docs(huya): 新增总览去困惑地图 + 代码风险标记 + 真机 Frida 稳定注入通道
- docs/HUYA_APP_OVERVIEW.md: 整体流程/三形态hdid区分/登录入口盘点/随机化矩阵/风险清单/真机Frida现状 - core/huya 各模块 docstring 加风险标记与 hdid 名称混淆提示, 指向总览 - tools/app_login_flow 标注已过时(未接注册链), tools/huya_device_profile 标注与 core 策略关系 - scripts/phone_stable_capture.py + diag_phone_lifecycle.py: 真机 spawn+art_callsite 稳定抓帧/四组诊断 - evidence/diag_phone/: 真机基线/attach/稳定抓帧实验证据 (90s 存活无 EGL 崩)
This commit is contained in:
yml2213
@@ -0,0 +1,201 @@
|
||||
#!/usr/bin/env python3
|
||||
"""真机版 存活/闪退四组对照诊断器 (M2102J2SC 5dd8c93f, fs152 15.2.2).
|
||||
|
||||
背景: 模拟器 GC3VE 上结论 = attach 主进程必死(msaoaidsec 静默 _exit) /
|
||||
spawn+脚本必 EGL 崩。换真机后两项都要重测 —— 真机 GPU 正常、无模拟器特征,
|
||||
msaoaidsec 在真机上的 frida 检测行为是未知数。
|
||||
|
||||
A. baseline 无 frida 正常启动 (应该活)
|
||||
B. spawn-zero spawn 立即 resume, 不加载任何脚本 (模拟器上稳定活)
|
||||
C. spawn-bypass spawn 挂起中加载 art_callsite 补丁后 resume (模拟器上 EGL 崩)
|
||||
D. attach 正常启动 7s 后 attach 主进程, 裸 attach (模拟器上静默 _exit)
|
||||
|
||||
指标(与模拟器版一致, 可交叉对比):
|
||||
proc_main /proc/<pid>/cmdline 精确等于 com.duowan.kiwi
|
||||
ui_focus dumpsys window mCurrentFocus 是否含包名
|
||||
crash logcat -b crash 的 Fatal/signal/Abort 计数
|
||||
detached frida session detached reason/detail
|
||||
|
||||
用法:
|
||||
/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0/.venv/bin/python \
|
||||
scripts/diag_phone_lifecycle.py [a|b|c|d] [serial] [remote]
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
from pathlib import Path
|
||||
|
||||
import frida
|
||||
|
||||
SERIAL = sys.argv[2] if len(sys.argv) > 2 else "5dd8c93f"
|
||||
REMOTE = sys.argv[3] if len(sys.argv) > 3 else "127.0.0.1:31878"
|
||||
PACKAGE = "com.duowan.kiwi"
|
||||
REPO = Path("/Users/yml/codes/douyu_login_py")
|
||||
OUT_DIR = REPO / "evidence" / "diag_phone"
|
||||
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
||||
ART_CALLSITE = RE / "evidence" / "scripts" / "bypass_msaoaid_maps_art_callsite.js"
|
||||
|
||||
DURATION = 22.0 # 单轮观察时长(s)
|
||||
|
||||
|
||||
def sh(*a):
|
||||
return subprocess.run(a, capture_output=True, text=True)
|
||||
|
||||
|
||||
def adb(*a):
|
||||
return sh("adb", "-s", SERIAL, *a)
|
||||
|
||||
|
||||
def main_pid():
|
||||
r = adb("shell", "pidof", PACKAGE)
|
||||
for p in r.stdout.strip().split():
|
||||
rr = adb("shell", "cat", f"/proc/{p}/cmdline")
|
||||
if rr.stdout.strip("\x00").strip() == PACKAGE:
|
||||
return int(p)
|
||||
return None
|
||||
|
||||
|
||||
def focus_state():
|
||||
r = adb("shell", "dumpsys", "window")
|
||||
m = re.search(r"mCurrentFocus=Window\{([^}]+)\}", r.stdout)
|
||||
if m:
|
||||
f = m.group(1)
|
||||
return (PACKAGE in f), f
|
||||
return False, "?"
|
||||
|
||||
|
||||
def crash_tail():
|
||||
r = adb("shell", "logcat", "-d", "-b", "crash", "-t", "60")
|
||||
n = r.stdout.count("Fatal") + r.stdout.count("Abort message") + r.stdout.count("signal ")
|
||||
return n, r.stdout[-1200:]
|
||||
|
||||
|
||||
def snapshot(label):
|
||||
p = main_pid()
|
||||
ok, foc = focus_state()
|
||||
return {"label": label, "proc": p, "ui_ok": ok, "focus": foc}
|
||||
|
||||
|
||||
DETACHED = []
|
||||
|
||||
|
||||
def detach_cb(reason, detail):
|
||||
DETACHED.append({"reason": reason, "detail": str(detail)})
|
||||
print(f" [detached] reason={reason} detail={detail}", flush=True)
|
||||
|
||||
|
||||
def run_observe(d, pid, label, extra=None):
|
||||
"""观察进程到超时或主进程死亡, 每 0.5s 记一次存活. 返回 timeline."""
|
||||
t0 = time.time()
|
||||
timeline = []
|
||||
last_pid = pid
|
||||
while time.time() - t0 < DURATION:
|
||||
ok, foc = focus_state()
|
||||
cur = main_pid()
|
||||
timeline.append({"t": round(time.time() - t0, 1), "proc": cur, "ui_ok": ok, "focus": foc})
|
||||
if cur is None or (last_pid is not None and cur != last_pid):
|
||||
break
|
||||
if extra is not None and extra():
|
||||
break
|
||||
time.sleep(0.5)
|
||||
return timeline
|
||||
|
||||
|
||||
def case_a():
|
||||
adb("shell", "logcat", "-c")
|
||||
adb("shell", "am", "force-stop", PACKAGE)
|
||||
time.sleep(1.5)
|
||||
adb("shell", "monkey", "-p", PACKAGE, "-c", "android.intent.category.LAUNCHER", "1")
|
||||
t0 = time.time()
|
||||
time.sleep(3)
|
||||
pid = main_pid()
|
||||
tl = run_observe(None, pid, "A")
|
||||
return {"group": "A", "t_spawn": round(time.time() - t0, 1), "pid": pid, "timeline": tl}
|
||||
|
||||
|
||||
def case_b():
|
||||
d = frida.get_device_manager().add_remote_device(REMOTE)
|
||||
adb("shell", "logcat", "-c")
|
||||
adb("shell", "am", "force-stop", PACKAGE)
|
||||
time.sleep(1.5)
|
||||
t0 = time.time()
|
||||
pid = d.spawn([PACKAGE])
|
||||
d.resume(pid)
|
||||
tl = run_observe(d, pid, "B", extra=lambda: False)
|
||||
return {"group": "B", "pid": pid, "t_spawn": round(time.time() - t0, 1),
|
||||
"timeline": tl, "detached": DETACHED}
|
||||
|
||||
|
||||
def case_c():
|
||||
d = frida.get_device_manager().add_remote_device(REMOTE)
|
||||
adb("shell", "logcat", "-c")
|
||||
adb("shell", "am", "force-stop", PACKAGE)
|
||||
time.sleep(1.5)
|
||||
t0 = time.time()
|
||||
pid = d.spawn([PACKAGE])
|
||||
suspend_start = time.time()
|
||||
session = d.attach(pid)
|
||||
session.on("detached", detach_cb)
|
||||
sc = session.create_script(ART_CALLSITE.read_text())
|
||||
sc.load()
|
||||
suspend_ms = (time.time() - suspend_start) * 1000
|
||||
d.resume(pid)
|
||||
print(f" [C] spawn pid={pid} 挂起{suspend_ms:.0f}ms(art_callsite) resumed", flush=True)
|
||||
tl = run_observe(d, pid, "C", extra=lambda: False)
|
||||
try:
|
||||
session.detach()
|
||||
except Exception:
|
||||
pass
|
||||
return {"group": "C", "pid": pid, "suspend_ms": round(suspend_ms, 1),
|
||||
"timeline": tl, "detached": DETACHED}
|
||||
|
||||
|
||||
def case_d():
|
||||
d = frida.get_device_manager().add_remote_device(REMOTE)
|
||||
adb("shell", "logcat", "-c")
|
||||
adb("shell", "am", "force-stop", PACKAGE)
|
||||
time.sleep(1.5)
|
||||
adb("shell", "monkey", "-p", PACKAGE, "-c", "android.intent.category.LAUNCHER", "1")
|
||||
time.sleep(7)
|
||||
pid = main_pid()
|
||||
t_att = time.time()
|
||||
try:
|
||||
session = d.attach(pid)
|
||||
session.on("detached", detach_cb)
|
||||
att_ms = (time.time() - t_att) * 1000
|
||||
print(f" [D] attach pid={pid} 耗时{att_ms:.0f}ms", flush=True)
|
||||
except Exception as exc:
|
||||
return {"group": "D", "pid": pid, "error": f"attach失败: {exc}",
|
||||
"detached": DETACHED}
|
||||
tl = run_observe(d, pid, "D", extra=lambda: False)
|
||||
try:
|
||||
session.detach()
|
||||
except Exception:
|
||||
pass
|
||||
return {"group": "D", "pid": pid, "attach_ms": round(att_ms, 1),
|
||||
"timeline": tl, "detached": DETACHED}
|
||||
|
||||
|
||||
def main():
|
||||
which = (sys.argv[1] if len(sys.argv) > 1 else "a").lower()
|
||||
OUT_DIR.mkdir(parents=True, exist_ok=True)
|
||||
cases = {"a": case_a, "b": case_b, "c": case_c, "d": case_d}
|
||||
result = cases[which]()
|
||||
n, tail = crash_tail()
|
||||
result["crash_count"] = n
|
||||
result["crash_tail"] = tail
|
||||
out = OUT_DIR / f"phone_{which}.json"
|
||||
out.write_text(json.dumps(result, indent=1, ensure_ascii=False), encoding="utf-8")
|
||||
print(f"[{which.upper()}] -> {out}")
|
||||
print(" 主进程最终:", result["timeline"][-1] if result["timeline"] else None)
|
||||
print(" crash:", n)
|
||||
if DETACHED:
|
||||
print(" detached:", DETACHED)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -0,0 +1,227 @@
|
||||
#!/usr/bin/env python3
|
||||
"""真机稳定抓帧: spawn + art_callsite 补丁 + 长时 hook.
|
||||
|
||||
模拟器结论: spawn+脚本必 EGL 崩(约4s), 只能抢 stale 窗口。
|
||||
真机 M2102J2SC 实测: spawn 挂起加载 art_callsite 补丁后 12s+ 稳定存活
|
||||
(无 detached, 无 EGL 崩) —— 本脚本验证两点:
|
||||
1) 更长存活 (默认 90s), 主进程不被换/不闪退 (watch 逻辑)
|
||||
2) hook 能力真实可用: 抓 libudbauthunify.so 的 setSafeDeviceId/createWupDeviceInfo
|
||||
(32hex hdid) + SSL_write (hypasswordLogin 帧) + 内存扫描 32hex
|
||||
|
||||
用法:
|
||||
/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0/.venv/bin/python \
|
||||
scripts/phone_stable_capture.py [duration_s] [serial] [remote]
|
||||
输出:
|
||||
evidence/diag_phone/phone_stable_capture.json (事件 + 存活时间线)
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import re
|
||||
import subprocess
|
||||
import sys
|
||||
import time
|
||||
from pathlib import Path
|
||||
|
||||
import frida
|
||||
|
||||
SERIAL = sys.argv[2] if len(sys.argv) > 2 else "5dd8c93f"
|
||||
REMOTE = sys.argv[3] if len(sys.argv) > 3 else "127.0.0.1:31878"
|
||||
DURATION = float(sys.argv[1]) if len(sys.argv) > 1 and sys.argv[1].replace(".", "").isdigit() else 90.0
|
||||
PACKAGE = "com.duowan.kiwi"
|
||||
REPO = Path("/Users/yml/codes/douyu_login_py")
|
||||
OUT = REPO / "evidence" / "diag_phone" / "phone_stable_capture.json"
|
||||
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
|
||||
ART_CALLSITE = RE / "evidence" / "scripts" / "bypass_msaoaid_maps_art_callsite.js"
|
||||
|
||||
MAIN_JS = r"""
|
||||
'use strict';
|
||||
function readStdString(p){
|
||||
if (p.isNull()) return null;
|
||||
try{
|
||||
var first = p.readU8();
|
||||
if ((first & 1) === 0) {
|
||||
var len = first >> 1;
|
||||
return (len>0 && len<256) ? p.add(1).readUtf8String(len) : '';
|
||||
} else {
|
||||
var data = p.readPointer();
|
||||
var len = p.add(8).readU64();
|
||||
return (len>0 && len<1024) ? data.readUtf8String(len) : null;
|
||||
}
|
||||
}catch(e){ return null; }
|
||||
}
|
||||
function hexb(p,n){try{return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join('');}catch(e){return '';}}
|
||||
function head(p,n){try{return p.readCString(n);}catch(e){return '';}}
|
||||
function emit(tag,val){ send({type:tag, tag:tag, val:''+(val||''), ts:Date.now()}); }
|
||||
var hooked=false, scanned=false;
|
||||
|
||||
function hookUdb(){
|
||||
if (hooked) return;
|
||||
var md = Process.findModuleByName('libudbauthunify.so');
|
||||
if (!md) return;
|
||||
emit('mod-base', ''+md.base);
|
||||
try{
|
||||
Interceptor.attach(md.base.add(0x26A2E0), {
|
||||
onEnter:function(a){ this.sd=readStdString(a[1]); this.hd=readStdString(a[2]); },
|
||||
onLeave:function(){
|
||||
var hd=(this.hd||''); emit('SETSD', hd+' | sd='+(this.sd||'').slice(0,24));
|
||||
if(/^[0-9a-f]{32}$/.test(hd)) emit('FOUND_HDID_32', hd);
|
||||
}
|
||||
});
|
||||
}catch(e){ emit('hook-err','setSd '+e); }
|
||||
try{
|
||||
Interceptor.attach(md.base.add(0x2746A0), {
|
||||
onLeave:function(ret){
|
||||
try{ var s=readStdString(ret.add(152)); if(s){ emit('WUPDEV_HDID',''+s); if(/^[0-9a-f]{32}$/.test(s)) emit('FOUND_HDID_32',''+s); } }catch(e){}
|
||||
}
|
||||
});
|
||||
}catch(e){ emit('hook-err','wupdev '+e); }
|
||||
emit('ready','all hooked');
|
||||
hooked = true;
|
||||
}
|
||||
|
||||
function hookSSL(){
|
||||
try{
|
||||
var r=new ApiResolver('module');
|
||||
r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
|
||||
Interceptor.attach(m.address,{onEnter:function(a){
|
||||
var len=a[2].toInt32();
|
||||
if(len<50||len>50000)return;
|
||||
var h=head(a[1],Math.min(len,600));
|
||||
if(h.indexOf('hypasswordLogin')>=0){
|
||||
emit('WUP_LOGIN_FULL', len+'B '+hexb(a[1],len));
|
||||
}
|
||||
}});
|
||||
});
|
||||
send({type:'sslwrite-hooked', tag:'ssl'});
|
||||
}catch(e){}
|
||||
}
|
||||
|
||||
function scanMem(){
|
||||
var found = {};
|
||||
try{
|
||||
var ranges = Process.enumerateRanges({protection:'r--', coalesce:true});
|
||||
var total = ranges.length, scannedB = 0;
|
||||
ranges.forEach(function(r, ri){
|
||||
try{
|
||||
var size = r.size;
|
||||
if (size <= 0) return;
|
||||
var step = 256*1024;
|
||||
var off = 0;
|
||||
while (off < size){
|
||||
var n = Math.min(step, size - off);
|
||||
var buf = Memory.readByteArray(r.base.add(off), n);
|
||||
if (buf){
|
||||
var sbuf = new Uint8Array(buf);
|
||||
var s = '';
|
||||
for (var i=0;i<sbuf.length;i++) s += String.fromCharCode(sbuf[i]);
|
||||
var re = /[0-9a-f]{32,40}/gi;
|
||||
var m;
|
||||
while ((m = re.exec(s)) !== null){
|
||||
var v = m[0].toLowerCase();
|
||||
if (!/^[0-9a-f]{32}$/.test(v)) continue;
|
||||
found[v] = (found[v]||0) + 1;
|
||||
}
|
||||
scannedB += n;
|
||||
}
|
||||
off += step;
|
||||
}
|
||||
}catch(e){}
|
||||
});
|
||||
}catch(e){ emit('scan-err',''+e); }
|
||||
var keys = Object.keys(found);
|
||||
emit('scan-result', 'ranges='+total+' scannedB='+scannedB+' found32+='+keys.length);
|
||||
keys.sort().forEach(function(k, i){
|
||||
if (i < 60) emit('H32CAND', k+' x'+found[k]);
|
||||
});
|
||||
scanned = true;
|
||||
}
|
||||
|
||||
setInterval(hookUdb, 100);
|
||||
setInterval(hookSSL, 1000);
|
||||
var scanLaunched = false;
|
||||
setInterval(function(){
|
||||
if (!scanLaunched && hooked && !scanned){
|
||||
scanLaunched = true;
|
||||
setTimeout(scanMem, 2500);
|
||||
}
|
||||
}, 500);
|
||||
"""
|
||||
|
||||
|
||||
def adb(*a):
|
||||
return subprocess.run(["adb", "-s", SERIAL, *a], capture_output=True, text=True)
|
||||
|
||||
|
||||
def main_pid():
|
||||
r = adb("shell", "pidof", PACKAGE)
|
||||
for p in r.stdout.strip().split():
|
||||
rr = adb("shell", "cat", f"/proc/{p}/cmdline")
|
||||
if rr.stdout.strip("\x00").strip() == PACKAGE:
|
||||
return int(p)
|
||||
return None
|
||||
|
||||
|
||||
def main():
|
||||
OUT.parent.mkdir(parents=True, exist_ok=True)
|
||||
adb("shell", "am", "force-stop", PACKAGE)
|
||||
time.sleep(1.5)
|
||||
adb("shell", "logcat", "-c")
|
||||
|
||||
d = frida.get_device_manager().add_remote_device(REMOTE)
|
||||
pid = d.spawn([PACKAGE])
|
||||
print(f"[*] spawn pid={pid}", flush=True)
|
||||
session = d.attach(pid)
|
||||
det = []
|
||||
session.on("detached", lambda r, dd: det.append({"reason": r, "detail": str(dd)}) or print(f"[*] detached {r} {dd}", flush=True))
|
||||
|
||||
def load(js, name):
|
||||
s = session.create_script(js); s.load()
|
||||
print(f"[*] loaded {name}", flush=True)
|
||||
return s
|
||||
|
||||
try:
|
||||
load(ART_CALLSITE.read_text(), "art_callsite")
|
||||
except Exception as e:
|
||||
print("[*] bypass load err:", str(e)[:160], flush=True)
|
||||
d.resume(pid)
|
||||
print("[*] resumed, running", DURATION, "s", flush=True)
|
||||
|
||||
events = []
|
||||
def on_message(m, data):
|
||||
if m.get("type") == "error":
|
||||
print("[JS-ERR]", str(m)[:200], flush=True)
|
||||
return
|
||||
p = m.get("payload") or {}
|
||||
t = p.get("type")
|
||||
if t == "FOUND_HDID_32":
|
||||
print(f"\n*** FOUND_HDID_32 = {p.get('val')} ***", flush=True)
|
||||
elif t in ("mod-base", "ready", "scan-result", "sslwrite-hooked", "hook-err"):
|
||||
print(f"[{t}] {p.get('val')}", flush=True)
|
||||
elif t == "WUP_LOGIN_FULL":
|
||||
b = bytes.fromhex(p.get("val", "").split("B ")[-1]) if "B " in p.get("val", "") else b""
|
||||
h = re.search(rb"hdid.{0,100}", b)
|
||||
print(f"[WUP_LOGIN] len={p.get('val','').split('B')[0]} ctx={(h.group(0)[:110] if h else b[:60])}", flush=True)
|
||||
events.append(p)
|
||||
OUT.write_text(json.dumps({"events": events, "detached": det}, indent=1), encoding="utf-8")
|
||||
|
||||
main_sc = load(MAIN_JS, "main_hook")
|
||||
main_sc.on("message", on_message)
|
||||
|
||||
t0 = time.time()
|
||||
timeline = []
|
||||
start_pid = pid
|
||||
while time.time() - t0 < DURATION:
|
||||
cur = main_pid()
|
||||
timeline.append({"t": round(time.time() - t0, 1), "proc": cur, "pid_changed": cur != start_pid})
|
||||
if cur is None or cur != start_pid:
|
||||
print(f"[*] 主进程 pid 变化/消失: {start_pid} -> {cur}", flush=True)
|
||||
break
|
||||
time.sleep(3)
|
||||
print(f"[*] done, {len(events)} events, alive_pid={start_pid == main_pid()}", flush=True)
|
||||
OUT.write_text(json.dumps({"events": events, "timeline": timeline, "detached": det}, indent=1), encoding="utf-8")
|
||||
print(f"[*] saved {OUT}", flush=True)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user