#!/usr/bin/env python3
"""干净验证: 模拟器 spawn + 挂起加载 bypass → resume → 确认存活并抓到 dfpReport。
打印每个 bypass 脚本的 event, 确认安装成功。
"""
from __future__ import annotations
import frida, time, json, subprocess
from pathlib import Path

REMOTE = "127.0.0.1:31878"
PACKAGE = "com.duowan.kiwi"
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/emu_clean_verify.json")

MAIN_JS = """
'use strict';
send({type:'armed'});
function hexb(p,n){try{return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join('');}catch(e){return '';}}
function head(p,n){try{return p.readCString(n);}catch(e){return '';}}
try{
  var r=new ApiResolver('module');
  r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
    Interceptor.attach(m.address,{onEnter:function(a){
      var len=a[2].toInt32();
      if(len<50||len>50000)return;
      var h=head(a[1],Math.min(len,1500));
      if(h.indexOf('dfpReport')>=0||h.indexOf('dckey')>=0){
        send({cls:h.indexOf('dfpReport')>=0?'dfpReport':'dckey',len:len,hex:hexb(a[1],len)});
      }
    }});
  });
  send({type:'hooked'});
}catch(e){send({type:'err',e:String(e)});}
"""


def bypass_events(session, js_path, label):
    """加载 bypass 并捕获其 send(event) 消息, 返回是否成功安装."""
    events = []

    def on_msg(m, d):
        if m.get('type') == 'send':
            events.append(m.get('payload'))
        elif m.get('type') == 'error':
            events.append({'scripterr': str(m)[:120]})

    try:
        sc = session.create_script(js_path.read_text())
        sc.on('message', on_msg)
        sc.load()
        time.sleep(0.15)
        print(f"  [{label}] events: {events}", flush=True)
        return events
    except Exception as e:
        print(f"  [{label}] load ERR: {e}", flush=True)
        return [{'loaderr': str(e)[:120]}]


def main():
    subprocess.run(["adb", "-s", "127.0.0.1:5555", "shell", "am", "force-stop", PACKAGE], capture_output=True)
    time.sleep(1.5)
    d = frida.get_device_manager().add_remote_device(REMOTE)
    pid = d.spawn([PACKAGE])
    print(f"[*] spawned pid={pid}", flush=True)
    session = d.attach(pid)
    print("[*] suspended, loading bypass (fast)...", flush=True)

    e1 = bypass_events(session, RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js", "bypass_msaoaid")
    e2 = bypass_events(session, RE / "evidence/scripts/mask_frida_maps_only.js", "mask_frida")

    print("[*] resuming...", flush=True)
    d.resume(pid)
    ok = []

    # patch_guard 在 resume 后加载
    e3 = bypass_events(session, RE / "evidence/scripts/patch_guard_block_termination.js", "patch_guard")

    # 主 hook
    events = []
    def on_main(m, dta):
        if m.get('type') == 'error':
            print("[JS-ERR]", str(m)[:120], flush=True); return
        p = m.get('payload') or {}
        t = p.get('type')
        if t == 'armed': print("[*] armed", flush=True)
        elif t == 'hooked': print("[*] SSL_write hooked", flush=True)
        elif 'cls' in p:
            print(f"[*] {p['cls']} len={p['len']}", flush=True)
            events.append(p); OUT.write_text(json.dumps(events))
    sc = session.create_script(MAIN_JS)
    sc.on('message', on_main)
    sc.load()

    # 观察 25s: 存活 + 是否有 dfpReport
    for t in [2, 4, 6, 8, 10, 15, 20, 25]:
        time.sleep(t if t == 2 else t - prev)
        prev = t
        alive = [p for p in d.enumerate_processes() if p.pid == pid]
        print(f"  +{t}s alive={bool(alive)}", flush=True)
        if not alive:
            print("[*] *** App DEAD at +%ds ***" % t, flush=True); break
    print(f"[*] final alive check: {bool([p for p in d.enumerate_processes() if p.pid==pid])}", flush=True)
    print(f"[*] dfpReport captured: {len([e for e in events if e.get('cls')=='dfpReport'])}", flush=True)
    try: d.kill(pid)
    except: pass


if __name__ == "__main__":
    main()