Update main.cpp

This commit is contained in:
gggaa2152 2026-04-06 18:37:57 +08:00 committed by GitHub
parent 397476079e
commit 904ae3770d
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -26,45 +26,52 @@ struct {
typedef EGLBoolean (*p_eglSwapBuffers)(EGLDisplay dpy, EGLSurface surface);
static p_eglSwapBuffers old_eglSwapBuffers = nullptr;
// 对应日志中的底层符号: android::InputConsumer::consume(...)
typedef int (*p_InputConsumer_consume)(void* instance, void* factory, bool consumeBatches, int64_t frameTime, uint32_t* outSeq, void** outEvent);
static p_InputConsumer_consume old_consume = nullptr;
// --- 底层输入钩子 ---
// --- 核心修复:直接读取 MotionEvent 内存 ---
// Android MotionEvent 结构体在不同版本略有差异,但 getX(0) 通常位于固定偏移
void handle_motion_event(void* event) {
if (!event) return;
static auto _getType = (int (*)(void*))dlsym(RTLD_DEFAULT, "AInputEvent_getType");
static auto _getAction = (int (*)(void*))dlsym(RTLD_DEFAULT, "AMotionEvent_getAction");
static auto _getPointerCount = (size_t (*)(void*))dlsym(RTLD_DEFAULT, "AMotionEvent_getPointerCount");
static auto _getX = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getX");
static auto _getY = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getY");
if (_getType && _getType(event) == AINPUT_EVENT_TYPE_MOTION) {
int action = _getAction(event) & AMOTION_EVENT_ACTION_MASK;
// 获取第一根手指的坐标
float x = _getX(event, 0);
float y = _getY(event, 0);
if (x >= 0 && y >= 0) {
g_TouchData.x = x;
g_TouchData.y = y;
if (action == AMOTION_EVENT_ACTION_DOWN) {
g_TouchData.down = true;
} else if (action == AMOTION_EVENT_ACTION_UP || action == AMOTION_EVENT_ACTION_CANCEL) {
g_TouchData.down = false;
}
// LOGI("Touch Catch: %.f, %.f, state: %d", x, y, g_TouchData.down);
}
}
}
// 输入钩子
int hook_InputConsumer_consume(void* instance, void* factory, bool consumeBatches, int64_t frameTime, uint32_t* outSeq, void** outEvent) {
int result = old_consume(instance, factory, consumeBatches, frameTime, outSeq, outEvent);
// 如果成功获取到事件包
if (result == 0 && outEvent && *outEvent) {
void* event = *outEvent;
// 动态获取解析函数,防止库加载顺序问题
static auto _getType = (int (*)(void*))dlsym(RTLD_DEFAULT, "AInputEvent_getType");
static auto _getAction = (int (*)(void*))dlsym(RTLD_DEFAULT, "AMotionEvent_getAction");
static auto _getX = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getX");
static auto _getY = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getY");
if (_getType && _getType(event) == AINPUT_EVENT_TYPE_MOTION) {
int action = _getAction(event) & AMOTION_EVENT_ACTION_MASK;
float x = _getX(event, 0);
float y = _getY(event, 0);
// 存入全局变量供 ImGui 使用
if (x >= 0 && y >= 0) {
g_TouchData.x = x;
g_TouchData.y = y;
if (action == AMOTION_EVENT_ACTION_DOWN) g_TouchData.down = true;
else if (action == AMOTION_EVENT_ACTION_UP || action == AMOTION_EVENT_ACTION_CANCEL) g_TouchData.down = false;
}
}
handle_motion_event(*outEvent);
}
return result;
}
// --- 渲染钩子函数 ---
// 渲染钩子
EGLBoolean hook_eglSwapBuffers(EGLDisplay dpy, EGLSurface surface) {
if (!g_Initialized) {
LOGI("Initializing ImGui...");
EGLint width, height;
eglQuerySurface(dpy, surface, EGL_WIDTH, &width);
eglQuerySurface(dpy, surface, EGL_HEIGHT, &height);
@ -72,18 +79,19 @@ EGLBoolean hook_eglSwapBuffers(EGLDisplay dpy, EGLSurface surface) {
ImGui::CreateContext();
ImGuiIO& io = ImGui::GetIO();
io.DisplaySize = ImVec2((float)width, (float)height);
io.ConfigFlags |= ImGuiConfigFlags_IsTouchScreen; // 开启触摸标志
io.ConfigFlags |= ImGuiConfigFlags_IsTouchScreen;
ImGui::GetStyle().ScaleAllSizes(3.0f);
ImGui_ImplOpenGL3_Init("#version 300 es");
g_Initialized = true;
LOGI("ImGui Full Init Success: %d x %d", width, height);
}
// --- 关键:将底层捕获的输入喂给 ImGui ---
ImGuiIO& io = ImGui::GetIO();
// 关键修复:同步坐标到 ImGui
io.MousePos = ImVec2(g_TouchData.x, g_TouchData.y);
io.MouseDown[0] = g_TouchData.down;
io.DeltaTime = 1.0f / 60.0f; // 维持恒定帧时,防止拖拽失效
ImGui_ImplOpenGL3_NewFrame();
ImGui::NewFrame();
@ -93,15 +101,15 @@ EGLBoolean hook_eglSwapBuffers(EGLDisplay dpy, EGLSurface surface) {
ImGui::SetNextWindowSize(ImVec2(600, 450), ImGuiCond_FirstUseEver);
if (ImGui::Begin("AndKitty Menu", &g_ShowMenu)) {
ImGui::TextColored(ImVec4(1,1,0,1), "Plugin Status: ACTIVE");
ImGui::Text("Input: %.0f, %.0f (%s)", g_TouchData.x, g_TouchData.y, g_TouchData.down ? "DOWN" : "UP");
ImGui::TextColored(ImVec4(0, 1, 0, 1), "Plugin Status: ACTIVE");
ImGui::Text("Input: %.1f, %.1f (%s)", g_TouchData.x, g_TouchData.y, g_TouchData.down ? "DOWN" : "UP");
ImGui::Separator();
static bool test_check = true;
ImGui::Checkbox("Test Feature", &test_check);
if (ImGui::Button("Close Menu")) {
g_ShowMenu = false;
// g_ShowMenu = false;
}
}
ImGui::End();
@ -114,26 +122,25 @@ EGLBoolean hook_eglSwapBuffers(EGLDisplay dpy, EGLSurface surface) {
}
void* init_thread(void*) {
LOGI("Step 1: Thread Started, sleeping 10s...");
LOGI("Plugin thread started. Waiting for libs...");
sleep(10);
// 1. Hook 渲染 (eglSwapBuffers)
// 1. Hook eglSwapBuffers
void* egl_addr = dlsym(RTLD_DEFAULT, "eglSwapBuffers");
if (egl_addr) {
DobbyHook(egl_addr, (void*)hook_eglSwapBuffers, (void**)&old_eglSwapBuffers);
LOGI("Hooked eglSwapBuffers");
LOGI("eglSwapBuffers Hooked.");
}
// 2. Hook 底层输入 (InputConsumer::consume)
// 使用你 Frida 跑出来的那个精准符号
// 2. Hook InputConsumer::consume (符号来自你的日志)
const char* consume_sym = "_ZN7android13InputConsumer7consumeEPNS_26InputEventFactoryInterfaceEblPjPPNS_10InputEventE";
void* consume_addr = dlsym(RTLD_DEFAULT, consume_sym);
if (consume_addr) {
DobbyHook(consume_addr, (void*)hook_InputConsumer_consume, (void**)&old_consume);
LOGI("Hooked InputConsumer::consume Successfully!");
LOGI("AInputQueue_getEvent Hooked at %p", consume_addr);
} else {
LOGI("Failed to find InputConsumer::consume symbol!");
LOGI("Failed to find Input symbol!");
}
return nullptr;