live-hub-py/scripts/capture_frame.py

#!/usr/bin/env python3
"""抓"一帧"dfpReport(含响应 actionV)—— 自动重试, 直到拿到为止。

目标:每一台干净模拟器, 抓到一帧完整 dfpReport wire + 对应的 606B 响应(actionV),
即获得这台"设备"的纯 Python 可重放身份凭证。App 存活 3-6s 足够(dfpReport 启动即发)。
"""
from __future__ import annotations
from pathlib import Path
import frida, time, subprocess, json, re

REMOTE = "127.0.0.1:31878"
PACKAGE = "com.duowan.kiwi"
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/frame_" + time.strftime("%H%M%S") + ".json")
BYPASS = "bypass_msaoaid_maps_skip_cleanup.js"   # 真机验证过的组合, 过 frida 反调试

MAIN_JS = """
'use strict';
send({type:'armed'});
function hexb(p,n){try{return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join('');}catch(e){return '';}}
function head(p,n){try{return p.readCString(n);}catch(e){return '';}}
var got_dfp=false;
try{
  var r=new ApiResolver('module');
  r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
    Interceptor.attach(m.address,{onEnter:function(a){
      var len=a[2].toInt32();
      if(len<50||len>50000)return;
      var h=head(a[1],Math.min(len,1500));
      if(h.indexOf('dfpReport')>=0){
        got_dfp=true;
        send({type:'dfp',len:len,hex:hexb(a[1],len)});
      }
    }});
  });
  send({type:'hooked'});
}catch(e){send({type:'err',e:String(e)});}
try{
  var r2=new ApiResolver('module');
  r2.enumerateMatchesSync('exports:*!SSL_read').forEach(function(m){
    Interceptor.attach(m.address,{onEnter:function(a){this.buf=a[1];},
      onLeave:function(ret){
        var nn=ret.toInt32();
        if(nn<=0||nn>4000)return;
        send({type:'resp',len:nn,hex:hexb(this.buf,nn)});
      }});
  });
  send({type:'readhooked'});
}catch(e){send({type:'readerr',e:String(e)});}
"""


def one_try(d, attempt, result):
    subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE], capture_output=True)
    time.sleep(1.2)
    pid = d.spawn([PACKAGE])
    print(f"[att{attempt}] spawn pid={pid}", flush=True)
    s = d.attach(pid)
    # 挂起内加载 bypass (快速)
    try:
        sc = s.create_script((RE/"evidence/scripts"/BYPASS).read_text()); sc.load()
    except Exception as e:
        print(f"[att{attempt}] bypass err {e}", flush=True)
    d.resume(pid)
    print("[att%d] resumed (bypass loaded)" % attempt, flush=True)

    got_dfp = False
    def on_main(m, dd):
        nonlocal got_dfp
        if m.get('type') == 'error':
            print(f"[att{attempt}] JSErr {str(m)[:100]}", flush=True); return
        p = m.get('payload') or {}
        t = p.get('type')
        if t == 'hooked':
            print(f"[att{attempt}] SSL_write hooked", flush=True)
        elif t == 'dfp':
            got_dfp = True
            print(f"[att{attempt}] dfpReport len={p['len']}", flush=True)
            result['dfp_wire'] = p['hex']
            result['dfp_pid'] = pid
        elif t == 'resp':
            # 保存 606B 响应 (可能含 actionV)
            result.setdefault('resps', []).append({'len': p['len'], 'hex': p['hex']})
            if p['len'] == 606:
                av = re.search(rb'actionV\(([0-9a-f]{40})', bytes.fromhex(p['hex'] or ''))
                mark = f" actionV={av.group(1).decode()}" if av else ""
            else:
                mark = ""
            print(f"[att{attempt}] resp len={p['len']}{mark}", flush=True)

    mainsc = s.create_script(MAIN_JS)
    mainsc.on('message', on_main)
    mainsc.load()

    # 观察 ~15s 内抓 dfp (dfp 启动即发, 快)
    t0 = time.time()
    while time.time() - t0 < 15:
        time.sleep(2)
        if got_dfp:
            time.sleep(3)  # 再等一帧响应
            break
    # 确认拿到 dfp 且其响应缺失则不强求
    print(f"[att{attempt}] 结束观察, got_dfp={got_dfp}", flush=True)
    try: d.kill(pid)
    except: pass
    return got_dfp


def main():
    d = frida.get_device_manager().add_remote_device(REMOTE)
    result = {}
    for attempt in range(1, 6):
        try:
            ok = one_try(d, attempt, result)
            if ok and result.get('dfp_wire'):
                print(f"[*] SUCCESS att{attempt}: dfp_wire_len={len(result['dfp_wire'])//2}$", flush=True)
                json.dump(result, open(OUT, 'w'), indent=2)
                print(f"[*] saved {OUT}", flush=True)
                return
        except Exception as e:
            print(f"[att{attempt}] ERR {repr(e)}", flush=True)
            time.sleep(2)
    print("[*] 5 次均未抓到 dfpReport", flush=True)


if __name__ == "__main__":
    main()