#!/usr/bin/env python3
"""重 hook datadiv 解码器: 读返回值指向内存的前 64B hex。

datadiv 函数解密一个数据块(不只是字符串), 魔数 5718 / 设备数据 / key
可能藏在解码后的内存里。命中(含 5718 或 android)即持久化。
"""
from __future__ import annotations

import json
import time
from pathlib import Path

import frida

RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/dfp_datadiv_hex.json")

JS = r"""
'use strict';
Process.setExceptionHandler(function(d){ return true; });
send({type:'armed'});

function hex(p, n){
  try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(x=>('0'+x.toString(16)).slice(-2)).join(''); }
  catch(e){ return 'ERR'; }
}

var hooked = 0;
function hookMod(modName){
  var m = null;
  try{ m = Process.getModuleByName(modName); }catch(e){ return false; }
  m.enumerateExports().forEach(function(exp){
    if (exp.name.indexOf('datadiv') < 0) return;
    try{
      Interceptor.attach(exp.address, {
        onLeave: function(ret){
          var p = ret;
          if (p.isNull()) return;
          var h64 = '';
          try{ h64 = hex(p, 64); }catch(e){ return; }
          if (h64.indexOf('ERR') >= 0) return;
          // 命中关键词: 魔数 / android / 可读字符串
          var low = h64.toLowerCase();
          var hit = low.indexOf('5718') >= 0 || low.indexOf('616e64726f6964') >= 0;
          var str = '';
          try{ str = p.readUtf8String(); }catch(e){}
          if (hit || (str && str.length > 4 && str.length < 100 && /[a-z]{4,}/i.test(str))) {
            send({type:'dd', mod:modName, fn:exp.name, h64:h64, str:str});
          }
        }
      });
      hooked += 1;
    }catch(e){}
  });
  return true;
}

var tries = 0;
var iv = setInterval(function(){
  tries += 1;
  var ok = hookMod('libhydeviceid.so') | hookMod('libudbauthunify.so');
  if (tries % 5 === 0) send({type:'waiting', tries:tries, hooked:hooked});
  if (ok) { clearInterval(iv); send({type:'hooked_count', n:hooked}); }
  if (tries > 60) clearInterval(iv);
}, 1000);
"""


def main():
    device = frida.get_device_manager().add_remote_device("127.0.0.1:31877")
    pid = device.spawn(["com.duowan.kiwi"])
    print(f"[*] spawned pid={pid}", flush=True)
    session = device.attach(pid)
    session.create_script(
        (RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()
    ).load()
    session.create_script(
        (RE / "evidence/scripts/mask_frida_maps_only.js").read_text()
    ).load()
    device.resume(pid)
    time.sleep(11)
    session.create_script(
        (RE / "evidence/scripts/patch_guard_block_termination.js").read_text()
    ).load()

    events = []

    def on_message(message, data):
        if message.get("type") == "error":
            print("[JS-ERR]", str(message)[:160], flush=True); return
        if message.get("type") != "send":
            return
        p = message.get("payload") or {}
        t = p.get("type")
        if t == "dd":
            print(f"[dd] {p.get('mod')} {p.get('fn')}: {p.get('h64')} {p.get('str')!r}", flush=True)
            events.append(p)
            OUT.write_text(json.dumps(events, indent=1))
        elif t == "hooked_count":
            print(f"[*] hooked {p.get('n')} datadiv", flush=True)
        elif t == "waiting":
            print(f"[waiting] tries={p.get('tries')} hooked={p.get('hooked')}", flush=True)

    script = session.create_script(JS)
    script.on("message", on_message)
    script.load()
    print("[*] datadiv 重hook中 (每1s重试), 请触发登录 (命中即持久化)", flush=True)
    try:
        while True:
            time.sleep(5)
    except KeyboardInterrupt:
        pass
    print(f"[*] 结束, {len(events)} 条 -> {OUT}", flush=True)


if __name__ == "__main__":
    main()