9f0b0742a8
真机暴露出 IME/按键通道的缺口，一并补上并证明： 1. RemoteInputConnection.sendKeyEvent 与 Activity.onKeyDown 都先处理**可打印** unicodeChar（走 v3 Text 通道），再退到扫描码查表。原先只查表：软键盘发的是 keyCode=UNKNOWN + unicodeChar，查不到表就被当未映射键吞掉，字整个丢了。 门槛排除控制值（Enter/Tab）——远端应用要的是按键事件而非 WM_CHAR。 2. onKeyDown/onKeyUp 补齐硬键与物理键盘路径（阶段 2 验收里的软键盘按键）， repeatCount>0 只发一次 down，避免长按把远端消息队列刷爆。 isAutorepeat() 是 @hide，改用公开的 getRepeatCount()（javap 核实）。 3. getUnicodeChar() 返回的是单个 UTF-16 code unit 而非码点，注释按此改正： BMP 外字符由 IME commitText 成对送达，不经这条路。 tools/phone_chain_proof.ps1：手机按键 -> v3 Text -> agent SendInput -> 自有 Windows 靶窗自报内容，全链路一次跑通（真机 vivo S6 实测 abc 到位、ENTER 走 scan 28、BACK 断开回表单、表单 UI 重连成功）。要点： - 靶窗必须自报窗口句柄（pid+hwnd 两行），Get-Process 取 MainWindowHandle 有竞态； - 不能用 keybd_event(VK_MENU) 破前台锁：ALT 之后的首个字符被当菜单助记键吞掉， 实测三个字符只剩 b；改用 AttachThreadInput + SetForegroundWindow，不合成按键； - 退役遗留靶窗只能 touch 已存在的 stop.flag：新建会命中即将启动那次的停止路径， 靶窗刚起就自杀（实测 pid 报了又消失）； - adb 进度信息走 stderr，PS 5.1 + ErrorActionPreference=Stop 会当终止错误， 按 build-android.ps1 同款办法临时放宽并只看退出码。 - 表单填字用 keyevent 而非 adb input text：设备只有第三方中文 IME，text 注入会被 组词（ASCII 句点变 U+3002）。跑前记录并禁用原 IME，finally 精确还原。
111 lines
4.5 KiB
PowerShell
111 lines
4.5 KiB
PowerShell
# 2b V6/V7 proof target: a dedicated WinForms window we own.
|
|
# ASCII-only source (PS 5.1 decodes BOM-less .ps1 as GBK; see personal lessons).
|
|
#
|
|
# Launched by text_injection_proof.ps1. Shows a topmost empty TextBox, writes
|
|
# its current text to ResultFile (UTF-8 with BOM) on every change, exits when
|
|
# StopFile appears. The proof injects through the remote-control pipeline and
|
|
# polls ResultFile - so "what arrived on the controlled desktop" is reported
|
|
# by the receiving application itself, not by a screenshot or OCR.
|
|
|
|
param(
|
|
[Parameter(Mandatory = $true)][string]$PidFile,
|
|
[Parameter(Mandatory = $true)][string]$ResultFile,
|
|
[Parameter(Mandatory = $true)][string]$StopFile,
|
|
# SendInput lands on whatever is FOREGROUND. When the injector is driven
|
|
# from another machine (phone -> agent -> this desktop), nothing in this
|
|
# process keeps our window on top, so an unrelated window could eat the
|
|
# injection. With this switch the form re-asserts foreground every tick and
|
|
# the caller still asserts foreground before injecting.
|
|
[switch]$GrabForeground
|
|
)
|
|
$ErrorActionPreference = "Stop"
|
|
Add-Type -AssemblyName System.Windows.Forms
|
|
Add-Type -AssemblyName System.Drawing
|
|
|
|
# Event handler scriptblocks resolve script-scoped vars; make that explicit
|
|
# instead of relying on the param locals staying on a visible scope chain.
|
|
$script:PidFile = $PidFile
|
|
$script:ResultFile = $ResultFile
|
|
$script:StopFile = $StopFile
|
|
$script:lastWritten = $null
|
|
|
|
$form = New-Object System.Windows.Forms.Form
|
|
$form.Text = "RemoteTextTarget"
|
|
$form.ClientSize = New-Object System.Drawing.Size(420, 140)
|
|
$form.TopMost = $true
|
|
$form.StartPosition = "Manual"
|
|
$form.Location = New-Object System.Drawing.Point(80, 80)
|
|
|
|
$tb = New-Object System.Windows.Forms.TextBox
|
|
$tb.Multiline = $true
|
|
$tb.Font = New-Object System.Drawing.Font("Segoe UI", 16.0)
|
|
$tb.Dock = "Fill"
|
|
$form.Controls.Add($tb)
|
|
|
|
$script:GrabForeground = $GrabForeground
|
|
if ($script:GrabForeground) {
|
|
Add-Type -TypeDefinition @"
|
|
using System;
|
|
using System.Runtime.InteropServices;
|
|
public static class OwnForeground {
|
|
[DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow();
|
|
[DllImport("user32.dll")] public static extern bool SetForegroundWindow(IntPtr h);
|
|
[DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr h, IntPtr pid);
|
|
[DllImport("kernel32.dll")] public static extern uint GetCurrentThreadId();
|
|
[DllImport("user32.dll")] public static extern bool AttachThreadInput(uint a, uint b, bool f);
|
|
|
|
// Deliberately NO keybd_event(VK_MENU). The usual 'tap ALT to beat the
|
|
// foreground lock' trick corrupts exactly what we measure: after ALT, Windows
|
|
// treats the next character as a menu MNEMONIC, so the first injected
|
|
// character is eaten. Measured 2026-10-30: ALT re-asserting every 60ms turned
|
|
// three injected characters into only 'b' in the target.
|
|
// Attaching input queues is a lock workaround that synthesises no key input.
|
|
public static bool Claim(IntPtr h) {
|
|
uint fgThread = GetWindowThreadProcessId(GetForegroundWindow(), IntPtr.Zero);
|
|
uint myThread = GetCurrentThreadId();
|
|
AttachThreadInput(myThread, fgThread, true);
|
|
bool ok = SetForegroundWindow(h);
|
|
AttachThreadInput(myThread, fgThread, false);
|
|
return ok && GetForegroundWindow() == h;
|
|
}
|
|
public static IntPtr Now() { return GetForegroundWindow(); }
|
|
}
|
|
"@
|
|
}
|
|
|
|
$timer = New-Object System.Windows.Forms.Timer
|
|
$timer.Interval = 150
|
|
$timer.Add_Tick({
|
|
if (Test-Path $script:StopFile) {
|
|
$form.Close()
|
|
return
|
|
}
|
|
if ($script:GrabForeground) {
|
|
# Re-assert only when actually lost (unconditional claiming every tick
|
|
# would fight the user for the desktop outside a proof run).
|
|
if ([OwnForeground]::Now() -ne $form.Handle) {
|
|
[void]$form.Activate()
|
|
[void][OwnForeground]::Claim($form.Handle)
|
|
}
|
|
}
|
|
if ($tb.Text -ne $script:lastWritten) {
|
|
$script:lastWritten = $tb.Text
|
|
$enc = New-Object System.Text.UTF8Encoding($true)
|
|
[System.IO.File]::WriteAllText($script:ResultFile, $tb.Text, $enc)
|
|
}
|
|
if (-not $tb.Focused) { [void]$tb.Focus() }
|
|
})
|
|
|
|
$form.Add_Shown({
|
|
$form.Activate()
|
|
[void]$tb.Focus()
|
|
# Report BOTH pid and window handle: a proof caller resolving the handle via
|
|
# Get-Process races with window creation and can read 0. Handle is stable
|
|
# here because the form is realized by the time Shown fires.
|
|
[System.IO.File]::WriteAllText($script:PidFile, "$PID`n" + $form.Handle.ToInt64())
|
|
})
|
|
|
|
$timer.Start()
|
|
[void]$form.ShowDialog()
|
|
$timer.Stop()
|