from __future__ import annotations

import unittest

from core.ksse_deobf import decode_ksse_string_blob, pack_le_values


class KsseStringDeobfuscationTests(unittest.TestCase):
    def test_decodes_ro_product_model_constant(self) -> None:
        blob = pack_le_values(
            (0x6EBC302C577D0010, 8),
            (0x586F51467422379A, 8),
            (0xBC97, 2),
        )
        self.assertEqual(decode_ksse_string_blob(blob), b"ro.product.model")

    def test_decodes_sdcard_documents_constant(self) -> None:
        # uStack_88 is overlapped by uStack_81 in Ghidra's stack view, so only
        # the first 7 bytes from that qword are part of this encoded blob.
        blob = (
            pack_le_values((0x73AF23664B200011, 8))
            + pack_le_values((0x006D490B6F056D9A, 8))[:7]
            + pack_le_values((0xADA49C59, 4))
        )
        self.assertEqual(decode_ksse_string_blob(blob), b"/sdcard/Documents")

    def test_decodes_long_global_constant_prefix(self) -> None:
        blob = bytes.fromhex(
            "50003f093073fa34c8757939297e4378b7969ecf6e5fbfabe471bb51bfe2748f"
            "bce08686b93afc4b70b39ccecc20925fb3672c75dd03182a46946d9c50c4b96"
            "1b18e5ad1639266a3857466100ca243fcd063"
        )
        decoded = decode_ksse_string_blob(blob)
        self.assertTrue(decoded.startswith(b"0123456789ABCDEF@/.Android_@KUAISHOU@"))
        self.assertIn(b"@DFP@", decoded)
        self.assertTrue(decoded.endswith(b"@NEBULA"))


if __name__ == "__main__":
    unittest.main()