#!/usr/bin/env python3
"""捕获 (明文JSON, 密文) 配对: 解 dfpReport 流式 keystream。

同时:
1. hook SSL_write 抓 dfpReport 密文 (魔数开头 3984B)
2. 扫描内存找明文 JSON ({"appId":"5008"...), dump 前 512 + 后 6000
命中配对后立即 pkill。
"""
from __future__ import annotations

import json
import time
from pathlib import Path

import frida

RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_pair.json")

JS = r"""
'use strict';
Process.setExceptionHandler(function(d){ return true; });
send({type:'armed'});

var captured = {wire: null, plain: null};

// ---- 1. SSL_write 抓密文 ----
try{
  var fns = [];
  var r = new ApiResolver('module');
  fns = r.enumerateMatchesSync('exports:*!SSL_write').map(function(x){ return x.address; });
  fns.slice(0, 6).forEach(function(p){
    Interceptor.attach(p, {
      onEnter: function(a){
        var len = a[2].toInt32();
        if (len < 100 || len > 20000) return;
        var head = '';
        try{ head = a[1].readCString(Math.min(len, 2000)); }catch(e){ return; }
        if (head.indexOf('dfpReport') < 0) return;
        var arr = new Uint8Array(a[1].readByteArray(len));
        var hex = '';
        for (var j = 0; j < arr.length; j++) hex += ('0'+arr[j].toString(16)).slice(-2);
        captured.wire = {len: len, hex: hex};
        send({type:'wire_cap', len: len});
        trySend();
      }
    });
  });
}catch(e){}

// ---- 2. 扫描明文 JSON ----
function scanPlain(){
  try{
    var r2 = new ApiResolver('module');
    Process.enumerateRanges('r--').forEach(function(rng){
      if (rng.size > 1024*1024*256) return;
      try{
        var hits = Memory.scanSync(rng.base, rng.size, '7b 22 61 70 70 49 64 22 3a 22 35 30 30 38');
        hits.slice(0, 3).forEach(function(x){
          var post = '';
          try{
            var arr = new Uint8Array(x.address.readByteArray(4096));
            post = Array.from(arr).map(function(b){return ('0'+b.toString(16)).slice(-2);}).join('');
          }catch(e){ return; }
          captured.plain = {addr: String(x.address), hex: post};
          send({type:'plain_cap', addr: String(x.address)});
          trySend();
        });
      }catch(e){}
    });
  }catch(e){}
}

function trySend(){
  if (captured.wire && captured.plain) {
    var out = {wire: captured.wire, plain: captured.plain};
    send({type:'PAIR', data: out});
  }
}

setInterval(function(){ try{ scanPlain(); }catch(e){} }, 3000);
"""


def main():
    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
    pid = device.spawn(["com.duowan.kiwi"])
    print(f"[*] spawned pid={pid}", flush=True)
    session = device.attach(pid)

    def on_message(message, data):
        if message.get("type") == "error":
            print("[JS-ERR]", str(message)[:200], flush=True); return
        if message.get("type") != "send":
            return
        p = message.get("payload") or {}
        t = p.get("type")
        if t == "wire_cap":
            print(f"[wire] 密文捕获 len={p.get('len')}", flush=True)
        elif t == "plain_cap":
            print(f"[plain] 明文JSON @{p.get('addr')}", flush=True)
        elif t == "PAIR":
            OUT.write_text(json.dumps(p.get('data')))
            print(f"[PAIR] 保存 -> {OUT}", flush=True)

    script = session.create_script(JS)
    script.on("message", on_message)
    script.load()
    print("[*] 主JS 已装载(resume前), 加载 bypass + resume", flush=True)
    session.create_script(
        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
    ).load()
    session.create_script(
        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
    ).load()
    device.resume(pid)
    time.sleep(11)
    session.create_script(
        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
    ).load()
    print("[*] 已 resume, 请触发登录, PAIR 出现即 pkill", flush=True)
    try:
        while True:
            time.sleep(5)
    except KeyboardInterrupt:
        pass


if __name__ == "__main__":
    main()