From 87b1c7a86ec71e22c1e9722005afe1d13529054e Mon Sep 17 00:00:00 2001
From: Lil-Ran <lilran4869@qq.com>
Date: Wed, 17 Dec 2025 23:49:38 +0800
Subject: [PATCH] fix: NOP is not 9 if minor version >= 13

---
 .github/workflows/regtest.yml | 10 +++++-----
 oneshot/detect.py             |  2 +-
 pycdc/pyc_code.cpp            |  2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/regtest.yml b/.github/workflows/regtest.yml
index a18514b..df6f7a2 100644
--- a/.github/workflows/regtest.yml
+++ b/.github/workflows/regtest.yml
@@ -39,18 +39,18 @@ jobs:
           lfs: true
           submodules: true
 
-      - name: Run shot.py
+      - name: Run shot.py and check for changes
+        working-directory: ./regtest
         run: |
-          touch ./regtest/.git/.no1shot
+          find . -type f -name '*\.1shot\.*' -exec rm -f {} + >/dev/null 2>&1
+          touch ./.git/.no1shot
           pip install pycryptodome
-          python3 ./project/oneshot/shot.py ./regtest --no-banner >/dev/null 2>&1
-          cd ./regtest
+          python3 ../project/oneshot/shot.py . --no-banner >/dev/null 2>&1
           if [ -n "$(git status --porcelain)" ]; then
             cd ../project
             COMMIT_MSG=$(git log -1 --pretty=%B | head -n 1)
             echo "$COMMIT_MSG" | grep -q "update tests" || { echo "Workspace changed but commit message does not contain 'update tests'. Failing workflow."; exit 1; }
           fi
-          cd ..
 
       - name: Commit and push changes
         if: ${{
diff --git a/oneshot/detect.py b/oneshot/detect.py
index 1125618..7e1c388 100644
--- a/oneshot/detect.py
+++ b/oneshot/detect.py
@@ -11,7 +11,7 @@ def ascii_ratio(data: bytes) -> float:
 
 
 def valid_bytes(data: bytes) -> bool:
-    return len(data) > 64 and all(0x30 <= b <= 0x39 for b in data[2:8])
+    return len(data) > 64 and all(0x30 <= b <= 0x39 for b in data[2:8]) and data[9] == 3
 
 
 def source_as_file(file_path: str) -> Union[List[bytes], None]:
diff --git a/pycdc/pyc_code.cpp b/pycdc/pyc_code.cpp
index 56b326b..45ed1fd 100644
--- a/pycdc/pyc_code.cpp
+++ b/pycdc/pyc_code.cpp
@@ -216,7 +216,7 @@ void PycCode::pyarmorDecryptCoCode(unsigned long consts_index, PycModule *mod)
         // Assume tail of code is not used there
         memset(
             &code_bytes[desc->decrypt_length],
-            9, // NOP
+            mod->verCompare(3, 13) == 0 ? 30 : mod->verCompare(3, 14) == 0 ? 27 : 9, // NOP
             desc->decrypt_begin_index);
     }