// CDP 运行时取证:监听 console + network,手动广播 goToOssAddress,观察列表请求 const sleep = ms => new Promise(r => setTimeout(r, ms)) ;(async () => { const list = await (await fetch('http://127.0.0.1:9222/json')).json() const page = (list || []).find(t => t.type === 'page' && /index\.html/.test(t.url || '')) if (!page) { console.log('no page'); process.exit(1) } const ws = new WebSocket(page.webSocketDebuggerUrl) await new Promise((res, rej) => { ws.onopen = res; ws.onerror = rej }) let mid = 0 const send = (method, params) => ws.send(JSON.stringify({ id: ++mid, method, params: params || {} })) ws.onmessage = ev => { const m = JSON.parse(ev.data) if (m.method === 'Runtime.consoleAPICalled') { const args = (m.params.args || []).map(a => a.value || a.description || '').join(' ') if (/ossAddressChange|goToOssAddress|listFiles|AccessDenied|Error/i.test(args)) console.log('[console]', args.slice(0, 300)) } if (m.method === 'Network.requestWillBeSent') { const u = m.params.request.url if (/aliyuncs/.test(u)) console.log('[req]', m.params.request.method, u.slice(0, 160)) } if (m.method === 'Network.responseReceived') { const u = m.params.response.url if (/aliyuncs/.test(u)) console.log('[rsp]', m.params.response.status, u.slice(0, 160)) } } send('Runtime.enable') send('Network.enable') await sleep(2000) console.log('--- 手动广播 goToOssAddress ---') send('Runtime.evaluate', { expression: `angular.element(document.querySelector('[ng-app]')).injector().get('$rootScope').$broadcast('goToOssAddress','oss://android-o1-images/trae-files-temp/'); 'ok'` }) await sleep(8000) ws.close() process.exit(0) })()