docs: 绕过配方状态更正 (bypass_all 未验证, 以原版三脚本为准) + 三层健康检查工具

2026-08-29 11:44:54 +08:00
parent 5fa1f6d082
commit 1a6711c180
11 changed files with 504 additions and 24 deletions
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""bypass_all vs 原版三脚本 — 三项标准 + Activity 轨迹对比."""
+import subprocess, sys, time, re
+from pathlib import Path
+import frida
+
+ADB="5dd8c93f"; PKG="com.duowan.kiwi"
+RE=Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+sys.path.insert(0,str(Path(__file__).resolve().parent))
+from bypass_loader import load_bypass
+
+def sh(*a): return subprocess.run(list(a),capture_output=True,text=True).stdout
+def pid_of():
+    for l in sh("adb","-s",ADB,"shell","ps","-A").splitlines():
+        if l.rstrip().endswith(PKG): return l.split()[1]
+def top_act():
+    out=sh("adb","-s",ADB,"shell","dumpsys","activity","activities")
+    for line in out.splitlines():
+        if "Hist #0" in line and PKG in line:
+            m=re.search(r"u0 ([\w.$]+) t\d+", line)
+            return m.group(1) if m else "?"
+    return None
+
+def run(label, loader, attempts=2, watch=40):
+    for a in range(1,attempts+1):
+        sh("adb","-s",ADB,"shell","am","force-stop",PKG); time.sleep(4)
+        sh("adb","-s",ADB,"logcat","-c")
+        d=frida.get_device_manager().add_remote_device("127.0.0.1:31878")
+        pid0=d.spawn([PKG]); s=d.attach(pid0)
+        loader(s)
+        d.resume(pid0)
+        trail=[]; die=None; t0=time.time()
+        while time.time()-t0<watch:
+            time.sleep(4)
+            p=pid_of()
+            if p is None: die=f"{time.time()-t0:.0f}s"; break
+            act=top_act()
+            if act and (not trail or trail[-1]!=act): trail.append(act)
+        log=sh("adb","-s",ADB,"logcat","-d")
+        anr = "ANR in com.duowan.kiwi" in log
+        fatal = "FATAL EXCEPTION" in log and PKG in log
+        entered = any("Splash" not in x for x in trail)
+        tag = f"{label}#{a}"
+        print(f"{tag}: die={die or 'no'} ANR={anr} FATAL={fatal} entered={entered}")
+        print(f"   trail: {' -> '.join(trail) if trail else '(none)'}")
+        try: s.detach()
+        except: pass
+
+def load_merged(s):
+    load_bypass(s, patch_guard_delay_ms=11000)
+def load_original(s):
+    s.create_script((RE/"evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()).load()
+    s.create_script((RE/"evidence/scripts/mask_frida_maps_only.js").read_text()).load()
+    time.sleep(11)
+    s.create_script((RE/"evidence/scripts/patch_guard_block_termination.js").read_text()).load()
+
+if __name__=="__main__":
+    which=sys.argv[1] if len(sys.argv)>1 else "both"
+    if which in ("merged","both"): run("merged", load_merged)
+    if which in ("original","both"): run("original", load_original)