#!/usr/bin/env python3
"""R38b: RC4 key 诞生点追踪 (MD5 transform 消息积累)."""
import json, subprocess, time
from pathlib import Path
import frida

REMOTE="127.0.0.1:31878"; ADB="5dd8c93f"; PACKAGE="com.duowan.kiwi"
RE=Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
HERE=Path(__file__).resolve().parent.parent
OUT=HERE/"evidence"/("keytrace2_"+time.strftime("%H%M%S")+".json")

def clear_turing():
    for d in ("app_turingdfp","app_turingfd"):
        subprocess.run(["adb","-s",ADB,"shell","su","-c",f"rm -rf /data/data/{PACKAGE}/{d}/*"],capture_output=True)
    subprocess.run(["adb","-s",ADB,"shell","su","-c",f"find /data/data/{PACKAGE} -name 'resinfo*' -delete"],capture_output=True)

def main():
    clear_turing()
    d=frida.get_device_manager().add_remote_device(REMOTE)
    subprocess.run(["adb","-s",ADB,"shell","am","force-stop",PACKAGE],capture_output=True)
    time.sleep(1.5)
    pid=d.spawn([PACKAGE]); print(f"[*] spawn pid={pid}",flush=True)
    s=d.attach(pid)
    try:
        b=s.create_script((RE/"evidence/scripts/bypass_msaoaid_maps_skip_cleanup.js").read_text()); b.load()
    except Exception as e: print(f"[*] bypass err {e}",flush=True)
    d.resume(pid)
    result={}; state={"post":False,"key":False}
    def on(m,_):
        if m.get("type")=="error":
            t=str(m)
            if "ClassNotFoundException" not in t: print(f"[JS] {t[:150]}",flush=True)
            return
        p=m.get("payload") or {}
        ev=p.get("event")
        if ev=="post": state["post"]=True; print("[+] POST fired",flush=True)
        elif ev=="key-site": state["key"]=True; print(f"[+] KEY ARRIVED: {p.get('key')} md5calls={p.get('md5calls')} states={p.get('nstates')}",flush=True)
        elif ev=="hy-armed": print("[*] hy armed",flush=True)
        elif ev=="java-md5-hooked": print("[*] java digest hooked",flush=True)
        elif ev=="key-copies-done": print(f"[*] key copies: {p.get('n')}",flush=True)
        result.setdefault(ev or "misc",[]).append(p)
    sc=s.create_script((HERE/"tools/frida/hook_keytrace2.js").read_text())
    sc.on("message",on); sc.load()
    t0=time.time()
    while time.time()-t0<220:
        time.sleep(3)
        if state["key"] and state["post"]: time.sleep(5); break
    json.dump(result,open(OUT,"w"),indent=2)
    print(f"[*] saved {OUT} post={state['post']} key={state['key']}",flush=True)
    try: s.detach()
    except Exception: pass

if __name__=="__main__": main()