feat(huya): hook阶段结论 - NativeBridge排除动态JNI与各库RN, 静态物证=内联描述符块; 双库unidbg打通; 设备稳定注意
- 排除: Java_导出扫描/各库dlopen JNI_OnLoad RN拦截/健康进程重触发RN = 全0命中 - unidbg verbose: hydeviceid仅FindClass+NewGlobalRef; udb仅注册HuyaAuthCore - 物证: hydeviceid .data@0x3e21e4 内联方法描述符块(klog/b/c/g/h+getDataDir/getPath) + 类名字符串 - 双库: udb(JNI_OnLoad@0x262620)解密合并 unidbg 加载成功; merge 升级段驱动+动态保留+init_array置零+仅重定位槽清理 - 新输入: udb_deviceID/udb_deviceID_encode/oaid prefs + b(104) + Build.*字段 - 设备稳定: pm clear+frida attach 探测致闪退, 后续禁用; 无frida冷启动健康 - 静态还原重启点: isNative定讫 -> 注册函数(运行期建表模式) 或 Java逻辑; unidbg差分oracle + fnPtr兜底
This commit is contained in:
yml2213
@@ -1,45 +1,112 @@
|
||||
#!/usr/bin/env python3
|
||||
"""把 FULL dump 的解密数据合并进 ORIGINAL .so (元数据完好, unidbg 直接可加载).
|
||||
"""通用解密合并 (v3): 按 PT_LOAD 映射 vaddr<->文件偏移, 把 FULL dump 的解密内存
|
||||
合入 ORIGINAL .so 的正确文件位置; 数据段内陈旧运行期指针清掉.
|
||||
|
||||
关键洞察: unidbg 加载原文件时会自己按 .rela.dyn 重定位(RELATIVE=base+addend,
|
||||
GLOB_DAT/JUMP_SLOT=按符号解析) —— 重定位槽内容会被覆盖, 所以只需要把
|
||||
"非重定位的加密数据"(字符串/密钥/常量)换成解密字节即可.
|
||||
映射: dump 偏移(vaddr 轴) V -> 原文件偏移 = V - 0x1000 (V>=0x3b21c0) 否则 V.
|
||||
随后把数据区里残留的运行期指针(>=0x4000000000)统一回退/清零.
|
||||
用法: python3 merge_decrypted.py <original.so> <dump_full.so> <runtime_base> <out.so>
|
||||
"""
|
||||
from __future__ import annotations
|
||||
import struct, sys
|
||||
|
||||
def phdrs(data):
|
||||
e_phoff = struct.unpack_from('<Q', data, 0x20)[0]
|
||||
e_phentsize = struct.unpack_from('<H', data, 0x36)[0]
|
||||
e_phnum = struct.unpack_from('<H', data, 0x38)[0]
|
||||
out = []
|
||||
for i in range(e_phnum):
|
||||
p = struct.unpack_from('<IIQQQQQQ', data, e_phoff + i * e_phentsize)
|
||||
out.append(dict(type=p[0], flags=p[1], off=p[2], vaddr=p[3], filesz=p[4], memsz=p[5]))
|
||||
return out
|
||||
|
||||
def sections(data):
|
||||
e_shoff = struct.unpack_from('<Q', data, 0x28)[0]
|
||||
e_shentsize = struct.unpack_from('<H', data, 0x3A)[0]
|
||||
e_shnum = struct.unpack_from('<H', data, 0x3C)[0]
|
||||
e_shstrndx = struct.unpack_from('<H', data, 0x3E)[0]
|
||||
sh = []
|
||||
for i in range(e_shnum):
|
||||
s = struct.unpack_from('<IIQQQQIIQQ', data, e_shoff + i * e_shentsize)
|
||||
sh.append(dict(name=s[0], type=s[1], addr=s[3], offset=s[4], size=s[5]))
|
||||
shstr = sh[e_shstrndx]
|
||||
tab = data[shstr['offset']:shstr['offset'] + shstr['size']]
|
||||
def nm(idx):
|
||||
e = tab.find(b'\0', idx)
|
||||
return tab[idx:e].decode(errors='replace')
|
||||
for s in sh:
|
||||
s['name'] = nm(s['name'])
|
||||
return sh
|
||||
|
||||
def main():
|
||||
original, dump, base_s, out = sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4]
|
||||
base = int(base_s, 16)
|
||||
od = bytearray(open(original, 'rb').read())
|
||||
orig_raw = open(original, 'rb').read()
|
||||
dd = open(dump, 'rb').read()
|
||||
print(f"[*] original size={len(od):#x} dump size={len(dd):#x} base={base:#x}")
|
||||
print(f"[*] orig={len(od):#x} dump={len(dd):#x} base=0x{base:x}")
|
||||
|
||||
def d2o(v):
|
||||
"""dump 偏移(vaddr轴) -> 原文件偏移"""
|
||||
return v - 0x1000 if v >= 0x3b21c0 else v
|
||||
ph = phdrs(orig_raw)
|
||||
secs = sections(orig_raw)
|
||||
dyn_ranges, zero_ranges = [], []
|
||||
for s in secs:
|
||||
if s['name'] == '.dynamic':
|
||||
dyn_ranges.append((s['offset'], s['offset'] + s['size']))
|
||||
if s['name'] in ('.init_array', '.fini_array'):
|
||||
zero_ranges.append((s['offset'], s['offset'] + s['size']))
|
||||
|
||||
# 1) 复制解密数据: 覆盖 [0x30000, 0x3eb000) (rodata+data), 含 text 尾部(相同, 无害)
|
||||
COPY = [(0x30000, 0x3eb000)]
|
||||
for a, b in COPY:
|
||||
for off in range(a, b):
|
||||
pass # 慢, 用切片
|
||||
# 切片方式: 逐块映射(避免逐字节)
|
||||
dst_start, dst_end = 0x30000, min(0x3eb000, len(dd))
|
||||
# 一次性: dump[0x30000:0x3b21c0) -> orig[0x30000:0x3b21c0) (v<0x3b21c0 1:1)
|
||||
s1, e1 = 0x30000, 0x3b21c0
|
||||
od[s1:e1] = dd[s1:e1]
|
||||
# dump[0x3b21c0:0x3eb000) -> orig[0x3b11c0:0x3ea000)
|
||||
s2, e2 = 0x3b21c0, min(0x3eb000, len(dd))
|
||||
d2 = e2 - 0x1000
|
||||
if d2 <= len(od):
|
||||
od[s2 - 0x1000:d2] = dd[s2:e2]
|
||||
print(f"[*] data merged: dump[{s1:#x}:{e1:#x}]->orig[{s1:#x}] ; dump[{s2:#x}:{e2:#x}]->orig[{s2-0x1000:#x}:{d2:#x}]")
|
||||
# 按段复制: 数据段文件偏移 <- dump(运行时 vaddr=文件段 vaddr) 内容
|
||||
DATA_SECS = ('.rodata', '.data.rel.ro', '.got', '.got.plt', '.data')
|
||||
n_copied = 0
|
||||
for s in secs:
|
||||
if s['type'] == 8 or s['name'] not in DATA_SECS:
|
||||
continue
|
||||
vaddr, foff, sz = s['addr'], s['offset'], s['size']
|
||||
if vaddr + sz > len(dd) or foff + sz > len(od):
|
||||
print(f"[!] skip {s['name']}: out of bounds vaddr={vaddr:#x} off={foff:#x} sz={sz:#x}")
|
||||
continue
|
||||
if dd[vaddr:vaddr+sz] != od[foff:foff+sz]:
|
||||
od[foff:foff+sz] = dd[vaddr:vaddr+sz]
|
||||
n_copied += sz
|
||||
print(f"[*] merged {n_copied:#x} bytes via section mapping")
|
||||
|
||||
for a, b in dyn_ranges:
|
||||
od[a:b] = orig_raw[a:b]
|
||||
print(f"[*] kept original .dynamic [{a:#x}:{b:#x})")
|
||||
for a, b in zero_ranges:
|
||||
od[a:b] = b'\x00' * (b - a)
|
||||
print(f"[*] zeroed [{a:#x}:{b:#x})")
|
||||
|
||||
# 清理只作用于重定位目标槽: vaddr->文件偏移, 越界运行期指针清零/模块内回退
|
||||
R_AARCH64_RELATIVE, R_AARCH64_ABS64 = 1027, 257
|
||||
R_AARCH64_GLOB_DAT, R_AARCH64_JUMP_SLOT = 1025, 1026
|
||||
def v2foff(vaddr):
|
||||
for s_ in secs:
|
||||
if s_['type'] == 8 or s_['size'] == 0:
|
||||
continue
|
||||
if s_['addr'] <= vaddr < s_['addr'] + s_['size']:
|
||||
return s_['offset'] + (vaddr - s_['addr'])
|
||||
return None
|
||||
n_zero = n_rebase = 0
|
||||
for s_ in secs:
|
||||
if s_['name'] not in ('.rela.dyn', '.rela.plt') or s_['type'] == 8:
|
||||
continue
|
||||
for i in range(0, s_['size'], 24):
|
||||
r_off, r_info, _ = struct.unpack_from('<QQq', orig_raw, s_['offset'] + i)
|
||||
rt = r_info & 0xffffffff
|
||||
if rt not in (R_AARCH64_RELATIVE, R_AARCH64_ABS64, R_AARCH64_GLOB_DAT, R_AARCH64_JUMP_SLOT):
|
||||
continue
|
||||
foff = v2foff(r_off)
|
||||
if foff is None or foff + 8 > len(od):
|
||||
continue
|
||||
v = struct.unpack_from('<Q', od, foff)[0]
|
||||
if v < 0x4000000000:
|
||||
continue
|
||||
if base <= v < base + 0x600000:
|
||||
struct.pack_into('<Q', od, foff, v - base)
|
||||
n_rebase += 1
|
||||
else:
|
||||
struct.pack_into('<Q', od, foff, 0)
|
||||
n_zero += 1
|
||||
print(f"[*] reloc slots: rebased={n_rebase} zeroed={n_zero}")
|
||||
|
||||
open(out, 'wb').write(od)
|
||||
open(out, 'wb').write(od)
|
||||
print(f"[*] -> {out}")
|
||||
|
||||
|
||||
@@ -98,10 +98,18 @@ public class HyDeviceId extends AbstractJni {
|
||||
|
||||
vm = emulator.createDalvikVM();
|
||||
vm.setJni(this);
|
||||
vm.setVerbose(false);
|
||||
vm.setVerbose(true);
|
||||
DalvikModule dm = vm.loadLibrary(new File(soPath), false);
|
||||
dm.callJNI_OnLoad(emulator);
|
||||
module = dm.getModule();
|
||||
// 第二库: libudbauthunify (NativeBridge.klog/b 等 native 注册处, JNI_OnLoad@0x262620)
|
||||
try {
|
||||
DalvikModule udb = vm.loadLibrary(new File("/Users/yml/codes/douyu_login_py/tools/unidbg/hydev/so/libudbauthunify_merged.so"), false);
|
||||
udb.callJNI_OnLoad(emulator);
|
||||
System.out.println("[*] libudbauthunify loaded base=0x" + Long.toHexString(udb.getModule().base));
|
||||
} catch (Throwable t) {
|
||||
System.out.println("[!] udb load failed: " + t);
|
||||
}
|
||||
NE = vm.resolveClass("com/huya/security/hydeviceid/NativeEntry");
|
||||
System.out.println("[*] lib loaded base=0x" + Long.toHexString(module.base));
|
||||
}
|
||||
@@ -129,6 +137,7 @@ public class HyDeviceId extends AbstractJni {
|
||||
vm.resolveClass("android/content/ContextWrapper", vm.resolveClass("android/content/Context"))).newObject(signature);
|
||||
}
|
||||
if (signature.equals("com/huya/security/hydeviceid/NativeBridge->b(I)Ljava/lang/String;")) {
|
||||
System.out.println("[JNI] NativeBridge.b FALLBACK-STUB (native not registered?)");
|
||||
int i = vaList.getIntArg(0);
|
||||
// 真机实测值 (2026-08-28): 100=GUID 101= MID 102= MID 106=64hex, 99/103=null, 104/105=""
|
||||
String v = null;
|
||||
@@ -200,6 +209,12 @@ public class HyDeviceId extends AbstractJni {
|
||||
System.out.println("[JNI] SharedPreferences.edit()");
|
||||
return new PrefsEditor(vm);
|
||||
}
|
||||
case "android/content/SharedPreferences$Editor->remove(Ljava/lang/String;)Landroid/content/SharedPreferences$Editor;": {
|
||||
String rk = strArg(vaList, 0);
|
||||
System.out.println("[prefs-remove] " + rk);
|
||||
PREFS.remove(rk);
|
||||
return dvmObject;
|
||||
}
|
||||
case "android/content/SharedPreferences$Editor->putString(Ljava/lang/String;Ljava/lang/String;)Landroid/content/SharedPreferences$Editor;": {
|
||||
String k = strArg(vaList, 0);
|
||||
String v = strArg(vaList, 1);
|
||||
@@ -236,6 +251,19 @@ public class HyDeviceId extends AbstractJni {
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public DvmObject<?> getStaticObjectField(BaseVM vm, DvmClass dvmClass, String signature) {
|
||||
// android/os/Build 静态字段读
|
||||
if (signature.equals("android/os/Build->BRAND:Ljava/lang/String;")) return new StringObject(vm, "Xiaomi");
|
||||
if (signature.equals("android/os/Build->MODEL:Ljava/lang/String;")) return new StringObject(vm, "M2102J2SC");
|
||||
if (signature.equals("android/os/Build->MANUFACTURER:Ljava/lang/String;")) return new StringObject(vm, "Xiaomi");
|
||||
if (signature.equals("android/os/Build->DEVICE:Ljava/lang/String;")) return new StringObject(vm, "thyme");
|
||||
if (signature.equals("android/os/Build->BOARD:Ljava/lang/String;")) return new StringObject(vm, "thyme");
|
||||
if (signature.equals("android/os/Build->FINGERPRINT:Ljava/lang/String;")) return new StringObject(vm, "Xiaomi/thyme/thyme:11/RKQ1.200826.002/V12.5.9.0.RKACNXM:user/release-keys");
|
||||
noteUnhandled(signature);
|
||||
return null;
|
||||
}
|
||||
|
||||
@Override
|
||||
public int callIntMethodV(BaseVM vm, DvmObject<?> dvmObject, String signature, VaList vaList) {
|
||||
try {
|
||||
|
||||
Reference in New Issue
Block a user