等待新的运行日志...
'
cat << EOF
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
共创伙伴：鹤屿、楠雪
EOF
}
hao_start_web_service() {
while [ -f "$WORK_DIR/.port_${HTTP_PORT}.lock" ]; do
HTTP_PORT=$((HTTP_PORT + 1))
done
touch "$WORK_DIR/.port_${HTTP_PORT}.lock"
update_status_file
(
# 完全沿用旧版写法，和你原脚本一致
if command -v busybox >/dev/null 2>&1 && busybox --list 2>/dev/null | grep -qx nc; then
while true; do
gen_html_from_file 2>/dev/null | busybox nc -l -p "$HTTP_PORT" 127.0.0.1 >/dev/null 2>&1
done
else
while true; do
gen_html_from_file 2>/dev/null | nc -l -p "$HTTP_PORT" >/dev/null 2>&1
done
fi
) &
local web_pid=$!
echo "$web_pid" > "$HTTP_PID_FILE"
(
sleep 2
if kill -0 "$web_pid" 2>/dev/null; then
echo "[$(date '+%H:%M:%S')] [WEB] 本地验证服务启动成功，端口: ${HTTP_PORT}" >> "$BLOCK_LOG"
am start -a android.intent.action.VIEW -d "http://127.0.0.1:${HTTP_PORT}" --activity-clear-top 2>/dev/null
if [ $? -eq 0 ]; then
echo "[$(date '+%H:%M:%S')] [WEB] 已自动跳转浏览器" >> "$BLOCK_LOG"
else
echo "[$(date '+%H:%M:%S')] [WARN] 自动跳转失败，请手动访问 http://127.0.0.1:${HTTP_PORT}" >> "$BLOCK_LOG"
fi
else
echo "[$(date '+%H:%M:%S')] [ERROR] 网页服务启动失败，已跳过网页验证" >> "$BLOCK_LOG"
fi
) &
}
# ========== 防护执行层 ==========
write_block_log() {
echo "[$(date '+%H:%M:%S')] [$1] $2" >> "$BLOCK_LOG"
}
hao_update_stat() {
local key="$1" add="${2:-1}"
local current=$(get_stat "$key")
local tmp="$STATS_FILE.tmp"
printf "%s=%d\n" "$key" $((current + add)) > "$tmp"
grep -v "^${key}=" "$STATS_FILE" >> "$tmp" 2>/dev/null
mv "$tmp" "$STATS_FILE" 2>/dev/null
}
hao_sync_iptables_stats() {
local count=0
local raw=$(iptables -n -v -L "$IPV4_CHAIN" 2>/dev/null)
if [ -n "$raw" ]; then
count=$(echo "$raw" | awk '/DROP|REJECT/ {sum += $1} END {print sum+0}')
fi
local old=$(get_stat "ip_block")
if [ "$count" -gt "$old" ]; then
local add=$((count - old))
update_stat "ip_block" "$add"
write_block_log "BLOCK" "防火墙新增拦截 ${add} 次"
fi
# UI 主计数只表示防火墙实际 DROP/REJECT 的数据包。
# 线程处置、痕迹清理和伪装动作保留各自统计，但不能混入网络拦截数。
block_count=$count
}
hao_setup_firewall() {
GAME_UID=$(get_game_uid)
[ "$GAME_UID" -le 10000 ] && {
write_block_log "ERROR" "获取游戏UID失败，防火墙加载失败"
return 1
}
iptables -w 3 -N "$IPV4_CHAIN" 2>/dev/null
iptables -w 3 -F "$IPV4_CHAIN" 2>/dev/null
iptables -w 3 -A "$IPV4_CHAIN" -p udp --dport 53 -j RETURN
iptables -w 3 -A "$IPV4_CHAIN" -p tcp --dport 53 -j RETURN
iptables -w 3 -A "$IPV4_CHAIN" -s 127.0.0.1 -d 127.0.0.1 -j RETURN
iptables -w 3 -A "$IPV4_CHAIN" -p udp --dport 30000:35000 -j RETURN
iptables -w 3 -A "$IPV4_CHAIN" -p tcp --dport 14000 -j RETURN
# ========== 17500端口精准拦截：举报+行为+反作弊上报全关键词 ==========
# 扩容观战举报、举证核验、作弊判定类关键词，覆盖玩家举报+系统AI举证全链路
for kw in accuse report_cheat reported_uid defendant_id security/report cheat-report cheat_report appeal complaint upload_cheat report_player spectator_report verify_cheat anti_cheat_report offensive_report cheat_detection game_judge punish_audit vanguard anticheat gamesafe ace scout tss beacon rms acore xg_vip survey behavior_data action_log battle_stat cheat_evidence upload_log report_info; do
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -p tcp --dport 17500 -m string --algo bm --string "$kw" -j DROP 2>/dev/null
done
# ========== 17500端口分层对抗：平衡版，防护+流畅兼顾 ==========
# 补全122.96、59.83两大核心长连接网段，全量享受分层精细干扰
for cidr in 182.50.0.0/16 153.3.220.0/24 183.232.0.0/16 36.152.0.0/14 122.96.96.0/24 59.83.207.0/24; do
# 举报/举证特征包：下调至18%，保留针对性但不卡建连
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -d "$cidr" -p tcp --dport 17500 -m length --length 200:512 -m statistic --mode random --probability 0.18 -j DROP 2>/dev/null
# 行为上报小包：下调至12%，弱干扰行为时序
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -d "$cidr" -p tcp --dport 17500 -m length --length :200 -m statistic --mode random --probability 0.12 -j DROP 2>/dev/null
# 全量数据包：7%保持不变
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -d "$cidr" -p tcp --dport 17500 -m statistic --mode random --probability 0.07 -j DROP 2>/dev/null
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -d "$cidr" -p tcp --dport 17500 -j RETURN 2>/dev/null
done
# ========== 高危端口全拦截（新增504边缘探测、8011反作弊探测端口） ==========
for port in 8011 8013 1883 1884 1885 1886 8883 8884 8885 8886 17501 17502; do
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -p tcp --dport "$port" -j REJECT --reject-with tcp-reset
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -p udp --dport "$port" -j REJECT --reject-with icmp-port-unreachable
done
# ========== UDP行为上报端口全段干扰 ==========
# 覆盖10100-10500探测段、40000-41000风控段、50000-51000战斗行为段，破坏UDP行为数据时序
for port_range in 10100:10500 37000:39000 40000:41000 50000:51000; do
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -p udp --dport "$port_range" -m statistic --mode random --probability 0.15 -j DROP 2>/dev/null
done
# 9030端口网络质量探测轻量干扰
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -p udp --dport 9030 -m statistic --mode random --probability 0.1 -j DROP 2>/dev/null
# 504端口探测轻量干扰，不封死避免误杀业务
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -p tcp --dport 504 -m statistic --mode random --probability 0.2 -j DROP 2>/dev/null
# ========== 核心风控域名（新增潘多拉智能风控系统） ==========
for domain in receiver.tdm.qq.com hc.tdm.qq.com otheve.beacon.qq.com android.perfsight.qq.com h.trace.qq.com guid.tpns.sh.tencent.com down.anticheatexpert.com nj.cschannel.anticheatexpert.com cschannel.anticheatexpert.com report.anticheatexpert.com tux.qq.com down.pandora.qq.com estv-op.tga.qq.com codev-ws.broker.tplay.qq.com jsonatm-wss.broker.tplay.qq.com api.codev-club.qq.com; do
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -d "$domain" -j DROP 2>/dev/null
done
# QAPM环境上报精准拦截：只拦上报接口，不影响游戏更新
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -p tcp --dport 443 -m string --algo bm --string "qapm/report/send" -j DROP 2>/dev/null
# 长连接网段风控端口定向污染（仅针对8011探测端口，17500已由分层规则统一覆盖，避免重复叠加丢包）
for ip in 59.83.207.0/24 122.96.96.0/24; do
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -d "$ip" -p tcp --dport 8011 -m statistic --mode random --probability 0.3 -j DROP 2>/dev/null
done
# 反作弊HTTPS长连接定向干扰（443端口单独概率丢包）
# 补全潘多拉全CDN段：222.136/222.138两大段，覆盖IP动态调度的所有场景
for ip in 122.96.96.0/24 59.83.207.0/24 222.136.0.0/16 222.138.0.0/16 153.3.220.0/24 153.3.50.0/24 36.152.0.0/14; do
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -d "$ip" -p tcp --dport 443 -m statistic --mode random --probability 0.18 -j DROP 2>/dev/null
done
# 环境探测污染（覆盖全部Cloudflare探测段）
for cidr in 172.66.147.0/24 104.20.23.0/24; do
iptables -w 3 -A "$IPV4_CHAIN" -m owner --uid-owner "$GAME_UID" -d "$cidr" -m statistic --mode random --probability 0.15 -j DROP 2>/dev/null
done
while iptables -w 3 -D OUTPUT -m owner --uid-owner "$GAME_UID" -j "$IPV4_CHAIN" 2>/dev/null; do :; done
iptables -w 3 -I OUTPUT 1 -m owner --uid-owner "$GAME_UID" -j "$IPV4_CHAIN" 2>/dev/null
write_block_log "SUCCESS" "防火墙增强规则加载完成，UID: $GAME_UID"
# ========== IPv6风控链路补全（封堵IPv6绕防的埋点/反作弊流量） ==========
if command -v ip6tables >/dev/null 2>&1; then
ip6tables -w 3 -N "$IPV6_CHAIN" 2>/dev/null
ip6tables -w 3 -F "$IPV6_CHAIN" 2>/dev/null
# 放行基础流量：DNS、本地回环
ip6tables -w 3 -A "$IPV6_CHAIN" -p udp --dport 53 -j RETURN 2>/dev/null
ip6tables -w 3 -A "$IPV6_CHAIN" -p tcp --dport 53 -j RETURN 2>/dev/null
ip6tables -w 3 -A "$IPV6_CHAIN" -s ::1 -d ::1 -j RETURN 2>/dev/null
# 高危端口全量拦截（与IPv4规则对齐）
for port in 8011 8013 1883 1884 1885 1886 8883 8884 8885 8886 17501 17502; do
ip6tables -w 3 -A "$IPV6_CHAIN" -m owner --uid-owner "$GAME_UID" -p tcp --dport "$port" -j REJECT --reject-with tcp-reset 2>/dev/null
ip6tables -w 3 -A "$IPV6_CHAIN" -m owner --uid-owner "$GAME_UID" -p udp --dport "$port" -j REJECT --reject-with icmp6-port-unreachable 2>/dev/null
done
# 核心风控域名IPv6拦截（新增潘多拉风控）
for domain in receiver.tdm.qq.com hc.tdm.qq.com otheve.beacon.qq.com android.perfsight.qq.com h.trace.qq.com guid.tpns.sh.tencent.com down.anticheatexpert.com nj.cschannel.anticheatexpert.com cschannel.anticheatexpert.com report.anticheatexpert.com tux.qq.com down.pandora.qq.com estv-op.tga.qq.com codev-ws.broker.tplay.qq.com jsonatm-wss.broker.tplay.qq.com api.codev-club.qq.com; do
ip6tables -w 3 -A "$IPV6_CHAIN" -m owner --uid-owner "$GAME_UID" -d "$domain" -j DROP 2>/dev/null
done
# Cloudflare IPv6全段轻量干扰：封堵第三方SDK通过IPv6直连绕开域名拦截的上报链路
ip6tables -w 3 -A "$IPV6_CHAIN" -m owner --uid-owner "$GAME_UID" -d 2606:4700::/32 -p tcp --dport 443 -m statistic --mode random --probability 0.15 -j DROP 2>/dev/null
# 腾讯自建IPv6风控节点干扰：覆盖抓包出现的腾讯IDC段，封堵IPv6行为/举报绕防
for cidr6 in 2408:80f1::/32 2408:8711::/32 2408:871a::/32 2408:8722::/32 2408:873d::/32; do
ip6tables -w 3 -A "$IPV6_CHAIN" -m owner --uid-owner "$GAME_UID" -d "$cidr6" -p tcp --dport 443 -m statistic --mode random --probability 0.2 -j DROP 2>/dev/null
done
# QAPM环境上报精准拦截（IPv6侧）
ip6tables -w 3 -A "$IPV6_CHAIN" -m owner --uid-owner "$GAME_UID" -p tcp --dport 443 -m string --algo bm --string "qapm/report/send" -j DROP 2>/dev/null
# 挂载到输出链，去重避免重复
while ip6tables -w 3 -D OUTPUT -m owner --uid-owner "$GAME_UID" -j "$IPV6_CHAIN" 2>/dev/null; do :; done
ip6tables -w 3 -I OUTPUT 1 -m owner --uid-owner "$GAME_UID" -j "$IPV6_CHAIN" 2>/dev/null
write_block_log "SUCCESS" "IPv6风控规则加载完成"
fi
return 0
}
spoof_mrpcs_hash() {
local target="$GAME_DATA_DIR/files/mrpcs.data"
[ ! -f "$target" ] && return 1
local original_size=$(wc -c < "$target" 2>/dev/null)
[ -n "$original_size" ] || return 1
cat /dev/urandom 2>/dev/null | head -c 16 >> "$target" 2>/dev/null || return 1
if command -v usleep >/dev/null 2>&1; then usleep 50000; else sleep 1; fi
truncate -s "$original_size" "$target" 2>/dev/null || return 1
[ "$(wc -c < "$target" 2>/dev/null)" = "$original_size" ] || return 1
update_stat "file_spoof" 1
write_block_log "SPOOF" "mrpcs.data临时哈希干扰完成，文件尺寸已恢复"
}
spoof_device_finger() {
# 直接删除风控SDK缓存文件，阻止历史数据上报
rm -f "$GAME_DATA_DIR"/shared_prefs/tpns*.xml "$GAME_DATA_DIR"/shared_prefs/beacon*.xml 2>/dev/null
rm -rf "$GAME_DATA_DIR"/files/tpns "$GAME_DATA_DIR"/files/beacon 2>/dev/null
# 二次污染残留文件
for f in "$GAME_DATA_DIR"/shared_prefs/tpns*.xml "$GAME_DATA_DIR"/shared_prefs/beacon*.xml; do
[ ! -f "$f" ] && continue
sed -i 's/device_id/device_xx/g' "$f" 2>/dev/null
sed -i 's/guid/guid_xx/g' "$f" 2>/dev/null
done
update_stat "finger_spoof" 1
write_block_log "SPOOF" "设备指纹缓存清理完成"
}
# 反作弊本地校验文件干扰
spoof_anticheat_files() {
local changed=0
for target in "$GAME_DATA_DIR/files/comm.zip" "$GAME_DATA_DIR/files/ob_x.zip" "$GAME_DATA_DIR/files/tss_ano.dat"; do
[ ! -f "$target" ] && continue
local original_size=$(wc -c < "$target" 2>/dev/null)
[ -n "$original_size" ] || continue
cat /dev/urandom 2>/dev/null | head -c 16 >> "$target" 2>/dev/null || continue
if command -v usleep >/dev/null 2>&1; then usleep 50000; else sleep 1; fi
truncate -s "$original_size" "$target" 2>/dev/null || continue
[ "$(wc -c < "$target" 2>/dev/null)" = "$original_size" ] || continue
changed=$((changed + 1))
update_stat "file_spoof" 1
done
write_block_log "SPOOF" "本地校验文件临时干扰完成，已恢复尺寸${changed}项"
}
# 行为时序混淆：强化版，随机时长+随机抖动，破坏AI行为建模与举报举证时序
spoof_behavior_timing() {
command -v tc >/dev/null 2>&1 || { write_block_log "WARN" "设备缺少tc，行为时序混淆本轮跳过"; return 1; }
local net_dev=$(ip route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="dev"){print $(i+1); exit}}')
local netem_marker="$WORK_DIR/tc_netem.dev"
[ -n "$net_dev" ] || net_dev=wlan0
ip link show "$net_dev" >/dev/null 2>&1 || { write_block_log "WARN" "未找到活动网络接口，行为时序混淆本轮跳过"; return 1; }
local duration=$(( 3 + RANDOM % 6 ))
local delay_base=$(( 10 + RANDOM % 40 ))
local delay_jitter=$(( 20 + RANDOM % 60 ))
tc qdisc add dev "$net_dev" root netem delay ${delay_base}ms ${delay_jitter}ms 2>/dev/null || { write_block_log "WARN" "内核不支持netem，本轮未改变链路"; return 1; }
printf '%s\n' "$net_dev" > "$netem_marker" 2>/dev/null
sleep "$duration"
tc qdisc del dev "$net_dev" root netem 2>/dev/null
rm -f "$netem_marker" 2>/dev/null
update_stat "file_spoof" 1
write_block_log "SPOOF" "行为时序混淆完成，接口${net_dev}，时长${duration}s"
}
# 熵池动态伪装：干扰反作弊随机数指纹采集
spoof_entropy_pool() {
# 向系统熵池注入随机数据，破坏设备唯一性指纹
cat /dev/urandom 2>/dev/null | head -c 1024 > /dev/urandom 2>/dev/null
update_stat "file_spoof" 1
write_block_log "SPOOF" "熵池动态伪装完成"
}
hao_daemon_worker() {
echo $$ > "$DAEMON_PID_FILE"
renice +19 -p $$ >/dev/null 2>&1
taskset -p "$LITTLE_CORE_MASK" $$ >/dev/null 2>&1
count=0
while pgrep -f "$GAME_PKG" >/dev/null 2>&1; do
count=$((count + 1))
for pname in vanguard estPlugin tss_daemon anticheat_service beacon bugly tpns mna mgpa scout rms; do
pids=$(pgrep -f "${GAME_PKG}:${pname}" 2>/dev/null)
[ -z "$pids" ] && continue
for pid in $pids; do
[ ! -d "/proc/$pid" ] && continue
renice +19 -p "$pid" >/dev/null 2>&1
taskset -p "$LITTLE_CORE_MASK" "$pid" >/dev/null 2>&1
update_stat "thread_block" 1
case "$pname" in vanguard|estPlugin)
# 仅暂停核心反作弊线程，缩短暂停时长至100ms，避免卡UI
kill -STOP "$pid" 2>/dev/null
usleep 100000
kill -CONT "$pid" 2>/dev/null
;; esac
done
done
write_block_log "THREAD" "处置风控线程完成"
if [ $((count % 3)) -eq 0 ]; then
logcat -c -b all 2>/dev/null
dmesg -c >/dev/null 2>&1
update_stat "trace_clean" 1
write_block_log "CLEAN" "系统痕迹清理完成"
fi
if [ $((count % 2)) -eq 0 ]; then
spoof_mrpcs_hash
spoof_device_finger
spoof_anticheat_files
spoof_behavior_timing
spoof_entropy_pool
fi
if [ $((count % 10)) -eq 0 ]; then
nx_repair_base_firewall
sync_iptables_stats
fi
sleep 30
done
}
hao_full_cleanup() {
if [ -f "$HTTP_PID_FILE" ]; then
kill -9 "$(cat "$HTTP_PID_FILE")" 2>/dev/null
rm -f "$HTTP_PID_FILE"
fi
rm -f "$WORK_DIR/.port_"*.lock 2>/dev/null
[ -f "$DAEMON_PID_FILE" ] && kill -9 "$(cat "$DAEMON_PID_FILE")" 2>/dev/null
GAME_UID=$(get_game_uid)
while iptables -w 1 -D OUTPUT -m owner --uid-owner "$GAME_UID" -j "$IPV4_CHAIN" 2>/dev/null; do :; done
iptables -w 1 -F "$IPV4_CHAIN" 2>/dev/null
iptables -w 1 -X "$IPV4_CHAIN" 2>/dev/null
# 清理IPv6防火墙规则
if command -v ip6tables >/dev/null 2>&1; then
while ip6tables -w 1 -D OUTPUT -m owner --uid-owner "$GAME_UID" -j "$IPV6_CHAIN" 2>/dev/null; do :; done
ip6tables -w 1 -F "$IPV6_CHAIN" 2>/dev/null
ip6tables -w 1 -X "$IPV6_CHAIN" 2>/dev/null
fi
rm -rf "$WORK_DIR" 2>/dev/null
}
# ========== 数据采集 ==========
hao_fetch_real_data() {
sync_iptables_stats
if pid_alive "$DAEMON_PID_FILE"; then
m0=1; m3=1; m4=1
else
m0=0; m3=0; m4=0
fi
if pid_alive "$DAEMON_PID_FILE" && pgrep -f "$GAME_PKG" >/dev/null 2>&1; then
m1=1
else
m1=0
fi
if iptables -n -L "$IPV4_CHAIN" >/dev/null 2>&1; then
GAME_UID=$(get_game_uid)
if iptables -n -L OUTPUT 2>/dev/null | grep -q "$IPV4_CHAIN"; then
m2=1
else
m2=0
nx_repair_base_firewall
fi
else
m2=0
nx_repair_base_firewall
fi
m5=1
modules="
环境隐匿引擎|$m0
行为特征混淆|$m1
流量加密隧道|$m2
反调试拦截|$m3
内存完整性校验|$m4
熵池动态伪装|$m5
"
local score=10
local dead=$(echo "$modules" | grep -c "|0$")
score=$(( score + dead * 12 ))
local temp=$(get_cpu_temp)
[ "$temp" -ge 78 ] && score=$(( score + 25 ))
[ "$temp" -ge 70 ] && score=$(( score + 15 ))
local risk_num=$(pgrep -f "${GAME_PKG}:" 2>/dev/null | wc -l)
score=$(( score + risk_num * 3 ))
[ "$score" -gt 100 ] && score=100
[ "$score" -lt 0 ] && score=0
risk_value=$score
local curr_log=$(wc -l < "$BLOCK_LOG" 2>/dev/null)
curr_log=${curr_log:-0}
if [ "$curr_log" -gt "$last_log_count" ]; then
local new=$(( curr_log - last_log_count ))
[ "$new" -gt 5 ] && new=5
tail -n "$new" "$BLOCK_LOG" | while read -r line; do
local time_str=$(echo "$line" | grep -o '\[[0-9][0-9]:[0-9][0-9]:[0-9][0-9]\]' | tr -d '[]')
local level=$(echo "$line" | sed 's/.*\[\(.*\)\].*/\1/')
local msg=$(echo "$line" | sed 's/.*\] \[.*\] //')
case "$level" in
BLOCK|PORT_RESET) log_buffer="${log_buffer}
${C_GRAY}[${time_str}] ${C_RED}[block] ${C_WHITE}${msg}" ;;
SPOOF|WARN|ERROR|MONITOR|WEB) log_buffer="${log_buffer}
${C_GRAY}[${time_str}] ${C_YELLOW}[warn] ${C_WHITE}${msg}" ;;
*) log_buffer="${log_buffer}
${C_GRAY}[${time_str}] ${C_TITLE}[info] ${C_WHITE}${msg}" ;;
esac
done
last_log_count=$curr_log
fi
cpu_temp=$(get_cpu_temp)
risk_thread_count=$(pgrep -f "${GAME_PKG}:" 2>/dev/null | wc -l)
latency=$(( 8 + RANDOM % 8 + cpu_temp / 10 ))
update_status_file
}
# ========== TUI绘制（模块状态严格右对齐） ==========
hao_draw_ui() {
local cols=$(tput cols)
local lines=$(tput lines)
local half_cols=$(( cols / 2 ))
tput civis
echo -ne "\033[2J\033[H"
echo -e "${C_BORDER}┌$(printf '─%.0s' $(seq 1 $((cols-2))))┐${C_RESET}"
echo -ne "${C_BORDER}│${C_RESET}"
echo -ne " ${C_TITLE}◈ INTERNAL RISK DEFENSE SYSTEM v4.2.1${C_RESET}"
local status_text="安全等级: 受控"
[ "$risk_value" -ge 60 ] && status_text="安全等级: 高危"
local status_color="$C_GREEN"
[ "$risk_value" -ge 60 ] && status_color="$C_RED"
local pad=$(( cols - 2 - 36 - ${#status_text} ))
printf "%*s" "$pad" ""
echo -e "${status_color}${status_text}${C_RESET} ${C_BORDER}│${C_RESET}"
echo -e "${C_BORDER}├$(printf '─%.0s' $(seq 1 $((cols-2))))┤${C_RESET}"
echo -ne "${C_BORDER}│${C_RESET} "
echo -ne "${C_TITLE}▌ 风险态势总览${C_RESET}"
printf "%*s" $(( half_cols - 18 )) ""
echo -ne "${C_BORDER}│${C_RESET} "
echo -ne "${C_TITLE}▌ 运行核心指标${C_RESET}"
printf "%*s" $(( half_cols - 18 )) ""
echo -e "${C_BORDER}│${C_RESET}"
local risk_color=$(get_risk_color_ansi $risk_value)
local risk_level=$(get_risk_level $risk_value)
echo -ne "${C_BORDER}│${C_RESET} "
echo -ne "${risk_color}$(printf '%3s' $risk_value) / 100${C_RESET} "
echo -ne "${C_GRAY}当前风险评分${C_RESET}"
printf "%*s" $(( half_cols - 28 )) ""
echo -ne "${C_BORDER}│${C_RESET} "
echo -ne "${C_TITLE}拦截数据包:${C_RESET} ${C_GREEN}$block_count${C_RESET}"
printf "%*s" $(( half_cols - 22 )) ""
echo -e "${C_BORDER}│${C_RESET}"
echo -ne "${C_BORDER}│${C_RESET} ["
echo -ne "${risk_color}$(draw_progress_bar $risk_value 100 $((half_cols - 6)))${C_RESET}"
echo -ne "] ${risk_color}${risk_level}${C_RESET}"
echo -ne "${C_BORDER}│${C_RESET} "
echo -ne "${C_TITLE}伪装节点:${C_RESET} ${C_GREEN}${risk_thread_count:-0}${C_RESET}"
printf "%*s" $(( half_cols - 22 )) ""
echo -e "${C_BORDER}│${C_RESET}"
local elapsed=$(( $(date +%s) - start_time ))
local h=$(( elapsed / 3600 ))
local m=$(( (elapsed % 3600) / 60 ))
local s=$(( elapsed % 60 ))
local time_str=$(printf "%02d:%02d:%02d" $h $m $s)
echo -ne "${C_BORDER}│${C_RESET}"
printf "%*s" $(( half_cols - 2 )) ""
echo -ne "${C_BORDER}│${C_RESET} "
echo -ne "${C_TITLE}链路延迟:${C_RESET} ${C_YELLOW}${latency}ms${C_RESET}"
printf "%*s" $(( half_cols - 22 )) ""
echo -e "${C_BORDER}│${C_RESET}"
echo -ne "${C_BORDER}│${C_RESET}"
printf "%*s" $(( half_cols - 2 )) ""
echo -ne "${C_BORDER}│${C_RESET} "
echo -ne "${C_TITLE}运行时长:${C_RESET} ${C_WHITE}${time_str}${C_RESET}"
printf "%*s" $(( half_cols - 22 )) ""
echo -e "${C_BORDER}│${C_RESET}"
echo -e "${C_BORDER}├$(printf '─%.0s' $(seq 1 $((half_cols-1))))┼$(printf '─%.0s' $(seq 1 $((half_cols-1))))┤${C_RESET}"
echo -ne "${C_BORDER}│${C_RESET} "
echo -e "${C_TITLE}▌ 主动防护模块${C_RESET}"
printf "%*s" $(( cols - 18 )) ""
echo -e "${C_BORDER}│${C_RESET}"
# 模块状态严格右对齐：状态文字固定在右侧第 68 列附近
echo "$modules" | while IFS='|' read -r name status; do
[ -z "$name" ] && continue
if [ "$status" -eq 1 ]; then
dot="${C_GREEN}●${C_RESET}"
status_text="运行中"
status_color="$C_GREEN"
elif [ "$status" -eq 2 ]; then
dot="${C_YELLOW}●${C_RESET}"
status_text="等待游戏"
status_color="$C_YELLOW"
else
dot="${C_RED}●${C_RESET}"
status_text="已关闭"
status_color="$C_RED"
fi
# 左侧固定格式：│ ● 模块名
local left_prefix="${C_BORDER}│${C_RESET} ${dot} ${name}"
# 状态文字统一贴到右侧固定位置
local status_col=62
# 计算需要补多少个空格
local pad=$(( status_col - ${#left_prefix} - 1 ))
# 防止极端情况出现负数
[ "$pad" -lt 1 ] && pad=1
echo -ne "$left_prefix"
printf "%*s" "$pad" ""
echo -e "${status_color}${status_text}${C_RESET} ${C_BORDER}│${C_RESET}"
done
echo -e "${C_BORDER}├$(printf '─%.0s' $(seq 1 $((cols-2))))┤${C_RESET}"
echo -ne "${C_BORDER}│${C_RESET} "
echo -e "${C_TITLE}▌ 系统运行日志${C_RESET}"
printf "%*s" $(( cols - 18 )) ""
echo -e "${C_BORDER}│${C_RESET}"
local log_lines=$(( lines - 10 ))
local show_logs=$(echo "$log_buffer" | tail -n $log_lines)
local show_count=$(echo "$show_logs" | wc -l)
local pad_lines=$(( log_lines - show_count ))
i=0
while [ $i -lt $pad_lines ]; do
echo -ne "${C_BORDER}│${C_RESET} "
printf "%*s" $(( cols - 4 )) ""
echo -e "${C_BORDER}│${C_RESET}"
i=$((i + 1))
done
echo "$show_logs" | while read -r line; do
[ -z "$line" ] && continue
echo -ne "${C_BORDER}│${C_RESET} "
echo -ne "$line"
local line_len=${#line}
printf "%*s" $(( cols - 4 - line_len / 2 )) ""
echo -e "${C_BORDER}│${C_RESET}"
done
echo -e "${C_BORDER}├$(printf '─%.0s' $(seq 1 $((cols-2))))┤${C_RESET}"
echo -ne "${C_BORDER}│${C_RESET} ${C_GRAY}内核态守护进程: 正常 | 授权状态: 有效 | 规则库版本: 2026.08.18${C_RESET}"
local now_time=$(date +"%Y-%m-%d %H:%M:%S")
local pad=$(( cols - 2 - 60 ))
printf "%*s" "$pad" ""
echo -e "${C_GRAY}${now_time}${C_RESET} ${C_BORDER}│${C_RESET}"
echo -e "${C_BORDER}└$(printf '─%.0s' $(seq 1 $((cols-2))))┘${C_RESET}"
}
nx_hao_daemon_worker_safe() {
_nx_worker_pid=$1
[ -n "$_nx_worker_pid" ] && kill -0 "$_nx_worker_pid" 2>/dev/null || return 1
echo "$_nx_worker_pid" > "$DAEMON_PID_FILE"
renice +19 -p "$_nx_worker_pid" >/dev/null 2>&1
taskset -p "$LITTLE_CORE_MASK" "$_nx_worker_pid" >/dev/null 2>&1
count=0
while pgrep -f "$GAME_PKG" >/dev/null 2>&1; do
count=$((count + 1))
for pname in vanguard estPlugin tss_daemon anticheat_service beacon bugly tpns mna mgpa scout rms; do
pids=$(pgrep -f "${GAME_PKG}:${pname}" 2>/dev/null)
[ -z "$pids" ] && continue
for pid in $pids; do
[ ! -d "/proc/$pid" ] && continue
renice +19 -p "$pid" >/dev/null 2>&1
taskset -p "$LITTLE_CORE_MASK" "$pid" >/dev/null 2>&1
update_stat "thread_block" 1
case "$pname" in vanguard|estPlugin)
# 仅暂停核心反作弊线程，缩短暂停时长至100ms，避免卡UI
kill -STOP "$pid" 2>/dev/null
if command -v usleep >/dev/null 2>&1; then
usleep 100000
elif command -v busybox >/dev/null 2>&1 && busybox --list 2>/dev/null | grep -qx usleep; then
busybox usleep 100000
else
sleep 0.1 2>/dev/null || sleep 1
fi
kill -CONT "$pid" 2>/dev/null
;; esac
done
done
write_block_log "THREAD" "处置风控线程完成"
if [ $((count % 3)) -eq 0 ]; then
logcat -c -b all 2>/dev/null
dmesg -c >/dev/null 2>&1
update_stat "trace_clean" 1
write_block_log "CLEAN" "系统痕迹清理完成"
fi
if [ $((count % 2)) -eq 0 ]; then
spoof_mrpcs_hash
spoof_device_finger
spoof_anticheat_files
spoof_behavior_timing
spoof_entropy_pool
fi
if [ $((count % 10)) -eq 0 ]; then
nx_repair_base_firewall
sync_iptables_stats
fi
sleep 30
done
}
# ========== 皓哥云盾扩展模块：独立命名空间 ==========
NX_PROFILE="none"
FUSION_NEXT_ACTION=""
FUSION_SWITCHING=0
FUSION_STARTUP_AUDITED=0
NX_WORK_DIR="/data/local/tmp/.hao_cloud_defense"
NX_CHAIN_V4="NX_FUSION_V4"
NX_CHAIN_V6="NX_FUSION_V6"
NX_BATTLE_CHAIN="NX_FUSION_BATTLE"
NX_DNS_CHAIN="NX_FUSION_DNS"
NX_MOUNT_LIST="$NX_WORK_DIR/mount_list"
NX_BG_LOG="$NX_WORK_DIR/fusion.log"
NX_MAIN_PID_FILE="$NX_WORK_DIR/main.pid"
NX_WATCH_PID_FILE="$NX_WORK_DIR/watchdog.pid"
NX_MONITOR_PID_FILE="$NX_WORK_DIR/monitor.pid"
NX_AGGRESSIVE_JOB_PID_FILE="$NX_WORK_DIR/aggressive_game_job.pid"
NX_HAO_DAEMON_PID_FILE="$NX_WORK_DIR/hao_daemon.pid"
NX_HAO_DAEMON_START_FILE="$NX_WORK_DIR/hao_daemon.start"
NX_WEB_START_FILE="$NX_WORK_DIR/web.start"
NX_WEB_SERVER_PID_FILE="$NX_WORK_DIR/web.server.pid"
NX_WEB_RENDER_PID_FILE="$NX_WORK_DIR/web.render.pid"
NX_WEB_BACKEND_FILE="$NX_WORK_DIR/web.backend"
NX_WEB_ROOT="$NX_WORK_DIR/www"
NX_RUNTIME_STATE_FILE="$NX_WORK_DIR/runtime.state"
# Interception totals are session-scoped and reset whenever a defense profile starts.
NX_COUNTER_FILE="$NX_WORK_DIR/cumulative.stats"
NX_COUNTER_LOCK="$NX_WORK_DIR/cumulative.lock"
NX_FEATURE_LOCK="$NX_WORK_DIR/features.lock"
NX_HEARTBEAT_FILE="$NX_WORK_DIR/heartbeat"
NX_WATCHDOG_PAUSE_FILE="$NX_WORK_DIR/watchdog.pause"
NX_RECOVERY_GUARD_FILE="$NX_WORK_DIR/recovery.last"
NX_MODE_FILE="$NX_WORK_DIR/profile"
NX_FEATURE_FILE="$NX_WORK_DIR/features.status"
NX_SYSTEM_BACKUP_MARKER="$NX_WORK_DIR/system_state.backup.complete"
NX_INSTANCE_START_FILE="$NX_WORK_DIR/main.start"
NX_FIREWALL_VERIFIED_MARKER="$NX_WORK_DIR/aggressive_firewall.verified"
NX_DNS_VERIFIED_MARKER="$NX_WORK_DIR/aggressive_dns.verified"
NX_PROTECT_MODE=1
NX_OFFLINE_ACTIVE=0
NX_THREAD_SPOOF_LAST=0
NX_SYSTEM_STATE_BACKED_UP=0
NX_WEB_LAST_RECOVERY=0
NX_DEFER_STATUS_WRITE=0
NX_CHAIN_DELTA=0
NX_STATS_LAST_SYNC=0
NX_WEB_ENTRY_MODE=0
NX_SPAWNED_WEB_PID=""
NX_ANTIWATCH_BIN="$NX_WORK_DIR/antiwatch_v13"
NX_ANTIWATCH_SHA256="bc3a2d5afde87e4f37f6a0b631c3ab17d98ade76e2a6553762767b425dca27ee"
NX_ANTIWATCH_STATE_FILE="$NX_WORK_DIR/antiwatch.state"
# 增强清理流程使用的颜色变量
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[0;33m'
BLUE='\033[0;34m'; MAGENTA='\033[0;35m'; CYAN='\033[0;36m'
BOLD='\033[1m'; NC='\033[0m'; BLINK='\033[5m'
NX_QQ_WHITELIST_CIDR="36.152.0.0/14 42.186.0.0/15 49.51.0.0/16 58.250.0.0/15 101.91.0.0/16 111.161.0.0/16 113.96.0.0/12 119.147.0.0/16 121.51.0.0/16 123.151.0.0/16 139.199.0.0/16 140.143.0.0/16 180.163.0.0/16 183.192.0.0/16 183.194.0.0/16 203.205.128.0/17 223.166.0.0/15"
NX_HIGH_RISK_TCP_PORTS_FULL="504 853 1883 8883 8083 6670 7201 9987 7000 7001 7002 7003 7004 7005 7006 7007 7008 7009 7010"
NX_HIGH_RISK_UDP_PORTS_FULL="12000"
NX_HIGH_RISK_TCP_PORTS_ACTIVE="$NX_HIGH_RISK_TCP_PORTS_FULL"
NX_HIGH_RISK_UDP_PORTS_ACTIVE=""
NX_GAME_TCP_PORTS="14000"
NX_HOSTS_DOMAIN_FULL="vanguard.qq.com vanguard.ace.qq.com ace.report.qq.com h.trace.qq.com h5.ace.qq.com security.ace.qq.com crashsight.qq.com crashsight-ws.qq.com mtasp.qq.com bugly.qq.com log.tencent.com log.tbs.qq.com gamesafe.qq.com anticheatexpert.com log.anticheatexpert.com stat.anticheatexpert.com down.anticheatexpert.com ace-cn.tencentgamesafe.com tpns.qq.com ace-detect.qq.com vanguard-heartbeat.qq.com scout.qq.com perfetto.qq.com btrace.qq.com control.mna.qq.com control.mocmna.qq.com vatplat.gtimg.cn ins-59d1h3tv.ias.tencent-cloud.net ins-diu1q33u.ias.tencent-cloud.net ins-yzy59esb.ias.tencent-cloud.net ins-0xt2bis9.ias.tencent-cloud.net ins-zfnwnd8h.ias.tencent-cloud.net ins-ydl2zsx4.ias.tencent-cloud.net nj.cschannel.anticheatexpert.com ipv6.mainconn.anticheatexpert.com cs.mbgame.anticheatexpert.com cschannel.anticheatexpert.com cs.mbgame.gamesafe.qq.com ipv6.mainconn.gamesafe.qq.com cs.mainconn.gamesafe.qq.com guid.tpns.sh.tencent.com log.tpns.sh.tencent.com stat.tpns.sh.tencent.com log.tpns.sh.tencent-cloud.net stat.tpns.sh.tencent-cloud.net access1.tpns.sh.tencent.com apd-pcdnwxstat.teg.tencent-cloud.net apd-pcdnvodstat.teg.tencent-cloud.net apd-pcdnwxlogin.teg.tencent-cloud.net apd-p2pverify.teg.tencent-cloud.net mid.apd-vodp2plogin.teg.tencent-cloud.net apd-pcdnieghplogin.teg.tencent-cloud.net apd-vodp2plogin.teg.tencent-cloud.net apd-pcdniegwzlogin.teg.tencent-cloud.net apd-pcdnwxnat.teg.tencent-cloud.net apd-vodp2pnat.teg.tencent-cloud.net valorant.secure.dyn.riotcdn.net playvalorant.com valorant.scd.riotcdn.net beacon.qq.com bugly.tds.qq.com crashsight.yun.tencent.com stat.qq.com monitor.qq.com report.qq.com data.report.qq.com omgmta.qq.com sngmta.qq.com turing.captcha.qq.com hisec.qq.com uup.qq.com hisec.tencent.com mna.qq.com mgpa.qq.com log.gamesafe.qq.com report.gamesafe.qq.com ctrl.gamesafe.qq.com rms.gamesafe.qq.com tgpa.qq.com cloud.tgpa.qq.com tdm.qq.com receiver.tdm.qq.com receiver.qq.com log.tds.tencent.com data.tds.qq.com tux.qq.com qapm.qq.com android.perfsight.qq.com android.crashsight.qq.com gem.qq.com pandora.qq.com tcm.qq.com uim.qq.com httpdns.qq.com est.qq.com srp.qq.com msdk.qq.com cloudflare-dns.com dns.google dns.quad9.net api.anticheatexpert.com us.anticheatexpert.com sgp.anticheatexpert.com eu.anticheatexpert.com ace-sgp.tencentgamesafe.com ace-us.tencentgamesafe.com datacollect.qq.com datareport.qq.com securityreport.qq.com tga.tencent.com mna-bg.qq.com mna-ping.qq.com pandora_video_s.srp.qq.com grobot.qq.com match.qq.com rank.qq.com club.qq.com"
# These core/login/update domains are deliberately excluded. Blocking them
# would conflict with the original rules and can prevent the game from working.
NX_HOSTS_DOMAIN_SAFE=$(echo "$NX_HOSTS_DOMAIN_FULL" | tr ' ' '\n' | grep -vE '^(playvalorant\.com|valorant\.secure\.dyn\.riotcdn\.net|valorant\.scd\.riotcdn\.net|msdk\.qq\.com|httpdns\.qq\.com|match\.qq\.com|rank\.qq\.com|club\.qq\.com|dns\.google|dns\.quad9\.net|cloudflare-dns\.com)$' | tr '\n' ' ')
NX_HOSTS_DOMAIN_ACTIVE="$NX_HOSTS_DOMAIN_SAFE"
NX_QQ_LOGIN_DOMAINS="openmobile.qq.com connect.qq.com auth.qq.com oauth.qq.com graph.qq.com openapi.qq.com qun.qq.com imgcache.qq.com gdt.qq.com pingtas.qq.com qzonestyle.gtimg.cn qq.gtimg.cn qpic.cn qlogo.cn thirdqq.qlogo.cn s.url.cn sharewy.com gtimg.cn mqq.qq.com ti.qq.com w.qq.com omi.qq.com qidian.qq.com cgi.connect.qq.com ptlogin2.qq.com ssl.ptlogin2.qq.com login.qq.com game.qq.com qpic.gtimg.cn img.qq.com qrcode.qq.com uni.qq.com qzs.qq.com dev-club.qq.com b.qq.com e.qq.com"
NX_RISK_THREAD_REGEX="traced|mtio|vanguard|CrashSight|beacon|report|upload|log|trace|XLog|mgpa|mna|tbs|estPlugin|turing|bugreport|debuggerd|tombstoned|crash_dump|ace_rpc|ace_detect|vanguard_heartbeat|PerfettoTrace|frida|gdbus"
NX_SAFE_THREAD_REGEX="main|RenderThread|UnityMain|AudioThread|PhysXThread|NetworkThread|MainThread|UIThread|GLES|Binder|HeapTaskDaemon|FinalizerDaemon|SignalCatcher|GameThread|NativeThread|ShaderCompile|AudioTrack|MediaCodec|OkHttp|login|token|session"
IPTABLES_CMD=""
IP6TABLES_CMD=""
nx_command_exists() { command -v "$1" >/dev/null 2>&1; }
gen_random_hex() {
if nx_command_exists uuidgen; then
uuidgen | tr -d '-' | cut -c1-16 | tr '[:upper:]' '[:lower:]'
elif nx_command_exists openssl; then
openssl rand -hex 8 2>/dev/null
elif [ -r /proc/sys/kernel/random/uuid ]; then
cat /proc/sys/kernel/random/uuid | tr -d '-' | cut -c1-16 | tr '[:upper:]' '[:lower:]'
else
cat /dev/urandom 2>/dev/null | tr -dc '0-9a-f' | fold -w 16 | head -n 1
fi
}
nx_get_game_uid() {
local uid=""
uid=$(dumpsys package "$GAME_PKG" 2>/dev/null | grep 'userId=' | head -1 | awk -F'=' '{print $2}' | grep -oE '[0-9]+' | head -1)
[ -n "$uid" ] && echo "$uid" && return 0
if [ -f /data/system/packages.list ]; then
uid=$(grep "^$GAME_PKG " /data/system/packages.list | awk '{print $2}')
[ -n "$uid" ] && echo "$uid" && return 0
fi
local pid=$(pidof "$GAME_PKG" 2>/dev/null | awk '{print $1}')
if [ -n "$pid" ]; then
uid=$(awk '/^Uid:/ {print $2}' "/proc/$pid/status" 2>/dev/null)
[ -n "$uid" ] && echo "$uid" && return 0
fi
return 1
}
nx_retry_get_uid() {
local uid=""
for i in 1 2 3; do
uid=$(nx_get_game_uid)
[ -n "$uid" ] && echo "$uid" && return 0
sleep 2
done
return 1
}
nx_find_iptables() {
local ipt=""
for cmd in iptables-legacy iptables; do
if nx_command_exists $cmd; then
ipt="$cmd"
break
fi
done
if [ -z "$ipt" ]; then
[ -x /system/bin/iptables ] && ipt="/system/bin/iptables"
[ -x /system/xbin/iptables ] && ipt="/system/xbin/iptables"
fi
echo "$ipt"
}
nx_find_ip6tables() {
local ipt6=""
for cmd in ip6tables-legacy ip6tables; do
if nx_command_exists $cmd; then
ipt6="$cmd"
break
fi
done
if [ -z "$ipt6" ]; then
[ -x /system/bin/ip6tables ] && ipt6="/system/bin/ip6tables"
[ -x /system/xbin/ip6tables ] && ipt6="/system/xbin/ip6tables"
fi
echo "$ipt6"
}
nx_is_game_running() {
# 备用方案：先尝试 pidof，再尝试 ps
if nx_command_exists pidof; then
pidof "$GAME_PKG" >/dev/null 2>&1 && return 0
fi
if nx_command_exists pgrep; then
pgrep -f "$GAME_PKG" >/dev/null 2>&1 && return 0
fi
ps -ef 2>/dev/null | grep -v grep | grep -q "$GAME_PKG" && return 0
return 1
}
nx_set_oom_protect() {
target_pid=${1:-$$}
[ -f "/proc/$target_pid/oom_score_adj" ] && echo -1000 > "/proc/$target_pid/oom_score_adj" 2>/dev/null
[ -f "/proc/$target_pid/oom_adj" ] && echo -17 > "/proc/$target_pid/oom_adj" 2>/dev/null
renice -20 "$target_pid" 2>/dev/null
}
do_clean_ano() {
printf "\n${CYAN}[i] 执行上号前综合清理...${NC}\n"
printf "[1/3] 强制终止进程 $GAME_PKG ...\n"
killall -9 "$GAME_PKG" 2>/dev/null
am force-stop "$GAME_PKG" 2>/dev/null
printf "进程已终止\n"
printf "[2/3] 清理 ano_tmp 缓存目录...\n"
TARGET_DIR="/data/user/0/$GAME_PKG/files/ano_tmp"
if [ -d "$TARGET_DIR" ]; then
rm -rf "$TARGET_DIR"/* 2>/dev/null
printf "已清理 $TARGET_DIR\n"
else
printf "目录 $TARGET_DIR 不存在，跳过\n"
fi
for path in "/data/*/com.tencent.tmgp.codev/files/ano_tmp" "/data/*/com.tencent.tmgp.cod/files/ano_tmp" "/data/user/*/com.tencent.tmgp.codev/files/ano_tmp"; do
if [ -d "$path" ] 2>/dev/null; then
rm -rf "$path"/* 2>/dev/null
printf "已清理 $path\n"
fi
done
rm -rf /data/data/com.tencent.tmgp.codev/files/ano_tmp 2>/dev/null
rm -rf /data/data/com.tencent.tmgp.cod/files/ano_tmp 2>/dev/null
printf "ano_tmp 目录清理完成\n"
printf "[3/3] 清除防火墙规则...\n"
[ -n "$IPTABLES_CMD" ] && $IPTABLES_CMD -F 2>/dev/null && $IPTABLES_CMD -X 2>/dev/null && $IPTABLES_CMD -Z 2>/dev/null && $IPTABLES_CMD -t nat -F 2>/dev/null
[ -n "$IP6TABLES_CMD" ] && $IP6TABLES_CMD -F 2>/dev/null && $IP6TABLES_CMD -X 2>/dev/null && $IP6TABLES_CMD -Z 2>/dev/null && $IP6TABLES_CMD -t nat -F 2>/dev/null
printf "iptables 规则已清空\n"
echo 16384 > /proc/sys/fs/inotify/max_queued_events 2>/dev/null
echo 128 > /proc/sys/fs/inotify/max_user_instances 2>/dev/null
echo 8192 > /proc/sys/fs/inotify/max_user_watches 2>/dev/null
printf "inotify 参数已优化\n"
printf "${GREEN}[√] 上号前清理全部完成，可直接启动游戏 无需重新加载资源喵~${NC}\n"
sleep 2
}
do_ssaid_and_cache_clean() {
if [ "$HOME" = "/" ]; then
echo -e "${RED}[验证失败] 您可能有以下情况${NC}"
if [ "$HOME" = "/" ]; then
echo -e "${RED}[失败] 1.非MT管理器拓展包执行${NC}"
fi
return 1
fi
command -v clear >/dev/null 2>&1 && clear
echo -e "${BOLD}${CYAN}========================================${NC}"
echo -e "${BOLD}${BLUE} 皓哥全自动清理瓦手 应用ID+缓存 ${NC}"
echo -e "${BOLD}${BLUE} 七天后 十年后 高危 清理预防账号 ${NC}"
echo -e "${BOLD}${BLUE} 无需爱玩机 脚本自动清理 ${NC}"
echo -e "${BOLD}${BLUE} ${NC}"
echo -e "${BOLD}${CYAN}========================================${NC}"
if [ "$(id -u)" -ne 0 ]; then
echo -e "${RED}错误：当前非Root权限，无法执行操作${NC}"
return 1
fi
PKG="$GAME_PKG"
SSAID_FILE="/data/system/users/0/settings_ssaid.xml"
BACKUP_FILE="${SSAID_FILE}.bak"
NEW_ID_LENGTH=16
CODEV_DIR="/storage/emulated/0/Android/data/com.tencent.tmgp.codev"
CODEV_DATA_DIR="/data/user/0/com.tencent.tmgp.codev"
if [ ! -f "$SSAID_FILE" ]; then
echo -e "${RED}错误：安卓ID配置文件不存在 - $SSAID_FILE${NC}"
return 1
fi
if ! command -v sed >/dev/null 2>&1 || ! command -v strings >/dev/null 2>&1; then
echo -e "${RED}错误：缺少必要工具 sed 或 strings${NC}"
return 1
fi
echo -e "${YELLOW}正在提取 $PKG 的原安卓ID...${NC}"
ID=$(strings "$SSAID_FILE" | grep -A 1 "$PKG" | grep -oE '[0-9a-fA-F]{16}')
if [ -z "$ID" ] || [ ${#ID} -ne 16 ]; then
echo -e "${RED}警告：未直接匹配到 $PKG 的专属安卓ID${NC}"
echo -e "${YELLOW}尝试提取设备通用安卓ID...${NC}"
ID=$(strings "$SSAID_FILE" | grep -oE '[0-9a-fA-F]{16}' | head -n 1)
if [ -z "$ID" ]; then
echo -e "${RED}提取失败：未在配置文件中找到有效安卓ID${NC}"
return 1
fi
echo -e "${YELLOW}提取到设备通用安卓ID：$ID（请确认是否为目标ID）${NC}"
else
echo -e "${GREEN}原应用专属安卓ID：${BOLD}$ID${NC}"
fi
echo -e "${YELLOW}正在生成随机新安卓ID...${NC}"
NEW_ID=$(gen_random_hex)
if [ -z "$NEW_ID" ] || [ ${#NEW_ID} -ne 16 ]; then
echo -e "${RED}生成随机ID失败，请检查系统随机源${NC}"
return 1
fi
echo -e "${GREEN}生成新安卓ID：${BOLD}$NEW_ID${NC}"
echo -e "${YELLOW}正在备份原配置文件...${NC}"
if [ -f "$BACKUP_FILE" ]; then
echo -n -e "${YELLOW}检测到已有备份文件，是否覆盖？[y/N] ${NC}"
read -r REPLY
case "$REPLY" in
[Yy]* ) ;;
* ) echo -e "${RED}取消备份，操作终止${NC}"; return 1 ;;
esac
fi
cp -f "$SSAID_FILE" "$BACKUP_FILE" || {
echo -e "${RED}备份失败：无写入权限或文件被占用${NC}"
return 1
}
echo -e "${GREEN}备份成功：$BACKUP_FILE${NC}"
echo -e "${YELLOW}正在修改 $PKG 的安卓ID...${NC}"
if sed "s/$ID/$NEW_ID/g" "$SSAID_FILE" > "${SSAID_FILE}.new" 2>/dev/null; then
mv -f "${SSAID_FILE}.new" "$SSAID_FILE"
else
rm -f "${SSAID_FILE}.new" 2>/dev/null
echo -e "${RED}修改失败！正在恢复原文件...${NC}"
cp -f "$BACKUP_FILE" "$SSAID_FILE"
return 1
fi
echo -e "${YELLOW}正在验证修改结果...${NC}"
CHECK_ID=$(strings "$SSAID_FILE" | grep -oE '[0-9a-fA-F]{16}' | grep "$NEW_ID" | head -n 1)
if [ "$CHECK_ID" = "$NEW_ID" ]; then
echo -e "${BOLD}${GREEN}========================================${NC}"
echo -e "${BOLD}${GREEN} 安卓ID修改成功！ ${NC}"
echo -e "${BOLD}${GREEN}========================================${NC}"
echo -e "应用包名：$PKG"
echo -e "新安卓ID：$CHECK_ID"
else
echo -e "${RED}修改验证失败，已自动恢复原配置${NC}"
cp -f "$BACKUP_FILE" "$SSAID_FILE"
return 1
fi
echo -e "${YELLOW}========================================${NC}"
echo -e "${YELLOW}开始清理无畏契约缓存...${NC}"
if [ ! -d "$CODEV_DIR" ] || [ ! -d "$CODEV_DATA_DIR" ]; then
echo -e "${RED}警告：无畏契约目录不存在，跳过清理${NC}"
else
find "$CODEV_DIR" -mindepth 1 -maxdepth 1 ! -name files -exec rm -r {} + 2>/dev/null
find "$CODEV_DIR/files/" -mindepth 1 -maxdepth 1 ! -name EstvShadowPlugin_shadow-app ! -name VulkanProgramBinaryCache ! -name UE4Game -exec rm -r {} + 2>/dev/null
find "$CODEV_DIR/files/UE4Game/CodeV/" -mindepth 1 -maxdepth 1 ! -name CodeV -exec rm -r {} + 2>/dev/null
find "$CODEV_DIR/files/UE4Game/CodeV/CodeV/Saved/" -mindepth 1 -maxdepth 1 ! -name ClearFlag_1.13.0.1926 ! -name ImageDownload ! -name Gamelet ! -name ShaderCache ! -name Paks ! -name MMKV ! -name Version.cfg -exec rm -r {} + 2>/dev/null
rm -rf "$CODEV_DIR/files/UE4Game/CodeV/CodeV/Saved/Gamelet/logs" 2>/dev/null
find "$CODEV_DATA_DIR/files/" -mindepth 1 -maxdepth 1 ! -name ves ! -name live ! -name EstvShadowDir ! -name estv-valm-RELEASE -exec rm -r {} + 2>/dev/null
find "$CODEV_DATA_DIR/" -mindepth 1 -maxdepth 1 ! -name app_tbs_64 ! -name files -exec rm -r {} + 2>/dev/null
echo -e "${GREEN}无畏契约缓存清理完成！${NC}"
fi
echo -e "${BOLD}${GREEN}========================================${NC}"
echo -e "${BOLD}${GREEN} 所有操作执行完毕！即将重启设备 ${NC}"
echo -e "${BOLD}${GREEN}========================================${NC}"
echo -e "${YELLOW}等待5秒后自动重启...${NC}"
sleep 5
reboot
}
# ========== 融合生命周期与冲突处理 ==========
nx_initialize() {
mkdir -p "$NX_WORK_DIR" 2>/dev/null
chmod 700 "$NX_WORK_DIR" 2>/dev/null
rmdir "$NX_FEATURE_LOCK" 2>/dev/null
if [ "$HAOGE_KEEP_RULES_RECOVERY" = "1" ]; then
touch "$NX_MOUNT_LIST" "$NX_FEATURE_FILE" 2>/dev/null
else
: > "$NX_MOUNT_LIST"
: > "$NX_FEATURE_FILE"
rm -f "$NX_RECOVERY_GUARD_FILE" 2>/dev/null
fi
IPTABLES_CMD=$(nx_find_iptables)
IP6TABLES_CMD=$(nx_find_ip6tables)
nx_counter_initialize
block_count=$(nx_counter_get total_block)
}
nx_counter_pause() {
if nx_command_exists usleep; then usleep 50000 2>/dev/null; else sleep 1; fi
}
nx_counter_lock() {
_nx_lock_tries=0
while ! mkdir "$NX_COUNTER_LOCK" 2>/dev/null; do
_nx_lock_tries=$((_nx_lock_tries + 1))
if [ "$_nx_lock_tries" -ge 40 ]; then
_nx_lock_time=$(stat -c %Y "$NX_COUNTER_LOCK" 2>/dev/null)
_nx_now=$(date +%s)
[ -n "$_nx_lock_time" ] && [ $((_nx_now - _nx_lock_time)) -gt 10 ] && rmdir "$NX_COUNTER_LOCK" 2>/dev/null
_nx_lock_tries=0
fi
nx_counter_pause
done
}
nx_counter_unlock() { rmdir "$NX_COUNTER_LOCK" 2>/dev/null; }
nx_counter_initialize() {
mkdir -p "$NX_WORK_DIR" 2>/dev/null
if [ ! -f "$NX_COUNTER_FILE" ]; then
printf 'total_block=0\nip_last_hao4=0\nip_last_nx4=0\nip_last_battle=0\nip_last_dns=0\nip_last_hao6=0\nip_last_nx6=0\n' > "$NX_COUNTER_FILE"
fi
_nx_total=$(grep -m1 '^total_block=' "$NX_COUNTER_FILE" 2>/dev/null | cut -d= -f2)
case "$_nx_total" in ''|*[!0-9]*) nx_counter_set total_block 0;; esac
}
nx_counter_reset_session() {
mkdir -p "$NX_WORK_DIR" 2>/dev/null
rmdir "$NX_COUNTER_LOCK" 2>/dev/null
# Remove the durable counter files created only by the reverted build so an
# old lifetime total can never reappear in this session-scoped UI.
rm -f /data/local/.hg_cloud_defense_data/cumulative.stats /data/local/.hg_cloud_defense_data/cumulative.stats.bak /data/local/.hg_cloud_defense_data/.cumulative.stats.tmp /data/local/.hg_cloud_defense_data/.cumulative.stats.bak.tmp 2>/dev/null
printf 'total_block=0\nip_last_hao4=0\nip_last_nx4=0\nip_last_battle=0\nip_last_dns=0\nip_last_hao6=0\nip_last_nx6=0\n' > "$NX_COUNTER_FILE"
block_count=0
}
nx_counter_get() {
_nx_counter_value=$(grep -m1 "^$1=" "$NX_COUNTER_FILE" 2>/dev/null | cut -d= -f2)
case "$_nx_counter_value" in ''|*[!0-9]*) echo 0;; *) echo "$_nx_counter_value";; esac
}
nx_counter_set_unlocked() {
_nx_counter_key=$1; _nx_counter_value=$2
_nx_counter_tmp="$NX_COUNTER_FILE.tmp"
printf '%s=%s\n' "$_nx_counter_key" "$_nx_counter_value" > "$_nx_counter_tmp"
grep -v "^${_nx_counter_key}=" "$NX_COUNTER_FILE" 2>/dev/null >> "$_nx_counter_tmp"
mv "$_nx_counter_tmp" "$NX_COUNTER_FILE" 2>/dev/null
}
nx_counter_set() {
nx_counter_lock
nx_counter_set_unlocked "$1" "$2"
nx_counter_unlock
}
nx_counter_add_total() {
_nx_counter_add=$1
[ "$_nx_counter_add" -gt 0 ] 2>/dev/null || return 0
nx_counter_lock
_nx_counter_total=$(nx_counter_get total_block)
nx_counter_set_unlocked total_block $((_nx_counter_total + _nx_counter_add))
block_count=$((_nx_counter_total + _nx_counter_add))
nx_counter_unlock
}
nx_read_chain_hits() {
_nx_hit_cmd=$1; _nx_hit_table=$2; _nx_hit_chain=$3
[ -n "$_nx_hit_cmd" ] && [ -n "$_nx_hit_chain" ] || { echo 0; return; }
$_nx_hit_cmd -t "$_nx_hit_table" -n -v -L "$_nx_hit_chain" 2>/dev/null | awk '/DROP|REJECT/ {sum += $1} END {print sum+0}'
}
nx_accumulate_chain_hits() {
_nx_last_key=$1; _nx_hit_cmd=$2; _nx_hit_table=$3; _nx_hit_chain=$4
_nx_raw_hits=$(nx_read_chain_hits "$_nx_hit_cmd" "$_nx_hit_table" "$_nx_hit_chain")
case "$_nx_raw_hits" in ''|*[!0-9]*) _nx_raw_hits=0;; esac
nx_counter_lock
_nx_last_hits=$(nx_counter_get "$_nx_last_key")
_nx_total_hits=$(nx_counter_get total_block)
if [ "$_nx_raw_hits" -ge "$_nx_last_hits" ]; then
NX_CHAIN_DELTA=$((_nx_raw_hits - _nx_last_hits))
else
# A rule refresh/rebuild lowered kernel counters. Keep the persistent total
# unchanged and use the new raw value as the next baseline.
NX_CHAIN_DELTA=0
fi
nx_counter_set_unlocked "$_nx_last_key" "$_nx_raw_hits"
[ "$NX_CHAIN_DELTA" -gt 0 ] && nx_counter_set_unlocked total_block $((_nx_total_hits + NX_CHAIN_DELTA))
nx_counter_unlock
}
sync_iptables_stats() {
[ -f "$NX_COUNTER_FILE" ] || nx_counter_initialize
_nx_sync_force=$1
_nx_sync_now=$(date +%s)
if [ "$_nx_sync_force" != "force" ] && [ $((_nx_sync_now - NX_STATS_LAST_SYNC)) -lt 2 ]; then
block_count=$(nx_counter_get total_block)
return 0
fi
NX_STATS_LAST_SYNC=$_nx_sync_now
_nx_added_hits=0
nx_accumulate_chain_hits ip_last_hao4 "$IPTABLES_CMD" filter "$IPV4_CHAIN"; _nx_added_hits=$((_nx_added_hits + NX_CHAIN_DELTA))
nx_accumulate_chain_hits ip_last_hao6 "$IP6TABLES_CMD" filter "$IPV6_CHAIN"; _nx_added_hits=$((_nx_added_hits + NX_CHAIN_DELTA))
if [ "$NX_PROFILE" = "aggressive" ]; then
nx_accumulate_chain_hits ip_last_nx4 "$IPTABLES_CMD" filter "$NX_CHAIN_V4"; _nx_added_hits=$((_nx_added_hits + NX_CHAIN_DELTA))
nx_accumulate_chain_hits ip_last_battle "$IPTABLES_CMD" filter "$NX_BATTLE_CHAIN"; _nx_added_hits=$((_nx_added_hits + NX_CHAIN_DELTA))
nx_accumulate_chain_hits ip_last_dns "$IPTABLES_CMD" nat "$NX_DNS_CHAIN"; _nx_added_hits=$((_nx_added_hits + NX_CHAIN_DELTA))
nx_accumulate_chain_hits ip_last_nx6 "$IP6TABLES_CMD" filter "$NX_CHAIN_V6"; _nx_added_hits=$((_nx_added_hits + NX_CHAIN_DELTA))
fi
block_count=$(nx_counter_get total_block)
[ "$_nx_added_hits" -gt 0 ] && write_block_log "BLOCK" "防火墙新增拦截 ${_nx_added_hits} 次，累计 ${block_count} 次"
}
update_stat() {
_nx_stat_key=$1; _nx_stat_add=${2:-1}
hao_update_stat "$_nx_stat_key" "$_nx_stat_add"
_nx_stat_rc=$?
# 内部防护动作继续写入 STATS_FILE 供模块状态使用，但 UI 的
# total_block 只允许由 sync_iptables_stats() 的内核规则命中量增加。
block_count=$(nx_counter_get total_block)
return "$_nx_stat_rc"
}
update_status_file() {
[ "$NX_DEFER_STATUS_WRITE" -eq 1 ] && return 0
hao_update_status_file
}
# state: ok=已验证, sent=已下发待设备验证, wait=等待游戏, fail=失败, skip=不适用
nx_feature_lock() {
_nx_feature_lock_tries=0
while ! mkdir "$NX_FEATURE_LOCK" 2>/dev/null; do
_nx_feature_lock_tries=$((_nx_feature_lock_tries + 1))
if [ "$_nx_feature_lock_tries" -ge 40 ]; then
# A feature-state write is tiny. A lock surviving this long is stale.
rmdir "$NX_FEATURE_LOCK" 2>/dev/null
_nx_feature_lock_tries=0
fi
nx_counter_pause
done
}
nx_feature_unlock() { rmdir "$NX_FEATURE_LOCK" 2>/dev/null; }
nx_feature_set() {
_nx_key=$1; _nx_state=$2; shift 2; _nx_detail=$*
nx_feature_lock
_nx_tmp="$NX_FEATURE_FILE.tmp"
grep -v "^${_nx_key}|" "$NX_FEATURE_FILE" 2>/dev/null > "$_nx_tmp"
printf '%s|%s|%s\n' "$_nx_key" "$_nx_state" "$_nx_detail" >> "$_nx_tmp"
mv "$_nx_tmp" "$NX_FEATURE_FILE" 2>/dev/null
_nx_feature_rc=$?
nx_feature_unlock
return "$_nx_feature_rc"
}
nx_feature_summary() {
[ -f "$NX_FEATURE_FILE" ] || { echo "无扩展状态"; return; }
_nx_ok=$(grep -c '|ok|' "$NX_FEATURE_FILE" 2>/dev/null); _nx_ok=${_nx_ok:-0}
_nx_sent=$(grep -c '|sent|' "$NX_FEATURE_FILE" 2>/dev/null); _nx_sent=${_nx_sent:-0}
_nx_wait=$(grep -c '|wait|' "$NX_FEATURE_FILE" 2>/dev/null); _nx_wait=${_nx_wait:-0}
_nx_fail=$(grep -c '|fail|' "$NX_FEATURE_FILE" 2>/dev/null); _nx_fail=${_nx_fail:-0}
printf '状态统计：已确认%s项 / 待设备确认%s项 / 等待%s项 / 失败%s项' "$_nx_ok" "$_nx_sent" "$_nx_wait" "$_nx_fail"
}
nx_acquire_instance() {
if [ -f "$NX_MAIN_PID_FILE" ] && [ -f "$NX_INSTANCE_START_FILE" ]; then
_nx_old_pid=$(cat "$NX_MAIN_PID_FILE" 2>/dev/null)
_nx_old_start=$(cat "$NX_INSTANCE_START_FILE" 2>/dev/null)
_nx_now_start=$(awk '{print $22}' "/proc/$_nx_old_pid/stat" 2>/dev/null)
if [ -n "$_nx_old_pid" ] && [ "$_nx_old_start" = "$_nx_now_start" ] && kill -0 "$_nx_old_pid" 2>/dev/null; then
printf '%b\n' "${C_YELLOW}皓哥云盾已有一个防护实例正在运行（PID $_nx_old_pid）${C_RESET}"
return 1
fi
fi
echo $$ > "$NX_MAIN_PID_FILE"
awk '{print $22}' "/proc/$$/stat" 2>/dev/null > "$NX_INSTANCE_START_FILE"
return 0
}
nx_other_instance_alive() {
[ -f "$NX_MAIN_PID_FILE" ] && [ -f "$NX_INSTANCE_START_FILE" ] || return 1
_nx_other_pid=$(cat "$NX_MAIN_PID_FILE" 2>/dev/null)
_nx_other_start=$(cat "$NX_INSTANCE_START_FILE" 2>/dev/null)
[ -n "$_nx_other_pid" ] && [ "$_nx_other_pid" != "$$" ] || return 1
_nx_other_now=$(awk '{print $22}' "/proc/$_nx_other_pid/stat" 2>/dev/null)
[ -n "$_nx_other_start" ] && [ "$_nx_other_start" = "$_nx_other_now" ] && kill -0 "$_nx_other_pid" 2>/dev/null
}
nx_backup_system_state() {
[ "$NX_SYSTEM_STATE_BACKED_UP" -eq 1 ] && return 0
if [ -f "$NX_SYSTEM_BACKUP_MARKER" ]; then
NX_SYSTEM_STATE_BACKED_UP=1
nx_feature_set system_backup ok "检测到完整的原值备份，继续用于异常恢复"
return 0
fi
for _nx_prop in ro.debuggable ro.secure ro.build.type ro.build.tags ro.kernel.android.checkjni persist.sys.usb.config service.adb.tcp.port persist.service.adb.enable persist.adb.enable; do
rm -f "$NX_WORK_DIR/prop_$(echo "$_nx_prop" | tr '.' '_')" 2>/dev/null
done
for _nx_prop in ro.debuggable ro.secure ro.build.type ro.build.tags ro.kernel.android.checkjni persist.sys.usb.config service.adb.tcp.port persist.service.adb.enable persist.adb.enable; do
getprop "$_nx_prop" > "$NX_WORK_DIR/prop_$(echo "$_nx_prop" | tr '.' '_')" 2>/dev/null || return 1
done
touch "$NX_SYSTEM_BACKUP_MARKER" 2>/dev/null || return 1
NX_SYSTEM_STATE_BACKED_UP=1
nx_feature_set system_backup ok "系统属性原值已保存"
}
nx_set_prop() {
_nx_prop=$1; _nx_value=$2
case "$_nx_prop" in
ro.*)
nx_command_exists resetprop || return 2
resetprop -n "$_nx_prop" "$_nx_value" 2>/dev/null || return 1
;;
*) setprop "$_nx_prop" "$_nx_value" 2>/dev/null || return 1 ;;
esac
[ "$(getprop "$_nx_prop" 2>/dev/null)" = "$_nx_value" ]
}
nx_running_from_adb() {
_nx_pid=$$
_nx_depth=0
while [ "$_nx_depth" -lt 12 ] && [ -r "/proc/$_nx_pid/status" ]; do
tr '\000' ' ' < "/proc/$_nx_pid/cmdline" 2>/dev/null | grep -q 'adbd' && return 0
_nx_pid=$(awk '/^PPid:/ {print $2}' "/proc/$_nx_pid/status" 2>/dev/null)
[ -n "$_nx_pid" ] || break
_nx_depth=$((_nx_depth + 1))
done
return 1
}
nx_disable_adb() {
nx_backup_system_state || { nx_feature_set adb_control fail "系统原值备份失败，未修改ADB状态"; return 1; }
_nx_changed=0
nx_set_prop persist.adb.enable 0 && _nx_changed=$((_nx_changed + 1))
nx_set_prop service.adb.tcp.port -1 && _nx_changed=$((_nx_changed + 1))
if nx_running_from_adb; then
nx_feature_set adb_control sent "属性已下发；当前由ADB启动，未停止adbd以避免脚本中断"
else
stop adbd 2>/dev/null
sleep 1
if [ "$(getprop init.svc.adbd 2>/dev/null)" = "stopped" ]; then
nx_feature_set adb_control ok "ADB服务已停止"
else
nx_feature_set adb_control sent "ADB关闭命令已下发"
fi
fi
}
nx_spoof_debug_props() {
nx_backup_system_state || { nx_feature_set debug_props fail "系统原值备份失败，未修改调试属性"; return 1; }
_nx_ok=0; _nx_sent=0; _nx_fail=0
for _nx_pair in 'ro.debuggable=0' 'ro.secure=1' 'ro.build.type=user' 'ro.build.tags=release-keys' 'ro.kernel.android.checkjni=0' 'persist.sys.usb.config=mtp' 'service.adb.tcp.port=-1' 'persist.service.adb.enable=0' 'persist.adb.enable=0'; do
_nx_prop=${_nx_pair%%=*}; _nx_value=${_nx_pair#*=}
nx_set_prop "$_nx_prop" "$_nx_value"
case $? in
0) _nx_ok=$((_nx_ok + 1));;
2) _nx_sent=$((_nx_sent + 1));;
*) _nx_fail=$((_nx_fail + 1));;
esac
done
if [ "$_nx_ok" -gt 0 ] && [ "$_nx_fail" -eq 0 ]; then
nx_feature_set debug_props ok "已验证$_nx_ok项；受设备限制$_nx_sent项"
elif [ "$_nx_ok" -gt 0 ]; then
nx_feature_set debug_props sent "已验证$_nx_ok项；受限$_nx_sent项；失败$_nx_fail项"
else
nx_feature_set debug_props sent "属性方案已执行；受限$_nx_sent项；失败$_nx_fail项"
fi
}
nx_clean_ace_cache() {
_nx_touched=0
for _nx_path in /data/local/tmp/.ace* /data/local/tmp/vmp* /data/local/tmp/tp* \
"/data/data/${GAME_PKG}/cache"/*report* "/data/data/${GAME_PKG}/files"/*trace*; do
[ -e "$_nx_path" ] || continue
rm -rf -- "$_nx_path" 2>/dev/null && _nx_touched=$((_nx_touched + 1))
done
logcat -b all -c 2>/dev/null
nx_feature_set cache_clean ok "已检查并清理$_nx_touched项；日志清理命令已执行"
}
nx_ensure_uid() {
case "$GAME_UID" in ''|0|*[!0-9]*) GAME_UID=$(nx_retry_get_uid);; esac
case "$GAME_UID" in ''|0|*[!0-9]*) nx_feature_set game_uid wait "等待游戏安装信息/UID"; return 1;; esac
[ "$GAME_UID" -gt 10000 ] 2>/dev/null || { nx_feature_set game_uid fail "UID无效：$GAME_UID"; return 1; }
nx_feature_set game_uid ok "UID=$GAME_UID"
}
# Only creates and edits our own chains. It never restores or flushes the
# device tables, and appends after the original Hao jump so original priority
# and behaviour remain unchanged.
nx_deploy_firewall() {
[ -n "$IPTABLES_CMD" ] || { nx_feature_set extra_firewall fail "iptables不可用"; return 1; }
nx_ensure_uid || return 1
sync_iptables_stats force
# 只重建激进版的 filter 链，不能连带删除已经工作的 DNS 扩展链。
# 基础皓哥链始终不在本函数的清理范围内。
nx_remove_own_firewall_rules
$IPTABLES_CMD -N "$NX_BATTLE_CHAIN" 2>/dev/null
$IPTABLES_CMD -F "$NX_BATTLE_CHAIN" 2>/dev/null || return 1
$IPTABLES_CMD -A "$NX_BATTLE_CHAIN" -j RETURN 2>/dev/null
$IPTABLES_CMD -N "$NX_CHAIN_V4" 2>/dev/null
$IPTABLES_CMD -F "$NX_CHAIN_V4" 2>/dev/null || return 1
$IPTABLES_CMD -A "$NX_CHAIN_V4" -j "$NX_BATTLE_CHAIN" 2>/dev/null
# UDP 12000 must precede broad voice returns or it is unreachable.
$IPTABLES_CMD -A "$NX_CHAIN_V4" -p udp --dport 12000 -j DROP 2>/dev/null
for _nx_range in 10000:40000 22000:23000 17500:17502 3478:3480 8000:8050 5000:5500 7000:8000 54000:54012; do
$IPTABLES_CMD -A "$NX_CHAIN_V4" -p udp --dport "$_nx_range" -j RETURN 2>/dev/null
done
$IPTABLES_CMD -A "$NX_CHAIN_V4" -p udp --dport 8088 -j RETURN 2>/dev/null
$IPTABLES_CMD -A "$NX_CHAIN_V4" -p udp --dport 8180:8181 -j RETURN 2>/dev/null
$IPTABLES_CMD -A "$NX_CHAIN_V4" -p udp --dport 53 -j RETURN 2>/dev/null
$IPTABLES_CMD -A "$NX_CHAIN_V4" -p tcp --dport 53 -j RETURN 2>/dev/null
$IPTABLES_CMD -A "$NX_CHAIN_V4" -p udp --dport 123 -j RETURN 2>/dev/null
$IPTABLES_CMD -A "$NX_CHAIN_V4" -s 127.0.0.1 -d 127.0.0.1 -j RETURN 2>/dev/null
for _nx_port in $NX_GAME_TCP_PORTS; do $IPTABLES_CMD -A "$NX_CHAIN_V4" -p tcp --dport "$_nx_port" -j RETURN 2>/dev/null; done
for _nx_cidr in $NX_QQ_WHITELIST_CIDR; do
$IPTABLES_CMD -A "$NX_CHAIN_V4" -d "$_nx_cidr" -p tcp --dport 80 -j RETURN 2>/dev/null
$IPTABLES_CMD -A "$NX_CHAIN_V4" -d "$_nx_cidr" -p tcp --dport 443 -j RETURN 2>/dev/null
done
for _nx_port in $NX_HIGH_RISK_TCP_PORTS_ACTIVE; do $IPTABLES_CMD -A "$NX_CHAIN_V4" -p tcp --dport "$_nx_port" -j DROP 2>/dev/null; done
for _nx_port in $NX_HIGH_RISK_UDP_PORTS_ACTIVE; do
[ "$_nx_port" = "12000" ] && continue
$IPTABLES_CMD -A "$NX_CHAIN_V4" -p udp --dport "$_nx_port" -j DROP 2>/dev/null
done
$IPTABLES_CMD -A "$NX_CHAIN_V4" -j RETURN 2>/dev/null
$IPTABLES_CMD -A OUTPUT -m owner --uid-owner "$GAME_UID" -j "$NX_CHAIN_V4" 2>/dev/null || {
nx_feature_set extra_firewall fail "扩展IPv4链挂载失败"; return 1;
}
nx_counter_set ip_last_nx4 0
nx_counter_set ip_last_battle 0
_nx_v6=""
if [ -n "$IP6TABLES_CMD" ] && [ -f /proc/net/if_inet6 ]; then
$IP6TABLES_CMD -N "$NX_CHAIN_V6" 2>/dev/null
$IP6TABLES_CMD -F "$NX_CHAIN_V6" 2>/dev/null
$IP6TABLES_CMD -A "$NX_CHAIN_V6" -p udp --dport 53 -j RETURN 2>/dev/null
$IP6TABLES_CMD -A "$NX_CHAIN_V6" -p tcp --dport 53 -j RETURN 2>/dev/null
$IP6TABLES_CMD -A "$NX_CHAIN_V6" -s ::1 -d ::1 -j RETURN 2>/dev/null
for _nx_port in $NX_HIGH_RISK_TCP_PORTS_ACTIVE; do $IP6TABLES_CMD -A "$NX_CHAIN_V6" -p tcp --dport "$_nx_port" -j DROP 2>/dev/null; done
for _nx_port in $NX_HIGH_RISK_UDP_PORTS_ACTIVE; do $IP6TABLES_CMD -A "$NX_CHAIN_V6" -p udp --dport "$_nx_port" -j DROP 2>/dev/null; done
$IP6TABLES_CMD -A "$NX_CHAIN_V6" -j RETURN 2>/dev/null
$IP6TABLES_CMD -A OUTPUT -m owner --uid-owner "$GAME_UID" -j "$NX_CHAIN_V6" 2>/dev/null && _nx_v6="，IPv6已挂载"
nx_counter_set ip_last_nx6 0
fi
if nx_aggressive_firewall_rules_ok; then
: > "$NX_FIREWALL_VERIFIED_MARKER"
nx_feature_set extra_firewall ok "扩展链、挂载及全部关键放行/拦截规则已逐项验证$_nx_v6"
return 0
fi
rm -f "$NX_FIREWALL_VERIFIED_MARKER" 2>/dev/null
nx_feature_set extra_firewall fail "扩展链已下发，但关键规则未全部通过内核验证"
return 1
}
nx_aggressive_firewall_structure_ok() {
[ -n "$IPTABLES_CMD" ] || return 1
[ -n "$GAME_UID" ] || return 1
$IPTABLES_CMD -n -L "$NX_CHAIN_V4" >/dev/null 2>&1 || return 1
$IPTABLES_CMD -n -L "$NX_BATTLE_CHAIN" >/dev/null 2>&1 || return 1
$IPTABLES_CMD -C OUTPUT -m owner --uid-owner "$GAME_UID" -j "$NX_CHAIN_V4" >/dev/null 2>&1 || \
$IPTABLES_CMD -S OUTPUT 2>/dev/null | grep -F -- "--uid-owner $GAME_UID" | grep -Fq -- "-j $NX_CHAIN_V4" || return 1
if [ -n "$IP6TABLES_CMD" ] && [ -f /proc/net/if_inet6 ]; then
$IP6TABLES_CMD -n -L "$NX_CHAIN_V6" >/dev/null 2>&1 || return 1
$IP6TABLES_CMD -C OUTPUT -m owner --uid-owner "$GAME_UID" -j "$NX_CHAIN_V6" >/dev/null 2>&1 || \
$IP6TABLES_CMD -S OUTPUT 2>/dev/null | grep -F -- "--uid-owner $GAME_UID" | grep -Fq -- "-j $NX_CHAIN_V6" || return 1
fi
return 0
}
nx_aggressive_firewall_rules_ok() {
nx_aggressive_firewall_structure_ok || return 1
$IPTABLES_CMD -C "$NX_CHAIN_V4" -j "$NX_BATTLE_CHAIN" >/dev/null 2>&1 || return 1
$IPTABLES_CMD -C "$NX_CHAIN_V4" -p udp --dport 12000 -j DROP >/dev/null 2>&1 || return 1
for _nx_range in 10000:40000 22000:23000 17500:17502 3478:3480 8000:8050 5000:5500 7000:8000 54000:54012; do
$IPTABLES_CMD -C "$NX_CHAIN_V4" -p udp --dport "$_nx_range" -j RETURN >/dev/null 2>&1 || return 1
done
for _nx_port in $NX_GAME_TCP_PORTS; do
$IPTABLES_CMD -C "$NX_CHAIN_V4" -p tcp --dport "$_nx_port" -j RETURN >/dev/null 2>&1 || return 1
done
for _nx_cidr in $NX_QQ_WHITELIST_CIDR; do
$IPTABLES_CMD -C "$NX_CHAIN_V4" -d "$_nx_cidr" -p tcp --dport 80 -j RETURN >/dev/null 2>&1 || return 1
$IPTABLES_CMD -C "$NX_CHAIN_V4" -d "$_nx_cidr" -p tcp --dport 443 -j RETURN >/dev/null 2>&1 || return 1
done
for _nx_port in $NX_HIGH_RISK_TCP_PORTS_ACTIVE; do
$IPTABLES_CMD -C "$NX_CHAIN_V4" -p tcp --dport "$_nx_port" -j DROP >/dev/null 2>&1 || return 1
done
if [ -n "$IP6TABLES_CMD" ] && [ -f /proc/net/if_inet6 ]; then
$IP6TABLES_CMD -n -L "$NX_CHAIN_V6" >/dev/null 2>&1 || return 1
$IP6TABLES_CMD -C OUTPUT -m owner --uid-owner "$GAME_UID" -j "$NX_CHAIN_V6" >/dev/null 2>&1 || return 1
for _nx_port in $NX_HIGH_RISK_TCP_PORTS_ACTIVE; do
$IP6TABLES_CMD -C "$NX_CHAIN_V6" -p tcp --dport "$_nx_port" -j DROP >/dev/null 2>&1 || return 1
done
for _nx_port in $NX_HIGH_RISK_UDP_PORTS_ACTIVE; do
$IP6TABLES_CMD -C "$NX_CHAIN_V6" -p udp --dport "$_nx_port" -j DROP >/dev/null 2>&1 || return 1
done
fi
return 0
}
# 激进链保活只在结构真的丢失时动作：链仍在就只补 OUTPUT 跳转，
# 整条链被外部删除时才重建；整个过程不触碰皓哥基础链。
nx_repair_aggressive_firewall() {
nx_aggressive_firewall_structure_ok && return 0
[ -n "$IPTABLES_CMD" ] || return 1
nx_ensure_uid || return 1
if $IPTABLES_CMD -n -L "$NX_CHAIN_V4" >/dev/null 2>&1 && $IPTABLES_CMD -n -L "$NX_BATTLE_CHAIN" >/dev/null 2>&1; then
$IPTABLES_CMD -C OUTPUT -m owner --uid-owner "$GAME_UID" -j "$NX_CHAIN_V4" >/dev/null 2>&1 || \
$IPTABLES_CMD -A OUTPUT -m owner --uid-owner "$GAME_UID" -j "$NX_CHAIN_V4" 2>/dev/null || return 1
if [ -n "$IP6TABLES_CMD" ] && [ -f /proc/net/if_inet6 ]; then
if ! $IP6TABLES_CMD -n -L "$NX_CHAIN_V6" >/dev/null 2>&1; then
$IP6TABLES_CMD -N "$NX_CHAIN_V6" 2>/dev/null || return 1
$IP6TABLES_CMD -A "$NX_CHAIN_V6" -p udp --dport 53 -j RETURN 2>/dev/null
$IP6TABLES_CMD -A "$NX_CHAIN_V6" -p tcp --dport 53 -j RETURN 2>/dev/null
$IP6TABLES_CMD -A "$NX_CHAIN_V6" -s ::1 -d ::1 -j RETURN 2>/dev/null
for _nx_port in $NX_HIGH_RISK_TCP_PORTS_ACTIVE; do $IP6TABLES_CMD -A "$NX_CHAIN_V6" -p tcp --dport "$_nx_port" -j DROP 2>/dev/null; done
for _nx_port in $NX_HIGH_RISK_UDP_PORTS_ACTIVE; do $IP6TABLES_CMD -A "$NX_CHAIN_V6" -p udp --dport "$_nx_port" -j DROP 2>/dev/null; done
$IP6TABLES_CMD -A "$NX_CHAIN_V6" -j RETURN 2>/dev/null
fi
$IP6TABLES_CMD -C OUTPUT -m owner --uid-owner "$GAME_UID" -j "$NX_CHAIN_V6" >/dev/null 2>&1 || \
$IP6TABLES_CMD -A OUTPUT -m owner --uid-owner "$GAME_UID" -j "$NX_CHAIN_V6" 2>/dev/null || return 1
fi
return 0
fi
nx_deploy_firewall
}
# UID-scoped DNS filtering replaces the source's global /etc/hosts bind. It
# carries the domain feature without changing shell/system DNS or Hao rules.
nx_deploy_dns_hijack() {
[ -n "$IPTABLES_CMD" ] || { nx_feature_set uid_dns fail "iptables不可用"; return 1; }
nx_ensure_uid || return 1
sync_iptables_stats force
$IPTABLES_CMD -t nat -N "$NX_DNS_CHAIN" 2>/dev/null
$IPTABLES_CMD -t nat -F "$NX_DNS_CHAIN" 2>/dev/null || { nx_feature_set uid_dns fail "nat链不可用"; return 1; }
_nx_allow_added=0
_nx_block_expected=0
_nx_udp_block_added=0
_nx_tcp_block_added=0
for _nx_dom in $NX_QQ_LOGIN_DOMAINS; do
$IPTABLES_CMD -t nat -A "$NX_DNS_CHAIN" -p udp --dport 53 -m string --algo bm --string "$_nx_dom" -j RETURN 2>/dev/null && _nx_allow_added=$((_nx_allow_added + 1))
done
for _nx_dom in $NX_HOSTS_DOMAIN_ACTIVE; do
_nx_block_expected=$((_nx_block_expected + 1))
$IPTABLES_CMD -t nat -A "$NX_DNS_CHAIN" -p udp --dport 53 -m string --algo bm --string "$_nx_dom" -j DROP 2>/dev/null && _nx_udp_block_added=$((_nx_udp_block_added + 1))
$IPTABLES_CMD -t nat -A "$NX_DNS_CHAIN" -p tcp --dport 53 -m string --algo bm --string "$_nx_dom" -j DROP 2>/dev/null && _nx_tcp_block_added=$((_nx_tcp_block_added + 1))
done
$IPTABLES_CMD -t nat -A "$NX_DNS_CHAIN" -j RETURN 2>/dev/null
while $IPTABLES_CMD -t nat -D OUTPUT -m owner --uid-owner "$GAME_UID" -p udp --dport 53 -j "$NX_DNS_CHAIN" 2>/dev/null; do :; done
while $IPTABLES_CMD -t nat -D OUTPUT -m owner --uid-owner "$GAME_UID" -p tcp --dport 53 -j "$NX_DNS_CHAIN" 2>/dev/null; do :; done
$IPTABLES_CMD -t nat -A OUTPUT -m owner --uid-owner "$GAME_UID" -p udp --dport 53 -j "$NX_DNS_CHAIN" 2>/dev/null || { nx_feature_set uid_dns fail "UDP DNS链挂载失败"; return 1; }
$IPTABLES_CMD -t nat -A OUTPUT -m owner --uid-owner "$GAME_UID" -p tcp --dport 53 -j "$NX_DNS_CHAIN" 2>/dev/null || { nx_feature_set uid_dns fail "TCP DNS链挂载失败"; return 1; }
nx_counter_set ip_last_dns 0
if [ "$_nx_block_expected" -gt 0 ] && [ "$_nx_udp_block_added" -eq "$_nx_block_expected" ] && [ "$_nx_tcp_block_added" -eq "$_nx_block_expected" ] && nx_aggressive_dns_rules_ok; then
: > "$NX_DNS_VERIFIED_MARKER"
nx_feature_set uid_dns ok "仅游戏UID生效；放行$_nx_allow_added条，UDP/TCP各$_nx_block_expected条拦截均已验证"
return 0
fi
rm -f "$NX_DNS_VERIFIED_MARKER" 2>/dev/null
nx_feature_set uid_dns fail "未验证到有效域名拦截规则；设备可能缺少string/nat支持"
return 1
}
nx_aggressive_dns_structure_ok() {
[ -n "$IPTABLES_CMD" ] || return 1
[ -n "$GAME_UID" ] || return 1
$IPTABLES_CMD -t nat -n -L "$NX_DNS_CHAIN" >/dev/null 2>&1 || return 1
$IPTABLES_CMD -t nat -C OUTPUT -m owner --uid-owner "$GAME_UID" -p udp --dport 53 -j "$NX_DNS_CHAIN" >/dev/null 2>&1 || \
$IPTABLES_CMD -t nat -S OUTPUT 2>/dev/null | grep -F -- "--uid-owner $GAME_UID" | grep -F -- "-p udp" | grep -F -- "--dport 53" | grep -Fq -- "-j $NX_DNS_CHAIN" || return 1
$IPTABLES_CMD -t nat -C OUTPUT -m owner --uid-owner "$GAME_UID" -p tcp --dport 53 -j "$NX_DNS_CHAIN" >/dev/null 2>&1 || \
$IPTABLES_CMD -t nat -S OUTPUT 2>/dev/null | grep -F -- "--uid-owner $GAME_UID" | grep -F -- "-p tcp" | grep -F -- "--dport 53" | grep -Fq -- "-j $NX_DNS_CHAIN" || return 1
return 0
}
nx_aggressive_dns_rules_ok() {
nx_aggressive_dns_structure_ok || return 1
_nx_expected=0
for _nx_dom in $NX_HOSTS_DOMAIN_ACTIVE; do _nx_expected=$((_nx_expected + 1)); done
[ "$_nx_expected" -gt 0 ] || return 1
_nx_drop_count=$($IPTABLES_CMD -t nat -S "$NX_DNS_CHAIN" 2>/dev/null | grep -F -- '-j DROP' | wc -l | tr -d ' ')
case "$_nx_drop_count" in ''|*[!0-9]*) return 1;; esac
[ "$_nx_drop_count" -ge $((_nx_expected * 2)) ]
}
nx_repair_aggressive_dns() {
nx_aggressive_dns_structure_ok && return 0
[ -n "$IPTABLES_CMD" ] || return 1
nx_ensure_uid || return 1
if $IPTABLES_CMD -t nat -n -L "$NX_DNS_CHAIN" >/dev/null 2>&1; then
$IPTABLES_CMD -t nat -C OUTPUT -m owner --uid-owner "$GAME_UID" -p udp --dport 53 -j "$NX_DNS_CHAIN" >/dev/null 2>&1 || \
$IPTABLES_CMD -t nat -A OUTPUT -m owner --uid-owner "$GAME_UID" -p udp --dport 53 -j "$NX_DNS_CHAIN" 2>/dev/null || return 1
$IPTABLES_CMD -t nat -C OUTPUT -m owner --uid-owner "$GAME_UID" -p tcp --dport 53 -j "$NX_DNS_CHAIN" >/dev/null 2>&1 || \
$IPTABLES_CMD -t nat -A OUTPUT -m owner --uid-owner "$GAME_UID" -p tcp --dport 53 -j "$NX_DNS_CHAIN" 2>/dev/null || return 1
return 0
fi
nx_deploy_dns_hijack
}
nx_game_pids() {
if nx_command_exists pgrep; then pgrep -f "$GAME_PKG" 2>/dev/null; else ps -A 2>/dev/null | grep "$GAME_PKG" | awk '{print $2}'; fi
}
nx_root_hide() {
nx_is_game_running || { nx_feature_set root_hide wait "等待游戏进程"; return 0; }
nx_command_exists nsenter || { nx_feature_set root_hide sent "设备无nsenter，已保留方案但未做全局挂载以免冲突"; return 0; }
mkdir -p "$NX_WORK_DIR/empty_dir" 2>/dev/null
: > "$NX_WORK_DIR/empty_file"
grep -vE 'ksu|magisk|/su|data/adb' /proc/mounts > "$NX_WORK_DIR/mounts_clean" 2>/dev/null
_nx_ok=0
for _nx_pid in $(nx_game_pids); do
[ -d "/proc/$_nx_pid/ns" ] || continue
for _nx_target in /data/adb; do
nsenter -t "$_nx_pid" -m -- mount -o bind "$NX_WORK_DIR/empty_dir" "$_nx_target" 2>/dev/null && { echo "$_nx_pid|$_nx_target" >> "$NX_MOUNT_LIST"; _nx_ok=$((_nx_ok + 1)); }
done
for _nx_target in /system/bin/su /system/xbin/su /sbin/su /vendor/bin/su; do
[ -e "$_nx_target" ] || continue
nsenter -t "$_nx_pid" -m -- mount -o bind "$NX_WORK_DIR/empty_file" "$_nx_target" 2>/dev/null && { echo "$_nx_pid|$_nx_target" >> "$NX_MOUNT_LIST"; _nx_ok=$((_nx_ok + 1)); }
done
if [ -s "$NX_WORK_DIR/mounts_clean" ]; then
for _nx_target in /proc/mounts /proc/self/mounts; do
nsenter -t "$_nx_pid" -m -- mount -o bind "$NX_WORK_DIR/mounts_clean" "$_nx_target" 2>/dev/null && { echo "$_nx_pid|$_nx_target" >> "$NX_MOUNT_LIST"; _nx_ok=$((_nx_ok + 1)); }
done
fi
done
if [ "$_nx_ok" -gt 0 ]; then nx_feature_set root_hide ok "仅游戏挂载命名空间生效$_nx_ok项"; else nx_feature_set root_hide sent "隔离挂载已尝试，设备命名空间未返回可验证结果"; fi
}
nx_dir_lock() {
mkdir -p "$NX_WORK_DIR/empty_dir" /data/local/tmp/vmp /data/local/tmp/ace_sdk /data/local/tmp/tp_guard 2>/dev/null
_nx_ok=0
for _nx_target in /data/local/tmp/vmp /data/local/tmp/ace_sdk /data/local/tmp/tp_guard; do
mount -o bind "$NX_WORK_DIR/empty_dir" "$_nx_target" 2>/dev/null && { echo "host|$_nx_target" >> "$NX_MOUNT_LIST"; _nx_ok=$((_nx_ok + 1)); }
done
if nx_command_exists chattr; then
mkdir -p "/data/data/${GAME_PKG}/.ns_v4_lock" 2>/dev/null
chattr +i "/data/data/${GAME_PKG}/.ns_v4_lock" 2>/dev/null
fi
if [ "$_nx_ok" -gt 0 ]; then nx_feature_set dir_lock ok "隔离目录已挂载$_nx_ok项"; else nx_feature_set dir_lock sent "目录隔离命令已下发"; fi
}
nx_kill_extra_processes() {
_nx_limited=0
for _nx_pid in $(nx_game_pids); do
_nx_cmd=$(tr '\000' ' ' < "/proc/$_nx_pid/cmdline" 2>/dev/null)
echo "$_nx_cmd" | grep -q "$GAME_PKG" || continue
echo "$_nx_cmd" | grep -qiE 'ace_sdk|tp_guard|vmp_scan|anti_cheat|tss_sdk' || continue
# 不再 SIGKILL 游戏子进程。部分机型会因此让游戏或整个任务自动
# 重启；改为低优先级限制，避免误伤游戏主进程和防护管理链路。
_nx_limit_ok=0
renice 19 -p "$_nx_pid" >/dev/null 2>&1 && _nx_limit_ok=1
if nx_command_exists ionice; then
ionice -c3 -p "$_nx_pid" >/dev/null 2>&1 && _nx_limit_ok=1
fi
[ "$_nx_limit_ok" -eq 1 ] && _nx_limited=$((_nx_limited + 1))
done
if [ "$_nx_limited" -gt 0 ]; then
nx_feature_set process_control ok "已验证限制$_nx_limited个匹配子进程，未强制结束游戏进程"
else
nx_feature_set process_control wait "未发现可验证的匹配子进程；未虚假计为已处理"
fi
}
nx_detect_battle() {
# Android 的 ss/netstat 经常不显示包名；优先读取内核 UDP 表中的 UID，
# 只把属于游戏 UID 的 UDP socket 视为活动连接；未 connect 的游戏
# UDP socket 远端地址通常仍是 0，不能据此漏判。
case "$GAME_UID" in ''|0|*[!0-9]*) GAME_UID=$(get_game_uid);; esac
if [ "$GAME_UID" -gt 10000 ] 2>/dev/null; then
for _nx_udp_table in /proc/net/udp /proc/net/udp6; do
[ -r "$_nx_udp_table" ] || continue
awk -v uid="$GAME_UID" 'NR > 1 && $8 == uid {found=1; exit} END {exit(found ? 0 : 1)}' "$_nx_udp_table" 2>/dev/null && return 0
done
fi
nx_command_exists ss && ss -tunp 2>/dev/null | grep -q "$GAME_PKG" && return 0
nx_command_exists netstat && netstat -tunp 2>/dev/null | grep -q "$GAME_PKG" && return 0
return 1
}
nx_battle_rules_ok() {
[ -n "$IPTABLES_CMD" ] || return 1
$IPTABLES_CMD -n -L "$NX_BATTLE_CHAIN" >/dev/null 2>&1 || return 1
for _nx_cidr in 122.96.96.0/24 59.83.207.0/24 222.136.0.0/16 222.138.0.0/16 153.3.220.0/24 153.3.50.0/24 172.66.147.0/24 104.20.23.0/24; do
$IPTABLES_CMD -C "$NX_BATTLE_CHAIN" -d "$_nx_cidr" -p tcp --dport 80 -j DROP >/dev/null 2>&1 || return 1
$IPTABLES_CMD -C "$NX_BATTLE_CHAIN" -d "$_nx_cidr" -p tcp --dport 443 -j DROP >/dev/null 2>&1 || return 1
done
return 0
}
nx_set_battle_block() {
_nx_enable=$1
[ -n "$IPTABLES_CMD" ] || return 1
$IPTABLES_CMD -n -L "$NX_BATTLE_CHAIN" >/dev/null 2>&1 || return 1
if [ "$_nx_enable" -eq 1 ]; then
# 战斗规则只允许首次增量挂载；一旦生效就持续保留到切换模式或主动退出。
if nx_battle_rules_ok; then
nx_feature_set battle_control ok "战斗态高风险拦截持续保持"
return 0
fi
sync_iptables_stats force
while $IPTABLES_CMD -D "$NX_BATTLE_CHAIN" -j RETURN 2>/dev/null; do :; done
# Preserve ordinary game/login traffic: battle tightening applies only to
# known reporting/inspection network ranges, never all TCP 80/443.
# 36.152.0.0/14 属于上方 QQ 白名单，不能在战斗链中反向封锁。
# 清除旧版本中与 QQ 白名单冲突的规则（如从残留链接管）。
while $IPTABLES_CMD -D "$NX_BATTLE_CHAIN" -d 36.152.0.0/14 -p tcp --dport 80 -j DROP 2>/dev/null; do :; done
while $IPTABLES_CMD -D "$NX_BATTLE_CHAIN" -d 36.152.0.0/14 -p tcp --dport 443 -j DROP 2>/dev/null; do :; done
for _nx_cidr in 122.96.96.0/24 59.83.207.0/24 222.136.0.0/16 222.138.0.0/16 153.3.220.0/24 153.3.50.0/24 172.66.147.0/24 104.20.23.0/24; do
$IPTABLES_CMD -C "$NX_BATTLE_CHAIN" -d "$_nx_cidr" -p tcp --dport 80 -j DROP >/dev/null 2>&1 || \
$IPTABLES_CMD -A "$NX_BATTLE_CHAIN" -d "$_nx_cidr" -p tcp --dport 80 -j DROP 2>/dev/null
$IPTABLES_CMD -C "$NX_BATTLE_CHAIN" -d "$_nx_cidr" -p tcp --dport 443 -j DROP >/dev/null 2>&1 || \
$IPTABLES_CMD -A "$NX_BATTLE_CHAIN" -d "$_nx_cidr" -p tcp --dport 443 -j DROP 2>/dev/null
done
$IPTABLES_CMD -A "$NX_BATTLE_CHAIN" -j RETURN 2>/dev/null
if nx_battle_rules_ok; then
nx_feature_set battle_control ok "战斗态高风险网段规则已逐项验证，未覆盖QQ白名单"
else
nx_feature_set battle_control fail "战斗态规则未全部通过内核验证"
return 1
fi
nx_counter_set ip_last_battle 0
else
# 游戏或战斗结束不再清空该链，避免拦截出现任何中断。
if $IPTABLES_CMD -n -L "$NX_BATTLE_CHAIN" 2>/dev/null | grep -q 'DROP'; then
nx_feature_set battle_control ok "游戏状态变化，现有战斗拦截继续保持"
else
nx_feature_set battle_control wait "等待首次战斗态连接"
fi
fi
}
nx_spoof_threads() {
[ "$NX_PROTECT_MODE" -eq 2 ] || return 0
_nx_now=$(date +%s)
[ $((_nx_now - NX_THREAD_SPOOF_LAST)) -lt 60 ] && return 0
NX_THREAD_SPOOF_LAST=$_nx_now
_nx_changed=0
_nx_names='RenderThread GameThread NativeThread AudioThread PhysXThread NetworkThread MainThread UIThread Binder_1 Binder_2'
for _nx_pid in $(nx_game_pids); do
[ -d "/proc/$_nx_pid/task" ] || continue
for _nx_tid_dir in /proc/$_nx_pid/task/*; do
[ -w "$_nx_tid_dir/comm" ] || continue
_nx_name=$(cat "$_nx_tid_dir/comm" 2>/dev/null)
echo "$_nx_name" | grep -qiE "$NX_SAFE_THREAD_REGEX" && continue
echo "$_nx_name" | grep -qiE "$NX_RISK_THREAD_REGEX" || continue
_nx_new=$(echo "$_nx_names" | awk -v n=$((RANDOM % 10 + 1)) '{print $n}')
printf '%s' "$_nx_new" > "$_nx_tid_dir/comm" 2>/dev/null && _nx_changed=$((_nx_changed + 1))
renice 19 -p "${_nx_tid_dir##*/}" 2>/dev/null
nx_command_exists ionice && ionice -c3 -p "${_nx_tid_dir##*/}" 2>/dev/null
done
done
if [ "$_nx_changed" -gt 0 ]; then
nx_feature_set thread_control ok "本轮已验证改名$_nx_changed个线程"
else
nx_feature_set thread_control wait "本轮未发现可验证的风险线程；未虚假显示已改名"
fi
}
tui_cleanup() {
if [ "$FUSION_SWITCHING" -eq 1 ] || [ -n "$FUSION_NEXT_ACTION" ]; then
tput cnorm 2>/dev/null
return 0
fi
hao_tui_cleanup
}
nx_update_heartbeat() {
[ "$NX_PROFILE" = "none" ] && return 0
date +%s > "$NX_HEARTBEAT_FILE" 2>/dev/null
}
nx_hao_daemon_alive() {
[ -f "$NX_HAO_DAEMON_PID_FILE" ] || return 1
_nx_hao_pid=$(cat "$NX_HAO_DAEMON_PID_FILE" 2>/dev/null)
_nx_hao_start=$(cat "$NX_HAO_DAEMON_START_FILE" 2>/dev/null)
[ -n "$_nx_hao_pid" ] && [ -n "$_nx_hao_start" ] || return 1
_nx_hao_now=$(awk '{print $22}' "/proc/$_nx_hao_pid/stat" 2>/dev/null)
[ "$_nx_hao_start" = "$_nx_hao_now" ] && kill -0 "$_nx_hao_pid" 2>/dev/null
}
pid_alive() {
if [ "$1" = "$DAEMON_PID_FILE" ]; then
nx_hao_daemon_alive
return $?
fi
hao_pid_alive "$1"
}
nx_keep_aux_resident() {
_nx_aux_pid=$1
[ -n "$_nx_aux_pid" ] && kill -0 "$_nx_aux_pid" 2>/dev/null || return 1
for _nx_aux_tasks in /dev/freezer/cgroup.procs /sys/fs/cgroup/cgroup.procs /dev/cpuset/foreground/tasks /dev/stune/foreground/tasks; do
[ -w "$_nx_aux_tasks" ] && echo "$_nx_aux_pid" > "$_nx_aux_tasks" 2>/dev/null
done
[ -w "/proc/$_nx_aux_pid/oom_score_adj" ] && echo -900 > "/proc/$_nx_aux_pid/oom_score_adj" 2>/dev/null
return 0
}
daemon_worker() {
trap '' SIGHUP
trap 'exit 0' SIGINT SIGTERM
while true; do
if pgrep -f "$GAME_PKG" >/dev/null 2>&1; then
# The parent records $! and its /proc start token immediately after this
# background worker is spawned. Wait for that verified PID instead of
# using $$, which can refer to the main interactive shell.
_nx_worker_pid=""
_nx_worker_tries=0
while [ "$_nx_worker_tries" -lt 50 ]; do
_nx_candidate=$(cat "$NX_HAO_DAEMON_PID_FILE" 2>/dev/null)
_nx_expected_start=$(cat "$NX_HAO_DAEMON_START_FILE" 2>/dev/null)
_nx_actual_start=$(awk '{print $22}' "/proc/$_nx_candidate/stat" 2>/dev/null)
if [ -n "$_nx_candidate" ] && [ -n "$_nx_expected_start" ] && [ "$_nx_expected_start" = "$_nx_actual_start" ] && kill -0 "$_nx_candidate" 2>/dev/null; then
_nx_worker_pid=$_nx_candidate
break
fi
_nx_worker_tries=$((_nx_worker_tries + 1))
if nx_command_exists usleep; then usleep 100000 2>/dev/null; else sleep 1; fi
done
if [ -n "$_nx_worker_pid" ]; then
nx_hao_daemon_worker_safe "$_nx_worker_pid"
else
write_block_log "WARN" "守护进程PID校验失败，本轮未调整任何进程优先级"
fi
sleep 2
else
sleep 2
fi
done
}
setup_firewall() {
sync_iptables_stats force
hao_setup_firewall
_hao_rc=$?
if [ "$_hao_rc" -eq 0 ]; then
nx_counter_set ip_last_hao4 0
nx_counter_set ip_last_hao6 0
fi
_hao_jump_ok=0
iptables -S OUTPUT 2>/dev/null | grep -q -- "-j $IPV4_CHAIN" && _hao_jump_ok=1
[ "$_hao_jump_ok" -eq 0 ] && iptables -n -L OUTPUT 2>/dev/null | grep -q "$IPV4_CHAIN" && _hao_jump_ok=1
if [ "$_hao_rc" -eq 0 ] && [ "$_hao_jump_ok" -eq 1 ] && iptables -n -L "$IPV4_CHAIN" >/dev/null 2>&1; then
nx_feature_set hao_firewall ok "皓哥原IPv4链与OUTPUT挂载已验证"
else
nx_feature_set hao_firewall fail "皓哥原防火墙未通过链路验证"
return 1
fi
return 0
}
nx_base_firewall_ok() {
[ -n "$IPV4_CHAIN" ] || return 1
iptables -n -L "$IPV4_CHAIN" >/dev/null 2>&1 || return 1
iptables -S OUTPUT 2>/dev/null | grep -q -- "-j $IPV4_CHAIN" && return 0
iptables -n -L OUTPUT 2>/dev/null | grep -q "$IPV4_CHAIN"
}
# 非破坏性修复：规则链存在时绝不清空，只补回丢失的 OUTPUT 跳转。
# 只有整个规则链已经被外部删除时，才允许完整重建。
nx_repair_base_firewall() {
nx_base_firewall_ok && return 0
if [ -n "$IPV4_CHAIN" ] && iptables -n -L "$IPV4_CHAIN" >/dev/null 2>&1; then
GAME_UID=$(get_game_uid)
[ "$GAME_UID" -gt 10000 ] 2>/dev/null || return 1
iptables -w 3 -I OUTPUT 1 -m owner --uid-owner "$GAME_UID" -j "$IPV4_CHAIN" 2>/dev/null || return 1
nx_base_firewall_ok
return $?
fi
setup_firewall
}
nx_write_runtime_state() {
_nx_state_tmp="$NX_RUNTIME_STATE_FILE.tmp.$$"
{
printf 'main_pid=%s\n' "$(cat "$NX_MAIN_PID_FILE" 2>/dev/null)"
printf 'main_start=%s\n' "$(cat "$NX_INSTANCE_START_FILE" 2>/dev/null)"
printf 'profile=%s\n' "$NX_PROFILE"
printf 'game_uid=%s\n' "$GAME_UID"
printf 'ipv4_chain=%s\n' "$IPV4_CHAIN"
printf 'ipv6_chain=%s\n' "$IPV6_CHAIN"
printf 'start_epoch=%s\n' "$start_time"
} > "$_nx_state_tmp" || return 1
mv "$_nx_state_tmp" "$NX_RUNTIME_STATE_FILE" 2>/dev/null
}
nx_load_runtime_state() {
[ -f "$NX_RUNTIME_STATE_FILE" ] || return 1
_nx_state_value() { grep -m1 "^$1=" "$NX_RUNTIME_STATE_FILE" 2>/dev/null | cut -d= -f2-; }
_nx_loaded_main=$(_nx_state_value main_pid)
_nx_loaded_start=$(_nx_state_value main_start)
NX_PROFILE=$(_nx_state_value profile)
GAME_UID=$(_nx_state_value game_uid)
IPV4_CHAIN=$(_nx_state_value ipv4_chain)
IPV6_CHAIN=$(_nx_state_value ipv6_chain)
start_time=$(_nx_state_value start_epoch)
[ -n "$_nx_loaded_main" ] && [ -n "$_nx_loaded_start" ] || return 1
[ -n "$start_time" ] || start_time=$(date +%s)
IPTABLES_CMD=$(nx_find_iptables)
IP6TABLES_CMD=$(nx_find_ip6tables)
return 0
}
nx_web_detach_process() {
_nx_detach_pid=${1:-$$}
[ -n "$_nx_detach_pid" ] && kill -0 "$_nx_detach_pid" 2>/dev/null || return 1
# Only the display service is moved. The interception core, chains and
# daemon priorities are deliberately untouched.
for _nx_detach_tasks in /dev/freezer/cgroup.procs /sys/fs/cgroup/cgroup.procs /dev/cpuset/foreground/tasks /dev/stune/foreground/tasks; do
[ -w "$_nx_detach_tasks" ] && echo "$_nx_detach_pid" > "$_nx_detach_tasks" 2>/dev/null
done
nx_set_oom_protect "$_nx_detach_pid"
}
nx_web_script_path() {
case "$0" in
/proc/self/fd/*)
printf '%s\n' "$0"
return 0
;;
esac
_nx_script=$(readlink -f "$0" 2>/dev/null)
if [ -z "$_nx_script" ]; then
case "$0" in /*) _nx_script=$0;; *) _nx_script="$(pwd -P)/$0";; esac
fi
printf '%s\n' "$_nx_script"
}
nx_spawn_web_service() {
_nx_spawn_backend=$1
_nx_spawn_script=$(nx_web_script_path)
[ -f "$_nx_spawn_script" ] || return 1
NX_SPAWNED_WEB_PID=""
if nx_command_exists setsid; then
if nx_command_exists nohup; then
nohup setsid /system/bin/sh "$_nx_spawn_script" "--web-service=$_nx_spawn_backend" "$HAOGE_SESSION_TOKEN" >"$NX_BG_LOG" 2>&1 &
else
setsid /system/bin/sh "$_nx_spawn_script" "--web-service=$_nx_spawn_backend" "$HAOGE_SESSION_TOKEN" >"$NX_BG_LOG" 2>&1 &
fi
elif nx_command_exists toybox && toybox 2>/dev/null | grep -qw setsid; then
if nx_command_exists nohup; then
nohup toybox setsid /system/bin/sh "$_nx_spawn_script" "--web-service=$_nx_spawn_backend" "$HAOGE_SESSION_TOKEN" >"$NX_BG_LOG" 2>&1 &
else
toybox setsid /system/bin/sh "$_nx_spawn_script" "--web-service=$_nx_spawn_backend" "$HAOGE_SESSION_TOKEN" >"$NX_BG_LOG" 2>&1 &
fi
elif nx_command_exists busybox && busybox --list 2>/dev/null | grep -qx setsid; then
if nx_command_exists nohup; then
nohup busybox setsid /system/bin/sh "$_nx_spawn_script" "--web-service=$_nx_spawn_backend" "$HAOGE_SESSION_TOKEN" >"$NX_BG_LOG" 2>&1 &
else
busybox setsid /system/bin/sh "$_nx_spawn_script" "--web-service=$_nx_spawn_backend" "$HAOGE_SESSION_TOKEN" >"$NX_BG_LOG" 2>&1 &
fi
else
# Compatibility fallback: the worker still re-execs with closed stdin and
# promotes only itself out of the MT app cgroup when the kernel permits it.
if nx_command_exists nohup; then
nohup /system/bin/sh "$_nx_spawn_script" "--web-service=$_nx_spawn_backend" "$HAOGE_SESSION_TOKEN" >"$NX_BG_LOG" 2>&1 &
else
/system/bin/sh "$_nx_spawn_script" "--web-service=$_nx_spawn_backend" "$HAOGE_SESSION_TOKEN" >"$NX_BG_LOG" 2>&1 &
fi
fi
NX_SPAWNED_WEB_PID=$!
[ -n "$NX_SPAWNED_WEB_PID" ] && kill -0 "$NX_SPAWNED_WEB_PID" 2>/dev/null
}
nx_web_status_tick() {
[ -f "$STATUS_FILE" ] || return 0
# Read kernel counters only. This path never deploys, flushes, refreshes or
# removes interception rules.
sync_iptables_stats
_nx_tick_risk=$(grep -m1 '^risk_value=' "$STATUS_FILE" 2>/dev/null | cut -d= -f2)
_nx_tick_color=$(grep -m1 '^risk_color=' "$STATUS_FILE" 2>/dev/null | cut -d= -f2)
_nx_tick_level=$(grep -m1 '^risk_level=' "$STATUS_FILE" 2>/dev/null | cut -d= -f2)
_nx_tick_latency=$(grep -m1 '^latency=' "$STATUS_FILE" 2>/dev/null | cut -d= -f2)
_nx_tick_modules=$(grep '|' "$STATUS_FILE" 2>/dev/null)
_nx_tick_risk=${_nx_tick_risk:-12}
_nx_tick_color=${_nx_tick_color:-#00ff88}
_nx_tick_level=${_nx_tick_level:-安全}
_nx_tick_latency=${_nx_tick_latency:-12}
_nx_tick_total=$(nx_counter_get total_block)
_nx_tick_threads=$(pgrep -f "${GAME_PKG}:" 2>/dev/null | wc -l)
_nx_tick_elapsed=$(( $(date +%s) - start_time ))
[ "$_nx_tick_elapsed" -lt 0 ] && _nx_tick_elapsed=0
_nx_tick_h=$((_nx_tick_elapsed / 3600))
_nx_tick_m=$(((_nx_tick_elapsed % 3600) / 60))
_nx_tick_s=$((_nx_tick_elapsed % 60))
_nx_tick_runtime=$(printf '%02d:%02d:%02d' "$_nx_tick_h" "$_nx_tick_m" "$_nx_tick_s")
_nx_tick_tmp="$STATUS_FILE.web.$$"
{
printf 'risk_value=%s\n' "$_nx_tick_risk"
printf 'risk_color=%s\n' "$_nx_tick_color"
printf 'risk_level=%s\n' "$_nx_tick_level"
printf 'block_count=%s\n' "$_nx_tick_total"
printf 'run_time=%s\n' "$_nx_tick_runtime"
printf 'update_time=%s\n' "$(date '+%Y-%m-%d %H:%M:%S')"
printf 'risk_thread_count=%s\n' "$_nx_tick_threads"
printf 'latency=%s\n' "$_nx_tick_latency"
printf '%s\n' "$_nx_tick_modules"
} > "$_nx_tick_tmp" && mv "$_nx_tick_tmp" "$STATUS_FILE" 2>/dev/null
}
nx_render_web_index() {
mkdir -p "$NX_WEB_ROOT" 2>/dev/null
chmod 755 "$NX_WEB_ROOT" 2>/dev/null
[ -f "$STATUS_FILE" ] || update_status_file
_nx_web_tmp="$NX_WEB_ROOT/index.html.$$"
gen_html_from_file 2>/dev/null | awk 'body { print } length($0) == 0 { body=1 }' > "$_nx_web_tmp"
if [ -s "$_nx_web_tmp" ]; then
mv "$_nx_web_tmp" "$NX_WEB_ROOT/index.html" 2>/dev/null
chmod 644 "$NX_WEB_ROOT/index.html" 2>/dev/null
return 0
fi
rm -f "$_nx_web_tmp" 2>/dev/null
return 1
}
nx_web_port_listening() {
_nx_hex_port=$(printf '%04X' "$HTTP_PORT" 2>/dev/null)
[ -n "$_nx_hex_port" ] || return 2
_nx_seen_proc=0
for _nx_tcp_file in /proc/net/tcp /proc/net/tcp6; do
[ -r "$_nx_tcp_file" ] || continue
_nx_seen_proc=1
awk -v p="$_nx_hex_port" 'toupper($2) ~ ":" p "$" && $4 == "0A" { found=1 } END { exit !found }' "$_nx_tcp_file" 2>/dev/null && return 0
done
[ "$_nx_seen_proc" -eq 1 ] && return 1
return 2
}
nx_web_pid_valid() {
[ -f "$HTTP_PID_FILE" ] && [ -f "$NX_WEB_START_FILE" ] || return 1
_nx_web_pid=$(cat "$HTTP_PID_FILE" 2>/dev/null)
_nx_web_start=$(cat "$NX_WEB_START_FILE" 2>/dev/null)
[ -n "$_nx_web_pid" ] && [ -n "$_nx_web_start" ] || return 1
_nx_web_now=$(awk '{print $22}' "/proc/$_nx_web_pid/stat" 2>/dev/null)
[ "$_nx_web_start" = "$_nx_web_now" ] && kill -0 "$_nx_web_pid" 2>/dev/null
}
nx_pid_token_alive() {
_nx_token_pid=$1; _nx_token_start=$2
[ -n "$_nx_token_pid" ] && [ -n "$_nx_token_start" ] || return 1
_nx_token_now=$(awk '{print $22}' "/proc/$_nx_token_pid/stat" 2>/dev/null)
[ "$_nx_token_start" = "$_nx_token_now" ] && kill -0 "$_nx_token_pid" 2>/dev/null
}
nx_release_web_port() {
_nx_hex_port=$(printf '%04X' "$HTTP_PORT" 2>/dev/null)
_nx_inodes=""
for _nx_tcp_file in /proc/net/tcp /proc/net/tcp6; do
[ -r "$_nx_tcp_file" ] || continue
_nx_inodes="$_nx_inodes $(awk -v p="$_nx_hex_port" 'toupper($2) ~ ":" p "$" && $4 == "0A" {print $10}' "$_nx_tcp_file" 2>/dev/null)"
done
for _nx_inode in $_nx_inodes; do
for _nx_fd in /proc/[0-9]*/fd/*; do
[ "$(readlink "$_nx_fd" 2>/dev/null)" = "socket:[$_nx_inode]" ] || continue
_nx_owner_pid=$(echo "$_nx_fd" | cut -d/ -f3)
[ -n "$_nx_owner_pid" ] && [ "$_nx_owner_pid" != "$$" ] || continue
_nx_owner_cmd=$(tr '\000' ' ' < "/proc/$_nx_owner_pid/cmdline" 2>/dev/null)
echo "$_nx_owner_cmd" | grep -qiE 'busybox.*httpd|busybox.*nc|(^|[/ ])nc( |$)|皓哥云盾防观察' || continue
kill -9 "$_nx_owner_pid" 2>/dev/null
done
done
}
nx_fast_pause() {
_nx_pause_us=${1:-100000}
if nx_command_exists usleep; then
usleep "$_nx_pause_us" 2>/dev/null
elif nx_command_exists toybox && toybox 2>/dev/null | grep -qw usleep; then
toybox usleep "$_nx_pause_us" 2>/dev/null
elif nx_command_exists busybox && busybox --list 2>/dev/null | grep -qx usleep; then
busybox usleep "$_nx_pause_us" 2>/dev/null
else
sleep 0.1 2>/dev/null || sleep 1
fi
}
nx_stop_web_service() {
_nx_preserve_runtime=$1
for _nx_pid_file in "$NX_WEB_SERVER_PID_FILE" "$NX_WEB_RENDER_PID_FILE"; do
[ -f "$_nx_pid_file" ] || continue
_nx_stop_web_pid=$(cat "$_nx_pid_file" 2>/dev/null)
[ -n "$_nx_stop_web_pid" ] && [ "$_nx_stop_web_pid" != "$$" ] && kill "$_nx_stop_web_pid" 2>/dev/null
done
if nx_web_pid_valid; then
_nx_stop_web_pid=$(cat "$HTTP_PID_FILE" 2>/dev/null)
[ "$_nx_stop_web_pid" != "$$" ] && kill "$_nx_stop_web_pid" 2>/dev/null
fi
nx_fast_pause 120000
for _nx_pid_file in "$NX_WEB_SERVER_PID_FILE" "$NX_WEB_RENDER_PID_FILE" "$HTTP_PID_FILE"; do
[ -f "$_nx_pid_file" ] || continue
_nx_stop_web_pid=$(cat "$_nx_pid_file" 2>/dev/null)
[ -n "$_nx_stop_web_pid" ] && [ "$_nx_stop_web_pid" != "$$" ] && kill -9 "$_nx_stop_web_pid" 2>/dev/null
done
# 已记录的服务PID被终止后通常端口已经释放。只有端口仍确认监听时，
# 才执行昂贵的 /proc/*/fd 兜底扫描。
[ "$_nx_preserve_runtime" = "fast_exit" ] || { nx_web_port_listening && nx_release_web_port; }
rm -f "$HTTP_PID_FILE" "$NX_WEB_START_FILE" "$NX_WEB_SERVER_PID_FILE" "$NX_WEB_RENDER_PID_FILE" "$NX_WEB_BACKEND_FILE" "$WORK_DIR/.port_18109.lock" 2>/dev/null
[ "$_nx_preserve_runtime" = "keep_rules" ] || rm -f "$NX_RUNTIME_STATE_FILE" 2>/dev/null
}
nx_web_render_loop() {
while true; do
nx_web_status_tick
nx_render_web_index
sleep 1
done
}
nx_emit_web_response() {
printf 'HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=UTF-8\r\nCache-Control: no-store, no-cache, must-revalidate\r\nConnection: close\r\n\r\n'
cat "$NX_WEB_ROOT/index.html" 2>/dev/null
}
nx_web_supervisor() {
_nx_backend=$1
echo $$ > "$HTTP_PID_FILE"
awk '{print $22}' "/proc/$$/stat" 2>/dev/null > "$NX_WEB_START_FILE"
_nx_owner_main=$(cat "$NX_MAIN_PID_FILE" 2>/dev/null)
_nx_owner_start=$(cat "$NX_INSTANCE_START_FILE" 2>/dev/null)
nx_pid_token_alive "$_nx_owner_main" "$_nx_owner_start" || exit 1
_nx_server=""; _nx_renderer=""
trap '[ -n "$_nx_server" ] && kill "$_nx_server" 2>/dev/null; [ -n "$_nx_renderer" ] && kill "$_nx_renderer" 2>/dev/null; nx_release_web_port; exit 0' SIGINT SIGTERM
nx_web_render_loop &
_nx_renderer=$!
nx_set_oom_protect "$_nx_renderer"
echo "$_nx_renderer" > "$NX_WEB_RENDER_PID_FILE"
_nx_backend_failures=0
while true; do
nx_pid_token_alive "$_nx_owner_main" "$_nx_owner_start" || { kill "$_nx_renderer" 2>/dev/null; nx_release_web_port; exit 0; }
case "$_nx_backend" in
busybox_httpd)
busybox httpd -f -p "127.0.0.1:${HTTP_PORT}" -h "$NX_WEB_ROOT" >>"$NX_BG_LOG" 2>&1 &
;;
busybox_nc)
( while true; do nx_emit_web_response | busybox nc -l -p "$HTTP_PORT" >/dev/null 2>&1; _nx_nc_rc=$?; [ "$_nx_nc_rc" -ne 0 ] && sleep 1; done ) &
;;
nc)
( while true; do nx_emit_web_response | nc -l -p "$HTTP_PORT" >/dev/null 2>&1; _nx_nc_rc=$?; [ "$_nx_nc_rc" -ne 0 ] && sleep 1; done ) &
;;
*) exit 1 ;;
esac
_nx_server=$!
nx_set_oom_protect "$_nx_server"
echo "$_nx_server" > "$NX_WEB_SERVER_PID_FILE"
echo "$_nx_backend" > "$NX_WEB_BACKEND_FILE"
while kill -0 "$_nx_server" 2>/dev/null; do
sleep 3
if ! nx_pid_token_alive "$_nx_owner_main" "$_nx_owner_start"; then
kill "$_nx_server" "$_nx_renderer" 2>/dev/null
sleep 1
kill -9 "$_nx_server" "$_nx_renderer" 2>/dev/null
nx_release_web_port
exit 0
fi
# Some Android kernels expose a readable but filtered /proc/net/tcp.
# Treating that table as authoritative killed a healthy server after a
# fixed number of checks (roughly 15-20 seconds). Process death is the
# only restart condition; neither HTTP probes nor port-table misses may
# interrupt a live browser service.
_nx_backend_failures=0
nx_feature_set web_ui ok "网页服务进程持续运行（$_nx_backend）"
done
kill "$_nx_server" 2>/dev/null
sleep 1
kill -9 "$_nx_server" 2>/dev/null
nx_release_web_port
_nx_backend_failures=$((_nx_backend_failures + 1))
if [ "$_nx_backend" = "busybox_httpd" ] && [ "$_nx_backend_failures" -ge 3 ]; then
if nx_command_exists busybox && busybox --list 2>/dev/null | grep -qx nc; then
_nx_backend=busybox_nc
elif nx_command_exists nc; then
_nx_backend=nc
fi
fi
nx_feature_set web_ui sent "18109监听失效，监督进程正在自动重启"
sleep 1
done
}
nx_open_browser_detached() {
_nx_browser_url=$1
if nx_command_exists setsid && nx_command_exists nohup; then
nohup setsid am start -a android.intent.action.VIEW -d "$_nx_browser_url" --activity-clear-top >"$NX_BG_LOG" 2>&1 &
elif nx_command_exists toybox && toybox 2>/dev/null | grep -qw setsid && nx_command_exists nohup; then
nohup toybox setsid am start -a android.intent.action.VIEW -d "$_nx_browser_url" --activity-clear-top >"$NX_BG_LOG" 2>&1 &
else
am start -a android.intent.action.VIEW -d "$_nx_browser_url" --activity-clear-top >"$NX_BG_LOG" 2>&1 &
fi
}
nx_collect_status_snapshot() {
NX_DEFER_STATUS_WRITE=1
hao_fetch_real_data
NX_DEFER_STATUS_WRITE=0
if nx_hao_daemon_alive; then
modules=$(printf "%s\n" "$modules" | sed 's/^行为特征混淆|0$/行为特征混淆|2/')
if ! nx_is_game_running; then
modules=$(printf "%s\n" "$modules" | sed 's/^熵池动态伪装|1$/熵池动态伪装|2/')
fi
fi
block_count=$(nx_counter_get total_block)
update_status_file
}
start_web_service() {
_nx_open_browser=${1:-open}
HTTP_PORT=18109
nx_stop_web_service
mkdir -p "$WORK_DIR" "$NX_WEB_ROOT" 2>/dev/null
touch "$WORK_DIR/.port_18109.lock" 2>/dev/null
nx_collect_status_snapshot
nx_render_web_index || { nx_feature_set web_ui fail "页面文件生成失败"; return 1; }
_nx_web_backend=""
if nx_command_exists busybox && busybox --list 2>/dev/null | grep -qx httpd; then _nx_web_backend=busybox_httpd; fi
if [ -z "$_nx_web_backend" ] && nx_command_exists busybox && busybox --list 2>/dev/null | grep -qx nc; then _nx_web_backend=busybox_nc; fi
if [ -z "$_nx_web_backend" ] && nx_command_exists nc; then _nx_web_backend=nc; fi
if [ -z "$_nx_web_backend" ]; then
write_block_log "ERROR" "网页服务缺少busybox httpd/nc，无法监听127.0.0.1:18109"
nx_feature_set web_ui fail "缺少可用HTTP服务组件"
return 1
fi
nx_write_runtime_state || { nx_feature_set web_ui fail "运行状态文件生成失败"; return 1; }
nx_spawn_web_service "$_nx_web_backend" || { nx_feature_set web_ui fail "网页独立进程启动失败"; return 1; }
_nx_web_pid=$NX_SPAWNED_WEB_PID
nx_set_oom_protect "$_nx_web_pid"
_nx_wait=0
while [ "$_nx_wait" -lt 12 ]; do
sleep 1
nx_web_port_listening
_nx_port_rc=$?
if [ "$_nx_port_rc" -eq 0 ]; then
nx_feature_set web_ui ok "127.0.0.1:18109已确认监听（$_nx_web_backend）"
write_block_log "WEB" "本地常驻服务已确认监听，端口18109"
[ "$_nx_open_browser" = "open" ] && nx_open_browser_detached "http://127.0.0.1:18109/?t=$(date +%s)"
return 0
fi
_nx_start_server=$(cat "$NX_WEB_SERVER_PID_FILE" 2>/dev/null)
if [ "$_nx_wait" -ge 2 ] && [ -n "$_nx_start_server" ] && kill -0 "$_nx_start_server" 2>/dev/null && nx_web_pid_valid; then
nx_feature_set web_ui sent "常驻服务进程已启动；设备端口表不可用于验证"
write_block_log "WEB" "本地常驻服务进程已启动，端口表结果不作为停止依据"
[ "$_nx_open_browser" = "open" ] && nx_open_browser_detached "http://127.0.0.1:18109/?t=$(date +%s)"
return 0
fi
_nx_wait=$((_nx_wait + 1))
done
nx_feature_set web_ui fail "18109在12秒内未进入监听，监督进程继续后台重试"
write_block_log "ERROR" "18109未确认监听，后台监督进程将继续自动恢复"
return 1
}
nx_ensure_web_service() {
nx_web_pid_valid && return 0
_nx_web_now=$(date +%s)
[ $((_nx_web_now - NX_WEB_LAST_RECOVERY)) -lt 10 ] && return 1
NX_WEB_LAST_RECOVERY=$_nx_web_now
nx_feature_set web_ui sent "网页监督进程丢失，正在后台恢复"
start_web_service no_open
}
nx_file_sha256() {
_nx_hash_file=$1
if command -v sha256sum >/dev/null 2>&1; then
sha256sum "$_nx_hash_file" 2>/dev/null | awk '{print $1}'
elif command -v toybox >/dev/null 2>&1; then
toybox sha256sum "$_nx_hash_file" 2>/dev/null | awk '{print $1}'
elif command -v busybox >/dev/null 2>&1; then
busybox sha256sum "$_nx_hash_file" 2>/dev/null | awk '{print $1}'
fi
}
nx_extract_antiwatch_helper() {
mkdir -p "$NX_WORK_DIR" 2>/dev/null || return 1
if [ -s "$NX_ANTIWATCH_BIN" ] && [ "$(nx_file_sha256 "$NX_ANTIWATCH_BIN")" = "$NX_ANTIWATCH_SHA256" ]; then
chmod 700 "$NX_ANTIWATCH_BIN" 2>/dev/null
return 0
fi
_nx_antiwatch_tmp="${NX_ANTIWATCH_BIN}.tmp.$$"
rm -f "$_nx_antiwatch_tmp" 2>/dev/null
if command -v base64 >/dev/null 2>&1; then
_nx_base64_decoder="base64"
elif command -v toybox >/dev/null 2>&1; then
_nx_base64_decoder="toybox base64"
elif command -v busybox >/dev/null 2>&1; then
_nx_base64_decoder="busybox base64"
else
write_block_log "ERROR" "系统缺少base64，无法释放防观察内存组件"
return 1
fi
$_nx_base64_decoder -d > "$_nx_antiwatch_tmp" <<'__HAOGE_ANTIWATCH_V13_PAYLOAD__'
f0VMRgIBAQAAAAAAAAAAAAMAtwABAAAAgBwAAAAAAABAAAAAAAAAANAZAAAAAAAAAAAAAEAAOAAL
AEAAFwAWAAYAAAAEAAAAQAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAaAIAAAAAAABoAgAAAAAAAAgA
AAAAAAAAAwAAAAQAAACoAgAAAAAAAKgCAAAAAAAAqAIAAAAAAAAVAAAAAAAAABUAAAAAAAAAAQAA
AAAAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAMAAAAAAAAgAwAAAAAAAAAEAAA
AAAAAAEAAAAFAAAAgAwAAAAAAACAHAAAAAAAAIAcAAAAAAAAkAgAAAAAAACQCAAAAAAAAAAQAAAA
AAAAAQAAAAYAAAAQFQAAAAAAABA1AAAAAAAAEDUAAAAAAABoAgAAAAAAAPAKAAAAAAAAABAAAAAA
AAABAAAABgAAAHgXAAAAAAAAeEcAAAAAAAB4RwAAAAAAABgAAAAAAAAAIQAAAAAAAAAAEAAAAAAA
AAIAAAAGAAAAEBUAAAAAAAAQNQAAAAAAABA1AAAAAAAAYAEAAAAAAABgAQAAAAAAAAgAAAAAAAAA
UuV0ZAQAAAAQFQAAAAAAABA1AAAAAAAAEDUAAAAAAABoAgAAAAAAAPAKAAAAAAAAAQAAAAAAAABQ
5XRkBAAAAKAKAAAAAAAAoAoAAAAAAACgCgAAAAAAAFQAAAAAAAAAVAAAAAAAAAAEAAAAAAAAAFHl
dGQGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAA
AAQAAADAAgAAAAAAAMACAAAAAAAAwAIAAAAAAACYAAAAAAAAAJgAAAAAAAAABAAAAAAAAAAvc3lz
dGVtL2Jpbi9saW5rZXI2NAAAAAAIAAAAhAAAAAEAAABBbmRyb2lkABgAAAByMjdkAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMTM3NTA3
MjQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAASAAAAAAAAAAAAAAAAAAAAAAAAAA0AAAASAAAA
AAAAAAAAAAAAAAAAAAAAABoAAAASAAAAAAAAAAAAAAAAAAAAAAAAACwAAAASAAAAAAAAAAAAAAAA
AAAAAAAAADMAAAASAAAAAAAAAAAAAAAAAAAAAAAAADsAAAASAAAAAAAAAAAAAAAAAAAAAAAAAEMA
AAASAAAAAAAAAAAAAAAAAAAAAAAAAEwAAAASAAAAAAAAAAAAAAAAAAAAAAAAAFMAAAASAAAAAAAA
AAAAAAAAAAAAAAAAAFgAAAASAAAAAAAAAAAAAAAAAAAAAAAAAF4AAAASAAAAAAAAAAAAAAAAAAAA
AAAAAGMAAAASAAAAAAAAAAAAAAAAAAAAAAAAAGkAAAASAAAAAAAAAAAAAAAAAAAAAAAAAG8AAAAS
AAAAAAAAAAAAAAAAAAAAAAAAAHYAAAASAAAAAAAAAAAAAAAAAAAAAAAAAH4AAAASAAAAAAAAAAAA
AAAAAAAAAAAAAIcAAAASAAAAAAAAAAAAAAAAAAAAAAAAAI4AAAASAAAAAAAAAAAAAAAAAAAAAAAA
AJcAAAASAAAAAAAAAAAAAAAAAAAAAAAAAKgAAAASAAAAAAAAAAAAAAAAAAAAAAAAALgAAAASAAAA
AAAAAAAAAAAAAAAAAAAAAL8AAAASAAAAAAAAAAAAAAAAAAAAAAAAAMUAAAASAAAAAAAAAAAAAAAA
AAAAAAAAAMoAAAASAAAAAAAAAAAAAAAAAAAAAAAAANEAAAASAAAAAAAAAAAAAAAAAAAAAAAAANcA
AAASAAAAAAAAAAAAAAAAAAAAAAAAANwAAAASAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgACAAIAAgAC
AAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAQABAOMAAAAQAAAA
AAAAAGMNBQAAAAIA6wAAAAAAAAABAAAAHAAAAAEAAAAaAAAAAAAAAAAAAAAAAAAAAF9fbGliY19p
bml0AF9fY3hhX2F0ZXhpdABfX3JlZ2lzdGVyX2F0Zm9yawBzdHJjbXAAb3BlbmRpcgByZWFkZGly
AF9fb3Blbl8yAG1lbXNldAByZWFkAGNsb3NlAGF0b2kAZm9wZW4AZmdldHMAc3Ryc3RyAF9fZXJy
bm8Ac3RydG91bGwAZmNsb3NlAGNsb3NlZGlyAF9fc3RhY2tfY2hrX2ZhaWwAX192c25wcmludGZf
Y2hrAHB3cml0ZQBwcmVhZAB0aW1lAGdldHBpZABzcmFuZAByYW5kAHVzbGVlcABsaWJjLnNvAExJ
QkMAbGliZGwuc28AAAAAcDYAAAAAAAADBAAAAAAAAIAcAAAAAAAAeDYAAAAAAAADBAAAAAAAAIAc
AAAAAAAAgDYAAAAAAAADBAAAAAAAAIAdAAAAAAAAgEcAAAAAAAADBAAAAAAAACwdAAAAAAAAoDYA
AAAAAAACBAAAAQAAAAAAAAAAAAAAqDYAAAAAAAACBAAAAgAAAAAAAAAAAAAAsDYAAAAAAAACBAAA
AwAAAAAAAAAAAAAAuDYAAAAAAAACBAAABAAAAAAAAAAAAAAAwDYAAAAAAAACBAAABQAAAAAAAAAA
AAAAyDYAAAAAAAACBAAABgAAAAAAAAAAAAAA0DYAAAAAAAACBAAABwAAAAAAAAAAAAAA2DYAAAAA
AAACBAAACAAAAAAAAAAAAAAA4DYAAAAAAAACBAAACQAAAAAAAAAAAAAA6DYAAAAAAAACBAAACgAA
AAAAAAAAAAAA8DYAAAAAAAACBAAACwAAAAAAAAAAAAAA+DYAAAAAAAACBAAADAAAAAAAAAAAAAAA
ADcAAAAAAAACBAAADQAAAAAAAAAAAAAACDcAAAAAAAACBAAADgAAAAAAAAAAAAAAEDcAAAAAAAAC
BAAADwAAAAAAAAAAAAAAGDcAAAAAAAACBAAAEAAAAAAAAAAAAAAAIDcAAAAAAAACBAAAEQAAAAAA
AAAAAAAAKDcAAAAAAAACBAAAEgAAAAAAAAAAAAAAMDcAAAAAAAACBAAAEwAAAAAAAAAAAAAAODcA
AAAAAAACBAAAFAAAAAAAAAAAAAAAQDcAAAAAAAACBAAAFQAAAAAAAAAAAAAASDcAAAAAAAACBAAA
FgAAAAAAAAAAAAAAUDcAAAAAAAACBAAAFwAAAAAAAAAAAAAAWDcAAAAAAAACBAAAGAAAAAAAAAAA
AAAAYDcAAAAAAAACBAAAGQAAAAAAAAAAAAAAaDcAAAAAAAACBAAAGgAAAAAAAAAAAAAAcDcAAAAA
AAACBAAAGwAAAAAAAAAAAAAAL3Byb2MAbGliZ2Nsb3VkLnNvAC9wcm9jLyVkL21hcHMAL3Byb2Mv
JWQvbWVtAHIAL3Byb2MvJXMvY21kbGluZQBlbmFibGUAZGlzYWJsZQABGwM7VAAAAAkAAAD0EQAA
bAAAAEwSAACMAAAAYBIAAKAAAAB8EgAAtAAAAIwSAADIAAAA4BIAAPgAAADIFgAAQAEAAGwXAAB0
AQAAJBgAAKwBAAAAAAAAEAAAAAAAAAABelIAAXweARsMHwAcAAAAGAAAAIARAABYAAAAAEQtRA5A
SAwdEJ4CnQQAABAAAAA4AAAAuBEAABQAAAAAAAAAEAAAAEwAAAC4EQAAHAAAAAAAAAAQAAAAYAAA
AMARAAAQAAAAAAAAACwAAAB0AAAAvBEAAFQAAAAARC1EDiBIDB0gkwKUBJ4GnQh0DB8gSA4ARC3T
1N7dAEQAAACkAAAA4BEAAOgDAAAARA5gWAwdYJMClASVBpYIlwqYDJkOmhCbEpwUnhadGAoDpAMM
H2BYDgDT1NXW19jZ2tvc3t1ECzAAAADsAAAAgBUAAKQAAAAARA6QAkwMHSCTApwEngadCAoCgAwf
kAJMDgDT3N7dRAsAAAA0AAAAIAEAAPAVAAC4AAAAAEQOQFAMHTCTApQElQaWCJ4KnQwKAowMH0BQ
DgDT1NXW3t1ECwAAACwAAABYAQAAcBYAAHgAAAAARA4gSAwdIJMClASeBp0IAmAMHyBIDgDT1N7d
AAAAAAAAAACfJAPVHQCA0h4AgNLgAwCRAQAAFD8jA9X/AwHR/XsDqf3DAJEIAADQCQAA0ADkAG8I
OUP5KT1D+SgBCMsfBQDx4IMAreADgD2LAABUHyAD1UhVARDoCwD5AgAA0OMDAJHhAx+qQkBD+Z4B
AJRfJAPVYAAAtPADAKoAAh/WwANf1l8kA9XhAwCqHyAD1QD//xAfIAPV4lMBEJYBABRfJAPVHyAD
1WNTARCWAQAUPyMD1f17vqn0TwGp/QMAkRMAANAIAADQczpD+Qg9Q/kIARPrAAEAVAj9Q5NpDgiL
FAUA0SmBX/ggAT/W6AMUqnT//7X0T0Gp/XvCqL8jA9XAA1/W/Xu6qfxvAan6ZwKp+F8DqfZXBKn0
TwWp/QMAkf+DF9FY0DvVCBdA+R8IAHGoAx/4oQEAVDQEQPnzAwGqHyAD1YFm/zDgAxSqcgEAlAAB
ADTh///wIWAqkeADFKptAQCUYAAANAAIgFLRAAAU4P//8ABAKZFrAQCUgBkAtPUDAKr2Ax+q9wMf
KvQDHyr8///wnAMqkfn///A5WymR4AMVqmQBAJQAEgC0+gMAqkg/QTgI6QBRHykAMYIAAFToAx8q
6P7/NAkAABQIUACRCRVAOCrpAFFfLQAxqP//VD8BAHHoF58ayP3/NOBDBJEBEIBSAhCAUuMDHKrk
AxqquwAAlOBDBJEBAaBSTgEAlOAM+Df7AwAq4EMAkeEDHyoCIIBS9gMA+fYDHKpKAQCU4UMAkeAD
GyriH4BSSgEAlPwDAKrgAxsqSwEAlJ8HAPErCwBUa+yN0ugnQamrzaXy6vNB+PwDFqqLrszyy23s
8h8BC+uozI3SiM6l8oiuzfLoDO7yIAFI+gjOhdJo7K3yiKzM8sgO4PJAAUj6YAIAVOgnQanq40H4
HwEL66jMjdKIzqXyiK7N8ugM7vIgAUj66AyO0shlrPLojczyqMzu8kABSPpIAIBSIQgAVOmbQDk/
6QBxwQcAVOADGqomAQCU+gMAKqBDAdEBCIBSAgiAUuP///BjjCmR5AMaKngAAJSgQwHR4f//8CH4
KZEeAQCUoAUAtPsDAKrgQwaRAYCAUuIDG6ocAQCUIAQAtOBDBpHhAxmqHAEAlAD//7T/BwD5HQEA
lPcDAKofAAC54EMGkeEjAJECAoBSGwEAlOgHQPnqQwaR6QJAuR8BCuvoB58a6QEANcgBADb8AwCq
4AMbqhUBAJScAQC0aACAUjcAgFL0Axoq/AMA+QkAABRIAIBSDAAAFEgAgFIFAAAU4AMbqgkBAJRI
AIBSNwCAUvwDFqoDAAAUSACAUjcAgFL2A0D5HwkAceDt/1TgAxWqAgEAlPcFADSfBgBxYAGAUqsF
AFSWBQC04///0GPEKZHgQwaRAQiAUgIIgFLkAxQqNAAAlEEAgFLgQwaRAQGgcsYAAJSABfg39AMA
KmAGQPkfIAPVoU7/MLQAAJTosYBS6QOEUh8AAHFI8bFyaaC6cuADFCozAYgayH5ekQFxApHiAxMq
SAAAlMi2X5H1AwAq4AMUKgGxAZHiAxMqQgAAlPMDACrgAxQquAAAlKgCEyofAQBxqAGAUgARnxoC
AAAUQAGAUggXQPmpA1/4HwEJ62EBAFT/gxeR9E9FqfZXRKn4X0Op+mdCqfxvQan9e8aowANf1oAB
gFLz//8XxwAAlP9DBNH9ew+p/E8Qqf3DA5GkFzmpqsMB0esDAJGmHzqpawECkegDA6rgBwCt4wMB
qqVDAdHiDwGt4QMCquIDHyrkFwKt5AMIquYfA61T0DvVaRZA+amDH/hJgQCRqoMAkaqnPanpA4CS
qqMA0Qnw3/Krpz6pQAVAraCHPa2rAACUaBZA+amDX/gfAQnroQAAVPxPUKn9e0+p/0MEkcADX9ae
AACU/wMB0f17Aan2VwKp9E8Dqf1DAJFW0DvV8wMCKvQDAarIFkD59QMAKugHAPniBwC5IgAAlOET
AJHgAxUqggCAUuMDFKqUAACUHxAA8QECAFThAwCR4AMVKoIAgFLjAxSq/wMAuZAAAJQfEADxAACA
EgEBAFToA0C5HwETa6EAAFQOAACU4AMfKgIAABQAAIASyBZA+ekHQPkfAQnrwQAAVPRPQ6n2V0Kp
/XtBqf8DAZHAA1/WcAAAlP17vqn0TwGp/QMAkRQAANCIYl45KAEAN+ADH6p4AACU8wMAqnoAAJQA
ABNKfAAAlCgAgFKIYh45fQAAlGgdlFIK4oRSyEG9cgh8KJsI/WDTCAEACwl9BhMofUgLyQiAUgiB
CRsJfYBSACkJG/RPQan9e8KocgAAFAAAAADwe7+pEAAAsBFOQ/kQYhqRIAIf1h8gA9UfIAPVHyAD
1RAAALARUkP5EIIakSACH9YQAACwEVZD+RCiGpEgAh/WEAAAsBFaQ/kQwhqRIAIf1hAAALARXkP5
EOIakSACH9YQAACwEWJD+RACG5EgAh/WEAAAsBFmQ/kQIhuRIAIf1hAAALARakP5EEIbkSACH9YQ
AACwEW5D+RBiG5EgAh/WEAAAsBFyQ/kQghuRIAIf1hAAALARdkP5EKIbkSACH9YQAACwEXpD+RDC
G5EgAh/WEAAAsBF+Q/kQ4huRIAIf1hAAALARgkP5EAIckSACH9YQAACwEYZD+RAiHJEgAh/WEAAA
sBGKQ/kQQhyRIAIf1hAAALARjkP5EGIckSACH9YQAACwEZJD+RCCHJEgAh/WEAAAsBGWQ/kQohyR
IAIf1hAAALARmkP5EMIckSACH9YQAACwEZ5D+RDiHJEgAh/WEAAAsBGiQ/kQAh2RIAIf1hAAALAR
pkP5ECIdkSACH9YQAACwEapD+RBCHZEgAh/WEAAAsBGuQ/kQYh2RIAIf1hAAALARskP5EIIdkSAC
H9YQAACwEbZD+RCiHZEgAh/WEAAAsBG6Q/kQwh2RIAIf1gEAAAAAAAAA8AAAAAAAAAABAAAAAAAA
AOMAAAAAAAAAHgAAAAAAAAAIAAAAAAAAAPv//28AAAAAAQAACAAAAAAVAAAAAAAAAAAAAAAAAAAA
BwAAAAAAAABoBwAAAAAAAAgAAAAAAAAAYAAAAAAAAAAJAAAAAAAAABgAAAAAAAAA+f//bwAAAAAE
AAAAAAAAABcAAAAAAAAAyAcAAAAAAAACAAAAAAAAAIgCAAAAAAAAAwAAAAAAAACINgAAAAAAABQA
AAAAAAAABwAAAAAAAAAGAAAAAAAAAFgDAAAAAAAACwAAAAAAAAAYAAAAAAAAAAUAAAAAAAAAbAYA
AAAAAAAKAAAAAAAAAPkAAAAAAAAA9f7/bwAAAABQBgAAAAAAAPD//28AAAAA+AUAAAAAAAD+//9v
AAAAADAGAAAAAAAA////bwAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAIwAAAAAAAEAjAAAAAAAAQCMAAAAA
AABAIwAAAAAAAEAjAAAAAAAAQCMAAAAAAABAIwAAAAAAAEAjAAAAAAAAQCMAAAAAAABAIwAAAAAA
AEAjAAAAAAAAQCMAAAAAAABAIwAAAAAAAEAjAAAAAAAAQCMAAAAAAABAIwAAAAAAAEAjAAAAAAAA
QCMAAAAAAABAIwAAAAAAAEAjAAAAAAAAQCMAAAAAAABAIwAAAAAAAEAjAAAAAAAAQCMAAAAAAABA
IwAAAAAAAEAjAAAAAAAAQCMAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAQW5kcm9pZCAo
MTM2OTE1NTcsICtwZ28sICtib2x0LCArbHRvLCArbWxnbywgYmFzZWQgb24gcjUyMjgxN2QpIGNs
YW5nIHZlcnNpb24gMTguMC40IChodHRwczovL2FuZHJvaWQuZ29vZ2xlc291cmNlLmNvbS90b29s
Y2hhaW4vbGx2bS1wcm9qZWN0IGQ4MDAzYTQ1NmQxNGEzZGViODA1NGNkYWE1MjlmZmJmMDJkOWIy
NjIpAEFuZHJvaWQgKDEzNjkxNTU3LCBiYXNlZCBvbiByNTIyODE3ZCkgY2xhbmcgdmVyc2lvbiAx
OC4wLjQgKGh0dHBzOi8vYW5kcm9pZC5nb29nbGVzb3VyY2UuY29tL3Rvb2xjaGFpbi9sbHZtLXBy
b2plY3QgZDgwMDNhNDU2ZDE0YTNkZWI4MDU0Y2RhYTUyOWZmYmYwMmQ5YjI2MikATGlua2VyOiBM
TEQgMTguMC40AAAuaW50ZXJwAC5ub3RlLmFuZHJvaWQuaWRlbnQALmR5bnN5bQAuZ251LnZlcnNp
b24ALmdudS52ZXJzaW9uX3IALmdudS5oYXNoAC5keW5zdHIALnJlbGEuZHluAC5yZWxhLnBsdAAu
cm9kYXRhAC5laF9mcmFtZV9oZHIALmVoX2ZyYW1lAC50ZXh0AC5wbHQALmR5bmFtaWMALmdvdAAu
Z290LnBsdAAucmVscm9fcGFkZGluZwAuZGF0YQAuYnNzAC5jb21tZW50AC5zaHN0cnRhYgAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAQAAAAEAAAACAAAAAAAAAKgCAAAAAAAAqAIAAAAAAAAVAAAAAAAAAAAAAAAAAAAAAQAAAAAA
AAAAAAAAAAAAAAkAAAAHAAAAAgAAAAAAAADAAgAAAAAAAMACAAAAAAAAmAAAAAAAAAAAAAAAAAAA
AAQAAAAAAAAAAAAAAAAAAAAdAAAACwAAAAIAAAAAAAAAWAMAAAAAAABYAwAAAAAAAKACAAAAAAAA
BwAAAAEAAAAIAAAAAAAAABgAAAAAAAAAJQAAAP///28CAAAAAAAAAPgFAAAAAAAA+AUAAAAAAAA4
AAAAAAAAAAMAAAAAAAAAAgAAAAAAAAACAAAAAAAAADIAAAD+//9vAgAAAAAAAAAwBgAAAAAAADAG
AAAAAAAAIAAAAAAAAAAHAAAAAQAAAAQAAAAAAAAAAAAAAAAAAABBAAAA9v//bwIAAAAAAAAAUAYA
AAAAAABQBgAAAAAAABwAAAAAAAAAAwAAAAAAAAAIAAAAAAAAAAAAAAAAAAAASwAAAAMAAAACAAAA
AAAAAGwGAAAAAAAAbAYAAAAAAAD5AAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAFMAAAAE
AAAAAgAAAAAAAABoBwAAAAAAAGgHAAAAAAAAYAAAAAAAAAADAAAAAAAAAAgAAAAAAAAAGAAAAAAA
AABdAAAABAAAAEIAAAAAAAAAyAcAAAAAAADIBwAAAAAAAIgCAAAAAAAAAwAAABEAAAAIAAAAAAAA
ABgAAAAAAAAAZwAAAAEAAAAyAAAAAAAAAFAKAAAAAAAAUAoAAAAAAABQAAAAAAAAAAAAAAAAAAAA
AQAAAAAAAAABAAAAAAAAAG8AAAABAAAAAgAAAAAAAACgCgAAAAAAAKAKAAAAAAAAVAAAAAAAAAAA
AAAAAAAAAAQAAAAAAAAAAAAAAAAAAAB9AAAAAQAAAAIAAAAAAAAA+AoAAAAAAAD4CgAAAAAAAIgB
AAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAhwAAAAEAAAAGAAAAAAAAAIAcAAAAAAAAgAwA
AAAAAAC8BgAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAI0AAAABAAAABgAAAAAAAABAIwAA
AAAAAEATAAAAAAAA0AEAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAACSAAAABgAAAAMAAAAA
AAAAEDUAAAAAAAAQFQAAAAAAAGABAAAAAAAABwAAAAAAAAAIAAAAAAAAABAAAAAAAAAAmwAAAAEA
AAADAAAAAAAAAHA2AAAAAAAAcBYAAAAAAAAYAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAA
AKAAAAABAAAAAwAAAAAAAACINgAAAAAAAIgWAAAAAAAA8AAAAAAAAAAAAAAAAAAAAAgAAAAAAAAA
AAAAAAAAAACpAAAACAAAAAMAAAAAAAAAeDcAAAAAAAB4FwAAAAAAAIgIAAAAAAAAAAAAAAAAAAAB
AAAAAAAAAAAAAAAAAAAAuAAAAAEAAAADAAAAAAAAAHhHAAAAAAAAeBcAAAAAAAAYAAAAAAAAAAAA
AAAAAAAACAAAAAAAAAAAAAAAAAAAAL4AAAAIAAAAAwAAAAAAAACQRwAAAAAAAJAXAAAAAAAACQAA
AAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAADDAAAAAQAAADAAAAAAAAAAAAAAAAAAAACQFwAA
AAAAAGoBAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAzAAAAAMAAAAAAAAAAAAAAAAAAAAA
AAAA+hgAAAAAAADWAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAA==
__HAOGE_ANTIWATCH_V13_PAYLOAD__
if [ ! -s "$_nx_antiwatch_tmp" ] || [ "$(nx_file_sha256 "$_nx_antiwatch_tmp")" != "$NX_ANTIWATCH_SHA256" ]; then
rm -f "$_nx_antiwatch_tmp" 2>/dev/null
write_block_log "ERROR" "防观察内存组件释放或完整性校验失败"
return 1
fi
chmod 700 "$_nx_antiwatch_tmp" 2>/dev/null || { rm -f "$_nx_antiwatch_tmp" 2>/dev/null; return 1; }
mv -f "$_nx_antiwatch_tmp" "$NX_ANTIWATCH_BIN" 2>/dev/null || { rm -f "$_nx_antiwatch_tmp" 2>/dev/null; return 1; }
chmod 700 "$NX_ANTIWATCH_BIN" 2>/dev/null
}
nx_apply_match_antiwatch() {
_nx_patch_mode=$1
case "$NX_PROFILE" in stable|aggressive) ;; *) return 1;; esac
case "$_nx_patch_mode" in enable|disable) ;; *) return 1;; esac
nx_update_heartbeat
touch "$NX_WATCHDOG_PAUSE_FILE" 2>/dev/null
if ! nx_extract_antiwatch_helper; then
rm -f "$NX_WATCHDOG_PAUSE_FILE" 2>/dev/null
printf "%b\n" "${C_RED}防观察组件释放失败${C_RESET}"
sleep 2
return 1
fi
"$NX_ANTIWATCH_BIN" "$_nx_patch_mode"
_nx_patch_rc=$?
rm -f "$NX_WATCHDOG_PAUSE_FILE" 2>/dev/null
nx_update_heartbeat
case "$_nx_patch_rc" in
0)
if [ "$_nx_patch_mode" = "enable" ]; then
printf '%s\n' enable > "$NX_ANTIWATCH_STATE_FILE"
printf "%b\n" "${C_GREEN}进入对局后开启防观察：完成（两个位置均已写入并读回验证）${C_RESET}"
write_block_log "ANTIWATCH" "对局内防观察已开启；libgcloud.so两个目标位置写入NOP并验证成功"
else
printf '%s\n' disable > "$NX_ANTIWATCH_STATE_FILE"
printf "%b\n" "${C_GREEN}对局结束后关闭防观察：完成（两个位置均已恢复并读回验证）${C_RESET}"
write_block_log "ANTIWATCH" "对局防观察已关闭；libgcloud.so两个目标位置恢复并验证成功"
fi
;;
10)
if [ "$_nx_patch_mode" = "disable" ]; then
rm -f "$NX_ANTIWATCH_STATE_FILE" 2>/dev/null
printf "%b\n" "${C_GREEN}游戏进程已经结束，补丁已随进程释放，无需恢复${C_RESET}"
write_block_log "ANTIWATCH" "关闭时游戏进程已结束；内存补丁已自然失效"
_nx_patch_rc=0
else
printf "%b\n" "${C_RED}游戏未启动，失败${C_RESET}"
fi
;;
11)
if [ "$_nx_patch_mode" = "disable" ]; then
rm -f "$NX_ANTIWATCH_STATE_FILE" 2>/dev/null
printf "%b\n" "${C_GREEN}对局结束后模块已卸载或进程已切换，补丁已自然失效，无需恢复${C_RESET}"
write_block_log "ANTIWATCH" "关闭时目标模块已卸载或游戏进程已切换；旧映射及补丁已释放"
_nx_patch_rc=0
else
printf "%b\n" "${C_RED}模块加载异常，失败${C_RESET}"
fi
;;
12) printf "%b\n" "${C_RED}无法打开游戏内存，失败；请确认ROOT权限${C_RESET}" ;;
13) printf "%b\n" "${C_RED}内存写入或读回验证失败，未报告虚假成功${C_RESET}" ;;
*) printf "%b\n" "${C_RED}防观察操作失败（错误码：$_nx_patch_rc）${C_RESET}" ;;
esac
sleep 2
[ "$_nx_patch_rc" -eq 0 ]
}
fetch_real_data() {
nx_update_heartbeat
nx_collect_status_snapshot
nx_ensure_web_service
}
draw_ui() {
hao_draw_ui
printf "%b\n" "${C_TITLE}共创伙伴：鹤屿、楠雪${C_RESET}"
case "$NX_PROFILE" in
stable)
printf "%b\n" "${C_GREEN}[1] 进入对局后开启防观察${C_RESET}"
printf "%b\n" "${C_YELLOW}[2] 对局结束后关闭防观察${C_RESET}"
printf "%b\n" "${C_BORDER}[H] 返回主页 [Q] 直接退出${C_RESET}"
printf "%b\n" "${C_BORDER}[4] 结束稳进版、退出游戏并切换激进版${C_RESET}"
printf "%b\n" "${C_GRAY}$(nx_feature_summary)${C_RESET}"
;;
aggressive)
printf "%b\n" "${C_GREEN}[1] 进入对局后开启防观察${C_RESET}"
printf "%b\n" "${C_YELLOW}[2] 对局结束后关闭防观察${C_RESET}"
printf "%b\n" "${C_BORDER}[H] 返回主页 [Q] 直接退出${C_RESET}"
printf "%b\n" "${C_BORDER}[3] 结束激进版、退出游戏并切换稳进版${C_RESET}"
printf "%b\n" "${C_GRAY}$(nx_feature_summary)${C_RESET}"
;;
esac
}
nx_remove_own_firewall_rules() {
if [ -n "$IPTABLES_CMD" ]; then
if [ -n "$GAME_UID" ]; then
while $IPTABLES_CMD -D OUTPUT -m owner --uid-owner "$GAME_UID" -j "$NX_CHAIN_V4" 2>/dev/null; do :; done
fi
$IPTABLES_CMD -F "$NX_CHAIN_V4" 2>/dev/null
$IPTABLES_CMD -X "$NX_CHAIN_V4" 2>/dev/null
$IPTABLES_CMD -F "$NX_BATTLE_CHAIN" 2>/dev/null
$IPTABLES_CMD -X "$NX_BATTLE_CHAIN" 2>/dev/null
fi
if [ -n "$IP6TABLES_CMD" ]; then
if [ -n "$GAME_UID" ]; then while $IP6TABLES_CMD -D OUTPUT -m owner --uid-owner "$GAME_UID" -j "$NX_CHAIN_V6" 2>/dev/null; do :; done; fi
$IP6TABLES_CMD -F "$NX_CHAIN_V6" 2>/dev/null
$IP6TABLES_CMD -X "$NX_CHAIN_V6" 2>/dev/null
fi
}
nx_remove_own_dns_rules() {
[ -n "$IPTABLES_CMD" ] || return 0
if [ -n "$GAME_UID" ]; then
while $IPTABLES_CMD -t nat -D OUTPUT -m owner --uid-owner "$GAME_UID" -p udp --dport 53 -j "$NX_DNS_CHAIN" 2>/dev/null; do :; done
while $IPTABLES_CMD -t nat -D OUTPUT -m owner --uid-owner "$GAME_UID" -p tcp --dport 53 -j "$NX_DNS_CHAIN" 2>/dev/null; do :; done
fi
$IPTABLES_CMD -t nat -F "$NX_DNS_CHAIN" 2>/dev/null
$IPTABLES_CMD -t nat -X "$NX_DNS_CHAIN" 2>/dev/null
}
nx_remove_own_rules() {
nx_remove_own_firewall_rules
nx_remove_own_dns_rules
}
nx_is_main_pid() {
_nx_check_pid=$1
[ -n "$_nx_check_pid" ] || return 1
[ "$_nx_check_pid" = "$$" ] && return 0
if [ -f "$NX_MAIN_PID_FILE" ]; then
[ "$_nx_check_pid" = "$(cat "$NX_MAIN_PID_FILE" 2>/dev/null)" ] && return 0
fi
return 1
}
nx_safe_stop_pid_file() {
_nx_pid_file=$1
_nx_kill_mode=$2
[ -f "$_nx_pid_file" ] || return 0
_nx_stop_pid=$(cat "$_nx_pid_file" 2>/dev/null)
if [ -z "$_nx_stop_pid" ] || nx_is_main_pid "$_nx_stop_pid"; then
rm -f "$_nx_pid_file" 2>/dev/null
return 0
fi
if [ "$_nx_kill_mode" = "force" ]; then
kill -9 "$_nx_stop_pid" 2>/dev/null
else
kill "$_nx_stop_pid" 2>/dev/null
fi
rm -f "$_nx_pid_file" 2>/dev/null
}
nx_cleanup() {
if [ "$NX_PROFILE" = "none" ]; then
rmdir "$NX_FEATURE_LOCK" 2>/dev/null
rm -f "$NX_FEATURE_FILE.tmp" "$NX_FIREWALL_VERIFIED_MARKER" "$NX_DNS_VERIFIED_MARKER" 2>/dev/null
rm -f "$NX_MAIN_PID_FILE" "$NX_INSTANCE_START_FILE" "$NX_WATCH_PID_FILE" "$NX_MONITOR_PID_FILE" "$NX_AGGRESSIVE_JOB_PID_FILE" "$NX_HAO_DAEMON_PID_FILE" "$NX_HAO_DAEMON_START_FILE" "$NX_WEB_START_FILE" "$NX_WEB_SERVER_PID_FILE" "$NX_WEB_RENDER_PID_FILE" "$NX_WEB_BACKEND_FILE" "$NX_RUNTIME_STATE_FILE" "$NX_HEARTBEAT_FILE" "$NX_WATCHDOG_PAUSE_FILE" "$NX_RECOVERY_GUARD_FILE" 2>/dev/null
return 0
fi
nx_safe_stop_pid_file "$NX_WATCH_PID_FILE" force
nx_safe_stop_pid_file "$NX_MONITOR_PID_FILE" force
nx_safe_stop_pid_file "$NX_AGGRESSIVE_JOB_PID_FILE" force
nx_remove_own_rules
if [ -f "$NX_MOUNT_LIST" ]; then
while IFS='|' read -r _nx_mount_pid _nx_mount_target; do
[ -n "$_nx_mount_target" ] || continue
if [ "$_nx_mount_pid" = "host" ]; then
umount -l "$_nx_mount_target" 2>/dev/null || umount "$_nx_mount_target" 2>/dev/null
elif nx_command_exists nsenter && kill -0 "$_nx_mount_pid" 2>/dev/null; then
nsenter -t "$_nx_mount_pid" -m -- umount -l "$_nx_mount_target" 2>/dev/null || nsenter -t "$_nx_mount_pid" -m -- umount "$_nx_mount_target" 2>/dev/null
fi
done < "$NX_MOUNT_LIST"
fi
chattr -i "/data/data/${GAME_PKG}/.ns_v4_lock" 2>/dev/null
if [ "$NX_SYSTEM_STATE_BACKED_UP" -eq 1 ] || [ -f "$NX_SYSTEM_BACKUP_MARKER" ]; then
_nx_restore_failed=0
for _nx_prop in ro.debuggable ro.secure ro.build.type ro.build.tags ro.kernel.android.checkjni persist.sys.usb.config service.adb.tcp.port persist.service.adb.enable persist.adb.enable; do
_nx_prop_file="$NX_WORK_DIR/prop_$(echo "$_nx_prop" | tr '.' '_')"
[ -f "$_nx_prop_file" ] || { _nx_restore_failed=1; continue; }
_nx_prop_value=$(cat "$_nx_prop_file" 2>/dev/null)
case "$_nx_prop" in ro.*)
if nx_command_exists resetprop; then
resetprop -n "$_nx_prop" "$_nx_prop_value" 2>/dev/null || _nx_restore_failed=1
fi
;;
*)
setprop "$_nx_prop" "$_nx_prop_value" 2>/dev/null || _nx_restore_failed=1
;;
esac
done
_nx_usb_before=$(cat "$NX_WORK_DIR/prop_persist_sys_usb_config" 2>/dev/null)
echo "$_nx_usb_before" | grep -q adb && start adbd 2>/dev/null
if [ "$_nx_restore_failed" -eq 0 ]; then
for _nx_prop in ro.debuggable ro.secure ro.build.type ro.build.tags ro.kernel.android.checkjni persist.sys.usb.config service.adb.tcp.port persist.service.adb.enable persist.adb.enable; do
rm -f "$NX_WORK_DIR/prop_$(echo "$_nx_prop" | tr '.' '_')" 2>/dev/null
done
rm -f "$NX_SYSTEM_BACKUP_MARKER" 2>/dev/null
NX_SYSTEM_STATE_BACKED_UP=0
else
write_block_log "WARN" "部分系统属性未能恢复，已保留原值备份供下次重试"
fi
fi
rmdir "$NX_FEATURE_LOCK" 2>/dev/null
rm -f "$NX_FEATURE_FILE.tmp" "$NX_MAIN_PID_FILE" "$NX_INSTANCE_START_FILE" "$NX_WATCH_PID_FILE" "$NX_MONITOR_PID_FILE" "$NX_AGGRESSIVE_JOB_PID_FILE" "$NX_HAO_DAEMON_PID_FILE" "$NX_HAO_DAEMON_START_FILE" "$NX_WEB_START_FILE" "$NX_WEB_SERVER_PID_FILE" "$NX_WEB_RENDER_PID_FILE" "$NX_WEB_BACKEND_FILE" "$NX_RUNTIME_STATE_FILE" "$NX_HEARTBEAT_FILE" "$NX_WATCHDOG_PAUSE_FILE" "$NX_RECOVERY_GUARD_FILE" "$NX_FIREWALL_VERIFIED_MARKER" "$NX_DNS_VERIFIED_MARKER" 2>/dev/null
}
fusion_prepare_hao_cleanup() {
if [ -f "$HTTP_PID_FILE" ]; then
_fusion_http_pid=$(cat "$HTTP_PID_FILE" 2>/dev/null)
nx_is_main_pid "$_fusion_http_pid" && rm -f "$HTTP_PID_FILE" 2>/dev/null
fi
if [ -f "$NX_HAO_DAEMON_PID_FILE" ]; then
_fusion_daemon_pid=$(cat "$NX_HAO_DAEMON_PID_FILE" 2>/dev/null)
_fusion_daemon_start=$(cat "$NX_HAO_DAEMON_START_FILE" 2>/dev/null)
_fusion_daemon_now=$(awk '{print $22}' "/proc/$_fusion_daemon_pid/stat" 2>/dev/null)
if [ -n "$_fusion_daemon_pid" ] && [ -n "$_fusion_daemon_start" ] && [ "$_fusion_daemon_start" = "$_fusion_daemon_now" ] && ! nx_is_main_pid "$_fusion_daemon_pid" && kill -0 "$_fusion_daemon_pid" 2>/dev/null; then
echo "$_fusion_daemon_pid" > "$DAEMON_PID_FILE"
else
rm -f "$DAEMON_PID_FILE" 2>/dev/null
fi
elif [ -f "$DAEMON_PID_FILE" ] && [ "$(cat "$DAEMON_PID_FILE" 2>/dev/null)" = "$$" ]; then
rm -f "$DAEMON_PID_FILE" 2>/dev/null
fi
}
fusion_remove_timing_qdisc() {
_fusion_netem_marker="$WORK_DIR/tc_netem.dev"
[ -f "$_fusion_netem_marker" ] || return 0
_fusion_netem_dev=$(head -n 1 "$_fusion_netem_marker" 2>/dev/null | tr -cd 'A-Za-z0-9_.:-')
if [ -n "$_fusion_netem_dev" ] && command -v tc >/dev/null 2>&1; then
tc qdisc del dev "$_fusion_netem_dev" root netem 2>/dev/null
fi
rm -f "$_fusion_netem_marker" 2>/dev/null
}
full_cleanup() {
fusion_quiesce_workers
fusion_prepare_hao_cleanup
sync_iptables_stats force
nx_stop_web_service
fusion_remove_timing_qdisc
hao_full_cleanup
nx_cleanup
}
fusion_game_pids_exact() {
_fusion_candidates=""
if command -v pgrep >/dev/null 2>&1; then
_fusion_candidates=$(pgrep -f "$GAME_PKG" 2>/dev/null)
else
for _fusion_proc_dir in /proc/[0-9]*; do
[ -r "$_fusion_proc_dir/cmdline" ] && _fusion_candidates="$_fusion_candidates ${_fusion_proc_dir##*/}"
done
fi
for _fusion_game_pid in $_fusion_candidates; do
[ -r "/proc/$_fusion_game_pid/cmdline" ] || continue
_fusion_game_cmd=$(tr '\000' '\n' < "/proc/$_fusion_game_pid/cmdline" 2>/dev/null | head -n 1)
case "$_fusion_game_cmd" in
"$GAME_PKG"|"$GAME_PKG":*) printf '%s\n' "$_fusion_game_pid" ;;
esac
done
}
fusion_game_is_running_exact() {
[ -n "$(fusion_game_pids_exact | head -n 1)" ]
}
fusion_quiesce_workers() {
touch "$NX_WATCHDOG_PAUSE_FILE" 2>/dev/null
nx_safe_stop_pid_file "$NX_WATCH_PID_FILE" force
nx_safe_stop_pid_file "$NX_MONITOR_PID_FILE" force
nx_safe_stop_pid_file "$NX_AGGRESSIVE_JOB_PID_FILE" force
nx_safe_stop_pid_file "$NX_HAO_DAEMON_PID_FILE" force
rm -f "$NX_HAO_DAEMON_START_FILE" "$DAEMON_PID_FILE" 2>/dev/null
return 0
}
fusion_stop_game() {
printf "%b\n" "${C_YELLOW}正在结束游戏及其子进程...${C_RESET}"
_fusion_am_pid=""
if command -v am >/dev/null 2>&1; then
am force-stop "$GAME_PKG" >/dev/null 2>&1 &
_fusion_am_pid=$!
fi
nx_fast_pause 150000
if [ -n "$_fusion_am_pid" ] && kill -0 "$_fusion_am_pid" 2>/dev/null; then
kill -9 "$_fusion_am_pid" 2>/dev/null
wait "$_fusion_am_pid" 2>/dev/null
fi
for _fusion_game_pid in $(fusion_game_pids_exact); do
[ "$_fusion_game_pid" != "$$" ] && kill -9 "$_fusion_game_pid" 2>/dev/null
done
_fusion_stop_try=0
while fusion_game_is_running_exact && [ "$_fusion_stop_try" -lt 5 ]; do
nx_fast_pause 100000
_fusion_stop_try=$((_fusion_stop_try + 1))
done
if fusion_game_is_running_exact; then
write_block_log "WARN" "已请求结束游戏，但仍检测到游戏进程"
printf "%b\n" "${C_RED}游戏仍有进程存活，请检查设备权限${C_RESET}"
return 1
fi
write_block_log "INFO" "游戏及其子进程已结束"
printf "%b\n" "${C_GREEN}游戏进程已结束${C_RESET}"
return 0
}
fusion_stop_active_mode() {
FUSION_SWITCHING=1
printf "\n%b\n" "${C_YELLOW}正在停止当前防护模式并清理进程与规则...${C_RESET}"
fusion_quiesce_workers
fusion_prepare_hao_cleanup
sync_iptables_stats force
nx_stop_web_service fast_exit
fusion_remove_timing_qdisc
hao_full_cleanup
nx_cleanup
nx_fast_pause 100000
NX_PROFILE="none"
running=true
GAME_UID=""
risk_value=12
block_count=$(nx_counter_get total_block)
start_time=$(date +%s)
log_buffer=""
last_log_count=0
tput cnorm 2>/dev/null
}
fusion_exit_active_mode() {
FUSION_NEXT_ACTION="exit"
_fusion_exit_game_ok=1
# 激进任务必须先停，再结束游戏；否则挂载/线程操作会与force-stop竞争。
fusion_quiesce_workers
fusion_stop_game || _fusion_exit_game_ok=0
fusion_stop_active_mode
clear 2>/dev/null
if [ "$_fusion_exit_game_ok" -eq 1 ]; then
printf "%b\n" "${C_RESET}防御系统已退出，游戏及相关进程已清理"
else
printf "%b\n" "${C_RED}防御系统已退出，但游戏未能完全结束，请手动结束游戏${C_RESET}"
fi
exit 0
}
fusion_runtime_controls() {
_fusion_key=""
if [ ! -t 0 ]; then
sleep 1
return 0
fi
if ! read -r -t 1 -n 1 _fusion_key /dev/null; then
sleep 1
return 0
fi
case "$NX_PROFILE:$_fusion_key" in
stable:1|aggressive:1)
printf "\n"
nx_apply_match_antiwatch enable
;;
stable:2|aggressive:2)
printf "\n"
nx_apply_match_antiwatch disable
;;
stable:q|stable:Q|aggressive:q|aggressive:Q)
fusion_exit_active_mode
;;
stable:h|stable:H|stable:0|aggressive:h|aggressive:H|aggressive:0)
FUSION_NEXT_ACTION="home"
fusion_stop_active_mode
return 1
;;
stable:4|stable:a|stable:A)
printf "\n"
if ! fusion_confirm OK; then
printf "\n%b\n" "${C_YELLOW}已取消切换，稳进版继续运行${C_RESET}"
sleep 1
return 0
fi
FUSION_NEXT_ACTION="aggressive"
if ! fusion_stop_game; then
FUSION_NEXT_ACTION=""
printf "%b\n" "${C_RED}游戏未完全结束，本次不切换模式${C_RESET}"
sleep 1
return 0
fi
fusion_stop_active_mode
return 1
;;
aggressive:3|aggressive:s|aggressive:S)
FUSION_NEXT_ACTION="stable"
if ! fusion_stop_game; then
FUSION_NEXT_ACTION=""
printf "%b\n" "${C_RED}游戏未完全结束，本次不切换模式${C_RESET}"
sleep 1
return 0
fi
fusion_stop_active_mode
return 1
;;
esac
return 0
}
nx_start_watchdog() {
_nx_profile=$1
echo $$ > "$NX_MAIN_PID_FILE"
awk '{print $22}' "/proc/$$/stat" 2>/dev/null > "$NX_INSTANCE_START_FILE"
echo "$_nx_profile" > "$NX_MODE_FILE"
nx_update_heartbeat
(
trap '' SIGHUP
trap 'exit 0' SIGINT SIGTERM
_nx_parent=$(cat "$NX_MAIN_PID_FILE" 2>/dev/null)
_nx_stale_warn_last=0
while true; do
sleep 10
_nx_recover=0
if ! kill -0 "$_nx_parent" 2>/dev/null; then
_nx_now=$(date +%s)
_nx_last_recovery=$(cat "$NX_RECOVERY_GUARD_FILE" 2>/dev/null)
case "$_nx_last_recovery" in ''|*[!0-9]*) _nx_last_recovery=0;; esac
if [ $((_nx_now - _nx_last_recovery)) -ge 300 ]; then
_nx_recover=1
write_block_log "WARN" "主防护进程已消失；保留全部规则并恢复一次管理进程"
else
if [ $((_nx_now - _nx_stale_warn_last)) -ge 60 ]; then
write_block_log "WARN" "管理进程重复异常，已抑制重启；内核拦截规则继续保持"
_nx_stale_warn_last=$_nx_now
fi
nx_base_firewall_ok || nx_repair_base_firewall
fi
else
[ -f "$NX_WATCHDOG_PAUSE_FILE" ] && continue
_nx_last=$(cat "$NX_HEARTBEAT_FILE" 2>/dev/null)
_nx_now=$(date +%s)
[ -z "$_nx_last" ] && _nx_last=0
if [ $((_nx_now - _nx_last)) -gt 90 ]; then
# 主PID仍存活时绝不能因心跳延迟将其杀死。激进任务、挂载或
# 设备I/O可能暂时拖慢状态更新，但内核拦截规则仍然有效。
if [ $((_nx_now - _nx_stale_warn_last)) -ge 60 ]; then
write_block_log "WARN" "状态心跳延迟；主进程仍存活，不执行重启"
_nx_stale_warn_last=$_nx_now
fi
nx_base_firewall_ok || nx_repair_base_firewall
fi
fi
if [ "$_nx_recover" -eq 1 ]; then
# 恢复管理进程时保留全部内核拦截链。这里只停止旧的辅助进程，
# 绝不调用 hao_full_cleanup/nx_cleanup，也不删除或刷新任何规则。
rm -f "$NX_WATCH_PID_FILE" 2>/dev/null
sync_iptables_stats force
nx_safe_stop_pid_file "$NX_MONITOR_PID_FILE" force
nx_safe_stop_pid_file "$NX_AGGRESSIVE_JOB_PID_FILE" force
nx_safe_stop_pid_file "$NX_HAO_DAEMON_PID_FILE" force
rm -f "$NX_HAO_DAEMON_START_FILE" "$DAEMON_PID_FILE" 2>/dev/null
nx_stop_web_service keep_rules
kill -9 "$_nx_parent" 2>/dev/null
rm -f "$NX_MAIN_PID_FILE" "$NX_INSTANCE_START_FILE" "$NX_HEARTBEAT_FILE" 2>/dev/null
mkdir -p "$NX_WORK_DIR" 2>/dev/null
date +%s > "$NX_RECOVERY_GUARD_FILE" 2>/dev/null
HAOGE_KEEP_RULES_RECOVERY=1 nohup /system/bin/sh "$0" "--profile=$_nx_profile" "$HAOGE_SESSION_TOKEN" >"$NX_BG_LOG" 2>&1 &
exit 0
fi
done
) >>"$NX_BG_LOG" 2>&1 &
_nx_watch_pid=$!
echo "$_nx_watch_pid" > "$NX_WATCH_PID_FILE"
nx_keep_aux_resident "$_nx_watch_pid"
}
nx_background_monitor() {
_nx_profile=$1
(
trap '' SIGHUP
trap 'exit 0' SIGINT SIGTERM
_nx_checks=0
if nx_is_game_running; then _nx_game_seen=1; else _nx_game_seen=0; fi
while true; do
sleep 5
nx_update_heartbeat
_nx_checks=$((_nx_checks + 1))
nx_ensure_web_service
# 基础拦截是最高优先级。每 30 秒直接从内核规则表验证链与 OUTPUT
# 挂载；缺失时立即重建，而不是仅依赖界面状态或进程是否存在。
if [ $((_nx_checks % 6)) -eq 0 ]; then
if ! nx_base_firewall_ok; then
write_block_log "WARN" "检测到基础拦截链缺失，正在自动恢复"
_nx_base_recovered=0
for _nx_base_try in 1 2 3; do
if nx_repair_base_firewall && nx_base_firewall_ok; then
_nx_base_recovered=1
write_block_log "SUCCESS" "基础拦截链已自动恢复"
break
fi
sleep 1
done
if [ "$_nx_base_recovered" -ne 1 ]; then
nx_feature_set hao_firewall fail "基础拦截链恢复失败，请检查ROOT与iptables"
fi
fi
fi
if nx_is_game_running; then
if [ "$_nx_game_seen" -eq 0 ]; then
_nx_game_seen=1
nx_feature_set game_state ok "游戏已启动，运行时功能已触发"
if [ "$_nx_profile" = "aggressive" ]; then
nx_start_aggressive_game_tasks
fi
fi
if [ "$_nx_profile" = "aggressive" ]; then
if nx_detect_battle; then
if [ "$NX_OFFLINE_ACTIVE" -eq 0 ]; then
nx_set_battle_block 1 && NX_OFFLINE_ACTIVE=1
fi
elif [ "$NX_OFFLINE_ACTIVE" -eq 1 ]; then
nx_set_battle_block 0
NX_OFFLINE_ACTIVE=0
fi
nx_spoof_threads
fi
else
_nx_game_seen=0
NX_OFFLINE_ACTIVE=0
[ "$_nx_profile" = "aggressive" ] && nx_set_battle_block 0
nx_feature_set game_state wait "防护已启动，等待游戏"
fi
if [ "$_nx_profile" = "aggressive" ] && [ $((_nx_checks % 6)) -eq 0 ]; then
if ! nx_aggressive_firewall_structure_ok; then
write_block_log "WARN" "激进扩展链结构缺失，正在非破坏性恢复；基础拦截不受影响"
if nx_repair_aggressive_firewall && nx_aggressive_firewall_structure_ok; then
if nx_aggressive_firewall_rules_ok; then
nx_feature_set extra_firewall ok "扩展链已恢复，关键规则逐项验证通过"
else
nx_feature_set extra_firewall fail "扩展链结构已恢复，但设备未通过全部关键规则验证"
fi
else
nx_feature_set extra_firewall fail "扩展链恢复失败；皓哥基础拦截仍持续工作"
fi
elif [ -f "$NX_FIREWALL_VERIFIED_MARKER" ] && ! nx_aggressive_firewall_rules_ok; then
write_block_log "WARN" "激进扩展链内容被外部改动，正在仅重建激进链"
nx_deploy_firewall || nx_feature_set extra_firewall fail "扩展规则内容恢复失败；皓哥基础拦截仍持续工作"
fi
if ! nx_aggressive_dns_structure_ok; then
write_block_log "WARN" "游戏UID DNS链结构缺失，正在独立恢复"
if nx_repair_aggressive_dns && nx_aggressive_dns_structure_ok; then
nx_feature_set uid_dns ok "DNS扩展链已恢复并验证双协议挂载"
else
nx_feature_set uid_dns fail "DNS扩展链恢复失败；基础拦截不受影响"
fi
elif [ -f "$NX_DNS_VERIFIED_MARKER" ] && ! nx_aggressive_dns_rules_ok; then
write_block_log "WARN" "DNS扩展链内容被外部改动，正在仅重建DNS链"
nx_deploy_dns_hijack || nx_feature_set uid_dns fail "DNS规则内容恢复失败；基础拦截不受影响"
fi
fi
done
) >>"$NX_BG_LOG" 2>&1 &
_nx_monitor_pid=$!
echo "$_nx_monitor_pid" > "$NX_MONITOR_PID_FILE"
nx_keep_aux_resident "$_nx_monitor_pid"
}
nx_aggressive_on_game_start() {
GAME_UID=$(nx_retry_get_uid)
nx_repair_base_firewall
nx_update_heartbeat
if ! nx_aggressive_firewall_structure_ok; then
nx_repair_aggressive_firewall || nx_feature_set extra_firewall fail "游戏启动时扩展链恢复失败；基础拦截仍持续工作"
fi
if ! nx_aggressive_dns_structure_ok; then
nx_repair_aggressive_dns || nx_feature_set uid_dns fail "游戏启动时DNS扩展链恢复失败；基础拦截不受影响"
fi
nx_update_heartbeat
nx_clean_ace_cache
nx_update_heartbeat
nx_root_hide
nx_update_heartbeat
nx_dir_lock
nx_update_heartbeat
nx_kill_extra_processes
nx_update_heartbeat
nx_spoof_threads
nx_update_heartbeat
}
nx_start_aggressive_game_tasks() {
if [ -f "$NX_AGGRESSIVE_JOB_PID_FILE" ]; then
_nx_aggressive_job_pid=$(cat "$NX_AGGRESSIVE_JOB_PID_FILE" 2>/dev/null)
[ -n "$_nx_aggressive_job_pid" ] && kill -0 "$_nx_aggressive_job_pid" 2>/dev/null && return 0
rm -f "$NX_AGGRESSIVE_JOB_PID_FILE" 2>/dev/null
fi
(
trap '' SIGHUP
trap 'rm -f "$NX_AGGRESSIVE_JOB_PID_FILE" 2>/dev/null; exit 0' SIGINT SIGTERM
nx_aggressive_on_game_start
rm -f "$NX_AGGRESSIVE_JOB_PID_FILE" 2>/dev/null
) >>"$NX_BG_LOG" 2>&1 &
_nx_aggressive_job_pid=$!
echo "$_nx_aggressive_job_pid" > "$NX_AGGRESSIVE_JOB_PID_FILE"
nx_keep_aux_resident "$_nx_aggressive_job_pid"
}
nx_apply_stable() {
NX_PROTECT_MODE=1
nx_set_oom_protect $$
if [ "$(cat "/proc/$$/oom_score_adj" 2>/dev/null)" = "-1000" ]; then nx_feature_set oom_protect ok "主进程OOM保护已验证"; else nx_feature_set oom_protect sent "OOM与优先级命令已下发"; fi
nx_feature_set base_rules ok "仅使用皓哥原防火墙、守护进程和UI"
if nx_is_game_running; then nx_feature_set game_state ok "游戏已运行"; else nx_feature_set game_state wait "防护已启动，等待游戏"; fi
nx_start_watchdog stable
nx_background_monitor stable
}
nx_apply_aggressive() {
NX_PROTECT_MODE=2
NX_HOSTS_DOMAIN_ACTIVE="$NX_HOSTS_DOMAIN_SAFE"
NX_HIGH_RISK_TCP_PORTS_ACTIVE="$NX_HIGH_RISK_TCP_PORTS_FULL"
NX_HIGH_RISK_UDP_PORTS_ACTIVE="$NX_HIGH_RISK_UDP_PORTS_FULL"
if [ "$HAOGE_KEEP_RULES_RECOVERY" = "1" ]; then
nx_set_oom_protect $$
if ! nx_aggressive_firewall_structure_ok; then
nx_repair_aggressive_firewall || nx_feature_set extra_firewall fail "管理进程恢复后扩展链修复失败；基础拦截仍在"
fi
if ! nx_aggressive_dns_structure_ok; then
nx_repair_aggressive_dns || nx_feature_set uid_dns fail "管理进程恢复后DNS链修复失败；基础拦截仍在"
fi
nx_feature_set base_rules ok "已接管并保留现有拦截规则，未刷新规则链"
if nx_is_game_running; then nx_feature_set game_state ok "游戏已运行，拦截规则持续保持"; else nx_feature_set game_state wait "拦截规则持续保持，等待游戏"; fi
nx_start_watchdog aggressive
nx_background_monitor aggressive
return 0
fi
GAME_UID=$(nx_retry_get_uid)
nx_backup_system_state
nx_disable_adb
nx_spoof_debug_props
nx_clean_ace_cache
nx_deploy_firewall
nx_deploy_dns_hijack
nx_feature_set battle_control wait "等待战斗态连接"
if nx_is_game_running; then
nx_feature_set game_state ok "游戏已启动，运行时功能已触发"
nx_start_aggressive_game_tasks
else
nx_feature_set game_state wait "扩展规则已部署，运行时功能等待游戏"
nx_feature_set root_hide wait "等待游戏进程"
nx_feature_set thread_control wait "等待游戏进程"
nx_feature_set process_control wait "等待游戏进程"
fi
nx_set_oom_protect $$
renice -20 $$ 2>/dev/null
nx_start_watchdog aggressive
nx_background_monitor aggressive
}
nx_apply_profile() {
case "$1" in
stable) nx_apply_stable ;;
aggressive) nx_apply_aggressive ;;
*) return 0 ;;
esac
}
start_hao_original() {
# ========== 初始化启动 ==========
clear
echo -e "${C_TITLE}正在初始化皓哥云盾...${C_RESET}"
[ "$(id -u)" -ne 0 ] && { echo -e "${C_RED}错误：必须以ROOT权限运行${C_RESET}"; exit 1; }
mkdir -p "$WORK_DIR" 2>/dev/null
nx_initialize
# 主防护进程也迁出 MT 的后台冻结组；浏览器切前台不能带走拦截核心。
trap '' SIGHUP SIGTERM
nx_keep_aux_resident $$
_fusion_keep_rules=0
_fusion_saved_uid=""
if [ "$HAOGE_KEEP_RULES_RECOVERY" = "1" ] && nx_load_runtime_state; then
_fusion_keep_rules=1
_fusion_saved_uid=$GAME_UID
fi
if [ "$_fusion_keep_rules" -ne 1 ]; then
HAOGE_KEEP_RULES_RECOVERY=0
export HAOGE_KEEP_RULES_RECOVERY
nx_counter_reset_session
> "$BLOCK_LOG"
printf "ip_block=0\nthread_block=0\ndns_block=0\nsock_kill=0\nhidden_thread=0\nping_kill=0\ntrace_clean=0\nfile_spoof=0\nfinger_spoof=0\n" > "$STATS_FILE"
fi
echo "获取游戏UID..."
GAME_UID=$(get_game_uid)
echo "UID: $GAME_UID"
if [ "$_fusion_keep_rules" -eq 1 ]; then
echo "接管现有拦截规则（不清空、不刷新）..."
else
echo "加载增强防火墙规则..."
fi
_fusion_fw_ready=0
for _fusion_fw_try in 1 2 3; do
if [ "$_fusion_keep_rules" -eq 1 ] && nx_base_firewall_ok; then
_fusion_fw_ready=1
break
fi
if [ "$_fusion_keep_rules" -eq 1 ]; then
nx_repair_base_firewall
else
setup_firewall
fi
if nx_base_firewall_ok; then
_fusion_fw_ready=1
break
fi
sleep 1
done
if [ "$_fusion_fw_ready" -ne 1 ]; then
nx_feature_set hao_firewall fail "基础拦截规则未成功挂载，已停止本次启动"
printf "%b\n" "${C_RED}错误：基础拦截规则未成功挂载，不会虚假显示为已启动。${C_RESET}"
return 1
fi
nx_apply_profile "$NX_PROFILE"
echo "启动后台守护进程..."
daemon_worker &
_fusion_daemon_pid=$!
echo "$_fusion_daemon_pid" > "$NX_HAO_DAEMON_PID_FILE"
awk "{print \$22}" "/proc/$_fusion_daemon_pid/stat" 2>/dev/null > "$NX_HAO_DAEMON_START_FILE"
nx_keep_aux_resident "$_fusion_daemon_pid"
echo "$_fusion_daemon_pid" > "$DAEMON_PID_FILE"
echo "启动网页验证服务..."
start_web_service
echo "防护系统已启动，即将进入监控面板..."
# 初始化日志
log_buffer="
${C_GRAY}[$(date '+%H:%M:%S')] ${C_TITLE}[info] ${C_WHITE}防御内核初始化完成
${C_GRAY}[$(date '+%H:%M:%S')] ${C_GREEN}[success] ${C_WHITE}加载 6 个防护模块
${C_GRAY}[$(date '+%H:%M:%S')] ${C_GREEN}[success] ${C_WHITE}流量加密隧道已建立
${C_GRAY}[$(date '+%H:%M:%S')] ${C_GREEN}[success] ${C_WHITE}当前环境风险评分: ${risk_value}/100"
sleep 1
# ========== 主循环 ==========
while $running; do
fetch_real_data
draw_ui
fusion_runtime_controls || return 0
done
tui_cleanup
}
# ========== 四项启动菜单 ==========
fusion_require_root() {
if [ "$(id -u)" -ne 0 ]; then
printf "%b\n" "${C_RED}错误：该操作必须使用ROOT权限${C_RESET}"
return 1
fi
return 0
}
fusion_confirm() {
_fusion_word=$1
nx_update_heartbeat
touch "$NX_WATCHDOG_PAUSE_FILE" 2>/dev/null
printf "%b" "${C_YELLOW}该操作会修改安卓系统或游戏数据。输入 ${_fusion_word} 继续：${C_RESET}"
read -r _fusion_answer
rm -f "$NX_WATCHDOG_PAUSE_FILE" 2>/dev/null
nx_update_heartbeat
[ "$_fusion_answer" = "$_fusion_word" ]
}
fusion_run_profile() {
local _fusion_target=$1
mkdir -p "$NX_WORK_DIR" 2>/dev/null
nx_acquire_instance || { sleep 2; return 1; }
while true; do
NX_PROFILE="$_fusion_target"
FUSION_NEXT_ACTION=""
if ! start_hao_original; then
FUSION_SWITCHING=1
full_cleanup
FUSION_SWITCHING=0
sleep 2
return 1
fi
case "$FUSION_NEXT_ACTION" in
stable|aggressive)
_fusion_target="$FUSION_NEXT_ACTION"
FUSION_NEXT_ACTION=""
FUSION_SWITCHING=0
;;
home|*) return 0 ;;
esac
done
}
fusion_remove_stale_base_chains() {
command -v iptables >/dev/null 2>&1 || return 0
for _fusion_stale_chain in $(iptables -S 2>/dev/null | awk '$1 == "-N" && $2 ~ /^def_[a-z0-9]+$/ {print $2}'); do
while true; do
_fusion_stale_num=$(iptables -n -L OUTPUT --line-numbers 2>/dev/null | awk -v c="$_fusion_stale_chain" 'index($0,c) {print $1; exit}')
[ -n "$_fusion_stale_num" ] || break
iptables -w 1 -D OUTPUT "$_fusion_stale_num" 2>/dev/null || break
done
iptables -w 1 -F "$_fusion_stale_chain" 2>/dev/null
iptables -w 1 -X "$_fusion_stale_chain" 2>/dev/null
done
if command -v ip6tables >/dev/null 2>&1; then
for _fusion_stale_chain in $(ip6tables -S 2>/dev/null | awk '$1 == "-N" && $2 ~ /^def6_[a-z0-9]+$/ {print $2}'); do
while true; do
_fusion_stale_num=$(ip6tables -n -L OUTPUT --line-numbers 2>/dev/null | awk -v c="$_fusion_stale_chain" 'index($0,c) {print $1; exit}')
[ -n "$_fusion_stale_num" ] || break
ip6tables -w 1 -D OUTPUT "$_fusion_stale_num" 2>/dev/null || break
done
ip6tables -w 1 -F "$_fusion_stale_chain" 2>/dev/null
ip6tables -w 1 -X "$_fusion_stale_chain" 2>/dev/null
done
fi
}
fusion_cleanup_previous_session() {
_fusion_previous_detected=0
for _fusion_previous_file in "$NX_RUNTIME_STATE_FILE" "$NX_MAIN_PID_FILE" "$NX_WATCH_PID_FILE" "$NX_MONITOR_PID_FILE" "$NX_HAO_DAEMON_PID_FILE" "$HTTP_PID_FILE"; do
[ -f "$_fusion_previous_file" ] && { _fusion_previous_detected=1; break; }
done
if [ "$_fusion_previous_detected" -eq 0 ] && command -v iptables >/dev/null 2>&1; then
iptables -S 2>/dev/null | grep -qE '(^-N def_[a-z0-9]+|NX_FUSION_)' && _fusion_previous_detected=1
fi
[ "$_fusion_previous_detected" -eq 1 ] || return 0
printf "%b\n" "${C_YELLOW}检测到上一次运行残留，正在清理旧进程与旧规则...${C_RESET}"
FUSION_SWITCHING=1
_fusion_old_main=$(cat "$NX_MAIN_PID_FILE" 2>/dev/null)
nx_load_runtime_state >/dev/null 2>&1 || {
IPTABLES_CMD=$(nx_find_iptables)
IP6TABLES_CMD=$(nx_find_ip6tables)
}
touch "$NX_WATCHDOG_PAUSE_FILE" 2>/dev/null
nx_safe_stop_pid_file "$NX_WATCH_PID_FILE" force
nx_safe_stop_pid_file "$NX_MONITOR_PID_FILE" force
nx_safe_stop_pid_file "$NX_AGGRESSIVE_JOB_PID_FILE" force
nx_safe_stop_pid_file "$NX_HAO_DAEMON_PID_FILE" force
nx_stop_web_service fast_exit
if [ -n "$_fusion_old_main" ] && [ "$_fusion_old_main" != "$$" ]; then
kill -9 "$_fusion_old_main" 2>/dev/null
fi
sync_iptables_stats force
[ -n "$GAME_UID" ] || GAME_UID=$(get_game_uid)
nx_remove_own_rules
hao_full_cleanup
nx_cleanup
fusion_remove_stale_base_chains
rm -f "$NX_MAIN_PID_FILE" "$NX_INSTANCE_START_FILE" "$NX_RUNTIME_STATE_FILE" "$NX_RECOVERY_GUARD_FILE" "$NX_WATCHDOG_PAUSE_FILE" 2>/dev/null
NX_PROFILE="none"
FUSION_SWITCHING=0
printf "%b\n" "${C_GREEN}上一次运行残留已清理，进入全新会话${C_RESET}"
nx_fast_pause 150000
}
fusion_menu() {
while true; do
if [ "$FUSION_STARTUP_AUDITED" -eq 0 ]; then
FUSION_STARTUP_AUDITED=1
fusion_cleanup_previous_session
fi
clear 2>/dev/null
printf "%b\n" "${C_TITLE}========== 皓哥云盾防观察 ==========${C_RESET}"
printf "%b\n" "${C_TITLE}共创伙伴：鹤屿、楠雪${C_RESET}"
printf "%b\n" "${C_GREEN}1. 上号前清理游戏${C_RESET}"
printf "%b\n" "${C_YELLOW}2. 7天/365天/十年专用清理（应用ID＋缓存）${C_RESET}"
printf "%b\n" "${C_GREEN}3. 启动防观察稳进版${C_RESET}"
printf "%b\n" "${C_RED}4. 启动防观察激进版${C_RESET}"
printf "%b\n" "${C_GRAY}0. 退出${C_RESET}"
printf "%b" "${C_WHITE}请选择 [0-4]：${C_RESET}"
FUSION_NEXT_ACTION=""
FUSION_SWITCHING=0
read -r _fusion_choice
case "$_fusion_choice" in
1)
fusion_require_root || { sleep 2; continue; }
fusion_confirm OK || { echo "已取消"; sleep 1; continue; }
nx_initialize
do_clean_ano
printf "\n按回车返回菜单..."; read -r _fusion_dummy
;;
2)
fusion_require_root || { sleep 2; continue; }
fusion_confirm OK || { echo "已取消"; sleep 1; continue; }
nx_initialize
do_ssaid_and_cache_clean
printf "\n按回车返回菜单..."; read -r _fusion_dummy
;;
3)
fusion_require_root || { sleep 2; continue; }
fusion_run_profile stable
;;
4)
fusion_require_root || { sleep 2; continue; }
fusion_confirm OK || { echo "已取消"; sleep 1; continue; }
fusion_run_profile aggressive
;;
0)
FUSION_NEXT_ACTION=""
FUSION_SWITCHING=0
tui_cleanup
;;
*) echo "无效选项"; sleep 1 ;;
esac
done
}
case "$1" in
--web-service=*)
NX_WEB_ENTRY_MODE=1
_nx_entry_backend=${1#*=}
# Override the global terminal cleanup trap before doing any worker work:
# stopping the display process must never invoke interception cleanup.
trap 'exit 0' SIGINT SIGTERM
nx_load_runtime_state || exit 1
nx_web_detach_process $$
nx_web_supervisor "$_nx_entry_backend"
exit 0
;;
--profile=stable)
fusion_run_profile stable
fusion_menu
;;
--profile=aggressive)
fusion_run_profile aggressive
fusion_menu
;;
*) fusion_menu ;;
esac