"""静态整理 ``passport_account_image`` / ``WeaponHI.dd(21)`` 链路证据。

这个工具只读 apktool 反编译目录，输出机器可读 JSON。目标不是替代动态
抓证，而是把当前本地 APK 中能静态证明的链路固定下来，避免后续继续靠记忆
判断：

``/f/a/p`` 上传态 ``VIMG_`` → 服务端/配置回写 ``wcfg`` →
``WeaponHI.dd(21)`` 读取 ``wcfg["a_y_q_z"]`` →
账号登录请求 body 注入 ``passport_account_image``。
"""

from __future__ import annotations

import argparse
import base64
import json
import re
import sys
from pathlib import Path
from typing import Any


ROOT = Path(__file__).resolve().parents[1]
DEFAULT_APKTOOL_DIR = ROOT / "out" / "agent_apk_triage" / "apktool"


RELATIVE_FILES = {
    "weaponhi": Path("smali_classes15/com/kuaishou/weapon/i/WeaponHI.smali"),
    "gzip": Path("smali_classes15/com/kuaishou/weapon/ks/i0.smali"),
    "z0": Path("smali_classes15/com/kuaishou/weapon/ks/z0.smali"),
    "x0": Path("smali_classes15/com/kuaishou/weapon/ks/x0.smali"),
    "r1": Path("smali_classes15/com/kuaishou/weapon/ks/r1.smali"),
    "i": Path("smali_classes15/com/kuaishou/weapon/ks/i.smali"),
    "y0": Path("smali_classes15/com/kuaishou/weapon/ks/y0.smali"),
    "zvl_c": Path("smali_classes8/zvl/c.smali"),
}


def _read_lines(path: Path) -> list[str]:
    return path.read_text(encoding="utf-8", errors="ignore").splitlines()


def _rel(path: Path, base: Path) -> str:
    try:
        return path.relative_to(base).as_posix()
    except ValueError:
        return path.as_posix()


def _line_refs(path: Path, base: Path, marker: str, *, limit: int = 20) -> list[dict[str, Any]]:
    if not path.exists():
        return []
    refs: list[dict[str, Any]] = []
    for line_no, line in enumerate(_read_lines(path), 1):
        if marker in line:
            refs.append(
                {
                    "file": _rel(path, base),
                    "line": line_no,
                    "text": line.strip(),
                }
            )
            if len(refs) >= limit:
                break
    return refs


def _first_line(path: Path, base: Path, marker: str) -> dict[str, Any]:
    refs = _line_refs(path, base, marker, limit=1)
    return refs[0] if refs else {}


def _method_bounds(lines: list[str], method_marker: str) -> tuple[int, int] | None:
    start = -1
    for index, line in enumerate(lines):
        if method_marker in line:
            start = index
            break
    if start < 0:
        return None
    end = len(lines)
    for index in range(start + 1, len(lines)):
        if lines[index].strip() == ".end method":
            end = index + 1
            break
    return start, end


def _first_line_in_method(path: Path, base: Path, method_marker: str, marker: str) -> dict[str, Any]:
    if not path.exists():
        return {}
    lines = _read_lines(path)
    bounds = _method_bounds(lines, method_marker)
    if bounds is None:
        return {}
    start, end = bounds
    for index in range(start, end):
        if marker in lines[index]:
            return {
                "file": _rel(path, base),
                "line": index + 1,
                "text": lines[index].strip(),
            }
    return {}


def _exists(path: Path) -> bool:
    return path.exists() and path.is_file()


def _extract_field_string(path: Path, field_name: str) -> str:
    if not path.exists():
        return ""
    pattern = re.compile(rf"\.field\s+public\s+static\s+{re.escape(field_name)}:.*?=\s+\"([^\"]*)\"")
    for line in _read_lines(path):
        match = pattern.search(line)
        if match:
            return match.group(1)
    return ""


def _decode_base64_text(value: str) -> str:
    if not value:
        return ""
    try:
        return base64.b64decode(value).decode("utf-8")
    except Exception:  # noqa: BLE001 - 诊断工具保留空值即可
        return ""


def _grep_tree(root: Path, marker: str, *, subdir: str = "smali_classes15/com/kuaishou/weapon", limit: int = 80) -> list[dict[str, Any]]:
    start = root / subdir
    if not start.exists():
        return []
    refs: list[dict[str, Any]] = []
    for path in start.rglob("*.smali"):
        try:
            lines = _read_lines(path)
        except OSError:
            continue
        for line_no, line in enumerate(lines, 1):
            if marker in line:
                refs.append({"file": _rel(path, root), "line": line_no, "text": line.strip()})
                if len(refs) >= limit:
                    return refs
    return refs


def _file_map(apktool_dir: Path) -> dict[str, Path]:
    return {name: apktool_dir / rel for name, rel in RELATIVE_FILES.items()}


def analyze_static_chain(apktool_dir: str | Path = DEFAULT_APKTOOL_DIR) -> dict[str, Any]:
    """分析本地 smali，返回 ``passport_account_image`` 静态证据报告。"""

    root = Path(apktool_dir)
    if not root.is_absolute():
        root = (ROOT / root).resolve()
    files = _file_map(root)

    encoded_fap = _extract_field_string(files["x0"], "d")
    encoded_cfg_pull = _extract_field_string(files["x0"], "c")
    encoded_cfg_push = _extract_field_string(files["x0"], "b")

    direct_a_y_q_z_refs = _grep_tree(root, "a_y_q_z")
    generic_writer_refs = _grep_tree(root, "Lcom/kuaishou/weapon/ks/z0;->a(ZLjava/lang/String;Ljava/lang/String;)V")

    facts: dict[str, Any] = {
        "files": {
            name: {
                "path": _rel(path, root),
                "exists": _exists(path),
            }
            for name, path in files.items()
        },
        "weaponhi_b_upload_encrypt": {
            "summary": "WeaponHI.b(str) = str.getBytes -> i0.a([B) GZIP -> MXSec.atlasEncrypt(privacykit, UUID, 0, bytes) -> Base64",
            "method": _first_line(files["weaponhi"], root, ".method public static b(Ljava/lang/String;)Ljava/lang/String;"),
            "gzip_call": _first_line_in_method(
                files["weaponhi"],
                root,
                ".method public static b(Ljava/lang/String;)Ljava/lang/String;",
                "Lcom/kuaishou/weapon/ks/i0;->a([B)[B",
            ),
            "gzip_impl": _first_line(files["gzip"], root, "Ljava/util/zip/GZIPOutputStream;"),
            "product": _first_line_in_method(
                files["weaponhi"],
                root,
                ".method public static b(Ljava/lang/String;)Ljava/lang/String;",
                'const-string v1, "privacykit"',
            ),
            "sdk_id": _first_line_in_method(
                files["weaponhi"],
                root,
                ".method public static b(Ljava/lang/String;)Ljava/lang/String;",
                'const-string v2, "7e46b28a-8c93-4940-8238-4c60e64e3c81"',
            ),
            "atlas_encrypt": _first_line_in_method(
                files["weaponhi"],
                root,
                ".method public static b(Ljava/lang/String;)Ljava/lang/String;",
                "->atlasEncrypt(Ljava/lang/String;Ljava/lang/String;I[B)[B",
            ),
            "base64": _first_line_in_method(
                files["weaponhi"],
                root,
                ".method public static b(Ljava/lang/String;)Ljava/lang/String;",
                "Lcom/kuaishou/weapon/ks/q;->c([BI)Ljava/lang/String;",
            ),
        },
        "weaponhi_dd21_read": {
            "summary": "WeaponHI.dd(21) 先复用内存 img；不是 VIMG_ 时读取 SharedPreferences wcfg['a_y_q_z'] 并缓存回 img",
            "method": _first_line(files["weaponhi"], root, ".method public static dd(I)Ljava/lang/String;"),
            "vimg_cache_guard": _first_line_in_method(
                files["weaponhi"],
                root,
                ".method public static dd(I)Ljava/lang/String;",
                'const-string v0, "VIMG_"',
            ),
            "z0_singleton": _first_line_in_method(
                files["weaponhi"],
                root,
                ".method public static dd(I)Ljava/lang/String;",
                "Lcom/kuaishou/weapon/ks/z0;->a(Landroid/content/Context;)Lcom/kuaishou/weapon/ks/z0;",
            ),
            "wcfg_key": _first_line_in_method(
                files["weaponhi"],
                root,
                ".method public static dd(I)Ljava/lang/String;",
                'const-string v0, "a_y_q_z"',
            ),
            "z0_get_string": _first_line_in_method(
                files["weaponhi"],
                root,
                ".method public static dd(I)Ljava/lang/String;",
                "Lcom/kuaishou/weapon/ks/z0;->a(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;",
            ),
        },
        "z0_wcfg_store": {
            "summary": "z0 构造函数打开 SharedPreferences 'wcfg'；a(String,String) 读取 getString；a(boolean,key,value) 是通用 putString 写入",
            "open_wcfg": _first_line_in_method(
                files["z0"],
                root,
                ".method public constructor <init>(Landroid/content/Context;)V",
                'const-string v0, "wcfg"',
            ),
            "get_shared_preferences": _first_line_in_method(
                files["z0"],
                root,
                ".method public constructor <init>(Landroid/content/Context;)V",
                "->getSharedPreferences(Ljava/lang/String;I)Landroid/content/SharedPreferences;",
            ),
            "get_string": _first_line_in_method(
                files["z0"],
                root,
                ".method public a(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;",
                "->getString(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String;",
            ),
            "generic_write_method": _first_line(files["z0"], root, ".method public a(ZLjava/lang/String;Ljava/lang/String;)V"),
            "put_string": _first_line_in_method(
                files["z0"],
                root,
                ".method public a(ZLjava/lang/String;Ljava/lang/String;)V",
                "SharedPreferences$Editor;->putString(Ljava/lang/String;Ljava/lang/String;)",
            ),
        },
        "passport_map_injection": {
            "summary": "账号登录公共参数开关 ugAccoutNetAddRiskParam 开启时调用 WeaponHI.dd(0x15)，再 put('passport_account_image', value)",
            "switch": _first_line(files["zvl_c"], root, 'const-string v2, "ugAccoutNetAddRiskParam"'),
            "dd21_call": _first_line(files["zvl_c"], root, "Lcom/kuaishou/weapon/i/WeaponHI;->dd(I)Ljava/lang/String;"),
            "map_key": _first_line(files["zvl_c"], root, 'const-string v1, "passport_account_image"'),
            "map_put": _first_line(files["zvl_c"], root, "Ljava/util/Map;->put(Ljava/lang/Object;Ljava/lang/Object;)Ljava/lang/Object;"),
        },
        "fap_upload": {
            "summary": "x0.d 解码为 /f/a/p；r1.a 组 JSON {data: 'VIMG_'+WeaponHI.b(payload)} 后经 i/y0 POST",
            "encoded_endpoint": encoded_fap,
            "decoded_endpoint": _decode_base64_text(encoded_fap),
            "encoded_cfg_pull_endpoint": encoded_cfg_pull,
            "decoded_cfg_pull_endpoint": _decode_base64_text(encoded_cfg_pull),
            "encoded_cfg_push_endpoint": encoded_cfg_push,
            "decoded_cfg_push_endpoint": _decode_base64_text(encoded_cfg_push),
            "x0_endpoint_line": _first_line(files["x0"], root, f'"{encoded_fap}"') if encoded_fap else {},
            "r1_weaponhi_b_call": _first_line(files["r1"], root, "Lcom/kuaishou/weapon/i/WeaponHI;->b(Ljava/lang/String;)Ljava/lang/String;"),
            "r1_vimg_prefix": _first_line(files["r1"], root, 'const-string v4, "VIMG_"'),
            "r1_payload_data_key": _first_line(files["r1"], root, 'const-string v5, "data"'),
            "r1_http_dispatch": _first_line(files["r1"], root, "Lcom/kuaishou/weapon/ks/i;->a(Landroid/content/Context;Lcom/kuaishou/weapon/ks/k1;)Ljava/lang/String;"),
            "okhttp_execute": _first_line(files["i"], root, "Lokhttp3/Call;->execute()Lokhttp3/Response;"),
            "urlconnection_post": _first_line(files["y0"], root, 'const-string v2, "POST"'),
        },
        "wcfg_writer_search": {
            "summary": "静态全库只发现 dd(21) 处直接出现 a_y_q_z；写入端更像服务端响应驱动的通用 key/value 落盘，需要动态证据确认具体 value",
            "direct_a_y_q_z_refs": direct_a_y_q_z_refs,
            "direct_a_y_q_z_write_found": any("putString" in item["text"] for item in direct_a_y_q_z_refs),
            "generic_z0_writer_refs": generic_writer_refs,
        },
    }

    proven = {
        "weaponhi_b_upload_encrypt": bool(
            facts["weaponhi_b_upload_encrypt"]["method"]
            and facts["weaponhi_b_upload_encrypt"]["gzip_call"]
            and facts["weaponhi_b_upload_encrypt"]["atlas_encrypt"]
        ),
        "weaponhi_dd21_reads_a_y_q_z": bool(
            facts["weaponhi_dd21_read"]["method"]
            and facts["weaponhi_dd21_read"]["wcfg_key"]
            and facts["weaponhi_dd21_read"]["z0_get_string"]
        ),
        "z0_uses_wcfg": bool(facts["z0_wcfg_store"]["open_wcfg"] and facts["z0_wcfg_store"]["get_string"]),
        "passport_map_injection": bool(
            facts["passport_map_injection"]["dd21_call"] and facts["passport_map_injection"]["map_key"]
        ),
        "fap_upload_endpoint": facts["fap_upload"]["decoded_endpoint"] == "/f/a/p",
        "direct_local_a_y_q_z_writer": bool(facts["wcfg_writer_search"]["direct_a_y_q_z_write_found"]),
    }

    chain = [
        "r1.a(payload, context) 构造上传态 VIMG_ + WeaponHI.b(payload)",
        "x0.d Base64 解码后命中 /f/a/p",
        "i/y0 发送 POST 并返回响应字符串",
        "wcfg 通用写入方法 z0.a(boolean,key,value) 可写任意 key",
        "WeaponHI.dd(21) 读取 wcfg['a_y_q_z']",
        "zvl.c 把 dd(21) 结果注入 passport_account_image",
    ]

    unresolved = []
    if not proven["direct_local_a_y_q_z_writer"]:
        unresolved.append(
            "未在 smali 中发现硬编码 a_y_q_z 的本地写入；最终 VIMG_...$AI_... 仍需 /f/a/p 响应或 wcfg 动态抓证。"
        )
    if not all(proven[key] for key in ("weaponhi_b_upload_encrypt", "weaponhi_dd21_reads_a_y_q_z", "z0_uses_wcfg", "passport_map_injection", "fap_upload_endpoint")):
        unresolved.append("部分静态锚点缺失，需检查 apktool 目录是否对应当前 APP 版本。")

    return {
        "apktool_dir": str(root),
        "facts": facts,
        "proven": proven,
        "chain": chain,
        "pure_calc_status": {
            "upload_vimg_building_block": bool(proven["weaponhi_b_upload_encrypt"]),
            "final_passport_ticket": "server_or_wcfg_state",
            "final_ticket_offline_proven": False,
            "next_evidence": [
                "抓 /f/a/p 返回体完整内容",
                "抓 z0.a(boolean,key,value) 或 SharedPreferences.Editor.putString 写入 a_y_q_z 的 value_full",
                "对比写入 value 与随后 mobile/checker / login body 的 passport_account_image",
            ],
        },
        "unresolved": unresolved,
    }


def build_parser() -> argparse.ArgumentParser:
    parser = argparse.ArgumentParser(description="静态整理 passport_account_image / WeaponHI.dd(21) 链路证据")
    parser.add_argument("--apktool-dir", default=str(DEFAULT_APKTOOL_DIR), help="apktool 反编译目录")
    parser.add_argument("--out", default="", help="可选 JSON 输出路径")
    parser.add_argument("--pretty", action="store_true", help="格式化 JSON 输出")
    return parser


def main() -> int:
    args = build_parser().parse_args()
    result = analyze_static_chain(args.apktool_dir)
    text = json.dumps(result, ensure_ascii=False, indent=2 if args.pretty else None)
    if args.out:
        out = Path(args.out)
        if not out.is_absolute():
            out = ROOT / out
        out.parent.mkdir(parents=True, exist_ok=True)
        out.write_text(text + "\n", encoding="utf-8")
        print(f"[OK] 写入 {out}")
    print(text)
    return 0


if __name__ == "__main__":
    raise SystemExit(main())