diff --git a/main.cpp b/main.cpp index 99c8e379a..392767efd 100644 --- a/main.cpp +++ b/main.cpp @@ -26,45 +26,52 @@ struct { typedef EGLBoolean (*p_eglSwapBuffers)(EGLDisplay dpy, EGLSurface surface); static p_eglSwapBuffers old_eglSwapBuffers = nullptr; -// 对应日志中的底层符号: android::InputConsumer::consume(...) typedef int (*p_InputConsumer_consume)(void* instance, void* factory, bool consumeBatches, int64_t frameTime, uint32_t* outSeq, void** outEvent); static p_InputConsumer_consume old_consume = nullptr; -// --- 底层输入钩子 --- +// --- 核心修复：直接读取 MotionEvent 内存 --- +// Android MotionEvent 结构体在不同版本略有差异，但 getX(0) 通常位于固定偏移 +void handle_motion_event(void* event) { + if (!event) return; + + static auto _getType = (int (*)(void*))dlsym(RTLD_DEFAULT, "AInputEvent_getType"); + static auto _getAction = (int (*)(void*))dlsym(RTLD_DEFAULT, "AMotionEvent_getAction"); + static auto _getPointerCount = (size_t (*)(void*))dlsym(RTLD_DEFAULT, "AMotionEvent_getPointerCount"); + static auto _getX = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getX"); + static auto _getY = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getY"); + + if (_getType && _getType(event) == AINPUT_EVENT_TYPE_MOTION) { + int action = _getAction(event) & AMOTION_EVENT_ACTION_MASK; + + // 获取第一根手指的坐标 + float x = _getX(event, 0); + float y = _getY(event, 0); + + if (x >= 0 && y >= 0) { + g_TouchData.x = x; + g_TouchData.y = y; + if (action == AMOTION_EVENT_ACTION_DOWN) { + g_TouchData.down = true; + } else if (action == AMOTION_EVENT_ACTION_UP || action == AMOTION_EVENT_ACTION_CANCEL) { + g_TouchData.down = false; + } + // LOGI("Touch Catch: %.f, %.f, state: %d", x, y, g_TouchData.down); + } + } +} + +// 输入钩子 int hook_InputConsumer_consume(void* instance, void* factory, bool consumeBatches, int64_t frameTime, uint32_t* outSeq, void** outEvent) { int result = old_consume(instance, factory, consumeBatches, frameTime, outSeq, outEvent); - - // 如果成功获取到事件包 if (result == 0 && outEvent && *outEvent) { - void* event = *outEvent; - - // 动态获取解析函数，防止库加载顺序问题 - static auto _getType = (int (*)(void*))dlsym(RTLD_DEFAULT, "AInputEvent_getType"); - static auto _getAction = (int (*)(void*))dlsym(RTLD_DEFAULT, "AMotionEvent_getAction"); - static auto _getX = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getX"); - static auto _getY = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getY"); - - if (_getType && _getType(event) == AINPUT_EVENT_TYPE_MOTION) { - int action = _getAction(event) & AMOTION_EVENT_ACTION_MASK; - float x = _getX(event, 0); - float y = _getY(event, 0); - - // 存入全局变量供 ImGui 使用 - if (x >= 0 && y >= 0) { - g_TouchData.x = x; - g_TouchData.y = y; - if (action == AMOTION_EVENT_ACTION_DOWN) g_TouchData.down = true; - else if (action == AMOTION_EVENT_ACTION_UP || action == AMOTION_EVENT_ACTION_CANCEL) g_TouchData.down = false; - } - } + handle_motion_event(*outEvent); } return result; } -// --- 渲染钩子函数 --- +// 渲染钩子 EGLBoolean hook_eglSwapBuffers(EGLDisplay dpy, EGLSurface surface) { if (!g_Initialized) { - LOGI("Initializing ImGui..."); EGLint width, height; eglQuerySurface(dpy, surface, EGL_WIDTH, &width); eglQuerySurface(dpy, surface, EGL_HEIGHT, &height); @@ -72,18 +79,19 @@ EGLBoolean hook_eglSwapBuffers(EGLDisplay dpy, EGLSurface surface) { ImGui::CreateContext(); ImGuiIO& io = ImGui::GetIO(); io.DisplaySize = ImVec2((float)width, (float)height); - io.ConfigFlags |= ImGuiConfigFlags_IsTouchScreen; // 开启触摸标志 + io.ConfigFlags |= ImGuiConfigFlags_IsTouchScreen; ImGui::GetStyle().ScaleAllSizes(3.0f); ImGui_ImplOpenGL3_Init("#version 300 es"); g_Initialized = true; + LOGI("ImGui Full Init Success: %d x %d", width, height); } - // --- 关键：将底层捕获的输入喂给 ImGui --- ImGuiIO& io = ImGui::GetIO(); + + // 关键修复：同步坐标到 ImGui io.MousePos = ImVec2(g_TouchData.x, g_TouchData.y); io.MouseDown[0] = g_TouchData.down; - io.DeltaTime = 1.0f / 60.0f; // 维持恒定帧时，防止拖拽失效 ImGui_ImplOpenGL3_NewFrame(); ImGui::NewFrame(); @@ -93,15 +101,15 @@ EGLBoolean hook_eglSwapBuffers(EGLDisplay dpy, EGLSurface surface) { ImGui::SetNextWindowSize(ImVec2(600, 450), ImGuiCond_FirstUseEver); if (ImGui::Begin("AndKitty Menu", &g_ShowMenu)) { - ImGui::TextColored(ImVec4(1,1,0,1), "Plugin Status: ACTIVE"); - ImGui::Text("Input: %.0f, %.0f (%s)", g_TouchData.x, g_TouchData.y, g_TouchData.down ? "DOWN" : "UP"); + ImGui::TextColored(ImVec4(0, 1, 0, 1), "Plugin Status: ACTIVE"); + ImGui::Text("Input: %.1f, %.1f (%s)", g_TouchData.x, g_TouchData.y, g_TouchData.down ? "DOWN" : "UP"); ImGui::Separator(); static bool test_check = true; ImGui::Checkbox("Test Feature", &test_check); if (ImGui::Button("Close Menu")) { - g_ShowMenu = false; + // g_ShowMenu = false; } } ImGui::End(); @@ -114,26 +122,25 @@ EGLBoolean hook_eglSwapBuffers(EGLDisplay dpy, EGLSurface surface) { } void* init_thread(void*) { - LOGI("Step 1: Thread Started, sleeping 10s..."); + LOGI("Plugin thread started. Waiting for libs..."); sleep(10); - // 1. Hook 渲染 (eglSwapBuffers) + // 1. Hook eglSwapBuffers void* egl_addr = dlsym(RTLD_DEFAULT, "eglSwapBuffers"); if (egl_addr) { DobbyHook(egl_addr, (void*)hook_eglSwapBuffers, (void**)&old_eglSwapBuffers); - LOGI("Hooked eglSwapBuffers"); + LOGI("eglSwapBuffers Hooked."); } - // 2. Hook 底层输入 (InputConsumer::consume) - // 使用你 Frida 跑出来的那个精准符号 + // 2. Hook InputConsumer::consume (符号来自你的日志) const char* consume_sym = "_ZN7android13InputConsumer7consumeEPNS_26InputEventFactoryInterfaceEblPjPPNS_10InputEventE"; void* consume_addr = dlsym(RTLD_DEFAULT, consume_sym); if (consume_addr) { DobbyHook(consume_addr, (void*)hook_InputConsumer_consume, (void**)&old_consume); - LOGI("Hooked InputConsumer::consume Successfully!"); + LOGI("AInputQueue_getEvent Hooked at %p", consume_addr); } else { - LOGI("Failed to find InputConsumer::consume symbol!"); + LOGI("Failed to find Input symbol!"); } return nullptr;