feat(huya): 全链路终局验证通过 - 活体cred采集+铸证+绑定闭环
This commit is contained in:
@@ -160,3 +160,11 @@ saveLoginData bean(1536B dump)=C++对象, cred在堆上经指针引用, 非内
|
||||
-> onLeave 读 out(x2) std::string 即152字符hyCred原文。
|
||||
scripts/hook_beandump.py 已建(时序模板可复用), 下轮改钩子地址重跑一次登录即得。
|
||||
另: 响应JSON键已确认含"cred"键(0x1c36e8)。
|
||||
|
||||
## ★ 终局验证(全链路)
|
||||
|
||||
活体采集(桥调getCred,零重登) -> hyCred(CiAXHUiF.../114B)
|
||||
-> cert_forge 铸新证书 -> bindQrLoginUser stage=2
|
||||
-> tryQrLogin uid=1199666914671 + biztoken344B ✅
|
||||
多账号流程定型: 每号设备登录一次+桥采cred入库, 此后永久全自动。
|
||||
纯Python长连接签发客户端(0x1001+JSON)留作后续可选优化, 参数已全部备齐。
|
||||
|
||||
@@ -4,9 +4,9 @@
|
||||
"ok": true,
|
||||
"uid": 1199666914671,
|
||||
"biztoken_len": 344,
|
||||
"biztoken": "AQAFwnM8LGUdBevEHD9p23OYot9Oo5t-Fn5w7_Wll1ct-BL1-E5tEiGUqf6uIEljOfasK301bY-QJYSsC-YXK6yGPcGXaOiudmU_TqlW0r1bFMQEAt4Abkwa9Svcz_KgecGv0tIYmwB-b7xWRhSDSO7AiIBWe9iFN1cIz-jQOl9vF7Mj84AUwYmF16CvKqnHJx-cgceOUXC8GSvioLnumB7EtnPVbsjCfqkTcrG8jvccF_RN7dsVxgTQ_1cTniSHr__yTil2n7L5x2bCUKh4mN7oXxyNjEkpHT4264quUhofp6nNfV_iJeY5bU30-yTXSVNSJby6xpmfO_eDRSfie-PL"
|
||||
"biztoken": "AQA0HB1eLBj6FYHHIIlA18jOJL4M2hm0cVgwCnpQQT6TFZ7kHUyrDPojHYobR5NxwphHBqoCZkSmrzwf1ejbc3dzgZVw6auP1LBFeuzyFyyqJSSamtM0QM09u7vnRdKMZ08_i5fMfyrN6jJGp6qsnQsJf_bJ3kXGGnTcvzqoJoeIQ8hvHTsqoykjXsAJOU2bHTIOTTIKpyRoSbbTVLYg9l19QtQRhKTZfmlJbyahFT_IZi4SGrGRQJn12s53fj8Iep-78FCrNYi0DpjI7UhOxClSl880X7OlZRvhjL_k7eU1oRCWihyGsDCX6WBqvW-NWroc20WYEnMkLyfFf03WToWh"
|
||||
}
|
||||
},
|
||||
"p1_new_hex": "010400353030381400c25220f81f60cf64ee54e83ef1eab6bdd047b5af28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a80a762e4c0ff033fb559c52b94b77d6995ead51d10ebeddf48db7350d1adc2b2b58725edc3353e38940458ac0cf1229abf18488aa5a474ab2770d8739bcb342bcf55dd6eee67e847cad7e4d553a0409d597908193a9c2ee65926a46df4fe741ea72e92e611c665602789c338530990fcda",
|
||||
"ts": 1787643388.3479419
|
||||
"p1_new_hex": "010400353030381400c25220f81f60cf64ee54e83ef1eab6bdd047b5af28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a20171d4885bb9bb40f29517ab490f3634a0640e942e24039e2f471a5a66a0c64662b68c43f64a90ab982d8298bfc5de4e58a0bb6617a7ab8ecc730cde4a28bd828261096ca95b6247bba5e4714395166f9a22eb0c9954e6d0890ba40fa951e70e63c7c4c8e8e5547f6ca029830f31adbe8",
|
||||
"ts": 1787649782.6306071
|
||||
}
|
||||
@@ -99,7 +99,7 @@ def main() -> int:
|
||||
# => 不校验时效。故铸造策略 = 保留原 nonce/指纹, 替换 cred 字段。
|
||||
# 实验 C: 换上 frida_cred_dump 里更早签发的 hyCred(同账号不同轮换值)。
|
||||
# 若 bind 成功 => 铸造机制完全打通(任意有效cred即可铸其证书)。
|
||||
old_cred = json.load(open("/tmp/old_cred.json"))
|
||||
old_cred = json.load(open("evidence/hycred_live.json"))
|
||||
cred_old = bytes.fromhex(old_cred["bin_hex"])
|
||||
P1_new = build_p1(b"5008", fields["fingerprint"], cred_old,
|
||||
rnd=fields["rnd"]) # 原始 nonce
|
||||
|
||||
Reference in New Issue
Block a user