yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(huya): 复刻15/15全量实证 + DiffProbe上线 + C向量更正(ae26d0)

Browse Source 
- 8组随机明文×随机钥逐字节命中 → 算法零残差
- appSign唯一未知: 钥=getkey双id派生材料(非裸24B)
This commit is contained in:
yml2213
2026-08-29 00:45:03 +08:00
parent fda956beca
commit 1afbd588a7
4 changed files with 73 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/unidbg/hydev/src/hydev/AesProbe.java
+27 -1
View File
@@ -156,6 +156,22 @@ public class AesProbe {
return "";
}
String callDecodeAes(String inHex, String key) {
byte[] inb = new byte[inHex.length()/2];
for (int i = 0; i < inb.length; i++) inb[i] = (byte) Integer.parseInt(inHex.substring(i*2, i*2+2), 16);
UnidbgPointer pin = writeStdString(new String(inb, java.nio.charset.StandardCharsets.ISO_8859_1));
UnidbgPointer pkey = writeStdString(key);
UnidbgPointer pout = writeStdString("");
try {
Number r = module.callFunction(emulator, 0x330498L, UnidbgPointer.nativeValue(pin), UnidbgPointer.nativeValue(pkey), UnidbgPointer.nativeValue(pout));
String out = readStdString(pout);
System.out.println("[decode_aes] key=" + key + " -> " + toHex(out) + " ascii=" + out);
} catch (Throwable t) {
System.out.println("[decode_aes] err " + t);
}
return "";
}
void dumpKeyMgr() {
UnidbgPointer self = emulator.getMemory().malloc(0x80, false).getPointer();
self.write(0, new byte[0x80], 0, 0x80);
@@ -213,7 +229,17 @@ public class AesProbe {
p.callOtp("abcd", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
p.callXxtea("abc", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
p.callMd5Char16("abc");
p.dumpKeyMgr();
// decode_aes@0x330498 (in, key, out) -- 直解 ed0db8
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "owNMiaCgcHmqoTr3iRamFuHj");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "KFWAH2cbkkNgFAgQPzriFPcU");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "4VYcPdvKKqjBHZtCmbroRXHk");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "xXEDWqiKLGwEZ6HubEiswCqK");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "3FMHubdKosFrhmXNLHTNHZwe");
// 设备材料 OTP 对拍 (appSign = OTP(设备材料)?)
p.callOtp("1e8bdf7d4f7a01d3" + "13.4.22" + "1.0.80138" + "127.0.0.1" + "xiaomi", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
p.callOtp("5008" + "13.4.22" + "1.0.80138", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
p.callOtp("ed0db8334cadd236c00cadf7e11ab5a5", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
p.emulator.close();
p.emulator.close();
}
tools/unidbg/hydev/src/hydev/HyDeviceId.java
+3 -1
View File
@@ -158,7 +158,7 @@ public class HyDeviceId extends AbstractJni {
signature.equals("android/provider/Settings$Global->getString(Landroid/content/ContentResolver;Ljava/lang/String;)Ljava/lang/String;")) {
String key = strArg(vaList, 1);
// 应用内实测 ANDROID_ID = MID
String v = key != null && key.equals("android_id") ? "1e8bdf7d4f7a01d3" : null;
String v = key != null && key.equals("android_id") ? System.getProperty("hydev.android_id", "1e8bdf7d4f7a01d3") : null;
System.out.println("[JNI] Settings.getString(" + key + ") -> " + v);
return v == null ? null : new StringObject(vm, v);
}
@@ -344,12 +344,14 @@ public class HyDeviceId extends AbstractJni {
public static void main(String[] args) throws Exception {
String so = args.length > 0 ? args[0] : "so/libhydeviceid_merged.so";
System.setProperty("hydev.android_id", args.length > 1 ? args[1] : "1e8bdf7d4f7a01d3");
HyDeviceId h = new HyDeviceId(so);
h.callInit();
String guid = h.callString(0x20f8c8L, "getGUID");
String cdid = h.callString(0x20eb08L, "getCDID");
String hdid = h.callString(0x20f0c8L, "getHDID");
String mid = h.callString(0x20fba8L, "getMID");
// 32hex 探针: 再调一轮以观察缓存 (若 init 后 getGUID 重取 = 缓存)
h.emulator.close();
System.out.println("=== GOLDEN COMPARE ===");
System.out.println("GUID expect 0a7dfaa882938a6ab502511452142c57 got " + guid + (guid.equals("0a7dfaa882938a6ab502511452142c57") ? " MATCH" : " MISMATCH"));