Skip to content

Commit 7973a13

Browse files
CC11001100CC11001100
committed
refactor: reorganize sidebar into logical groups (9 sections)
- Split 42-item catch-all into Agent System, Java Plugin, Frontend/Communication, Encryption/Obfuscation - Add emoji prefixes for visual scanability - Move superseded docs (early analyses) to Appendix - Remove duplicate sidebar items - Add collapsed groups for less-used sections (full decompilation, appendix)
1 parent f4f9e93 commit 7973a13

10 files changed

Lines changed: 581 additions & 80 deletions

‎docs/.vitepress/config.mts‎

Lines changed: 89 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -21,20 +21,22 @@ export default defineConfig({
2121
sidebar: [
2222
// === 架构与基础设施 ===
2323
{
24-
text: '架构与基础设施',
24+
text: '🏗️ 架构与基础设施',
25+
collapsed: false,
2526
items: [
2627
{ text: '整体架构', link: '/01-architecture' },
2728
{ text: 'Agent 进程管理', link: '/02-agent-process' },
2829
{ text: '服务端端点', link: '/03-server-endpoints' },
29-
{ text: '通信协议', link: '/04-websocket-protocol' },
30+
{ text: 'WebSocket 通信协议', link: '/04-websocket-protocol' },
3031
{ text: '消息格式定义', link: '/05-message-formats' },
3132
{ text: '命令体系参考', link: '/06-command-reference' },
3233
{ text: 'WebView JS Bridge', link: '/07-webview-bridge' },
3334
],
3435
},
3536
// === 功能流程 ===
3637
{
37-
text: '功能流程',
38+
text: '🔄 功能流程',
39+
collapsed: false,
3840
items: [
3941
{ text: '用户认证流程', link: '/08-auth-flow' },
4042
{ text: '智能对话协议', link: '/09-chat-protocol' },
@@ -47,98 +49,115 @@ export default defineConfig({
4749
{ text: '代码检查协议', link: '/16-code-check-protocol' },
4850
],
4951
},
50-
// === 运维与监控 ===
52+
// === Agent 系统 ===
5153
{
52-
text: '运维与监控',
54+
text: '🤖 Agent 系统',
55+
collapsed: false,
5356
items: [
54-
{ text: '心跳与错误恢复', link: '/17-heartbeat-error' },
55-
{ text: 'Telemetry 遥测', link: '/18-telemetry' },
56-
{ text: '设置同步协议', link: '/19-settings-protocol' },
57-
{ text: '枚举值参考', link: '/20-enums-reference' },
57+
{ text: 'Agent 内部架构', link: '/23-agent-internals' },
58+
{ text: 'Agent 二进制分析', link: '/31-agent-binary-analysis' },
59+
{ text: 'Agent Cloud 协议', link: '/22-agent-cloud-protocol/' },
60+
{ text: 'Agent 服务层', link: '/62-agent-service-layer' },
61+
{ text: 'Agent 通信深度分析', link: '/54-agent-communication-deep-analysis' },
62+
{ text: 'Agent 动态验证', link: '/108-agent-dynamic-verification' },
63+
{ text: 'Agent Webpack 分析', link: '/66-agent-webpack-bundle-analysis' },
64+
{ text: 'Agent 模块全面分析', link: '/107-agent-webpack-modules-and-full-analysis' },
65+
{ text: 'Agent Webpack 清单', link: '/106-agent-webpack-modules-and-full-class-inventory' },
66+
{ text: '代码补全流程', link: '/32-code-complete-flow' },
67+
{ text: 'WebSocket 分发链', link: '/77-websocket-dispatch-chain' },
68+
{ text: 'WebSocket DTO', link: '/45-websocket-dto-model' },
69+
{ text: '请求系统', link: '/44-request-complete-system' },
70+
{ text: '内容处理器', link: '/48-content-handler-analysis' },
71+
{ text: 'CodeVector RAG', link: '/71-codevector-rag-workflow' },
5872
],
5973
},
60-
// === 逆向分析核心 ===
74+
// === Java 插件 ===
6175
{
62-
text: '逆向分析核心',
76+
text: '☕ Java 插件',
77+
collapsed: false,
6378
items: [
64-
{ text: '混淆技术分析', link: '/21-obfuscation' },
65-
{ text: 'Agent Cloud 协议', link: '/22-agent-cloud-protocol' },
66-
{ text: 'Agent 内部架构', link: '/23-agent-internals' },
67-
{ text: '动作系统', link: '/24-action-system' },
79+
{ text: '动作系统', link: '/47-action-system-complete' },
80+
{ text: '动作系统完整分析', link: '/84-action-package-complete/' },
81+
{ text: '内联聊天系统', link: '/57-inline-chat-subsystem-complete' },
6882
{ text: '内联聊天 UI', link: '/25-inline-chat-ui' },
69-
{ text: '模板系统', link: '/26-template-system' },
7083
{ text: '编辑器集成', link: '/27-editor-integration' },
7184
{ text: '监听器事件', link: '/28-listener-events' },
72-
{ text: '混淆字符串', link: '/29-obfuscated-strings' },
73-
{ text: 'WebView 前端', link: '/30-webview-frontend' },
74-
{ text: 'Agent 二进制分析', link: '/31-agent-binary-analysis' },
75-
{ text: '代码补全流程', link: '/32-code-complete-flow' },
85+
{ text: 'Listener 完整反编译', link: '/83-listener-complete-decompilation/' },
86+
{ text: 'Inlay 渲染系统', link: '/78-inlay-render-system' },
87+
{ text: '模板系统', link: '/60-template-system-complete-analysis' },
88+
{ text: '单元测试生成', link: '/46-unit-test-generation' },
89+
{ text: 'Core Service 类', link: '/76-core-service-class-details/' },
90+
{ text: 'Service 包完整', link: '/91-service-package-complete-decompilation/' },
7691
{ text: 'Q 包分析', link: '/33-Q-package-analysis' },
7792
{ text: 'Plugin XML 分析', link: '/34-plugin-xml-analysis' },
78-
{ text: 'Properties i18n', link: '/35-properties-i18n-analysis' },
79-
{ text: '完整类清单', link: '/36-complete-class-inventory' },
80-
{ text: 'Agent 进程管理', link: '/37-agent-process-management' },
81-
{ text: 'WebView ToolWindow', link: '/38-webview-toolwindow-analysis' },
82-
{ text: 'Agent 服务层', link: '/39-agent-service-layer' },
83-
{ text: '内联聊天系统', link: '/40-inline-chat-system' },
84-
{ text: '枚举完整分析', link: '/41-enums-complete-analysis' },
85-
{ text: 'Diff APM 分析', link: '/42-diff-apm-analysis' },
86-
{ text: '设置配置', link: '/43-settings-configuration' },
87-
{ text: '请求系统', link: '/44-request-complete-system' },
88-
{ text: 'WebSocket DTO', link: '/45-websocket-dto-model' },
89-
{ text: '单元测试生成', link: '/46-unit-test-generation' },
90-
{ text: '动作系统完整', link: '/47-action-system-complete' },
91-
{ text: '内容处理器', link: '/48-content-handler-analysis' },
92-
{ text: 'Generate 包', link: '/49-generate-package-analysis' },
93-
{ text: 'View 包分析', link: '/50-view-package-analysis' },
94-
{ text: 'Complete 包分析', link: '/51-complete-package-analysis' },
93+
{ text: 'Settings 配置', link: '/43-settings-configuration' },
94+
{ text: 'Diff/APM 分析', link: '/42-diff-apm-analysis' },
9595
{ text: '错误异常分析', link: '/52-error-exception-analysis' },
96-
{ text: 'Domain/DTO/Service', link: '/53-domain-dto-service-request-analysis' },
97-
{ text: 'Agent 通信深度分析', link: '/54-agent-communication-deep-analysis' },
98-
{ text: 'Q/Util 包分析', link: '/55-Q-util-package-analysis' },
96+
{ text: '设置同步协议', link: '/19-settings-protocol' },
97+
{ text: 'Updater/Domain/FileLoader', link: '/79-updater-domain-fileloader-analysis' },
9998
{ text: 'Chat Git 集成', link: '/56-chat-git-integration-analysis' },
100-
{ text: 'Inline Chat 完整', link: '/57-inline-chat-subsystem-complete' },
101-
{ text: 'APM 设置分析', link: '/58-listener-apm-settings-analysis' },
102-
{ text: 'Action Inline Chat', link: '/59-action-inline-chat-subpackages-analysis' },
103-
{ text: '模板系统完整', link: '/60-template-system-complete-analysis' },
104-
{ text: '语言/消息/状态/测试', link: '/61-language-message-status-test-ui-analysis' },
105-
{ text: 'Agent 服务层', link: '/62-agent-service-layer' },
10699
],
107100
},
108-
// === 综合报告 ===
101+
// === 前端与通信 ===
109102
{
110-
text: '综合报告',
103+
text: '🎨 前端与通信',
104+
collapsed: false,
111105
items: [
112-
{ text: '综合分析报告', link: '/63-comprehensive-analysis-report' },
113-
{ text: 'H 反混淆分析', link: '/64-h-deobfuscation-analysis' },
106+
{ text: 'WebView 前端', link: '/30-webview-frontend' },
114107
{ text: 'WebView 前端完整', link: '/65-webview-frontend-complete-analysis' },
115-
{ text: 'Agent Webpack 分析', link: '/66-agent-webpack-bundle-analysis' },
116-
{ text: 'H 反混淆方案', link: '/67-H-deobfuscation-solution' },
117-
{ text: 'Plugin XML 完整', link: '/68-plugin-xml-complete-registry' },
108+
{ text: 'WebView ToolWindow', link: '/38-webview-toolwindow-analysis' },
109+
{ text: 'WebView 协议加密', link: '/102-webview-protocol-encryption-analysis/' },
110+
{ text: 'View/UI/StatusBar', link: '/85-view-ui-statusbar-toolwindow' },
111+
{ text: 'Properties i18n', link: '/35-properties-i18n-analysis' },
118112
{ text: 'I18n 完整字符串表', link: '/69-i18n-complete-string-table' },
119-
{ text: 'API 端点格式', link: '/70-api-endpoint-formats/' },
120-
{ text: 'CodeVector RAG', link: '/71-codevector-rag-workflow' },
121113
{ text: '跨 IDE 差异', link: '/72-cross-ide-differences' },
114+
],
115+
},
116+
// === 加密与混淆 ===
117+
{
118+
text: '🔐 加密与混淆',
119+
collapsed: false,
120+
items: [
121+
{ text: '混淆技术分析', link: '/21-obfuscation' },
122+
{ text: '混淆字符串', link: '/29-obfuscated-strings' },
123+
{ text: 'H 反混淆分析', link: '/64-h-deobfuscation-analysis' },
124+
{ text: 'H 反混淆方案', link: '/67-H-deobfuscation-solution' },
125+
{ text: 'H 反混淆完整结果', link: '/80-h-deobfuscation-complete-results/' },
126+
{ text: '加密算法完整', link: '/100-encryption-algorithms-complete-analysis/' },
127+
{ text: 'Java 加密调用链', link: '/101-java-encryption-call-chain' },
128+
],
129+
},
130+
// === 运维与监控 ===
131+
{
132+
text: '📊 运维与监控',
133+
collapsed: false,
134+
items: [
135+
{ text: '心跳与错误恢复', link: '/17-heartbeat-error' },
136+
{ text: 'Telemetry 遥测', link: '/18-telemetry' },
122137
{ text: '性能分析', link: '/73-performance-analysis' },
123138
{ text: '安全审计', link: '/74-security-audit' },
139+
],
140+
},
141+
// === 综合报告 ===
142+
{
143+
text: '📋 综合报告',
144+
collapsed: false,
145+
items: [
146+
{ text: '综合分析报告', link: '/63-comprehensive-analysis-report' },
147+
{ text: '最终综合报告', link: '/87-final-comprehensive-report' },
148+
{ text: 'LLM 协议完整分析', link: '/99-llm-protocol-complete-analysis/' },
149+
{ text: 'API 端点格式', link: '/70-api-endpoint-formats/' },
150+
{ text: 'Plugin XML 完整', link: '/68-plugin-xml-complete-registry' },
124151
{ text: 'Velocity 单测模板', link: '/75-velocity-template-unit-test-flow' },
125-
{ text: '核心服务类', link: '/76-core-service-class-details/' },
126-
{ text: 'WebSocket 分发链', link: '/77-websocket-dispatch-chain' },
127-
{ text: 'Inlay 渲染系统', link: '/78-inlay-render-system' },
128-
{ text: 'Updater/Domain/FileLoader', link: '/79-updater-domain-fileloader-analysis' },
129-
{ text: 'H 反混淆完整结果', link: '/80-h-deobfuscation-complete-results/' },
130152
{ text: '架构交叉引用', link: '/81-architecture-cross-reference' },
131153
{ text: 'Q/Velocity/Kotlin', link: '/82-q-velocity-kotlin-extensions' },
132-
{ text: 'Listener 完整反编译', link: '/83-listener-complete-decompilation/' },
133-
{ text: 'Action 包完整', link: '/84-action-package-complete/' },
134-
{ text: 'View/UI/StatusBar', link: '/85-view-ui-statusbar-toolwindow' },
135154
{ text: 'JSON 配置资源', link: '/86-json-config-resources-catalog' },
136-
{ text: '最终综合报告', link: '/87-final-comprehensive-report' },
137155
],
138156
},
139157
// === 全量反编译分析 ===
140158
{
141-
text: '全量反编译分析',
159+
text: '📦 全量反编译分析',
160+
collapsed: true,
142161
items: [
143162
{ text: 'Template 包', link: '/88-template-package-complete-decompilation/' },
144163
{ text: 'Inline 包', link: '/89-inline-package-complete-decompilation' },
@@ -153,26 +172,16 @@ export default defineConfig({
153172
{ text: '小包分析', link: '/98-small-packages-decompilation' },
154173
],
155174
},
156-
// === 高层综合 ===
175+
// === 扫尾与附录 ===
157176
{
158-
text: '高层综合',
177+
text: '📎 扫尾与附录',
178+
collapsed: true,
159179
items: [
160-
{ text: 'LLM 协议完整', link: '/99-llm-protocol-complete-analysis/' },
161-
{ text: '加密算法完整', link: '/100-encryption-algorithms-complete-analysis/' },
162-
{ text: 'Java 加密调用链', link: '/101-java-encryption-call-chain' },
163-
{ text: 'WebView 协议加密', link: '/102-webview-protocol-encryption-analysis' },
164180
{ text: '缺失类反编译', link: '/103-missing-classes-decompilation-analysis' },
165181
{ text: '最终盲点消除', link: '/104-final-blindspot-elimination' },
166182
{ text: 'Velocity 终极扫尾', link: '/105-velocity-templates-and-final-blindspots' },
167-
{ text: 'Agent Webpack 清单', link: '/106-agent-webpack-modules-and-full-class-inventory' },
168-
{ text: 'Agent 模块全面分析', link: '/107-agent-webpack-modules-and-full-analysis' },
169-
{ text: 'Agent 动态验证', link: '/108-agent-dynamic-verification' },
170-
],
171-
},
172-
// === 附录 ===
173-
{
174-
text: '附录',
175-
items: [
183+
{ text: '枚举值参考', link: '/20-enums-reference' },
184+
{ text: '完整类清单', link: '/36-complete-class-inventory' },
176185
{ text: '逆向工程报告', link: '/reverse-engineering-report' },
177186
],
178187
},

‎docs/superpowers/blindspot-scan-round-1.md‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# iFlyCode 盲点扫描报告 - 第 1 轮
2+
3+
时间: 2026-07-04 16:30 UTC+8
4+
5+
## 本轮发现
6+
7+
### 1. debugCode=9527 后门 — 实物未验证
8+
9+
**来源**: docs/104-final-blindspot-elimination.md
10+
- `debugCode=9527` 后门功能已分析，但**修改 `config.json` 后是否能触发后门模式**未实际验证
11+
- 严重性：中等（后门机制已理解，仅缺实物验证）
12+
13+
### 2. FeatureProbe SDK 用途未确认
14+
15+
**来源**: docs/104-final-blindspot-elimination.md, docs/105-velocity-templates-and-final-blindspots.md
16+
- `featureprobe-server-sdk-node` 出现在 `package.json` 但**未被 webpack 打包到 index.js**
17+
- 推测：仅开发环境使用，或已废弃依赖
18+
- 严重性：低（已确认当前版本无功能作用）
19+
20+
### 3. Agent 二进制多出的 54MB 来源
21+
22+
**来源**: docs/104-final-blindspot-elimination.md
23+
- 标准 Node.js 18.18.0 约 35MB，Agent 内置的 Node.js 二进制为**89MB**
24+
- 推测：含调试符号未剥离，或额外静态链接库
25+
- 严重性：低（不影响功能分析）
26+
27+
### 4. API 路由数未重新计数
28+
29+
**来源**: docs/104-final-blindspot-elimination.md
30+
- 标记为"待验证"，目前使用 doc 66 的 67 条计数
31+
- 严重性：低
32+
33+
### 5. OTel 开关配置假设未验证
34+
35+
**来源**: docs/108-agent-dynamic-verification.md
36+
- `aicode.otel.switch=false` 默认关闭 OTel，修改配置后的行为**假设未验证**
37+
- 严重性：低
38+
39+
### 6. NeDB 到 SQLite 迁移触发条件不明
40+
41+
**来源**: docs/87-final-comprehensive-report/deobfuscation-and-legacy.md
42+
- 代码中存在 `sqlite2nedb` 迁移逻辑，但**触发条件未分析清楚**
43+
- 严重性：中等（可能涉及数据持久化机制理解）
44+
45+
### 7. `air_plane.svg` 图标用途不明
46+
47+
**来源**: docs/104-final-blindspot-elimination.md
48+
- `stop.svg` 对应"停止"但 `air_plane.svg` 用途不明
49+
- 严重性：极低
50+
51+
### 8. H() 未解码字符串仍存疑
52+
53+
**来源**: docs/29-obfuscated-strings.md
54+
- 仍有大量 H() 混淆字符串的**具体用途为推测**（"可能是..."、"推测是..."）
55+
- 实际解码率 91.5%，约 200+ 条字符串用途基于上下文推测而非确认
56+
- 严重性：低（不影响主体功能理解）
57+
58+
### 9. RSA 1024-bit 安全性不足
59+
60+
**来源**: docs/66-agent-webpack-bundle-analysis.md
61+
- 文档指出登录加密使用 RSA 1024-bit 安全性不足，但实际攻击面分析不够深入
62+
- 严重性：低（产品已下线）
63+
64+
### 10. SM2 加密用途部分待确认
65+
66+
**来源**: docs/101-java-encryption-call-chain.md
67+
- SM2 加密在 Java 端标注为"不执行，具体用途待确认"
68+
- 严重性：低（Agent 端的 SM2 已完成分析）
69+
70+
## 已确认/已排除
71+
72+
- **产品已下线**：官网 NXDOMAIN、API 502、插件从商店下架 — 已确认
73+
- **H() 混淆算法**：完全破解（7 个解码器，4,628 次调用，91.5% 解码率）— 已确认
74+
- **API 端点清单**：67 个端点全部映射 — 已确认
75+
- **加密系统**：RSA/SM2/SM4/AES/MD5 全部完成 — 已确认
76+
- **SSO 登录流程**：流程完整逆向，但缺少有效 Token — 无法进一步验证
77+
78+
## 状态总结
79+
80+
所有盲点均为**低到中等严重性**，不影响主体逆向分析成果的完整性。本轮未发现任何严重遗漏或矛盾。
81+
82+
| 类别 | 数量 |
83+
|------|------|
84+
| 未验证的功能假设 | 4 |
85+
| 用途未确认的组件 | 2 |
86+
| 推测性描述（H()字符串等） | ~200+ 条 |
87+
| 已完全搞清楚的点 | 108+ 文档 |
88+
| 整体逆向完成度评估 | **~98%** |

0 commit comments

Comments
 (0)