live-hub-py/scripts/hook_emu_stable.py

#!/usr/bin/env python3
"""模拟器 稳定版 dfpReport 抓取: spawn→挂起快速加载2个bypass→立即resume→patch_guard+主hook。
内置自动重试(EGL 偶发崩 + 反调试偶发), 一旦抓到 dfpReport+actionV 或达上限即停。
"""
from __future__ import annotations
import frida, time, json, subprocess
from pathlib import Path

REMOTE = "127.0.0.1:31878"
PACKAGE = "com.duowan.kiwi"
RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
OUT = Path("/Users/yml/codes/douyu_login_py/evidence/emu_stable_dfp.json")

MAIN_JS = """
'use strict';
send({type:'armed'});
function hexb(p,n){try{return Array.from(new Uint8Array(p.readByteArray(n))).map(b=>('0'+b.toString(16)).slice(-2)).join('');}catch(e){return '';}}
function head(p,n){try{return p.readCString(n);}catch(e){return '';}}
var n=0;
try{
  var r=new ApiResolver('module');
  r.enumerateMatchesSync('exports:*!SSL_write').forEach(function(m){
    Interceptor.attach(m.address,{onEnter:function(a){
      var len=a[2].toInt32();
      if(len<50||len>50000)return;
      var h=head(a[1],Math.min(len,1500));
      if(h.indexOf('dfpReport')>=0||h.indexOf('dckey')>=0){
        n++; send({cls:h.indexOf('dfpReport')>=0?'dfpReport':'dckey',n:n,len:len,t:Date.now(),hex:hexb(a[1],len)});
      }
    }});
  });
  send({type:'hooked'});
}catch(e){send({type:'err',e:String(e)});}
try{
  var r2=new ApiResolver('module');
  r2.enumerateMatchesSync('exports:*!SSL_read').forEach(function(m){
    Interceptor.attach(m.address,{onEnter:function(a){this.buf=a[1];},
      onLeave:function(ret){
        var nn=ret.toInt32();
        if(nn<=0||nn>4000)return;
        send({type:'resp',len:nn,hex:hexb(this.buf,nn),t:Date.now()});
      }});
  });
  send({type:'readhooked'});
}catch(e){send({type:'readerr',e:String(e)});}
"""


def run_once(d, events, attempt):
    """一次尝试, 成功(抓到 actionV 或 dfp) 返回 True."""
    subprocess.run(["adb","-s","127.0.0.1:5555","shell","am","force-stop",PACKAGE],capture_output=True)
    time.sleep(1.2)
    pid = d.spawn([PACKAGE])
    print(f"[att{attempt}] spawn pid={pid}", flush=True)
    session = d.attach(pid)

    # 挂起时快速加载两个 bypass (极快, 不 sleep)
    def fast_load(path):
        try:
            s = session.create_script(path.read_text()); s.load(); return True
        except Exception as e:
            print(f"  [bypass-load-err] {e}", flush=True); return False
    fast_load(RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js")
    fast_load(RE / "evidence/scripts/mask_frida_maps_only.js")

    # 立即 resume
    d.resume(pid)
    print(f"[att{attempt}] resumed", flush=True)

    got_dfp = False
    def on_main(m, dta):
        nonlocal got_dfp
        if m.get('type') == 'error':
            return
        p = m.get('payload') or {}
        t = p.get('type')
        if t == 'hooked':
            print(f"[att{attempt}] SSL_write hooked", flush=True)
        elif 'cls' in p:
            print(f"[att{attempt}] {p['cls']} len={p['len']}", flush=True)
            events.append(p); OUT.write_text(json.dumps(events))
            if p['cls'] == 'dfpReport':
                got_dfp = True
        elif t == 'resp':
            import re
            av = re.search(rb'actionV\(([0-9a-f]{40})', bytes.fromhex(p.get('hex') or ''))
            mark = f" actionV={av.group(1).decode()}" if av else ""
            print(f"[att{attempt}] RESP len={p['len']}{mark}", flush=True)
            events.append(p); OUT.write_text(json.dumps(events))

    # patch_guard + 主 hook (resume 后)
    try:
        sg = session.create_script((RE/"evidence/scripts/patch_guard_block_termination.js").read_text()); sg.load()
    except Exception as e:
        print(f"  [guard-err] {e}", flush=True)
    sc = session.create_script(MAIN_JS)
    sc.on('message', on_main)
    sc.load()

    # 观察 ~35s, 抓到 dfp 即提前停
    for _ in range(8):
        time.sleep(4)
        if got_dfp:
            # 再等 actionV 响应
            time.sleep(4)
            print(f"[att{attempt}] dfp captured, stopping", flush=True)
            break
    try: d.kill(pid)
    except: pass
    return got_dfp


def main():
    d = frida.get_device_manager().add_remote_device(REMOTE)
    events = []
    for attempt in range(1, 6):  # 最多 5 次
        try:
            if run_once(d, events, attempt):
                print(f"[*] SUCCESS on attempt {attempt}", flush=True)
                break
        except Exception as e:
            print(f"[att{attempt}] ERROR {repr(e)}", flush=True)
            time.sleep(2)
    print(f"[*] done, {len(events)} events, saved {OUT}", flush=True)


if __name__ == "__main__":
    main()