docs(huya): 模拟器存活闪退诊断报告与 Frida 探测脚本证据

- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
2026-08-27 17:58:32 +08:00
parent 36b5d78050
commit 49c5c36c05
100 changed files with 8666 additions and 0 deletions
@@ -0,0 +1,46 @@
+"""模拟器 attach + 真机G2-0055组合bypass 存活测试. attach避开EGL崩, G2-0055过反调试."""
+from pathlib import Path
+import frida, time, subprocess
+REMOTE="127.0.0.1:31878"; PACKAGE="com.duowan.kiwi"
+RE=Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+BYPASS="bypass_msaoaid_maps_skip_cleanup.js"
+def main():
+    d=frida.get_device_manager().add_remote_device(REMOTE)
+    for r in range(1,4):
+        subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE],capture_output=True)
+        time.sleep(1)
+        subprocess.run(["adb","-s","127.0.0.1:5555","shell","monkey","-p",PACKAGE,"-c","android.intent.category.LAUNCHER","1"],capture_output=True)
+        time.sleep(7)
+        # attach
+        pid=None
+        for _ in range(10):
+            rr=subprocess.run(["adb","-s","127.0.0.1:5555","shell","pidof",PACKAGE],capture_output=True,text=True)
+            if rr.stdout.strip(): pid=int(rr.stdout.strip()); break
+            time.sleep(1)
+        if not pid: print(f"r{r} no pid"); continue
+        try:
+            s=d.attach(pid)
+        except Exception as e:
+            print(f"r{r} attach err {e}"); time.sleep(2); continue
+        # 加载 G2-0055
+        def on(m,dd):
+            if m.get('type')=='send':
+                p=m.get('payload'); 
+                if isinstance(p,dict) and p.get('event') in ('installed','predicate-branch-patched','art-callsite-patched','name-masked','fd-masked','maps-entry','art-entry','art-callsite'):
+                    print(f"  r{r} {p['event']}",flush=True)
+            elif m.get('type')=='error': print(f"  r{r} ERR {str(m)[:80]}",flush=True)
+        sc=s.create_script((RE/"evidence/scripts"/BYPASS).read_text()); sc.on('message',on); sc.load()
+        print(f"r{r} attach pid={pid} +G2-0055 loaded, 观察存活",flush=True)
+        prev=0; died=None
+        for t in [3,6,10,15,20,30,40,50,60]:
+            time.sleep(t-prev); prev=t
+            try: alive=[p for p in d.enumerate_processes() if p.pid==pid]
+            except: break
+            if not alive:
+                died=t
+                print(f"  r{r} DEAD at +{t}s",flush=True); break
+        if not died: print(f"  r{r} alive 60s!",flush=True)
+        try: s.detach()
+        except: pass
+        time.sleep(2)
+if __name__=="__main__": main()