docs(huya): 模拟器存活闪退诊断报告与 Frida 探测脚本证据

- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
2026-08-27 17:58:32 +08:00
parent 36b5d78050
commit 49c5c36c05
100 changed files with 8666 additions and 0 deletions
@@ -0,0 +1,164 @@
+#!/usr/bin/env python3
+"""模拟器 32hex hdid 抓取 v7 (严格按约定 doc)。
+
+时序(严格复刻成功案例 hook_emu_spawn_bypass.py):
+  1. spawn(挂起)
+  2. load bypass_msaoaid_maps_art_callsite.js  (挂起)
+  3. load mask_frida_maps_only.js               (挂起)
+  4. resume
+  5. sleep 11
+  6. load patch_guard_block_termination.js
+  7. load 主 hook JS: 轮询等模块 -> hook setSafeDeviceId/getHdid/createWupDeviceInfo + SSL_write
+命中即写 /tmp/emu_hdid_v7.json, 实时打印。
+"""
+import frida, time, re, subprocess, json
+from pathlib import Path
+
+REMOTE = "127.0.0.1:31878"
+PACKAGE = "com.duowan.kiwi"
+RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+OUT = Path("/tmp/emu_hdid_v7.json")
+
+MAIN_JS = r"""
+'use strict';
+function readStdString(p){
+  if (p.isNull()) return null;
+  try{
+    var first = p.readU8();
+    if ((first & 1) === 0) {
+      var len = first >> 1;
+      return (len>0 && len<256) ? p.add(1).readUtf8String(len) : '';
+    } else {
+      var data = p.readPointer();
+      var len = p.add(8).readU64();
+      return (len>0 && len<1024) ? data.readUtf8String(len) : null;
+    }
+  }catch(e){ return null; }
+}
+function hexb(p,n){try{return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join('');}catch(e){return '';}}
+function head(p,n){try{return p.readCString(n);}catch(e){return '';}}
+function emit(tag,val){ send({type:tag, tag:tag, val:''+(val||''), ts:Date.now()}); }
+var hooked=false, sslDone=false;
+
+function hookUdb(){
+  if (hooked) return;
+  var md = Process.findModuleByName('libudbauthunify.so');
+  if (!md) return;               // 未加载, 等下一轮
+  emit('mod-base', ''+md.base);
+  try{
+    Interceptor.attach(md.base.add(0x26A2E0), {
+      onEnter:function(a){ this.sd=readStdString(a[1]); this.hd=readStdString(a[2]); },
+      onLeave:function(){
+        var hd=(this.hd||''); emit('SETSD', hd+' | sd='+(this.sd||'').slice(0,24));
+        if(/^[0-9a-f]{32}$/.test(hd)) emit('FOUND_HDID_32', hd);
+      }
+    });
+  }catch(e){ emit('setSd-err',''+e); }
+  try{
+    Interceptor.attach(md.base.add(0x26A484), {
+      onEnter:function(a){ try{ this.thiz=this.context.x8; }catch(e){ this.thiz=null; } },
+      onLeave:function(){
+        if(!this.thiz) return;
+        try{
+          var s=readStdString(this.thiz.add(1088));
+          if(s){ emit('GETHDID',''+s); if(/^[0-9a-f]{32}$/.test(s)) emit('FOUND_HDID_32',''+s); }
+        }catch(e){}
+      }
+    });
+  }catch(e){ emit('getHdid-err',''+e); }
+  try{
+    Interceptor.attach(md.base.add(0x2746A0), {
+      onLeave:function(ret){
+        try{
+          var s=readStdString(ret.add(152));
+          if(s){ emit('WUPDEV_HDID',''+s); if(/^[0-9a-f]{32}$/.test(s)) emit('FOUND_HDID_32',''+s); }
+        }catch(e){ emit('wupdev-err',''+e); }
+      }
+    });
+  }catch(e){ emit('wupdev-err2',''+e); }
+  emit('ready','all hooked');
+  hooked=true;
+}
+
+function hookSSL(){
+  if (sslDone) return;
+  try{
+    var r=new ApiResolver('module');
+    r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
+      Interceptor.attach(m.address,{onEnter:function(a){
+        var len=a[2].toInt32();
+        if(len<50||len>50000)return;
+        var h=head(a[1],Math.min(len,600));
+        if(h.indexOf('hypasswordLogin')>=0||h.indexOf('huyaudbwebui')>=0){
+          emit('WUP_FRAME', len+'B '+h.slice(0,80));
+        }
+      }});
+    });
+    send({type:'sslwrite-hooked', tag:'ssl'});
+  }catch(e){}
+  sslDone=true;
+}
+
+setInterval(function(){ hookUdb(); }, 300);
+setInterval(function(){ hookSSL(); }, 1000);
+"""
+
+def load(session, js, wait=0.2):
+    try:
+        s = session.create_script(js); s.load(); return s
+    except Exception as e:
+        print("[load-err]", str(e)[:160], flush=True)
+        return None
+
+def main():
+    subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE],
+                   capture_output=True)
+    time.sleep(1.5)
+    d = frida.get_device_manager().add_remote_device(REMOTE)
+    pid = d.spawn([PACKAGE])
+    print(f"[*] spawn pid={pid}", flush=True)
+    session = d.attach(pid)
+
+    # 挂起阶段: 只加载两个 bypass (复刻成功案例)
+    load(session, (RE/"evidence/scripts/bypass_msaoaid_maps_skip_cleanup.js").read_text())
+    print("[*] bypass_msaoaid loaded", flush=True)
+    load(session, (RE/"evidence/scripts/mask_frida_maps_only.js").read_text())
+    print("[*] mask_frida loaded", flush=True)
+
+    d.resume(pid)
+    print("[*] resumed", flush=True)
+    # 立即加载 patch_guard (不 sleep 11! bash-118 成功案例 resume 后立即加载, sleep 期间 App 被杀)
+    load(session, (RE/"evidence/scripts/patch_guard_block_termination.js").read_text(), wait=0.1)
+    print("[*] patch_guard loaded", flush=True)
+
+    events = []
+    def on_message(m, data):
+        if m.get('type') == 'error':
+            print("[JS-ERR]", str(m)[:200], flush=True); return
+        p = m.get('payload') or {}
+        t = p.get('type')
+        if t in ('SETSD','GETHDID','WUPDEV_HDID','FOUND_HDID_32','mod-base','ready',
+                 'setSd-err','getHdid-err','wupdev-err','wupdev-err2'):
+            print(f"[{t}] {p.get('val')}", flush=True)
+            events.append(p); OUT.write_text(json.dumps(events, indent=1))
+        elif t == 'WUP_FRAME':
+            print(f"[WUP_FRAME] {p.get('val')}", flush=True)
+            events.append(p); OUT.write_text(json.dumps(events, indent=1))
+        elif t == 'sslwrite-hooked':
+            print("[*] SSL_write hooked", flush=True)
+
+    main_sc = load(session, MAIN_JS)
+    if main_sc:
+        main_sc.on('message', on_message)
+
+    print("[*] running 150s", flush=True)
+    t0 = time.time()
+    while time.time() - t0 < 150:
+        time.sleep(3)
+        if any(e.get('tag') in ('FOUND_HDID_32','SETSD','GETHDID','WUPDEV_HDID') for e in events):
+            print("[*] 命中 hdid, 提前停止", flush=True)
+            break
+    print(f"[*] done, {len(events)} events", flush=True)
+
+if __name__ == "__main__":
+    main()