param( [string]$Package = 'com.kuaishou.nebula', [string]$Script = 'out\probe_nebula_region_ticket.js', [string]$OutDir = 'out', [int]$LaunchDelayMilliseconds = 750, [switch]$PrintOnly ) $ErrorActionPreference = 'Stop' if ($Package -notmatch '^[A-Za-z0-9_.]+$') { throw "Invalid Android package name: $Package" } if (!(Test-Path -LiteralPath $Script)) { throw "Frida script not found: $Script" } if (!(Test-Path -LiteralPath $OutDir)) { New-Item -ItemType Directory -Path $OutDir | Out-Null } $scriptPath = (Resolve-Path -LiteralPath $Script).ProviderPath $outDirPath = (Resolve-Path -LiteralPath $OutDir).ProviderPath $ts = Get-Date -Format 'yyyyMMdd_HHmmss' $log = Join-Path $outDirPath ("probe_region_startup_fast_{0}.log" -f $ts) Write-Host ("PACKAGE={0}" -f $Package) Write-Host ("SCRIPT={0}" -f $scriptPath) Write-Host ("LOG={0}" -f $log) if ($PrintOnly) { Write-Host 'PRINT_ONLY=1' exit 0 } Write-Host '[startup] stopping existing package processes ...' & adb shell am force-stop $Package | Out-Null $launchJob = Start-Job -ArgumentList $Package,$LaunchDelayMilliseconds -ScriptBlock { param($Pkg, $DelayMilliseconds) Start-Sleep -Milliseconds $DelayMilliseconds & adb shell monkey -p $Pkg -c android.intent.category.LAUNCHER 1 2>&1 | Out-String } try { Write-Host '[startup] waiting for the main process ...' $remoteWait = "while ! pidof $Package; do sleep 0.02; done" $pidText = (& adb shell $remoteWait 2>$null | Out-String).Trim() $candidate = (($pidText -split '\s+') | Where-Object { $_ -match '^\d+$' } | Select-Object -First 1) if (-not $candidate) { throw "Main process did not return a numeric PID: $pidText" } $status = (& adb shell cat "/proc/$candidate/status" 2>$null | Out-String) $tgidMatch = [regex]::Match($status, '(?m)^Tgid:\s+(\d+)\s*$') if (-not $tgidMatch.Success) { throw "Unable to resolve Tgid for PID candidate $candidate" } $appPid = $tgidMatch.Groups[1].Value $cmdline = (& adb shell cat "/proc/$appPid/cmdline" 2>$null | Out-String) -replace "`0", '' if ($cmdline.Trim() -ne $Package) { throw "Resolved PID $appPid is not the main process: $($cmdline.Trim())" } Wait-Job -Job $launchJob -Timeout 10 | Out-Null Receive-Job -Job $launchJob -ErrorAction SilentlyContinue | Out-Null Write-Host ("MAIN_PID={0}" -f $appPid) Write-Host '[startup] attaching Frida immediately; press Ctrl+C to stop ...' & frida -U -p $appPid -l $scriptPath 2>&1 | Tee-Object -FilePath $log } finally { if ($launchJob) { Stop-Job -Job $launchJob -ErrorAction SilentlyContinue Remove-Job -Job $launchJob -Force -ErrorAction SilentlyContinue } }