diff --git a/main.cpp b/main.cpp index 7ad5340c4..99c8e379a 100644 --- a/main.cpp +++ b/main.cpp @@ -1,22 +1,21 @@ #include -#include +#include +#include #include #include -#include -#include +#include +#include +#include "dobby.h" #include "imgui.h" #include "imgui_impl_android.h" #include "imgui_impl_opengl3.h" -#include "dobby.h" -#include -#define LOG_TAG "AndKitty_Final" -#define LOGI(...) __android_log_print(ANDROID_LOG_INFO, LOG_TAG, __VA_ARGS__) +#define TAG "AndKitty_Menu" +#define LOGI(...) __android_log_print(ANDROID_LOG_INFO, TAG, __VA_ARGS__) // --- 状态存储 --- static bool g_Initialized = false; static bool g_ShowMenu = true; -static float g_Width = 0, g_Height = 0; struct { float x, y; @@ -24,117 +23,123 @@ struct { } g_TouchData = {0, 0, false}; // --- 原函数指针 --- -// 对应日志中的符号: android::InputConsumer::consume(...) -typedef int (*p_InputConsumer_consume)(void* instance, void* factory, bool consumeBatches, nsecs_t frameTime, uint32_t* outSeq, void** outEvent); -static p_InputConsumer_consume old_consume = nullptr; - typedef EGLBoolean (*p_eglSwapBuffers)(EGLDisplay dpy, EGLSurface surface); static p_eglSwapBuffers old_eglSwapBuffers = nullptr; -// --- 核心底层 Hook --- -int hook_InputConsumer_consume(void* instance, void* factory, bool consumeBatches, nsecs_t frameTime, uint32_t* outSeq, void** outEvent) { - // 先执行原函数，获取事件 +// 对应日志中的底层符号: android::InputConsumer::consume(...) +typedef int (*p_InputConsumer_consume)(void* instance, void* factory, bool consumeBatches, int64_t frameTime, uint32_t* outSeq, void** outEvent); +static p_InputConsumer_consume old_consume = nullptr; + +// --- 底层输入钩子 --- +int hook_InputConsumer_consume(void* instance, void* factory, bool consumeBatches, int64_t frameTime, uint32_t* outSeq, void** outEvent) { int result = old_consume(instance, factory, consumeBatches, frameTime, outSeq, outEvent); - // result == 0 说明成功消耗了一个事件 (OK) + // 如果成功获取到事件包 if (result == 0 && outEvent && *outEvent) { void* event = *outEvent; - - // 这里的 event 实际上是 android::MotionEvent* - // 我们通过导入 libandroid.so 的函数来解析这个对象，这是最稳妥的，不需要管偏移 - typedef int (*p_getType)(void*); - typedef int (*p_getAction)(void*); - typedef float (*p_getX)(void*, size_t); - typedef float (*p_getY)(void*, size_t); - static p_getType _getType = (p_getType)dlsym(RTLD_DEFAULT, "AInputEvent_getType"); - static p_getAction _getAction = (p_getAction)dlsym(RTLD_DEFAULT, "AMotionEvent_getAction"); - static p_getX _getX = (p_getX)dlsym(RTLD_DEFAULT, "AMotionEvent_getX"); - static p_getY _getY = (p_getY)dlsym(RTLD_DEFAULT, "AMotionEvent_getY"); + // 动态获取解析函数，防止库加载顺序问题 + static auto _getType = (int (*)(void*))dlsym(RTLD_DEFAULT, "AInputEvent_getType"); + static auto _getAction = (int (*)(void*))dlsym(RTLD_DEFAULT, "AMotionEvent_getAction"); + static auto _getX = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getX"); + static auto _getY = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getY"); - if (_getType && _getType(event) == 1) { // AINPUT_EVENT_TYPE_MOTION - int action = _getAction(event) & 0xFF; // AMOTION_EVENT_ACTION_MASK + if (_getType && _getType(event) == AINPUT_EVENT_TYPE_MOTION) { + int action = _getAction(event) & AMOTION_EVENT_ACTION_MASK; float x = _getX(event, 0); float y = _getY(event, 0); + // 存入全局变量供 ImGui 使用 if (x >= 0 && y >= 0) { g_TouchData.x = x; g_TouchData.y = y; - if (action == 0) g_TouchData.down = true; // ACTION_DOWN - else if (action == 1) g_TouchData.down = false; // ACTION_UP - else if (action == 3) g_TouchData.down = false; // ACTION_CANCEL + if (action == AMOTION_EVENT_ACTION_DOWN) g_TouchData.down = true; + else if (action == AMOTION_EVENT_ACTION_UP || action == AMOTION_EVENT_ACTION_CANCEL) g_TouchData.down = false; } } } return result; } -// --- 渲染逻辑 --- +// --- 渲染钩子函数 --- EGLBoolean hook_eglSwapBuffers(EGLDisplay dpy, EGLSurface surface) { - if (g_Width <= 0) { - EGLint w, h; - eglQuerySurface(dpy, surface, EGL_WIDTH, &w); - eglQuerySurface(dpy, surface, EGL_HEIGHT, &h); - g_Width = (float)w; g_Height = (float)h; - } - if (!g_Initialized) { + LOGI("Initializing ImGui..."); + EGLint width, height; + eglQuerySurface(dpy, surface, EGL_WIDTH, &width); + eglQuerySurface(dpy, surface, EGL_HEIGHT, &height); + ImGui::CreateContext(); ImGuiIO& io = ImGui::GetIO(); - io.DisplaySize = ImVec2(g_Width, g_Height); - io.ConfigFlags |= ImGuiConfigFlags_IsTouchScreen; + io.DisplaySize = ImVec2((float)width, (float)height); + io.ConfigFlags |= ImGuiConfigFlags_IsTouchScreen; // 开启触摸标志 + + ImGui::GetStyle().ScaleAllSizes(3.0f); ImGui_ImplOpenGL3_Init("#version 300 es"); - ImGui::StyleColorsDark(); g_Initialized = true; } - // 强制同步底层拦截到的坐标 + // --- 关键：将底层捕获的输入喂给 ImGui --- ImGuiIO& io = ImGui::GetIO(); io.MousePos = ImVec2(g_TouchData.x, g_TouchData.y); io.MouseDown[0] = g_TouchData.down; - io.DeltaTime = 1.0f / 60.0f; + io.DeltaTime = 1.0f / 60.0f; // 维持恒定帧时，防止拖拽失效 ImGui_ImplOpenGL3_NewFrame(); ImGui::NewFrame(); if (g_ShowMenu) { - ImGui::SetNextWindowSize(ImVec2(500, 400), ImGuiCond_FirstUseEver); - if (ImGui::Begin("AndKitty SGame Final", &g_ShowMenu)) { - ImGui::Text("Touch Pos: %.1f, %.1f", g_TouchData.x, g_TouchData.y); - ImGui::Text("Status: %s", g_TouchData.down ? "DOWN" : "UP"); - static float val = 0.5f; - ImGui::SliderFloat("Slider", &val, 0.0f, 1.0f); + ImGui::SetNextWindowPos(ImVec2(100, 100), ImGuiCond_FirstUseEver); + ImGui::SetNextWindowSize(ImVec2(600, 450), ImGuiCond_FirstUseEver); + + if (ImGui::Begin("AndKitty Menu", &g_ShowMenu)) { + ImGui::TextColored(ImVec4(1,1,0,1), "Plugin Status: ACTIVE"); + ImGui::Text("Input: %.0f, %.0f (%s)", g_TouchData.x, g_TouchData.y, g_TouchData.down ? "DOWN" : "UP"); + ImGui::Separator(); + + static bool test_check = true; + ImGui::Checkbox("Test Feature", &test_check); + + if (ImGui::Button("Close Menu")) { + g_ShowMenu = false; + } } ImGui::End(); } ImGui::Render(); ImGui_ImplOpenGL3_RenderDrawData(ImGui::GetDrawData()); + return old_eglSwapBuffers(dpy, surface); } void* init_thread(void*) { - sleep(5); + LOGI("Step 1: Thread Started, sleeping 10s..."); + sleep(10); - // 1. Hook 渲染 - void* egl = dlsym(RTLD_DEFAULT, "eglSwapBuffers"); - if (egl) DobbyHook(egl, (void*)hook_eglSwapBuffers, (void**)&old_eglSwapBuffers); + // 1. Hook 渲染 (eglSwapBuffers) + void* egl_addr = dlsym(RTLD_DEFAULT, "eglSwapBuffers"); + if (egl_addr) { + DobbyHook(egl_addr, (void*)hook_eglSwapBuffers, (void**)&old_eglSwapBuffers); + LOGI("Hooked eglSwapBuffers"); + } - // 2. Hook 底层输入 (使用日志中发现的符号) - // 注意：libinput.so 在不同系统可能路径不同，直接从内存搜索符号最稳 - void* consume_addr = dlsym(RTLD_DEFAULT, "_ZN7android13InputConsumer7consumeEPNS_26InputEventFactoryInterfaceEblPjPPNS_10InputEventE"); + // 2. Hook 底层输入 (InputConsumer::consume) + // 使用你 Frida 跑出来的那个精准符号 + const char* consume_sym = "_ZN7android13InputConsumer7consumeEPNS_26InputEventFactoryInterfaceEblPjPPNS_10InputEventE"; + void* consume_addr = dlsym(RTLD_DEFAULT, consume_sym); + if (consume_addr) { DobbyHook(consume_addr, (void*)hook_InputConsumer_consume, (void**)&old_consume); - LOGI("Successfully Hooked InputConsumer::consume"); + LOGI("Hooked InputConsumer::consume Successfully!"); } else { - LOGI("Failed to find consume symbol via RTLD_DEFAULT"); + LOGI("Failed to find InputConsumer::consume symbol!"); } return nullptr; } -__attribute__((constructor)) -void entry() { +__attribute__((constructor)) void init_plugin() { pthread_t t; pthread_create(&t, nullptr, init_thread, nullptr); }