// hook ga 的 b209202@0x20110 + k209202@0x219d8 — 抓 JNI 实参 (moderate - 只有 2 个 attach!)
function pad(h, n){ h=h||'0'; return h.length>=n?h:('0'.repeat(n-h.length)+h); }
setTimeout(function(){
  var mod = Process.findModuleByName('libturingga.so');
  if (!mod) { console.log('[B2] no ga module'); return; }
  var base = mod.base;
  var hooks = [
    {name:'b209202', off:0x20110, nargs:7},
    {name:'k209202', off:0x219d8, nargs:4},
  ];
  hooks.forEach(function(h){
    var addr = base.add(h.off);
    try {
      Interceptor.attach(addr, {
        onEnter: function(args){
          this.t = Date.now();
          var regs = 'a0=' + pad(args[0].toString(16)) + ' a1=' + pad(args[1].toString(16));
          for (var i=h.nargs-2; i<h.nargs; i++) regs += ' a' + i + '=' + pad(args[i].toString(16));
          console.log('[B2] ' + h.name + '.' + h.off.toString(16) + ' enter ' + regs);
        },
        onLeave: function(ret){
          console.log('[B2] ' + h.name + '.' + h.off.toString(16) + ' leave -> ' + pad(ret.toString(16)) + ' dt=' + (Date.now()-this.t) + 'ms');
        }
      });
      console.log('[B2] hooked ' + h.name + ' @' + h.off.toString(16));
    } catch(e) { console.log('[B2] hook ' + h.name + ' FAIL ' + e); }
  });

  // 监听 DFPService capture (同 hook_str_magic 的过滤)
  var ssl = Process.findModuleByName('libssl.so');
  if (ssl) {
    var f = Module.findExportByName('libssl.so', 'SSL_write');
    if (f) {
      Interceptor.attach(f, {
        onEnter: function(args){
          try {
            var len = args[2].toInt32();
            if (len < 50 || len > 60000) return;
            var b = args[1].readByteArray(Math.min(len, 300));
            var s = Array.from(new Uint8Array(b)).map(function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
            if (s.indexOf('7cda') >= 0 || s.indexOf('dfpReport') >= 0 || s.indexOf('hyudbwebuif') >= 0) {
              console.log('[B2] SSL_write len=' + len);
            }
          } catch(e){}
        }
      });
      console.log('[B2] ssl-write hook ok');
    }
  }
}, 1000);