#!/usr/bin/env python3
"""扫描堆中"加密前的明文"：设备采集数据(含 android- 开头、JSON/键值)。

dfpReport 明文 = [魔数][时间戳][设备数据], 加密前明文在堆里。
扫描含 'android' 或 'deviceinfo' 等键值的大块可读内存, dump 前后 8KB。
"""
from __future__ import annotations

import json
import time
from pathlib import Path

import frida

RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_plain_scan.json")

JS = r"""
'use strict';
Process.setExceptionHandler(function(d){ return true; });
send({type:'armed'});

function tryRead(p, n){
  try{ return p.readUtf8String(n); }catch(e){ return null; }
}

function scan(){
  try{
    Process.enumerateRanges('r--').forEach(function(r){
      if (r.size > 1024*1024*256) return;
      try{
        // 搜 "android-" 明文 (设备 UA 前缀, 加密前会出现)
        var hits = Memory.scanSync(r.base, r.size, '61 6e 64 72 6f 69 64 2d');
        hits.forEach(function(x){
          var s = tryRead(x.address, 300);
          if (s && s.length > 30 && /[a-z0-9]{3,}/.test(s)) {
            send({type:'plain', addr:String(x.address), s:s.slice(0, 300)});
          }
        });
        // 搜 "deviceinfo" 键
        var hits2 = Memory.scanSync(r.base, r.size, '64 65 76 69 63 65 69 6e 66 6f');
        hits2.forEach(function(x){
          var s = tryRead(x.address, 300);
          if (s) send({type:'plain', addr:String(x.address), s:s.slice(0, 300)});
        });
      }catch(e){}
    });
  }catch(e){}
  send({type:'tick'});
}

setInterval(function(){ try{ scan(); }catch(e){} }, 4000);
"""


def main():
    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
    pid = device.spawn(["com.duowan.kiwi"])
    print(f"[*] spawned pid={pid}", flush=True)
    session = device.attach(pid)

    events = []

    def on_message(message, data):
        if message.get("type") == "error":
            print("[JS-ERR]", str(message)[:200], flush=True); return
        if message.get("type") != "send":
            return
        p = message.get("payload") or {}
        t = p.get("type")
        if t == "plain":
            s = p.get('s', '')
            # 过滤明显的噪音 (路径/类名)
            if '/data/app' in s or 'library' in s or '.jar' in s: return
            key = p.get('addr')
            if any(e.get('addr') == key for e in events): return
            events.append(p)
            OUT.write_text(json.dumps(events, ensure_ascii=False, indent=1))
            print(f"[plain] @{key}: {s[:180]!r}", flush=True)

    script = session.create_script(JS)
    script.on("message", on_message)
    script.load()
    print("[*] 主JS 已装载(resume前), 加载 bypass + resume", flush=True)
    session.create_script(
        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
    ).load()
    session.create_script(
        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
    ).load()
    device.resume(pid)
    time.sleep(11)
    session.create_script(
        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
    ).load()
    print("[*] 已 resume, 扫描明文 (4s轮询), 请触发登录, 命中即 pkill", flush=True)
    try:
        while True:
            time.sleep(5)
    except KeyboardInterrupt:
        pass
    print(f"[*] 结束, {len(events)} 条 -> {OUT}", flush=True)


if __name__ == "__main__":
    main()