From 200130f8ce122d12ad038f6b1ab1263b3c2f00ae Mon Sep 17 00:00:00 2001 From: yml2213 Date: Fri, 28 Aug 2026 22:50:49 +0800 Subject: [PATCH] =?UTF-8?q?feat(huya):=20=C2=A711.11=20=E6=A0=87=E8=AF=86?= =?UTF-8?q?=E7=AC=A6=E5=85=A8=E6=B8=85=E5=8D=95=E5=8E=BB=E6=B7=B7=20-=20?= =?UTF-8?q?=E7=99=BB=E5=BD=95hdid(L1)=E4=B8=8EGUID(G1)=E4=BD=93=E7=B3=BB?= =?UTF-8?q?=E6=97=A0=E5=85=B3=E5=AE=9A=E8=AE=BA(=E6=89=8B=E6=9C=BA?= =?UTF-8?q?=E8=87=AA=E8=BA=ABGUID=E4=B9=9F=E8=A2=AB=E6=8B=92),=2032hex-hdi?= =?UTF-8?q?d=E7=94=9F=E6=88=90=E5=87=BD=E6=95=B0=E6=9C=AA=E5=AE=9A?= =?UTF-8?q?=E4=BD=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 决定性实验: hdid=0a7dfa(手机当前GUID)→APP_SIGN / ed0db8→1571B cred - 清单: G1/L1/D1/D2/D3/M1 六标识符逐一核实来源与可铸性 --- docs/HUYA_HDID_ALGORITHM_GEN.md | 30 +++++++++++++++++++++ evidence/mint/login_golden_hdid_2.bin | Bin 0 -> 1571 bytes evidence/mint/login_minted_hdid_2.bin | Bin 0 -> 652 bytes evidence/mint/login_phone_current_GUID.bin | Bin 0 -> 652 bytes 4 files changed, 30 insertions(+) create mode 100644 evidence/mint/login_golden_hdid_2.bin create mode 100644 evidence/mint/login_minted_hdid_2.bin create mode 100644 evidence/mint/login_phone_current_GUID.bin diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md index d1e2a5c..c5085d4 100644 --- a/docs/HUYA_HDID_ALGORITHM_GEN.md +++ b/docs/HUYA_HDID_ALGORITHM_GEN.md @@ -442,3 +442,33 @@ mid = LiveUserbase→tUAEx→t5=sMId (16hex)，**可任意铸造** → doLaunch - 推论: hdid-cert = 设备首次初始化时 native(私钥)签名 + 服务端侧存档; 服务端按"该 hdid 是否存在于注册设备库"校验 (APP_SIGN)。无上行明文通道可抓, 纯代码复刻 = 需 unidbg 重放 native 签名 (AESkeyMgr/bigaes 钥表线索已记录)。 + +## §11.11 标识符全清单与去混 (2026-08-28 夜, 用户要求彻底厘清) + +### 设备上/证据中的全部 hex 标识 (逐一核实) +| # | 值 | 长度 | 角色 | 来源/渠道 | 可铸造? | +|---|---|---|---|---|---| +| G1 | `0a7dfaa882938a6ab502511452142c57` | 32 | **GUID/sGuid**: HySignalGUIDCache.xml + hysignalconfigcache 双处一致 | doLaunch 按 mid 签发 (mid=1e8bdf7d=手机当前mid) | ✅ **可铸** (§11.8) | +| L1 | `ed0db8334cadd236c00cadf7e11ab5a5` | 32 | **登录 hdid** (WUP hypasswordLogin t1.t0) = GOLDEN | native 生成 + setDeviceInfo 上报, 不上行明文 (§11.10) | ❌ **纯Python不可铸** | +| D1 | `5b434c778490889697170e225029f56aff19ca47` | 40 | HYSIGNAL_DEVICE_ID_KEY (当前手机) | hysignal 缓存 | ? (未研究) | +| D2 | `7c5387e0539c023c31c4ff0e807e7256117385ee` | 40 | 登录帧 t2.t8 device_id (GOLDEN) = 库 getHDID 期望 | libhydeviceid getHDID@0x20f0c8 | unidbg 可调 | +| D3 | `02df398797432eadefcc12767119ad5e80999389` | 40 | CDID (库 getCDID 期望) | libhydeviceid | unidbg 可调 | +| M1 | `1e8bdf7d4f7a01d3` | 16 | mid (库 getMID 期望 = 手机当前 mid = 铸币默认 mid) | libhydeviceid getMID@0x20fba8 | ✅ 可铸 (任意16hex) | + +### 当前在搞哪一个 (定论) +**登录帧 t1.t0 的 32hex hdid (L1)** —— 它就是目标。决定性实验 (金样本账号, +仅换 hdid): 手机当前 GUID (G1) 作 hdid ❌ 被拒; 金样本 hdid (L1) ✅ 出 cred。 + +### 已完成 / 未完成 +- ✅ doLaunch 铸币机: sGuid (G1 系) = f(mid), 确定性, live 多次复现 +- ✅ 零设备注册链: 每账号新鲜 action/device_id (t2/t5) +- ✅ 登录管线: 金样本 hdid + 新鲜 action → 1571B cred (纯 Python 出 cred 全链路通) +- ❌ **登录 hdid (L1) 的纯代码铸造**: 与 GUID 无关 (手机自己的 G1 也被拒); + 它只存在于登录帧 + native 内存 (setSafeDeviceId), 无 HTTP 签发通道 (§11.10 全链路不可见) +- ❌ unidbg 重放 32hex-hdid 生成: 库已定位 getGUID/getCDID/getHDID(40hex)/getMID, + **32hex 登录-hdid 的生成函数尚未定位** (getHDID 是 40hex, 非登录 hdid) + +### 下步(未完成工作) +1. libhydeviceid 内定位 32hex-hdid 生成函数 (unidbg 枚举 32hex 返回的导出/偏移) +2. 若存在: 输入=?(androidId/config/MID 模型已有) → 铸币设备独立 hdid → 登录 +3. 若不存在: 登录 hdid = 设备级私钥证书, 纯代码不可达 → 每账号独立设备需真机/模拟器池 diff --git a/evidence/mint/login_golden_hdid_2.bin b/evidence/mint/login_golden_hdid_2.bin new file mode 100644 index 0000000000000000000000000000000000000000..96d194149b6e14e6532d6c5d52dba362ae259317 GIT binary patch literal 1571 zcmd^9{cjUx9KUv3$6j#bWhLT5wT}yl2*0tT%7trq7Uf`wh#-)`KrqpWlPNC?kU?N$W*dnI`V0OGKEFJ9o;=^r z=kt8OpL_s7Ft0dE1Ou&A0KEHgQ=x}Vk*w36pzN&IRpd#9Nrp+#QD+V9_J&#jUe47i zK$ZX~0{~v3AkUUy!!{=wBg+6@_Nn}QfG5m?7eVFyt3j@gc6iB{mkw#1U?m3QhzNAC zAx9kKhU5EbVq463|7J-(90D_ARHBe48<@U0$7QNrLYXgxtkdE&m$)04FsOc z0xMl)fT2WSEJ`}4XKWy3$6OGOxm+>{DYZKt6=Fn!A{Dp<#SjcZPz;sgQWzCWq%g-E zONBW}oIds$GsNu-6;;ro7?q51U|`Eq72x20+@=0`axe}Q%+BHtv-Bq@dIkW@1!nFX zE-Nqeq-+QTL1F~M&}9G+&2Meny<%SJcl}LT`6>x~Y+;{E%(VsHi1s_Zf7(VMC&S~Co zwPg{mzjkKT!9o6e>Q~Nfy}fXHYOwyJS(^u2cNHz~`rw-U>#<{NR&Dxp!`&@>PqTl) zcr@KRVUjLR)@3$M3C1rkS#$G~Lth{_+)q5NB`oI4n=lx0N zNP$%_6^3zKCX?Z?M25n`7us0<%uFcPYqMN0*ZajmL`M_hCZ*fR=#rGDk&vl0YP$p# zSFl=!tcs+xRD?jS@qnq;P^C4+tWJ5Irorc^G8*EkFj|{%27|I-T-oRfR1>Jr5Yfvu zI@(;3Hd_e0%c%2)RR*O4XCqp;R)gBC1OZt*VcdoKoEERjV3nDjm?G*_C}TB}xLHPc zHLOOPwyC{xR_amu{XP%ov(VZ|QXx~BHC|VfMh=riES*S4tPwgCZ_q~7eiEhX6^xzK zHP%Ox^%{t(GbvCbg!pNP&ZHzlh@PPXF|&ciA_UtYu5H8;=?Y7eqgrZ#0wFVr)p)H| zL}8Na8bVH~HBhHf8cce%6j7UM!je$h9ZD(^Ze6us8=`|@e}hGf>0w;0tO+~3>Z%0n zkN8-^UhS?`s%Vpn2N$@eLJ++0`9h^)N&CM>zuwuE_XY19z!T)L4jU6AV-zFg!B>H7 z04VJ(HQwMqDSBaAPl|yj(|`iJu$D95m;75Fe|u>?|DJOdwASTbvatEJBW)#mPAbX;8Zh*K$+M2_h5NZVPd92-)X8gXMx~)iqfpum$_611`WvCDGB5xD literal 0 HcmV?d00001 diff --git a/evidence/mint/login_minted_hdid_2.bin b/evidence/mint/login_minted_hdid_2.bin new file mode 100644 index 0000000000000000000000000000000000000000..ea828722c199256b2bc5a21445723ef17e55ed77 GIT binary patch literal 652 zcmeH@y-vbV7=}-6QU#i57}!|O;8aWxZRt;3kf4$v5+JP2X?qGyYTNWjB!N-{TS#r8?cvl5gN_3Y z4e62q-7K(s_=-RS{z--coWx-kK?4cUqXt>jRRJa>NoWEzq`HC{x=xjp{5~bA=lk1L z&~UMz5CNt!wn^RwMN4xuAhj+lh&HG5h)$yW zvb4 literal 0 HcmV?d00001 diff --git a/evidence/mint/login_phone_current_GUID.bin b/evidence/mint/login_phone_current_GUID.bin new file mode 100644 index 0000000000000000000000000000000000000000..ea828722c199256b2bc5a21445723ef17e55ed77 GIT binary patch literal 652 zcmeH@y-vbV7=}-6QU#i57}!|O;8aWxZRt;3kf4$v5+JP2X?qGyYTNWjB!N-{TS#r8?cvl5gN_3Y z4e62q-7K(s_=-RS{z--coWx-kK?4cUqXt>jRRJa>NoWEzq`HC{x=xjp{5~bA=lk1L z&~UMz5CNt!wn^RwMN4xuAhj+lh&HG5h)$yW zvb4 literal 0 HcmV?d00001