#!/usr/bin/env python3
"""抓模拟器自生成 32hex hdid — attach 主进程版 (PID=10200).

hook libudbauthunify.so:
  - BusinessCfg::setSafeDeviceId(0x26A2E0): a2=sd, a3=hdid
  - BusinessCfg::getHdid(0x26A484): this+1088 = std::string
  - createWupDeviceInfo(0x2746A0): 返回 +152 = hdid
"""
import time, frida

REMOTE = "127.0.0.1:31878"
PID = 10200

JS = r"""
'use strict';
function readStdString(p){
  if (p.isNull()) return null;
  try{
    var first = p.readU8();
    if ((first & 1) === 0) {
      var len = first >> 1;
      return (len>0 && len<256) ? p.add(1).readUtf8String(len) : '';
    } else {
      var data = p.readPointer();
      var len = p.add(8).readU64();
      return (len>0 && len<1024) ? data.readUtf8String(len) : null;
    }
  }catch(e){ return null; }
}
function log(t,m){ send({t:t,m:m}); }

function install(){
  var md = Process.findModuleByName('libudbauthunify.so');
  if(!md){ log('err','no module'); return; }
  log('mod','base='+md.base+' size='+md.size);

  Interceptor.attach(md.base.add(0x26A2E0), {
    onEnter:function(a){ this.sd=readStdString(a[1]); this.hd=readStdString(a[2]); },
    onLeave:function(){ log('setSafeDeviceId', JSON.stringify({sd:(this.sd||'').slice(0,48), hd:(this.hd||'').slice(0,48)})); }
  });

  Interceptor.attach(md.base.add(0x26A484), {
    onEnter:function(a){ this.thiz=a[0]; },
    onLeave:function(){
      try{
        var s=readStdString(this.thiz.add(1088));
        log('getHdid', (s!==null&&s!==undefined?'':s)||'EMPTY');
      }catch(e){ log('getHdid','ERR '+e); }
    }
  });

  Interceptor.attach(md.base.add(0x2746A0), {
    onLeave:function(ret){
      try{
        var s=readStdString(ret.add(152));
        if (s) log('wupDevInfo.hdid', ''+s);
      }catch(e){}
    }
  });

  // 也 hook libhydeviceid 数据区常见字符串? 先看 getHdid 输出
  log('hooked','all OK');
}

install();
"""

def main():
    dev = frida.get_device_manager().add_remote_device(REMOTE)
    pid = PID
    try:
        s = dev.attach(pid)
    except Exception as e:
        print("attach失败:", e); return
    print("attached", pid, flush=True)
    sc = s.create_script(JS)
    def on_msg(m,d):
        if m.get('type')=='send':
            p=m['payload']
            print("[%s] %s" % (p['t'], p['m']), flush=True)
        elif m.get('type')=='error':
            print("JSErr:", str(m)[:200], flush=True)
    sc.on('message', on_msg)
    sc.load()
    print("等待 90s ...", flush=True)
    time.sleep(90)
    print("done", flush=True)

if __name__ == "__main__":
    main()