#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""查询微信DB表结构和真实数据"""
import frida, time, json, subprocess

PHONE_IP = "192.168.110.80"
FRIDA_PORT = 27042
BASE = "/Users/karuo/Documents/开发/2、私域银行/工作手机"
HOOK_JS = BASE + "/sdk/agent/hook/wechat_full_control.js"

# 动态获取PID
result = subprocess.run(
    ["adb", "-s", f"{PHONE_IP}:5555", "shell", "ps -A | grep 'com.tencent.mm$'"],
    capture_output=True, text=True
)
pid_line = result.stdout.strip()
WECHAT_PID = int(pid_line.split()[1]) if pid_line else 9462
print(f"微信PID: {WECHAT_PID}")

dm = frida.get_device_manager()
device = dm.add_remote_device(f"{PHONE_IP}:{FRIDA_PORT}")
session = device.attach(WECHAT_PID)

events = []
def on_msg(m, d):
    if m.get("type") == "send":
        p = m["payload"]
        events.append(p)
        if p.get("type") in ("ready", "hook_ok", "real_send_captured"):
            print(f"  [EVENT:{p.get('type')}] {json.dumps(p, ensure_ascii=False)[:120]}")

with open(HOOK_JS, encoding="utf-8") as f:
    src = f.read()
script = session.create_script(src)
script.on("message", on_msg)
script.load()
time.sleep(3)
rpc = script.exports_sync

schema_info = {}

tables = ["SnsInfo", "label", "labelcontact", "conversation", "message", "rcontact", "chatroom"]
for t in tables:
    r = rpc.raw_query({"sql": f"PRAGMA table_info({t})"})
    cols = [row.get("name","") for row in r.get("rows", [])]
    schema_info[t] = cols
    print(f"\n=== {t} 字段: {cols}")

# 查rcontact type=3前5条
print("\n=== rcontact type=3 前5条 ===")
r6 = rpc.raw_query({"sql": "SELECT username, nickname, conRemark, type FROM rcontact WHERE type=3 LIMIT 5"})
for row in r6.get("rows", []):
    print(f"  {row}")

# 查DB实例
print("\n=== DB实例 ===")
r7 = rpc.get_db_info()
print(json.dumps(r7, ensure_ascii=False, indent=2))

# 查捕获的调用栈
print("\n=== 捕获的调用栈 ===")
r8 = rpc.get_captured_stack()
print(json.dumps(r8, ensure_ascii=False, indent=2))

# 查SnsInfo数据
print("\n=== SnsInfo前3条 ===")
r9 = rpc.raw_query({"sql": "SELECT * FROM SnsInfo LIMIT 3"})
print(json.dumps(r9, ensure_ascii=False, indent=2))

# 查label数据
print("\n=== label前5条 ===")
r10 = rpc.raw_query({"sql": "SELECT * FROM label LIMIT 5"})
print(json.dumps(r10, ensure_ascii=False, indent=2))

# 保存schema
with open(BASE + "/db_schema_20260518.json", "w", encoding="utf-8") as f:
    json.dump(schema_info, f, ensure_ascii=False, indent=2)
print(f"\nSchema已保存")

session.detach()
print("完成！")