#include #include #include #include #include #include #include #include "dobby.h" #include "imgui.h" #include "imgui_impl_android.h" #include "imgui_impl_opengl3.h" #define TAG "AndKitty_Menu" #define LOGI(...) __android_log_print(ANDROID_LOG_INFO, TAG, __VA_ARGS__) // --- 状态存储 --- static bool g_Initialized = false; static bool g_ShowMenu = true; struct { float x, y; bool down; } g_TouchData = {0, 0, false}; // --- 原函数指针 --- typedef EGLBoolean (*p_eglSwapBuffers)(EGLDisplay dpy, EGLSurface surface); static p_eglSwapBuffers old_eglSwapBuffers = nullptr; typedef int (*p_InputConsumer_consume)(void* instance, void* factory, bool consumeBatches, int64_t frameTime, uint32_t* outSeq, void** outEvent); static p_InputConsumer_consume old_consume = nullptr; // --- 核心修复:直接读取 MotionEvent 内存 --- // Android MotionEvent 结构体在不同版本略有差异,但 getX(0) 通常位于固定偏移 void handle_motion_event(void* event) { if (!event) return; static auto _getType = (int (*)(void*))dlsym(RTLD_DEFAULT, "AInputEvent_getType"); static auto _getAction = (int (*)(void*))dlsym(RTLD_DEFAULT, "AMotionEvent_getAction"); static auto _getPointerCount = (size_t (*)(void*))dlsym(RTLD_DEFAULT, "AMotionEvent_getPointerCount"); static auto _getX = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getX"); static auto _getY = (float (*)(void*, size_t))dlsym(RTLD_DEFAULT, "AMotionEvent_getY"); if (_getType && _getType(event) == AINPUT_EVENT_TYPE_MOTION) { int action = _getAction(event) & AMOTION_EVENT_ACTION_MASK; // 获取第一根手指的坐标 float x = _getX(event, 0); float y = _getY(event, 0); if (x >= 0 && y >= 0) { g_TouchData.x = x; g_TouchData.y = y; if (action == AMOTION_EVENT_ACTION_DOWN) { g_TouchData.down = true; } else if (action == AMOTION_EVENT_ACTION_UP || action == AMOTION_EVENT_ACTION_CANCEL) { g_TouchData.down = false; } // LOGI("Touch Catch: %.f, %.f, state: %d", x, y, g_TouchData.down); } } } // 输入钩子 int hook_InputConsumer_consume(void* instance, void* factory, bool consumeBatches, int64_t frameTime, uint32_t* outSeq, void** outEvent) { int result = old_consume(instance, factory, consumeBatches, frameTime, outSeq, outEvent); if (result == 0 && outEvent && *outEvent) { handle_motion_event(*outEvent); } return result; } // 渲染钩子 EGLBoolean hook_eglSwapBuffers(EGLDisplay dpy, EGLSurface surface) { if (!g_Initialized) { EGLint width, height; eglQuerySurface(dpy, surface, EGL_WIDTH, &width); eglQuerySurface(dpy, surface, EGL_HEIGHT, &height); ImGui::CreateContext(); ImGuiIO& io = ImGui::GetIO(); io.DisplaySize = ImVec2((float)width, (float)height); io.ConfigFlags |= ImGuiConfigFlags_IsTouchScreen; ImGui::GetStyle().ScaleAllSizes(3.0f); ImGui_ImplOpenGL3_Init("#version 300 es"); g_Initialized = true; LOGI("ImGui Full Init Success: %d x %d", width, height); } ImGuiIO& io = ImGui::GetIO(); // 关键修复:同步坐标到 ImGui io.MousePos = ImVec2(g_TouchData.x, g_TouchData.y); io.MouseDown[0] = g_TouchData.down; ImGui_ImplOpenGL3_NewFrame(); ImGui::NewFrame(); if (g_ShowMenu) { ImGui::SetNextWindowPos(ImVec2(100, 100), ImGuiCond_FirstUseEver); ImGui::SetNextWindowSize(ImVec2(600, 450), ImGuiCond_FirstUseEver); if (ImGui::Begin("AndKitty Menu", &g_ShowMenu)) { ImGui::TextColored(ImVec4(0, 1, 0, 1), "Plugin Status: ACTIVE"); ImGui::Text("Input: %.1f, %.1f (%s)", g_TouchData.x, g_TouchData.y, g_TouchData.down ? "DOWN" : "UP"); ImGui::Separator(); static bool test_check = true; ImGui::Checkbox("Test Feature", &test_check); if (ImGui::Button("Close Menu")) { // g_ShowMenu = false; } } ImGui::End(); } ImGui::Render(); ImGui_ImplOpenGL3_RenderDrawData(ImGui::GetDrawData()); return old_eglSwapBuffers(dpy, surface); } void* init_thread(void*) { LOGI("Plugin thread started. Waiting for libs..."); sleep(10); // 1. Hook eglSwapBuffers void* egl_addr = dlsym(RTLD_DEFAULT, "eglSwapBuffers"); if (egl_addr) { DobbyHook(egl_addr, (void*)hook_eglSwapBuffers, (void**)&old_eglSwapBuffers); LOGI("eglSwapBuffers Hooked."); } // 2. Hook InputConsumer::consume (符号来自你的日志) const char* consume_sym = "_ZN7android13InputConsumer7consumeEPNS_26InputEventFactoryInterfaceEblPjPPNS_10InputEventE"; void* consume_addr = dlsym(RTLD_DEFAULT, consume_sym); if (consume_addr) { DobbyHook(consume_addr, (void*)hook_InputConsumer_consume, (void**)&old_consume); LOGI("AInputQueue_getEvent Hooked at %p", consume_addr); } else { LOGI("Failed to find Input symbol!"); } return nullptr; } __attribute__((constructor)) void init_plugin() { pthread_t t; pthread_create(&t, nullptr, init_thread, nullptr); }