docs(huya): 模拟器存活闪退诊断报告与 Frida 探测脚本证据

- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧 - scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具 - evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本, emu_* 存活对比, diag_* 策略实验, baseline 裸测基准
2026-08-27 17:58:32 +08:00
parent 36b5d78050
commit 49c5c36c05
100 changed files with 8666 additions and 0 deletions
@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+"""spawn + 快速加载 bypass → resume 的【存活时长】多轮测试。
+
+验证: spawn 路径带 bypass 后 App 能活多久, 是否每个 spawn 都稳定抓到 dfpReport。
+流程每轮:
+  force-stop → spawn → attach → 挂起内快速加载 bypass_msaoaid + mask_frida
+  → resume → 加载 patch_guard + 主hook(SSL_write抓dfp)
+  → 持续观察存活, 记录死亡时间 或 抓满 N 秒
+统计多轮: 平均存活时长, dfpReport 捕获成功率, actionV。
+"""
+from __future__ import annotations
+import frida, time, subprocess, json, re
+from pathlib import Path
+
+REMOTE = "127.0.0.1:31878"
+PACKAGE = "com.duowan.kiwi"
+RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+OUT = Path("/Users/yml/codes/douyu_login_py/evidence/spawn_survival.json")
+
+MAIN_JS = """
+'use strict';
+send({type:'armed'});
+function hexb(p,n){try{return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join('');}catch(e){return '';}}
+function head(p,n){try{return p.readCString(n);}catch(e){return '';}}
+try{
+  var r=new ApiResolver('module');
+  r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
+    Interceptor.attach(m.address,{onEnter:function(a){
+      var len=a[2].toInt32();
+      if(len<50||len>50000)return;
+      var h=head(a[1],Math.min(len,1500));
+      if(h.indexOf('dfpReport')>=0||h.indexOf('dckey')>=0){
+        send({cls:h.indexOf('dfpReport')>=0?'dfpReport':'dckey',len:len,t:Date.now()});
+      }
+    }});
+  });
+  send({type:'hooked'});
+}catch(e){send({type:'err',e:String(e)});}
+"""
+
+ROUNDS = 4
+MAX_SURVIVE = 120  # 每轮最多观察秒数
+
+
+def one_round(d, r):
+    subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE], capture_output=True)
+    time.sleep(1.2)
+    pid = d.spawn([PACKAGE])
+    s = d.attach(pid)
+    # 挂起快速加载 2 bypass
+    for name in ["bypass_msaoaid_maps_art_callsite.js", "mask_frida_maps_only.js"]:
+        try:
+            sc = s.create_script((RE/"evidence/scripts"/name).read_text()); sc.load()
+        except Exception as e:
+            print(f"  r{r} bp {name} err {e}", flush=True)
+    d.resume(pid)
+    dfp = []
+    def on_main(m, dd):
+        if m.get('type') == 'error': return
+        p = m.get('payload') or {}
+        if p.get('type') == 'hooked':
+            print(f"  r{r} hook installed", flush=True)
+        elif 'cls' in p:
+            print(f"  r{r} {p['cls']} len={p['len']}", flush=True)
+            dfp.append(p)
+    # patch_guard + 主 hook
+    try:
+        sg = s.create_script((RE/"evidence/scripts/patch_guard_block_termination.js").read_text()); sg.load()
+    except Exception as e:
+        print(f"  r{r} guard err {e}", flush=True)
+    sc = s.create_script(MAIN_JS)
+    sc.on('message', on_main)
+    sc.load()
+    # 观察存活
+    t0 = time.time()
+    died_at = None
+    last_alive = True
+    while time.time() - t0 < MAX_SURVIVE:
+        time.sleep(3)
+        try:
+            alive = [p for p in d.enumerate_processes() if p.pid == pid]
+        except Exception:
+            break
+        if not alive:
+            died_at = time.time() - t0
+            break
+    survival = died_at if died_at else MAX_SURVIVE
+    got_dfp = any(e.get('cls')=='dfpReport' for e in dfp)
+    res = {"round": r, "survival_s": round(survival), "dfp_count": len([e for e in dfp if e.get('cls')=='dfpReport']), "got_dfp": got_dfp, "died": died_at is not None}
+    print(f"=> r{r}: 存活={survival:.0f}s dfpReport={res['dfp_count']} {'DIED' if died_at else 'alive'} ", flush=True)
+    try: d.kill(pid)
+    except: pass
+    return res
+
+
+def main():
+    d = frida.get_device_manager().add_remote_device(REMOTE)
+    all_res = []
+    for r in range(1, ROUNDS+1):
+        try:
+            all_res.append(one_round(d, r))
+        except Exception as e:
+            print(f"r{r} ERROR {e}", flush=True)
+            all_res.append({"round": r, "error": str(e)})
+        time.sleep(2)
+    print("\n=== 汇总 ===", flush=True)
+    sur = [x.get('survival_s') for x in all_res if 'survival_s' in x]
+    dfp = [x for x in all_res if x.get('got_dfp')]
+    print(f"存活时长: {sur}", flush=True)
+    print(f"dfpReport 捕获成功率: {len(dfp)}/{ROUNDS}", flush=True)
+    json.dump(all_res, open(OUT, 'w'), indent=2)
+    print(f"saved {OUT}", flush=True)
+
+
+if __name__ == "__main__":
+    main()