Scans current directory and outputs encrypted tinfoil.tfl when called. Requires phpseclib3 and composer. Adjust to your needs.

indexer.php

<?php

require_once 'vendor/autoload.php';

use phpseclib3\Crypt\RSA;
use phpseclib3\Crypt\AES;
use phpseclib3\Crypt\PublicKeyLoader;

// Load Tinfoil public key
$publicPem = <<<EOD
-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvPdrJigQ0rZAy+jla7hS
jwen8gkF0gjtl+lZGY59KatNd9Kj2gfY7dTMM+5M2tU4Wr3nk8KWr5qKm3hzo/2C
Gbc55im3tlRl6yuFxWQ+c/I2SM5L3xp6eiLUcumMsEo0B7ELmtnHTGCCNAIzTFzV
4XcWGVbkZj83rTFxpLsa1oArTdcz5CG6qgyVe7KbPsft76DAEkV8KaWgnQiG0Dps
INFy4vISmf6L1TgAryJ8l2K4y8QbymyLeMsABdlEI3yRHAm78PSezU57XtQpHW5I
aupup8Es6bcDZQKkRsbOeR9T74tkj+k44QrjZo8xpX9tlJAKEEmwDlyAg0O5CLX3
CQIDAQAB
-----END PUBLIC KEY-----
EOD;

// Your file hosting base URL
$baseUrl = 'https:/example.com/roms/'; // Change to your real base URL
$dir = '.'; // Scan current directory

$files = [];
$allowedExtensions = ['nsp', 'nsz', 'xci', 'xcz', 'zip'];

foreach (scandir($dir) as $file) {
    if ($file[0] === '.') continue;
    if (!is_file($file)) continue;

    $ext = strtolower(pathinfo($file, PATHINFO_EXTENSION));
    if (!in_array($ext, $allowedExtensions)) continue;

    $files[] = [
        'url' => $baseUrl . rawurlencode($file),
        'size' => filesize($file)
    ];
}


// JSON payload with "files" and "success"
$jsonData = [
    'files' => $files,
    'success' => 'Tinfoil Test Server!' // Replace with your own message
];

$json = json_encode($jsonData, JSON_UNESCAPED_SLASHES);

// Generate AES key
$aesKey = random_bytes(16);

// Encrypt AES key with RSA
$rsa = PublicKeyLoader::load($publicPem)->withPadding(RSA::ENCRYPTION_OAEP);
$sealedKey = $rsa->encrypt($aesKey);

// Encrypt JSON using AES-128-ECB with PKCS7 padding
$aes = new AES('ecb');
$aes->setKey($aesKey);

$padLen = 16 - (strlen($json) % 16);
$padding = str_repeat("\x00", $padLen);
$encrypted = $aes->encrypt($json . $padding);

// Output Tinfoil format
//header('Content-Type: application/octet-stream');
echo "TINFOIL\xF0";                        // Magic header + flags
echo $sealedKey;                          // Encrypted AES key (256 bytes)
echo pack('P', strlen($json));            // Unencrypted JSON length (8-byte LE)
echo $encrypted;                          // Encrypted JSON body