docs(huya): 模拟器存活闪退诊断报告与 Frida 探测脚本证据

- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
2026-08-27 17:58:32 +08:00
parent 36b5d78050
commit 49c5c36c05
100 changed files with 8666 additions and 0 deletions
@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+"""attach 模式抓模拟器 32hex hdid v4: hook createWupDeviceInfo(ret+152=hdid).
+
+直接 attach 正在运行的主进程(不 spawn, 无 EGL 崩溃风险)。
+createWupDeviceInfo 每次 udb 上报/wup 打包都调用 → 上报即触发, 无需登录UI。
+"""
+import frida, time, re, json, sys
+REMOTE = "127.0.0.1:31878"
+OUT = Path_ = "/tmp/emu_hdid_v4.json"
+
+JS = r"""
+'use strict';
+function readStdString(p){
+  if (p.isNull()) return null;
+  try{
+    var first = p.readU8();
+    if ((first & 1) === 0) {
+      var len = first >> 1;
+      return (len>0 && len<256) ? p.add(1).readUtf8String(len) : '';
+    } else {
+      var data = p.readPointer();
+      var len = p.add(8).readU64();
+      return (len>0 && len<1024) ? data.readUtf8String(len) : null;
+    }
+  }catch(e){ return null; }
+}
+function emit(tag, val){ send({type:'hdid', tag:tag, val:''+(val||''), ts:Date.now()}); }
+
+function install(){
+  var md = Process.findModuleByName('libudbauthunify.so');
+  if (!md){ emit('state','NO_MOD'); return; }
+  emit('state','mod='+md.base);
+
+  try{
+    Interceptor.attach(md.base.add(0x2746A0), {
+      onEnter:function(){ emit('tick','createWupDeviceInfo #' + (++window.__n||(window.__n=1))); },
+      onLeave:function(ret){
+        try{
+          var s = readStdString(ret.add(152));
+          emit('WUPDEV_HDID', ''+s);
+        }catch(e){ emit('WUPDEV_ERR', ''+e); }
+      }
+    });
+    emit('state','createWupDev hooked');
+  }catch(e){ emit('state','createWupDev ERR '+e); }
+
+  try{
+    Interceptor.attach(md.base.add(0x26A2E0), {
+      onEnter:function(a){ this.sd=readStdString(a[1]); this.hd=readStdString(a[2]); },
+      onLeave:function(){ emit('SETSD', (this.hd||'')+' | sd='+(this.sd||'').slice(0,24)); }
+    });
+  }catch(e){}
+
+  try{
+    Interceptor.attach(md.base.add(0x26A484), {
+      onEnter:function(a){ try{ this.thiz=this.context.x8; }catch(e){ this.thiz=null; } },
+      onLeave:function(){
+        if(!this.thiz) return;
+        try{ var s=readStdString(this.thiz.add(1088)); if(s) emit('GETHDID',''+s); }catch(e){}
+      }
+    });
+  }catch(e){}
+
+  emit('state','all hooked, waiting events');
+}
+install();
+"""
+
+def main():
+    dev = frida.get_device_manager().add_remote_device(REMOTE)
+    pid = None
+    for p in dev.enumerate_processes():
+        if p.name and p.name == 'com.duowan.kiwi':
+            pid = p.pid; break
+    if not pid:
+        print("找不到主进程"); return
+    print("attach pid =", pid, flush=True)
+    s = dev.attach(pid)
+    events = []
+    def on_msg(m, d):
+        if m.get('type') == 'send':
+            p = m['payload']
+            print(f"[{p.get('tag')}] {p.get('val')}", flush=True)
+            events.append(p); open(OUT,'w').write(json.dumps(events, indent=1))
+        elif m.get('type') == 'error':
+            print("JSErr:", str(m)[:150], flush=True)
+    sc = s.create_script(JS)
+    sc.on('message', on_msg)
+    sc.load()
+    print("运行 100s (App 上报会自动触发 createWupDeviceInfo)...", flush=True)
+    time.sleep(100)
+    print("done,", len(events), "events", flush=True)
+
+if __name__ == "__main__":
+    main()