// 假设 libil2cpp.so 已经被加载
var module = Process.findModuleByName("libil2cpp.so");

if (module) {
    console.log("[+] libil2cpp.so Found at Base Address: " + module.base);

    // RVA 地址 (Relative Virtual Address)
    const RVA_KEY_BUILDER_KEY = 0x1b77308;        // KeyBuilder::Key(Int32 size)
    const RVA_KEY_BUILDER_IV = 0x1b7737c;         // KeyBuilder::IV(Int32 size)
    const RVA_RC4_DECRYPT_OVERLAP_RET = 0x2473C80; // RC4_DecryptBufferOverlapped 返回前 (获取明文)

    // 计算实际的绝对地址 (Native Pointer)
    const keyBuilderKeyPtr = module.base.add(RVA_KEY_BUILDER_KEY);
    const keyBuilderIVPtr = module.base.add(RVA_KEY_BUILDER_IV);
    // 注意：我们 Hook 在解密函数返回前的指令，此时数据已经被原地解密
    const rc4DecryptRetPtr = module.base.add(RVA_RC4_DECRYPT_OVERLAP_RET);

    // --- Hook 1 & 2: 捕获 Key 和 IV ---
    hookKeyAndIV(keyBuilderKeyPtr, "RC4 Key");
    hookKeyAndIV(keyBuilderIVPtr, "RC4 IV");

    // --- Hook 3: 捕获解密后的缓冲区 ---
    hookDecryptedBuffer(rc4DecryptRetPtr);

} else {
    console.log("[-] libil2cpp.so NOT found. Check process and module name.");
}

// ----------------------------------------------------------------------
// 辅助函数
// ----------------------------------------------------------------------

function hookKeyAndIV(targetPtr, keyType) {
    Interceptor.attach(targetPtr, {
        onLeave: function (retval) {
            // 在 ARM64 中，返回值通常在 X0 寄存器中，返回的是 Byte[] 对象的指针
            // 在 il2cpp 中，Byte[] 对象通常结构为：
            // [X0] -> Il2CppArray Object
            // + 0x0 (指针) -> Class/VTable
            // + 0x8 (指针) -> Bounds (通常为 null)
            // + 0x10 (Int32) -> Length
            // + 0x14 (Int32) -> Padding
            // + 0x18 (指针) -> 实际数据 (元素 0)
            
            // 假设实际数据从偏移 0x18 开始，长度在 0x10
            var byteArrPtr = retval;
            if (!byteArrPtr.isNull()) {
                var length = byteArrPtr.add(0x10).readInt();
                var dataPtr = byteArrPtr.add(0x18);
                
                // 为了安全，限制读取长度
                if (length > 0 && length < 512) { 
                    var buffer = dataPtr.readByteArray(length);
                    console.log(`\n[+] CAPTURED ${keyType} (${length} bytes):`);
                    console.log(hexdump(buffer, { length: length }));
                } else {
                    console.warn(`[!] ${keyType} length ${length} is suspicious or too large. Skipped reading.`);
                }
            } else {
                console.warn(`[!] ${keyType} generation returned null.`);
            }
        }
    });
}

function hookDecryptedBuffer(targetPtr) {
    Interceptor.attach(targetPtr, {
        onEnter: function (args) {
            // 这个 Hook 点位于 RC4_DecryptBufferOverlapped 快返回之前。
            // 此时 X19 寄存器（在 onEnter/onLeave 中通过 this.context.x19 访问） 
            // 仍然持有 NativeDataView/Byte[] 对象的指针 (来自 sub_2473C2C MOV X19, X0)
            
            var byteArrPtr = this.context.x19;
            if (!byteArrPtr.isNull()) {
                var length = byteArrPtr.add(0x10).readInt(); // 长度在偏移 0x10
                var dataPtr = byteArrPtr.add(0x18);          // 数据在偏移 0x18
                
                // 捕获解密后的数据 (最大 512 字节，或限制为实际长度，取较小值)
                var captureLength = Math.min(length, 512); 
                
                // 确保数据指针有效且长度合理
                if (length > 0) {
                    var buffer = dataPtr.readByteArray(captureLength);
                    console.log(`\n[+] CAPTURED DECRYPTED BUFFER (First ${captureLength}/${length} bytes):`);
                    console.log("    Address (NativeDataView): " + byteArrPtr);
                    console.log("    Data Pointer: " + dataPtr);
                    console.log(hexdump(buffer, { length: captureLength }));
                    
                    // 检查魔术字来确定压缩类型
                    if (buffer && buffer.byteLength >= 4) {
                        var magic = (new Uint8Array(buffer.slice(0, 4)));
                        console.log(`    First 4 bytes (Hex): 0x${magic[0].toString(16).padStart(2, '0')}${magic[1].toString(16).padStart(2, '0')}${magic[2].toString(16).padStart(2, '0')}${magic[3].toString(16).padStart(2, '0')}`);
                        if (magic[0] === 0x1f && magic[1] === 0x8b) {
                             console.log("    !!! LIKELY GZIP/ZLIB COMPRESSED DATA !!!");
                        }
                        // LZ4 文件头是 0x04224D18 (小端序) 或 0x184D2204 (大端序)
                        // 字节数组 magic[0]=0x18, magic[1]=0x4d, magic[2]=0x22, magic[3]=0x04
                        if (magic[0] === 0x18 && magic[1] === 0x4d && magic[2] === 0x22 && magic[3] === 0x04) {
                             console.log("    !!! LIKELY LZ4 COMPRESSED DATA !!!");
                        }
                    }
                }
            }
        }
    });
}

frida -U -f "jp.glee.girl" -l hook.js 
Process.enumerateModules()

frida-ps -U #查看PID为 28902
frida -H 127.0.0.1:27042 -p 28902 -l hook.js --realm emulated 
#如果报错提示Failed to attach: process is not using emulation则移除 --realm emulated
Process.enumerateModules()

cat /proc/PID/maps

78d540735000-78d540dfa000 rw-p 00000000 08:23 6423855                    /data/media/0/Android/data/jp.glee.girl/files/il2cpp/Metadata/global-metadata.dat