yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

diag(huya): 30K组合爆破零命中 - 差分引擎就绪

Browse Source
This commit is contained in:
yml2213
2026-08-29 02:49:48 +08:00
parent dd883c02d8
commit 23c8b13d01
2 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/unidbg/hydev/src/hydev/AesProbe.java
+32
View File
@@ -176,6 +176,37 @@ public class AesProbe {
return "";
}
void burstOtp() {
String[] S3 = {"", "hy_300023887", "300023887", "772ed992b0e161276f44ec63671e60155c506294",
"1e8bdf7d4f7a01d3", "13.4.22", "1.0.80138", "5008", "xiaomi", "127.0.0.1", "7c5387e0539c023c31c4ff0e807e7256117385ee"};
String[] S5 = {"", "1e8bdf7d4f7a01d3", "00000000000000000000000000000000",
"7c5387e0539c023c31c4ff0e807e7256117385ee",
"hZrPb62GskrEeTYcLeUTL1fJ1OR8ky3x9qXQq0s6ICJV5v9T",
"*hZrPb62GskrEeTYcLeUTL1fJ1OR8ky3x9qXQq0s6ICJV5v9T", "13.4.22", "02df398797432eadefcc12767119ad5e80999389"};
String[] IN = {"0", "1", "3251699", "300023887", "1724464550000", "1724464550", "", "13.4.22"};
long[] CNT = {0, 1, 2, 3};
String G = "ed0db8334cadd236c00cadf7e11ab5a5";
int n = 0, hit = 0;
long t0 = System.currentTimeMillis();
for (String s3 : S3) for (String s4 : S3) for (String s5 : S5) for (String in : IN) for (long cnt : CNT) {
n++;
UnidbgPointer pa = writeStdString(in), ps3 = writeStdString(s3), ps4 = writeStdString(s4), ps5 = writeStdString(s5), pout = writeStdString("");
try {
module.callFunction(emulator, 0x32fa24L,
UnidbgPointer.nativeValue(pa), 2L, cnt,
UnidbgPointer.nativeValue(ps3), UnidbgPointer.nativeValue(ps4), UnidbgPointer.nativeValue(ps5),
4L, 0L, UnidbgPointer.nativeValue(pout));
String out = readStdString(pout);
if (out.length() >= 36) {
String mid = toHex(out).substring(4, 36);
if (mid.equals(G)) { System.out.println("!!! HIT in=" + in + " cnt=" + cnt + " s3=" + s3 + " s4=" + s4 + " s5=" + s5 + " out=" + toHex(out)); hit++; }
}
} catch (Throwable tx) {}
}
long dt = System.currentTimeMillis() - t0;
System.out.println("[burst] n=" + n + " hits=" + hit + " in " + dt + "ms");
}
String callOtp(String a, String b) {
UnidbgPointer pa = writeStdString(a);
UnidbgPointer pb = writeStdString(b);
@@ -636,6 +667,7 @@ public class AesProbe {
p.callOtpReal("0", 1L, "", "", "00000000000000000000000000000000", 0L);
p.callOtpReal("0", 1L, "hy_300023887", "772ed992b0e161276f44ec63671e60155c506294", "00000000000000000000000000000000", 0L);
p.callOtpReal("1724464550000", 0L, "", "", "", 0L);
p.burstOtp();
// 基准: 已知 16B 明文 + 24B 钥
// 64B 钥材料测试 (KeyExpansion 以 16B 步长读!!)
String k64_zmhav = "ZMHAVPRaxJ3MtXDjduUnXAKQ" + "\0".repeat(0);