#!/usr/bin/env python3
"""attach 模式抓模拟器 32hex hdid v4: hook createWupDeviceInfo(ret+152=hdid).

直接 attach 正在运行的主进程(不 spawn, 无 EGL 崩溃风险)。
createWupDeviceInfo 每次 udb 上报/wup 打包都调用 → 上报即触发, 无需登录UI。
"""
import frida, time, re, json, sys
REMOTE = "127.0.0.1:31878"
OUT = Path_ = "/tmp/emu_hdid_v4.json"

JS = r"""
'use strict';
function readStdString(p){
  if (p.isNull()) return null;
  try{
    var first = p.readU8();
    if ((first & 1) === 0) {
      var len = first >> 1;
      return (len>0 && len<256) ? p.add(1).readUtf8String(len) : '';
    } else {
      var data = p.readPointer();
      var len = p.add(8).readU64();
      return (len>0 && len<1024) ? data.readUtf8String(len) : null;
    }
  }catch(e){ return null; }
}
function emit(tag, val){ send({type:'hdid', tag:tag, val:''+(val||''), ts:Date.now()}); }

function install(){
  var md = Process.findModuleByName('libudbauthunify.so');
  if (!md){ emit('state','NO_MOD'); return; }
  emit('state','mod='+md.base);

  try{
    Interceptor.attach(md.base.add(0x2746A0), {
      onEnter:function(){ emit('tick','createWupDeviceInfo #' + (++window.__n||(window.__n=1))); },
      onLeave:function(ret){
        try{
          var s = readStdString(ret.add(152));
          emit('WUPDEV_HDID', ''+s);
        }catch(e){ emit('WUPDEV_ERR', ''+e); }
      }
    });
    emit('state','createWupDev hooked');
  }catch(e){ emit('state','createWupDev ERR '+e); }

  try{
    Interceptor.attach(md.base.add(0x26A2E0), {
      onEnter:function(a){ this.sd=readStdString(a[1]); this.hd=readStdString(a[2]); },
      onLeave:function(){ emit('SETSD', (this.hd||'')+' | sd='+(this.sd||'').slice(0,24)); }
    });
  }catch(e){}

  try{
    Interceptor.attach(md.base.add(0x26A484), {
      onEnter:function(a){ try{ this.thiz=this.context.x8; }catch(e){ this.thiz=null; } },
      onLeave:function(){
        if(!this.thiz) return;
        try{ var s=readStdString(this.thiz.add(1088)); if(s) emit('GETHDID',''+s); }catch(e){}
      }
    });
  }catch(e){}

  emit('state','all hooked, waiting events');
}
install();
"""

def main():
    dev = frida.get_device_manager().add_remote_device(REMOTE)
    pid = None
    for p in dev.enumerate_processes():
        if p.name and p.name == 'com.duowan.kiwi':
            pid = p.pid; break
    if not pid:
        print("找不到主进程"); return
    print("attach pid =", pid, flush=True)
    s = dev.attach(pid)
    events = []
    def on_msg(m, d):
        if m.get('type') == 'send':
            p = m['payload']
            print(f"[{p.get('tag')}] {p.get('val')}", flush=True)
            events.append(p); open(OUT,'w').write(json.dumps(events, indent=1))
        elif m.get('type') == 'error':
            print("JSErr:", str(m)[:150], flush=True)
    sc = s.create_script(JS)
    sc.on('message', on_msg)
    sc.load()
    print("运行 100s (App 上报会自动触发 createWupDeviceInfo)...", flush=True)
    time.sleep(100)
    print("done,", len(events), "events", flush=True)

if __name__ == "__main__":
    main()