#!/usr/bin/env python3
"""完整 dump 明文采集数据区域 (0x7814096d19 JSON 附近 + 0x78133bf220 键值结构)。

拿到加密前的完整明文 = 解密 dfpReport 的关键! dump 前后 8KB 到文件。
"""
from __future__ import annotations

import json
import time
from pathlib import Path

import frida

RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_plaintext_full.json")

JS = r"""
'use strict';
Process.setExceptionHandler(function(d){ return true; });
send({type:'armed'});

// 锚点: JSON 明文 + t1 键值结构
var ANCHORS = [
  ['json', '74 65 72 6d 69 6e 61 6c 54 79 70 65 22 3a 31'],     // terminalType":1
  ['t1kv', '74 65 72 6d 69 6e 61 6c'],                            // terminal (键值结构内)
];

function hex(p, n){
  try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(x=>('0'+x.toString(16)).slice(-2)).join(''); }
  catch(e){ return 'ERR'; }
}

function scan(){
  try{
    Process.enumerateRanges('r--').forEach(function(r){
      if (r.size > 1024*1024*256) return;
      try{
        ANCHORS.forEach(function(a){
          var hits = Memory.scanSync(r.base, r.size, a[1]);
          hits.slice(0, 5).forEach(function(x){
            var addr = x.address;
            // JSON: dump 前 512 + 后 8192
            var pre = '', post = '';
            try{ pre = hex(addr.sub(512), 512); }catch(e){}
            try{ post = hex(addr, 8192); }catch(e){}
            send({type:'dump', anchor:a[0], addr:String(addr), pre:pre, post:post});
          });
        });
      }catch(e){}
    });
  }catch(e){}
  send({type:'tick'});
}

setInterval(function(){ try{ scan(); }catch(e){} }, 4000);
"""


def main():
    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
    pid = device.spawn(["com.duowan.kiwi"])
    print(f"[*] spawned pid={pid}", flush=True)
    session = device.attach(pid)

    events = []

    def on_message(message, data):
        if message.get("type") == "error":
            print("[JS-ERR]", str(message)[:200], flush=True); return
        if message.get("type") != "send":
            return
        p = message.get("payload") or {}
        t = p.get("type")
        if t == "dump":
            addr = p.get('addr')
            if any(e.get('addr') == addr for e in events): return
            rec = {"anchor": p.get('anchor'), "addr": addr,
                   "pre": p.get('pre'), "post": p.get('post')}
            events.append(rec)
            OUT.write_text(json.dumps(events, ensure_ascii=False))
            # 打印 post 的可读部分 (前 400B)
            post = bytes.fromhex(p.get('post', ''))
            asc = ''.join(chr(b) if 32 <= b < 127 else '.' for b in post[:400])
            print(f"[dump:{p.get('anchor')}] @{addr}", flush=True)
            print(f"    {asc}", flush=True)

    script = session.create_script(JS)
    script.on("message", on_message)
    script.load()
    print("[*] 主JS 已装载(resume前), 加载 bypass + resume", flush=True)
    session.create_script(
        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
    ).load()
    session.create_script(
        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
    ).load()
    device.resume(pid)
    time.sleep(11)
    session.create_script(
        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
    ).load()
    print("[*] 已 resume, dump 明文区 (需触发登录采集后可 pkill)", flush=True)
    try:
        while True:
            time.sleep(5)
    except KeyboardInterrupt:
        pass
    print(f"[*] 结束, {len(events)} -> {OUT}", flush=True)


if __name__ == "__main__":
    main()