#!/usr/bin/env python3
"""完整导出 libhydeviceid.so .data 段解密后的全部字符串(不截断)。

.resume 后 .data 已被 datadiv 就地解密为明文。dump 全部字节 + 全部
字符串(带偏移)到 JSON, 供离线分析 XXTEA key / 魔数 / t1 来源。
"""
from __future__ import annotations

import json
import time
from pathlib import Path

import frida

RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_datadiv_full.json")

JS = r"""
'use strict';
Process.setExceptionHandler(function(d){ return true; });
send({type:'armed'});

var RANGES = [
  [0x36aec0, 0x6e75],   // .rodata
  [0x3b2460, 0x74d8],   // .data.rel.ro
  [0x3bb000, 0x2fc08],  // .data
];

function dumpSec(m, off, size){
  try{
    var base = m.base.add(off);
    var raw = base.readByteArray(size);
    var bytes = Array.from(new Uint8Array(raw));
    var strs = [];
    var cur = '';
    var curOff = 0;
    for (var i = 0; i < bytes.length; i++) {
      var c = bytes[i];
      if (c >= 32 && c < 127) { if (!cur) curOff = i; cur += String.fromCharCode(c); }
      else {
        if (cur.length >= 4) strs.push([off + curOff, cur]);
        cur = '';
      }
    }
    if (cur.length >= 4) strs.push([off + curOff, cur]);
    return {sec: off.toString(16), size: size, n: strs.length, strs: strs};
  }catch(e){ return {sec: off.toString(16), err: String(e)}; }
}

var tries = 0;
var iv = setInterval(function(){
  tries += 1;
  var m = null;
  try{ m = Process.getModuleByName('libhydeviceid.so'); }catch(e){}
  if (m) {
    clearInterval(iv);
    var out = [];
    RANGES.forEach(function(r){ out.push(dumpSec(m, r[0], r[1])); });
    send({type:'all', ranges: out});
  } else if (tries > 100) { clearInterval(iv); send({type:'no_mod'}); }
}, 50);
"""


def main():
    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
    pid = device.spawn(["com.duowan.kiwi"])
    print(f"[*] spawned pid={pid}", flush=True)
    session = device.attach(pid)

    def on_message(message, data):
        if message.get("type") == "error":
            print("[JS-ERR]", str(message)[:200], flush=True); return
        if message.get("type") != "send":
            return
        p = message.get("payload") or {}
        t = p.get("type")
        if t == "all":
            total = sum(r.get('n', 0) for r in p.get('ranges', []))
            print(f"[*] 完成, 共 {total} 条字符串 -> {OUT}", flush=True)
            OUT.write_text(json.dumps(p.get('ranges'), ensure_ascii=False))
        elif t == "no_mod":
            print("[*] 模块未加载", flush=True)

    script = session.create_script(JS)
    script.on("message", on_message)
    script.load()
    print("[*] 主JS 已装载(resume前), 加载 bypass + resume", flush=True)
    session.create_script(
        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
    ).load()
    session.create_script(
        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
    ).load()
    device.resume(pid)
    time.sleep(11)
    session.create_script(
        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
    ).load()
    time.sleep(5)
    print("[*] dump 完成, 结束", flush=True)


if __name__ == "__main__":
    main()