docs(huya): 模拟器存活闪退诊断报告与 Frida 探测脚本证据

- 诊断报告: attach 主进程静默退出/EGL 崩溃, 仅约 4s 窗口可抓帧
- scripts: attach/spawn/hook/emu 系列 Frida 脚本与抓帧/验证工具
- evidence: identity/reqchain/frame/inputbuf/magic_buf/propedge 抓取样本,
  emu_* 存活对比, diag_* 策略实验, baseline 裸测基准

scripts/watch_proc_v2.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""可靠主进程监控 v2: 主进程 = cmdline 精确等于包名 (排除 :sub 子进程).
+
+事实来源: adb /proc/<pid>/cmdline + pidof. 绝不使用 frida enumerate 判断存活.
+用法: python3 watch_proc_v2.py <seconds> [label]
+"""
+import subprocess, sys, time
+
+ADB = ["adb", "-s", "127.0.0.1:5555"]
+PACKAGE = "com.duowan.kiwi"
+
+def adb(*a):
+    return subprocess.run(ADB + list(a), capture_output=True, text=True)
+
+def main_pid():
+    """返回主进程 pid (cmdline==PACKAGE), 无则 None."""
+    r = adb("shell", "pidof", PACKAGE)
+    pids = r.stdout.strip().split()
+    for p in pids:
+        r2 = adb("shell", "cat", f"/proc/{p}/cmdline")
+        cmd = r2.stdout.strip("\x00").strip()
+        if cmd == PACKAGE:
+            return int(p)
+    return None
+
+def main():
+    seconds = int(sys.argv[1]) if len(sys.argv) > 1 else 60
+    label = sys.argv[2] if len(sys.argv) > 2 else ""
+    t0 = time.time()
+    last_alive = 0.0
+    died_at = None
+    pid_history = {}
+    print(f"[watch:{label}] {seconds}s 起点 main_pid={main_pid()}", flush=True)
+    while time.time() - t0 < seconds:
+        p = main_pid()
+        now = time.time() - t0
+        if p is not None:
+            pid_history.setdefault(p, now)
+            last_alive = now
+            died_at = None
+        elif died_at is None:
+            died_at = now
+            print(f"  +{now:5.1f}s DEAD (main) [存活到 +{last_alive:.1f}s]", flush=True)
+        time.sleep(1.5)
+    dur = time.time() - t0
+    p = main_pid()
+    print(f"[watch:{label}] END: alive={p is not None} pid={p} 最后存活时间=+{last_alive:.1f}s "
+          f"死亡时刻={round(died_at,1) if died_at else '未死'} pids_seen={list(pid_history.keys())} 总={dur:.1f}s", flush=True)
+
+if __name__ == "__main__":
+    main()