139 lines
5.1 KiB
PowerShell
139 lines
5.1 KiB
PowerShell
param(
|
||
[string]$OutputDir = "runs/live-probe-recorder-package",
|
||
[switch]$NoZip
|
||
)
|
||
|
||
$ErrorActionPreference = "Stop"
|
||
|
||
$repo = Resolve-Path -LiteralPath (Join-Path $PSScriptRoot "..")
|
||
$packageDir = Join-Path $repo $OutputDir
|
||
$buildRoot = Join-Path $repo "runs/live-probe-recorder-build"
|
||
$buildX86Dir = Join-Path $repo "runs/live-probe-recorder-build-x86"
|
||
$buildX64Dir = Join-Path $repo "runs/live-probe-recorder-build-x64"
|
||
$helperExe = Join-Path $buildX86Dir "ISphereWinHelper.exe"
|
||
$recorderExe = Join-Path $packageDir "ISphereLiveProbeRecorder.exe"
|
||
$variantsDir = Join-Path $packageDir "variants"
|
||
|
||
if (Test-Path -LiteralPath $packageDir) {
|
||
Remove-Item -LiteralPath $packageDir -Recurse -Force
|
||
}
|
||
if (Test-Path -LiteralPath "$packageDir.zip") {
|
||
Remove-Item -LiteralPath "$packageDir.zip" -Force
|
||
}
|
||
New-Item -ItemType Directory -Force -Path $packageDir | Out-Null
|
||
New-Item -ItemType Directory -Force -Path $variantsDir | Out-Null
|
||
|
||
& powershell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repo "scripts\build-win-helper.ps1") -OutputDir "runs/live-probe-recorder-build-x86" -Platform x86
|
||
if ($LASTEXITCODE -ne 0) {
|
||
throw "build-win-helper.ps1 x86 failed with exit code $LASTEXITCODE"
|
||
}
|
||
|
||
if (-not (Test-Path -LiteralPath $helperExe)) {
|
||
throw "built x86 helper not found: $helperExe"
|
||
}
|
||
|
||
Copy-Item -LiteralPath $helperExe -Destination $recorderExe -Force
|
||
Copy-Item -LiteralPath $helperExe -Destination (Join-Path $variantsDir "ISphereLiveProbeRecorder-x86.exe") -Force
|
||
|
||
& powershell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repo "scripts\build-win-helper.ps1") -OutputDir "runs/live-probe-recorder-build" -Platform anycpu
|
||
if ($LASTEXITCODE -ne 0) {
|
||
throw "build-win-helper.ps1 anycpu failed with exit code $LASTEXITCODE"
|
||
}
|
||
Copy-Item -LiteralPath (Join-Path $buildRoot "ISphereWinHelper.exe") -Destination (Join-Path $variantsDir "ISphereLiveProbeRecorder-anycpu.exe") -Force
|
||
|
||
& powershell -NoProfile -ExecutionPolicy Bypass -File (Join-Path $repo "scripts\build-win-helper.ps1") -OutputDir "runs/live-probe-recorder-build-x64" -Platform x64
|
||
if ($LASTEXITCODE -ne 0) {
|
||
throw "build-win-helper.ps1 x64 failed with exit code $LASTEXITCODE"
|
||
}
|
||
Copy-Item -LiteralPath (Join-Path $buildX64Dir "ISphereWinHelper.exe") -Destination (Join-Path $variantsDir "ISphereLiveProbeRecorder-x64.exe") -Force
|
||
|
||
@"
|
||
ISphereLiveProbeRecorder
|
||
|
||
默认说明：
|
||
- 顶层 ISphereLiveProbeRecorder.exe 是 x86 版，兼容性最好，建议优先用它。
|
||
- variants 目录里保留 anycpu/x86/x64 备用版本。
|
||
- 如果现场遇到 BadImageFormatException，请先确认解压后的 exe 大小和 hash，再运行 variants\ISphereLiveProbeRecorder-x86.exe。
|
||
|
||
使用方式：
|
||
1. 把本目录复制到可以正常登录 iSphere/IMPlatformClient 的电脑。
|
||
2. 先手工打开并登录 iSphere/IMPlatformClient。
|
||
3. 尽量手工打开一个联系人聊天窗口、一个群聊窗口，并让输入框/发送按钮/附件按钮所在区域可见；不用发送任何内容。
|
||
4. 保持客户端窗口打开。
|
||
5. 双击 ISphereLiveProbeRecorder.exe。
|
||
6. 程序会在 probe-output 下生成 isphere-live-probe-时间戳 目录。
|
||
7. 把生成的整个目录压缩后发回。
|
||
|
||
它记录：
|
||
- 目标进程、位数、路径、加载模块；
|
||
- 目标进程命令行摘要；
|
||
- 窗口列表；
|
||
- 目标窗口 UIA 控件树；
|
||
- 安装目录、缓存目录、配置/日志/数据库候选文件元数据；
|
||
- 关键 exe/dll 的版本和 SHA256；
|
||
- 小型配置/日志文件的脱敏文本片段；
|
||
- 注册表卸载项；
|
||
- 相关服务；
|
||
- 相关快捷方式；
|
||
- 目标进程 TCP 连接；
|
||
- 相关命名管道。
|
||
|
||
它不会：
|
||
- 发送消息；
|
||
- 发送/上传文件；
|
||
- 点击或输入；
|
||
- 注入或 hook；
|
||
- 修改客户端文件或数据。
|
||
"@ | Set-Content -LiteralPath (Join-Path $packageDir "README.txt") -Encoding UTF8
|
||
|
||
@"
|
||
@echo off
|
||
setlocal
|
||
cd /d "%~dp0"
|
||
ISphereLiveProbeRecorder.exe
|
||
pause
|
||
"@ | Set-Content -LiteralPath (Join-Path $packageDir "run-recorder.bat") -Encoding ASCII
|
||
|
||
@"
|
||
@echo off
|
||
setlocal
|
||
cd /d "%~dp0"
|
||
variants\ISphereLiveProbeRecorder-x86.exe
|
||
pause
|
||
"@ | Set-Content -LiteralPath (Join-Path $packageDir "run-x86-fallback.bat") -Encoding ASCII
|
||
|
||
@"
|
||
@echo off
|
||
setlocal
|
||
cd /d "%~dp0"
|
||
echo === Windows version ===
|
||
ver
|
||
echo.
|
||
echo === File sizes ===
|
||
dir ISphereLiveProbeRecorder.exe variants\ISphereLiveProbeRecorder-*.exe
|
||
echo.
|
||
echo === .NET Framework v4 runtime ===
|
||
reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
|
||
echo.
|
||
echo === Try top-level recorder ===
|
||
ISphereLiveProbeRecorder.exe --no-pause
|
||
echo exit code: %ERRORLEVEL%
|
||
pause
|
||
"@ | Set-Content -LiteralPath (Join-Path $packageDir "check-and-run.bat") -Encoding ASCII
|
||
|
||
$zipPath = "$packageDir.zip"
|
||
if (-not $NoZip) {
|
||
if (Test-Path -LiteralPath $zipPath) {
|
||
Remove-Item -LiteralPath $zipPath -Force
|
||
}
|
||
Compress-Archive -Path (Join-Path $packageDir "*") -DestinationPath $zipPath -Force
|
||
}
|
||
|
||
[ordered]@{
|
||
ok = $true
|
||
package_dir = (Resolve-Path -LiteralPath $packageDir).Path
|
||
recorder_exe = (Resolve-Path -LiteralPath $recorderExe).Path
|
||
recorder_platform = "x86"
|
||
zip = if (Test-Path -LiteralPath $zipPath) { (Resolve-Path -LiteralPath $zipPath).Path } else { $null }
|
||
} | ConvertTo-Json -Depth 4 -Compress
|