docs(huya): 模拟器存活闪退诊断报告与 Frida 探测脚本证据

- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
2026-08-27 17:58:32 +08:00
parent 36b5d78050
commit 49c5c36c05
100 changed files with 8666 additions and 0 deletions
@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""模拟器 spawn + 真机G2-0055组合bypass(bypass_msaoaid_maps_skip_cleanup.js) 存活测试。
+对照真机50s存活结论, 应在模拟器上也长时存活。
+"""
+from pathlib import Path
+import frida, time, subprocess, json
+REMOTE="127.0.0.1:31878"; PACKAGE="com.duowan.kiwi"
+RE=Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+BYPASS="bypass_msaoaid_maps_skip_cleanup.js"
+def one_round(d,r):
+    subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE],capture_output=True)
+    time.sleep(1.2)
+    pid=d.spawn([PACKAGE])
+    s=d.attach(pid)
+    # 挂起时加载 G2-0055 组合
+    sc=s.create_script((RE/"evidence/scripts"/BYPASS).read_text())
+    def on(m,dd):
+        if m.get('type')=='send': print(f"  r{r} {m.get('payload')}",flush=True)
+        elif m.get('type')=='error': print(f"  r{r} ERR {str(m)[:100]}",flush=True)
+    sc.on('message',on); sc.load()
+    d.resume(pid)
+    print(f"r{r} spawned+bypass, resume, 观察存活...",flush=True)
+    t0=time.time(); died=None; last=True
+    while time.time()-t0<90:
+        time.sleep(3)
+        try: alive=[p for p in d.enumerate_processes() if p.pid==pid]
+        except: break
+        if not alive:
+            died=time.time()-t0
+            print(f"  r{r} DEAD at +{died:.0f}s",flush=True); break
+        last=(time.time()-t0)
+    if not died:
+        print(f"  r{r} 存活超过 90s! (仍在最后观测点 {last:.0f}s)",flush=True)
+    try: d.kill(pid)
+    except: pass
+    return died if died else 90
+def main():
+    d=frida.get_device_manager().add_remote_device(REMOTE)
+    for r in range(1,4):
+        try:
+            surv=one_round(d,r)
+            print(f"=> r{r} 存活={surv:.0f}s",flush=True)
+        except Exception as e:
+            print(f"r{r} ERR {e}",flush=True)
+        time.sleep(2)
+if __name__=="__main__": main()