'use strict';
function emit(row) { try { send(row); } catch (e) {} }
function btOk() {
  try {
    return Thread.backtrace(this.context, Backtracer.ACCURATE).slice(0, 10).map(a => {
      const m = Process.findModuleByAddress(a);
      return m ? m.name + '!' + a.sub(m.base) : a.toString();
    }).join(' <- ');
  } catch (e) { return ''; }
}
const PREF = [0x57, 0x18, 0x82, 0xcf];
let fired = false;
for (const mod of Process.enumerateModules()) {
  let addr = null;
  try { addr = mod.getExportByName('SSL_write'); } catch (e) {}
  if (addr === null) continue;
  Interceptor.attach(addr, {
    onEnter(args) {
      if (fired) return;
      const buf = args[1];
      const num = args[2].toInt32();
      if (num < 40) return;
      try {
        const b = buf.readByteArray(1 << 20 > num ? num : num); // 尽量读
        const u = new Uint8Array(b);
        for (let i = 0; i + 4 < u.length; i++) {
          if (u[i] === PREF[0] && u[i+1] === PREF[1] && u[i+2] === PREF[2] && u[i+3] === PREF[3]) {
            fired = true;
            const n = Math.min(num, 12000);
            const hex = Array.from((new Uint8Array(buf.readByteArray(n)))).map(x => x.toString(16).padStart(2, '0')).join('');
            emit({ event: 'ssl-magic', module: mod.name, num, off: i, full: hex, bt: btOk() });
            return;
          }
        }
      } catch (e) {}
    },
  });
  emit({ event: 'ssl-hook', module: mod.name });
}