docs(huya): 模拟器存活闪退诊断报告与 Frida 探测脚本证据

- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
2026-08-27 17:58:32 +08:00
parent 36b5d78050
commit 49c5c36c05
100 changed files with 8666 additions and 0 deletions
@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""抓模拟器自生成 32hex hdid — attach 主进程版 (PID=10200).
+
+hook libudbauthunify.so:
+  - BusinessCfg::setSafeDeviceId(0x26A2E0): a2=sd, a3=hdid
+  - BusinessCfg::getHdid(0x26A484): this+1088 = std::string
+  - createWupDeviceInfo(0x2746A0): 返回 +152 = hdid
+"""
+import time, frida
+
+REMOTE = "127.0.0.1:31878"
+PID = 10200
+
+JS = r"""
+'use strict';
+function readStdString(p){
+  if (p.isNull()) return null;
+  try{
+    var first = p.readU8();
+    if ((first & 1) === 0) {
+      var len = first >> 1;
+      return (len>0 && len<256) ? p.add(1).readUtf8String(len) : '';
+    } else {
+      var data = p.readPointer();
+      var len = p.add(8).readU64();
+      return (len>0 && len<1024) ? data.readUtf8String(len) : null;
+    }
+  }catch(e){ return null; }
+}
+function log(t,m){ send({t:t,m:m}); }
+
+function install(){
+  var md = Process.findModuleByName('libudbauthunify.so');
+  if(!md){ log('err','no module'); return; }
+  log('mod','base='+md.base+' size='+md.size);
+
+  Interceptor.attach(md.base.add(0x26A2E0), {
+    onEnter:function(a){ this.sd=readStdString(a[1]); this.hd=readStdString(a[2]); },
+    onLeave:function(){ log('setSafeDeviceId', JSON.stringify({sd:(this.sd||'').slice(0,48), hd:(this.hd||'').slice(0,48)})); }
+  });
+
+  Interceptor.attach(md.base.add(0x26A484), {
+    onEnter:function(a){ this.thiz=a[0]; },
+    onLeave:function(){
+      try{
+        var s=readStdString(this.thiz.add(1088));
+        log('getHdid', (s!==null&&s!==undefined?'':s)||'EMPTY');
+      }catch(e){ log('getHdid','ERR '+e); }
+    }
+  });
+
+  Interceptor.attach(md.base.add(0x2746A0), {
+    onLeave:function(ret){
+      try{
+        var s=readStdString(ret.add(152));
+        if (s) log('wupDevInfo.hdid', ''+s);
+      }catch(e){}
+    }
+  });
+
+  // 也 hook libhydeviceid 数据区常见字符串? 先看 getHdid 输出
+  log('hooked','all OK');
+}
+
+install();
+"""
+
+def main():
+    dev = frida.get_device_manager().add_remote_device(REMOTE)
+    pid = PID
+    try:
+        s = dev.attach(pid)
+    except Exception as e:
+        print("attach失败:", e); return
+    print("attached", pid, flush=True)
+    sc = s.create_script(JS)
+    def on_msg(m,d):
+        if m.get('type')=='send':
+            p=m['payload']
+            print("[%s] %s" % (p['t'], p['m']), flush=True)
+        elif m.get('type')=='error':
+            print("JSErr:", str(m)[:200], flush=True)
+    sc.on('message', on_msg)
+    sc.load()
+    print("等待 90s ...", flush=True)
+    time.sleep(90)
+    print("done", flush=True)
+
+if __name__ == "__main__":
+    main()