#!/usr/bin/env python3
"""抓取真正"同时刻"的 (明文JSON, 密文) 对。

SSL_write 命中 dfpReport 时, 明文刚生成/正在内存, 立即全内存扫描
{"appId":"5008" 快照 -> 与本次密文构成同步 pair。命中即持久化。
"""
from __future__ import annotations

import json
import time
from pathlib import Path

import frida

RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_pair_sync.json")

JS = r"""
'use strict';
Process.setExceptionHandler(function(d){ return true; });
send({type:'armed'});

function hexb(p, n){
  try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(x=>('0'+x.toString(16)).slice(-2)).join(''); }
  catch(e){ return null; }
}
function hexs(buf){ return Array.from(new Uint8Array(buf)).map(function(x){return ('0'+x.toString(16)).slice(-2);}).join(''); }

// 同步: SSL_write 后 50ms 扫描明文 (此时 JSON 应仍在堆)
function scanPlainNow(tag){
  var out = [];
  try{
    Process.enumerateRanges('r--').forEach(function(rng){
      if (rng.size > 1024*1024*256) return;
      try{
        var hits = Memory.scanSync(rng.base, rng.size, '7b 22 61 70 70 49 64 22 3a 22 35 30 30 38');
        hits.slice(0, 4).forEach(function(x){
          var post = null;
          try{ post = x.address.readByteArray(4096); }catch(e){ return; }
          out.push({addr: String(x.address), hex: hexs(post)});
        });
      }catch(e){}
    });
  }catch(e){}
  if (out.length) send({type:'sync_plain', tag:tag, plains:out});
}

try{
  var r = new ApiResolver('module');
  r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
    Interceptor.attach(m.address, {
      onEnter: function(a){
        var len = a[2].toInt32();
        if (len < 100 || len > 20000) return;
        var head = '';
        try{ head = a[1].readCString(Math.min(len, 2000)); }catch(e){ return; }
        if (head.indexOf('dfpReport') < 0) return;
        var hex = hexb(a[1], len);
        var t = Date.now();
        send({type:'wire', len:len, hex:hex, t:t});
        setTimeout(function(){ scanPlainNow(t); }, 80);
      }
    });
  });
}catch(e){}
"""


def main():
    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
    pid = device.spawn(["com.duowan.kiwi"])
    print(f"[*] spawned pid={pid}", flush=True)
    session = device.attach(pid)

    events = []

    def on_message(message, data):
        if message.get("type") == "error":
            print("[JS-ERR]", str(message)[:200], flush=True); return
        if message.get("type") != "send":
            return
        p = message.get("payload") or {}
        t = p.get("type")
        if t == "wire":
            print(f"[wire] len={p.get('len')}", flush=True)
            events.append({"type": "wire", "t": p.get('t'), "hex": p.get('hex')})
            OUT.write_text(json.dumps(events))
        elif t == "sync_plain":
            print(f"[sync_plain] tag={p.get('tag')} {len(p.get('plains'))} 份", flush=True)
            events.append({"type": "plain", "t": p.get('tag'), "plains": p.get('plains')})
            OUT.write_text(json.dumps(events))
            for pl in p.get('plains'):
                try:
                    h = pl['hex']
                    j = h.index('7b226170704964223a2235303038')
                    asc = bytes.fromhex(h[j:j+700])
                    s = ''.join(chr(x) if 32<=x<127 else '.' for x in asc)
                    print(f"    @{pl['addr']}: {s[:200]}", flush=True)
                except Exception: pass

    script = session.create_script(JS)
    script.on("message", on_message)
    script.load()
    print("[*] 主JS 已装载(resume前), 加载 bypass + resume", flush=True)
    session.create_script(
        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
    ).load()
    session.create_script(
        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
    ).load()
    device.resume(pid)
    time.sleep(11)
    session.create_script(
        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
    ).load()
    print("[*] 已 resume. 请 退出登录->重新登录 (wire 后立即抓同刻明文)", flush=True)
    try:
        while True:
            time.sleep(5)
    except KeyboardInterrupt:
        pass
    print(f"[*] 结束 -> {OUT}", flush=True)


if __name__ == "__main__":
    main()