#!/usr/bin/env python3
"""attach + 全部 bypass + 主 hook: 验证 attach 路径能存活且抓到 dfpReport。
这是"不挂起、不 spawn"的路线, 无 EGL 崩问题。
"""
from __future__ import annotations
import frida, time, subprocess, json, re
from pathlib import Path

REMOTE = "127.0.0.1:31878"
PACKAGE = "com.duowan.kiwi"
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/emu_attach_full.json")
BYPASSES = ["bypass_msaoaid_maps_art_callsite.js", "mask_frida_maps_only.js", "patch_guard_block_termination.js"]

MAIN_JS = """
'use strict';
send({type:'armed'});
function hexb(p,n){try{return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join('');}catch(e){return '';}}
function head(p,n){try{return p.readCString(n);}catch(e){return '';}}
try{
  var r=new ApiResolver('module');
  r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
    Interceptor.attach(m.address,{onEnter:function(a){
      var len=a[2].toInt32();
      if(len<50||len>50000)return;
      var h=head(a[1],Math.min(len,1500));
      if(h.indexOf('dfpReport')>=0||h.indexOf('dckey')>=0){
        send({cls:h.indexOf('dfpReport')>=0?'dfpReport':'dckey',len:len,hex:hexb(a[1],len)});
      }
    }});
  });
  send({type:'hooked'});
}catch(e){send({type:'err',e:String(e)});}
try{
  var r2=new ApiResolver('module');
  r2.enumerateMatchesSync('exports:*!SSL_read').forEach(function(m){
    Interceptor.attach(m.address,{onEnter:function(a){this.buf=a[1];},
      onLeave:function(ret){
        var nn=ret.toInt32();
        if(nn<=0||nn>4000)return;
        send({type:'resp',len:nn,hex:hexb(this.buf,nn)});
      }});
  });
  send({type:'readhooked'});
}catch(e){send({type:'readerr',e:String(e)});}
"""


def main():
    subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE], capture_output=True)
    time.sleep(1)
    subprocess.run(["adb","-s","127.0.0.1:5555","shell","monkey","-p",PACKAGE,"-c","android.intent.category.LAUNCHER","1"], capture_output=True)
    print("app launched, waiting for dfp cold-start... attach fast", flush=True)
    d = frida.get_device_manager().add_remote_device(REMOTE)
    # 用 adb pidof 确定的 pid (更可靠)
    pid = None
    for _ in range(15):
        r = subprocess.run(["adb","-s","127.0.0.1:5555","shell","pidof",PACKAGE], capture_output=True, text=True)
        p = r.stdout.strip()
        if p:
            pid = int(p)
            break
        time.sleep(1)
    if not pid:
        # fallback frida enumerate
        ps = [x for x in d.enumerate_processes() if 'kiwi' in x.name or 'duowan' in x.name]
        pid = ps[0].pid if ps else None
    print("attach pid", pid, flush=True)
    s = d.attach(pid)
    for name in BYPASSES:
        try:
            sc = s.create_script((RE/"evidence/scripts"/name).read_text()); sc.load(); time.sleep(0.2)
        except Exception as e:
            print(f"bp err {name} {e}", flush=True)
    events = []
    def on_main(m, dta):
        if m.get('type') == 'error':
            print("[JS-ERR]", str(m)[:120], flush=True); return
        p = m.get('payload') or {}
        t = p.get('type')
        if t == 'armed': print("[*] armed", flush=True)
        elif t == 'hooked': print("[*] SSL_write hooked", flush=True)
        elif t in ('err','readerr'): print("[*]", t, p.get('e'), flush=True)
        elif 'cls' in p:
            print(f"[*] {p['cls']} len={p['len']}", flush=True)
            events.append(p); OUT.write_text(json.dumps(events))
        elif t == 'resp':
            av = re.search(rb'actionV\(([0-9a-f]{40})', bytes.fromhex(p.get('hex') or ''))
            mark = f" actionV={av.group(1).decode()}" if av else ""
            print(f"[*] RESP len={p['len']}{mark}", flush=True)
            events.append(p); OUT.write_text(json.dumps(events))
    sc = s.create_script(MAIN_JS)
    sc.on('message', on_main)
    sc.load()
    # 观察 60s, 若触发 dfpReport 会有; 同时可通过 am 触发
    print("[*] observing 60s", flush=True)
    prev = 0
    for t in [5,10,15,20,30,40,50,60]:
        time.sleep(t-prev); prev=t
        try:
            alive = [p for p in d.enumerate_processes() if p.pid==pid]
        except Exception: break
        if not alive: print(f"=> DEAD at +{t}s", flush=True); break
    print(f"[*] done, {len(events)} events", flush=True)


if __name__ == "__main__":
    main()