// 双钩 (send() 事件格式!): Cprivate.b(明文+密钥!) + Perseus.a 会话密钥
setTimeout(function(){
  function S(o){ try { send(o); } catch(e){} }
  try {
    Java.perform(function(){
      var hooked = 0;
      try {
        var Cpr = null, Melon = null;
        Java.enumerateClassLoaders({
          onMatch: function(loader){
            try {
              Java.classFactory.loader = loader;
              var c = Java.use('com.tencent.turingfd.sdk.ams.ga.private');
              if (c) { Cpr = c; Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon'); }
            } catch(e){}
          },
          onComplete: function(){}
        });
        if (!Cpr) { Cpr = Java.use('com.tencent.turingfd.sdk.ams.ga.private'); Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon'); }
        var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
        Cpr.b.overload('[B','[B').implementation = function(a, b){
          var out = this.b(a, b);
          try {
            S({event:'cpr-b', dlen:a.length, klen:b.length,
               key:Melon.a(b), dhead:(Melon.a(a)||'').substring(0,300)});
          } catch(e){ S({event:'cpr-err', e:String(e)}); }
          return out;
        };
        hooked++;
      } catch(e){ S({event:'cpr-nohook', e:String(e).substring(0,120)}); }
      try {
        var Perseus = Java.use('com.tencent.turingfd.sdk.ams.ga.Perseus');
        var Guava = Java.use('com.tencent.turingfd.sdk.ams.ga.Guava');
        Perseus.a.implementation = function(){
          this.a();
          try {
            var g = this.b.value;
            if (g) S({event:'perseus-key', c:g.c.value, b1:g.a.value, blen: g.b.value ? g.b.value.length : -1});
          } catch(e){}
        };
        hooked++;
      } catch(e2){ S({event:'cpr-noperseus', e:String(e2).substring(0,120)}); }
      S({event:'cpr-installed', hooked:hooked});
    });
  } catch(e) { S({event:'cpr-perm', e:String(e).substring(0,120)}); }
}, 1200);

// 兜底: SSL_write 抓 dfpReport 密文 (串过滤!)
try {
  var sslw = Module.findExportByName('libssl.so', 'SSL_write');
  if (sslw) {
    Interceptor.attach(sslw, {
      onEnter: function(args){
        try {
          var len = args[2].toInt32();
          if (len < 50 || len > 60000) return;
          var b = args[1].readByteArray(Math.min(len, 2000));
          var u = new Uint8Array(b);
          var s = '';
          for (var i=0;i<u.length;i++) s += String.fromCharCode(u[i]);
          if (s.indexOf('dfpReport') >= 0 || u.length>10 && (u[0]==0x7c || u[1]==0xda)) {
            var hex = Array.prototype.map.call(u, function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
            send({event:'ssl-dfp', len:len, head:hex.substring(0,120)});
          }
        } catch(e){}
      }
    });
    send({event:'ssl-hooked'});
  }
} catch(e) { send({event:'ssl-fail', e:String(e).substring(0,100)}); }