param( [string]$Package = 'com.kuaishou.nebula', [string]$Script = 'tools\frida_probe_passport_wcfg.js', [string]$OutDir = 'out', [int]$PostLaunchDelaySeconds = 8, [switch]$LaunchIfMissing, [switch]$PrintOnly ) $ErrorActionPreference = 'Stop' function Get-MainPidByAdb { param([string]$Pkg) try { $pidText = (& adb shell pidof $Pkg 2>$null) $pidText = if ($pidText) { ($pidText | Out-String).Trim() } else { '' } if ($pidText) { $seen = @{} foreach ($candidate in (($pidText -split '\s+') | Where-Object { $_ -match '^\d+$' })) { $status = (& adb shell cat "/proc/$candidate/status" 2>$null | Out-String) $tgidMatch = [regex]::Match($status, '(?m)^Tgid:\s+(\d+)\s*$') if (-not $tgidMatch.Success) { continue } $tgid = $tgidMatch.Groups[1].Value if ($seen.ContainsKey($tgid)) { continue } $seen[$tgid] = $true $cmdline = (& adb shell cat "/proc/$tgid/cmdline" 2>$null | Out-String) -replace "`0", '' if ($cmdline.Trim() -eq $Pkg) { return $tgid } } } } catch {} return $null } function Get-MainPidByFridaAppList { param([string]$Pkg) try { $rows = & frida-ps -Uai 2>$null foreach ($row in $rows) { $line = $row.Trim() if ($line -match '^\s*(\d+)\s+.+\s+(.+?)\s*$') { $pidValue = $matches[1] $ident = $matches[2].Trim() if ($ident -eq $Pkg) { return $pidValue } } } } catch {} return $null } function Show-Diagnostics { param([string]$Pkg) Write-Host '' Write-Host '[diag] frida-ps -U | Select-String:' try { & frida-ps -U 2>$null | Select-String $Pkg | ForEach-Object { $_.Line } } catch { Write-Host $_ } Write-Host '' Write-Host '[diag] frida-ps -Uai | Select-String:' try { & frida-ps -Uai 2>$null | Select-String $Pkg | ForEach-Object { $_.Line } } catch { Write-Host $_ } Write-Host '' Write-Host '[diag] adb shell ps -A | Select-String:' try { & adb shell ps -A 2>$null | Select-String $Pkg | ForEach-Object { $_.Line } } catch { Write-Host $_ } } if (!(Test-Path $Script)) { throw "Frida script not found: $Script" } if (!(Test-Path $OutDir)) { New-Item -ItemType Directory -Path $OutDir | Out-Null } $scriptPath = (Resolve-Path $Script).ProviderPath $outDirPath = (Resolve-Path $OutDir).ProviderPath $appPid = Get-MainPidByFridaAppList -Pkg $Package if (-not $appPid) { $appPid = Get-MainPidByAdb -Pkg $Package } if (-not $appPid -and $LaunchIfMissing) { Write-Host "[launch] main process missing, launching $Package ..." & adb shell monkey -p $Package 1 | Out-Null Write-Host "[launch] wait ${PostLaunchDelaySeconds}s for Java/APP runtime warmup ..." Start-Sleep -Seconds $PostLaunchDelaySeconds $appPid = Get-MainPidByFridaAppList -Pkg $Package if (-not $appPid) { $appPid = Get-MainPidByAdb -Pkg $Package } } if (-not $appPid) { Write-Host "[MISS] main process not found for package=$Package" Write-Host ' Only child processes like :push_v3/:push_mini/:messagesdk may be visible.' Write-Host ' Bring the main UI/login page to foreground, or add -LaunchIfMissing.' Show-Diagnostics -Pkg $Package exit 2 } $ts = Get-Date -Format 'yyyyMMdd_HHmmss' $log = Join-Path $outDirPath ("probe_passport_wcfg_{0}_{1}.log" -f $ts, $appPid) Write-Host ("APP_PID={0}" -f $appPid) Write-Host ("SCRIPT={0}" -f $scriptPath) Write-Host ("LOG={0}" -f $log) if ($PrintOnly) { Write-Host 'PRINT_ONLY=1' exit 0 } Write-Host 'Attaching main process. Finish login flow, then press Ctrl+C to exit Frida.' & frida -U -p $appPid -l $scriptPath 2>&1 | Tee-Object -FilePath $log