Release v1.3.7

Feat: Client build dialog support building Android application
Fix: Android client stops service when server sends BYE (delete client)
2026-06-26 15:28:57 +02:00 · 2026-06-25 17:48:45 +02:00 · 2026-06-25 17:38:01 +02:00 · 2026-06-25 17:38:01 +02:00 · 2026-06-24 22:31:14 +02:00 · 2026-06-21 23:00:05 +02:00
40 changed files with 1029 additions and 105 deletions
--- a/ReadMe.md
+++ b/ReadMe.md
@@ -12,7 +12,7 @@
  <a href="https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases">
    <img src="https://img.shields.io/gitea/v/release/yuanyuanxiang/SimpleRemoter?gitea_url=https%3A%2F%2Fgit.simpleremoter.com&style=flat-square&logo=gitea" alt="Gitea Release">
  </a>
-  <img src="https://img.shields.io/badge/client-Windows%20%7C%20Linux%20%7C%20macOS-blue?style=flat-square" alt="Client Platforms">
+  <img src="https://img.shields.io/badge/client-Windows%20%7C%20Linux%20%7C%20macOS%20%7C%20Android-blue?style=flat-square" alt="Client Platforms">
  <img src="https://img.shields.io/badge/server-Windows%20%7C%20Linux%20%7C%20macOS-success?style=flat-square" alt="Server Platforms">
  <img src="https://img.shields.io/badge/language-C%2B%2B17%20%2F%20Go-orange?style=flat-square&logo=cplusplus" alt="Language">
  <img src="https://img.shields.io/badge/license-MIT-green?style=flat-square" alt="License">
@@ -94,6 +94,7 @@
 | **Windows** | ✅ 完整功能 | ✅ MFC `YAMA.exe`（推荐）/ Go |
 | **Linux** (X11) | ✅ 屏幕 + 终端 + 文件 + 剪贴板 | ✅ Go |
 | **macOS** (Intel + Apple Silicon) | ✅ 屏幕 + 终端 + 文件 + 剪贴板 | ✅ Go |
+| **Android** (v1.3.7+) | ✅ 屏幕 + 触控/按键控制 | ❌ 不适用 |

 ---

@@ -206,6 +207,21 @@ Please read and obey the instructions in [SECURITY_AI.md](./docs/SECURITY_AI.md)

 **编译**：`cd linux && cmake . && make`

+### Android 客户端（v1.3.7+）
+
+**系统要求**：Android 5.0 (API 21) 及以上
+
+| 功能 | 状态 | 实现 |
+|---|---|---|
+| 远程桌面 | ✅ | MediaProjection + MediaCodec H.264 硬件编码 |
+| 触控/按键控制 | ✅ | AccessibilityService 注入，支持 D-pad 导航 |
+| 心跳/RTT | ✅ | RFC 6298 RTT 估算 |
+| 设备分组 | ✅ | szGroupName 编译期 patch / 服务端动态修改 |
+
+**生成客户端**：在主控 BuildDlg「生成」→ 选 `ghost - Google Android`，填入服务端 IP / 端口，生成 APK；使用 `android/sign_apk.bat` 重签后安装。
+
+**编译**：在 WSL 或 Linux 中 `cd android && ./build_apk.sh`
+
 ### macOS 客户端（v1.3.2+）

 **系统要求**：
@@ -258,13 +274,13 @@ Please read and obey the instructions in [SECURITY_AI.md](./docs/SECURITY_AI.md)
             │  TCP (自定义二进制协议)   │ TCP (设备) + WS (浏览器)
             └────────┬─────────────────┘
                      │
-       ┌──────────────┼──────────────┐
-       ▼              ▼              ▼
-  ┌─────────┐    ┌─────────┐    ┌─────────┐
-  │ Windows │    │  Linux  │    │  macOS  │
-  │ 客户端  │    │ 客户端  │    │ 客户端  │
-  │ (DXGI)  │    │  (X11)  │    │ (CG)    │
-  └─────────┘    └─────────┘    └─────────┘
+       ┌──────────────┼──────────────┬──────────────┐
+       ▼              ▼              ▼              ▼
+  ┌─────────┐    ┌─────────┐    ┌─────────┐    ┌─────────┐
+  │ Windows │    │  Linux  │    │  macOS  │    │ Android │
+  │ 客户端  │    │ 客户端  │    │ 客户端  │    │ 客户端  │
+  │ (DXGI)  │    │  (X11)  │    │ (CG)    │    │ (MP/MC) │
+  └─────────┘    └─────────┘    └─────────┘    └─────────┘
 ```

 ### 多层授权（简化视图）
@@ -340,6 +356,7 @@ nohup ./server_linux_amd64 --port 6543 --http-port 9001 > yama.log 2>&1 &
 - **C++ 主控 & Windows 客户端**：VS 2019/2022/2026 打开 `SimpleRemoter.sln` → Release | x64
 - **Linux 客户端**：`cd linux && cmake . && make`
 - **macOS 客户端**：`cd macos && ./build.sh`
+- **Android 客户端**：`cd android && ./build_apk.sh`（WSL/Linux）
 - **Go 主控**：`cd server/go && go build ./cmd`

 ---
@@ -361,6 +378,31 @@ nohup ./server_linux_amd64 --port 6543 --http-port 9001 > yama.log 2>&1 &

 ## 更新日志

+### v1.3.7 (2026.6.26)
+
+**Android 客户端 & 窗口捕获增强 & 安全加固**
+
+**新功能：**
+- **Android 客户端**：首个 Android 受控端，支持 Android 5.0+（arm64-v8a / armeabi-v7a），MediaProjection + MediaCodec H.264 推流；AccessibilityService 触控 / 按键注入；D-pad 焦点导航完整控制 TV / 机顶盒
+- **设备分组**：编译期 patch 预设 / 服务端动态修改（`CMD_SET_GROUP`）；分组名持久化至 `filesDir/yama_group`，App 重启后保留
+- **APK 生成与重签**：BuildDlg 新增 `ghost - Google Android`，与 Linux / macOS ghost 流程一致；配套 `sign_apk.bat` 自动检测 SDK 完成重签
+- **服务端删除客户端**：BYE 指令后 Android Service 通过 JNI 正常停止
+- **前台窗口精准捕获**：PrintWindow + 服务端 HWND by clientID 路由，遮挡情况下仍可捕获完整窗口
+- **在线主机右键查看活动窗口**：实时查询目标机器前台窗口标题
+- **TOKEN_AUTH 响应 ECDSA 签名**：V2 私钥签名服务端响应，防伪服务端（`TOKEN_SERVER_VERIFY = 251`）
+- **反破解版本绑定**：版本与核心库绑定，阻断替换 DLL 的破解路径
+- **子授权连接数限制**：`LicenseLimit` 字段 + `CLicenseDlg` 右键菜单实时设置
+
+**改进：**
+- H264 模式跳过首帧 ~8MB 原始巨帧，服务端在首 IDR 帧后解锁画面
+- 自适应尺寸渲染改进，减少尺寸切换抖动
+
+**Bug 修复：**
+- `ARGBToNV12` 奇数尺寸窗口堆溢出（维度钳制到偶数对齐）
+- 连接初始化时多余屏幕重启（客户端 `ScreenManager.cpp` + 服务端 `ScreenSpyDlg.cpp` 双端修复）
+- 启动时内存 DLL 未正确还原
+- 授权客户端键盘日志目录冲突（各实例使用独立目录）
+
 ### v1.3.6 (2026.6.14)

 **ROI 区域捕获 & Web 音频流 & 主界面可用性全面提升**
--- a/ReadMe_EN.md
+++ b/ReadMe_EN.md
@@ -12,7 +12,7 @@
  <a href="https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases">
    <img src="https://img.shields.io/gitea/v/release/yuanyuanxiang/SimpleRemoter?gitea_url=https%3A%2F%2Fgit.simpleremoter.com&style=flat-square&logo=gitea" alt="Gitea Release">
  </a>
-  <img src="https://img.shields.io/badge/client-Windows%20%7C%20Linux%20%7C%20macOS-blue?style=flat-square" alt="Client Platforms">
+  <img src="https://img.shields.io/badge/client-Windows%20%7C%20Linux%20%7C%20macOS%20%7C%20Android-blue?style=flat-square" alt="Client Platforms">
  <img src="https://img.shields.io/badge/server-Windows%20%7C%20Linux%20%7C%20macOS-success?style=flat-square" alt="Server Platforms">
  <img src="https://img.shields.io/badge/language-C%2B%2B17%20%2F%20Go-orange?style=flat-square&logo=cplusplus" alt="Language">
  <img src="https://img.shields.io/badge/license-MIT-green?style=flat-square" alt="License">
@@ -94,6 +94,7 @@ This release (v1.3.4) adds the last missing piece — the **Go master**: a **del
 | **Windows** | ✅ All features | ✅ MFC `YAMA.exe` (recommended) / Go |
 | **Linux** (X11) | ✅ Screen + terminal + files + clipboard | ✅ Go |
 | **macOS** (Intel + Apple Silicon) | ✅ Screen + terminal + files + clipboard | ✅ Go |
+| **Android** (v1.3.7+) | ✅ Screen + touch/key injection | ❌ N/A |

 ---

@@ -206,6 +207,21 @@ Unless an offline license has been obtained, the master program exchanges necess

 **Build**: `cd linux && cmake . && make`

+### Android Client (v1.3.7+)
+
+**Requirements**: Android 5.0 (API 21) or later
+
+| Feature | Status | Implementation |
+|---|---|---|
+| Remote desktop | ✅ | MediaProjection + MediaCodec H.264 hardware encoding |
+| Touch / key injection | ✅ | AccessibilityService, supports D-pad TV navigation |
+| Heartbeat / RTT | ✅ | RFC 6298 RTT estimation |
+| Device grouping | ✅ | Build-time patch or server-side `CMD_SET_GROUP`; persisted across restarts |
+
+**Generate client**: In the master BuildDlg *Build* dialog, select `ghost - Google Android`, enter the server IP / port, and the APK is generated. Re-sign with `android/sign_apk.bat` before installing.
+
+**Build**: in WSL or Linux — `cd android && ./build_apk.sh`
+
 ### macOS Client (v1.3.2+)

 **Requirements**:
@@ -258,13 +274,13 @@ Unless an offline license has been obtained, the master program exchanges necess
             │ TCP (custom binary proto)│ TCP (devices) + WS (browsers)
             └────────┬─────────────────┘
                      │
-       ┌──────────────┼──────────────┐
-       ▼              ▼              ▼
-  ┌─────────┐    ┌─────────┐    ┌─────────┐
-  │ Windows │    │  Linux  │    │  macOS  │
-  │ client  │    │ client  │    │ client  │
-  │ (DXGI)  │    │  (X11)  │    │ (CG)    │
-  └─────────┘    └─────────┘    └─────────┘
+       ┌──────────────┼──────────────┬──────────────┐
+       ▼              ▼              ▼              ▼
+  ┌─────────┐    ┌─────────┐    ┌─────────┐    ┌─────────┐
+  │ Windows │    │  Linux  │    │  macOS  │    │ Android │
+  │ client  │    │ client  │    │ client  │    │ client  │
+  │ (DXGI)  │    │  (X11)  │    │ (CG)    │    │ (MP/MC) │
+  └─────────┘    └─────────┘    └─────────┘    └─────────┘
 ```

 ### Multi-Layer Authorization (simplified view)
@@ -340,6 +356,7 @@ Valid     : 2026-02-01 to 2028-02-01
 - **C++ master & Windows client**: open `SimpleRemoter.sln` in VS 2019 / 2022 / 2026 → Release | x64
 - **Linux client**: `cd linux && cmake . && make`
 - **macOS client**: `cd macos && ./build.sh`
+- **Android client**: `cd android && ./build_apk.sh` (WSL / Linux)
 - **Go master**: `cd server/go && go build ./cmd`

 ---
@@ -361,6 +378,31 @@ Valid     : 2026-02-01 to 2028-02-01

 ## Changelog

+### v1.3.7 (2026.6.26)
+
+**Android Client & Window Capture & Security Hardening**
+
+**New features:**
+- **Android client**: first Android controlled-side client, Android 5.0+ (arm64-v8a / armeabi-v7a); MediaProjection + MediaCodec H.264 streaming; AccessibilityService touch / key injection; D-pad focus navigation for full TV / set-top-box control
+- **Device grouping**: group name embedded at build time via APK binary patch or changed live by the server (`CMD_SET_GROUP`); persisted to `filesDir/yama_group`, survives app restarts
+- **APK build & re-sign**: BuildDlg adds `ghost - Google Android`, same workflow as Linux / macOS ghost; `sign_apk.bat` auto-detects SDK and re-signs
+- **Clean exit on server delete**: BYE command triggers JNI `onNativeExit()` → `stopSelf()`
+- **Foreground window capture**: PrintWindow + server-side HWND routing by clientID, captures the target window even when occluded
+- **View active window from host list**: right-click menu queries and shows the foreground window title of the target machine in real time
+- **TOKEN_AUTH ECDSA signature**: server signs auth responses with its V2 P-256 key to prevent fake-server attacks (`TOKEN_SERVER_VERIFY = 251`)
+- **Anti-cracking version binding**: binary binds to core lib version; mismatched DLL replacement is rejected at load time
+- **Sub-license connection cap**: `LicenseLimit` field in `licenses.ini` + real-time set / clear from `CLicenseDlg` right-click menu
+
+**Improvements:**
+- H264 mode skips the initial ~8 MB raw first-frame; server unlocks display on the first IDR instead
+- Adaptive-size rendering improvements, fewer dimension-change artifacts
+
+**Bug fixes:**
+- `ARGBToNV12` heap overflow on odd-sized windows (clamp dims to even-aligned width/height)
+- Extra screen restarts on connection init (dual fix: client `ScreenManager.cpp` + server `ScreenSpyDlg.cpp`)
+- Memory DLL not restored on client startup
+- Authorization client keyboard log directory conflict (each instance gets its own directory)
+
 ### v1.3.6 (2026.6.14)

 **ROI region capture & Web audio streaming & master-UI usability overhaul**
--- a/ReadMe_TW.md
+++ b/ReadMe_TW.md
@@ -12,7 +12,7 @@
  <a href="https://git.simpleremoter.com/yuanyuanxiang/SimpleRemoter/releases">
    <img src="https://img.shields.io/gitea/v/release/yuanyuanxiang/SimpleRemoter?gitea_url=https%3A%2F%2Fgit.simpleremoter.com&style=flat-square&logo=gitea" alt="Gitea Release">
  </a>
-  <img src="https://img.shields.io/badge/client-Windows%20%7C%20Linux%20%7C%20macOS-blue?style=flat-square" alt="Client Platforms">
+  <img src="https://img.shields.io/badge/client-Windows%20%7C%20Linux%20%7C%20macOS%20%7C%20Android-blue?style=flat-square" alt="Client Platforms">
  <img src="https://img.shields.io/badge/server-Windows%20%7C%20Linux%20%7C%20macOS-success?style=flat-square" alt="Server Platforms">
  <img src="https://img.shields.io/badge/language-C%2B%2B17%20%2F%20Go-orange?style=flat-square&logo=cplusplus" alt="Language">
  <img src="https://img.shields.io/badge/license-MIT-green?style=flat-square" alt="License">
@@ -94,6 +94,7 @@
 | **Windows** | ✅ 完整功能 | ✅ MFC `YAMA.exe`（推薦）/ Go |
 | **Linux** (X11) | ✅ 螢幕 + 終端 + 檔案 + 剪貼簿 | ✅ Go |
 | **macOS** (Intel + Apple Silicon) | ✅ 螢幕 + 終端 + 檔案 + 剪貼簿 | ✅ Go |
+| **Android** (v1.3.7+) | ✅ 螢幕 + 觸控/按鍵注入 | ❌ 不適用 |

 ---

@@ -206,6 +207,21 @@ Please read and obey the instructions in [SECURITY_AI.md](./docs/SECURITY_AI.md)

 **編譯**：`cd linux && cmake . && make`

+### Android 用戶端（v1.3.7+）
+
+**系統需求**：Android 5.0 (API 21) 及以上
+
+| 功能 | 狀態 | 實作 |
+|---|---|---|
+| 遠端桌面 | ✅ | MediaProjection + MediaCodec H.264 硬體編碼 |
+| 觸控 / 按鍵注入 | ✅ | AccessibilityService，支援 D-pad TV 導航 |
+| 心跳 / RTT | ✅ | RFC 6298 RTT 估算 |
+| 裝置分組 | ✅ | 編譯期 patch 或服務端 `CMD_SET_GROUP` 動態修改；重啟後仍保留 |
+
+**產生用戶端**：在主控 BuildDlg「產生」選 `ghost - Google Android`，填入伺服端 IP / 埠，生成 APK；使用 `android/sign_apk.bat` 重簽後安裝。
+
+**編譯**：在 WSL 或 Linux 中 `cd android && ./build_apk.sh`
+
 ### macOS 用戶端（v1.3.2+）

 **系統需求**：
@@ -258,13 +274,13 @@ Please read and obey the instructions in [SECURITY_AI.md](./docs/SECURITY_AI.md)
             │  TCP (自訂二進位協定)     │ TCP (裝置) + WS (瀏覽器)
             └────────┬─────────────────┘
                      │
-       ┌──────────────┼──────────────┐
-       ▼              ▼              ▼
-  ┌─────────┐    ┌─────────┐    ┌─────────┐
-  │ Windows │    │  Linux  │    │  macOS  │
-  │ 用戶端  │    │ 用戶端  │    │ 用戶端  │
-  │ (DXGI)  │    │  (X11)  │    │ (CG)    │
-  └─────────┘    └─────────┘    └─────────┘
+       ┌──────────────┼──────────────┬──────────────┐
+       ▼              ▼              ▼              ▼
+  ┌─────────┐    ┌─────────┐    ┌─────────┐    ┌─────────┐
+  │ Windows │    │  Linux  │    │  macOS  │    │ Android │
+  │ 用戶端  │    │ 用戶端  │    │ 用戶端  │    │ 用戶端  │
+  │ (DXGI)  │    │  (X11)  │    │ (CG)    │    │ (MP/MC) │
+  └─────────┘    └─────────┘    └─────────┘    └─────────┘
 ```

 ### 多層授權（簡化視圖）
@@ -340,6 +356,7 @@ nohup ./server_linux_amd64 --port 6543 --http-port 9001 > yama.log 2>&1 &
 - **C++ 主控 & Windows 用戶端**：VS 2019/2022/2026 開啟 `SimpleRemoter.sln` → Release | x64
 - **Linux 用戶端**：`cd linux && cmake . && make`
 - **macOS 用戶端**：`cd macos && ./build.sh`
+- **Android 用戶端**：`cd android && ./build_apk.sh`（WSL/Linux）
 - **Go 主控**：`cd server/go && go build ./cmd`

 ---
@@ -361,6 +378,31 @@ nohup ./server_linux_amd64 --port 6543 --http-port 9001 > yama.log 2>&1 &

 ## 更新日誌

+### v1.3.7 (2026.6.26)
+
+**Android 用戶端 & 視窗擷取增強 & 安全加固**
+
+**新功能：**
+- **Android 用戶端**：首個 Android 受控端，支援 Android 5.0+（arm64-v8a / armeabi-v7a）；MediaProjection + MediaCodec H.264 推流；AccessibilityService 觸控 / 按鍵注入；D-pad 焦點導航完整控制 TV / 機上盒
+- **裝置分組**：編譯期 patch 預設 / 伺服端動態修改（`CMD_SET_GROUP`）；分組名持久化至 `filesDir/yama_group`，App 重啟後保留
+- **APK 產生與重簽**：BuildDlg 新增 `ghost - Google Android`，與 Linux / macOS ghost 流程一致；配套 `sign_apk.bat` 自動偵測 SDK 完成重簽
+- **伺服端刪除用戶端**：BYE 指令後 Android Service 透過 JNI 正常停止
+- **前台視窗精準擷取**：PrintWindow + 伺服端 HWND by clientID 路由，遮蓋情況下仍可擷取完整視窗
+- **線上主機右鍵查看活動視窗**：即時查詢目標機器前台視窗標題
+- **TOKEN_AUTH 回應 ECDSA 簽章**：V2 私鑰簽名伺服端回應，防偽造伺服端（`TOKEN_SERVER_VERIFY = 251`）
+- **反破解版本綁定**：版本與核心函式庫綁定，阻斷替換 DLL 的破解路徑
+- **子授權連線數限制**：`LicenseLimit` 欄位 + `CLicenseDlg` 右鍵選單即時設定
+
+**改進：**
+- H264 模式跳過首幀 ~8MB 原始巨幀，伺服端在首 IDR 幀後解鎖畫面
+- 自適應尺寸渲染改進，減少尺寸切換閃爍
+
+**Bug 修復：**
+- `ARGBToNV12` 奇數尺寸視窗堆積溢位（維度鉗制到偶數對齊）
+- 連線初始化時多餘螢幕重啟（用戶端 `ScreenManager.cpp` + 伺服端 `ScreenSpyDlg.cpp` 雙端修復）
+- 啟動時記憶體 DLL 未正確還原
+- 授權用戶端鍵盤日誌目錄衝突（各實例使用獨立目錄）
+
 ### v1.3.6 (2026.6.14)

 **ROI 區域擷取 & Web 音訊串流 & 主控介面可用性全面提升**
--- a/android/app/build.gradle
+++ b/android/app/build.gradle
@@ -3,6 +3,9 @@ plugins {
    id 'org.jetbrains.kotlin.android'
 }

+// 模拟器调试时传 -PincludeEmulatorAbis=true；build_apk.sh 发布时强制传 false
+def INCLUDE_EMULATOR_ABIS = project.findProperty('includeEmulatorAbis')?.toBoolean() ?: false
+
 android {
    namespace 'com.yama.client'
    compileSdk 35
@@ -16,7 +19,11 @@ android {
        versionName "1.0"

        ndk {
-            abiFilters 'arm64-v8a', 'armeabi-v7a'
+            if (INCLUDE_EMULATOR_ABIS) {
+                abiFilters 'arm64-v8a', 'armeabi-v7a', 'x86', 'x86_64'
+            } else {
+                abiFilters 'arm64-v8a', 'armeabi-v7a'
+            }
        }

        externalNativeBuild {
@@ -53,6 +60,13 @@ android {
        }
    }

+    packagingOptions {
+        jniLibs {
+            // .so 文件不压缩（ZIP_STORED），使服务端 patch 工具可直接在 APK 中搜索 FLAG_GHOST
+            useLegacyPackaging false
+        }
+    }
+
    compileOptions {
        sourceCompatibility JavaVersion.VERSION_17
        targetCompatibility JavaVersion.VERSION_17
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -8,6 +8,7 @@

    <application
        android:allowBackup="false"
+        android:extractNativeLibs="false"
        android:icon="@mipmap/ic_launcher"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:label="YAMA"
--- a/android/app/src/main/cpp/CMakeLists.txt
+++ b/android/app/src/main/cpp/CMakeLists.txt
@@ -24,6 +24,7 @@ set(CORE_SOURCES
    ${YAMA_ROOT}/client/Buffer.cpp
    ${YAMA_ROOT}/client/IOCPClient.cpp
    ${YAMA_ROOT}/client/sign_shim_unix.cpp
+    ${YAMA_ROOT}/common/logger.cpp
    ${YAMA_ROOT}/common/ikcp.c
 )

@@ -34,12 +35,11 @@ set(ANDROID_SOURCES

 add_library(yama SHARED ${CORE_SOURCES} ${ANDROID_SOURCES})

-# ---- 预编译静态库（由 SimplePlugins/sign_lib/build_android.sh 产出）----
+# ---- 预编译静态库（由 android/build_android_libs.ps1 产出）----
+# 支持 arm64-v8a / armeabi-v7a（真机）和 x86 / x86_64（Android 模拟器）
 target_link_libraries(yama PRIVATE
    "${CMAKE_CURRENT_SOURCE_DIR}/lib/${ANDROID_ABI}/libsign.a"
 )
-
-# ---- zstd（由 android/build_zstd_android.sh 产出）----
 target_link_libraries(yama PRIVATE
    "${CMAKE_CURRENT_SOURCE_DIR}/lib/${ANDROID_ABI}/libzstd.a"
 )
--- a/android/app/src/main/cpp/lib/x86/libsign.a
+++ b/android/app/src/main/cpp/lib/x86/libsign.a
--- a/android/app/src/main/cpp/lib/x86/libzstd.a
+++ b/android/app/src/main/cpp/lib/x86/libzstd.a
--- a/android/app/src/main/cpp/lib/x86_64/libsign.a
+++ b/android/app/src/main/cpp/lib/x86_64/libsign.a
--- a/android/app/src/main/cpp/lib/x86_64/libzstd.a
+++ b/android/app/src/main/cpp/lib/x86_64/libzstd.a
--- a/android/app/src/main/cpp/main.cpp
+++ b/android/app/src/main/cpp/main.cpp
@@ -1,6 +1,7 @@
 #include <jni.h>
 #include <android/log.h>
 #include <thread>
+#include <chrono>
 #include <atomic>
 #include <mutex>
 #include <set>
@@ -9,7 +10,9 @@
 #include <cinttypes>
 #include <cstdio>
 #include <unistd.h>
+#include <fcntl.h>
 #include <sys/stat.h>
+#include <sys/select.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <netdb.h>
@@ -22,13 +25,18 @@
 #include "ScreenHandler.h"
 #define XXH_INLINE_ALL
 #include "common/xxhash.h"
+#include "common/logger.h"

 #define LOG_TAG "YAMA"
-#undef Mprintf
-#define Mprintf(...) __android_log_print(ANDROID_LOG_DEBUG, LOG_TAG, __VA_ARGS__)
 #define LOGI(...) __android_log_print(ANDROID_LOG_INFO,  LOG_TAG, __VA_ARGS__)
 #define LOGE(...) __android_log_print(ANDROID_LOG_ERROR, LOG_TAG, __VA_ARGS__)

+// 1 = 状态提示显示到电视屏幕；0 = 只写 logcat，不显示到屏幕
+#define SCREEN_STATUS_ENABLED 0
+
+extern "C" int signMessage_c(const char* pk, int pkLen, const unsigned char* msg,
+                             int msgLen, char* buf, int bufSize);
+
 // ---- 设备信息 helper（登录时填充，仅调用一次）----

 static int GetCpuCores() {
@@ -109,23 +117,31 @@ static std::string JsonGetStr(const std::string& json, const char* key) {

 // 查询 ip-api.com，一次请求同时获取公网 IP 和地理位置（与 Windows 客户端同源）
 // 在连接线程中同步调用，超时 3 秒
-static bool FetchGeoInfo(std::string& pubIp, std::string& location) {
-    pubIp.clear(); location.clear();
+struct GeoResult {
+    std::string pubIp, location;
+    std::atomic<bool> ready{false};
+};

+static void FetchGeoInfoImpl(std::shared_ptr<GeoResult> out) {
    struct addrinfo hints = {}, *res = nullptr;
    hints.ai_family   = AF_INET;
    hints.ai_socktype = SOCK_STREAM;
-    if (getaddrinfo("ip-api.com", "80", &hints, &res) != 0 || !res) return false;
-
+    if (getaddrinfo("ip-api.com", "80", &hints, &res) != 0 || !res) {
+        out->ready.store(true, std::memory_order_release); return;
+    }
    int fd = ::socket(AF_INET, SOCK_STREAM, 0);
-    if (fd < 0) { freeaddrinfo(res); return false; }
+    if (fd < 0) { freeaddrinfo(res); out->ready.store(true, std::memory_order_release); return; }

    struct timeval tv = {3, 0};
    setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
    setsockopt(fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv));
+    fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK);
+    connect(fd, res->ai_addr, res->ai_addrlen);
+    fd_set wfds; FD_ZERO(&wfds); FD_SET(fd, &wfds);
+    bool connected = (select(fd + 1, nullptr, &wfds, nullptr, &tv) == 1);
+    fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) & ~O_NONBLOCK);

-    bool ok = false;
-    if (connect(fd, res->ai_addr, res->ai_addrlen) == 0) {
+    if (connected) {
        const char* req = "GET /json/?fields=status,query,country,city HTTP/1.0\r\n"
                          "Host: ip-api.com\r\n"
                          "Connection: close\r\n\r\n";
@@ -140,21 +156,37 @@ static bool FetchGeoInfo(std::string& pubIp, std::string& location) {
        if (sep != std::string::npos) {
            const std::string body = resp.substr(sep + 4);
            if (JsonGetStr(body, "status") == "success") {
-                pubIp           = JsonGetStr(body, "query");
+                out->pubIp        = JsonGetStr(body, "query");
                std::string city    = JsonGetStr(body, "city");
                std::string country = JsonGetStr(body, "country");
-                if (!city.empty() && !country.empty())  location = city + ", " + country;
-                else if (!country.empty())              location = country;
-                else if (!city.empty())                 location = city;
-                ok = true;
+                if (!city.empty() && !country.empty())  out->location = city + ", " + country;
+                else if (!country.empty())              out->location = country;
+                else if (!city.empty())                 out->location = city;
            }
        }
    }
    close(fd);
    freeaddrinfo(res);
-    return ok;
+    out->ready.store(true, std::memory_order_release);
 }

+// getaddrinfo 在某些设备上会永久阻塞，用独立线程 + 5 秒轮询超时保护 ConnectionThread
+static bool FetchGeoInfo(std::string& pubIp, std::string& location) {
+    pubIp.clear(); location.clear();
+    auto result = std::make_shared<GeoResult>();
+    std::thread(FetchGeoInfoImpl, result).detach();
+    for (int i = 0; i < 50 && !result->ready.load(std::memory_order_acquire); i++)
+        usleep(100000);  // 100ms × 50 = 5 秒
+    if (!result->ready.load(std::memory_order_acquire)) return false;
+    pubIp    = result->pubIp;
+    location = result->location;
+    return !pubIp.empty();
+}
+
+// 服务端通过 FLAG_GHOST（"Hello, World!"）定位此变量，patch szServerIP/szPort 后重签 APK
+// 偏移：szServerIP at +32, szPort at +132（见 commands.h CONNECT_ADDRESS 定义）
+CONNECT_ADDRESS g_SETTINGS = { FLAG_GHOST, "91.99.165.207", "443", CLIENT_TYPE_ANDROID };
+
 // ---- 全局状态 ----
 // CPP-06: g_bExit 是全局变量，跨调用边界不会被编译器缓存进寄存器；
 // IOCPClient 构造接受 const State& 持有引用，不能改为 atomic/volatile，
@@ -173,6 +205,8 @@ static jmethodID  g_getActiveWindowMid = nullptr;
 static jclass     g_captureClass        = nullptr;
 static jmethodID  g_requestIdrMid       = nullptr;
 static jmethodID  g_forceFirstFrameMid  = nullptr;
+static jmethodID  g_statusMid           = nullptr;  // CaptureService.onNativeStatus(String)
+static jmethodID  g_nativeExitMid       = nullptr;  // CaptureService.onNativeExit() — 服务端主动断开时停止服务

 // 心跳日志限流：每 60 秒最多打一次
 static std::atomic<uint64_t> g_lastHbLogMs{0};
@@ -241,6 +275,35 @@ static std::string g_androidVersion;
 static std::string g_screenRes;
 static std::string g_username;
 static std::string g_apkPath;
+static std::string g_filesDir;   // context.filesDir，无需权限，用于持久化分组名
+
+static void SaveGroupName() {
+    if (g_filesDir.empty()) return;
+    std::string path = g_filesDir + "/yama_group";
+    FILE* f = fopen(path.c_str(), "w");
+    if (!f) { LOGI("SaveGroupName: cannot open %s", path.c_str()); return; }
+    fputs(g_SETTINGS.szGroupName, f);
+    fclose(f);
+    LOGI("Group saved: %s", g_SETTINGS.szGroupName);
+}
+
+static void LoadGroupName() {
+    if (g_filesDir.empty()) return;
+    std::string path = g_filesDir + "/yama_group";
+    FILE* f = fopen(path.c_str(), "r");
+    if (!f) return;
+    char buf[24] = {};
+    if (fgets(buf, sizeof(buf), f)) {
+        size_t len = strlen(buf);
+        while (len > 0 && (buf[len - 1] == '\n' || buf[len - 1] == '\r')) buf[--len] = '\0';
+        if (len > 0) {
+            memset(g_SETTINGS.szGroupName, 0, sizeof(g_SETTINGS.szGroupName));
+            strncpy(g_SETTINGS.szGroupName, buf, sizeof(g_SETTINGS.szGroupName) - 1);
+            LOGI("Group loaded from file: %s", buf);
+        }
+    }
+    fclose(f);
+}

 // 屏幕尺寸（Java 侧 MediaCodec 配置后通过 nativeSetScreenSize 设置）
 // 初始化为 0；ScreenSpyThread 等到非零后再读，避免在 nativeSetScreenSize 之前
@@ -277,6 +340,29 @@ static void RequestIdrFromJava()      { CallCaptureStaticVoid(g_requestIdrMid);
 // 强制 VirtualDisplay 推一帧（静止屏幕绕过 SurfaceFlinger 空闲优化）
 static void ForceFirstFrameFromJava() { CallCaptureStaticVoid(g_forceFirstFrameMid); }

+// 向 CaptureService.onNativeStatus() 发送状态 Toast（连接线程诊断用）
+static void PostStatus(const char* msg) {
+    LOGI("STATUS: %s", msg);
+#if SCREEN_STATUS_ENABLED
+    if (!g_jvm || !g_captureClass || !g_statusMid) return;
+    JNIEnv* jenv = nullptr;
+    bool attached = false;
+    if (g_jvm->GetEnv((void**)&jenv, JNI_VERSION_1_6) == JNI_EDETACHED) {
+        g_jvm->AttachCurrentThread(&jenv, nullptr);
+        attached = true;
+    }
+    if (jenv) {
+        jstring js = jenv->NewStringUTF(msg);
+        if (js) {
+            jenv->CallStaticVoidMethod(g_captureClass, g_statusMid, js);
+            jenv->DeleteLocalRef(js);
+        }
+        if (jenv->ExceptionOccurred()) jenv->ExceptionClear();
+    }
+    if (attached) g_jvm->DetachCurrentThread();
+#endif
+}
+
 static void ScreenSpyThread()
 {
    // 等待 Java 侧 startCapture() 调用 nativeSetScreenSize 设置真实分辨率。
@@ -299,32 +385,36 @@ static void ScreenSpyThread()
        std::unique_ptr<IOCPClient>           client;
        std::unique_ptr<AndroidScreenHandler> handler;
        try {
+            LOGI("SST[%d]: creating IOCPClient", attempt);
            client = std::make_unique<IOCPClient>(g_bExit, true);
            client->EnableSubConnAuth(true, g_myClientID);

+            LOGI("SST[%d]: connecting %s:%d", attempt, g_serverIp.c_str(), g_serverPort);
            if (!client->ConnectServer(g_serverIp.c_str(), g_serverPort)) {
                LOGI("ScreenSpyThread: connect failed (attempt %d/20), retry 2s", attempt);
                Sleep(2000);
                continue;
            }
+            LOGI("SST[%d]: connected, creating handler w=%d h=%d", attempt, w, h);

            handler = std::make_unique<AndroidScreenHandler>(client.get(), w, h);
+            LOGI("SST[%d]: handler created, inserting to set", attempt);
            {
                std::lock_guard<std::mutex> lk(g_shMutex);
                g_screenHandlers.insert(handler.get());
            }

+            LOGI("SST[%d]: setManagerCallBack", attempt);
            client->setManagerCallBack(handler.get(),
                                       IOCPManager::DataProcess,
                                       IOCPManager::ReconnectProcess);
+            LOGI("SST[%d]: SendBitmapInfo", attempt);
            handler->SendBitmapInfo();
-            // 子连接刚建立，浏览器 initDecoder 完成后需要关键帧才能开始显示。
-            // ForceFirstFrameFromJava：短暂 resize VirtualDisplay 强制 SurfaceFlinger
-            // 推一帧给编码器——静止屏幕时 SurfaceFlinger 有空闲优化不主动推帧，
-            // 导致 REQUEST_SYNC_FRAME 排队等待，造成 10-60 秒黑屏。
-            // RequestIdrFromJava 确保此帧被编码为 IDR。
+            LOGI("SST[%d]: ForceFirstFrame", attempt);
            ForceFirstFrameFromJava();
+            LOGI("SST[%d]: RequestIdr", attempt);
            RequestIdrFromJava();
+            LOGI("SST[%d]: entering wait loop", attempt);

            while (client->IsRunning() && client->IsConnected() && S_CLIENT_NORMAL == g_bExit)
                Sleep(200);
@@ -354,24 +444,28 @@ static void ScreenSpyThread()
 int DataProcess(void* /*user*/, PBYTE szBuffer, ULONG ulLength)
 {
    if (!szBuffer || !ulLength) return TRUE;
-
-    if (!ClientAuth::IsCommandAllowed(szBuffer[0]))
+    int allowed = (int)ClientAuth::IsCommandAllowed(szBuffer[0]);
+    if (!allowed) {
+        LOGI("DataProcess cmd=%d len=%lu allowed=%d",
+             (int)(unsigned char)szBuffer[0], (unsigned long)ulLength, allowed);
        return TRUE;
+    }

    switch (szBuffer[0]) {
    case COMMAND_BYE:
-        LOGI("COMMAND_BYE");
+        PostStatus("BYE from server");
        g_bExit = S_CLIENT_EXIT;
        break;

    case CMD_HEARTBEAT_ACK:
        if (ulLength >= 1 + (ULONG)sizeof(HeartbeatACK)) {
-            HeartbeatACK* ack = (HeartbeatACK*)(szBuffer + 1);
+            HeartbeatACK ack;
+            memcpy(&ack, szBuffer + 1, sizeof(HeartbeatACK));
            uint64_t now = GetUnixMs();
            g_lastHeartbeatAckMs.store(now, std::memory_order_relaxed);
-            int64_t rtt = (int64_t)now - (int64_t)ack->Time;
-            if (ack->ProcessingMs > 0 && (int64_t)ack->ProcessingMs < rtt)
-                rtt -= ack->ProcessingMs;
+            int64_t rtt = (int64_t)now - (int64_t)ack.Time;
+            if (ack.ProcessingMs > 0 && (int64_t)ack.ProcessingMs < rtt)
+                rtt -= ack.ProcessingMs;
            g_rttEstimator.update_from_sample((double)rtt);
            if (now - g_lastHbLogMs.load(std::memory_order_relaxed) >= HB_LOG_INTERVAL_MS) {
                g_lastHbLogMs.store(now, std::memory_order_relaxed);
@@ -386,6 +480,9 @@ int DataProcess(void* /*user*/, PBYTE szBuffer, ULONG ulLength)
            if (settings.ReportInterval > 0)
                g_heartbeatInterval = std::max(settings.ReportInterval, 30);
            LOGI("MasterSettings OK interval=%ds (server=%d)", g_heartbeatInterval, settings.ReportInterval);
+            PostStatus("masterSettings: OK");
+        } else {
+            PostStatus("masterSettings: FAIL");
        }
        break;
    }
@@ -394,7 +491,8 @@ int DataProcess(void* /*user*/, PBYTE szBuffer, ULONG ulLength)
        // 每个 COMMAND_SCREEN_SPY 对应一个独立子连接，支持多人同时观看/控制
        size_t active;
        { std::lock_guard<std::mutex> lk(g_shMutex); active = g_screenHandlers.size(); }
-        LOGI("COMMAND_SCREEN_SPY → ScreenSpyThread (active=%zu)", active);
+        LOGI("cmd: COMMAND_SCREEN_SPY len=%lu active=%zu w=%d h=%d",
+             (unsigned long)ulLength, active, g_screenWidth.load(), g_screenHeight.load());
        std::thread(ScreenSpyThread).detach();
        break;
    }
@@ -412,6 +510,23 @@ int DataProcess(void* /*user*/, PBYTE szBuffer, ULONG ulLength)
        break;
    }

+    case CMD_SET_GROUP: {
+        std::string grp;
+        if (ulLength > 1) {
+            grp.assign((const char*)szBuffer + 1, ulLength - 1);
+            auto z = grp.find('\0');
+            if (z != std::string::npos) grp.resize(z);
+        }
+        {
+            std::lock_guard<std::mutex> lk(g_shMutex);
+            memset(g_SETTINGS.szGroupName, 0, sizeof(g_SETTINGS.szGroupName));
+            strncpy(g_SETTINGS.szGroupName, grp.c_str(), sizeof(g_SETTINGS.szGroupName) - 1);
+        }
+        SaveGroupName();
+        LOGI("Group changed to: %s", grp.c_str());
+        break;
+    }
+
    case COMMAND_SHELL:
        LOGI("COMMAND_SHELL (not implemented)");
        break;
@@ -421,7 +536,7 @@ int DataProcess(void* /*user*/, PBYTE szBuffer, ULONG ulLength)
        break;

    default:
-        LOGI("Unhandled cmd=%d", (int)szBuffer[0]);
+        LOGI("cmd: unhandled cmd=%d len=%lu", (int)szBuffer[0], (unsigned long)ulLength);
        break;
    }
    return TRUE;
@@ -432,14 +547,17 @@ static void ConnectionThread()
 {
    LOGI("ConnectionThread → %s:%d", g_serverIp.c_str(), g_serverPort);

+    PostStatus("geo: fetching...");
    std::string g_pubIp, g_location;
    FetchGeoInfo(g_pubIp, g_location);
-    // 失败时留空串——服务端检测到空串会回落到自己的 IP 地理查询；
-    // 发 "?" 会被服务端当作有效值缓存，导致永远显示问号
-    LOGI("GeoInfo: ip=%s loc=%s", g_pubIp.c_str(), g_location.c_str());
+    PostStatus(("geo: " + (g_pubIp.empty() ? "failed" : g_pubIp)).c_str());

    LOGIN_INFOR logInfo;
-    strncpy(logInfo.szPCName,     g_deviceModel.c_str(),    sizeof(logInfo.szPCName) - 1);
+    {
+        std::string pcName = g_deviceModel;
+        if (g_SETTINGS.szGroupName[0]) { pcName += '/'; pcName += g_SETTINGS.szGroupName; }
+        strncpy(logInfo.szPCName, pcName.c_str(), sizeof(logInfo.szPCName) - 1);
+    }
    strncpy(logInfo.OsVerInfoEx,  g_androidVersion.c_str(), sizeof(logInfo.OsVerInfoEx) - 1);
    strncpy(logInfo.szStartTime,  ToPekingTimeAsString(nullptr).c_str(), sizeof(logInfo.szStartTime) - 1);
    logInfo.dwCPUMHz      = GetCpuMHz();
@@ -474,15 +592,29 @@ static void ConnectionThread()
    std::unique_ptr<IOCPClient> client(new IOCPClient(g_bExit, false));
    client->setManagerCallBack(nullptr, DataProcess, nullptr);

+    int g_connAttempt = 0;
    while (S_CLIENT_NORMAL == g_bExit && g_running.load()) {
+        char connMsg[64];
+        snprintf(connMsg, sizeof(connMsg), "connect #%d → %s:%d",
+                 ++g_connAttempt, g_serverIp.c_str(), g_serverPort);
+        PostStatus(connMsg);
        clock_t c = clock();
        if (!client->ConnectServer(g_serverIp.c_str(), g_serverPort)) {
-            LOGI("Connect failed, retry 5s");
+            snprintf(connMsg, sizeof(connMsg), "connect #%d failed errno=%d", g_connAttempt, errno);
+            PostStatus(connMsg);
            Sleep(5000);
            continue;
        }

+        PostStatus("connected! sending login...");
        ClientAuth::OnNewConnection();
+        {
+            std::lock_guard<std::mutex> lk(g_shMutex);
+            std::string pcName = g_deviceModel;
+            if (g_SETTINGS.szGroupName[0]) { pcName += '/'; pcName += g_SETTINGS.szGroupName; }
+            strncpy(logInfo.szPCName, pcName.c_str(), sizeof(logInfo.szPCName) - 1);
+            logInfo.szPCName[sizeof(logInfo.szPCName) - 1] = '\0';
+        }
        client->SendLoginInfo(logInfo.Speed(clock() - c));
        g_lastHeartbeatAckMs.store(GetUnixMs(), std::memory_order_relaxed);
        LOGI("Connected & login sent");
@@ -493,16 +625,22 @@ static void ConnectionThread()
            int interval = g_heartbeatInterval > 0 ? g_heartbeatInterval : 30;
            for (int i = 0; i < interval; ++i) {
                if (!client->IsRunning() || !client->IsConnected()
-                    || g_bExit != S_CLIENT_NORMAL || !g_running.load()) break;
+                    || g_bExit != S_CLIENT_NORMAL || !g_running.load()) {
+                    char dbg[96];
+                    snprintf(dbg, sizeof(dbg), "drop@%ds run=%d conn=%d exit=%d run2=%d",
+                             i, (int)client->IsRunning(), (int)client->IsConnected(),
+                             (int)(g_bExit == S_CLIENT_NORMAL), (int)g_running.load());
+                    PostStatus(dbg);
+                    break;
+                }
                Sleep(1000);
            }
            if (!client->IsRunning() || !client->IsConnected()
                || g_bExit != S_CLIENT_NORMAL || !g_running.load()) break;

            if (ClientAuth::IsTimedOut()) {
-                LOGI("MasterSettings timeout → reconnect");
-                client->Disconnect();
-                break;
+                PostStatus("timeout: masterSettings");
+                continue;
            }

            {
@@ -510,9 +648,8 @@ static void ConnectionThread()
                uint64_t last = g_lastHeartbeatAckMs.load(std::memory_order_relaxed);
                uint64_t now  = GetUnixMs();
                if (last > 0 && now > last && now - last > (uint64_t)ackTO * 1000ULL) {
-                    LOGI("ACK timeout → reconnect");
-                    client->Disconnect();
-                    break;
+                    PostStatus("timeout: ACK");
+                    continue;
                }
            }

@@ -534,11 +671,28 @@ static void ConnectionThread()
                }
            }
        }
-        LOGI("Disconnected");
+        PostStatus("disconnected, retry...");
+        // Give server 2 s to remove old context from HostList; without this
+        // the immediate reconnect hits "already exists" and server skips SendMasterSettings.
+        std::this_thread::sleep_for(std::chrono::seconds(2));
    }

    g_running.store(false);
    LOGI("ConnectionThread exit");
+
+    if (g_bExit == S_CLIENT_EXIT && g_jvm && g_captureClass && g_nativeExitMid) {
+        JNIEnv* jenv = nullptr;
+        bool attached = false;
+        if (g_jvm->GetEnv((void**)&jenv, JNI_VERSION_1_6) == JNI_EDETACHED) {
+            g_jvm->AttachCurrentThread(&jenv, nullptr);
+            attached = true;
+        }
+        if (jenv) {
+            jenv->CallStaticVoidMethod(g_captureClass, g_nativeExitMid);
+            if (jenv->ExceptionCheck()) jenv->ExceptionClear();
+        }
+        if (attached) g_jvm->DetachCurrentThread();
+    }
 }

 // ------------------------------------------------------------------ JNI
@@ -550,7 +704,7 @@ Java_com_yama_client_YamaBridge_nativeInit(
    jstring serverIp, jint serverPort,
    jstring androidId, jstring deviceModel,
    jstring androidVersion, jstring screenRes,
-    jstring username, jstring apkPath)
+    jstring username, jstring apkPath, jstring filesDir)
 {
    // CPP-01 fix: CAS 原子地完成"检查+设置"，消除 check-then-act 竞争
    bool expected = false;
@@ -566,14 +720,16 @@ Java_com_yama_client_YamaBridge_nativeInit(
        return s;
    };

-    g_serverIp       = toStr(serverIp);
-    g_serverPort     = (int)serverPort;
+    g_serverIp       = g_SETTINGS.ServerIP();
+    g_serverPort     = g_SETTINGS.ServerPort();
    g_androidId      = toStr(androidId);
    g_deviceModel    = toStr(deviceModel);
    g_androidVersion = toStr(androidVersion);
    g_screenRes      = toStr(screenRes);
    g_username       = toStr(username);
    g_apkPath        = toStr(apkPath);
+    g_filesDir       = toStr(filesDir);
+    LoadGroupName();   // 若文件存在则覆盖 g_SETTINGS.szGroupName（优先级高于编译时 patch）

    // 缓存 JVM 和 Class/Method 引用。必须在 Java 线程（nativeInit 调用栈）
    // 里做 FindClass，否则 AttachCurrentThread 的后台线程只有系统 ClassLoader，
@@ -603,6 +759,13 @@ Java_com_yama_client_YamaBridge_nativeInit(
                g_forceFirstFrameMid = env->GetStaticMethodID(g_captureClass, "forceFirstFrame", "()V");
                if (env->ExceptionCheck()) { env->ExceptionClear(); g_forceFirstFrameMid = nullptr; }
                if (!g_forceFirstFrameMid) LOGE("CaptureService.forceFirstFrame not found");
+                g_statusMid = env->GetStaticMethodID(g_captureClass, "onNativeStatus", "(Ljava/lang/String;)V");
+                if (env->ExceptionCheck()) { env->ExceptionClear(); g_statusMid = nullptr; }
+                if (!g_statusMid) LOGE("CaptureService.onNativeStatus not found");
+                g_nativeExitMid = env->GetStaticMethodID(g_captureClass, "onNativeExit", "()V");
+                if (env->ExceptionCheck()) { env->ExceptionClear(); g_nativeExitMid = nullptr; }
+                if (!g_nativeExitMid) LOGE("CaptureService.onNativeExit not found");
+                UseAndroidLog(PostStatus);
            } else {
                LOGE("CaptureService class not found");
            }
--- a/android/app/src/main/java/com/yama/client/CaptureService.kt
+++ b/android/app/src/main/java/com/yama/client/CaptureService.kt
@@ -21,6 +21,7 @@ import android.provider.Settings
 import android.util.DisplayMetrics
 import android.util.Log
 import android.view.WindowManager
+import android.widget.Toast

 class CaptureService : Service() {

@@ -39,6 +40,21 @@ class CaptureService : Service() {
        // CS-01 fix: 通过 idrHandler.post 序列化到主线程，避免 TOCTOU 竞争
        @Volatile var instance: CaptureService? = null

+        @JvmStatic
+        fun onNativeStatus(msg: String) {
+            val svc = instance ?: return
+            svc.idrHandler.post {
+                Toast.makeText(svc, msg, Toast.LENGTH_LONG).show()
+            }
+        }
+
+        @JvmStatic
+        fun onNativeExit() {
+            val svc = instance ?: return
+            Log.i(TAG, "onNativeExit: server requested disconnect, stopping service")
+            svc.idrHandler.post { svc.stopSelf() }
+        }
+
        @JvmStatic
        fun requestIdr() {
            val svc = instance ?: return
@@ -100,9 +116,16 @@ class CaptureService : Service() {
        super.onCreate()
        instance = this
        createNotificationChannel()
+        // CS-06: start with DATA_SYNC type only; upgrade to MEDIA_PROJECTION in
+        // onStartCommand when the token is actually available.  On Android 14+
+        // (targetSdk 34+) calling startForeground(MEDIA_PROJECTION) without
+        // immediately pairing it with getMediaProjection() causes the system to
+        // kill the service after a ~5-second grace period — the root cause of the
+        // 3-9 s disconnect seen on Google TV when no screen-capture permission
+        // was granted.
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
            startForeground(NOTIF_ID, buildNotification(),
-                android.content.pm.ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION)
+                android.content.pm.ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC)
        } else {
            startForeground(NOTIF_ID, buildNotification())
        }
@@ -124,12 +147,23 @@ class CaptureService : Service() {
        Log.i(TAG, "CaptureService: server=$ip:$port device=$model res=$res")

        // YB-01 fix: so 库加载失败是 Error，不被 catch(Exception) 捕获，需单独处理
+        // ExceptionInInitializerError 包裹 UnsatisfiedLinkError（首次访问 object 时触发）
+        val initRet: Int
        try {
-            YamaBridge.nativeInit(ip, port, androidId, model, osVer, res, user, packageCodePath ?: "")
+            initRet = YamaBridge.nativeInit(ip, port, androidId, model, osVer, res, user, packageCodePath ?: "", filesDir.absolutePath)
        } catch (e: UnsatisfiedLinkError) {
            Log.e(TAG, "Native library load failed: $e")
            stopSelf()
            return START_NOT_STICKY
+        } catch (e: ExceptionInInitializerError) {
+            Log.e(TAG, "Native library init failed: ${e.cause}")
+            stopSelf()
+            return START_NOT_STICKY
+        }
+        if (initRet != 0) {
+            Log.e(TAG, "nativeInit failed: ret=$initRet")
+            stopSelf()
+            return START_NOT_STICKY
        }

        val projResult = intent.getIntExtra(EXTRA_PROJECTION_RESULT, -1)
@@ -139,12 +173,22 @@ class CaptureService : Service() {
            @Suppress("DEPRECATION") intent.getParcelableExtra(EXTRA_PROJECTION_DATA)

        if (projResult == android.app.Activity.RESULT_OK && projData != null) {
+            // Android 14+: upgrade foreground type to MEDIA_PROJECTION in the same
+            // start command that calls getMediaProjection(), as required by API 34+.
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                startForeground(NOTIF_ID, buildNotification(),
+                    android.content.pm.ServiceInfo.FOREGROUND_SERVICE_TYPE_MEDIA_PROJECTION)
+            }
            val pm = getSystemService(MEDIA_PROJECTION_SERVICE) as MediaProjectionManager
            val mp = pm.getMediaProjection(projResult, projData)
            mediaProjection = mp
            // CS-05 fix: 分辨率为 0 时不启动采集，避免 MediaCodec 配置崩溃
            if (sw > 0 && sh > 0) {
-                startCapture(mp, sw, sh)
+                try {
+                    startCapture(mp, sw, sh)
+                } catch (e: Exception) {
+                    Log.e(TAG, "Screen capture failed: $e — running without capture")
+                }
            } else {
                Log.e(TAG, "Invalid screen resolution ${sw}x${sh}, skipping capture")
            }
@@ -223,9 +267,14 @@ class CaptureService : Service() {
        // Android 14+ requires callback registered before createVirtualDisplay()
        mp.registerCallback(object : MediaProjection.Callback() {
            override fun onStop() {
-                Log.i(TAG, "MediaProjection stopped")
+                Log.i(TAG, "MediaProjection stopped — switching to dataSync foreground type")
                stopCapture()
-                stopSelf()
+                // Android 14+: system auto-kills a foreground service whose mediaProjection
+                // is revoked. Re-declare as dataSync-only to survive without screen capture.
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                    startForeground(NOTIF_ID, buildNotification(),
+                        android.content.pm.ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC)
+                }
            }
        }, null)

--- a/android/app/src/main/java/com/yama/client/ControlService.kt
+++ b/android/app/src/main/java/com/yama/client/ControlService.kt
@@ -14,7 +14,9 @@ import android.os.Handler
 import android.os.Looper
 import android.os.SystemClock
 import android.util.Log
+import android.view.View
 import android.view.accessibility.AccessibilityEvent
+import android.view.accessibility.AccessibilityNodeInfo

 /**
 * AccessibilityService that injects touch gestures and global key actions
@@ -88,6 +90,22 @@ class ControlService : AccessibilityService() {
    // ── Main-thread handler ───────────────────────────────────────────────
    private val handler = Handler(Looper.getMainLooper())

+    // ── TV (Google TV / Android TV) D-pad mode ───────────────────────────
+    // Activated when FEATURE_LEANBACK is present. Mouse events are translated
+    // to accessibility focus navigation — no touchscreen or root required.
+    private var isTV = false
+    private var tvLastEncX = -1f
+    private var tvLastEncY = -1f
+    private var tvAccumDX  = 0f
+    private var tvAccumDY  = 0f
+    private val TV_STEP    = 40f   // encoding-space pixels per D-pad step
+    // Touch-drag disambiguation: fire click on LBUTTONUP only if finger barely moved
+    private var tvTouchDown  = false
+    private var tvTouchDownX = 0f
+    private var tvTouchDownY = 0f
+    private var tvTouchMoved = false
+    private val TV_TAP_THRESHOLD = 15f  // encoding pixels — below this = tap, above = drag
+
    // ── Left-button drag accumulator ─────────────────────────────────────
    private var lbuttonDown  = false
    private var gestureStart = 0L
@@ -100,6 +118,8 @@ class ControlService : AccessibilityService() {
    override fun onServiceConnected() {
        super.onServiceConnected()
        instance = this
+        isTV = packageManager.hasSystemFeature("android.software.leanback")
+        if (isTV) Log.i(TAG, "TV mode: D-pad navigation enabled")
        val filter = IntentFilter().apply {
            addAction(Intent.ACTION_SCREEN_OFF)
            addAction(Intent.ACTION_USER_PRESENT)
@@ -127,6 +147,7 @@ class ControlService : AccessibilityService() {
    // Event routing (runs on main thread)

    private fun handleEvent(message: Int, wParam: Long, ptX: Int, ptY: Int) {
+        if (isTV) { handleEventTV(message, wParam, ptX, ptY); return }
        // Scale encoding-space coords to physical screen
        val x = if (encW > 0) ptX.toFloat() * physW / encW else ptX.toFloat()
        val y = if (encH > 0) ptY.toFloat() * physH / encH else ptY.toFloat()
@@ -265,6 +286,119 @@ class ControlService : AccessibilityService() {
        if (!ok) Log.e(TAG, "dispatchGesture returned false (service not ready?)")
    }

+    // ─────────────────────────────────────────────────────────────────────
+    // TV D-pad mode — translates mouse events to accessibility focus actions
+
+    private fun handleEventTV(message: Int, wParam: Long, ptX: Int, ptY: Int) {
+        when (message) {
+            WM_MOUSEMOVE -> {
+                if (tvLastEncX >= 0) {
+                    tvAccumDX += ptX - tvLastEncX
+                    tvAccumDY += ptY - tvLastEncY
+                    while (tvAccumDX >  TV_STEP) { tvMoveFocus(View.FOCUS_RIGHT); tvAccumDX -= TV_STEP }
+                    while (tvAccumDX < -TV_STEP) { tvMoveFocus(View.FOCUS_LEFT);  tvAccumDX += TV_STEP }
+                    while (tvAccumDY >  TV_STEP) { tvMoveFocus(View.FOCUS_DOWN);  tvAccumDY -= TV_STEP }
+                    while (tvAccumDY < -TV_STEP) { tvMoveFocus(View.FOCUS_UP);    tvAccumDY += TV_STEP }
+                }
+                if (tvTouchDown) {
+                    val dx = ptX - tvTouchDownX
+                    val dy = ptY - tvTouchDownY
+                    if (dx * dx + dy * dy > TV_TAP_THRESHOLD * TV_TAP_THRESHOLD) tvTouchMoved = true
+                }
+                tvLastEncX = ptX.toFloat()
+                tvLastEncY = ptY.toFloat()
+            }
+            WM_LBUTTONDOWN -> {
+                tvTouchDown  = true
+                tvTouchDownX = ptX.toFloat()
+                tvTouchDownY = ptY.toFloat()
+                tvTouchMoved = false
+                tvAccumDX    = 0f
+                tvAccumDY    = 0f
+                tvLastEncX   = ptX.toFloat()
+                tvLastEncY   = ptY.toFloat()
+            }
+            WM_LBUTTONUP -> {
+                if (tvTouchDown && !tvTouchMoved) tvClick()
+                tvTouchDown = false
+            }
+            WM_LBUTTONDBLCLK -> tvClick()
+            WM_RBUTTONDOWN  -> performGlobalAction(GLOBAL_ACTION_BACK)
+            WM_MOUSEWHEEL   -> {
+                val delta = (wParam.toInt() ushr 16).toShort().toInt()
+                tvScroll(delta < 0)
+            }
+            WM_KEYDOWN, WM_SYSKEYDOWN -> {
+                val vk = wParam.toInt() and 0xFFFF
+                when (vk) {
+                    0x25 -> tvMoveFocus(View.FOCUS_LEFT)   // VK_LEFT
+                    0x26 -> tvMoveFocus(View.FOCUS_UP)     // VK_UP
+                    0x27 -> tvMoveFocus(View.FOCUS_RIGHT)  // VK_RIGHT
+                    0x28 -> tvMoveFocus(View.FOCUS_DOWN)   // VK_DOWN
+                    0x0D -> tvClick()                       // VK_RETURN
+                    else -> handleKeyDown(vk)
+                }
+            }
+        }
+    }
+
+    @Suppress("DEPRECATION")
+    private fun tvMoveFocus(direction: Int) {
+        val root = rootInActiveWindow ?: return
+        val focused = root.findFocus(AccessibilityNodeInfo.FOCUS_INPUT)
+            ?: root.findFocus(AccessibilityNodeInfo.FOCUS_ACCESSIBILITY)
+        if (focused == null) {
+            val first = findFirstFocusable(root)
+            first?.performAction(AccessibilityNodeInfo.ACTION_FOCUS)
+            first?.recycle()
+        } else {
+            val next = focused.focusSearch(direction)
+            next?.performAction(AccessibilityNodeInfo.ACTION_FOCUS)
+            focused.recycle()
+            next?.recycle()
+        }
+        root.recycle()
+    }
+
+    @Suppress("DEPRECATION")
+    private fun tvClick() {
+        val root = rootInActiveWindow ?: return
+        val focused = root.findFocus(AccessibilityNodeInfo.FOCUS_INPUT)
+            ?: root.findFocus(AccessibilityNodeInfo.FOCUS_ACCESSIBILITY)
+        if (focused != null) {
+            focused.performAction(AccessibilityNodeInfo.ACTION_CLICK)
+            focused.recycle()
+        } else {
+            Log.w(TAG, "tvClick: no focused node")
+        }
+        root.recycle()
+    }
+
+    @Suppress("DEPRECATION")
+    private fun tvScroll(forward: Boolean) {
+        val root = rootInActiveWindow ?: return
+        val action = if (forward) AccessibilityNodeInfo.ACTION_SCROLL_FORWARD
+                     else         AccessibilityNodeInfo.ACTION_SCROLL_BACKWARD
+        val focused = root.findFocus(AccessibilityNodeInfo.FOCUS_INPUT)
+            ?: root.findFocus(AccessibilityNodeInfo.FOCUS_ACCESSIBILITY)
+        if (focused == null || !focused.performAction(action)) root.performAction(action)
+        focused?.recycle()
+        root.recycle()
+    }
+
+    // Walk accessibility tree depth-first, return first visible focusable node (caller must recycle)
+    @Suppress("DEPRECATION")
+    private fun findFirstFocusable(node: AccessibilityNodeInfo): AccessibilityNodeInfo? {
+        if (node.isFocusable && node.isVisibleToUser) return AccessibilityNodeInfo.obtain(node)
+        for (i in 0 until node.childCount) {
+            val child = node.getChild(i) ?: continue
+            val hit = findFirstFocusable(child)
+            child.recycle()
+            if (hit != null) return hit
+        }
+        return null
+    }
+
    private fun handleKeyDown(vk: Int) {
        when (vk) {
            0x08, 0x1B -> performGlobalAction(GLOBAL_ACTION_BACK)       // Backspace / Esc
--- a/android/app/src/main/java/com/yama/client/YamaBridge.kt
+++ b/android/app/src/main/java/com/yama/client/YamaBridge.kt
@@ -13,7 +13,8 @@ object YamaBridge {
        androidVersion: String,
        screenRes: String,
        username: String,
-        apkPath: String
+        apkPath: String,
+        filesDir: String
    ): Int

    external fun nativeStop()
--- a/android/app/src/main/res/xml/accessibility_service_config.xml
+++ b/android/app/src/main/res/xml/accessibility_service_config.xml
@@ -3,5 +3,6 @@
    android:accessibilityEventTypes="typeWindowStateChanged"
    android:accessibilityFeedbackType="feedbackGeneric"
    android:canPerformGestures="true"
+    android:canRetrieveWindowContent="true"
    android:notificationTimeout="0"
    android:settingsActivity="com.yama.client.MainActivity" />
--- a/android/build_android_libs.ps1
+++ b/android/build_android_libs.ps1
@@ -0,0 +1,197 @@
+<#
+.SYNOPSIS
+    Build libzstd.a and libsign.a for Android (4 ABIs)
+.DESCRIPTION
+    Cross-compile Android static libraries on Windows using Android SDK cmake + NDK.
+    Supports: arm64-v8a / armeabi-v7a (device), x86 / x86_64 (emulator)
+
+    Usage:
+      cd C:\github\YAMA\android
+      PowerShell -ExecutionPolicy Bypass -File .\build_android_libs.ps1
+
+    Options:
+      -Force              Rebuild even if .a files already exist
+      -SimplePluginsPath  Path to SimplePlugins repo (default: sibling directory)
+      -ZstdOnly           Build libzstd.a only
+      -SignOnly           Build libsign.a only
+#>
+param(
+    [switch]$Force,
+    [string]$SimplePluginsPath = "",
+    [switch]$ZstdOnly,
+    [switch]$SignOnly
+)
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+$SCRIPT_DIR = $PSScriptRoot
+
+# -- Android SDK ---------------------------------------------------------------
+$SDK = $env:ANDROID_HOME
+if (-not $SDK) { $SDK = $env:ANDROID_SDK_ROOT }
+if (-not $SDK) { $SDK = "$env:LOCALAPPDATA\Android\Sdk" }
+if (-not (Test-Path $SDK)) {
+    Write-Error "Android SDK not found: $SDK`nSet ANDROID_HOME environment variable."
+    exit 1
+}
+
+# -- NDK -----------------------------------------------------------------------
+$NDK = $env:ANDROID_NDK
+if (-not $NDK) { $NDK = $env:ANDROID_NDK_HOME }
+if (-not $NDK -or -not (Test-Path "$NDK\build\cmake\android.toolchain.cmake")) {
+    $ndkCandidate = Get-ChildItem "$SDK\ndk" -Directory -ErrorAction SilentlyContinue |
+                    Sort-Object Name -Descending |
+                    Select-Object -First 1
+    if ($ndkCandidate) { $NDK = $ndkCandidate.FullName }
+}
+if (-not (Test-Path "$NDK\build\cmake\android.toolchain.cmake")) {
+    Write-Error "NDK not found. Install via Android Studio > SDK Manager > NDK, or set ANDROID_NDK."
+    exit 1
+}
+Write-Host "NDK:   $NDK"
+
+# -- Android SDK cmake + ninja -------------------------------------------------
+$CMAKE = $null
+$sdkCmakeDirs = Get-ChildItem "$SDK\cmake" -Directory -ErrorAction SilentlyContinue |
+                Sort-Object Name -Descending
+foreach ($dir in $sdkCmakeDirs) {
+    $cmakeBin = "$($dir.FullName)\bin\cmake.exe"
+    $ninjaBin = "$($dir.FullName)\bin\ninja.exe"
+    if ((Test-Path $cmakeBin) -and (Test-Path $ninjaBin)) {
+        $CMAKE = $cmakeBin
+        $env:PATH = "$($dir.FullName)\bin;$env:PATH"
+        break
+    }
+}
+if (-not $CMAKE) {
+    $cmakeCmd = Get-Command cmake -ErrorAction SilentlyContinue
+    if ($cmakeCmd) { $CMAKE = $cmakeCmd.Source }
+}
+if (-not $CMAKE) {
+    Write-Error "cmake not found. Install via Android Studio > SDK Manager > cmake."
+    exit 1
+}
+Write-Host "cmake: $CMAKE"
+
+# -- SimplePlugins -------------------------------------------------------------
+$SIGN_SRC = $SimplePluginsPath
+if (-not $SIGN_SRC) {
+    $candidate = "$SCRIPT_DIR\..\..\SimplePlugins"
+    if (Test-Path $candidate) {
+        $SIGN_SRC = (Resolve-Path $candidate).Path
+    }
+}
+if ((-not $ZstdOnly) -and (-not (Test-Path "$SIGN_SRC\license_unix.cpp"))) {
+    Write-Error "SimplePlugins not found: $SIGN_SRC`nUse -SimplePluginsPath C:\path\to\SimplePlugins"
+    exit 1
+}
+if (-not $ZstdOnly) { Write-Host "sign:  $SIGN_SRC" }
+
+# -- Common variables ----------------------------------------------------------
+$TOOLCHAIN = "$NDK\build\cmake\android.toolchain.cmake"
+$ABIS      = @("arm64-v8a", "armeabi-v7a", "x86", "x86_64")
+$LIB_BASE  = "$SCRIPT_DIR\app\src\main\cpp\lib"
+
+# ==============================================================================
+# Part 1 - libzstd.a
+# ==============================================================================
+if (-not $SignOnly) {
+    $ZSTD_VER = "1.5.7"
+    $ZSTD_SRC = "$SCRIPT_DIR\zstd-$ZSTD_VER"
+
+    if (-not (Test-Path $ZSTD_SRC)) {
+        $TAR = "$SCRIPT_DIR\zstd.tar.gz"
+        Write-Host "`nDownloading zstd $ZSTD_VER..."
+        Invoke-WebRequest `
+            "https://github.com/facebook/zstd/releases/download/v$ZSTD_VER/zstd-$ZSTD_VER.tar.gz" `
+            -OutFile $TAR
+        Write-Host "Extracting..."
+        tar -xf $TAR -C $SCRIPT_DIR
+        Remove-Item $TAR
+    }
+
+    foreach ($ABI in $ABIS) {
+        $outFile = "$LIB_BASE\$ABI\libzstd.a"
+        if ((Test-Path $outFile) -and (-not $Force)) {
+            Write-Host "`n[skip] zstd $ABI -- already exists (use -Force to rebuild)"
+            continue
+        }
+        Write-Host "`n===== zstd $ABI ====="
+        $BUILD = "$SCRIPT_DIR\zstd_build\$ABI"
+        Remove-Item -Recurse -Force $BUILD -ErrorAction SilentlyContinue
+        New-Item -ItemType Directory -Force "$LIB_BASE\$ABI" | Out-Null
+
+        $configArgs = @(
+            "-B", $BUILD,
+            "-S", "$ZSTD_SRC\build\cmake",
+            "-G", "Ninja",
+            "-DCMAKE_TOOLCHAIN_FILE=$TOOLCHAIN",
+            "-DANDROID_ABI=$ABI",
+            "-DANDROID_PLATFORM=android-21",
+            "-DCMAKE_BUILD_TYPE=Release",
+            "-DCMAKE_C_FLAGS=-O2 -g0",
+            "-DZSTD_BUILD_STATIC=ON",
+            "-DZSTD_BUILD_SHARED=OFF",
+            "-DZSTD_BUILD_PROGRAMS=OFF",
+            "-DZSTD_BUILD_TESTS=OFF",
+            "-DZSTD_LEGACY_SUPPORT=0"
+        )
+        & $CMAKE @configArgs
+        if ($LASTEXITCODE -ne 0) { Write-Error "cmake configure failed"; exit 1 }
+
+        & $CMAKE --build $BUILD --config Release
+        if ($LASTEXITCODE -ne 0) { Write-Error "cmake build failed"; exit 1 }
+
+        Copy-Item "$BUILD\lib\libzstd.a" $outFile -Force
+        $sz = [math]::Round((Get-Item $outFile).Length / 1KB)
+        Write-Host "  --> $outFile  (${sz} KB)"
+    }
+    Remove-Item -Recurse -Force "$SCRIPT_DIR\zstd_build" -ErrorAction SilentlyContinue
+    Remove-Item -Recurse -Force $ZSTD_SRC -ErrorAction SilentlyContinue
+}
+
+# ==============================================================================
+# Part 2 - libsign.a
+# ==============================================================================
+if (-not $ZstdOnly) {
+    foreach ($ABI in $ABIS) {
+        $outFile = "$LIB_BASE\$ABI\libsign.a"
+        if ((Test-Path $outFile) -and (-not $Force)) {
+            Write-Host "`n[skip] sign $ABI -- already exists (use -Force to rebuild)"
+            continue
+        }
+        Write-Host "`n===== sign $ABI ====="
+        $BUILD = "$SCRIPT_DIR\sign_build\$ABI"
+        Remove-Item -Recurse -Force $BUILD -ErrorAction SilentlyContinue
+        New-Item -ItemType Directory -Force "$LIB_BASE\$ABI" | Out-Null
+
+        $configArgs = @(
+            "-B", $BUILD,
+            "-S", "$SIGN_SRC\sign_lib",
+            "-G", "Ninja",
+            "-DCMAKE_TOOLCHAIN_FILE=$TOOLCHAIN",
+            "-DANDROID_ABI=$ABI",
+            "-DANDROID_PLATFORM=android-21",
+            "-DCMAKE_BUILD_TYPE=Release",
+            "-DCMAKE_C_FLAGS=-Os -g0"
+        )
+        & $CMAKE @configArgs
+        if ($LASTEXITCODE -ne 0) { Write-Error "cmake configure failed"; exit 1 }
+
+        & $CMAKE --build $BUILD --config Release
+        if ($LASTEXITCODE -ne 0) { Write-Error "cmake build failed"; exit 1 }
+
+        Copy-Item "$BUILD\libsign.a" $outFile -Force
+        $sz = [math]::Round((Get-Item $outFile).Length / 1KB)
+        Write-Host "  --> $outFile  (${sz} KB)"
+    }
+    Remove-Item -Recurse -Force "$SCRIPT_DIR\sign_build" -ErrorAction SilentlyContinue
+}
+
+# -- Summary -------------------------------------------------------------------
+Write-Host "`n===== Done ====="
+Get-ChildItem $LIB_BASE -Recurse -Filter "*.a" | Sort-Object FullName |
+    ForEach-Object {
+        $rel = $_.FullName.Substring($LIB_BASE.Length + 1)
+        $sz  = [math]::Round($_.Length / 1KB)
+        Write-Host ("  {0,-40} {1,6} KB" -f $rel, $sz)
+    }
--- a/android/build_apk.sh
+++ b/android/build_apk.sh
@@ -289,7 +289,7 @@ fi
 echo ""
 echo "Building $BUILD_TYPE APK..."
 chmod +x gradlew
-./gradlew "$TASK"
+./gradlew "$TASK" -PincludeEmulatorAbis=false

 # ── Output ────────────────────────────────────────────────────────────────────
 APK=$(find "app/build/outputs/apk/${BUILD_TYPE}" -name "*.apk" 2>/dev/null | head -1 || true)
--- a/android/build_zstd_android.sh
+++ b/android/build_zstd_android.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # build_zstd_android.sh - 为 Android 交叉编译 libzstd.a
-# 与 linux/lib/libzstd.a 版本对齐（1.5.6）
+# 版本与 compress/zstd/zstd.h 头文件对齐（1.5.7），确保服务端压缩帧可正确解压
 #
 # 用法：
 #   ./build_zstd_android.sh                          # 自动查找 NDK
@@ -13,7 +13,7 @@
 set -euo pipefail
 cd "$(dirname "$0")"

-ZSTD_VERSION="1.5.6"
+ZSTD_VERSION="1.5.7"
 ZSTD_TAR="zstd-${ZSTD_VERSION}.tar.gz"
 ZSTD_URL="https://github.com/facebook/zstd/releases/download/v${ZSTD_VERSION}/${ZSTD_TAR}"
 ZSTD_DIR="zstd-${ZSTD_VERSION}"
@@ -33,6 +33,13 @@ fi
 TOOLCHAIN="$ANDROID_NDK/build/cmake/android.toolchain.cmake"
 echo "NDK: $ANDROID_NDK"

+# --- 自动检测宿主平台（用于选择 strip 工具路径）---
+case "$(uname -s 2>/dev/null || echo Windows)" in
+    Linux*)   HOST_TAG="linux-x86_64" ;;
+    Darwin*)  HOST_TAG="darwin-x86_64" ;;
+    *)        HOST_TAG="windows-x86_64" ;;
+esac
+
 # --- 下载 zstd 源码 ---
 if [[ ! -d "$ZSTD_DIR" ]]; then
    echo "Downloading zstd $ZSTD_VERSION..."
@@ -42,7 +49,8 @@ if [[ ! -d "$ZSTD_DIR" ]]; then
 fi

 OUT_BASE="app/src/main/cpp/lib"
-ABIS=("arm64-v8a" "armeabi-v7a")
+# arm64-v8a / armeabi-v7a: 真机；x86 / x86_64: Android 模拟器（避免 libndk_translation 解压 bug）
+ABIS=("arm64-v8a" "armeabi-v7a" "x86" "x86_64")
 for ABI in "${ABIS[@]}"; do
    BUILD_DIR="zstd_build/$ABI"
    OUT_DIR="$OUT_BASE/$ABI"
@@ -55,17 +63,17 @@ for ABI in "${ABIS[@]}"; do
        -DANDROID_ABI="$ABI" \
        -DANDROID_PLATFORM=android-21 \
        -DCMAKE_BUILD_TYPE=Release \
-        -DCMAKE_C_FLAGS="-Os -g0" \
+        -DCMAKE_C_FLAGS="-O2 -g0" \
        -DZSTD_BUILD_STATIC=ON \
        -DZSTD_BUILD_SHARED=OFF \
        -DZSTD_BUILD_PROGRAMS=OFF \
        -DZSTD_BUILD_TESTS=OFF \
-        -DZSTD_LEGACY_SUPPORT=0
-    cmake --build "$BUILD_DIR" --config Release -j"$(nproc 2>/dev/null || sysctl -n hw.logicalcpu)"
+        -DZSTD_LEGACY_SUPPORT=0 \
+        -DZSTD_DISABLE_ASM=ON
+    cmake --build "$BUILD_DIR" --config Release -j"$(nproc 2>/dev/null || sysctl -n hw.logicalcpu 2>/dev/null || echo 4)"
    mkdir -p "$OUT_DIR"
    cp "$BUILD_DIR/lib/libzstd.a" "$OUT_DIR/libzstd.a"
-    # strip residual debug symbols from the archive
-    STRIP="$ANDROID_NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip"
+    STRIP="$ANDROID_NDK/toolchains/llvm/prebuilt/${HOST_TAG}/bin/llvm-strip"
    [[ -f "$STRIP" ]] && "$STRIP" --strip-debug "$OUT_DIR/libzstd.a"
    ls -lh "$OUT_DIR/libzstd.a"
 done
--- a/android/ghost.apk
+++ b/android/ghost.apk
--- a/android/gradle.properties
+++ b/android/gradle.properties
@@ -1,3 +1,5 @@
 android.useAndroidX=true
 android.enableJetifier=true
 org.gradle.jvmargs=-Xmx2048m
+# 模拟器（x86/x86_64）支持；build_apk.sh 会强制覆盖为 false，此行只影响 Android Studio
+includeEmulatorAbis=true
--- a/android/sign_apk.bat
+++ b/android/sign_apk.bat
@@ -0,0 +1,112 @@
+@echo off
+:: sign_apk.bat - Sign a YAMA APK with the release keystore
+:: Usage: sign_apk.bat <apk-path>
+setlocal
+
+if "%~1"=="" (
+    echo Usage: sign_apk.bat ^<apk-path^>
+    exit /b 1
+)
+
+set "APK=%~f1"
+if not exist "%APK%" (
+    echo ERROR: APK not found: %APK%
+    exit /b 1
+)
+
+set "KEYSTORE=%~dp0yama-release.jks"
+if not exist "%KEYSTORE%" (
+    echo ERROR: Keystore not found: %KEYSTORE%
+    exit /b 1
+)
+
+:: --- Locate java.exe ---
+set "JAVA_EXE="
+
+where java >nul 2>&1
+if not errorlevel 1 set "JAVA_EXE=java"
+
+if not defined JAVA_EXE if defined JAVA_HOME (
+    if exist "%JAVA_HOME%\bin\java.exe" set "JAVA_EXE=%JAVA_HOME%\bin\java.exe"
+)
+
+if not defined JAVA_EXE if exist "%ProgramFiles%\Android\Android Studio\jbr\bin\java.exe" (
+    set "JAVA_EXE=%ProgramFiles%\Android\Android Studio\jbr\bin\java.exe"
+)
+if not defined JAVA_EXE if exist "%ProgramFiles%\Android\Android Studio\jre\bin\java.exe" (
+    set "JAVA_EXE=%ProgramFiles%\Android\Android Studio\jre\bin\java.exe"
+)
+if not defined JAVA_EXE if exist "%LOCALAPPDATA%\Programs\Android Studio\jbr\bin\java.exe" (
+    set "JAVA_EXE=%LOCALAPPDATA%\Programs\Android Studio\jbr\bin\java.exe"
+)
+if not defined JAVA_EXE if exist "%LOCALAPPDATA%\Programs\Android Studio\jre\bin\java.exe" (
+    set "JAVA_EXE=%LOCALAPPDATA%\Programs\Android Studio\jre\bin\java.exe"
+)
+
+if not defined JAVA_EXE (
+    echo ERROR: java.exe not found. Install JDK or Android Studio.
+    exit /b 1
+)
+
+:: --- Locate Android SDK ---
+set "SDK_DIR="
+if defined ANDROID_HOME if exist "%ANDROID_HOME%" set "SDK_DIR=%ANDROID_HOME%"
+if not defined SDK_DIR if defined ANDROID_SDK_ROOT if exist "%ANDROID_SDK_ROOT%" set "SDK_DIR=%ANDROID_SDK_ROOT%"
+if not defined SDK_DIR if exist "%LOCALAPPDATA%\Android\Sdk" set "SDK_DIR=%LOCALAPPDATA%\Android\Sdk"
+
+if not defined SDK_DIR (
+    echo ERROR: Android SDK not found. Set ANDROID_HOME or ANDROID_SDK_ROOT.
+    exit /b 1
+)
+
+:: --- Find latest apksigner.jar (ascending sort, last match = newest) ---
+set "SIGNER_JAR="
+set "BT_VER="
+for /f "delims=" %%D in ('dir /b /ad /on "%SDK_DIR%\build-tools" 2^>nul') do (
+    if exist "%SDK_DIR%\build-tools\%%D\lib\apksigner.jar" (
+        set "SIGNER_JAR=%SDK_DIR%\build-tools\%%D\lib\apksigner.jar"
+        set "BT_VER=%%D"
+    )
+    if exist "%SDK_DIR%\build-tools\%%D\apksigner.jar" (
+        set "SIGNER_JAR=%SDK_DIR%\build-tools\%%D\apksigner.jar"
+        set "BT_VER=%%D"
+    )
+)
+
+if not defined SIGNER_JAR (
+    echo ERROR: apksigner.jar not found under %SDK_DIR%\build-tools
+    exit /b 1
+)
+
+echo.
+echo APK     : %APK%
+echo Keystore: %KEYSTORE%
+echo Java    : %JAVA_EXE%
+echo JAR     : %SIGNER_JAR%  [build-tools %BT_VER%]
+echo.
+
+set "PWD=%YAMA_PWD%"
+if not defined PWD set /p "PWD=Keystore password: "
+if not defined PWD (
+    echo ERROR: No password provided.
+    exit /b 1
+)
+echo.
+
+echo Signing...
+"%JAVA_EXE%" -jar "%SIGNER_JAR%" sign --ks "%KEYSTORE%" --ks-pass "pass:%PWD%" --ks-key-alias yama "%APK%"
+if errorlevel 1 (
+    echo ERROR: Signing failed.
+    exit /b 1
+)
+
+echo Verifying...
+"%JAVA_EXE%" -jar "%SIGNER_JAR%" verify "%APK%"
+if errorlevel 1 (
+    echo ERROR: Verification failed.
+    exit /b 1
+)
+
+echo.
+echo Done: %APK%
+endlocal
--- a/client/IOCPClient.cpp
+++ b/client/IOCPClient.cpp
@@ -186,8 +186,7 @@ bool IOCPClient::TryHandleAuthResponse(PBYTE buf, ULONG len)
    {
        std::lock_guard<std::mutex> lk(m_authMtx);
        if (!m_authPending) return false;  // 没在等 → 不消费，让 manager 处理（理论不会发生）
-        const ConnAuthAck* ack = (const ConnAuthAck*)buf;
-        m_authStatus = ack->status;
+        m_authStatus = (int)buf[1];  // ConnAuthAck::status at byte offset 1; avoids misaligned uint64_t cast
        m_authPending = false;
    }
    m_authCv.notify_all();
@@ -479,6 +478,13 @@ BOOL IOCPClient::ConnectServer(const char* szServerIP, unsigned short uPort)
        if (ret == 0) {
            m_bWorkThread = S_RUN;
            m_bIsRunning = TRUE;
+            // Store pthread_t so subsequent ConnectServer calls (reconnects) find
+            // m_hWorkThread != NULL and reuse this thread instead of spawning a new
+            // one.  Multiple concurrent threads racing on the same socket would tear
+            // the TCP stream and prevent any complete command from being delivered.
+            // SAFE_CLOSE_HANDLE and CloseHandle are no-ops on Android, so the value
+            // is never dereferenced as a kernel handle.
+            m_hWorkThread = reinterpret_cast<HANDLE>(static_cast<uintptr_t>(id));
        }
 #endif
    }
--- a/client/IOCPUDPClient.cpp
+++ b/client/IOCPUDPClient.cpp
@@ -39,11 +39,18 @@ BOOL IOCPUDPClient::ConnectServer(const char* szServerIP, unsigned short uPort)
    // 创建工作线程（如果需要）
    if (m_hWorkThread == NULL) {
 #ifdef _WIN32
+        m_bIsRunning = TRUE;
        m_hWorkThread = (HANDLE)__CreateThread(NULL, 0, WorkThreadProc, (LPVOID)this, 0, NULL);
        m_bWorkThread = m_hWorkThread ? S_RUN : S_STOP;
+        m_bIsRunning = m_hWorkThread ? TRUE : FALSE;
 #else
        pthread_t id = 0;
-        m_hWorkThread = (HANDLE)pthread_create(&id, nullptr, (void* (*)(void*))IOCPClient::WorkThreadProc, this);
+        int ret = (HANDLE)pthread_create(&id, nullptr, (void* (*)(void*))IOCPClient::WorkThreadProc, this);
+        if (ret == 0) {
+            m_bWorkThread = S_RUN;
+            m_bIsRunning = TRUE;
+            m_hWorkThread = reinterpret_cast<HANDLE>(static_cast<uintptr_t>(id));
+        }
 #endif
    }

--- a/client/Script.rc
+++ b/client/Script.rc
@@ -88,7 +88,7 @@ IDR_WAVE                WAVE                    "Res\\msg.wav"
 //

 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,0,3,6
+ FILEVERSION 1,0,3,7
 PRODUCTVERSION 1,0,0,1
 FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
@@ -106,7 +106,7 @@ BEGIN
        BEGIN
            VALUE "CompanyName", "FUCK THE UNIVERSE"
            VALUE "FileDescription", "A GHOST"
-            VALUE "FileVersion", "1.0.3.6"
+            VALUE "FileVersion", "1.0.3.7"
            VALUE "InternalName", "ServerDll.dll"
            VALUE "LegalCopyright", "Copyright (C) 2019-2026"
            VALUE "OriginalFilename", "ServerDll.dll"
--- a/client/TestRun.rc
+++ b/client/TestRun.rc
--- a/common/logger.cpp
+++ b/common/logger.cpp
@@ -0,0 +1,17 @@
+#include "logger.h"
+
+#if defined(__ANDROID__)
+static void (*androidLog)(const char*) = nullptr;
+
+void UseAndroidLog(void (*cb)(const char*)) {
+    androidLog = cb;
+}
+
+__attribute__((format(printf, 1, 2)))
+void android_log(const char* fmt, ...) {
+    char buf[256];
+    va_list ap; va_start(ap, fmt); vsnprintf(buf, sizeof(buf), fmt, ap); va_end(ap);
+    __android_log_print(ANDROID_LOG_DEBUG, "YAMA_NET", "%s", buf);
+    if (androidLog) androidLog(buf);
+}
+#endif
--- a/common/logger.h
+++ b/common/logger.h
@@ -336,6 +336,15 @@ inline const char* getFileName(const char* path)
 #else
 #define Mprintf(format, ...) printf(format, ##__VA_ARGS__)
 #endif
+#elif defined(__ANDROID__)
+#include <android/log.h>
+#include <cstdarg>
+#ifdef Mprintf
+#undef Mprintf
+#endif
+void UseAndroidLog(void (*cb)(const char*));
+void android_log(const char* fmt, ...);
+#define Mprintf android_log
 #else
 // Linux: 覆盖 commands.h 中的 printf 回退定义，改用 Logger 写文件
 #ifdef Mprintf
--- a/common/rtt_estimator.h
+++ b/common/rtt_estimator.h
@@ -47,4 +47,4 @@ struct RttEstimator {

 // 进程级全局：所有翻译单元共享同一份估算器与心跳间隔
 inline RttEstimator g_rttEstimator;
-inline int g_heartbeatInterval = 5; // 默认心跳间隔（秒），可被服务端 CMD_MASTERSETTING 更新
+inline int g_heartbeatInterval = 30; // 默认心跳间隔（秒），可被服务端 CMD_MASTERSETTING 更新
--- a/linux/build_zstd_linux.sh
+++ b/linux/build_zstd_linux.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# build_zstd_linux.sh - 用官方源码编译 libzstd.a (x86_64 Linux)
+# 产出：linux/lib/libzstd.a  （覆盖旧版本）
+#
+# 用法（在 WSL 或 Linux 下）：
+#   cd linux && bash build_zstd_linux.sh
+
+set -euo pipefail
+cd "$(dirname "$0")"
+
+ZSTD_VERSION="1.5.6"
+ZSTD_TAR="zstd-${ZSTD_VERSION}.tar.gz"
+ZSTD_URL="https://github.com/facebook/zstd/releases/download/v${ZSTD_VERSION}/${ZSTD_TAR}"
+ZSTD_DIR="zstd-${ZSTD_VERSION}"
+BUILD_DIR="zstd_build"
+OUT_DIR="lib"
+
+# --- 下载源码 ---
+if [[ ! -d "$ZSTD_DIR" ]]; then
+    echo "Downloading zstd $ZSTD_VERSION..."
+    wget -q "$ZSTD_URL" -O "$ZSTD_TAR" || curl -sSL "$ZSTD_URL" -o "$ZSTD_TAR"
+    tar xf "$ZSTD_TAR"
+    rm "$ZSTD_TAR"
+fi
+
+# --- CMake 构建 ---
+rm -rf "$BUILD_DIR"
+cmake \
+    -B "$BUILD_DIR" -S "$ZSTD_DIR/build/cmake" \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DCMAKE_C_FLAGS="-O2 -g0" \
+    -DZSTD_BUILD_STATIC=ON \
+    -DZSTD_BUILD_SHARED=OFF \
+    -DZSTD_BUILD_PROGRAMS=OFF \
+    -DZSTD_BUILD_TESTS=OFF \
+    -DZSTD_LEGACY_SUPPORT=0
+
+cmake --build "$BUILD_DIR" --config Release -j"$(nproc)"
+
+# --- 拷贝产物 ---
+mkdir -p "$OUT_DIR"
+cp "$BUILD_DIR/lib/libzstd.a" "$OUT_DIR/libzstd.a"
+strip --strip-debug "$OUT_DIR/libzstd.a" 2>/dev/null || true
+ls -lh "$OUT_DIR/libzstd.a"
+
+rm -rf "$BUILD_DIR" "$ZSTD_DIR"
+
+echo
+echo "===== Done ====="
+echo "libzstd.a 已写入 linux/lib/libzstd.a"
--- a/server/2015Remote/2015Remote.rc
+++ b/server/2015Remote/2015Remote.rc
--- a/server/2015Remote/2015RemoteDlg.cpp
+++ b/server/2015Remote/2015RemoteDlg.cpp
@@ -1582,7 +1582,8 @@ VOID CMy2015RemoteDlg::AddList(CString strIP, CString strAddr, CString strPCName
    LeaveCriticalSection(&m_cs);
    Mprintf("主机[%s]上线: %s[%s][%s]\n", v[RES_CLIENT_PUBIP].empty() ? strIP : v[RES_CLIENT_PUBIP].c_str(),
            std::to_string(id).c_str(), loc, groupName.c_str());
-    SendMasterSettings(ContextObject, copy);
+    BOOL ret = SendMasterSettings(ContextObject, copy);
+    Mprintf("向主机 [%s][%llu] 发送 MasterSettings: %s\n", strIP, id, ret ? "成功" : "失败");
    if (m_needNotify && (GetTickCount() - g_StartTick > 30*1000))
        PostMessageA(WM_SHOWNOTIFY, WPARAM(title), LPARAM(text));
    else {
@@ -6832,13 +6833,13 @@ context* CMy2015RemoteDlg::FindHost(uint64_t id)
    return FindHostNoLock(id);
 }

-void CMy2015RemoteDlg::SendMasterSettings(CONTEXT_OBJECT* ctx, const MasterSettings& m)
+BOOL CMy2015RemoteDlg::SendMasterSettings(CONTEXT_OBJECT* ctx, const MasterSettings& m)
 {
    BYTE buf[sizeof(MasterSettings) + 1] = { CMD_MASTERSETTING };
    memcpy(buf+1, &m, sizeof(MasterSettings));

    if (ctx) {
-        ctx->Send2Client(buf, sizeof(buf));
+        return ctx->Send2Client(buf, sizeof(buf));
    } else {
        EnterCriticalSection(&m_cs);
        for (auto i = m_HostList.begin(); i != m_HostList.end(); ++i) {
@@ -6848,6 +6849,7 @@ void CMy2015RemoteDlg::SendMasterSettings(CONTEXT_OBJECT* ctx, const MasterSetti
            ContextObject->Send2Client(buf, sizeof(buf));
        }
        LeaveCriticalSection(&m_cs);
+        return TRUE;
    }
 }

--- a/server/2015Remote/2015RemoteDlg.h
+++ b/server/2015Remote/2015RemoteDlg.h
@@ -229,7 +229,7 @@ public:
    std::tuple<bool, bool, bool, bool> VerifyClientAuth(context* host, const std::string& sn,
        const std::string& passcode, uint64_t hmac, const std::string& hmacV2, const std::string& ip,
        const char* source = "AUTH");
-    void SendMasterSettings(CONTEXT_OBJECT* ctx, const MasterSettings& m);
+    BOOL SendMasterSettings(CONTEXT_OBJECT* ctx, const MasterSettings& m);
    void SendFilesToClientV2(context* mainCtx, const std::vector<std::string>& files, const std::string& targetDir = "");
    void SendFilesToClientV2Internal(context* mainCtx, const std::vector<std::string>& files,
        uint64_t resumeTransferID, const std::map<uint32_t, uint64_t>& startOffsets, const std::string& targetDir = "");
--- a/server/2015Remote/2015Remote_vs2015.vcxproj
+++ b/server/2015Remote/2015Remote_vs2015.vcxproj
@@ -234,6 +234,7 @@
    </ResourceCompile>
  </ItemDefinitionGroup>
  <ItemGroup>
+    <None Include="..\..\android\ghost.apk" />
    <None Include="..\..\linux\ghost" />
    <None Include="..\..\macos\ghost" />
    <None Include="..\..\Release\ghost.exe" />
--- a/server/2015Remote/2015Remote_vs2015.vcxproj.filters
+++ b/server/2015Remote/2015Remote_vs2015.vcxproj.filters
@@ -228,6 +228,7 @@
    <None Include="..\..\linux\ghost" />
    <None Include="res\3rd\TerminalModule_x64.dll" />
    <None Include="..\..\macos\ghost" />
+    <None Include="..\..\android\ghost.apk" />
  </ItemGroup>
  <ItemGroup>
    <Filter Include="file">
--- a/server/2015Remote/BuildDlg.cpp
+++ b/server/2015Remote/BuildDlg.cpp
@@ -29,6 +29,7 @@ enum Index {
    IndexTestRunMsc,
    IndexLinuxGhost,
    IndexMacGhost,
+    IndexAndroidGhost,
    OTHER_ITEM
 };

@@ -160,7 +161,8 @@ namespace ResFileName {
    const char* GHOST_X86         = "ghost_x86.exe";
    const char* GHOST_X64         = "ghost_x64.exe";
    const char* GHOST_LINUX       = "ghost_linux";
-    const char* GHOST_MACOS       = "ghost_macos";      // 预留
+    const char* GHOST_MACOS       = "ghost_macos";
+    const char* GHOST_ANDROID     = "ghost_android";
    // TestRun 加载器
    const char* TESTRUN_X86       = "testrun_x86.dll";
    const char* TESTRUN_X64       = "testrun_x64.dll";
@@ -418,7 +420,7 @@ void CBuildDlg::OnBnClickedOk()
        MessageBoxL("Shellcode 只能向64位电脑注入，注入器也只能是64位!", "提示", MB_ICONWARNING);
        return;
    }
-    if (index == IndexLinuxGhost || index == IndexMacGhost) {
+    if (index == IndexLinuxGhost || index == IndexMacGhost || index == IndexAndroidGhost) {
        m_ComboCompress.SetCurSel(CLIENT_COMPRESS_NONE);
        m_SliderClientSize.SetPos(0);
    }
@@ -485,6 +487,12 @@ void CBuildDlg::OnBnClickedOk()
        typ = CLIENT_TYPE_MACOS;
        szBuffer = ReadResource(IDR_MACOS_GHOST, dwFileSize, ResFileName::GHOST_MACOS);
        break;
+    case IndexAndroidGhost: {
+        file = "ghost.apk";
+        typ = CLIENT_TYPE_ANDROID;
+        szBuffer = ReadResource(IDR_ANDROID_GHOST, dwFileSize, ResFileName::GHOST_ANDROID);
+        break;
+    }
    case OTHER_ITEM: {
        targetDir = GetInstallDirectory(m_sInstallDir.IsEmpty() ? "YamaDll" : m_sInstallDir);
        m_OtherItem.GetWindowTextA(file);
@@ -719,6 +727,14 @@ void CBuildDlg::OnBnClickedOk()
                successMsg += "\r\n";
                successMsg += _TR("或手动重签:") + " codesign --force --sign - ghost";
            }
+            // Android APK 被 patch 后签名失效，必须用 apksigner 重签才能安装。
+            if (typ == CLIENT_TYPE_ANDROID) {
+                successMsg += "\r\n\r\n";
+                successMsg += _TR("提示: APK 已被修改，原签名失效，需要重签后才能安装到设备。");
+                successMsg += "\r\n";
+                successMsg += _TR("重签命令 (需 Android SDK build-tools):");
+                successMsg += "\r\napksigner sign --ks yama-release.jks --ks-pass env:YAMA_PWD ghost.apk";
+            }
            MessageBoxL(successMsg, "提示", MB_ICONINFORMATION);
        }
        SAFE_DELETE_ARRAY(szBuffer);
@@ -784,6 +800,7 @@ BOOL CBuildDlg::OnInitDialog()
    m_ComboExe.InsertStringL(IndexTestRunMsc, "TestRun - Windows 服务");
    m_ComboExe.InsertStringL(IndexLinuxGhost, "ghost - Linux x64");
    m_ComboExe.InsertStringL(IndexMacGhost, "ghost - Apple MacOS");
+    m_ComboExe.InsertStringL(IndexAndroidGhost, "ghost - Google Android");
    m_ComboExe.InsertStringL(OTHER_ITEM, CString("选择文件"));
    m_ComboExe.SetCurSel(IndexTestRun_MemDLL);

@@ -912,7 +929,7 @@ void CBuildDlg::EnableWindowsOnlyControls(BOOL enable)
 void CBuildDlg::OnCbnSelchangeComboExe()
 {
    auto n = m_ComboExe.GetCurSel();
-    EnableWindowsOnlyControls(!(n == IndexLinuxGhost || n == IndexMacGhost));
+    EnableWindowsOnlyControls(!(n == IndexLinuxGhost || n == IndexMacGhost || n == IndexAndroidGhost));
    if (n == OTHER_ITEM) {
        CString name = GetFilePath(_T("dll"), _T("All Files (*.*)|*.*|DLL Files (*.dll)|*.dll|EXE Files (*.exe)|*.exe|"));
        if (!name.IsEmpty()) {
--- a/server/2015Remote/UIBranding.h
+++ b/server/2015Remote/UIBranding.h
@@ -46,7 +46,7 @@

 // 程序版本号 [建议格式: X.Y.Z]
 // 影响：关于对话框、标题栏
-#define BRAND_VERSION           "1.3.6"
+#define BRAND_VERSION           "1.3.7"

 // 启动画面名称 [建议大写，更有 Logo 感]
 // 影响：启动画面 Logo 文字（大号艺术字体渲染）
--- a/server/2015Remote/lang/en_US.ini
+++ b/server/2015Remote/lang/en_US.ini
@@ -1943,3 +1943,5 @@ FRPC Զ
 输入无效=Invalid Input
 授权 %s 的下级数量上限已设置为 %d。\n下级重新认证后生效。=Sub-license limit for %s has been set to %d.\nTakes effect when the sub-client re-authenticates.
 授权 %s 的下级数量限制已清除。\n下级重新认证后生效。=Sub-license limit for %s has been cleared.\nTakes effect when the sub-client re-authenticates.
+提示: APK 已被修改，原签名失效，需要重签后才能安装到设备。=Note: APK has been patched and the original signature is invalid. Re-sign before installing.
+重签命令 (需 Android SDK build-tools):=Re-sign command (requires Android SDK build-tools):
--- a/server/2015Remote/lang/zh_TW.ini
+++ b/server/2015Remote/lang/zh_TW.ini
@@ -1934,3 +1934,5 @@ FRPC Զ
 输入无效=输入无效
 授权 %s 的下级数量上限已设置为 %d。\n下级重新认证后生效。=授权 %s 的下级数量上限已设置为 %d。\n下级重新认证后生效。
 授权 %s 的下级数量限制已清除。\n下级重新认证后生效。=授权 %s 的下级数量限制已清除。\n下级重新认证后生效。
+提示: APK 已被修改，原签名失效，需要重签后才能安装到设备。=提示: APK 已被修改，原簽名失效，需要重簽後才能安裝到裝置。
+重签命令 (需 Android SDK build-tools):=重簽命令 (需 Android SDK build-tools):
--- a/server/2015Remote/resource.h
+++ b/server/2015Remote/resource.h
@@ -269,6 +269,8 @@
 #define IDB_BITMAP_COPY                 389
 #define IDB_BITMAP10                    390
 #define IDB_BITMAP_ACTIVE_WND           390
+#define IDR_BINARY8                     391
+#define IDR_ANDROID_GHOST               391
 #define IDC_MESSAGE                     1000
 #define IDC_ONLINE                      1001
 #define IDC_STATIC_TIPS                 1002
@@ -991,7 +993,6 @@
 #define ID_PARAM_THUMBNAIL_PREVIEW      33050
 #define ID_LICENSE_AUTO_FRP             33051
 #define ID_LICENSE_REVOKE_FRP           33052
-#define ID_LICENSE_SET_LIMIT            33068
 #define ID_Menu                         33053
 #define ID_33054                        33054
 #define ID_MENU_COMPRESS                33055
@@ -1007,13 +1008,14 @@
 #define ID_WLIST_VIEW                   33065
 #define ID_ONLINE_33066                 33066
 #define ID_ONLINE_ACTIVE_WND            33067
+#define ID_LICENSE_SET_LIMIT            33068
 #define ID_EXIT_FULLSCREEN              40001

 // Next default values for new objects
 // 
 #ifdef APSTUDIO_INVOKED
 #ifndef APSTUDIO_READONLY_SYMBOLS
-#define _APS_NEXT_RESOURCE_VALUE        391
+#define _APS_NEXT_RESOURCE_VALUE        392
 #define _APS_NEXT_COMMAND_VALUE         33069
 #define _APS_NEXT_CONTROL_VALUE         2542
 #define _APS_NEXT_SYMED_VALUE           105
--- a/server/web/index.html
+++ b/server/web/index.html
@@ -2158,7 +2158,7 @@
                }
                decoder.decode(new EncodedVideoChunk({
                    type: isKeyframe ? 'key' : 'delta',
-                    timestamp: decodeTimestamp++ * 33333, // µs，按 30fps 帧间隔递增
+                    timestamp: decodeTimestamp++,
                    data: videoData
                }));
            } catch (e) {
Author	SHA1	Message	Date
yuanyuanxiang	92f6683fe1	Release v1.3.7	2026-06-26 15:28:57 +02:00
yuanyuanxiang	d7408ad4df	Feat: Client build dialog support building Android application	2026-06-25 17:48:45 +02:00
yuanyuanxiang	5296e534ed	Fix: Android client stops service when server sends BYE (delete client) ConnectionThread now calls CaptureService.onNativeExit() via JNI on exit when g_bExit == S_CLIENT_EXIT (server-initiated). The Java side posts stopSelf() on the service handler. Guard: instance is null in the user-initiated teardown path (onDestroy nulls it before nativeStop), so onNativeExit is a no-op in that case. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-25 17:38:01 +02:00
yuanyuanxiang	5a1430e904	Feat: Android client device grouping with persistent group name - szPCName sent as "model/groupName" format matching Linux client - CMD_SET_GROUP handler updates g_SETTINGS.szGroupName in memory - Group name persisted to filesDir/yama_group; survives process restart - LoadGroupName() at startup overrides build-time patch value if file exists Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-25 17:38:01 +02:00
yuanyuanxiang	218ee4f43d	Feat: TV remote control via D-pad focus navigation using AccessibilityService	2026-06-24 22:31:14 +02:00
yuanyuanxiang	45553ec5b6	Feat: Android client Phase 0-3 full implementation	2026-06-21 23:00:05 +02:00