yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(huya): decode全11钥=全二进制垃圾 - appSign钥∉已知目录, 方向修正(找hdid真生产方)

Browse Source
This commit is contained in:
yml2213
2026-08-29 01:29:23 +08:00
parent 1dd67a36d7
commit 26dc74a661
2 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/unidbg/hydev/src/hydev/AesProbe.java
+20
View File
@@ -311,6 +311,22 @@ public class AesProbe {
return -1;
}
String callDecodeAesRawHex(String inHex, String key) {
byte[] inb = new byte[inHex.length()/2];
for (int i = 0; i < inb.length; i++) inb[i] = (byte) Integer.parseInt(inHex.substring(i*2, i*2+2), 16);
UnidbgPointer pin = writeStdString(new String(inb, java.nio.charset.StandardCharsets.ISO_8859_1));
UnidbgPointer pkey = writeStdString(key);
UnidbgPointer pout = writeStdString("");
try {
module.callFunction(emulator, 0x330498L, UnidbgPointer.nativeValue(pin), UnidbgPointer.nativeValue(pkey), UnidbgPointer.nativeValue(pout));
String out = readStdString(pout);
// out 可能是 ASCII-hex (或原始字节) -> 双解释
String asHex = toHex(out);
System.out.println("[decode-hex] key=" + key + " ascii32hex=" + out + " rawOut=" + asHex);
} catch (Throwable t) { System.out.println("[decode-hex] err " + t); }
return "";
}
void dumpKeyMgr() {
UnidbgPointer self = emulator.getMemory().malloc(0x80, false).getPointer();
self.write(0, new byte[0x80], 0, 0x80);
@@ -375,6 +391,10 @@ public class AesProbe {
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "4VYcPdvKKqjBHZtCmbroRXHk");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "xXEDWqiKLGwEZ6HubEiswCqK");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "3FMHubdKosFrhmXNLHTNHZwe");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "ybEWdvkjGjPQa2ugireHJCLL");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "HuyaUdb1928374650qwertyuiop");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "xXEDWqiKLGwEZ6HubEiswCqK");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "4VYcPdvKKqjBHZtCmbroRXHk");
// 设备材料 OTP 对拍 (appSign = OTP(设备材料)?)
p.callOtp("1e8bdf7d4f7a01d3" + "13.4.22" + "1.0.80138" + "127.0.0.1" + "xiaomi", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
p.callOtp("5008" + "13.4.22" + "1.0.80138", "ZMHAVPRaxJ3MtXDjduUnXAKQ");