docs(huya): R19 turing运行时路线终态 — 专项交接资产齐备

- turing类定位(ga果汁混淆系) + Java载荷hook零触发(=全native, 路线关闭) - 静态密钥假设否定; 流式密文实锤 - 交接: 密文x3/请求全文/组件/工具/触发方法全收录 (docs §11.49)
2026-08-29 06:29:34 +08:00
parent 021cd636c8
commit 0944e9c86b
4 changed files with 85 additions and 0 deletions
@@ -0,0 +1,2 @@
+{"event": "turing-classes", "list": ["android.text.util.-$$Lambda$Linkify$7J_-cMhIF2bcttjkxA2jDFP8sKw", "java.security.spec.ECFieldFp", "com.tencent.turingfd.sdk.ams.ga.Lemon", "com.tencent.turingfd.sdk.ams.ga.Sultana$do", "com.tencent.turingfd.sdk.ams.ga.Blueberry$do", "com.tencent.turingfd.sdk.ams.ga.Solar$if", "com.tencent.turingfd.sdk.ams.ga.Segment", "com.tencent.turingfd.sdk.ams.ga.Pineapple", "com.tencent.turingfd.sdk.ams.ga.Cumquat$do", "com.tencent.turingfd.sdk.ams.ga.Perseus", "com.tencent.turingfd.sdk.ams.ga.default", "com.tencent.turingfd.sdk.ams.ga.White", "com.tencent.turingfd.sdk.ams.ga.Nectarine$if$do", "com.tencent.turingfd.sdk.ams.ga.Rambutan", "com.tencent.turingfd.sdk.ams.ga.Sultana$if", "com.tencent.turingfd.sdk.ams.ga.Guava", "com.tencent.turingfd.sdk.ams.ga.Pitaya", "com.tencent.turingfd.sdk.ams.ga.Bryony", "com.tencent.turingfd.sdk.ams.ga.Core", "com.tencent.turingfd.sdk.ams.ga.Solar", "com.tencent.turingfd.sdk.ams.ga.native", "com.tencent.turingfd.sdk.ams.ga.Shaddock", "com.tencent.turingfd.sdk.ams.ga.synchronized", "com.tencent.turingfd.sdk.ams.ga.Pistachio", "com.tencent.turingfd.sdk.ams.ga.Sorosis", "com.tencent.turingfd.sdk.ams.ga.Pineapple$do", "com.tencent.turingfd.sdk.ams.ga.Quarenden$do", "com.tencent.turingfd.sdk.ams.ga.Flat", "com.tencent.turingfd.sdk.ams.ga.Auriga", "com.tencent.turingfd.sdk.ams.ga.private"]}
+{"event": "turing-hooks-done", "n": 0}
@@ -0,0 +1,2 @@
+{"event": "turing-classes", "list": ["android.text.util.-$$Lambda$Linkify$7J_-cMhIF2bcttjkxA2jDFP8sKw", "java.security.spec.ECFieldFp", "com.tencent.turingfd.sdk.ams.ga.Lemon", "com.tencent.turingfd.sdk.ams.ga.Sultana$do", "com.tencent.turingfd.sdk.ams.ga.Blueberry$do", "com.tencent.turingfd.sdk.ams.ga.Solar$if", "com.tencent.turingfd.sdk.ams.ga.Segment", "com.tencent.turingfd.sdk.ams.ga.Pineapple", "com.tencent.turingfd.sdk.ams.ga.Cumquat$do", "com.tencent.turingfd.sdk.ams.ga.Perseus", "com.tencent.turingfd.sdk.ams.ga.default", "com.tencent.turingfd.sdk.ams.ga.White", "com.tencent.turingfd.sdk.ams.ga.Nectarine$if$do", "com.tencent.turingfd.sdk.ams.ga.Rambutan", "com.tencent.turingfd.sdk.ams.ga.Sultana$if", "com.tencent.turingfd.sdk.ams.ga.Guava", "com.tencent.turingfd.sdk.ams.ga.Pitaya", "com.tencent.turingfd.sdk.ams.ga.Bryony", "com.tencent.turingfd.sdk.ams.ga.Core", "com.tencent.turingfd.sdk.ams.ga.Solar", "com.tencent.turingfd.sdk.ams.ga.native", "com.tencent.turingfd.sdk.ams.ga.Shaddock", "com.tencent.turingfd.sdk.ams.ga.synchronized", "com.tencent.turingfd.sdk.ams.ga.Pistachio", "com.tencent.turingfd.sdk.ams.ga.Sorosis", "com.tencent.turingfd.sdk.ams.ga.Pineapple$do", "com.tencent.turingfd.sdk.ams.ga.Quarenden$do", "com.tencent.turingfd.sdk.ams.ga.Flat", "com.tencent.turingfd.sdk.ams.ga.Auriga", "com.tencent.turingfd.sdk.ams.ga.private"]}
+{"event": "turing-hooks-done", "n": 14}
@@ -0,0 +1,58 @@
+'use strict';
+function emit(row) { try { send(row); } catch (e) {} }
+setTimeout(() => {
+  try {
+    Java.perform(() => {
+      const found = [];
+      Java.enumerateLoadedClasses({
+        onMatch(name) {
+          if (/Turing|turing|DFp|Dfp|dfp/i.test(name)) found.push(name);
+        },
+        onComplete() {
+          emit({ event: 'turing-classes', list: found.slice(0, 30) });
+          const hooked = {};
+          for (const cn of found.slice(0, 20)) {
+            try {
+              const K = Java.use(cn);
+              const ms = K.class.getDeclaredMethods();
+              for (const m of ms) {
+                const mn = m.getName();
+                const pt = m.getParameterTypes();
+                const hasPayload = Array.from(pt).some(t => ['byte[]','java.lang.String','[B','java.util.Map'].indexOf(t.getName()) >= 0);
+                if (!hasPayload) continue;
+                const dsc = m.toGenericString ? m.toGenericString().slice(0, 120) : mn;
+                try {
+                  K[mn].overloads.forEach(ov => {
+                    const key = cn + '#' + mn + '#' + ov.argumentTypes.length;
+                    if (hooked[key]) return;
+                    hooked[key] = true;
+                    ov.implementation = function () {
+                      try {
+                        const args = Array.from(arguments).map((a, ix) => {
+                          try {
+                            if (a === null || a === undefined) return String(a);
+                            if (ov.argumentTypes[ix] && ov.argumentTypes[ix].className === 'byte[]') {
+                              const arr = Java.array('byte', a);
+                              return 'byte[' + arr.length + ']:' + Array.from(arr.slice(0, 60)).map(b => (b & 0xff).toString(16).padStart(2, '0')).join('');
+                            }
+                            const s = String(a);
+                            return s.length > 120 ? s.slice(0, 60) + '…(' + s.length + ')' : s;
+                          } catch (e2) { return '<a>'; }
+                        });
+                        emit({ event: 'turing-jni', cls: cn, method: mn, nArgs: args.length, args: args.slice(0, 5) });
+                      } catch (e3) {}
+                      return ov.apply(this, arguments);
+                    };
+                  });
+                } catch (e4) {}
+              }
+            } catch (e5) {}
+          }
+          emit({ event: 'turing-hooks-done', n: Object.keys(hooked).length });
+        },
+      });
+    });
+  } catch (e) {
+    emit({ event: 'turing-err', msg: String(e).slice(0, 200) });
+  }
+}, 3500);