#!/usr/bin/env python3
"""信封规则测定 v2 —— 单次新鲜信封, 紧凑窗口内连续对照。

流程: 设备hook刷新信封(~60s) -> 立刻登录两账号取cred -> 窗口内连续4次bind:
  X0 对照:    原uid + 信封原nonce+可信cred铸证   (期望✅)
  X1 错配:    原uid(t3不动) + 新账号cred铸证     (测 t3与cert内cred的交叉校验)
  X2 换账号:  t3补丁成新uid + 新账号cred铸证     (零设备关键判定)
  X3 改session: 三处session一致随机化 + 可信cred (测session是否校验)

铸造铁律(probe_forge_cert_bind已证): 服务端校验证书内nonce字段内容,
纯随机nonce必40020 => 必须【复用信封原证书的rnd/指纹/key_idx】, 仅替换cred。
"""
from __future__ import annotations

import base64
import json
import random
import re
import struct
import subprocess
import sys
import time
from pathlib import Path

ROOT = Path(__file__).resolve().parent.parent
sys.path.insert(0, str(ROOT))
sys.path.insert(0, str(ROOT / "tools"))
sys.path.insert(0, str(ROOT / "scripts"))

from app_login_flow import wup_password_login_raw, parse_cred  # noqa: E402
from cert_forge import build_p1, decrypt_cert, forge_cert, parse_p1  # noqa: E402
from envelope_forge import Envelope  # noqa: E402
from probe_huya_qr_bind import QrRole, web_behavior  # noqa: E402
from core.huya.device_fingerprint import get_huya_sdid  # noqa: E402

TRUSTED = ("hy_300023887", "aa778899")
NEWACCT = ("hy_300024708", "aa778899")
KEYCAP = ROOT / "evidence/cert_keycap.json"


def env_forge(env: Envelope, cred: bytes) -> bytes:
    """复用信封原证书的 rnd/指纹/key_idx, 仅替换 cred 字段重铸。"""
    orig = base64.b64decode(env.cert_b64)
    f = parse_p1(decrypt_cert(orig))
    return forge_cert(build_p1(f["app_id"], f["fingerprint"], cred, rnd=f["rnd"]),
                      key_idx=orig[1])


def login_uid_cred(account: str, password: str) -> tuple[int, bytes]:
    resp = wup_password_login_raw(account, password)
    s = resp.find(b"\x0a\x0a", 0x40)
    e = resp.find(b"_wup_header")
    body = resp[s:e]
    uid = struct.unpack_from(">Q", body, 235)[0]
    cred = parse_cred(resp)
    assert cred, "无cred"
    return uid, cred


def refresh_envelope_from_device(max_age: float = 600.0) -> None:
    """信封够新鲜(<max_age秒, 实测TTL约15~20分钟)直接用; 否则后台hook重抓。"""
    age = time.time() - KEYCAP.stat().st_mtime
    if age < max_age:
        print(f"[hook] 信封仅{age:.0f}s新, 跳过设备采集")
        return
    mtime0 = KEYCAP.stat().st_mtime
    py = Path.home() / "codes/Reverse-Engineering-Agent-Universal-v3.0/.venv/bin/python"
    proc = subprocess.Popen(
        [str(py), str(ROOT / "scripts/hook_cert_keycap.py")],
        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    while time.time() - mtime0 < 120 and KEYCAP.stat().st_mtime == mtime0:
        time.sleep(1)
    if KEYCAP.stat().st_mtime == mtime0:
        proc.kill()
        raise RuntimeError("120s 未等到信封更新")
    time.sleep(1)  # 等文件写完整
    print(f"[hook] 信封已刷新 (+{time.time()-mtime0:.0f}s)")


def try_bind(wup_b64: str, name: str) -> dict | None:
    from urllib.parse import quote
    sdid = get_huya_sdid(allow_fallback=False).sdid
    pc = QrRole(pc=True, sdid=sdid)
    ph = QrRole(pc=False, sdid=sdid)
    beh, page = web_behavior()
    resp = pc.call("/qrLgn/getQrId", "70001",
                   {"behavior": beh, "type": "", "domainList": "", "page": page})
    qrid = ((resp.get("data") or {}).get("qrId")) if resp.get("returnCode") == 0 else None
    if not qrid:
        print(f"  [{name}] getQrId失败 {resp.get('returnCode')}")
        return None
    cp = f"https://aq.huya.com/r/confirm.html?k={qrid}&id=5002"
    ph.call("/qrLgn/scanQrPicNotify", "70005",
            {"qrId": qrid, "wupData": wup_b64,
             "behavior": quote("[]", safe=""), "page": quote(cp, safe="")})
    r2 = ph.call("/qrLgn/bindQrLoginUser", "70007",
                 {"qrId": qrid, "wupData": wup_b64,
                  "behavior": quote("[]", safe=""), "page": quote(cp, safe="")})
    print(f"  [{name}] bindQr rc={r2.get('returnCode')} "
          f"{r2.get('message') or r2.get('description') or ''}")
    if r2.get("returnCode") != 0:
        return None
    for _ in range(4):
        rt = pc.call("/qrLgn/tryQrLogin", "70003",
                     {"qrId": qrid, "remember": "1", "domainList": "",
                      "behavior": beh, "page": page})
        dt = rt.get("data") or {}
        if dt.get("stage") == 2 and dt.get("biztoken"):
            return {"ok": True, "uid": dt.get("uid")}
        time.sleep(1.5)
    return None


def patch_session_consistent(env: Envelope, session: int) -> Envelope:
    """三处session等宽一致改写, 并回读校验。"""
    raw = bytearray(env.raw)
    # iRequestId @[8:12]
    struct.pack_into(">I", raw, 8, session & 0xFFFFFFFF)
    # meta JSON 内等宽替换
    s, e = env.meta_json_span
    js = bytes(raw[s:e]).decode()
    old = re.search(r'"session":(\d+)', js).group(1)
    new = str(session)[-len(old):] if len(str(session)) >= len(old) else \
        str(session).rjust(len(old), "0")
    js2 = js.replace(f'"session":{old}', f'"session":{new}', 1)
    assert len(js2.encode()) == e - s
    raw[s:e] = js2.encode()
    # v0 blob: 定位key串后的完整值段, 解析其头后整体替换为同构5B
    i = bytes(raw).find(b"wupudbrequest_v0")
    klen_off = i - 1                      # STRING1长度字节
    vhead = klen_off + 1 + raw[klen_off]  # value字段头(0x1d)
    assert raw[vhead] & 0x0F == 0x0D
    p = vhead + 1                          # 元素类型头
    dt_len = raw[p] & 0x0F
    if dt_len == 0x00:
        vn = raw[p + 1]; val = p + 2
    elif dt_len == 0x01:
        vn = struct.unpack_from(">h", raw, p + 1)[0]; val = p + 3
    elif dt_len == 0x03:
        vn = struct.unpack_from(">i", raw, p + 1)[0]; val = p + 5
    else:
        raise ValueError(f"v0长度编码{dt_len:#x}")
    # 保持首字节(head)不动, 只换其后4字节数值
    struct.pack_into(">I", raw, val + 1, session & 0xFFFFFFFF)
    env.raw = raw
    return env


def main() -> int:
    results = {}

    # 并行: 登录(不依赖信封) 与 设备hook同时跑
    import threading
    cred_box: dict = {}

    def _login_all():
        uid_t, cred_t = login_uid_cred(*TRUSTED)
        uid_n, cred_n = login_uid_cred(*NEWACCT)
        cred_box.update(uid_t=uid_t, cred_t=cred_t, uid_n=uid_n, cred_n=cred_n)

    th = threading.Thread(target=_login_all, daemon=True)
    t0 = time.time()
    th.start()
    refresh_envelope_from_device()
    th.join(timeout=30)
    t_refresh = KEYCAP.stat().st_mtime  # 以信封采集时刻为窗口原点
    print(f"[login] 可信uid={cred_box['uid_t']} 新账号uid={cred_box['uid_n']} "
          f"(准备耗时{time.time()-t0:.0f}s) —— 开始紧凑窗口")
    uid_t, cred_t = cred_box["uid_t"], cred_box["cred_t"]
    uid_n, cred_n = cred_box["uid_n"], cred_box["cred_n"]

    def elapsed() -> float:
        return f"+{time.time()-t_refresh:.0f}s"

    # X0 对照
    env = Envelope.load()
    assert env.uid == uid_t
    r = try_bind(env.patch_cert(env_forge(env, cred_t)).wup_b64(),
                 f"X0对照 {elapsed()}")
    results["X0_control"] = r

    # X1 uid错配
    env = Envelope.load()
    r = try_bind(env.patch_cert(env_forge(env, cred_n)).wup_b64(),
                 f"X1错配 {elapsed()}")
    results["X1_uid_mismatch"] = r

    # X2 换账号
    env = Envelope.load()
    r = try_bind(env.patch_uid(uid_n).patch_cert(env_forge(env, cred_n)).wup_b64(),
                 f"X2换号 {elapsed()}")
    results["X2_cross_account"] = r

    # X3 session一致随机
    env = Envelope.load()
    sess = 3_900_000 + random.randint(1, 99_999)
    r = try_bind(patch_session_consistent(env, sess).patch_cert(
        env_forge(env, cred_t)).wup_b64(), f"X3改session {elapsed()}")
    results["X3_random_session"] = r

    print("\n===== 结论 =====")
    for k, v in results.items():
        print(f"  {k}: {'✅ 通过' if v else '❌ 拒绝'} {v or ''}")
    (ROOT / "evidence/envelope_rules2.json").write_text(
        json.dumps(results, ensure_ascii=False, indent=1))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())