struct arm_debug_state64 {
    __uint64_t bvr[16];   // 断点地址
    __uint32_t bcr[16];   // 断点控制
    __uint64_t wvr[16];   // 观察点地址
    __uint32_t wcr[16];   // 观察点控制
    __uint64_t mdscr_el1; // 单步等
};

thread_set_exception_ports(thread, EXC_MASK_BREAKPOINT, exc_port,
        EXCEPTION_STATE_IDENTITY | MACH_EXCEPTION_CODES, ARM_THREAD_STATE64);

// arm64 调试架构常量(参考 lldb DNBArchImplARM64)
#define BCR_ENABLE   (1u << 0)        // E:  使能
#define BCR_PMC_EL0  (0b10u << 1)     // PMC: 在 EL0(用户态)匹配
#define BCR_BAS_ALL  (0b1111u << 5)   // BAS: AArch64 下全 4 字节
#define MDSCR_SS     (1u << 0)        // MDSCR_EL1.SS: 软件单步使能
#define PSTATE_SS    (1u << 21)       // CPSR/PSTATE.SS

static void apply_bps_to_thread(mach_port_t th) {
    arm_debug_state64_t d;
    mach_msg_type_number_t c = ARM_DEBUG_STATE64_COUNT;
    thread_get_state(th, ARM_DEBUG_STATE64, (thread_state_t)&d, &c);
    for (int i = 0; i < MAX_HW_BP; i++) {
        if (g_bps[i].used) {
            d.__bvr[i] = g_bps[i].addr & ~3ULL;            // 4 字节对齐
            d.__bcr[i] = BCR_BAS_ALL | BCR_PMC_EL0 | BCR_ENABLE;
        }
    }
    thread_set_state(th, ARM_DEBUG_STATE64, (thread_state_t)&d, ARM_DEBUG_STATE64_COUNT);
}

#pragma pack(4)
typedef struct {
    mach_msg_header_t          Head;
    mach_msg_body_t            msgh_body;
    mach_msg_port_descriptor_t thread;
    mach_msg_port_descriptor_t task;
    NDR_record_t               NDR;
    exception_type_t           exception;
    mach_msg_type_number_t     codeCnt;
    int64_t                    code[2];
    int                        flavor;
    mach_msg_type_number_t     old_stateCnt;
    natural_t                  old_state[THREAD_STATE_MAX];
} exc_request_t;

typedef struct {
    mach_msg_header_t       Head;
    NDR_record_t           NDR;
    kern_return_t          RetCode;
    int                    flavor;
    mach_msg_type_number_t new_stateCnt;
    natural_t              new_state[THREAD_STATE_MAX];
} exc_reply_t;
#pragma pack()

static void *exc_server_thread(void *arg) {
    for (;;) {
        exc_request_t req; exc_reply_t rep;
        memset(&req, 0, sizeof(req));
        mach_msg(&req.Head, MACH_RCV_MSG, 0, sizeof(req),
                 g_exc_port, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);

        mach_port_t thread = req.thread.name;
        arm_thread_state64_t *st = (arm_thread_state64_t *)req.old_state;
        kern_return_t rc = handle_exception(thread, req.exception, st);

        memset(&rep, 0, sizeof(rep));
        rep.Head.msgh_bits = MACH_MSGH_BITS(MACH_MSGH_BITS_REMOTE(req.Head.msgh_bits), 0);
        rep.Head.msgh_remote_port = req.Head.msgh_remote_port;
        rep.Head.msgh_id = req.Head.msgh_id + 100;   // 2407 -> 2507
        rep.NDR = req.NDR; rep.RetCode = rc; rep.flavor = req.flavor;
        if (rc == KERN_SUCCESS) {
            rep.new_stateCnt = req.old_stateCnt;
            memcpy(rep.new_state, req.old_state, req.old_stateCnt * sizeof(natural_t));
            rep.Head.msgh_size = offsetof(exc_reply_t, new_state)
                               + req.old_stateCnt * sizeof(natural_t);
        } else {
            rep.Head.msgh_size = offsetof(exc_reply_t, flavor);
        }
        mach_msg(&rep.Head, MACH_SEND_MSG, rep.Head.msgh_size, 0,
                 MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, MACH_PORT_NULL);
        mach_port_deallocate(mach_task_self(), req.thread.name);
        mach_port_deallocate(mach_task_self(), req.task.name);
    }
    return NULL;
}

static kern_return_t handle_exception(mach_port_t thread, exception_type_t exc,
                                      arm_thread_state64_t *st) {
    if (exc != EXC_BREAKPOINT) return KERN_FAILURE;

    uint64_t tid = tid_of(thread);
    pthread_mutex_lock(&g_lock);
    step_ctx_t *sc = step_get(tid);

    // 情况 1:这是我们刚才发起的「单步」产生的异常 —— 复原断点,关单步,放行
    if (sc && sc->slot >= 0) {
        arm_debug_state64_t d;
        if (get_dbg(thread, &d) == KERN_SUCCESS) {
            d.__bcr[sc->slot] |= BCR_ENABLE;   // 重新挂上之前禁用的断点
            d.__mdscr_el1     &= ~MDSCR_SS;     // 关单步
            set_dbg(thread, &d);
        }
        st->__cpsr &= ~PSTATE_SS;
        sc->slot = -1; sc->tid = 0;            // 释放槽位
        pthread_mutex_unlock(&g_lock);
        return KERN_SUCCESS;
    }

    // 情况 2:断点命中 —— 找到是哪个槽位
    uint64_t pc = strip_pac((uint64_t)arm_thread_state64_get_pc(*st));
    hb_entry_t *hit = NULL;
    for (int i = 0; i < MAX_HW_BP; i++)
        if (g_bps[i].used && (g_bps[i].addr & ~3ULL) == (pc & ~3ULL)) { hit = &g_bps[i]; break; }
    if (!hit) { pthread_mutex_unlock(&g_lock); return KERN_FAILURE; } // 不是我们的,转发出去

    hb_callback_t cb = hit->cb; void *user = hit->user; int slot = hit->slot;
    pthread_mutex_unlock(&g_lock);

    if (cb) cb(st, user);   // ===== 用户 hook 逻辑 =====

    // 用户改了 PC 就不会再撞断点,直接放行,无需单步
    uint64_t newpc = strip_pac((uint64_t)arm_thread_state64_get_pc(*st));
    if ((newpc & ~3ULL) != (pc & ~3ULL)) return KERN_SUCCESS;

    // PC 没动 —— 必须「踏过去」
    pthread_mutex_lock(&g_lock);
    arm_debug_state64_t d;
    if (get_dbg(thread, &d) == KERN_SUCCESS) {
        d.__bcr[slot] &= ~BCR_ENABLE;
        d.__mdscr_el1 |= MDSCR_SS;
        set_dbg(thread, &d);
    }
    st->__cpsr |= PSTATE_SS;
    step_ctx_t *ns = step_find_or_alloc(tid);
    if (ns) ns->slot = slot;
    pthread_mutex_unlock(&g_lock);
    return KERN_SUCCESS;
}

static uintptr_t image_base_by_suffix(const char *suffix) {
    uint32_t cnt = _dyld_image_count();
    for (uint32_t i = 0; i < cnt; i++) {
        const char *name = _dyld_get_image_name(i);
        size_t nl = strlen(name), sl = strlen(suffix);
        if (nl >= sl && strcmp(name + nl - sl, suffix) == 0)
            return (uintptr_t)_dyld_get_image_header(i);
    }
    return 0;
}

static void dump_mem(const char *tag, uint64_t addr, size_t len) {
    if (!addr) { NSLog(@"  %-8s = (null)", tag); return; }
    if (len == 0) len = 32; if (len > 4096) len = 4096;
    static uint8_t buf[4096]; vm_size_t out = 0;
    kern_return_t kr = vm_read_overwrite(mach_task_self(),
                          (vm_address_t)addr, len, (vm_address_t)buf, &out);
    if (kr != KERN_SUCCESS) {
        NSLog(@"  %-8s @0x%llx 不可读(可能是标量, kr=%d)", tag, (unsigned long long)addr, kr);
        return;
    }
    NSMutableString *h = [NSMutableString string], *a = [NSMutableString string];
    for (vm_size_t i = 0; i < out; i++) {
        [h appendFormat:@"%02x", buf[i]];
        [a appendFormat:@"%c", (buf[i] >= 0x20 && buf[i] < 0x7f) ? buf[i] : '.'];
    }
    NSLog(@"  %-8s @0x%llx (%lu): %@ | %@", tag, (unsigned long long)addr, (unsigned long)out, h, a);
}

static uint64_t tid_of(mach_port_t th) {
    thread_identifier_info_data_t ii;
    mach_msg_type_number_t c = THREAD_IDENTIFIER_INFO_COUNT;
    if (thread_info(th, THREAD_IDENTIFIER_INFO, (thread_info_t)&ii, &c) == KERN_SUCCESS)
        return ii.thread_id;
    return 0;
}

static void *watcher_thread(void *arg) {
    g_watch_tid = tid_of(pthread_mach_thread_np(pthread_self()));
    static uint64_t seen[1024]; static int nseen = 0;
    int tick = 0;
    while (g_watch_run) {
        if (++tick >= 25) { nseen = 0; tick = 0; }   // 每 ~5s 全量重下(兜底)
        thread_act_array_t threads; mach_msg_type_number_t n;
        if (task_threads(mach_task_self(), &threads, &n) == KERN_SUCCESS) {
            uint64_t now[1024]; int nnow = 0;
            pthread_mutex_lock(&g_lock);
            for (unsigned i = 0; i < n; i++) {
                mach_port_t th = threads[i];
                uint64_t tid = tid_of(th);
                if (tid && tid != g_server_tid && tid != g_watch_tid) {
                    if (nnow < 1024) now[nnow++] = tid;
                    bool was = false;
                    for (int k = 0; k < nseen; k++) if (seen[k] == tid) { was = true; break; }
                    step_ctx_t *sc = step_get(tid);
                    if (!was && !(sc && sc->slot >= 0)) apply_bps_to_thread(th);
                }
                mach_port_deallocate(mach_task_self(), th);
            }
            nseen = nnow;
            for (int k = 0; k < nnow; k++) seen[k] = now[k];
            pthread_mutex_unlock(&g_lock);
            vm_deallocate(mach_task_self(), (vm_address_t)threads, n * sizeof(thread_act_t));
        }
        usleep(200 * 1000);
    }
    return NULL;
}