docs(huya): 模拟器存活闪退诊断报告与 Frida 探测脚本证据

- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
2026-08-27 17:58:32 +08:00
parent 36b5d78050
commit 49c5c36c05
100 changed files with 8666 additions and 0 deletions
@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+"""模拟器 spawn+立即resume 版 dfpReport 捕获。
+
+关键: spawn 后【立即】resume(App 避免 EGL 崩溃), 然后立即 attach+load 主 hook。
+dfpReport 冷启动约 1s 后自动发, attach 足够快能赶上。
+"""
+from __future__ import annotations
+import frida, time, json, re
+from pathlib import Path
+
+REMOTE = "127.0.0.1:31878"
+PACKAGE = "com.duowan.kiwi"
+OUT = Path("/Users/yml/codes/douyu_login_py/evidence/emu_spawn_dfp.json")
+
+JS = r"""
+'use strict';
+send({type:'armed'});
+function hexb(p,n){try{return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join('');}catch(e){return '';}}
+function head(p,n){try{return p.readCString(n);}catch(e){return '';}}
+var n=0;
+try{
+  var r=new ApiResolver('module');
+  r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
+    Interceptor.attach(m.address,{onEnter:function(a){
+      var len=a[2].toInt32();
+      if(len<50||len>50000)return;
+      var h=head(a[1],Math.min(len,1500));
+      if(h.indexOf('dfpReport')>=0||h.indexOf('dckey')>=0){
+        n++; send({cls:h.indexOf('dfpReport')>=0?'dfpReport':'dckey',n:n,len:len,t:Date.now(),hex:hexb(a[1],len)});
+      }
+    }});
+  });
+  send({type:'hooked'});
+}catch(e){send({type:'err',e:String(e)});}
+"""
+
+
+def main():
+    d = frida.get_device_manager().add_remote_device(REMOTE)
+    pid = d.spawn([PACKAGE])
+    print(f"[*] spawn pid={pid}", flush=True)
+    # 立即 resume (防 EGL 崩)
+    d.resume(pid)
+    time.sleep(0.4)
+    session = d.attach(pid)
+    events = []
+
+    def on_message(m, data):
+        if m.get('type') == 'error':
+            print("[JS-ERR]", str(m)[:200], flush=True); return
+        p = m.get('payload') or {}
+        t = p.get('type')
+        if t == 'armed':
+            print("[*] armed", flush=True)
+        elif t == 'hooked':
+            print("[*] SSL_write hooked", flush=True)
+        elif t == 'err':
+            print("[*] err", p.get('e'), flush=True)
+        elif 'cls' in p:
+            print(f"[{p.get('t')}] {p.get('cls')} len={p.get('len')}", flush=True)
+            events.append(p); OUT.write_text(json.dumps(events))
+
+    sc = session.create_script(JS)
+    sc.on('message', on_message)
+    sc.load()
+    print(f"[*] loaded. running (OUT={OUT})", flush=True)
+    t0 = time.time()
+    try:
+        while time.time() - t0 < 60:
+            time.sleep(4)
+    except KeyboardInterrupt:
+        pass
+    print(f"[*] done, {len(events)} dfpRevent(s)", flush=True)
+
+
+if __name__ == "__main__":
+    main()