#!/usr/bin/env python3
"""attach + 全部 bypass: 观察 attach 路径加载 bypass 后 App 是否存活。
用于定位 attach 后反调试点。
"""
from __future__ import annotations
import frida, time, subprocess
from pathlib import Path

REMOTE = "127.0.0.1:31878"
PACKAGE = "com.duowan.kiwi"
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
BYPASSES = ["bypass_msaoaid_maps_art_callsite.js", "mask_frida_maps_only.js", "patch_guard_block_termination.js"]


def main():
    subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE], capture_output=True)
    time.sleep(1)
    subprocess.run(["adb","-s","127.0.0.1:5555","shell","monkey","-p",PACKAGE,"-c","android.intent.category.LAUNCHER","1"], capture_output=True)
    print("app launched normally, waiting 8s...", flush=True)
    time.sleep(8)
    d = frida.get_device_manager().add_remote_device(REMOTE)
    ps = [p for p in d.enumerate_processes() if 'kiwi' in p.name or 'duowan' in p.name]
    if not ps:
        print("no kiwi process", flush=True); return
    pid = ps[0].pid
    print("attach pid", pid, flush=True)
    s = d.attach(pid)
    for name in BYPASSES:
        try:
            sc = s.create_script((RE/"evidence/scripts"/name).read_text())
            def on_msg(m, dd, n=name):
                if m.get('type')=='send':
                    print(f"[{n}] {m.get('payload')}", flush=True)
                elif m.get('type')=='error':
                    print(f"[{n}] ERR {str(m)[:120]}", flush=True)
            sc.on('message', on_msg)
            sc.load(); time.sleep(0.3)
        except Exception as e:
            print(f"[{name}] load ERR {e}", flush=True)
    print("all bypass loaded. observing 30s", flush=True)
    prev = 0
    for t in [3, 6, 10, 15, 20, 30]:
        time.sleep(t - prev); prev = t
        try:
            alive = [p for p in d.enumerate_processes() if p.pid == pid]
        except Exception:
            break
        print(f"  +{t}s alive={bool(alive)}", flush=True)
        if not alive:
            print(f"=> DEAD at +{t}s", flush=True); break
    try: s.detach()
    except: pass


if __name__ == "__main__":
    main()