// 轻量 Java hook: Cprivate.b(byte[] data, byte[] key) — 抓明文+密钥 (单点 hook, 不扫内存!)
setTimeout(function(){
  try {
    Java.perform(function(){
      try {
        var Cpr = Java.use('com.tencent.turingfd.sdk.ams.ga.Cprivate');
        var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
        Cpr.b.overload('[B','[B').implementation = function(a, b){
          try {
            var plainHex = Melon.a(a);   // a() = byte[] -> hex? (Melon.a(byte[]) = hex!)
            var keyHex = Melon.a(b);
            console.log('[CPR] Cprivate.b data-len=' + a.length + ' key-len=' + b.length);
            console.log('[CPR] key=' + keyHex);
            console.log('[CPR] data-head=' + (plainHex ? plainHex.substring(0, 160) : 'null'));
          } catch(e) { console.log('[CPR] dump-exc ' + e); }
          return this.b(a, b);
        };
        console.log('[CPR] hooked Cprivate.b');
      } catch(e2) { console.log('[CPR] no Cprivate: ' + e2); }
    });
  } catch(e) { console.log('[CPR] perm-exc ' + e); }
}, 1500);