From 56ae7047fc8c3758061c234269af1d542238c151 Mon Sep 17 00:00:00 2001
From: Lost-MSth <th84292@foxmail.com>
Date: Mon, 2 Nov 2020 19:02:50 +0800
Subject: [PATCH] Update to v1.5

A small update.
---
 README.md                                     |  23 ++++++------
 latest version/database/arcaea_database.db    | Bin 77824 -> 77824 bytes
 .../database/database_initialize.py           |  15 ++++++--
 latest version/database/songs/dement/3.aff    |   1 +
 latest version/main.py                        |   9 +++++
 latest version/server/arcscore.py             |  34 ++++++++++++++++++
 latest version/server/auth.py                 |  12 -------
 7 files changed, 69 insertions(+), 25 deletions(-)

diff --git a/README.md b/README.md
index e888609..4af9034 100644
--- a/README.md
+++ b/README.md
@@ -19,15 +19,16 @@ This is a small local Arcaea server based on Python and Flask, which can simulat
 - 自定义世界模式 Customizable World Mode
 - 自定义歌曲下载 Customizable songs download
 - 全角色立绘 All character drawings
+- 角色技能 Character skills
 - 全剧情解锁 Unlock all the storys
 - 后台查分 Background search scores
 - 后台自定义歌曲定数 Customize chart consts in the background
+- 成绩校验 Score check
 
 没有以下 We don't have：
-- 角色特性 Character characteristics
+- 角色数值 Character characteristic value
 - 购买 Purchase
 - 歌曲解锁、曲包解锁 Songs unlocking and music packs unlocking
-- 反作弊系统 Anti cheating system
 - 服务器安全性保证 Server security assurance
 
 可能有问题 There may be problems：
@@ -37,23 +38,23 @@ This is a small local Arcaea server based on Python and Flask, which can simulat
 只是很有趣，用处探索中。  
 It is just so interesting. What it can do is under exploration.
 
-不太会apk反编译，想破解songlists hash验证，有人教我吗（  
-I don't know APK decompilation very well. I want to crack the songlists hash verification. Help.
 
 ## 下载 Download
 [这里 Here](https://github.com/Lost-MSth/Arcaea-server/releases)
 
+[Arcaea](https://konmai.cn/#arcaea)
+
 ## 更新日志 Update log
 只保留最新版本 Only keep the latest version.
-### Version 1.4
-- 适用于Arcaea 3.2.2版本 For Arcaea 3.2.2
-- 更新了歌曲数据库 Update the song database.
-- 新增自定义歌曲下载功能 Add the customizable song download function.
-- 角色**咲弥**可以看到立绘了 The drawing of character **Etude** can be seen.
 
-> 提醒：反编译只对c版本有效，对谷歌版本无效
+> 提醒：更新时请注意保留原先的数据库，以防数据丢失
+>
+> Tips: When updating, please keep the original database in case of data loss.
 
-> Tips: Decompilation is only valid for c version, not for Google version.
+### Version 1.5
+- 仍然适用于Arcaea 3.2.2版本 Still for Arcaea 3.2.2
+- 新增了角色技能 Add character skills.
+- 新增了分数校验系统 Add score check system.
 
 ## 运行环境与依赖 Running environment and requirements
 - Windows操作系统 Windows operating system
diff --git a/latest version/database/arcaea_database.db b/latest version/database/arcaea_database.db
index a1852a5269a729e4802e36724dd96663cf646c96..d39e9310478e063f8e41c038962822373688c582 100644
GIT binary patch
delta 3399
zcma);OH3PA6oxYf#Ed=T@j!@q8VuOjNgQk_6iNaiB`*<zQc{UTQARgrut&CMta&7I
zOJ!6=s)X8ZM(w7L^d&Xj^pR}ZgoIYA)Go4XQ>nYC+o-#))84t)_u5kuwM+2-pL6cH
z=bmpiA2n}2YX16hKR2EkpPrtY9?#tVt6wTFa|3(C-^Fe59r2pDAjX4Ff<Fe|2rdT0
z!eil6p&-l&0sasEbN)5{I4=Yq1U?JA8aNji@&E1r)&GV675^pwEcb-_fqR$JxLI!C
zwiJ56I&Z%hsUC`jni$6CV;CmGvI5Jpk?WhW2)GGuUc7iQ2ke|8t3}ny%cfl_DMoyl
z>Z7in<Dh=ntIq>tEjdJWBQ)-iS7#}uYFRO@nL(;uq}oBEHM6>*WQz(gWB@j<s-_K!
zGWsW~ZZ=BI=cqYK&3Z|()RJN*G~H6<l4=;bv9WG|oLny2rtF(YI>+8WTunu2lu;Tb
zLZav;V41d|%4?vaskywB?4xpYI@E<eBF9}bl$;GyBzvDC?e$8_RiLfu28j1iZN0fY
zMC(><%9^g}iEgTkxz(cd-9(4e!%MI=km&L%(e-u_WdUdw%&eHzyl#(lQt1$FK_`*o
zpxL~wsqrusqAF3$uvch;3YgnRbt^RBKB5EmnySmWtWqjlm1<tK<TA(><eZ`FSCy;|
zOiM8)J7|Oy%SQ1zJ4l4AUb>>onRGgZ?lXh?Q?X0R<X-BVr<wN>A3BO@0mG8V(;Mio
zY7VHH{CqmmPK~Is=xFW4h|(BZP6icwx{WGN(iCk(S({SJ9UL7W%+fW*Eaw$N8Ih=!
zG`f0yQzG7mK^+TG<upwaB0_v63NR}h4W9iX^(3iB^m<^2jrF2_Z8BKXRvD(=s2~w%
z^PpH%G`IoQ?P3wPJB_lQ5NMJ)mL0_xBM=|z6M9|~vZ<~qa#q*Yi)z*~^Qr-^D6*ni
zMnzs%l>I!81M@TWYIzc<*2cUWBVQg1(4_Tl1c-K5(xUrNU+`1UY1$1x@!$@^mr`BZ
zSO;oRMnOud1~&tos~L`(>wAgwno;}fxib@T*|g$i!<=HN`8dtY5_5wi4d-J5PCgv?
zBC6Spw^D2UfwdAVEqcv4dm}QQX`x~`O|>`DOvDX?QER5E6`ZXbkwUDA`ry{@$5-eh
zKDRzoF6efTFVw_gK0sM*)eu#T2{p0!M^q@<L*&Q$c;5P`CA7@?_J|L~TjG|uE~dqn
z;LpLW;L#u>JP<w<&Iuy_kbj52%y$O<415)^0}1~V|BinPa%;@*<9^{j=4|dX$Fe`M
zZ?TuzA=U>8_GPP6z7yrAV-hn`Bbf8SoxUZUxDi^ZVTtK)s8is$;bVqcEW-V#c<Xi9
zH8mtLqgX!TJiZf!+rh;k#Fa~{xj~8P!oQ-afNdFESbk}F|BEEje-LXfDlzRi03sF)
z5M5CLb?-t}$jdB<tfjlFd^#dAVH{@E`Q~m%br+>leY8?UDR}I@rG@#_Scc@n2dk0l
zP_M-F)Q;_5HI(-*ou5ywuC99ZWlXC?kHmCfy?gsFyM~^#5KlynhsXui!ERa!+N)66
zeF_1JXmKSNTH{^xMq|!}?Y>URDTt{fof2~dXB~20-%iY9Cn8fK?5PNzfeo)f5_yxj
zY+BqWF-aU{#rbVJqIz)jbQ(={(C8`mrNKjVT!6G8(Vxwu!+RyB4`-Wq2JUs@f$}1#
zMxbOn9S+<nmTjM}*dzzq8#M$iw9z&p1i{m`od>F+!f%!Mc|+BRX%~$;3vwMt6OzQF
zNJHPeHxO>v8M7hUrfKKfdyz}H+5cwFlt@FMEe<OYPpJi9sEHE>$Xd3cBuOzi0wK`R
zpv1&TXM*>8tIuZ6qCm$JF$cC^SiwLcu~B#a7kCcx^e#!o{2BPYR3)Lj=ot^tTS4f7
z2MipyJcEwECu_h%d;Ex>K2XFSX!4(SKcz_yI`eh<gmds4wT7QloWvZ!y;*d=yWd}1
zL(e46VU|8JL>!opU2&m8=fB>cj7uF4bY@y5W(H?NyBxY($uuQS8me;D>D`h1^_rd3
z&VkA2TId-Oec+`upHZwleH0DD)BvE$&Tt~$M0*Nz^}El>x2St29TCXc-WfWOWF)q>
Tba8bYhX>5tOSd<ld|&<t-(;e5

delta 2096
zcmZwIO=uKX8~||NX1957=6&qj@6FE4&g^b>H6fY=q@iC_twqroX%uY^twY&1)5b~I
z?zRL<Cx@Pj2xU%6OWHyqh(ggz4AHa~DPCK|Ta-d6^cp;P>NsZJ?raA3_WS?e|KrWf
zt~`maJc<AMUm1-b9-n-5YHH%}ot-jYnvt*WV}G*;Y>j=(7T6g!&Qf%TKBDXNI{k`%
zK;Nbn8YlmdKgbPoh1ldQnIswf3_r#j_<Q^{zJ!nB8h%CoSAHnpl&{|5$=768zot3L
zaB={ESPTF_AoPAv`(|ZWGuO<uxw$!|7FL8jtqHA$)z7U8twd-=sNriqT-XTMee3!g
zj-o}Jpamg{8dkqIRj3l7iqKMomV^%Z>WJR_qlW|+!^!^GMWKZVEeOp=XkKWpSDoG4
z$O+E&GJ$?uS)rM*`fX)|rXw^hG!>yvN-&RLE;JdTNuex4nNS*`^rbr9^GCw$PfSEI
z4y!*g7Ai-mEL4h6NhtF4eE(~K1jC4AD0DDF2LpBMtD2@H!Xf@#aS`(6i;#hckeCSB
zTvZb#kQ{*S@2iE|KPHkh($YS*%{JK&Y?)nTWAr(FOmERE^fH~MBQ!=Hk(*?NTp&~4
zhhYal#5eF4cp8sl+50FwkbjYv<!Sk#jHPX9L;6ly@;(uY<i^$w+!*GdvAYZR(7HNN
zt#MH9Sq?#{cC=+JESPq?8FV;W<={||b#2`^qE|R5_GUp?d1vOmnUP~bifV9>4o4WX
zmKm^n^6tg4vc^F^9HX5wZBx|M)ovMg`)&>!3J0a25xS9gv=Rr|-XjnyomsROgF5<9
z_k<UpL~p#I6K1Ppi%uHF?ne9w2#d$&JGP~tZQ7r7EIT-AvcSQcy`>;5xPNZwj+XE1
z0mA&OxhyK|&v9@doS2(!T6R;f>nE(w%$60D(6W6eA(VZ;b6M=8lHouNpOiWNQG2m|
zx@RCYy=U|3Bg>tjMkBRn-qbnMYFX{iJN0v|?z|(MgR$LW?x&kN-k<Ew;r_I#;Stso
z@zjf`Qx1lMl+rzg8Kiq(-g4bb_cD%#`-X%Nhx(WI^e-Q8iyJLVdmb9;<bu_n4+cDd
zI2a8t3B6pix9@i?_rv@6pbq;U3-7;jw%zoe`rwp_K@MIIM)~W0!%b|B8s$V^ZG_^d
qo9%gVLGH&}wX!<UHvmGhQ;XsP+}m4KTm~ElFOd6mEBo_rOaBApbd7!h

diff --git a/latest version/database/database_initialize.py b/latest version/database/database_initialize.py
index dce53ee..9eeebf5 100644
--- a/latest version/database/database_initialize.py	
+++ b/latest version/database/database_initialize.py	
@@ -178,13 +178,24 @@
 ,'Chuni Penguin','Haruna','Nono','MTA-XXX','MDA-21','Kanae','Hikari(Fantasia)','Tairitsu(Sonata)','Sia','DORO*C'
 ,'Tairitsu(Tempest)','Brillante','Ilith(Summer)','Etude']
 
+skill_id = ['gauge_easy','','','','note_mirror','','','gauge_hard','frag_plus_10_pack_stellights','gauge_easy|frag_plus_15_pst&prs'
+            ,'gauge_hard|fail_frag_minus_100','frag_plus_5_side_light','visual_hide_hp','frag_plus_5_side_conflict'
+            ,'challenge_fullcombo_0gauge','gauge_overflow','gauge_easy|note_mirror','note_mirror'
+            ,'visual_tomato_pack_tonesphere','frag_rng_ayu','gaugestart_30|gaugegain_70','combo_100-frag_1'
+            ,'audio_gcemptyhit_pack_groovecoaster','gauge_saya','gauge_chuni','kantandeshou'
+            ,'gauge_haruna','frags_nono','gauge_pandora','gauge_regulus','omatsuri_daynight'
+            ,'','','sometimes(note_mirror|frag_plus_5)','scoreclear_aa|visual_scoregauge','gauge_tempest'
+            ,'gauge_hard','gauge_ilith_summer','']
+
+skill_id_uncap = ['','','frags_kou','','visual_ink','','','','','','','','','shirabe_entry_fee','','','','','','','','frags_yume','','','','','','','','','','','','','','','','','']
+
 for i in range(0, 39):
     if i in [0, 1, 2, 4, 13, 26, 27, 28, 29, 36, 21]:
-        sql = 'insert into character values('+str(i)+',"'+char[i]+'''",30,25000,25000,90,90,90,'',0,0,'',0,'',1,1)'''
+        sql = 'insert into character values('+str(i)+',"'+char[i]+'''",30,25000,25000,90,90,90,"'''+skill_id[i]+'''",0,0,"'''+skill_id_uncap[i]+'''",0,'',1,1)'''
         c.execute(sql)
     else:
         if i != 5:
-            sql = 'insert into character values('+str(i)+',"'+char[i]+'''",30,25000,25000,90,90,90,'',0,0,'',0,'',0,0)'''
+            sql = 'insert into character values('+str(i)+',"'+char[i]+'''",30,25000,25000,90,90,90,"'''+skill_id[i]+'''",0,0,"'''+skill_id_uncap[i]+'''",0,'',0,0)'''
             c.execute(sql)
 
 
diff --git a/latest version/database/songs/dement/3.aff b/latest version/database/songs/dement/3.aff
index c5e53a6..3c3a669 100644
--- a/latest version/database/songs/dement/3.aff	
+++ b/latest version/database/songs/dement/3.aff	
@@ -2,6 +2,7 @@ AudioOffset:408
 -
 timing(0,210.00,4.00);
 (1142,4);
+flick(1142,0.50,0.50,0.00,1.00);
 (1571,2);
 (2857,1);
 (3142,2);
diff --git a/latest version/main.py b/latest version/main.py
index e3c2acf..1cff63c 100644
--- a/latest version/main.py	
+++ b/latest version/main.py	
@@ -16,6 +16,8 @@
 
 
 def error_return(error_code):  # 错误返回
+    # 2 Arcaea服务器正在维护
+    # 5 请更新Arcaea到最新版本
     # 100 无法在此ip地址下登录游戏
     # 101 用户名占用
     # 102 电子邮箱已注册
@@ -307,6 +309,8 @@ def song_score_post():
     headers = request.headers
     token = headers['Authorization']
     token = token[7:]
+    song_token = request.form['song_token']
+    song_hash = request.form['song_hash']
     song_id = request.form['song_id']
     difficulty = int(request.form['difficulty'])
     score = int(request.form['score'])
@@ -318,10 +322,15 @@ def song_score_post():
     modifier = int(request.form['modifier'])
     beyond_gauge = int(request.form['beyond_gauge'])
     clear_type = int(request.form['clear_type'])
+    submission_hash = request.form['submission_hash']
 
     try:
         user_id = server.auth.token_get_id(token)
         if user_id is not None:
+            # 增加成绩校验
+            if not server.arcscore.arc_score_check(user_id, song_id, difficulty, score, shiny_perfect_count, perfect_count, near_count, miss_count, health, modifier, beyond_gauge, clear_type, song_token, song_hash, submission_hash):
+                return error_return(107)
+
             r, re = server.arcscore.arc_score_post(user_id, song_id, difficulty, score, shiny_perfect_count,
                                                    perfect_count, near_count, miss_count, health, modifier, beyond_gauge, clear_type)
             if r:
diff --git a/latest version/server/arcscore.py b/latest version/server/arcscore.py
index c053697..8cf87fa 100644
--- a/latest version/server/arcscore.py	
+++ b/latest version/server/arcscore.py	
@@ -2,6 +2,7 @@
 import time
 import json
 import server.arcworld
+import hashlib
 
 
 def b2int(x):
@@ -20,6 +21,16 @@ def int2b(x):
         return True
 
 
+def md5(code):
+    # md5加密算法
+    code = code.encode()
+    md5s = hashlib.md5()
+    md5s.update(code)
+    codes = md5s.hexdigest()
+
+    return codes
+
+
 def get_score(c, user_id, song_id, difficulty):
     # 根据user_id、song_id、难度得到该曲目最好成绩，返回字典
     c.execute('''select * from best_score where user_id = :a and song_id = :b and difficulty = :c''',
@@ -480,6 +491,29 @@ def arc_score_post(user_id, song_id, difficulty, score, shiny_perfect_count, per
     return ptt, re
 
 
+def arc_score_check(user_id, song_id, difficulty, score, shiny_perfect_count, perfect_count, near_count, miss_count, health, modifier, beyond_gauge, clear_type, song_token, song_hash, submission_hash):
+    # 分数校验，返回布尔值
+    if shiny_perfect_count < 0 or perfect_count < 0 or near_count < 0 or miss_count < 0 or score < 0:
+        return False
+    if difficulty not in [0, 1, 2, 3]:
+        return False
+
+    all_note = perfect_count + near_count + miss_count
+    ascore = 10000000 / all_note * \
+        (perfect_count + near_count/2) + shiny_perfect_count
+    if abs(ascore - score) >= 5:
+        return False
+
+    x = song_token + song_hash + song_id + str(difficulty) + str(score) + str(shiny_perfect_count) + str(
+        perfect_count) + str(near_count) + str(miss_count) + str(health) + str(modifier) + str(clear_type)
+    y = str(user_id) + song_hash
+    checksum = md5(x+md5(y))
+    if checksum != submission_hash:
+        return False
+
+    return True
+
+
 def arc_all_post(user_id, scores_data, clearlamps_data):
     # 向云端同步，无返回
     # 注意，best_score表不比较，直接覆盖
diff --git a/latest version/server/auth.py b/latest version/server/auth.py
index 5a8b6d3..12b88cd 100644
--- a/latest version/server/auth.py	
+++ b/latest version/server/auth.py	
@@ -62,18 +62,6 @@ def build_user_id(c):
         else:
             return 2000001
 
-    # def insert_user_char(c, user_id):
-    #     # 为用户添加所有可用角色
-    #     for i in range(0, 38):
-    #         if i in [0, 1, 2, 4, 13, 26, 27, 28, 29, 36, 21]:
-    #             sql = 'insert into user_char values('+str(user_id)+','+str(
-    #                 i)+''',30,25000,25000,90,90,90,'',0,0,'',0,1,1)'''
-    #             c.execute(sql)
-    #         else:
-    #             if i != 5:
-    #                 sql = 'insert into user_char values('+str(user_id)+','+str(
-    #                     i)+''',30,25000,25000,90,90,90,'',0,0,'',0,0,0)'''
-    #                 c.execute(sql)
     def insert_user_char(c, user_id):
         # 为用户添加所有可用角色
         c.execute('''select * from character''')