yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(huya): 💎💎💎 R34 会话密钥活体捕获成功 (P7TAzQYmX4O6i95q!)

Browse Source 
- Java.choose 堆枚举 @SSL_write 命中 = 密钥体系! (16字符随机, 每注册轮换)
- 多POST结构对比: 密文紧跟magic, 头版本位 01/11 变体
- Java Cprivate.a x 会话密钥 x 0-48切片 = 全null → 13.4.22传输≠Cprivate!
- hook_final/hook_brute 可复用捕获体系
This commit is contained in:
yml2213
2026-08-29 09:10:57 +08:00
parent 0647c0c682
commit 2fe23e4274
4 changed files with 217 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/frida/hook_brute.js
+71
View File
@@ -0,0 +1,71 @@
// 多切片×多密钥暴力: Java 真 Cprivate.a
function emit(o){ try{ send(o); }catch(e){} }
let klist = [];
for (const mod of Process.enumerateModules()) {
let addr = null;
try { addr = mod.getExportByName('SSL_write'); } catch(e){}
if (!addr) continue;
Interceptor.attach(addr, {
onEnter(args){
try {
var num = args[2].toInt32();
if (num < 60 || num > 60000) return;
var u = new Uint8Array(args[1].readByteArray(num));
var s = '';
for (var i=0;i<u.length;i++) s += (u[i]>=32 && u[i]<127) ? String.fromCharCode(u[i]) : '.';
if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return;
var hex = Array.prototype.map.call(u, function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
emit({event:'post', num:num, hex:hex});
setTimeout(function(){
try {
Java.perform(function(){
var keys = [];
Java.enumerateClassLoaders({
onMatch: function(loader){
try {
Java.classFactory.loader = loader;
Java.choose('com.tencent.turingfd.sdk.ams.ga.Perseus', {
onMatch: function(inst){
try {
var g = inst.b.value;
if (g && keys.indexOf(g.c.value) < 0) keys.push(g.c.value);
} catch(e){}
},
onComplete: function(){
try {
var C = Java.use('com.tencent.turingfd.sdk.ams.ga.private');
var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
var idx = hex.indexOf('571882cf664bb39401ee');
if (idx < 0) return;
var all = hex.substring(idx+20);
var tot = keys.length;
for (var ki=0; ki<tot; ki++) {
var key = keys[ki];
var karr = Java.use('java.lang.String').$new(key).getBytes('UTF-8');
for (var off=0; off<=48; off+=2) {
var cph = all.substring(off);
if (cph.length < 16 || cph.length % 8 !== 0) continue;
var bytes = [];
for (var i=0;i<cph.length;i+=2) bytes.push(parseInt(cph.substr(i,2),16));
var arr = Java.array('byte', bytes);
var plain = C.a(arr, karr);
if (plain !== null) {
emit({event:'DEC-OK', key:key, off:off, len:plain.length, hex:Melon.a(plain).substring(0,400)});
}
}
}
emit({event:'brute-done', keys:keys.length});
} catch(e){ emit({event:'brute-e', e:String(e).substring(0,120)}); }
}
});
} catch(e){}
},
onComplete: function(){}
});
});
} catch(e){}
}, 300);
} catch(e){}
}
});
}
tools/frida/hook_final.js
+67
View File
@@ -0,0 +1,67 @@
// 终极: SSL抓POST(full!) + 堆取Guava密钥 + Java Cprivate.a当场解密!
function emit(o){ try{ send(o); }catch(e){} }
let gotKey = null, tried = 0;
for (const mod of Process.enumerateModules()) {
let addr = null;
try { addr = mod.getExportByName('SSL_write'); } catch(e){}
if (!addr) continue;
Interceptor.attach(addr, {
onEnter(args){
try {
var num = args[2].toInt32();
if (num < 60 || num > 60000) return;
var u = new Uint8Array(args[1].readByteArray(num));
var s = '';
for (var i=0;i<u.length;i++) s += (u[i]>=32 && u[i]<127) ? String.fromCharCode(u[i]) : '.';
if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return;
var hex = Array.prototype.map.call(u, function(x){return ('0'+x.toString(16)).slice(-2)}).join('');
emit({event:'post-full', num:num, hex:hex});
// 堆取密钥
setTimeout(function(){
try {
Java.perform(function(){
Java.enumerateClassLoaders({
onMatch: function(loader){
try {
Java.classFactory.loader = loader;
Java.choose('com.tencent.turingfd.sdk.ams.ga.Perseus', {
onMatch: function(inst){
try {
var g = inst.b.value;
if (g && !gotKey) { gotKey = g.c.value; emit({event:'key', c:gotKey}); }
} catch(e){}
},
onComplete: function(){
if (gotKey && tried < 3) {
tried++;
try {
var C = Java.use('com.tencent.turingfd.sdk.ams.ga.private');
var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
// 密文 = body内 magic@后; 简化: 用整 POST 找 571882cf...
var needle = [0x57,0x18,0x82,0xcf,0x66,0x4b,0xb3,0x94,0x01,0xee];
var idx = hex.indexOf('571882cf664bb39401ee');
var cipherHex = idx >= 0 ? hex.substring(idx+20) : '';
if (cipherHex.length > 16) {
var bytes = [];
for (var i=0;i<cipherHex.length;i+=2) bytes.push(parseInt(cipherHex.substr(i,2),16));
var arr = Java.array('byte', bytes);
var karr = Java.use('java.lang.String').$new(gotKey).getBytes('UTF-8');
var plain = C.a(arr, karr);
if (plain === null) emit({event:'dec-null'});
else emit({event:'dec-ok', len:plain.length, hex:Melon.a(plain).substring(0,800)});
}
} catch(e){ emit({event:'dec-e', e:String(e).substring(0,120)}); }
}
}
});
} catch(e){}
},
onComplete: function(){}
});
});
} catch(e){}
}, 400);
} catch(e){}
}
});
}
tools/frida/hook_heapkey.js
+57
View File
@@ -0,0 +1,57 @@
// str-magic 命中后: Java 堆枚举 Guava/Perseus + 16字符密钥串扫描
'use strict';
function emit(row){ try{ send(row); }catch(e){} }
function hex16(b){ var h=''; for(var i=0;i<b.length;i++) h+=('0'+b[i].toString(16)).slice(-2); return h; }
for (const mod of Process.enumerateModules()) {
let addr = null;
try { addr = mod.getExportByName('SSL_write'); } catch(e){}
if (!addr) continue;
Interceptor.attach(addr, {
onEnter(args){
try {
var num = args[2].toInt32();
if (num < 60 || num > 60000) return;
var u = new Uint8Array(args[1].readByteArray(num));
var s = '';
for (var i=0;i<u.length;i++) s += (u[i]>=32 && u[i]<127) ? String.fromCharCode(u[i]) : '.';
if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return;
emit({event:'str-hit', num:num});
// 立即堆枚举 Guava (会话密钥类!)
setTimeout(function(){
try {
Java.perform(function(){
Java.enumerateClassLoaders({
onMatch: function(loader){
try {
Java.classFactory.loader = loader;
Java.choose('com.tencent.turingfd.sdk.ams.ga.Guava', {
onMatch: function(inst){
try {
var c = inst.c.value;
var d = inst.d.value;
var b = inst.b.value;
emit({event:'heap-guava', c:c, d:d, bLen: b ? b.length : -1, a: inst.a.value});
} catch(e){ emit({event:'heap-guava-e', e:String(e).substring(0,80)}); }
},
onComplete: function(){}
});
Java.choose('com.tencent.turingfd.sdk.ams.ga.Perseus', {
onMatch: function(inst){
try {
var g = inst.b.value;
emit({event:'heap-perseus', c: g ? g.c.value : null});
} catch(e){}
},
onComplete: function(){ emit({event:'heap-done'}); }
});
} catch(e){}
},
onComplete: function(){}
});
});
} catch(e){ emit({event:'heap-exc', e:String(e).substring(0,100)}); }
}, 300);
} catch(e){}
}
});
}