不知道写了什么太卡了，回退

.idea/.gitignore

@@ -3,3 +3,5 @@
 /workspace.xml
 # Editor-based HTTP Client requests
 /httpRequests/
+# GitHub Copilot persisted chat sessions
+/copilot/chatSessions

agent/bocai/HookYDSJ.js

@@ -0,0 +1,179 @@
+import {logColor, LogColor} from "../logger";
+const IS_SAVE_ALL_JS = false;
+const TARGET_PACKAGE = "com.rbigkic.yyydsj";
+
+const targetModuleName = "libcocos2djs.so";
+let TAGET_DATA_FILES = `/data/data/${TARGET_PACKAGE}/files`;
+
+const PROJECT_PATH = `${TAGET_DATA_FILES}/project.js`;
+const RE_PROJECT_PATH = `${TAGET_DATA_FILES}/index.jsc`;
+
+export let HookYDSJ = {
+    start: function () {
+        Java.perform(function () {
+            Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"), {
+                onEnter: function (args) {
+                    var soName = args[0].readCString();
+                    // console.log("dlopen called with: " + soName);
+                    // 获取正在加载的模块的名称
+                    var moduleName = Memory.readUtf8String(args[0]);
+                    this.isTargetModule = (moduleName.indexOf(targetModuleName) !== -1);
+                },
+                onLeave: function (ret) {
+                    if (this.isTargetModule) {
+                        HookYDSJ.hook();
+                    }
+                }
+            });
+        })
+    }, hook: function () {
+        logColor("HookLDGP start", LogColor.RED_BG);
+        let addressBase = Module.findBaseAddress(targetModuleName);
+
+        function saveString(scriptString) {
+
+            logColor("=======开始写入========", LogColor.GREEN_TEXT);
+            var file = new File(PROJECT_PATH, "wb");
+            file.write(scriptString);
+            file.flush();
+            file.close();
+            logColor("=======写入完成========", LogColor.GREEN_TEXT);
+        }
+
+        function createDir(saveFilePath) {
+            let path = require('path'); // 引入path模块，假设Frida环境支持或者有类似的路径处理方法
+
+            // 分离目录路径和文件名
+            let dirPath = path.dirname(saveFilePath);
+            let fileName = path.basename(saveFilePath);
+
+            // 检查目录是否存在，不存在则创建
+            Java.perform(function () {
+                // 使用 Java 的 File 类
+                var File = Java.use("java.io.File");
+
+                // 目标目录路径
+
+                // 创建 File 对象表示这个目录
+                var targetDir = File.$new(dirPath);
+
+                // 检查目录是否存在
+                if (!targetDir.exists()) {
+                    // 目录不存在，尝试创建目录
+                    var success = targetDir.mkdirs();
+                    if (success) {
+                        logColor("目录创建成功:" + saveFilePath, LogColor.GREEN_TEXT)
+                    } else {
+                        logColor("目录创建失败:" + saveFilePath, LogColor.RED_TEXT)
+                    }
+                } else {
+                    logColor("目录已存在:" + saveFilePath, LogColor.RED_TEXT)
+                }
+            });
+        }
+        function saveAllJs(args) {
+            if (IS_SAVE_ALL_JS) {
+                let saveFilePath = `${TAGET_DATA_FILES}/saved_js/`;
+                //判断saveFilePath是否存在,不存在则创建
+                if (!args[4].isNull()) {//这个应该是别名
+                    var jsName = args[4].readUtf8String();
+                    let filePath = `${saveFilePath}${jsName}`;
+                    createDir(filePath);
+                    var scriptString = args[1].readUtf8String();
+
+                    logColor(`=======开始写入--${jsName}--========`, LogColor.GREEN_TEXT);
+                    var file = new File(filePath, "wb");
+                    file.write(scriptString);
+                    file.flush();
+                    file.close();
+                    logColor(`=======写入--${jsName}--完成========`, LogColor.GREEN_TEXT);
+                }
+            }
+            return IS_SAVE_ALL_JS;
+        }
+
+        try {
+            logColor("addressBase: " + addressBase, LogColor.RED_BG);
+            Module.ensureInitialized(targetModuleName);
+            var targetFunctionAddress = addressBase.add(0x000008E3FE4);
+            Interceptor.attach(targetFunctionAddress, {
+                onEnter: function (args) {
+                    // console.log("evalString Function called");
+                    //判断args是否为空
+                    if (args === null) {
+                        console.log("evalString Function args is null");
+                        return;
+                    }
+
+                    //用颜色打印所有的参数
+                    if (!args[4].isNull()) {//这个应该是别名
+                        var contextName = args[4].readUtf8String();
+                        console.log("脚本别名" + contextName);
+                        var scriptLength = args[2].toInt32();
+                        console.log("Length of code: " + scriptLength);
+
+                        if (saveAllJs(args)){
+                            logColor("----------保存所有脚本-----", LogColor.RED_BG);
+                            return;
+                        }
+
+                        if (contextName.indexOf("assets/main/index.jsc") !== -1) {
+                            //保存最新的版本
+                            // var scriptString = args[1].readUtf8String();
+                            // console.log("JavaScript scriptString: " + scriptString);
+                            // saveString(scriptString);
+                            // return 1;
+
+                            this.replaced = 1;
+                            //获取当前时间
+                            this.startTime = new Date().getTime();
+                            // return 1;
+
+                            var env = Java.vm.getEnv();
+
+                            let libCliSo = Module.load("/data/data/com.rbigkic.yyydsj/files/libcli.so");
+                            logColor("libCliSo: " + libCliSo, LogColor.GREEN_TEXT);
+                            let readFileAddress = libCliSo.findExportByName("readFile");
+                            logColor("readFile: " + readFileAddress, LogColor.GREEN_TEXT);
+                            let readFile = new NativeFunction(readFileAddress, 'pointer', ['pointer', "pointer"]);
+                            let filePath = Memory.allocUtf8String(RE_PROJECT_PATH);
+
+                            let jByteArray = readFile(env.handle, filePath);
+                            // 处理返回的 jbyteArray
+                            var length = env.getArrayLength(jByteArray);
+                            var buffer = env.getByteArrayElements(jByteArray, null);
+                            args[1] = ptr(buffer);
+                            args[2] = ptr(length);
+                            // TraceTools.crash2Trace(this.context);
+
+                            // var scriptEngine = args[0];
+                            // console.log("JavaScript scriptEngine add: " + scriptEngine);
+                            //
+                            // var reProjectJs = readProjectJs();
+                            // args[1] = reProjectJs.buffer;
+                            // args[2] = reProjectJs.length;
+                            // args[3] = reProjectJs.addPtr;
+                            // logColor("reProjectJs: " + reProjectJs.length, LogColor.RED_BG);
+                            //
+                            var scriptLength = args[2].toInt32();
+                            console.log("Length of code: " + scriptLength);
+                            //
+                            console.log("Result storage: " + args[3] + " typeof:" + typeof args[3]);
+                        }
+                    }
+                },
+                onLeave: function (retval) {
+                    //尝试所有类型的返回值
+                    if (this.replaced) {
+                        console.log("json 替换结果:", retval.toInt32() === 1);
+                        var endTime = new Date().getTime();
+                        console.log("耗时: " + (endTime - this.startTime) + "ms");
+                    }
+                }
+            });
+        } catch (e) {
+
+            console.log("error: " + e);
+        }
+    }
+}

agent/index.ts

@@ -1,12 +1,13 @@
-import {hooklinker} from "./hooklinker";
+// import {hooklinker} from "./hooklinker";
 import {SafeSelf} from "./safeSelf";
 import {dumper} from "./dumper";
 import {HookGameCenter} from "./HookGameCenter";
-import {HookJavaLog} from "./tools/HookJavaLog";
+import {HookYDSJ} from "./bocai/HookYDSJ";
+// import {HookJavaLog} from "./tools/HookJavaLog";
 
 // SafeSelf.start();
 // SafeSelf.hook_dlopen();
-SafeSelf.hook_dlopen("libmsaoaidsec.so");
+// SafeSelf.hook_dlopen("libmsaoaidsec.so");
 setImmediate(main)
 
 function main() {
@@ -15,10 +16,11 @@ function main() {
     //     Java.perform(() => {
     //         HookGameCenter.startHook()
     //     })
-    HookJavaLog.testHookJavaLog()
+    // HookJavaLog.testHookJavaLog()
     // init_array 通用模板的注入
-    hooklinker.start();
+    // hooklinker.start();
     // dumper.start();
+    HookYDSJ.start()
 }
 
 

agent/tools/logger.ts

@@ -0,0 +1,143 @@
+
+const DEBUG: boolean = false;
+const INTOOLS: boolean = false;
+export function log(msg: string): void {
+    if (DEBUG) {
+        log4Android(msg);
+    } else {
+
+        console.log(msg);
+    }
+}
+export function log4AndroidD(msg: string,tag:string): void {
+    let log = "android.util.Log";
+    let log_cls = Java.use(log);
+    log_cls.d(tag, msg);
+}
+export function log4AndroidV(msg: string,tag:string): void {
+    let log = "android.util.Log";
+    let log_cls = Java.use(log);
+    log_cls.v(tag, msg);
+}
+export function log4AndroidI(msg: string,tag:string): void {
+    let log = "android.util.Log";
+    let log_cls = Java.use(log);
+    log_cls.i(tag, msg);
+}
+export function log4AndroidW(msg: string,tag:string): void {
+    let log = "android.util.Log";
+    let log_cls = Java.use(log);
+    log_cls.w(tag, msg);
+}
+export function log4AndroidE(msg: string,tag:string): void {
+    let log = "android.util.Log";
+    let log_cls = Java.use(log);
+    log_cls.e(tag, msg);
+}
+export function log4Android(msg: string): void {
+    let log = "android.util.Log";
+    let log_cls = Java.use(log);
+    log_cls.w("Dumper", msg);
+}
+export function  logHHex(pointer :NativePointer) :void {
+    let s = hexdump(pointer, {
+        offset: 0,
+        length: 64,
+        header: true,
+        ansi: true
+    });
+
+    console.log(s);
+}
+export function  logHHexLength(pointer :NativePointer,length: number) :void {
+    console.log(hexdump(pointer, {
+        offset: 0,
+        length: length,
+        header: true,
+        ansi: true
+    }));
+}
+export function logColor(message: string, type: number): void {
+
+    if (DEBUG) {
+        log4Android(message);
+        return;
+    }
+    if (INTOOLS){
+        log(message)
+        return;
+    }
+    if (type == undefined) {
+        log(message)
+
+        return;
+    }
+    switch (type) {
+        case LogColor.WHITE_TEXT:
+        case LogColor.WHITE_BG:
+            log(message);
+            break;
+        case LogColor.RED_TEXT:
+        case LogColor.RED_BG:
+            console.error(message);
+            break;
+        case LogColor.YELLOW_TEXT:
+        case LogColor.YELLOW_BG:
+            console.warn(message);
+            break;
+        default:
+            console.log("\x1b[" + type + "m" + message + "\x1b[0m");
+            break;
+
+    }
+
+}
+
+export var LogColor = {
+    // STANDARD TEXT COLORS
+    BLACK_TEXT: 30,
+    RED_TEXT: 31,
+    GREEN_TEXT: 32,
+    YELLOW_TEXT: 33,
+    BLUE_TEXT: 34,
+    MAGENTA_TEXT: 35,
+    CYAN_TEXT: 36,
+    WHITE_TEXT: 37,
+
+    // EXTENDED TEXT COLORS (BRIGHT VERSIONS)
+    BRIGHT_BLACK_TEXT: 90,
+    BRIGHT_RED_TEXT: 91,
+    BRIGHT_GREEN_TEXT: 92,
+    BRIGHT_YELLOW_TEXT: 93,
+    BRIGHT_BLUE_TEXT: 94,
+    BRIGHT_MAGENTA_TEXT: 95,
+    BRIGHT_CYAN_TEXT: 96,
+    BRIGHT_WHITE_TEXT: 97,
+
+    // STANDARD BACKGROUND COLORS
+    BLACK_BG: 40,
+    RED_BG: 41,
+    GREEN_BG: 42,
+    YELLOW_BG: 43,
+    BLUE_BG: 44,
+    MAGENTA_BG: 45,
+    CYAN_BG: 46,
+    WHITE_BG: 47,
+
+    // EXTENDED BACKGROUND COLORS (BRIGHT VERSIONS)
+    BRIGHT_BLACK_BG: 100,
+    BRIGHT_RED_BG: 101,
+    BRIGHT_GREEN_BG: 102,
+    BRIGHT_YELLOW_BG: 103,
+    BRIGHT_BLUE_BG: 104,
+    BRIGHT_MAGENTA_BG: 105,
+    BRIGHT_CYAN_BG: 106,
+    BRIGHT_WHITE_BG: 107
+}
+
+
+
+
+
+
+