const TARGET_LIB_NAME = "libmsaoaidsec.so";

function hook_dlopen() {
    ["android_dlopen_ext", "dlopen"].forEach(funcName => {
        let addr = Module.findExportByName(null, funcName);
        if (addr) {
            Interceptor.attach(addr, {
                onEnter(args) {
                    let libName = ptr(args[0]).readCString();
                    if (libName) {
                        console.log(`[+] ${funcName} onEnter: ${libName}`);
                    }
                },
                onLeave: function (retval) {
                    console.log(`[+] ${funcName} onLeave`);
                }
            });
        }
    });
}

hook_dlopen();

const TARGET_LIB_NAME = "libmsaoaidsec.so";

function hook_JNI_OnLoad() {
  // 先尝试通过 `findExportByName`
  let jniOnLoad = Module.findExportByName(TARGET_LIB_NAME, "JNI_OnLoad");

  // 如果找不到，就遍历所有导出符号
  if (!jniOnLoad) {
    console.log("[Info] `JNI_OnLoad` 未导出，尝试遍历导出符号...");
    for (let symbol of module.enumerateSymbols()) {
      if (symbol.name.indexOf("JNI_OnLoad") >= 0) {
        jniOnLoad = symbol.address;
        console.log("[Success] 找到 JNI_OnLoad: ", jniOnLoad);
        break;
      }
    }
  }

  if (!jniOnLoad) {
    console.error("[Error] 未找到 `JNI_OnLoad` 函数");
    return;
  }

  // Hook `JNI_OnLoad`
  Interceptor.attach(jniOnLoad, {
    onEnter(args) {
      console.log("[Hooked] JNI_OnLoad 被调用");
    }
  });
}

function hook_dlopen() {
  ["android_dlopen_ext", "dlopen"].forEach(funcName => {
    let addr = Module.findExportByName(null, funcName);
    if (addr) {
      Interceptor.attach(addr, {
        onEnter(args) {
          let libName = ptr(args[0]).readCString();
          if (libName && libName.indexOf(TARGET_LIB_NAME) >= 0) {
            this.is_can_hook = true;
            console.log(`[+] ${funcName} onEnter: ${libName}`);
          }
        },
        onLeave: function (retval) {
          if (this.is_can_hook) {
            console.log(`[+] ${funcName} onLeave, start hook JNI_OnLoad `);
            hook_JNI_OnLoad()
          }
        }
      });
    }
  });
}

hook_dlopen();

const TARGET_LIB_NAME = "libmsaoaidsec.so";

function find_call_constructors() {
  is64Bit = Process.pointerSize === 8;
  var linkerModule = Process.getModuleByName(is64Bit ? "linker64" : "linker");
  var symbols = linkerModule.enumerateSymbols();
  for (var i = 0; i < symbols.length; i++) {
    if (symbols[i].name.indexOf('call_constructors') > 0) {
      console.warn(`call_constructors symbol name: ${symbols[i].name} address: ${symbols[i].address}`);
      return symbols[i].address;
    }
  }
}

function hook_call_constructors() {
  var ptr_call_constructors = find_call_constructors();
  var listener = Interceptor.attach(ptr_call_constructors, {
    onEnter: function (args) {
      console.warn(`call_constructors onEnter`);
      listener.detach();
    },
  })
}

function hook_dlopen() {
  ["android_dlopen_ext", "dlopen"].forEach(funcName => {
    let addr = Module.findExportByName(null, funcName);
    if (addr) {
      Interceptor.attach(addr, {
        onEnter(args) {
          let libName = ptr(args[0]).readCString();
          if (libName && libName.indexOf(TARGET_LIB_NAME) >= 0) {
            hook_call_constructors();
          }
        },
        onLeave: function (retval) {
        }
      });
    }
  });
}

var is64Bit = Process.pointerSize === 8;
hook_dlopen()

const TARGET_LIB_NAME = "libmsaoaidsec.so";
var TargetLibModule = null;  // 存储目标库模块信息

/////////////////////////////////////////

/**
 * Hook pthread_create，拦截目标库创建的线程
 */
function hook_pthread_create() {
	let pthread_create_addr = Module.findExportByName("libc.so", "pthread_create");
	if (!pthread_create_addr) {
		console.error("Failed to find pthread_create!");
		return;
	}

	Interceptor.attach(pthread_create_addr, {
		onEnter(args) {
			let thread_func_ptr = args[2];  // 线程函数地址
			console.log("[+] pthread_create called, thread function address: " + thread_func_ptr);

			// 确保目标库已加载
			if (!TargetLibModule) {
				//console.warn("Target library not loaded yet!");
				return;
			}

			// 判断线程函数是否在目标库 `so` 的范围内
			if (thread_func_ptr.compare(TargetLibModule.base) > 0 &&
				thread_func_ptr.compare(TargetLibModule.base.add(TargetLibModule.size)) < 0) {

				console.warn("[!] Intercepted thread function at: " + thread_func_ptr +
					" (Offset: " + thread_func_ptr.sub(TargetLibModule.base) + ")");

				// 替换线程函数，防止执行
				Interceptor.replace(thread_func_ptr, new NativeCallback(() => {
					console.log("[*] Fake thread function executed, doing nothing...");
				}, "void", []));
			}
		}
	});
}

function find_call_constructors() {
	is64Bit = Process.pointerSize === 8;
	var linkerModule = Process.getModuleByName(is64Bit ? "linker64" : "linker");
	var symbols = linkerModule.enumerateSymbols();
	for (var i = 0; i < symbols.length; i++) {
		if (symbols[i].name.indexOf('call_constructors') > 0) {
			console.warn(`call_constructors symbol name: ${symbols[i].name} address: ${symbols[i].address}`);
			return symbols[i].address;
		}
	}
}

function hook_call_constructors() {
	var ptr_call_constructors = find_call_constructors();
	var listener = Interceptor.attach(ptr_call_constructors, {
		onEnter: function (args) {
			console.warn(`call_constructors onEnter`);
			if (!TargetLibModule) {
				TargetLibModule = Process.findModuleByName(TARGET_LIB_NAME);
			}
			hook_pthread_create();
			listener.detach();
		},
	})
}

function hook_dlopen() {
	["android_dlopen_ext", "dlopen"].forEach(funcName => {
		let addr = Module.findExportByName(null, funcName);
		if (addr) {
			Interceptor.attach(addr, {
				onEnter(args) {
					let libName = ptr(args[0]).readCString();
					if (libName && libName.indexOf(TARGET_LIB_NAME) >= 0) {
						hook_call_constructors();
					}
				},
				onLeave: function (retval) {
				}
			});
		}
	});
}

var is64Bit = Process.pointerSize === 8;
hook_dlopen()

function nop_code(addr) {
	Memory.patchCode(ptr(addr), 4, code => {
		const cw = new ThumbWriter(code, { pc: ptr(addr) });
		cw.putNop();
		cw.putNop();
		cw.flush();
	})
}

function bypass() {
	nop_code(TargetLibModule.base.add(0xc603 - 1))
}

/**
 * 替换目标库使用的pthread_create函数。
 * @description 该脚本使用 Frida 进行动态分析，主要目标是：
 *  1. 监听 `dlopen` / `android_dlopen_ext`，在加载目标库时执行后续 Hook 操作。
 *  2. 监听 `call_constructors` 以确保目标库完全初始化后再 Hook `dlsym`。
 *  3. Hook `dlsym` 并拦截特定符号（如 `pthread_create`），替换其返回值。
 *  4. 通过 `fake_pthread_create` 生成虚假 `pthread_create` 实现，使目标库无法正确调用线程创建函数。
 */

const TARGET_LIB_NAME = "libmsaoaidsec.so";
var TargetLibModule = null;  // 存储目标库模块信息


function create_fake_pthread_create() {
	const fake_pthread_create = Memory.alloc(4096)
	Memory.protect(fake_pthread_create, 4096, "rwx")
	Memory.patchCode(fake_pthread_create, 4096, code => {
		const cw = new Arm64Writer(code, { pc: ptr(fake_pthread_create) })
		cw.putRet()
	})
	return fake_pthread_create
}

function hook_dlsym() {
	var dlsym = Module.findExportByName(null, "dlsym");
	if (dlsym !== null) {
		Interceptor.attach(dlsym, {
			onEnter: function (args) {
				// 获取调用 dlsym 的返回地址
				let caller = this.context.lr;
				if (caller.compare(TargetLibModule.base) > 0 &&
					caller.compare(TargetLibModule.base.add(TargetLibModule.size)) < 0) {
					var name = ptr(args[1]).readCString(); 		// 读取符号名
					if (name == 'pthread_create') {
						console.warn(`replace symbol name: pthread_create`);
						this.canFake = true;
					}
				}
			},
			onLeave: function (retval) {
				if (this.canFake) {
					retval.replace(fake_pthread_create);
				}
			}
		});
	}
}

function find_call_constructors() {
	is64Bit = Process.pointerSize === 8;
	var linkerModule = Process.getModuleByName(is64Bit ? "linker64" : "linker");
	var symbols = linkerModule.enumerateSymbols();
	for (var i = 0; i < symbols.length; i++) {
		if (symbols[i].name.indexOf('call_constructors') > 0) {
			console.warn(`call_constructors symbol name: ${symbols[i].name} address: ${symbols[i].address}`);
			return symbols[i].address;
		}
	}
}

function hook_call_constructors() {
	var ptr_call_constructors = find_call_constructors();
	var listener = Interceptor.attach(ptr_call_constructors, {
		onEnter: function (args) {
			if (!TargetLibModule) {
				TargetLibModule = Process.findModuleByName(TARGET_LIB_NAME);
			}
			console.warn(`call_constructors onEnter: ${TARGET_LIB_NAME} Module Base: ${TargetLibModule.base}`);
			hook_dlsym();
			listener.detach();
		},
	})
}

function hook_dlopen() {
	["android_dlopen_ext", "dlopen"].forEach(funcName => {
		let addr = Module.findExportByName(null, funcName);
		if (addr) {
			Interceptor.attach(addr, {
				onEnter(args) {
					let libName = ptr(args[0]).readCString();
					if (libName && libName.indexOf(TARGET_LIB_NAME) >= 0) {
						hook_call_constructors();
					}
				},
				onLeave: function (retval) {
				}
			});
		}
	});
}

var is64Bit = Process.pointerSize === 8;
// 创建虚假pthread_create
var fake_pthread_create = create_fake_pthread_create();
hook_dlopen()

function replace_init_proc() {
	if (!TargetLibModule) return;

	// 需要替换的偏移地址列表
	const offsets = [0xc40d, 0x53a9, 0x53e5, 0x53f5];

	offsets.forEach(offset => {
		Interceptor.replace(TargetLibModule.base.add(offset), new NativeCallback(function () {
			console.log(`replace ${offset.toString(16)}`);
		}, "void", []));
	});
}

/*
 * - 监视 `dlopen` 和 `android_dlopen_ext`，拦截 `libmsaoaidsec.so` 的加载。
 * - 跳过其init_proc函数的调用，并通过补丁nop的方式跳过崩溃的函数调用。
 */

const TARGET_LIB_NAME = "libmsaoaidsec.so";
const init_offsets = [0x14400, 0x83fc, 0x8448, 0x8460, 0x84b4, 0x85a8]; // 这里填init函数列表，先通过init_array.js脚本获取
const patch_offsets = [0x8750]; // 这里填需要nop掉的偏移地址
var TargetLibModule = null;     // 存储目标库模块信息



function nop_code(addr) {
    Memory.patchCode(ptr(addr), 4, code => {
        const cw = new Arm64Writer(code, { pc: ptr(addr) });// 64位
        cw.putNop();
        cw.putNop();
        cw.flush();
    })
}

function bypass() {
    patch_offsets.forEach(offset => {
        console.log(`patch ${offset.toString(16)}`);
        nop_code(TargetLibModule.base.add(offset));	// 64位不用减一
    });
}


function find_call_constructors() {
    is64Bit = Process.pointerSize === 8;
    var linkerModule = Process.getModuleByName(is64Bit ? "linker64" : "linker");
    var symbols = linkerModule.enumerateSymbols();
    for (var i = 0; i < symbols.length; i++) {
        if (symbols[i].name.indexOf('call_constructors') > 0) {
            console.warn(`call_constructors symbol name: ${symbols[i].name} address: ${symbols[i].address}`);
            return symbols[i].address;
        }
    }
}

function hook_call_constructors() {
    var ptr_call_constructors = find_call_constructors();
    var listener = Interceptor.attach(ptr_call_constructors, {
        onEnter(args) {
            if (!TargetLibModule) {
                TargetLibModule = Process.findModuleByName(TARGET_LIB_NAME);
            }

            if (TargetLibModule != null) {
                init_offsets.forEach(offset => {
                    Interceptor.replace(TargetLibModule.base.add(offset), new NativeCallback(function () {
                        console.log(`replace ${offset.toString(16)}`);
                    }, "void", []));
                });

                bypass();
                listener.detach()
            }

        },
        onLeave(retval) {
            if (this.shouldSkip) {
                retval.replace(0); // 直接返回，不执行 `.init_array`
            }
        }
    });
}

function hook_dlopen() {
    ["android_dlopen_ext", "dlopen"].forEach(funcName => {
        let addr = Module.findExportByName(null, funcName);
        if (addr) {
            Interceptor.attach(addr, {
                onEnter(args) {
                    let libName = ptr(args[0]).readCString();
                    if (libName && libName.indexOf(TARGET_LIB_NAME) >= 0) {
                        console.warn(`[!] Blocking ${funcName} loading: ${libName}`);
                        hook_call_constructors();
                    }
                },
                onLeave(retval) {
                }
            });
        }
    });
}

var is64Bit = Process.pointerSize === 8;
hook_dlopen();

function nop_code(addr) {
	Memory.patchCode(ptr(addr), 4, code => {
		const cw = new ThumbWriter(code, { pc: ptr(addr) });
		cw.putNop();
		cw.putNop();
		cw.flush();
	})
}

function bypass() {
	nop_code(TargetLibModule.base.add(0xc74d - 1));
}

/**
 * 替换模板库的加载
 */

const TARGET_LIB_NAME = "libmsaoaidsec.so";
const REPLACE_LIB_NAME = "libdummy.so";


function hook_dlopen() {
    ["android_dlopen_ext", "dlopen"].forEach(funcName => {
        let addr = Module.findExportByName(null, funcName);
        if (addr) {
            Interceptor.attach(addr, {
                onEnter(args) {
                    let libName = ptr(args[0]).readCString();
                    if (libName && libName.indexOf(TARGET_LIB_NAME) >= 0) {
                        console.log(`[+] ${funcName} onEnter: ${libName}`);

                        // 替换为加载 REPLACE_LIB_NAME
                        let newLib = Memory.allocUtf8String(REPLACE_LIB_NAME);
                        args[0] = newLib;
                        console.log(`[+] ${funcName}: 替换 ${libName} -> ${REPLACE_LIB_NAME}`);
                    }
                },
                onLeave: function (retval) {
                }
            });
        }
    });
}

hook_dlopen();

/**
适用对象：通用
作用：监控 System.loadLibrary 加载的库文件，替换msaoaidsec的加载。
*/

const TargetLibName = 'msaoaidsec'
const MyLibName = 'dummy'

function hook() {
  const System = Java.use('java.lang.System');
  const Runtime = Java.use('java.lang.Runtime');
  const VMStack = Java.use('dalvik.system.VMStack');

  System.loadLibrary.implementation = function (libName) {
    try {
      console.log('System.loadLibrary("' + libName + '")');
      //printStack(); // 想知道是哪个类加载的可以打开日志

      var name = libName;
      if (libName == TargetLibName) {
        console.warn(`replace ${TargetLibName} as ${MyLibName}`);
        name = MyLibName;
      }
      return Runtime.getRuntime().loadLibrary0(VMStack.getCallingClassLoader(), name);
    } catch (e) {
      //console.log(e);
    }
  }
}


// 打印堆栈
function printStack() {
  Java.perform(function () {
    console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Exception").$new()));
  });
}

hook();

function nop_code(addr) {
	Memory.patchCode(ptr(addr), 4, code => {
		const cw = new Arm64Writer(code, { pc: ptr(addr) });// 64位
		cw.putNop();
		cw.putNop();
		cw.flush();
	})
}

function bypass() {
	nop_code(TargetLibModule.base.add(0x8750));	// 64位不用减一
}

/**
 * Frida Hook - 监视 `pthread_create`，检测目标库创建的线程
 * 
 * 目标：
 * - 监视 `dlopen` 和 `android_dlopen_ext`，检测目标库何时加载。
 * - 通过 `call_constructors` 确保 `pthread_create` Hook 在目标库加载后执行。
 * - 拦截 `pthread_create`，检查线程函数是否在目标库 `so` 的范围内。
 * - 若发现目标库创建的线程，则替换线程函数，阻止其执行。
 * - 并在 JNI_OnLoad 里替换未注册成功的jni函数。
 * 
 * 说明：
 * - `pthread_create` 是创建线程的标准函数，Hook 它可以拦截所有新建线程。
 * - `call_constructors` 由 `linker` 调用，用于执行动态库的全局构造函数。
 * - `hook_call_constructors()` 确保 `TargetLibModule` 记录目标库的基地址，并在适当时机 Hook `pthread_create`。
 */

const TARGET_LIB_NAME = "libmsaoaidsec.so";
var TargetLibModule = null;  // 存储目标库模块信息

/////////////////////////////////////////

/**
 * Hook pthread_create，拦截目标库创建的线程
 */
function hook_pthread_create() {
	let pthread_create_addr = Module.findExportByName("libc.so", "pthread_create");
	if (!pthread_create_addr) {
		console.error("Failed to find pthread_create!");
		return;
	}

	Interceptor.attach(pthread_create_addr, {
		onEnter(args) {
			let thread_func_ptr = args[2];  // 线程函数地址
			console.log("[+] pthread_create called, thread function address: " + thread_func_ptr);

			// 确保目标库已加载
			if (!TargetLibModule) {
				//console.warn("Target library not loaded yet!");
				return;
			}

			// 判断线程函数是否在目标库 `so` 的范围内
			if (thread_func_ptr.compare(TargetLibModule.base) > 0 &&
				thread_func_ptr.compare(TargetLibModule.base.add(TargetLibModule.size)) < 0) {

				console.warn("[!] Intercepted thread function at: " + thread_func_ptr +
					" (Offset: " + thread_func_ptr.sub(TargetLibModule.base) + ")");

				// 替换线程函数，防止执行
				Interceptor.replace(thread_func_ptr, new NativeCallback(() => {
					console.log("[*] Fake thread function executed, doing nothing...");
				}, "void", []));
			}
		}
	});
}

function hook_JNI_OnLoad() {
	// 先尝试通过 `findExportByName`
	let jniOnLoad = Module.findExportByName(TARGET_LIB_NAME, "JNI_OnLoad");

	// 如果找不到，就遍历所有导出符号
	if (!jniOnLoad) {
		console.log("[Info] `JNI_OnLoad` 未导出，尝试遍历导出符号...");
		for (let symbol of module.enumerateSymbols()) {
			if (symbol.name.indexOf("JNI_OnLoad") >= 0) {
				jniOnLoad = symbol.address;
				console.log("[Success] 找到 JNI_OnLoad: ", jniOnLoad);
				break;
			}
		}
	}

	if (!jniOnLoad) {
		console.error("[Error] 未找到 `JNI_OnLoad` 函数");
		return;
	}

	// Hook `JNI_OnLoad`
	Interceptor.attach(jniOnLoad, {
		onEnter(args) {
			console.log("[Hooked] JNI_OnLoad 被调用");
			bypass();
		}
	});
}

function bypass() {
	try {
		var targetClassName = "com.bun.miitmdid.e";
		var targetClass = Java.use(targetClassName);
		console.log("[*] Successfully loaded class: " + targetClass);

		targetClass.a.overloads.forEach(function (overload) {
			overload.implementation = function () {
				console.log("[*] Hooked " + targetClass + ".a() with args: " + JSON.stringify(arguments));
				return 0; // 理论上要返回对应的值，这里粗暴一点随便返回个数值，不影响App正常运行即可。
			};
		});
	} catch (e) {
		console.log("[!] Error: " + e);
	}
}

function find_call_constructors() {
	is64Bit = Process.pointerSize === 8;
	var linkerModule = Process.getModuleByName(is64Bit ? "linker64" : "linker");
	var symbols = linkerModule.enumerateSymbols();
	for (var i = 0; i < symbols.length; i++) {
		if (symbols[i].name.indexOf('call_constructors') > 0) {
			console.warn(`call_constructors symbol name: ${symbols[i].name} address: ${symbols[i].address}`);
			return symbols[i].address;
		}
	}
}

function hook_call_constructors() {
	var ptr_call_constructors = find_call_constructors();
	var listener = Interceptor.attach(ptr_call_constructors, {
		onEnter: function (args) {
			console.warn(`call_constructors onEnter`);
			if (!TargetLibModule) {
				TargetLibModule = Process.findModuleByName(TARGET_LIB_NAME);
			}
			hook_pthread_create();
			listener.detach();
		},
	})
}

function hook_dlopen() {
	["android_dlopen_ext", "dlopen"].forEach(funcName => {
		let addr = Module.findExportByName(null, funcName);
		if (addr) {
			Interceptor.attach(addr, {
				onEnter(args) {
					let libName = ptr(args[0]).readCString();
					if (libName && libName.indexOf(TARGET_LIB_NAME) >= 0) {
						this.is_can_hook = true;
						hook_call_constructors();
					}
				},
				onLeave: function (retval) {
					if (this.is_can_hook) {
						console.log(`[+] ${funcName} onLeave, start hook JNI_OnLoad `);
						hook_JNI_OnLoad();
					}
				}
			});
		}
	});
}

var is64Bit = Process.pointerSize === 8;
hook_dlopen()

function bypass() {
	try {
		var targetClassName = "com.bun.miitmdid.e";
		var targetClass = Java.use(targetClassName);
		console.log("[*] Successfully loaded class: " + targetClass);

		targetClass.a.overloads.forEach(function (overload) {
			overload.implementation = function () {
				console.log("[*] Hooked " + targetClass + ".a() with args: " + JSON.stringify(arguments));
				return 0; // 理论上要返回对应的值，这里粗暴一点随便返回个数值，不影响App正常运行即可。
			};
		});
	} catch (e) {
		console.log("[!] Error: " + e);
	}
}