUTOMATICALLY after reconstruct — do not wait for user to ask

Input Sources (check all, use what exists)

1. output/[name]/final/reconstruct_*.py — individual crypto functions
2. Retrofit catalog from Agent 13 — all endpoints + HTTP method + params
3. Auth chain from Agent 14 — login → token → request sequence
4. HAR catalog from crypto-recon-har — real request/response examples
5. output/[name]/java/ — read specific classes if flow is unclear

What You Build

A single, self-contained Python file with:

• All crypto functions (imported or inline)
• Full HTTP session with cloudscraper
• Complete flow from start to finish
• Clear section comments (flow steps, not code explanation)
• Working example at bottom

Output: output/[domain]/final/flow_[name].py Example: output/[domain]/final/flow_register.py

Phase 1: Read All Reconstructed Functions

Read everything in output/[domain]/final/reconstruct_*.py.

For each file, extract:

• Function name and signature
• What it produces (signature? token? encrypted payload?)
• What parameters it needs

Build a dependency map:

generate_sign_params(data) → (random, signature, timestamp)
    needed by: every API request

encrypt_password(pwd) → base64_ciphertext
    needed by: login request only

build_auth_header(token) → {"Authorization": "Bearer ..."}
    needed by: all authenticated requests

Phase 2: Map the Flow

Identify all HTTP steps needed for the user's goal.

Template flows:

Register Account Flow

Step 1: GET base URL
  → collect cookies, CSRF token, initial session

Step 2: POST /api/register (or similar)
  → payload: username, password, phone, referral_code
  → crypto: sign_params(payload), encrypt_password(password)
  → response: user_id, token

Step 3: POST /api/login (verify account works)
  → payload: username, encrypted_password
  → crypto: sign_params, encrypt_password
  → response: access_token, refresh_token

Step 4: GET /api/user/info (verify token works)
  → headers: Authorization: Bearer {access_token}
  → crypto: sign_params on empty {}
  → response: user profile

Login + Bet Flow

Step 1: POST /api/login
Step 2: GET /api/game/list
Step 3: POST /api/bet
  → payload: game_id, amount, selection
  → crypto: sign_params(full_payload)

If goal is unclear: default to building "login + authenticated request" flow — the most useful starting point.

Phase 3: Discover Missing Endpoints

If endpoint URLs are unknown:

1. Check output/[domain]/final/[domain].md — signing findings include callers
2. Check output/[domain]/deobf/beautified/*.js — search for fetch/axios calls near signing code:

   python tools/scan.py output/[domain]/deobf/beautified/ --category SIGNING
   

3. Look for URL patterns in JS:

   /api/user/register
   /api/auth/login
   /v1/user/signup
   

4. If still unknown — use placeholder BASE_URL + "/api/register" and note it

Phase 4: Build the Script

Script Structure

import hashlib
import json
import time
import uuid
import base64

import cloudscraper

BASE_URL = "https://[domain]"


# ── Crypto Functions ──────────────────────────────────────────────────────────

def generate_sign_params(data: dict) -> tuple[str, str, int]:
    # [paste reconstructed function verbatim]
    ...


def encrypt_password(password: str) -> str:
    # [paste reconstructed function verbatim]
    ...


# ── HTTP Session ──────────────────────────────────────────────────────────────

def make_session() -> cloudscraper.CloudScraper:
    return cloudscraper.create_scraper(
        browser={"browser": "chrome", "platform": "windows", "mobile": False}
    )


# ── API Calls ─────────────────────────────────────────────────────────────────

def api_register(session, username: str, password: str, phone: str) -> dict:
    payload = {
        "username": username,
        "password": encrypt_password(password),
        "phone": phone,
    }
    random_str, signature, timestamp = generate_sign_params(payload)
    payload["random"] = random_str
    payload["signature"] = signature
    payload["timestamp"] = timestamp

    resp = session.post(f"{BASE_URL}/api/user/register", json=payload, timeout=30)
    resp.raise_for_status()
    return resp.json()


def api_login(session, username: str, password: str) -> dict:
    payload = {
        "username": username,
        "password": encrypt_password(password),
    }
    random_str, signature, timestamp = generate_sign_params(payload)
    payload["random"] = random_str
    payload["signature"] = signature
    payload["timestamp"] = timestamp

    resp = session.post(f"{BASE_URL}/api/user/login", json=payload, timeout=30)
    resp.raise_for_status()
    return resp.json()


def api_user_info(session, token: str) -> dict:
    payload = {}
    random_str, signature, timestamp = generate_sign_params(payload)
    headers = {
        "Authorization": f"Bearer {token}",
    }
    params = {
        "random": random_str,
        "signature": signature,
        "timestamp": timestamp,
    }
    resp = session.get(f"{BASE_URL}/api/user/info", headers=headers, params=params, timeout=30)
    resp.raise_for_status()
    return resp.json()


# ── Main Flow ─────────────────────────────────────────────────────────────────

def run_register_flow(username: str, password: str, phone: str):
    session = make_session()

    print(f"[1/3] Registering {username}...")
    reg_resp = api_register(session, username, password, phone)
    print(f"      → {reg_resp}")

    print(f"[2/3] Logging in...")
    login_resp = api_login(session, username, password)
    token = login_resp.get("data", {}).get("token") or login_resp.get("token")
    print(f"      → token: {token[:20]}..." if token else "      → no token in response")

    if token:
        print(f"[3/3] Fetching user info...")
        info_resp = api_user_info(session, token)
        print(f"      → {info_resp}")

    return login_resp


if __name__ == "__main__":
    result = run_register_flow(
        username="testuser123",
        password="Test@1234",
        phone="08123456789",
    )
    print("\nFinal result:", json.dumps(result, indent=2, ensure_ascii=False))

Rules for Clean Code

• No comments explaining what the code does — names do that
• ONE comment per section header (flow step) — # ── Register ──
• All crypto functions at the top, API calls in the middle, flow at the bottom
• Each API function handles its own signing — caller doesn't touch crypto
• Response errors print the raw JSON, not a custom message
• raise_for_status() on every request — let it fail loudly

Phase 5: Verify Before Shipping

Use verification-before-completion from superpowers:

Before calling this done, check:

• All imported modules are available (pip install cloudscraper requests)
• BASE_URL is set correctly
• Every endpoint URL is filled in (no TODO placeholders)
• if __name__ == "__main__" block runs without syntax error
• Crypto functions match exactly what's in reconstruct_*.py
• Parameter names match what the API expects (check the JS callers)

Phase 6: Test Run Instruction

Tell user how to test:

Script saved to: output/[domain]/final/flow_register.py

Before running:
  pip install cloudscraper requests

To run:
  python output/[domain]/final/flow_register.py

If you get 401/403: the signature is wrong → run crypto-recon-debugging
If you get 200 with error message: endpoint URL may be wrong, check network tab

Then offer: "Want me to run crypto-recon-debugging to verify the signature?"