#!/usr/bin/env python3
"""追踪 k1(this+0x10)写入者: hook std::string::operator=(0x3e6464) + getInstance(0x281270)。"""
from __future__ import annotations

import json
import subprocess
import time
from pathlib import Path

import frida

RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")

JS = r"""
'use strict';
Process.setExceptionHandler(function(d){ send({type:'segv', info:{type:d.type, addr:String(d.address)}}); return true; });
var base = Process.getModuleByName('libudbauthunify.so').base;
send({type:'armed', base:String(base)});
var cfgAddr = null;

function rdStr(p){
  try{
    var b0=p.readU8();
    if((b0&1)===0){ var l=b0>>1; if(l>8192) return {t:'s?',len:l,v:''};
      return {t:'s',len:l,v:l?Array.from(new Uint8Array(p.add(1).readByteArray(l))).map(x=>('0'+x.toString(16)).slice(-2)).join(''):''}; }
    var len=parseInt(p.add(8).readU64().toString());
    if(len>65536) return {t:'l?',len:len,v:''};
    var dp=p.add(16).readPointer();
    return {t:'l',len:len,v:Array.from(new Uint8Array(dp.readByteArray(len))).map(x=>('0'+x.toString(16)).slice(-2)).join('')};
  }catch(e){ return {t:'err',len:-1,v:String(e)}; }
}

// getInstance @0x281270 -> 单例
try {
  Interceptor.attach(base.add(0x281270), {
    onLeave: function(r){
      cfgAddr = r;
      var s = rdStr(r.add(0x10));
      send({type:'cfg', addr:String(r), k1v:s.v, k1len:s.len});
    }
  });
} catch(e){ send({type:'hookerr', where:'getInstance', msg:''+e}); }

// operator= @0x3e6464: a[0]=目标, a[1]=源
try {
  Interceptor.attach(base.add(0x3e6464), {
    onEnter: function(a){
      if (!cfgAddr) return;
      if (a[0].equals(cfgAddr.add(0x10))) {
        var v = rdStr(a[1]);
        send({type:'write_k1', val:v.v, len:v.len,
              bt:Thread.backtrace(this.context, Backtracer.ACCURATE).map(function(x){
                return DebugSymbol.fromAddress(x).toString().slice(0,90);}).slice(0,5)});
      }
    }
  });
} catch(e){ send({type:'hookerr', where:'op=', msg:''+e}); }

setTimeout(function(){
  if (cfgAddr) {
    var s = rdStr(cfgAddr.add(0x10));
    send({type:'final_k1', k1:s.v, len:s.len});
  } else {
    send({type:'final_k1', k1:'NO_CFG'});
  }
}, 90000);
"""


def main():
    d = frida.get_device_manager().add_remote_device('127.0.0.1:31877')
    pid = d.spawn(['com.duowan.kiwi'])
    print(f'spawned {pid}')
    s = d.attach(pid)
    s.create_script((RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()).load()
    s.create_script((RE / "evidence/scripts/mask_frida_maps_only.js").read_text()).load()
    d.resume(pid)
    print('resumed')
    time.sleep(11)
    s.create_script((RE / "evidence/scripts/patch_guard_block_termination.js").read_text()).load()
    print('patch_guard on')

    sc = s.create_script(JS)
    events = []
    got_armed = []

    def on_msg(m, _):
        if m.get('type') == 'error':
            print('JS ERR:', str(m)[:240]); return
        if m.get('type') != 'send':
            return
        p = m.get('payload') or {}
        t = p.get('type')
        events.append(p)
        if t == 'armed':
            got_armed.append(1); print('[armed]')
        elif t == 'cfg':
            print(f"[cfg] addr={p['addr']} k1len={p['k1len']}")
        elif t == 'write_k1':
            print(f"[WRITE k1] len={p['len']} val={p['val'][:60]}")
            for f in p['bt']:
                print("    <", f)
        elif t == 'final_k1':
            print(f"[FINAL k1] len={p['len']} {p['k1'][:40]}")
        elif t == 'hookerr':
            print('[hookerr]', p)

    sc.on('message', on_msg)
    sc.load()
    assert got_armed

    deadline = time.time() + 150
    while time.time() < deadline:
        time.sleep(2)
        if any(e.get('type') == 'final_k1' for e in events):
            time.sleep(3)
            break
    Path('/tmp/opencode/k1_trace2.json').write_text(json.dumps(events))
    print('saved /tmp/opencode/k1_trace2.json')


if __name__ == '__main__':
    for attempt in range(3):
        print(f'===== 尝试 #{attempt+1} =====')
        try:
            main()
            break
        except frida.InvalidOperationError as e:
            print(f'session detached: {e}')
            subprocess.run(['adb', 'shell', 'am', 'force-stop', 'com.duowan.kiwi'])
            time.sleep(3)
        except Exception as e:
            print(f'err: {e}')
            subprocess.run(['adb', 'shell', 'am', 'force-stop', 'com.duowan.kiwi'])
            time.sleep(3)