App 加固后崩溃堆栈无法还原：怎样核对 R8 Mapping 与 Retrace 证据链

import hashlib
import json
import subprocess
import sys
from pathlib import Path

REQUIRED = {
    'artifact',
    'mapping',
    'rawStack',
    'artifactSha256',
    'mappingSha256',
    'stackSha256',
    'versionCode',
    'buildId',
    'retraceCommand',
    'output',
}

def stop(message):
    raise SystemExit(message)

def digest(path):
    hasher = hashlib.sha256()
    with path.open('rb') as stream:
        for chunk in iter(lambda: stream.read(1024 * 1024), b''):
            hasher.update(chunk)
    return hasher.hexdigest()

def safe_path(value, field):
    path = Path(str(value)).expanduser().resolve()
    if not path.is_file():
        stop(f'{field} is not a readable file')
    return path

def expected_hash(value, field):
    text = str(value).lower().strip()
    if len(text) != 64 or any(ch not in '0123456789abcdef' for ch in text):
        stop(f'{field} is not a SHA-256 value')
    return text

def verify_file(record, path_field, hash_field):
    path = safe_path(record[path_field], path_field)
    expected = expected_hash(record[hash_field], hash_field)
    actual = digest(path)
    if actual != expected:
        stop(f'{path_field} digest does not match the evidence manifest')
    return path

if len(sys.argv) != 2:
    stop('usage: python retrace_guard.py evidence.json')
manifest_path = Path(sys.argv[1]).expanduser().resolve()
if not manifest_path.is_file():
    stop('evidence manifest is missing')
record = json.loads(manifest_path.read_text(encoding='utf-8'))
missing = sorted(REQUIRED - record.keys())
if missing:
    raise SystemExit(f'evidence manifest lacks fields: {missing}')
if not str(record['versionCode']).isdigit():
    stop('versionCode must be numeric')
if not str(record['buildId']).strip():
    stop('buildId is empty')
artifact = verify_file(record, 'artifact', 'artifactSha256')
mapping = verify_file(record, 'mapping', 'mappingSha256')
raw_stack = verify_file(record, 'rawStack', 'stackSha256')
stack_text = raw_stack.read_text(encoding='utf-8')
if 'Exception' not in stack_text and 'Error' not in stack_text:
    stop('raw stack has no exception or error header')
command = record['retraceCommand']
if not isinstance(command, list) or not command or not all(isinstance(x, str) for x in command):
    stop('retraceCommand must be a non-empty argument array')
output = Path(str(record['output'])).expanduser().resolve()
if output.exists():
    stop('output already exists; choose a new evidence path')
result = subprocess.run(
    [*command, str(mapping), str(raw_stack)],
    check=False,
    capture_output=True,
    text=True,
)
if result.returncode != 0:
    stop(f'Retrace failed with exit code {result.returncode}')
output.write_text(result.stdout, encoding='utf-8')
summary = {
    'artifact': artifact.name,
    'versionCode': str(record['versionCode']),
    'buildId': str(record['buildId']),
    'mappingSha256': digest(mapping),
    'stackSha256': digest(raw_stack),
    'outputSha256': digest(output),
}
print(json.dumps(summary, ensure_ascii=False, sort_keys=True))