docs(huya): 模拟器存活闪退诊断报告与 Frida 探测脚本证据

- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
2026-08-27 17:58:32 +08:00
parent 36b5d78050
commit 49c5c36c05
100 changed files with 8666 additions and 0 deletions
@@ -0,0 +1,124 @@
+#!/usr/bin/env python3
+"""attach 模式抓模拟器自生成 32hex hdid (对比真机 ed0db8...).
+
+核心: hook libudbauthunify.so:
+  - BusinessCfg::setSafeDeviceId(0x26A2E0): a1+1008=sd, a1+1088=hdid (两者都写)
+  - BusinessCfg::getHdid(0x26A484): this+1088 是 std::string 对象
+  - createWupDeviceInfo(0x2746A0): 返回结构 +152 = hdid std::string
+App 正常启动后 attach, 不做 spawn (spawn 挂起会 EGL 闪退)。
+"""
+import sys, time, json
+import frida
+
+REMOTE = "127.0.0.1:31878"
+PACKAGE = "com.duowan.kiwi"
+
+JS = r"""
+'use strict';
+function readStdString(p){
+  if (p.isNull()) return null;
+  try{
+    var first = p.readU8();
+    if ((first & 1) === 0) {
+      // short string: len = first>>1
+      var len = first >> 1;
+      return p.add(1).readUtf8String(len > 0 && len < 128 ? len : 0) || '';
+    } else {
+      var data = p.readPointer();
+      var len = p.add(8).readU64();
+      if (len > 0 && len < 512) return data.readUtf8String(len) || '';
+      return null;
+    }
+  }catch(e){ return null; }
+}
+function log(t, m){ send({t:t, m:m}); }
+
+function tryInstall(){
+  var md = Process.findModuleByName('libudbauthunify.so');
+  if (!md){ return false; }
+  log('mod', md.base.toString() + ' size=' + md.size);
+
+  // setSafeDeviceId: a2=sd, a3=hdid (std::string*)
+  Interceptor.attach(md.base.add(0x26A2E0), {
+    onEnter: function(a){
+      this.sd = readStdString(a[1]);
+      this.hd = readStdString(a[2]);
+    },
+    onLeave: function(){
+      log('setSafeDeviceId', JSON.stringify({sd: (this.sd||'').slice(0,48), hd: (this.hd||'').slice(0,48)}));
+    }
+  });
+
+  // getHdid: this+1088 = std::string
+  Interceptor.attach(md.base.add(0x26A484), {
+    onEnter: function(a){ this.thiz = a[0]; },
+    onLeave: function(){
+      try{
+        var s = readStdString(this.thiz.add(1088));
+        log('getHdid', s ? ''+s : 'EMPTY');
+      }catch(e){ log('getHdid', 'ERR ' + e); }
+    }
+  });
+
+  // createWupDeviceInfo 输出 +152 hdid
+  Interceptor.attach(md.base.add(0x2746A0), {
+    onLeave: function(ret){
+      try{
+        var s = readStdString(ret.add(152));
+        log('wupDeviceInfo.hdid', s ? ''+s : 'EMPTY');
+      }catch(e){}
+    }
+  });
+
+  log('hooked', 'all');
+  return true;
+}
+
+var installed = false;
+function poll(){
+  if (!installed){ installed = tryInstall(); }
+  if (!installed){ setTimeout(poll, 300); }
+}
+poll();
+"""
+
+def main():
+    dev = frida.get_device_manager().add_remote_device(REMOTE)
+    # 找 App 进程 attach
+    pid = None
+    for p in dev.enumerate_processes():
+        if p.name and PACKAGE in p.name:
+            pid = p.pid
+            break
+    if not pid:
+        print("App 未运行, 先启动:", PACKAGE)
+        import subprocess
+        subprocess.run(["adb", "-s", "127.0.0.1:5555", "shell",
+                        "monkey -p %s -c android.intent.category.LAUNCHER 1" % PACKAGE],
+                       capture_output=True)
+        time.sleep(12)  # 等 lib 加载
+        for p in dev.enumerate_processes():
+            if p.name and PACKAGE in p.name:
+                pid = p.pid
+                break
+    if not pid:
+        print("仍找不到进程"); return
+    print("attach pid =", pid, flush=True)
+    session = dev.attach(pid)
+
+    def on_message(msg, data):
+        if msg.get("type") == "send":
+            pl = msg["payload"]
+            print("[%s] %s" % (pl["t"], pl["m"]), flush=True)
+        elif msg.get("type") == "error":
+            print("JSErr:", str(msg)[:200], flush=True)
+
+    script = session.create_script(JS)
+    script.on("message", on_message)
+    script.load()
+    print("等待 hook 事件 (60s)...", flush=True)
+    time.sleep(60)
+    print("done", flush=True)
+
+if __name__ == "__main__":
+    main()