docs(huya): 模拟器存活闪退诊断报告与 Frida 探测脚本证据

- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
2026-08-27 17:58:32 +08:00
parent 36b5d78050
commit 49c5c36c05
100 changed files with 8666 additions and 0 deletions
@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+"""attach + 全部 bypass: 观察 attach 路径加载 bypass 后 App 是否存活。
+用于定位 attach 后反调试点。
+"""
+from __future__ import annotations
+import frida, time, subprocess
+from pathlib import Path
+
+REMOTE = "127.0.0.1:31878"
+PACKAGE = "com.duowan.kiwi"
+RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+BYPASSES = ["bypass_msaoaid_maps_art_callsite.js", "mask_frida_maps_only.js", "patch_guard_block_termination.js"]
+
+
+def main():
+    subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE], capture_output=True)
+    time.sleep(1)
+    subprocess.run(["adb","-s","127.0.0.1:5555","shell","monkey","-p",PACKAGE,"-c","android.intent.category.LAUNCHER","1"], capture_output=True)
+    print("app launched normally, waiting 8s...", flush=True)
+    time.sleep(8)
+    d = frida.get_device_manager().add_remote_device(REMOTE)
+    ps = [p for p in d.enumerate_processes() if 'kiwi' in p.name or 'duowan' in p.name]
+    if not ps:
+        print("no kiwi process", flush=True); return
+    pid = ps[0].pid
+    print("attach pid", pid, flush=True)
+    s = d.attach(pid)
+    for name in BYPASSES:
+        try:
+            sc = s.create_script((RE/"evidence/scripts"/name).read_text())
+            def on_msg(m, dd, n=name):
+                if m.get('type')=='send':
+                    print(f"[{n}] {m.get('payload')}", flush=True)
+                elif m.get('type')=='error':
+                    print(f"[{n}] ERR {str(m)[:120]}", flush=True)
+            sc.on('message', on_msg)
+            sc.load(); time.sleep(0.3)
+        except Exception as e:
+            print(f"[{name}] load ERR {e}", flush=True)
+    print("all bypass loaded. observing 30s", flush=True)
+    prev = 0
+    for t in [3, 6, 10, 15, 20, 30]:
+        time.sleep(t - prev); prev = t
+        try:
+            alive = [p for p in d.enumerate_processes() if p.pid == pid]
+        except Exception:
+            break
+        print(f"  +{t}s alive={bool(alive)}", flush=True)
+        if not alive:
+            print(f"=> DEAD at +{t}s", flush=True); break
+    try: s.detach()
+    except: pass
+
+
+if __name__ == "__main__":
+    main()