feat(huya): OTP内部串池取证 - MsgRegSendSms协议标签现形(登录/注册请求加密器)+双钥相邻

2026-08-29 01:23:52 +08:00
parent a8aebfed40
commit 1dd67a36d7
2 changed files with 23 additions and 1 deletions
@@ -179,6 +179,20 @@ public class AesProbe {
        return "";
    }

+    void dumpRegion(String tag, long addr, long size) {
+        UnidbgPointer pp = UnidbgPointer.pointer(emulator, addr);
+        if (pp == null) { System.out.println("[dump] " + tag + " null"); return; }
+        byte[] buf = new byte[(int) size];
+        try { pp.read(0, buf, 0, buf.length); } catch (Throwable t) { System.out.println("[dump] " + tag + " err " + t); return; }
+        StringBuilder sb = new StringBuilder();
+        for (int i = 0; i < buf.length; i++) {
+            byte b = buf[i];
+            sb.append(String.format("%02x", b & 0xff));
+            if ((i + 1) % 16 == 0) sb.append(' ');
+        }
+        System.out.println("[dump] " + tag + " (" + size + "B): " + sb);
+    }
+
    void scanMemoryForKeys() {
        byte[] needle = "ZMHAVPRaxJ3MtXDjduUnXAKQ".getBytes(java.nio.charset.StandardCharsets.ISO_8859_1);
        long[] ranges = {0x0L, 0x1000000L, 0x40000000L, 0x80000000L, 0x100000000L, 0x300000000L, 0x70200000L};
@@ -365,7 +379,8 @@ public class AesProbe {
        p.callOtp("1e8bdf7d4f7a01d3" + "13.4.22" + "1.0.80138" + "127.0.0.1" + "xiaomi", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
        p.callOtp("5008" + "13.4.22" + "1.0.80138", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
        p.callOtp("ed0db8334cadd236c00cadf7e11ab5a5", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
-        p.scanMemoryForKeys();
+        p.dumpRegion("0x127ddbe0", 0x127ddf00L, 0x420);
+        p.dumpRegion("0x127ddf00", 0x127ddf00L, 0x200);
        p.emulator.close();
    }
 }