某书 Android 9.43.1 签名算法解析

P = 2**255 - 19

def clamp(k: bytes) -> bytes:
    k = bytearray(k)
    k[0] &= 0xF8
    k[31] = (k[31] & 0x7F) | 0x40
    return bytes(k)

def x25519(scalar: bytes, u: bytes) -> bytes:
    k = int.from_bytes(clamp(scalar), 'little')
    x1 = int.from_bytes(u, 'little') & ((1 << 255) - 1)
    x2, z2, x3, z3, swap = 1, 0, x1, 1, 0
    for t in range(254, -1, -1):
        kt = (k >> t) & 1
        swap ^= kt
        if swap:
            x2, x3 = x3, x2
            z2, z3 = z3, z2
        swap = kt
        a = (x2 + z2) % P
        aa = (a * a) % P
        b = (x2 - z2) % P
        bb = (b * b) % P
        e = (aa - bb) % P
        c = (x3 + z3) % P
        d = (x3 - z3) % P
        da = (d * a) % P
        cb = (c * b) % P
        x3 = ((da + cb) ** 2) % P
        z3 = ((da - cb) ** 2 * x1) % P
        x2 = (aa * bb) % P
        z2 = (e * (aa + 121665 * e)) % P
    if swap:
        x2, x3 = x3, x2
        z2, z3 = z3, z2
    return ((x2 * pow(z2, P - 2, P)) % P).to_bytes(32, 'little')

import hashlib

def canonical(method: str, path: str, query: str, body: bytes, mua: str) -> bytes:
    return (f'{method}\n{path}\n{query}\n'
            f'{hashlib.sha256(body).hexdigest()}\n{mua}').encode()

def gf2_apply(digest16: bytes, rows) -> bytes:
    # rows：附录 A 的 128 行，每行 129 列（128 个输入位 + 1 个常量位）
    v = int.from_bytes(digest16, 'big') | (1 << 128)
    out = bytearray(16)
    for i, row in enumerate(rows):
        bit = 0
        for j, c in enumerate(row):
            if c:
                bit ^= (v >> j) & 1
        if bit:
            out[i // 8] |= 1 << (7 - i % 8)
    return bytes(out)

def compute_sig(method: str, path: str, query: str, body: bytes, mua: str, rows) -> str:
    d = hashlib.sha256(canonical(method, path, query, body, mua)).digest()
    return (gf2_apply(d[:16], rows) + d[16:]).hex()

import hashlib, struct

def gf_mul(a, b):
    r = 0
    for _ in range(8):
        if b & 1: r ^= a
        a = ((a << 1) ^ 0x11B) & 0xFF if a & 0x80 else (a << 1) & 0xFF
        b >>= 1
    return r

def gf_inv(x):
    if x == 0: return 0
    for y in range(1, 256):
        if gf_mul(x, y) == 1: return y

def rotl(v, n): return ((v << n) | (v >> (8 - n))) & 0xFF

SBOX = bytes(gf_inv(x) ^ rotl(gf_inv(x), 1) ^ rotl(gf_inv(x), 2)
             ^ rotl(gf_inv(x), 3) ^ rotl(gf_inv(x), 4) ^ 0x63 for x in range(256))

def crc_state(data):
    s = 0xFFFFFFFF
    for v in data:
        s ^= v
        for _ in range(8):
            s = (s >> 1) ^ 0xEDB88320 if s & 1 else s >> 1
    return s

def crc32(data): return crc_state(data) ^ 0xFFFFFFFF

def ns(data): return bytes((v >> 4) | ((v & 0x0F) << 4) for v in data)

WORD_ORDER = (7, 0, 2, 5, 6, 3, 1, 4)
LANE3 = (0xB, 0x2, 0xF, 0x6, 0x8, 0x9, 0xE, 0x3, 0x1, 0xD, 0x7, 0x5, 0xC, 0xA, 0x0, 0x4)
ROUND_KEYS = tuple(bytes.fromhex(h) for h in (
    "786873306f6832697534616e376f6732", "5a3241711e764471e0d4fb95096b0c3e",
    "43713041275115398f5bfa6ff3c8c4fa", "1e6f5f1e27766300174cf798864b8f75",
    "ed82ddc30e781b293c70b32b4539b6c3", "52d00dce760e1578cabaddf62717a162",
    "2bfbf638faf4e18c2d9711e7789c3d5f", "93689ea6fe0aeb0467f0ad4a819ba6f9",
    "fa920caa767c97888c7ca1eb61bf19e0"))
FINAL_A = bytes.fromhex("69fbf75dee92059829554ea58b130aea")
FINAL_C = bytes.fromhex("34cf3865648a181d73d6ffaa5f55bf34")
CBC_IV = bytes.fromhex("6e2052fb01f05fd238ad54534bd00831")

def digest_lane(canonical: bytes, counter: int) -> bytes:
    digest = hashlib.sha256(canonical + struct.pack('<I', counter)).digest()
    state = b''.join(digest[i*4:i*4+4] for i in WORD_ORDER)
    b0, b1, b2, b3 = state[0:8], state[8:16], state[16:24], state[24:32]
    s = ns(b0)
    lane0 = bytes(v ^ (crc_state(s) & 0xFF) for v in s)
    cn = ((b1[0] << 4) | (b1[7] >> 4)) ^ ((b1[6] << 4) | (b1[1] >> 4))
    lane1 = bytes(v if i in (3, 5) else ns(bytes((v,)))[0]
                  for i, v in enumerate(bytes(v ^ (cn & 0xFF) for v in b1)))
    sub = bytes(t for v in b2 for t in (LANE3[v >> 4], LANE3[v & 0x0F]))
    lane2 = bytes(v ^ (crc_state(sub) & 0xFF) for v in b2)
    first = b3[0] ^ 0xAE
    c0 = ns(bytes((first,)))[0]
    second = b3[1] ^ c0 ^ 0xAE
    c1 = ns(bytes((second,)))[0]
    mask = c0 ^ c1 ^ 0xAE
    lane3 = bytes((c0 ^ c1 ^ first, c1 ^ second, *(v ^ mask for v in b3[2:])))
    return lane0 + lane1 + lane2 + lane3

def transpose(s): return bytes(s[r*4+c] for c in range(4) for r in range(4))

def shift_rows(s): return b''.join(s[r*4+r:r*4+4] + s[r*4:r*4+r] for r in range(4))

def mix_columns(s):
    t = transpose(s); out = bytearray()
    for off in range(0, 16, 4):
        a, b, c, d = t[off:off+4]
        out += bytes((gf_mul(a,2)^gf_mul(b,3)^c^d, a^gf_mul(b,2)^gf_mul(c,3)^d,
                      a^b^gf_mul(c,2)^gf_mul(d,3), gf_mul(a,3)^b^c^gf_mul(d,2)))
    return transpose(bytes(out))

def s1_block(block):
    s = shift_rows(transpose(block))
    for rk in ROUND_KEYS:
        s = bytes(SBOX[v ^ m] for v, m in zip(s, rk))
        s = shift_rows(mix_columns(s))
    s = bytes(SBOX[v ^ a] ^ c for v, a, c in zip(s, FINAL_A, FINAL_C))
    return transpose(s)

def s1_cbc(payload):
    prev, out = CBC_IV, bytearray()
    for off in range(0, len(payload), 16):
        prev = s1_block(bytes(x ^ y for x, y in zip(payload[off:off+16], prev)))
        out += prev
    return bytes(out)

def build_s1_raw(canonical: bytes, counter: int, timestamp_s: int) -> bytes:
    lane = digest_lane(canonical, counter)
    seed = (struct.pack('<I', timestamp_s) + bytes.fromhex('51244a19')
            + b'\x00\x00' + lane + bytes.fromhex('170e'))
    source = b'\x01' + s1_cbc(seed + b'\x04' * 4) + crc32(seed).to_bytes(4, 'big')
    return (b'\x00' + struct.pack('<I', counter) + source
            + crc32(source).to_bytes(4, 'big'))

import base64, hashlib

RCON = [0x12310000, 0x02000100, 0x04020000, 0x08020200, 0x10102000,
        0x30020400, 0x40002000, 0x80002000, 0x1b002000, 0x36200200]
MASK = bytes.fromhex('f1892131ff001123f1001356f1234890')
HEADER = bytes.fromhex('3501323400020861667a666607176639')

def rotw(w): return ((w << 8) | (w >> 24)) & 0xFFFFFFFF

def subw(w): return int.from_bytes(bytes(SBOX[b] for b in w.to_bytes(4, 'big')), 'big')

def key_expand(key16: bytes) -> bytes:
    w = [int.from_bytes(key16[i*4:i*4+4], 'big') for i in range(4)]
    for i in range(10):
        t = subw(rotw(w[-1]))
        w.append(w[-4] ^ t ^ RCON[i])
        for _ in range(3):
            w.append(w[-4] ^ w[-1])
    return b''.join(x.to_bytes(4, 'big') for x in w)

def xtime(a): a <<= 1; return (a ^ 0x11B) & 0xFF if a & 0x100 else a & 0xFF

def gmul(a, b):
    r = 0
    for _ in range(8):
        if b & 1: r ^= a
        b >>= 1; a = xtime(a)
    return r

INV = [0] * 256
for i, v in enumerate(SBOX):
    INV[v] = i

def inv_shift_rows(s):
    return bytes([s[0], s[13], s[10], s[7], s[4], s[1], s[14], s[11],
                  s[8], s[5], s[2], s[15], s[12], s[9], s[6], s[3]])

def inv_mix_columns(s):
    o = bytearray(16)
    for c in range(4):
        a = s[c*4:c*4+4]
        o[c*4+0] = gmul(a[0],14) ^ gmul(a[1],11) ^ gmul(a[2],13) ^ gmul(a[3],9)
        o[c*4+1] = gmul(a[0],9)  ^ gmul(a[1],14) ^ gmul(a[2],11) ^ gmul(a[3],13)
        o[c*4+2] = gmul(a[0],13) ^ gmul(a[1],9)  ^ gmul(a[2],14) ^ gmul(a[3],11)
        o[c*4+3] = gmul(a[0],11) ^ gmul(a[1],13) ^ gmul(a[2],9)  ^ gmul(a[3],14)
    return bytes(o)

def xor16(a, b): return bytes(x ^ y for x, y in zip(a, b))

def aes_decrypt_block(block: bytes, rk: bytes) -> bytes:
    s = xor16(block, rk[160:176])
    for i in range(9, 0, -1):
        s = inv_shift_rows(s)
        s = bytes(INV[b] for b in s)
        s = xor16(s, rk[i*16:(i+1)*16])
        s = inv_mix_columns(s)
    s = inv_shift_rows(s)
    s = bytes(INV[b] for b in s)
    return xor16(s, rk[0:16])

def main_hmac_key64(main_hmac_b64: str, device_id: str) -> bytes:
    raw = base64.b64decode(main_hmac_b64)
    key16 = bytes(a ^ b for a, b in zip(device_id.encode()[:16], MASK))
    rk = key_expand(key16)
    plain, prev = bytearray(), bytes(16)
    for off in range(0, len(raw), 16):
        block = raw[off:off+16]
        plain += xor16(aes_decrypt_block(block, rk), prev)
        prev = block
    assert bytes(plain[:16]) == HEADER
    return bytes(plain[16:80])   # key64

import base64
from urllib.parse import urlsplit

RC4_KEY = '逆向违法，即刻停止！Reverse engineering is illegal. Cease now!'.encode()
MASK36 = bytes.fromhex('606b39fd3c39443008502297d736827cf3903c05d0e77e0737f77066f77460435bd69068')
MASK16 = bytes.fromhex('b3661b2425c8d1cf9674e8218b30b91a')
HDR_PREFIX = bytes.fromhex('8dfe00055569')
HDR_SUFFIX = bytes.fromhex('a6d7a54f949cf960')
EMPTY_HF = bytes.fromhex('9a89')

def rc4(key: bytes, data: bytes) -> bytes:
    s = list(range(256)); j = 0
    for i in range(256):
        j = (j + s[i] + key[i % len(key)]) & 0xFF
        s[i], s[j] = s[j], s[i]
    i = j = 0
    out = bytearray()
    for b in data:
        i = (i + 1) & 0xFF
        j = (j + s[i]) & 0xFF
        s[i], s[j] = s[j], s[i]
        out.append(b ^ s[(s[i] + s[j]) & 0xFF])
    return bytes(out)

def shield_70b(device_id: str, url: str, headers: dict) -> str:
    parts = urlsplit(url)
    devid = device_id.encode()
    plain = bytearray([0xC1])
    plain += bytes(a ^ b for a, b in zip(devid, MASK36))
    plain.append(0xF4)
    plain += MASK16
    payload = HDR_PREFIX + EMPTY_HF + HDR_SUFFIX + rc4(RC4_KEY, bytes(plain))
    return 'XY' + base64.b64encode(payload).decode()

shield_70b('4ee6f1f8-75e5-313d-993b-e5a8aaedbaae',
           'https://edith.xiaohongshu.com/api/sns/v1/system_service/vfc_code'
           '?phone=13800138000&zone=1&type=login',
           {'xy-common-params': '', 'xy-direction': '90'})
# 'XYjf4ABVVpmomm16VPlJz5YE0FodlR1qnMmVnCszuzcoCJfJOhpEN1aN/UnJcBJa1K0LUqi0v+Qdey0hyMHeAio6PLpd74zQ=='

0000006b000000a1000000f41aa7488200000000d600000043000000e9344f900480000000ad00000087000000d3699e200a000000005a0000000f000000a7d23d401480
000000de000000be000000bbbfddc9a880000000d7000000dc00000083651ddbd000000000af000000b800000007cb3ab6a08000000035000000d0000000fa8dd324c080
000052c2000050580000948e724ad6de000000a4840000a0b10000281ce494adbc00000049090000416200005138c8285a788000009213000083c50000a2709151b5f280
000076e5000057d20000d16e50e8bc38800000be080000fefd00003752d29bafac0000007d110000fcfa00006fa4a5375e58000000a9e10000a8ac00004ac739256b6e80
005903f600b6dfcb67928b7da4d5840e0000b306ed006cbe97cf2416fb49ab091c8000660cdb00d87d2e9f482df69256133a0000cd19b600b0fb5d3f905bed24ac277400
00c2319a00d6297019b23ca6ec8dcae60000dd60c3001b8c2b55f6f3307dcf11c20000bac18600361857aaede761fb9f238400002c81fb00dbef65334945be52eac20680
2e83b6e02070089b2805fb342ddca9ea805d076cc040e01137510af6695bb852d680bb0ed88081c0236fa215edd2b771a4ae80771db001038046de452bdba56ee2495e00
c0b9d6e226718527a3524d7ff1183b5600aef01b246c9203d56fa161cbceecdf46805ce13648d82406abde43c3979dd9be8e809741db70903804cd94827d1a166ed4f480
0000c839000004bf525057d5373bf6f200000091720000087fa4a0aeab6f76ede480000022e4000011ff49415c56deecdbca00000044c8000023fe9283b9acbcd9b69480
000041a8000042437657248d4e899ad80000004b6900008138befe1fcfab29c34200000096d2000003707dfc3e9f56538684800000e49c0000025fa9a82bea9b9dfbf880
0000e80700007f41c7a6066322a26ad2000000d10e0000ff838e4d0cc74445d4a4800000a31d0000fe071c9a198e898ba94a800000473a0000fc0e3835321c1216529600
000067730000875cb7cd635b078fcefe00000027e1000070f8a93dc1d42cbcf72e0000004ec20000e0f0527a82a95979ef5c80000074830000bfa0635303319151b56880
0061cc240066d036e82b4c58155412588000c3994800cda16dd15798b12ba825b28000863390009b43daa3ae316257504a6600000d6720003787b4475c63c5aea094cc80
007a03640009df5e67928bd249153ac2000094caed00756e8b270f5afd877f66dc80002895db00eadc164e1fb5fa0fffcdba000030e69200b3681b741526ac0aaa892c00
4f7dffe1cd22b109585c8fcce37ac080809efbfec29b446213b1b91e99c6f58002803df6fc843789c52762733c338ceb0106007aedf8096f128a4ec5e6786718d7020c00
baa60ff21307a595d2907e03d3d5c498003a30e004ea2cfa23fd7c72ca44d148b0007461c008d559f446faf9e49589a3906000a7be7ff066915884acae47e6f13de04000
004972c159e314b3a0d85844c737f8de000092e482b3c6296641b0b1898e6ff0bc000024c805668c53cd836062121cdee178800048910acd18a69b07c1c52538bcc2f280
00d950d4c2d35984ae5ad20eb74e7c388000fbd268dd44a7bafc6dfd59a9ab01ac0000f6a5d0ba894f75f8dafab3525602580000a439602cf18a59506cac22639bfc6e80
00910f4e61cbf6b4a99b5dc62bf114300000221f9cc397ed685237bb8c57e329608000443e39862edbd0a46f7718aec653c28000897c720d5db6a149deee305c8ca68600
0083f6aa7a709af73b2780a792e9593c800096e21a942bc35bdfd55c890f22a74a00002cc434285786b7beabb9121f444f940000c887273065fbdad4cd2ee315788a1800
0026917e7f7a7f7fcc52e223de0bd9a880004c22fdfff5ffff99a4c446bc17b25200009844fafeebfefe3349888d792f64a400003189f4fcd7fcfc6792101af35fc94880
0045839787d587870376c31739b44a3a8000ad965070d17070cabe640cac634dde80005a2ca0e0a3e0e0957dc91958c79abe000093c83fbf3dbfbfe6a971116f85ecd400
743ecdc06bec892c6fddd951127d57b600e87c9b80d6d91259debab2a225fbae6c00d1f93701adb225b3bc7564454af65cd800a3f26f025a644a6679eac98b94edb9b000
33db13c4de251de19c084a473aa624d6001388ea48d7a6b3ee56cc4dde66301f1a802710d590af4d66ddac999abccd613e36003a1f66e03576449637eeec2889be2bda80
c751e0217a1dd8365c17560d304c03f4008ea2c042f53ab06db92fac1b619806e8801c458085eb7460da735f5836c3310cd280388b010bd7e8c1b4e6bfb16d866319a680
b747e236d5cc5a5e906834d73d8b31ba80a9de244cd1846d8b7cc73fa24a5a60828052bc4898a309da16f98e7e4594b5c10680632870103d0e6c1bae0bab86182681fa00
2ec92c906de01e859dd433f9fee74048005d935920dac03c0b3ba967f2fcce819000bb26b340b48078177652cfe5f89d032000774c66816801f12feca49fcaf03b064000
c051e193bde2fdda449d0c6c1f914cc880ae6beeb61624e43114ef2a21c0c5d8da805cd6dd6c2d48c86329df5542808ab0b6009764964836708f42ce6a997cfff3202400
5c68805b2d88b57c09115555c24ba8c400b9d001b75b106af91323aaaa849650880073a1026eb721d4f227465454092ca01000e64304dc6e42a9e54e8da8a81359412080
90ef88e3f10de7b6950b0505e5f82b86007cb7909dce937b1023065f5f08bbffc880f96e203b9d26f721460cbfbf1177fe9280aeb4c02d16c45a3e84082a2ae1a554e200
3cf10ea808ea48249e0228807d47ed4e0078e31d5011d590483d045101fb8fdb9c00f1c63aa023ab20907a08a202f61eb63880e38c744146564020f5114504ed3c6c7200
fae9e62b8546c9647521a388a63f35aa00c822c2ff0367dbed74406f903039861a00914484fe06cfb6dbe881de2061720d34001e780754047524924f0194c0bea3f62680

MASK = (1 << 64) - 1
P1 = 0x9E3779B185EBCA87
P2 = 0xC2B2AE3D27D4EB4F
P4 = 0x85EBCA77C2B2AE63
SECRET = bytes.fromhex("b8fe6c3923a44bbe7c01812cf721ad1cded46de9839097db7240a4a4b7b3671fcb79e64eccc0e578825ad07dccff7221b8084674f743248ee03590e6813a264c3c2852bb91c300cb88d0658b1b532ea371644897a20df94e3819ef46a9deacd8a8fa763fe39c343ff9dcbbc7c70b4f1d8a51e04bcdb45931c89f7ec9d9787364eac5ac8334d3ebc3c581a0fffa1363eb170ddd51b7f0da49d316552629d4689e2b16be587d47a1fc8ff8b8d17ad031ce45cb3a8f95160428afd7fbcabb4b407e")


def _read(b: bytes, pos: int) -> int:
    return int.from_bytes(b[pos:pos + 8], "little")


def _avalanche(x: int) -> int:
    x &= MASK
    x ^= x >> 37
    x = x * 0x165667919E3779F9 & MASK
    return x ^ (x >> 32)


def xxh3_128_medium(data: bytes, seed: int = 0) -> int:
    """Return high64<<64|low64, rejecting lengths outside 17..240."""
    n = len(data)
    if not 17 <= n <= 240:
        raise ValueError("medium XXH3-128 currently supports 17..240 bytes")
    seed &= MASK
    low, high = n * P1 & MASK, 0

    def mix16(pos: int, sec: int, seed: int) -> int:
        a = _read(data, pos) ^ ((_read(SECRET, sec) + seed) & MASK)
        b = _read(data, pos + 8) ^ ((_read(SECRET, sec + 8) - seed) & MASK)
        product = a * b
        return ((product & MASK) ^ (product >> 64))

    def mix32(a: int, b: int, sec: int, sd: int) -> None:
        nonlocal low, high
        low = ((low + mix16(a, sec, sd)) & MASK) ^ ((_read(data, b) + _read(data, b + 8)) & MASK)
        high = ((high + mix16(b, sec + 16, sd)) & MASK) ^ ((_read(data, a) + _read(data, a + 8)) & MASK)

    if n <= 128:
        for i in range((n - 1) // 32, -1, -1):
            mix32(16 * i, n - 16 * (i + 1), 32 * i, seed)
    else:
        for i in range(32, 160, 32):
            mix32(i - 32, i - 16, i - 32, seed)
        low, high = _avalanche(low), _avalanche(high)
        for i in range(160, n + 1, 32):
            mix32(i - 32, i - 16, 3 + i - 160, seed)
        mix32(n - 16, n - 32, 136 - 17 - 16, -seed & MASK)
    result_low = _avalanche(low + high)
    result_high = -_avalanche(low * P1 + high * P4 + (n - seed) * P2) & MASK
    return result_high << 64 | result_low


P3 = 0x165667B19E3779F9
P5 = 0x27D4EB2F165667C5
P32_1 = 0x9E3779B1
P32_2 = 0x85EBCA77
P32_3 = 0xC2B2AE3D


def _swap(x: int, size: int) -> int:
    return int.from_bytes(x.to_bytes(size, "little"), "big")


def _avalanche64(x: int) -> int:
    x &= MASK
    x = ((x ^ (x >> 33)) * P2) & MASK
    x = ((x ^ (x >> 29)) * P3) & MASK
    return x ^ (x >> 32)


def _short(data: bytes, seed: int) -> int:
    n = len(data)
    if n == 0:
        low = _avalanche64(seed ^ _read(SECRET, 64) ^ _read(SECRET, 72))
        high = _avalanche64(seed ^ _read(SECRET, 80) ^ _read(SECRET, 88))
    elif n < 4:
        combined = (data[0] << 16) | (data[n >> 1] << 24) | data[-1] | (n << 8)
        swapped = _swap(combined, 4)
        rotated = ((swapped << 13) | (swapped >> 19)) & 0xFFFFFFFF
        flip_l = (int.from_bytes(SECRET[:4], "little") ^ int.from_bytes(SECRET[4:8], "little")) + seed
        flip_h = (int.from_bytes(SECRET[8:12], "little") ^ int.from_bytes(SECRET[12:16], "little")) - seed
        low = _avalanche64(combined ^ (flip_l & MASK))
        high = _avalanche64(rotated ^ (flip_h & MASK))
    elif n <= 8:
        seed ^= _swap(seed & 0xFFFFFFFF, 4) << 32
        value = int.from_bytes(data[:4], "little") | (int.from_bytes(data[-4:], "little") << 32)
        flip = ((_read(SECRET, 16) ^ _read(SECRET, 24)) + seed) & MASK
        product = (value ^ flip) * (P1 + (n << 2))
        low, high = product & MASK, product >> 64
        high = (high + (low << 1)) & MASK
        low ^= high >> 3
        low = ((low ^ (low >> 35)) * 0x9FB21C651E98DF25) & MASK
        low ^= low >> 28
        high = _avalanche(high)
    else:
        flip_l = ((_read(SECRET, 32) ^ _read(SECRET, 40)) - seed) & MASK
        flip_h = ((_read(SECRET, 48) ^ _read(SECRET, 56)) + seed) & MASK
        head, tail = _read(data, 0), _read(data, n - 8)
        product = (head ^ tail ^ flip_l) * P1
        low, high = product & MASK, product >> 64
        low = (low + ((n - 1) << 54)) & MASK
        tail ^= flip_h
        high = (high + tail + (tail & 0xFFFFFFFF) * (P32_2 - 1)) & MASK
        low ^= _swap(high, 8)
        product = low * P2
        low = _avalanche(product & MASK)
        high = _avalanche((product >> 64) + high * P2)
    return (high << 64) | low


def _long(data: bytes, seed: int) -> int:
    if seed:
        parts = []
        for i in range(0, 192, 16):
            parts.append(((_read(SECRET, i) + seed) & MASK).to_bytes(8, "little"))
            parts.append(((_read(SECRET, i + 8) - seed) & MASK).to_bytes(8, "little"))
        secret = b"".join(parts)
    else:
        secret = SECRET
    acc = [P32_3, P1, P2, P3, P4, P32_2, P5, P32_1]

    def stripe(pos: int, sec: int) -> None:
        for lane in range(8):
            value = _read(data, pos + 8 * lane)
            keyed = value ^ _read(secret, sec + 8 * lane)
            acc[lane ^ 1] = (acc[lane ^ 1] + value) & MASK
            acc[lane] = (acc[lane] + (keyed & 0xFFFFFFFF) * (keyed >> 32)) & MASK

    n = len(data)
    blocks = (n - 1) // 1024
    for block in range(blocks):
        for j in range(16):
            stripe(block * 1024 + j * 64, j * 8)
        for lane in range(8):
            value = acc[lane]
            acc[lane] = ((value ^ (value >> 47) ^ _read(secret, 128 + lane * 8)) * P32_1) & MASK
    for j in range(((n - 1) - blocks * 1024) // 64):
        stripe(blocks * 1024 + j * 64, j * 8)
    stripe(n - 64, 121)

    def merge(sec: int, start: int) -> int:
        total = start
        for i in range(4):
            product = (acc[2*i] ^ _read(secret, sec+16*i)) * (acc[2*i+1] ^ _read(secret, sec+16*i+8))
            total += (product & MASK) ^ (product >> 64)
        return _avalanche(total)

    return merge(117, ~(n * P2)) << 64 | merge(11, n * P1)


def xxh3_128(data: bytes, seed: int = 0) -> int:
    """Return the unsigned 128-bit digest (high64 followed by low64).

    Seed is reduced modulo 2**64, as in the xxHash C API. This is a one-shot
    implementation, with no runtime dependency on xxhash/unidbg/native code.
    """
    if not isinstance(data, (bytes, bytearray, memoryview)):
        raise TypeError("data must be bytes-like")
    if type(seed) is not int:
        raise TypeError("seed must be an integer")
    data = bytes(data)
    seed &= MASK
    if len(data) <= 16:
        return _short(data, seed)
    if len(data) <= 240:
        return xxh3_128_medium(data, seed)
    return _long(data, seed)

Copyright (C) 2012-2023 Yann Collet

 BSD 2-Clause License (https://www.opensource.org/licenses/bsd-license.php)

 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
 met:

    Redistributions of source code must retain the above copyright
      notice, this list of conditions and the following disclaimer.
    Redistributions in binary form must reproduce the above
      copyright notice, this list of conditions and the following disclaimer
      in the documentation and/or other materials provided with the
      distribution.

 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
 A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
 OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 You can contact the author at:
   - xxHash homepage: https://www.xxhash.com
   - xxHash source repository: https://github.com/Cyan4973/xxHash