feat(huya): 💎💎💎 R34 会话密钥活体捕获成功 (P7TAzQYmX4O6i95q!)

- Java.choose 堆枚举 @SSL_write 命中 = 密钥体系! (16字符随机, 每注册轮换) - 多POST结构对比: 密文紧跟magic, 头版本位 01/11 变体 - Java Cprivate.a x 会话密钥 x 0-48切片 = 全null → 13.4.22传输≠Cprivate! - hook_final/hook_brute 可复用捕获体系
2026-08-29 09:10:57 +08:00
parent 0647c0c682
commit 2fe23e4274
4 changed files with 217 additions and 0 deletions
@@ -0,0 +1,57 @@
+// str-magic 命中后: Java 堆枚举 Guava/Perseus + 16字符密钥串扫描
+'use strict';
+function emit(row){ try{ send(row); }catch(e){} }
+function hex16(b){ var h=''; for(var i=0;i<b.length;i++) h+=('0'+b[i].toString(16)).slice(-2); return h; }
+for (const mod of Process.enumerateModules()) {
+  let addr = null;
+  try { addr = mod.getExportByName('SSL_write'); } catch(e){}
+  if (!addr) continue;
+  Interceptor.attach(addr, {
+    onEnter(args){
+      try {
+        var num = args[2].toInt32();
+        if (num < 60 || num > 60000) return;
+        var u = new Uint8Array(args[1].readByteArray(num));
+        var s = '';
+        for (var i=0;i<u.length;i++) s += (u[i]>=32 && u[i]<127) ? String.fromCharCode(u[i]) : '.';
+        if (s.indexOf('dfpReport') < 0 && s.indexOf('hyudbwebuif') < 0) return;
+        emit({event:'str-hit', num:num});
+        // 立即堆枚举 Guava (会话密钥类!)
+        setTimeout(function(){
+          try {
+            Java.perform(function(){
+              Java.enumerateClassLoaders({
+                onMatch: function(loader){
+                  try {
+                    Java.classFactory.loader = loader;
+                    Java.choose('com.tencent.turingfd.sdk.ams.ga.Guava', {
+                      onMatch: function(inst){
+                        try {
+                          var c = inst.c.value;
+                          var d = inst.d.value;
+                          var b = inst.b.value;
+                          emit({event:'heap-guava', c:c, d:d, bLen: b ? b.length : -1, a: inst.a.value});
+                        } catch(e){ emit({event:'heap-guava-e', e:String(e).substring(0,80)}); }
+                      },
+                      onComplete: function(){}
+                    });
+                    Java.choose('com.tencent.turingfd.sdk.ams.ga.Perseus', {
+                      onMatch: function(inst){
+                        try {
+                          var g = inst.b.value;
+                          emit({event:'heap-perseus', c: g ? g.c.value : null});
+                        } catch(e){}
+                      },
+                      onComplete: function(){ emit({event:'heap-done'}); }
+                    });
+                  } catch(e){}
+                },
+                onComplete: function(){}
+              });
+            });
+          } catch(e){ emit({event:'heap-exc', e:String(e).substring(0,100)}); }
+        }, 300);
+      } catch(e){}
+    }
+  });
+}