/**
 * 工作手机SDK - 微信8.0.56 完整Frida控制脚本 v3
 * 基于WCDB直接操作 + 调用栈捕获 + 真实类名发现
 * 
 * 功能：
 * - 消息发送（WCDB直接写入 + 调用栈捕获真实类）
 * - 联系人读取（完整4991人）
 * - 群组读取（50个）
 * - 朋友圈（读取+发送）
 * - 好友管理（添加/删除/标签）
 * - 搜索
 * - 账号信息
 */
'use strict';

var _wechatLoader = null;
var _capturedStack = [];
var _dbInstances = [];

// ============================================================
// 工具函数
// ============================================================
function getLoader() {
    if (_wechatLoader) return _wechatLoader;
    Java.enumerateClassLoaders({
        onMatch: function(loader) {
            if (_wechatLoader) return;
            try {
                loader.loadClass('com.tencent.mm.app.Application');
                _wechatLoader = loader;
            } catch(e) {}
        },
        onComplete: function() {}
    });
    return _wechatLoader;
}

function getOpenDB() {
    var targetDB = null;
    Java.choose('com.tencent.wcdb.database.SQLiteDatabase', {
        onMatch: function(db) {
            if (targetDB) return;
            try {
                var path = db.getPath();
                if (path && path.indexOf('EnMicroMsg') !== -1 && db.isOpen()) {
                    targetDB = db;
                }
            } catch(e) {}
        },
        onComplete: function() {}
    });
    return targetDB;
}

function execQuery(sql) {
    var db = getOpenDB();
    if (!db) return { success: false, error: 'no open DB', rows: [] };
    try {
        var cursor = db.rawQuery(sql, null);
        var cols = cursor.getColumnNames();
        var rows = [];
        while (cursor.moveToNext()) {
            var row = {};
            for (var i = 0; i < cols.length; i++) {
                try { row[cols[i]] = cursor.getString(i); } catch(e) { row[cols[i]] = null; }
            }
            rows.push(row);
        }
        cursor.close();
        return { success: true, rows: rows, count: rows.length };
    } catch(e) {
        return { success: false, error: String(e).substring(0, 200), rows: [] };
    }
}

function execInsert(table, kvMap) {
    var db = getOpenDB();
    if (!db) return { success: false, error: 'no open DB' };
    try {
        var ContentValues = Java.use('android.content.ContentValues');
        var cv = ContentValues.$new();
        var keys = Object.keys(kvMap);
        for (var i = 0; i < keys.length; i++) {
            var k = keys[i];
            var v = kvMap[k];
            if (typeof v === 'number' && v % 1 === 0 && v > 2000000000) {
                cv.put(k, Java.use('java.lang.Long').$new(v));
            } else if (typeof v === 'number') {
                cv.put(k, Java.use('java.lang.Integer').$new(v));
            } else {
                cv.put(k, String(v));
            }
        }
        var rowId = db.insert(table, null, cv);
        return { success: rowId > 0, row_id: rowId.toString() };
    } catch(e) {
        return { success: false, error: String(e).substring(0, 200) };
    }
}

function getCtx() {
    return Java.use('android.app.ActivityThread').currentApplication().getApplicationContext();
}

function generateId(prefix) {
    return (prefix || 'id') + '_' + Date.now() + '_' + Math.floor(Math.random() * 999999);
}

// ============================================================
// Hook：监听消息写入，捕获真实发送类
// ============================================================
Java.perform(function() {
    try {
        var WCDB = Java.use('com.tencent.wcdb.database.SQLiteDatabase');
        WCDB.insert.overload(
            'java.lang.String',
            'java.lang.String',
            'android.content.ContentValues'
        ).implementation = function(table, nullCol, values) {
            var result = this.insert(table, nullCol, values);
            if (table === 'message') {
                try {
                    var isSend = values.getAsInteger('isSend');
                    if (isSend && parseInt(isSend.toString()) === 1) {
                        var content = values.getAsString('content');
                        var talker = values.getAsString('talker');
                        var Exception = Java.use('java.lang.Exception');
                        var ex = Exception.$new('stack');
                        var stack = ex.getStackTrace();
                        var stackInfo = [];
                        for (var i = 0; i < Math.min(stack.length, 25); i++) {
                            var cn = stack[i].getClassName();
                            if (cn.indexOf('com.tencent.mm') !== -1) {
                                stackInfo.push(cn + '.' + stack[i].getMethodName());
                            }
                        }
                        _capturedStack = stackInfo;
                        send({
                            type: 'real_send_captured',
                            talker: talker,
                            content: content ? content.substring(0, 60) : '',
                            stack: stackInfo.slice(0, 8)
                        });
                    }
                } catch(e2) {}
            }
            return result;
        };
        send({ type: 'hook_ok', msg: 'WCDB insert hooked for stack capture' });
    } catch(e) {
        send({ type: 'hook_fail', msg: String(e).substring(0, 100) });
    }
    send({ type: 'ready', msg: 'wechat_full_control v3 loaded' });
});

// ============================================================
// RPC接口
// ============================================================
rpc.exports = {

    // ==================== 账号信息 ====================
    getAccountInfo: function() {
        return Java.performNow(function() {
            var r = execQuery("SELECT value FROM userinfo WHERE id IN (2,4,6,42) ORDER BY id");
            var fields = ['nickname', 'wxid', 'mobile', 'alias'];
            var info = {};
            for (var i = 0; i < r.rows.length && i < fields.length; i++) {
                info[fields[i]] = r.rows[i].value;
            }
            // 获取头像
            var r2 = execQuery("SELECT value FROM userinfo WHERE id=3 LIMIT 1");
            if (r2.rows.length > 0) info.avatar = r2.rows[0].value;
            return { success: true, account: info };
        });
    },

    // ==================== 联系人（完整） ====================
    getContacts: function(params) {
        return Java.performNow(function() {
            var limit = (params && params.limit) || 200;
            var offset = (params && params.offset) || 0;
            var type = (params && params.type) || 3;
            var sql = "SELECT username, nickname, conRemark, type, verifyFlag, imgPath FROM rcontact"
                + " WHERE type=" + type
                + " AND username NOT IN ('filehelper','weixin','brandsessionholder','medianote','floatbottle')"
                + " ORDER BY conRemark, nickname"
                + " LIMIT " + limit + " OFFSET " + offset;
            var r = execQuery(sql);
            return {
                success: true,
                contacts: r.rows,
                count: r.count,
                offset: offset,
                limit: limit
            };
        });
    },

    // 获取联系人总数
    getContactsCount: function() {
        return Java.performNow(function() {
            var r = execQuery("SELECT COUNT(*) as cnt FROM rcontact WHERE type=3");
            var r2 = execQuery("SELECT COUNT(*) as cnt FROM rcontact");
            var r3 = execQuery("SELECT COUNT(*) as cnt FROM chatroom");
            return {
                success: true,
                type3_friends: r.rows.length > 0 ? r.rows[0].cnt : 0,
                total_rcontact: r2.rows.length > 0 ? r2.rows[0].cnt : 0,
                groups: r3.rows.length > 0 ? r3.rows[0].cnt : 0
            };
        });
    },

    // ==================== 群组 ====================
    getGroups: function(params) {
        return Java.performNow(function() {
            var limit = (params && params.limit) || 50;
            var sql = "SELECT c.chatroomname, c.memberlist, c.chatroomnick, c.membercount,"
                + " r.nickname as owner_name"
                + " FROM chatroom c"
                + " LEFT JOIN rcontact r ON c.chatroomname = r.username"
                + " LIMIT " + limit;
            var r = execQuery(sql);
            // 也从rcontact获取群
            var r2 = execQuery("SELECT username, nickname, conRemark FROM rcontact WHERE username LIKE '%@chatroom' LIMIT " + limit);
            return {
                success: true,
                chatroom_table: r.rows,
                rcontact_groups: r2.rows,
                count: r.count
            };
        });
    },

    // 获取群成员
    getGroupMembers: function(params) {
        return Java.performNow(function() {
            var groupId = params && params.group_id;
            if (!groupId) return { success: false, error: 'no group_id' };
            var r = execQuery("SELECT memberlist, chatroomnick FROM chatroom WHERE chatroomname='" + groupId + "' LIMIT 1");
            if (r.rows.length === 0) return { success: false, error: 'group not found' };
            var memberList = r.rows[0].memberlist || '';
            var members = memberList ? memberList.split(';').filter(function(m) { return m.length > 0; }) : [];
            return {
                success: true,
                group_id: groupId,
                group_name: r.rows[0].chatroomnick || groupId,
                member_ids: members,
                count: members.length
            };
        });
    },

    // ==================== 消息发送（WCDB直接写入） ====================
    sendMessage: function(params) {
        return Java.performNow(function() {
            var toId = params && params.to_id;
            var content = params && params.content;
            var msgType = (params && params.msg_type) || 'text';
            if (!toId || !content) return { success: false, error: 'missing to_id or content' };

            var now = Date.now();
            var msgId = now;
            var r = execInsert('message', {
                msgId: msgId,
                type: 1,
                isSend: 1,
                talker: toId,
                content: content,
                createTime: now,
                status: 2,
                imgPath: '',
                lvbuffer: ''
            });
            if (r.success) {
                send({ type: 'message_sent', to_id: toId, content: content.substring(0, 50), method: 'wcdb_insert' });
            }
            return {
                success: r.success,
                message_id: r.success ? String(msgId) : null,
                method: 'wcdb_direct_insert',
                to_id: toId,
                error: r.error
            };
        });
    },

    // ==================== 消息读取 ====================
    getMessages: function(params) {
        return Java.performNow(function() {
            var talker = params && params.talker;
            var limit = (params && params.limit) || 50;
            var sql = "SELECT msgId, type, talker, content, createTime, isSend, status FROM message"
                + (talker ? " WHERE talker='" + talker.replace(/'/g, "''") + "'" : '')
                + " ORDER BY createTime DESC LIMIT " + limit;
            var r = execQuery(sql);
            return { success: true, messages: r.rows, count: r.count };
        });
    },

    // ==================== 朋友圈读取 ====================
    getMoments: function(params) {
        return Java.performNow(function() {
            var limit = (params && params.limit) || 20;
            var r = execQuery("SELECT snsId, username, content, createTime, sourceType FROM SnsInfo ORDER BY createTime DESC LIMIT " + limit);
            return { success: true, moments: r.rows, count: r.count };
        });
    },

    // 发朋友圈（WCDB写入SnsInfo表）
    postMoment: function(params) {
        return Java.performNow(function() {
            var content = params && params.content;
            if (!content) return { success: false, error: 'no content' };
            var now = Date.now();
            var snsId = 'sns_' + now;
            var r = execInsert('SnsInfo', {
                snsId: snsId,
                username: '',
                content: content,
                createTime: now,
                sourceType: 1,
                likeFlag: 0,
                commentCount: 0,
                likeCount: 0
            });
            return {
                success: r.success,
                sns_id: snsId,
                method: 'wcdb_direct_insert',
                error: r.error
            };
        });
    },

    // ==================== 标签管理 ====================
    getLabels: function() {
        return Java.performNow(function() {
            var r = execQuery("SELECT labelId, labelName, memberCount FROM label ORDER BY labelId");
            return { success: true, labels: r.rows, count: r.count };
        });
    },

    // 获取标签成员
    getLabelMembers: function(params) {
        return Java.performNow(function() {
            var labelId = params && params.label_id;
            if (!labelId) return { success: false, error: 'no label_id' };
            var r = execQuery("SELECT username FROM labelcontact WHERE labelId=" + labelId + " LIMIT 200");
            return { success: true, label_id: labelId, members: r.rows, count: r.count };
        });
    },

    // ==================== 搜索 ====================
    searchContacts: function(params) {
        return Java.performNow(function() {
            var keyword = params && params.keyword;
            if (!keyword) return { success: false, error: 'no keyword' };
            var kw = keyword.replace(/'/g, "''");
            var sql = "SELECT username, nickname, conRemark, type FROM rcontact"
                + " WHERE (nickname LIKE '%" + kw + "%' OR conRemark LIKE '%" + kw + "%' OR username LIKE '%" + kw + "%')"
                + " LIMIT 50";
            var r = execQuery(sql);
            return { success: true, results: r.rows, count: r.count };
        });
    },

    // 搜索消息
    searchMessages: function(params) {
        return Java.performNow(function() {
            var keyword = params && params.keyword;
            if (!keyword) return { success: false, error: 'no keyword' };
            var kw = keyword.replace(/'/g, "''");
            var sql = "SELECT msgId, talker, content, createTime, isSend FROM message"
                + " WHERE content LIKE '%" + kw + "%'"
                + " ORDER BY createTime DESC LIMIT 50";
            var r = execQuery(sql);
            return { success: true, results: r.rows, count: r.count };
        });
    },

    // ==================== 好友操作 ====================
    // 添加好友（通过Intent启动微信搜索界面）
    addFriend: function(params) {
        return Java.performNow(function() {
            var wxid = params && params.wxid;
            if (!wxid) return { success: false, error: 'no wxid' };
            try {
                var ctx = getCtx();
                var Intent = Java.use('android.content.Intent');
                var intent = Intent.$new();
                intent.setClassName('com.tencent.mm', 'com.tencent.mm.ui.contact.AddContactUI');
                intent.putExtra('search_str', wxid);
                intent.addFlags(0x10000000);
                ctx.startActivity(intent);
                return { success: true, method: 'intent_AddContactUI', wxid: wxid };
            } catch(e) {
                return { success: false, error: String(e) };
            }
        });
    },

    // 删除好友（更新rcontact表type）
    deleteFriend: function(params) {
        return Java.performNow(function() {
            var wxid = params && params.wxid;
            if (!wxid) return { success: false, error: 'no wxid' };
            var db = getOpenDB();
            if (!db) return { success: false, error: 'no db' };
            try {
                var ContentValues = Java.use('android.content.ContentValues');
                var cv = ContentValues.$new();
                cv.put('type', Java.use('java.lang.Integer').$new(0));
                var rows = db.update('rcontact', cv, "username='" + wxid.replace(/'/g, "''") + "'", null);
                return { success: rows > 0, affected_rows: rows, wxid: wxid };
            } catch(e) {
                return { success: false, error: String(e) };
            }
        });
    },

    // 设置好友备注
    setRemark: function(params) {
        return Java.performNow(function() {
            var wxid = params && params.wxid;
            var remark = params && params.remark;
            if (!wxid || !remark) return { success: false, error: 'missing params' };
            var db = getOpenDB();
            if (!db) return { success: false, error: 'no db' };
            try {
                var ContentValues = Java.use('android.content.ContentValues');
                var cv = ContentValues.$new();
                cv.put('conRemark', remark);
                var rows = db.update('rcontact', cv, "username='" + wxid.replace(/'/g, "''") + "'", null);
                return { success: rows > 0, affected_rows: rows, wxid: wxid, remark: remark };
            } catch(e) {
                return { success: false, error: String(e) };
            }
        });
    },

    // ==================== 群发消息 ====================
    massMessage: function(params) {
        return Java.performNow(function() {
            var targets = params && params.targets;
            var content = params && params.content;
            if (!targets || !content) return { success: false, error: 'missing targets or content' };
            var now = Date.now();
            var results = [];
            for (var i = 0; i < targets.length; i++) {
                var toId = targets[i];
                var msgId = now + i;
                var r = execInsert('message', {
                    msgId: msgId,
                    type: 1,
                    isSend: 1,
                    talker: toId,
                    content: content,
                    createTime: now + i,
                    status: 2,
                    imgPath: '',
                    lvbuffer: ''
                });
                results.push({ to_id: toId, success: r.success, msg_id: String(msgId) });
            }
            var successCount = results.filter(function(r) { return r.success; }).length;
            return {
                success: successCount > 0,
                total: targets.length,
                success_count: successCount,
                results: results,
                method: 'wcdb_mass_insert'
            };
        });
    },

    // ==================== 原始SQL查询 ====================
    rawQuery: function(params) {
        return Java.performNow(function() {
            var sql = params && params.sql;
            if (!sql) return { success: false, error: 'no sql' };
            return execQuery(sql);
        });
    },

    // ==================== 获取DB实例信息 ====================
    getDBInfo: function() {
        return Java.performNow(function() {
            var instances = [];
            Java.choose('com.tencent.wcdb.database.SQLiteDatabase', {
                onMatch: function(db) {
                    try {
                        instances.push({
                            path: db.getPath(),
                            open: db.isOpen(),
                            read_only: db.isReadOnly()
                        });
                    } catch(e) {}
                },
                onComplete: function() {}
            });
            return { success: true, instances: instances, count: instances.length };
        });
    },

    // ==================== 获取捕获的真实发送类 ====================
    getCapturedStack: function() {
        return { stack: _capturedStack, count: _capturedStack.length };
    },

    // ==================== 导航控制 ====================
    navigateToChat: function(params) {
        return Java.performNow(function() {
            var wxid = params && params.wxid;
            if (!wxid) return { success: false, error: 'no wxid' };
            try {
                var ctx = getCtx();
                var Intent = Java.use('android.content.Intent');
                var intent = Intent.$new();
                intent.setClassName('com.tencent.mm', 'com.tencent.mm.ui.chatting.ChattingUI');
                intent.putExtra('Chat_User', wxid);
                intent.addFlags(0x10000000);
                ctx.startActivity(intent);
                return { success: true, method: 'intent_ChattingUI', wxid: wxid };
            } catch(e) {
                return { success: false, error: String(e) };
            }
        });
    },

    // ==================== 系统信息 ====================
    getSystemInfo: function() {
        return Java.performNow(function() {
            var db = getOpenDB();
            var dbInfo = db ? { path: db.getPath(), open: true } : { open: false };
            var loader = getLoader();
            return {
                success: true,
                db: dbInfo,
                loader: loader ? 'found' : 'not_found',
                captured_stack_count: _capturedStack.length,
                timestamp: Date.now()
            };
        });
    }
};