#!/usr/bin/env python3
"""通用 aarch64 反汇编工具: 分析内存 dump 的 libhydeviceid.so (解密后).

用法:
  arm64_disasm.py <dump.so> <模块基址> <偏移hex> [长度字节]
例:
  反汇编 JNI_OnLoad(0x22c4c8) 前 0x300 字节:
  arm64_disasm.py evidence/diag_phone/libhydeviceid_dump.so 0x7814211000 0x22c4c8 0x300
  打印所有 BL/BLR 分支目标到模块偏移.
"""
from __future__ import annotations

import sys
from capstone import Cs, CS_ARCH_ARM64, CS_MODE_ARM


def load(fn):
    with open(fn, "rb") as f:
        return f.read()


def main():
    dump_path = sys.argv[1]
    base = int(sys.argv[2], 16)
    start_off = int(sys.argv[3], 16)   # 相对模块基址的偏移 (内存态文件里约等于文件偏移)
    length = int(sys.argv[4], 16) if len(sys.argv) > 4 else 0x200
    data = load(dump_path)
    md = Cs(CS_ARCH_ARM64, CS_MODE_ARM)
    md.detail = True
    code = data[start_off:start_off + length]
    print(f"# base=0x{base:x} start_off=0x{start_off:x} len=0x{length:x}")
    for insn in md.disasm(code, base + start_off):
        disp = ""
        if insn.mnemonic.startswith(("b.", "b ")) or insn.mnemonic in ("bl", "br", "blr", "cbz", "cbnz"):
            if insn.operands:
                disp = f"  ; -> 0x{insn.operands[0].imm:x}"
            elif insn.mnemonic == "blr":
                disp = "  ; [indirect call]"
        print(f"  0x{insn.address:x}\t{insn.mnemonic:8s} {insn.op_str}{disp}")


if __name__ == "__main__":
    main()