# 已知的 data 数组（37字节）
data = [
    0x0A, 0x0C, 0x04, 0x1F, 0x26, 0x6C, 0x43, 0x2D, 0x3C, 0x0C,
    0x54, 0x4C, 0x24, 0x25, 0x11, 0x06, 0x05, 0x3A, 0x7C, 0x51,
    0x38, 0x1A, 0x03, 0x0D, 0x01, 0x36, 0x1F, 0x12, 0x26, 0x04,
    0x68, 0x5D, 0x3F, 0x2D, 0x37, 0x2A, 0x7D
]

n = len(data)

# 假设输入长度为 n，因为 data 有 n 字节，且最后是 }
# 使用递推：input[i+1] = input[i] ^ i ^ data[i]

def recover_flag(start_char):
    inp = [0] * n
    inp[0] = start_char
    for i in range(n - 1):
        inp[i+1] = inp[i] ^ i ^ data[i]
    return bytes(inp).decode('latin1')

# 尝试常见 flag 开头
candidates = ['f', 'c', 'F']

for c in candidates:
    flag = recover_flag(ord(c))
    if flag.endswith('}'):
        print(f"可能的 flag: {flag}")
        # 额外检查是否合理
        if 'flag{' in flag or 'FLAG{' in flag or 'ctf{' in flag:
            print(f"✅ 匹配格式: {flag}")

#!/usr/bin/env python3

import sys
import os

# 定义Payload的起始偏移量
PAYLOAD_OFFSET = 0x48DC8  # 十进制 298440


def extract_payload(input_file, output_file):
    """
    从输入的SO文件中提取Payload并保存到输出文件
    """
    try:
        # 检查输入文件是否存在
        if not os.path.exists(input_file):
            print(f"错误: 输入文件 '{input_file}' 不存在。")
            return False

        with open(input_file, 'rb') as f_in:
            # 跳转到Payload的起始偏移量
            f_in.seek(PAYLOAD_OFFSET)
            # 读取从偏移量开始到文件末尾的所有数据
            payload_data = f_in.read()

        # 检查是否读取到了数据
        if not payload_data:
            print(f"错误: 在偏移量 {PAYLOAD_OFFSET} 之后没有数据。")
            return False

        # 将数据写入输出文件
        with open(output_file, 'wb') as f_out:
            f_out.write(payload_data)

        print(f"成功! Payload 已从 '{input_file}' 提取到 '{output_file}'")
        print(f"提取大小: {len(payload_data)} 字节")
        return True

    except Exception as e:
        print(f"提取过程中发生错误: {e}")
        return False


if __name__ == '__main__':
    # 如果没有提供参数，使用默认路径
    if len(sys.argv) < 3:
        input_file = r"D:\桌面\libshell.so"
        output_file = r"D:\桌面\payload.elf"
        print(f"使用默认路径: 输入文件={input_file}, 输出文件={output_file}")
    else:
        # 使用提供的参数
        input_file = sys.argv[1]
        output_file = sys.argv[2]

    extract_payload(input_file, output_file)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import sys
import struct
from typing import Dict, Tuple, List, Optional


def s1_to_s8(x: int, bits: int) -> int:
    sign = 1 << (bits - 1)
    mask = (1 << bits) - 1
    x &= mask
    return (x ^ sign) - sign


def s16(x: int) -> int:
    return struct.unpack('<h', struct.pack('<H', x & 0xFFFF))[0]


def s32_from_u2(lo: int, hi: int) -> int:
    v = (hi << 16) | lo
    return struct.unpack('<i', struct.pack('<I', v))[0]


def s64_from_u2(u1: int, u2_: int, u3: int, u4: int) -> int:
    lo = (u2_ << 16) | u1
    hi = (u4 << 16) | u3
    v = (hi << 32) | lo
    return struct.unpack('<q', struct.pack('<Q', v & 0xFFFFFFFFFFFFFFFF))[0]


def hex32(n: int) -> str:
    return f"0x{(n & 0xFFFFFFFF):08x}"


def hex16(n: int) -> str:
    return f"0x{(n & 0xFFFF):04x}"


def hex8(n: int) -> str:
    return f"0x{(n & 0xFF):02x}"


OPCODES: Dict[int, Tuple[str, str, Optional[int], Optional[int]]] = {
    0x00: ("nop", "10x", None, None),
    0x01: ("move", "12x", None, None),
    0x02: ("move/from16", "22x", None, None),
    0x03: ("move/16", "32x", None, None),
    0x04: ("move-wide", "12x", None, None),
    0x05: ("move-wide/from16", "22x", None, None),
    0x06: ("move-wide/16", "32x", None, None),
    0x07: ("move-object", "12x", None, None),
    0x08: ("move-object/from16", "22x", None, None),
    0x09: ("move-object/16", "32x", None, None),
    0x0a: ("move-result", "11x", None, None),
    0x0b: ("move-result-wide", "11x", None, None),
    0x0c: ("move-result-object", "11x", None, None),
    0x0d: ("move-exception", "11x", None, None),
    0x0e: ("return-void", "10x", None, None),
    0x0f: ("return", "11x", None, None),
    0x10: ("return-wide", "11x", None, None),
    0x11: ("return-object", "11x", None, None),
    0x12: ("const/4", "11n", None, None),
    0x13: ("const/16", "21s", None, None),
    0x14: ("const", "31i", None, None),
    0x15: ("const/high16", "21ih", None, None),
    0x16: ("const-wide/16", "21s", None, None),
    0x17: ("const-wide/32", "31i", None, None),
    0x18: ("const-wide", "51l", None, None),
    0x19: ("const-wide/high16", "21lh", None, None),
    0x1a: ("const-string", "21c", 0, None),
    0x1b: ("const-string/jumbo", "31c", 0, None),
    0x1c: ("const-class", "21c", 1, None),
    0x1d: ("monitor-enter", "11x", None, None),
    0x1e: ("monitor-exit", "11x", None, None),
    0x1f: ("check-cast", "21c", 1, None),
    0x20: ("instance-of", "22c", 1, None),
    0x21: ("array-length", "12x", None, None),
    0x22: ("new-instance", "21c", 1, None),
    0x23: ("new-array", "22c", 1, None),
    0x24: ("filled-new-array", "35c", 1, None),
    0x25: ("filled-new-array/range", "3rc", 1, None),
    0x26: ("fill-array-data", "31t", None, None),
    0x27: ("throw", "11x", None, None),
    0x28: ("goto", "10t", None, None),
    0x29: ("goto/16", "20t", None, None),
    0x2a: ("goto/32", "30t", None, None),
    0x2b: ("packed-switch", "31t", None, None),
    0x2c: ("sparse-switch", "31t", None, None),
    0x2d: ("cmpl-float", "23x", None, None),
    0x2e: ("cmpg-float", "23x", None, None),
    0x2f: ("cmpl-double", "23x", None, None),
    0x30: ("cmpg-double", "23x", None, None),
    0x31: ("cmp-long", "23x", None, None),
    0x32: ("if-eq", "22t", None, None),
    0x33: ("if-ne", "22t", None, None),
    0x34: ("if-lt", "22t", None, None),
    0x35: ("if-ge", "22t", None, None),
    0x36: ("if-gt", "22t", None, None),
    0x37: ("if-le", "22t", None, None),
    0x38: ("if-eqz", "21t", None, None),
    0x39: ("if-nez", "21t", None, None),
    0x3a: ("if-ltz", "21t", None, None),
    0x3b: ("if-gez", "21t", None, None),
    0x3c: ("if-gtz", "21t", None, None),
    0x3d: ("if-lez", "21t", None, None),

    0x44: ("aget", "23x", None, None),
    0x45: ("aget-wide", "23x", None, None),
    0x46: ("aget-object", "23x", None, None),
    0x47: ("aget-boolean", "23x", None, None),
    0x48: ("aget-byte", "23x", None, None),
    0x49: ("aget-char", "23x", None, None),
    0x4a: ("aget-short", "23x", None, None),
    0x4b: ("aput", "23x", None, None),
    0x4c: ("aput-wide", "23x", None, None),
    0x4d: ("aput-object", "23x", None, None),
    0x4e: ("aput-boolean", "23x", None, None),
    0x4f: ("aput-byte", "23x", None, None),
    0x50: ("aput-char", "23x", None, None),
    0x51: ("aput-short", "23x", None, None),

    0x52: ("iget", "22c", 2, None),
    0x53: ("iget-wide", "22c", 2, None),
    0x54: ("iget-object", "22c", 2, None),
    0x55: ("iget-boolean", "22c", 2, None),
    0x56: ("iget-byte", "22c", 2, None),
    0x57: ("iget-char", "22c", 2, None),
    0x58: ("iget-short", "22c", 2, None),

    0x59: ("iput", "22c", 2, None),
    0x5a: ("iput-wide", "22c", 2, None),
    0x5b: ("iput-object", "22c", 2, None),
    0x5c: ("iput-boolean", "22c", 2, None),
    0x5d: ("iput-byte", "22c", 2, None),
    0x5e: ("iput-char", "22c", 2, None),
    0x5f: ("iput-short", "22c", 2, None),

    0x60: ("sget", "21c", 2, None),
    0x61: ("sget-wide", "21c", 2, None),
    0x62: ("sget-object", "21c", 2, None),
    0x63: ("sget-boolean", "21c", 2, None),
    0x64: ("sget-byte", "21c", 2, None),
    0x65: ("sget-char", "21c", 2, None),
    0x66: ("sget-short", "21c", 2, None),

    0x67: ("sput", "21c", 2, None),
    0x68: ("sput-wide", "21c", 2, None),
    0x69: ("sput-object", "21c", 2, None),
    0x6a: ("sput-boolean", "21c", 2, None),
    0x6b: ("sput-byte", "21c", 2, None),
    0x6c: ("sput-char", "21c", 2, None),
    0x6d: ("sput-short", "21c", 2, None),

    0x6e: ("invoke-virtual", "35c", 3, None),
    0x6f: ("invoke-super", "35c", 3, None),
    0x70: ("invoke-direct", "35c", 3, None),
    0x71: ("invoke-static", "35c", 3, None),
    0x72: ("invoke-interface", "35c", 3, None),

    0x74: ("invoke-virtual/range", "3rc", 3, None),
    0x75: ("invoke-super/range", "3rc", 3, None),
    0x76: ("invoke-direct/range", "3rc", 3, None),
    0x77: ("invoke-static/range", "3rc", 3, None),
    0x78: ("invoke-interface/range", "3rc", 3, None),

    0x7b: ("neg-int", "12x", None, None),
    0x7c: ("not-int", "12x", None, None),
    0x7d: ("neg-long", "12x", None, None),
    0x7e: ("not-long", "12x", None, None),
    0x7f: ("neg-float", "12x", None, None),
    0x80: ("neg-double", "12x", None, None),

    0x81: ("int-to-long", "12x", None, None),
    0x82: ("int-to-float", "12x", None, None),
    0x83: ("int-to-double", "12x", None, None),
    0x84: ("long-to-int", "12x", None, None),
    0x85: ("long-to-float", "12x", None, None),
    0x86: ("long-to-double", "12x", None, None),
    0x87: ("float-to-int", "12x", None, None),
    0x88: ("float-to-long", "12x", None, None),
    0x89: ("float-to-double", "12x", None, None),
    0x8a: ("double-to-int", "12x", None, None),
    0x8b: ("double-to-long", "12x", None, None),
    0x8c: ("double-to-float", "12x", None, None),
    0x8d: ("int-to-byte", "12x", None, None),
    0x8e: ("int-to-char", "12x", None, None),
    0x8f: ("int-to-short", "12x", None, None),

    0x90: ("add-int", "23x", None, None),
    0x91: ("sub-int", "23x", None, None),
    0x92: ("mul-int", "23x", None, None),
    0x93: ("div-int", "23x", None, None),
    0x94: ("rem-int", "23x", None, None),
    0x95: ("and-int", "23x", None, None),
    0x96: ("or-int", "23x", None, None),
    0x97: ("xor-int", "23x", None, None),
    0x98: ("shl-int", "23x", None, None),
    0x99: ("shr-int", "23x", None, None),
    0x9a: ("ushr-int", "23x", None, None),

    0x9b: ("add-long", "23x", None, None),
    0x9c: ("sub-long", "23x", None, None),
    0x9d: ("mul-long", "23x", None, None),
    0x9e: ("div-long", "23x", None, None),
    0x9f: ("rem-long", "23x", None, None),
    0xa0: ("and-long", "23x", None, None),
    0xa1: ("or-long", "23x", None, None),
    0xa2: ("xor-long", "23x", None, None),
    0xa3: ("shl-long", "23x", None, None),
    0xa4: ("shr-long", "23x", None, None),
    0xa5: ("ushr-long", "23x", None, None),

    0xa6: ("add-float", "23x", None, None),
    0xa7: ("sub-float", "23x", None, None),
    0xa8: ("mul-float", "23x", None, None),
    0xa9: ("div-float", "23x", None, None),
    0xaa: ("rem-float", "23x", None, None),

    0xab: ("add-double", "23x", None, None),
    0xac: ("sub-double", "23x", None, None),
    0xad: ("mul-double", "23x", None, None),
    0xae: ("div-double", "23x", None, None),
    0xaf: ("rem-double", "23x", None, None),

    0xb0: ("add-int/2addr", "12x", None, None),
    0xb1: ("sub-int/2addr", "12x", None, None),
    0xb2: ("mul-int/2addr", "12x", None, None),
    0xb3: ("div-int/2addr", "12x", None, None),
    0xb4: ("rem-int/2addr", "12x", None, None),
    0xb5: ("and-int/2addr", "12x", None, None),
    0xb6: ("or-int/2addr", "12x", None, None),
    0xb7: ("xor-int/2addr", "12x", None, None),
    0xb8: ("shl-int/2addr", "12x", None, None),
    0xb9: ("shr-int/2addr", "12x", None, None),
    0xba: ("ushr-int/2addr", "12x", None, None),

    0xbb: ("add-long/2addr", "12x", None, None),
    0xbc: ("sub-long/2addr", "12x", None, None),
    0xbd: ("mul-long/2addr", "12x", None, None),
    0xbe: ("div-long/2addr", "12x", None, None),
    0xbf: ("rem-long/2addr", "12x", None, None),
    0xc0: ("and-long/2addr", "12x", None, None),
    0xc1: ("or-long/2addr", "12x", None, None),
    0xc2: ("xor-long/2addr", "12x", None, None),
    0xc3: ("shl-long/2addr", "12x", None, None),
    0xc4: ("shr-long/2addr", "12x", None, None),
    0xc5: ("ushr-long/2addr", "12x", None, None),

    0xc6: ("add-float/2addr", "12x", None, None),
    0xc7: ("sub-float/2addr", "12x", None, None),
    0xc8: ("mul-float/2addr", "12x", None, None),
    0xc9: ("div-float/2addr", "12x", None, None),
    0xca: ("rem-float/2addr", "12x", None, None),

    0xcb: ("add-double/2addr", "12x", None, None),
    0xcc: ("sub-double/2addr", "12x", None, None),
    0xcd: ("mul-double/2addr", "12x", None, None),
    0xce: ("div-double/2addr", "12x", None, None),
    0xcf: ("rem-double/2addr", "12x", None, None),

    0xd0: ("add-int/lit16", "22s", None, None),
    0xd1: ("rsub-int", "22s", None, None),
    0xd2: ("mul-int/lit16", "22s", None, None),
    0xd3: ("div-int/lit16", "22s", None, None),
    0xd4: ("rem-int/lit16", "22s", None, None),
    0xd5: ("and-int/lit16", "22s", None, None),
    0xd6: ("or-int/lit16", "22s", None, None),
    0xd7: ("xor-int/lit16", "22s", None, None),

    0xd8: ("add-int/lit8", "22b", None, None),
    0xd9: ("rsub-int/lit8", "22b", None, None),
    0xda: ("mul-int/lit8", "22b", None, None),
    0xdb: ("div-int/lit8", "22b", None, None),
    0xdc: ("rem-int/lit8", "22b", None, None),
    0xdd: ("and-int/lit8", "22b", None, None),
    0xde: ("or-int/lit8", "22b", None, None),
    0xdf: ("xor-int/lit8", "22b", None, None),
    0xe0: ("shl-int/lit8", "22b", None, None),
    0xe1: ("shr-int/lit8", "22b", None, None),
    0xe2: ("ushr-int/lit8", "22b", None, None),

    0x0100: ("packed-switch-payload", "pswitch-payload", None, None),
    0x0200: ("sparse-switch-payload", "sswitch-payload", None, None),
    0x0300: ("array-payload", "array-payload", None, None),

    0xfa: ("invoke-polymorphic", "45cc", 3, 4),
    0xfb: ("invoke-polymorphic/range", "4rcc", 3, 4),
    0xfc: ("invoke-custom", "35c", 5, None),
    0xfd: ("invoke-custom/range", "3rc", 5, None),
    0xfe: ("const-method-handle", "21c", 6, None),
    0xff: ("const-method-type", "21c", 4, None),
}


def reg_name(r: int, regs_size: int, ins_size: int) -> str:
    locals_size = max(0, regs_size - ins_size)
    if r >= locals_size:
        return f"p{r - locals_size}"
    return f"v{r}"


def ref_kind_name(kind: Optional[int]) -> str:
    if kind is None:
        return "ref"
    return {
        0: "string",
        1: "type",
        2: "field",
        3: "method",
        4: "proto",
        5: "call_site",
        6: "method_handle",
    }.get(kind, "ref")


class DexFile:
    def __init__(self, path: str):
        with open(path, 'rb') as f:
            self.data: bytes = f.read()
        self.size = len(self.data)
        self._parse_header()
        self._parse_primary_tables()
        self._parse_map_list()
        self._mh_count = 0
        self._mh_off = 0
        self._cs_count = 0
        self._cs_off = 0
        if self.map_items.get(0x0008):  # TYPE_METHOD_HANDLE_ITEM
            self._mh_count, self._mh_off = self.map_items[0x0008]
        if self.map_items.get(0x0007):  # TYPE_CALL_SITE_ID_ITEM
            self._cs_count, self._cs_off = self.map_items[0x0007]

    def _u1(self, off: int) -> int:
        return self.data[off]

    def _u2(self, off: int) -> int:
        return struct.unpack_from('<H', self.data, off)[0]

    def _u4(self, off: int) -> int:
        return struct.unpack_from('<I', self.data, off)[0]

    def _bytes(self, off: int, n: int) -> bytes:
        return self.data[off:off + n]

    def _parse_header(self) -> None:
        if self.size < 0x70:
            raise ValueError("DEX 文件过小")
        self.magic = self._bytes(0, 8)
        self.file_size = self._u4(0x20)
        self.header_size = self._u4(0x24)
        self.endian_tag = self._u4(0x28)
        self.map_off = self._u4(0x34)
        self.string_ids_size = self._u4(0x38)
        self.string_ids_off = self._u4(0x3C)
        self.type_ids_size = self._u4(0x40)
        self.type_ids_off = self._u4(0x44)
        self.proto_ids_size = self._u4(0x48)
        self.proto_ids_off = self._u4(0x4C)
        self.field_ids_size = self._u4(0x50)
        self.field_ids_off = self._u4(0x54)
        self.method_ids_size = self._u4(0x58)
        self.method_ids_off = self._u4(0x5C)

    def _parse_primary_tables(self) -> None:
        self._string_offs: List[int] = []
        for i in range(self.string_ids_size):
            self._string_offs.append(self._u4(self.string_ids_off + i * 4))
        self._string_cache: Dict[int, str] = {}

        self._type_str_idx: List[int] = []
        for i in range(self.type_ids_size):
            self._type_str_idx.append(self._u4(self.type_ids_off + i * 4))

        self._proto_list: List[Tuple[int, int, int]] = []
        for i in range(self.proto_ids_size):
            off = self.proto_ids_off + i * 12
            shorty_idx = self._u4(off + 0)
            return_type_idx = self._u4(off + 4)
            parameters_off = self._u4(off + 8)
            self._proto_list.append((shorty_idx, return_type_idx, parameters_off))

        self._field_list: List[Tuple[int, int, int]] = []
        for i in range(self.field_ids_size):
            off = self.field_ids_off + i * 8
            class_idx = self._u2(off + 0)
            type_idx = self._u2(off + 2)
            name_idx = self._u4(off + 4)
            self._field_list.append((class_idx, type_idx, name_idx))

        self._method_list: List[Tuple[int, int, int]] = []
        for i in range(self.method_ids_size):
            off = self.method_ids_off + i * 8
            class_idx = self._u2(off + 0)
            proto_idx = self._u2(off + 2)
            name_idx = self._u4(off + 4)
            self._method_list.append((class_idx, proto_idx, name_idx))

    def _parse_map_list(self) -> None:
        self.map_items: Dict[int, Tuple[int, int]] = {}
        if self.map_off == 0:
            return
        size = self._u4(self.map_off)
        off = self.map_off + 4
        for _ in range(size):
            if off + 12 > self.size:
                break
            typ = self._u2(off + 0)
            _unused = self._u2(off + 2)
            count = self._u4(off + 4)
            item_off = self._u4(off + 8)
            self.map_items[typ] = (count, item_off)
            off += 12

    def _uleb128(self, off: int) -> Tuple[int, int]:
        result = 0
        shift = 0
        pos = off
        while True:
            b = self._u1(pos)
            pos += 1
            result |= (b & 0x7F) << shift
            if (b & 0x80) == 0:
                break
            shift += 7
        return result, pos

    def _read_mutf8_at(self, off: int) -> Tuple[str, int]:
        _, pos = self._uleb128(off)
        chars: List[str] = []
        while True:
            b0 = self._u1(pos);
            pos += 1
            if b0 == 0x00:
                break
            if b0 < 0x80:
                chars.append(chr(b0))
            elif (b0 & 0xE0) == 0xC0:
                b1 = self._u1(pos);
                pos += 1
                code = ((b0 & 0x1F) << 6) | (b1 & 0x3F)
                if code == 0:
                    chars.append('\x00')
                else:
                    chars.append(chr(code))
            else:
                b1 = self._u1(pos);
                b2 = self._u1(pos + 1);
                pos += 2
                code = ((b0 & 0x0F) << 12) | ((b1 & 0x3F) << 6) | (b2 & 0x3F)
                if 0xD800 <= code <= 0xDBFF:
                    b0n = self._u1(pos);
                    b1n = self._u1(pos + 1);
                    b2n = self._u1(pos + 2);
                    pos += 3
                    code2 = ((b0n & 0x0F) << 12) | ((b1n & 0x3F) << 6) | (b2n & 0x3F)
                    if 0xDC00 <= code2 <= 0xDFFF:
                        cp = 0x10000 + (((code - 0xD800) << 10) | (code2 - 0xDC00))
                        chars.append(chr(cp))
                    else:
                        chars.append(chr(code))
                        chars.append(chr(code2))
                else:
                    chars.append(chr(code))
        return ''.join(chars), pos

    def get_string(self, idx: int) -> Optional[str]:
        if idx < 0 or idx >= self.string_ids_size:
            return None
        if idx in self._string_cache:
            return self._string_cache[idx]
        off = self._string_offs[idx]
        if off <= 0 or off >= self.size:
            return None
        s, _ = self._read_mutf8_at(off)
        self._string_cache[idx] = s
        return s

    def get_type_desc(self, idx: int) -> Optional[str]:
        if idx < 0 or idx >= self.type_ids_size:
            return None
        sidx = self._type_str_idx[idx]
        return self.get_string(sidx)

    def _get_type_list(self, off: int) -> List[str]:
        if off == 0 or off >= self.size:
            return []
        size = self._u4(off)
        types: List[str] = []
        p = off + 4
        for _ in range(size):
            t_idx = self._u2(p)
            p += 2
            desc = self.get_type_desc(t_idx)
            types.append(desc if desc is not None else f"type@{hex16(t_idx)}")
        return types

    def get_proto_sig(self, idx: int) -> Optional[str]:
        if idx < 0 or idx >= self.proto_ids_size:
            return None
        shorty_idx, ret_type_idx, params_off = self._proto_list[idx]
        ret = self.get_type_desc(ret_type_idx) or "V"
        params = self._get_type_list(params_off)
        return f"({''.join(params)}){ret}"

    def get_field_str(self, idx: int) -> Optional[str]:
        if idx < 0 or idx >= self.field_ids_size:
            return None
        class_idx, type_idx, name_idx = self._field_list[idx]
        owner = self.get_type_desc(class_idx) or f"type@{hex16(class_idx)}"
        ftype = self.get_type_desc(type_idx) or f"type@{hex16(type_idx)}"
        name = self.get_string(name_idx) or f"string@{hex32(name_idx)}"
        return f"{owner}->{name}:{ftype}"

    def get_method_str(self, idx: int) -> Optional[str]:
        if idx < 0 or idx >= self.method_ids_size:
            return None
        class_idx, proto_idx, name_idx = self._method_list[idx]
        owner = self.get_type_desc(class_idx) or f"type@{hex16(class_idx)}"
        name = self.get_string(name_idx) or f"string@{hex32(name_idx)}"
        sig = self.get_proto_sig(proto_idx) or f"proto@{hex16(proto_idx)}"
        return f"{owner}->{name}{sig}"

    def get_call_site_str(self, idx: int) -> Optional[str]:
        if self._cs_off == 0 or idx < 0 or idx >= self._cs_count:
            return None
        entry_off = self._u4(self._cs_off + idx * 4)
        return f"call_site@{hex32(entry_off)}"

    def get_method_handle_str(self, idx: int) -> Optional[str]:
        if self._mh_off == 0 or idx < 0 or idx >= self._mh_count:
            return None
        off = self._mh_off + idx * 8
        if off + 8 > self.size:
            return None
        mh_type = self._u2(off + 0)
        _unused = self._u2(off + 2)
        target_id = self._u2(off + 4)
        _unused2 = self._u2(off + 6)
        target_field = self.get_field_str(target_id)
        target_method = self.get_method_str(target_id)
        target = target_method if target_method is not None else target_field
        if target is None:
            target = f"id@{hex16(target_id)}"
        return f"method_handle[kind={mh_type}] {target}"

    def format_ref(self, kind: Optional[int], idx: int) -> str:
        if kind is None:
            return f"ref@{hex16(idx) if idx <= 0xFFFF else hex32(idx)}"
        if kind == 0:
            s = self.get_string(idx)
            return f"\"{s}\"" if s is not None else f"string@{hex16(idx) if idx <= 0xFFFF else hex32(idx)}"
        if kind == 1:
            s = self.get_type_desc(idx)
            return s if s is not None else f"type@{hex16(idx) if idx <= 0xFFFF else hex32(idx)}"
        if kind == 2:
            s = self.get_field_str(idx)
            return s if s is not None else f"field@{hex16(idx) if idx <= 0xFFFF else hex32(idx)}"
        if kind == 3:
            s = self.get_method_str(idx)
            return s if s is not None else f"method@{hex16(idx) if idx <= 0xFFFF else hex32(idx)}"
        if kind == 4:
            s = self.get_proto_sig(idx)
            return s if s is not None else f"proto@{hex16(idx) if idx <= 0xFFFF else hex32(idx)}"
        if kind == 5:
            s = self.get_call_site_str(idx)
            return s if s is not None else f"call_site@{hex16(idx) if idx <= 0xFFFF else hex32(idx)}"
        if kind == 6:
            s = this.get_method_handle_str(idx)
            return s if s is not None else f"method_handle@{hex16(idx) if idx <= 0xFFFF else hex32(idx)}"
        return f"{ref_kind_name(kind)}@{hex16(idx) if idx <= 0xFFFF else hex32(idx)}"


def decode_block(insns_bytes: bytes, regs_size: int, ins_size: int, dex: Optional[DexFile] = None) -> str:
    insns_size = len(insns_bytes) // 2
    units = list(struct.unpack('<' + 'H' * insns_size, insns_bytes))
    labels_needed: Dict[int, str] = {}
    payload_labels: Dict[int, str] = {}
    switch_bases: Dict[int, int] = {}
    decoded: List[Tuple[int, int, List[str]]] = []

    def rn(x: int) -> str:
        return reg_name(x, regs_size, ins_size)

    def fmt_ref(kind: Optional[int], idx: int, is_32: bool) -> str:
        if dex is None:
            base = hex32(idx) if is_32 else hex16(idx)
            return f"{ref_kind_name(kind)}@{base}"
        return dex.format_ref(kind, idx)

    def decode_one(pc: int) -> Tuple[int, List[str]]:
        u0 = units[pc]
        op_lo = u0 & 0xFF
        op_hi = (u0 >> 8) & 0xFF

        if u0 in (0x0100, 0x0200, 0x0300):
            if u0 == 0x0100:
                if pc + 4 > insns_size: return (1, ["# truncated packed-switch-payload"])
                size = units[pc + 1]
                lines = [".packed-switch 0x%08x" % ((units[pc + 3] << 16) | units[pc + 2])]
                for _ in range(size):
                    lines.append("    <tbd>")
                lines.append(".end packed-switch")
                return (4 + size * 2, lines)
            if u0 == 0x0200:
                if pc + 2 > insns_size: return (1, ["# truncated sparse-switch-payload"])
                size = units[pc + 1]
                lines = [".sparse-switch"]
                for _ in range(size):
                    lines.append("    <tbd> -> <tbd>")
                lines.append(".end sparse-switch")
                return (2 + size * 4, lines)
            if u0 == 0x0300:
                if pc + 4 > insns_size: return (1, ["# truncated array-payload"])
                elem_width = units[pc + 1]
                size = (units[pc + 3] << 16) | units[pc + 2]
                total_bytes = elem_width * size
                cu = (total_bytes + 1) // 2
                pad = cu & 1
                lines = [f".array-data {elem_width}", ".end array-data"]
                return (4 + cu + pad, lines)

        info = OPCODES.get(op_lo)
        if info is None:
            return (1, [f"# unknown-op {hex8(op_lo)}"])

        name, fmt, ref1, ref2 = info
        a8 = op_hi
        out: List[str] = []
        size = 1

        if fmt == "10x":
            out.append(name)
        elif fmt == "11x":
            out.append(f"{name} {rn(a8)}")
        elif fmt == "11n":
            A = (a8 >> 4) & 0xF;
            B = s1_to_s8(a8 & 0xF, 4)
            out.append(f"{name} {rn(A)}, {B}")
        elif fmt == "12x":
            A = (a8 >> 4) & 0xF;
            B = a8 & 0xF
            out.append(f"{name} {rn(A)}, {rn(B)}")
        elif fmt == "10t":
            off8 = s1_to_s8(a8, 8);
            tgt = pc + off8
            labels_needed.setdefault(tgt, f":L{tgt:04x}")
            out.append(f"{name} {labels_needed[tgt]}")
        elif fmt == "20t":
            size = 2;
            off16 = s16(units[pc + 1]);
            tgt = pc + off16
            labels_needed.setdefault(tgt, f":L{tgt:04x}")
            out.append(f"{name} {labels_needed[tgt]}")
        elif fmt == "30t":
            size = 3;
            off32 = s32_from_u2(units[pc + 1], units[pc + 2]);
            tgt = pc + off32
            labels_needed.setdefault(tgt, f":L{tgt:04x}")
            out.append(f"{name} {labels_needed[tgt]}")
        elif fmt == "21t":
            size = 2;
            A = a8;
            off16 = s16(units[pc + 1]);
            tgt = pc + off16
            labels_needed.setdefault(tgt, f":L{tgt:04x}")
            out.append(f"{name} {rn(A)}, {labels_needed[tgt]}")
        elif fmt == "22t":
            size = 2;
            A = (a8 >> 4) & 0xF;
            B = a8 & 0xF;
            off16 = s16(units[pc + 1]);
            tgt = pc + off16
            labels_needed.setdefault(tgt, f":L{tgt:04x}")
            out.append(f"{name} {rn(A)}, {rn(B)}, {labels_needed[tgt]}")
        elif fmt == "21s":
            size = 2;
            A = a8;
            lit = s16(units[pc + 1])
            out.append(f"{name} {rn(A)}, {lit}")
        elif fmt == "21ih":
            size = 2;
            A = a8;
            val = units[pc + 1] << 16
            out.append(f"{name} {rn(A)}, {hex(val)}")
        elif fmt == "21lh":
            size = 2;
            A = a8;
            val = units[pc + 1] << 48
            out.append(f"{name} {rn(A)}, {hex(val)}")
        elif fmt == "31i":
            size = 3;
            A = a8;
            lit = s32_from_u2(units[pc + 1], units[pc + 2])
            out.append(f"{name} {rn(A)}, {hex32(lit)}")
        elif fmt == "51l":
            size = 5;
            A = a8;
            lit = s64_from_u2(units[pc + 1], units[pc + 2], units[pc + 3], units[pc + 4])
            out.append(f"{name} {rn(A)}, {hex(lit & 0xFFFFFFFFFFFFFFFF)}")
        elif fmt == "21c":
            size = 2;
            A = a8;
            idx = units[pc + 1]
            out.append(f"{name} {rn(A)}, {fmt_ref(ref1, idx, False)}")
        elif fmt == "31c":
            size = 3;
            A = a8;
            idx = (units[pc + 2] << 16) | units[pc + 1]
            out.append(f"{name} {rn(A)}, {fmt_ref(ref1, idx, True)}")
        elif fmt == "22c":
            size = 2;
            A = (a8 >> 4) & 0xF;
            B = a8 & 0xF;
            idx = units[pc + 1]
            out.append(f"{name} {rn(A)}, {rn(B)}, {fmt_ref(ref1, idx, False)}")
        elif fmt == "22x":
            size = 2;
            A = a8;
            BBBB = units[pc + 1]
            out.append(f"{name} {rn(A)}, {rn(BBBB)}")
        elif fmt == "23x":
            size = 2;
            A = a8;
            B = units[pc + 1] & 0xFF;
            C = (units[pc + 1] >> 8) & 0xFF
            out.append(f"{name} {rn(A)}, {rn(B)}, {rn(C)}")
        elif fmt == "22s":
            size = 2;
            A = (a8 >> 4) & 0xF;
            B = a8 & 0xF;
            lit = s16(units[pc + 1])
            out.append(f"{name} {rn(A)}, {rn(B)}, {lit}")
        elif fmt == "22b":
            size = 2
            A = a8
            BC = units[pc + 1]
            B = BC & 0xFF
            C = s1_to_s8((BC >> 8) & 0xFF, 8)
            out.append(f"{name} {rn(A)}, {rn(B)}, {C}")
        elif fmt == "32x":
            size = 3;
            AAAA = units[pc + 1];
            BBBB = units[pc + 2]
            out.append(f"{name} {rn(AAAA)}, {rn(BBBB)}")
        elif fmt == "31t":
            size = 3;
            A = a8;
            off32 = s32_from_u2(units[pc + 1], units[pc + 2]);
            tgt = pc + off32
            payload_labels.setdefault(tgt, f":payload_{tgt:04x}")
            switch_bases[tgt] = pc
            out.append(f"{name} {rn(A)}, {payload_labels[tgt]}")
        elif fmt == "35c":
            size = 3;
            A = (a8 >> 4) & 0xF;
            G = a8 & 0xF;
            bbbb = units[pc + 1];
            cdef = units[pc + 2]
            C = (cdef) & 0xF;
            D = (cdef >> 4) & 0xF;
            E = (cdef >> 8) & 0xF;
            F = (cdef >> 12) & 0xF
            regs = [C, D, E, F, G][:A]
            out.append(f"{name} {{{', '.join(rn(r) for r in regs)}}}, {fmt_ref(ref1, bbbb, False)}")
        elif fmt == "3rc":
            size = 3;
            A = a8;
            bbbb = units[pc + 1];
            cccc = units[pc + 2]
            regs = [rn(cccc + i) for i in range(A)]
            out.append(f"{name} {{{', '.join(regs)}}}, {fmt_ref(ref1, bbbb, False)}")
        elif fmt == "45cc":
            size = 4;
            A = (a8 >> 4) & 0xF;
            G = a8 & 0xF;
            bbbb = units[pc + 1];
            cdef = units[pc + 2];
            hhhh = units[pc + 3]
            C = (cdef) & 0xF;
            D = (cdef >> 4) & 0xF;
            E = (cdef >> 8) & 0xF;
            F = (cdef >> 12) & 0xF
            regs = [C, D, E, F, G][:A]
            out.append(
                f"{name} {{{', '.join(rn(r) for r in regs)}}}, {fmt_ref(ref1, bbbb, False)}, {fmt_ref(ref2, hhhh, False)}")
        elif fmt == "4rcc":
            size = 4;
            A = a8;
            bbbb = units[pc + 1];
            cccc = units[pc + 2];
            hhhh = units[pc + 3]
            regs = [rn(cccc + i) for i in range(A)]
            out.append(f"{name} {{{', '.join(regs)}}}, {fmt_ref(ref1, bbbb, False)}, {fmt_ref(ref2, hhhh, False)}")
        else:
            out.append(f"# unhandled-format {fmt} ({name})")

        return (size, out)

    pc = 0
    while pc < insns_size:
        sz, lines = decode_one(pc)
        decoded.append((pc, max(1, sz), lines))
        pc += max(1, sz)

    for pco in list(payload_labels.keys()):
        if 0 <= pco < insns_size:
            u0 = units[pco]
            if u0 == 0x0100:
                payload_labels[pco] = f":pswitch_{pco:04x}"
            elif u0 == 0x0200:
                payload_labels[pco] = f":sswitch_{pco:04x}"
            elif u0 == 0x0300:
                payload_labels[pco] = f":array_{pco:04x}"
            else:
                payload_labels[pco] = f":payload_{pco:04x}"

    out: List[str] = []
    out.append(f".registers {regs_size}")
    out.append("")

    label_for_pc = {pc: name for pc, name in labels_needed.items()}
    label_for_pc.update({pc: name for pc, name in payload_labels.items()})

    def render_payload(pc0: int, content_lines: List[str]) -> List[str]:
        u0 = units[pc0]
        lines: List[str] = []
        if u0 == 0x0100:
            size = units[pc0 + 1] if pc0 + 1 < insns_size else 0
            first_key = s32_from_u2(units[pc0 + 2], units[pc0 + 3]) if pc0 + 3 < insns_size else 0
            base_pc = switch_bases.get(pc0, pc0)
            lines.append(f".packed-switch {hex32(first_key)}")
            for i in range(size):
                idx = pc0 + 4 + i * 2
                if idx + 1 >= insns_size:
                    lines.append("# truncated targets");
                    break
                tgt_rel = s32_from_u2(units[idx], units[idx + 1])
                tgt_abs = base_pc + tgt_rel
                lbl = label_for_pc.get(tgt_abs, f":L{tgt_abs:04x}")
                lines.append(f"    {lbl}")
            lines.append(".end packed-switch")
            return lines
        if u0 == 0x0200:
            size = units[pc0 + 1] if pc0 + 1 < insns_size else 0
            base_pc = switch_bases.get(pc0, pc0)
            lines.append(".sparse-switch")
            for i in range(size):
                kp = pc0 + 2 + i * 4
                if kp + 3 >= insns_size:
                    lines.append("# truncated pairs");
                    break
                key = s32_from_u2(units[kp], units[kp + 1])
                tgt_rel = s32_from_u2(units[kp + 2], units[kp + 3])
                tgt_abs = base_pc + tgt_rel
                lbl = label_for_pc.get(tgt_abs, f":L{tgt_abs:04x}")
                lines.append(f"    {hex32(key)} -> {lbl}")
            lines.append(".end sparse-switch")
            return lines
        if u0 == 0x0300:
            elem_width = units[pc0 + 1] if pc0 + 1 < insns_size else 1
            size = (units[pc0 + 3] << 16 | units[pc0 + 2]) if pc0 + 3 < insns_size else 0
            lines.append(f".array-data {elem_width}")
            byte_off = pc0 * 2 + 8
            for i in range(size):
                start = byte_off + i * elem_width
                end = start + elem_width
                if end > len(insns_bytes): break
                val = int.from_bytes(insns_bytes[start:end], 'little', signed=False)
                lines.append(f"    {hex(val)}")
            lines.append(".end array-data")
            return lines
        return content_lines

    for pc0, sz, content in decoded:
        if pc0 in label_for_pc:
            out.append(label_for_pc[pc0])
        u0 = units[pc0]
        if u0 in (0x0100, 0x0200, 0x0300):
            out += render_payload(pc0, content)
        else:
            fixed = []
            for ln in content:
                if "packed-switch" in ln or "sparse-switch" in ln or "fill-array-data" in ln:
                    for tgt, lbl in payload_labels.items():
                        ln = ln.replace(f":payload_{tgt:04x}", lbl)
                fixed.append(ln)
            out += fixed

    return "\n".join(out)


def disasm_pack(path: str, regs_size: int, ins_size: int, dex: Optional[DexFile]) -> str:
    with open(path, 'rb') as f:
        data = f.read()

    pos = 0
    idx = 0
    out_all: List[str] = []
    total = len(data)
    while pos + 8 <= total:
        off_u32, units = struct.unpack_from('<II', data, pos)
        pos += 8
        need = units * 2
        if units == 0 or pos + need > total:
            break
        insns = data[pos:pos + need]
        pos += need
        smali = decode_block(insns, regs_size, ins_size, dex)
        out_all.append(f"# record {idx}: file_off={hex(off_u32)} units={units} bytes={need}\n{smali}\n")
        idx += 1
    if idx == 0:
        return "# no records parsed (check file format)"
    return "\n".join(out_all)


def main():
    if len(sys.argv) != 3:
        print("Usage: python disassemble.py <input_file> <dex_file>")
        sys.exit(1)

    path = sys.argv[1]
    dex_path = sys.argv[2]

    # 寄存器数量和输入参数数量，根据实际情况调整
    regs = 64
    ins = 0

    dex = DexFile(dex_path)
    smali = disasm_pack(path, regs, ins, dex)

    # 输出到文件
    with open("out.smali", "w", encoding="utf-8") as f:
        f.write(smali)

    print("Disassembly completed. Output saved to out.smali")


if __name__ == "__main__":
    main()