feat(huya): 登录路径OTP全链LIVE验证 + appSign≠getOtp结构性证伪 (R14)
- 决定性捕获(hook_huya_crypto.js全链): xxtea密钥=账号稳定uid(1199666914671) getkey(1,2)=MKDK/1,3=nskdI7, md5输入=k1+getkey, AES明文=[02][0c00][12B xxtea][7200][114B cred] 逐字节验证 - frida入口arg0读""为误读(SSO读取bug), 内部xxtea钩子为真值 - GOLD模式(正确uid)346k+J2 6.2M+I 6.3M+H 1.39M 全零 -> ~14.3M差分终态 - 结构性证明: appSign跨账号稳定 vs getOtp账号级(cred轮换) -> t1.t0≠OTP-mid QED - 更正旧文档: in=uid非空串; 登录可带frida; 金样本uid=1199666914671 - 下一步: createWupRequestData@0x38dab0 appSign填充点反汇编
This commit is contained in:
yml2213
@@ -0,0 +1,50 @@
|
||||
{"event": "module-found", "name": "libudbauthunify.so", "base": "0x7205bdb000", "size": 4812800, "pid": 13009, "tid": 13035, "ts": 1787952105624, "seq": 1}
|
||||
{"event": "hook-installed", "needle": "hyudb_otp_encrypt", "address": "0x7205f0aa24", "pid": 13009, "tid": 13035, "ts": 1787952105651, "seq": 2}
|
||||
{"event": "hook-installed", "needle": "BusinessCfg6getOtp", "address": "0x7205e4416c", "pid": 13009, "tid": 13035, "ts": 1787952105673, "seq": 3}
|
||||
{"event": "hook-installed", "needle": "setSafeDeviceId", "address": "0x7205e452e0", "pid": 13009, "tid": 13035, "ts": 1787952105695, "seq": 4}
|
||||
{"event": "hook-installed", "needle": "getHdid", "address": "0x7205e45484", "pid": 13009, "tid": 13035, "ts": 1787952105716, "seq": 5}
|
||||
{"event": "hook-installed", "needle": "AESkeyMgr6getkey", "address": "0x7205e4371c", "pid": 13009, "tid": 13035, "ts": 1787952105735, "seq": 6}
|
||||
{"event": "hook-installed", "needle": "md5_char16", "address": "0x7205f0971c", "pid": 13009, "tid": 13035, "ts": 1787952105755, "seq": 7}
|
||||
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a9b04 (_ZN14WupDataPackageIN3wup22AppLgnPasswordLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a8b04 (_ZN27HandlerRequestLoginPassport9onHandlerEP10UdbMsgBase+0x4e0) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b664 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1334) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 13009, "tid": 13167, "ts": 1787952125838, "seq": 8}
|
||||
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 13009, "tid": 13167, "ts": 1787952125838, "seq": 9}
|
||||
{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 3140895056, "uidHi": 3019898993, "pid": 13009, "tid": 13167, "ts": 1787952126053, "seq": 10}
|
||||
{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 2, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a30fb7b0617ae74fd0a4defe5e1059ff6e2781dd245bbfa304133d379f3465fc49bf462bc7c96678b1f314c26fc87ebc9adf05983500435bed7a0310856c995a30ca1a41af034236445b1c48478378c1181d7186e763c18794ba9a4335c2ac5b381fbf6f99830f26ffc3c4a4c2046c642eb", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a405a7c0000", "stMs": "1787952126588", "nc": 0, "pid": 13009, "tid": 13167, "ts": 1787952126077, "seq": 11}
|
||||
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 2, "pid": 13009, "tid": 13167, "ts": 1787952126078, "seq": 12}
|
||||
{"event": "crypto-aeskey", "stage": "leave", "key": "MKDKeridjing7avnsasdSDHI", "pid": 13009, "tid": 13167, "ts": 1787952126078, "seq": 13}
|
||||
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3MKDKeridjing7avnsasdSDHI", "pid": 13009, "tid": 13167, "ts": 1787952126078, "seq": 14}
|
||||
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 13009, "tid": 13167, "ts": 1787952126078, "seq": 15}
|
||||
{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "0402bfe6496f781fa7005df2051bea5e0dce2ca4973edabdd7bb99f1a123f9f78727a7f14571da7e451134626b373f848858173a64bce167d3db0951b2257e6e18612e349f7067f4a0d9e212314d28a88fee718e8f7b65edc538fe5b9e435f0cdfa439bd7d22bf0db6ae8f97ead9d1901f54c6fc2678787b18966aef4cddc7c9142d2d27e5a46cb89aeb6f55b92ca5621fc0", "outSize": 146, "pid": 13009, "tid": 13167, "ts": 1787952126102, "seq": 16}
|
||||
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 13009, "tid": 13167, "ts": 1787952126137, "seq": 17}
|
||||
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 13009, "tid": 13167, "ts": 1787952126138, "seq": 18}
|
||||
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a965c (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x46c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 13009, "tid": 13167, "ts": 1787952126174, "seq": 19}
|
||||
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 13009, "tid": 13167, "ts": 1787952126175, "seq": 20}
|
||||
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a7f34 (_ZN14WupDataPackageIN3wup13UserLogoffReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a755c (_ZN22HandlerRequestLoginOut9onHandlerEP10UdbMsgBase+0x248) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b1e4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xeb4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 13009, "tid": 13167, "ts": 1787952157091, "seq": 21}
|
||||
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 13009, "tid": 13167, "ts": 1787952157091, "seq": 22}
|
||||
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x336314 (_ZN14WupDataPackageIN3wup24AppLgnCredentialLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3341d8 (_ZN28HandlerRequestAnonyLoginCred9onHandlerEP10UdbMsgBase+0x558) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bae4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x17b4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 13009, "tid": 13167, "ts": 1787952157131, "seq": 23}
|
||||
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 13009, "tid": 13167, "ts": 1787952157131, "seq": 24}
|
||||
{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 3140869456, "uidHi": 3019898993, "pid": 13009, "tid": 13167, "ts": 1787952157419, "seq": 25}
|
||||
{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 3, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a8066875728ac56814c316e2a466511c502bd76cf1ded554657b74729876cb9f7081cf1331add5a9f7ac54784e4d137cd79ba04e01ef74a2dc163726c3a7ced7c91bb4eb384075bc94ce2fdfde3276a64c300bfbd5d82b97f905d74c6c83a95bc42964d17f6bd1ac592c37301a49ba25748", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a40d4630000", "stMs": "1787952157795", "nc": 0, "pid": 13009, "tid": 13167, "ts": 1787952157475, "seq": 26}
|
||||
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 3, "pid": 13009, "tid": 13167, "ts": 1787952157475, "seq": 27}
|
||||
{"event": "crypto-aeskey", "stage": "leave", "key": "nskdI7MDGKSDJsnadjdoonvs", "pid": 13009, "tid": 13167, "ts": 1787952157475, "seq": 28}
|
||||
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3nskdI7MDGKSDJsnadjdoonvs", "pid": 13009, "tid": 13167, "ts": 1787952157475, "seq": 29}
|
||||
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 13009, "tid": 13167, "ts": 1787952157475, "seq": 30}
|
||||
{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "0403cd04c2f2d3a175bad6bd6b374bb26dde123b08356cc440b14af6ee30bc1f5b619785ce3ca319c2ddbeac4f7be0bb9f48e74f0bf01721e663750eb4c0edeba5b405516e3b61a272d07fed44f63ef86fde769247fa7f70686c5c8388fcc5aa34f4db2d7a61b3d1d140097737fd952a1e4ff04b521569c5291b88991d41369b8171e159276429c4db37f122933ef2ae5940", "outSize": 146, "pid": 13009, "tid": 13167, "ts": 1787952157505, "seq": 31}
|
||||
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 13009, "tid": 13167, "ts": 1787952157556, "seq": 32}
|
||||
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 13009, "tid": 13167, "ts": 1787952157556, "seq": 33}
|
||||
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x334be4 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x368) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 13009, "tid": 13167, "ts": 1787952157600, "seq": 34}
|
||||
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 13009, "tid": 13167, "ts": 1787952157600, "seq": 35}
|
||||
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a7be0 (_ZN23HandlerResponseLoginOut9onHandlerEP10UdbMsgBase+0xc8) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b244 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xf14) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 13009, "tid": 13167, "ts": 1787952157690, "seq": 36}
|
||||
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 13009, "tid": 13167, "ts": 1787952157690, "seq": 37}
|
||||
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a9b04 (_ZN14WupDataPackageIN3wup22AppLgnPasswordLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a8b04 (_ZN27HandlerRequestLoginPassport9onHandlerEP10UdbMsgBase+0x4e0) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b664 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1334) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 13009, "tid": 13167, "ts": 1787952163304, "seq": 38}
|
||||
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 13009, "tid": 13167, "ts": 1787952163304, "seq": 39}
|
||||
{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 3140869456, "uidHi": 3019898993, "pid": 13009, "tid": 13167, "ts": 1787952163485, "seq": 40}
|
||||
{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 4, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a809d210a177fa50eceea56049453c46f623a3972c7ff5ac5cebfcd609511ed73c10dbab42a27a7fab1b211e855463e5374c7a5c612f81b6caa48064a6ec73d0df9e7913636b984c8ea74377b75eeba8b8b696c89ea1a1c97297ae05c0dcc78d6f7e4fd379d825010888288b15bd4d620bb", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a40f0980000", "stMs": "1787952165016", "nc": 0, "pid": 13009, "tid": 13167, "ts": 1787952163515, "seq": 41}
|
||||
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 4, "pid": 13009, "tid": 13167, "ts": 1787952163515, "seq": 42}
|
||||
{"event": "crypto-aeskey", "stage": "leave", "key": "whdFNGFdfJHMJbdfg6jhdsFG", "pid": 13009, "tid": 13167, "ts": 1787952163515, "seq": 43}
|
||||
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3whdFNGFdfJHMJbdfg6jhdsFG", "pid": 13009, "tid": 13167, "ts": 1787952163515, "seq": 44}
|
||||
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 13009, "tid": 13167, "ts": 1787952163515, "seq": 45}
|
||||
{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "0404055bfce5f73e5d7d6a747acb7b8487bc2a350eed9bb1732110f58d4a88e097dbb0f52e86679716197bdb73f48ad1151575cc3208ae028c38eb14edca4296079118baf87eea95ba33cd885974e45a0bf9acf4531f9f809fdcce133779a87dedb1e7e3f5b96bc2f931c80bb602edf3471ccd1b8c9ebb5b37dff08a7423c04d0c718b53ae0a0dfd2bf902145897d063c141", "outSize": 146, "pid": 13009, "tid": 13167, "ts": 1787952163542, "seq": 46}
|
||||
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 13009, "tid": 13167, "ts": 1787952163576, "seq": 47}
|
||||
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 13009, "tid": 13167, "ts": 1787952163576, "seq": 48}
|
||||
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a965c (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x46c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 13009, "tid": 13167, "ts": 1787952163613, "seq": 49}
|
||||
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 13009, "tid": 13167, "ts": 1787952163613, "seq": 50}
|
||||
@@ -0,0 +1,38 @@
|
||||
{"event": "module-found", "name": "libudbauthunify.so", "base": "0x71ffb17000", "size": 4812800, "pid": 18573, "tid": 18595, "ts": 1787952417476}
|
||||
{"event": "hook-installed", "needle": "hyudb_otp_encrypt", "address": "0x71ffe46a24", "pid": 18573, "tid": 18595, "ts": 1787952417502}
|
||||
{"event": "hook-installed", "needle": "crypt_util13xxtea_encrypt", "address": "0x71ffe4583c", "pid": 18573, "tid": 18595, "ts": 1787952417524}
|
||||
{"event": "hook-installed", "needle": "hyudbxxt13xxtea_encryptEPjj", "address": "0x71ffd69700", "pid": 18573, "tid": 18595, "ts": 1787952417547}
|
||||
{"event": "hook-installed", "needle": "md5_char16", "address": "0x71ffe4571c", "pid": 18573, "tid": 18595, "ts": 1787952417566}
|
||||
{"event": "hook-installed", "needle": "UdbAESUtil7encrypt", "address": "0x71ffd67038", "pid": 18573, "tid": 18595, "ts": 1787952417587}
|
||||
{"event": "hook-installed", "needle": "AESkeyMgr6getkey", "address": "0x71ffd7f71c", "pid": 18573, "tid": 18595, "ts": 1787952417603}
|
||||
{"event": "hook-installed", "needle": "BusinessCfg6getOtp", "address": "0x71ffd8016c", "pid": 18573, "tid": 18595, "ts": 1787952417620}
|
||||
{"event": "crypto-getotp", "stage": "enter", "uidLo": 3865726288, "uidHi": 3019898993, "pid": 18573, "tid": 18720, "ts": 1787952430248}
|
||||
{"event": "crypto-otp", "stage": "enter", "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2": 2, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a8066875728ac56814c316e2a466511c502bd76cf1ded554657b74729876cb9f7081cf1331add5a9f7ac54784e4d137cd79ba04e01ef74a2dc163726c3a7ced7c91bb4eb384075bc94ce2fdfde3276a64c300bfbd5d82b97f905d74c6c83a95bc42964d17f6bd1ac592c37301a49ba25748", "arg6": 4, "arg7_ulong": "1a04a44fef80000", "pid": 18573, "tid": 18720, "ts": 1787952430249}
|
||||
{"event": "crypto-xxtea", "stage": "enter", "layer": "crypt_util", "keyStr": null, "keyHex": "", "inSize": 0, "inHex": "", "rawIn": "100000f8fe444aa001000000000000000000000000000000", "rawKey": "1a31343731323539313836303234002e0000000000000000", "pid": 18573, "tid": 18720, "ts": 1787952430250}
|
||||
{"event": "crypto-xxtea", "stage": "leave", "layer": "crypt_util", "outSize": 0, "outHex": "", "pid": 18573, "tid": 18720, "ts": 1787952430250}
|
||||
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 2, "pid": 18573, "tid": 18720, "ts": 1787952430250}
|
||||
{"event": "crypto-aeskey", "stage": "leave", "key": "MKDKeridjing7avnsasdSDHI", "keyHex": "4d4b444b657269646a696e673761766e7361736453444849", "pid": 18573, "tid": 18720, "ts": 1787952430250}
|
||||
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3MKDKeridjing7avnsasdSDHI", "inHex": "38363561343932346134303839376163316663666536623463326362623065334d4b444b657269646a696e673761766e7361736453444849", "inSize": 56, "pid": 18573, "tid": 18720, "ts": 1787952430250}
|
||||
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "keySize": 0, "pid": 18573, "tid": 18720, "ts": 1787952430250}
|
||||
{"event": "crypto-aes", "stage": "enter", "thisHex": "9087f7ff71000000637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0", "inSize": 131, "inHex": "020c00f59e76471465567e373337b372000a8066875728ac56814c316e2a466511c502bd76cf1ded554657b74729876cb9f7081cf1331add5a9f7ac54784e4d137cd79ba04e01ef74a2dc163726c3a7ced7c91bb4eb384075bc94ce2fdfde3276a64c300bfbd5d82b97f905d74c6c83a95bc42964d17f6bd1ac592c37301a49ba25748", "preSize": 0, "preHex": "", "pid": 18573, "tid": 18720, "ts": 1787952430251}
|
||||
{"event": "crypto-aes", "stage": "leave", "outSize": 144, "outHex": "b0a0af88aaf53a411b0eb1d283c88ff850a03b3877c0e5458cbcb2b2f8a97d07cb2cd37264f6fd9dcc92ac53966f8e565bf5895d65cc67c641a346df23df3e2e0af22f9ff84947b20e887687d9d38ef107fac73da5c45dc943a645989bc0ffa37464444fd7e07a228d30cad91d19d58957a52d6417372e1670ec9527e8df77dec01050c60bf18dde25e524bf854d65da", "pid": 18573, "tid": 18720, "ts": 1787952430252}
|
||||
{"event": "crypto-otp", "stage": "leave", "outStr": null, "outHex": "", "outSize": 0, "pid": 18573, "tid": 18720, "ts": 1787952430252}
|
||||
{"event": "crypto-aes", "stage": "enter", "thisHex": "9087f7ff71000000637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0", "inSize": 1106, "inHex": "7b2262697a746f6b656e5f766563223a5b7b2262697a4170706964223a2235303038222c2262697a746f6b656e223a224168516b3175337162315762676d36557a4b6e4f585763694469364768434867583953725166495a7336632f4e6332735267304e456a2f7163366445344f586c776269437a6f584652384952374865792f5572734e77786378346a4879306d552f465050504f474b5a7272495469756d564c326274624968664869304b36744f354c596d6a6f6f6b5a5852436c7361545043306142635a45666353497470467a2b322f6a327053714d6d51684a4371686d7247536547744b327037343775376a676b6a334a74793946483549593546445961797756757679222c22657272436f6465223a307d5d2c22636f6f6b6965223a7b2262697a746f6b656e223a22415141476a72674b66616b4b5043356e692d5537496479566344754e506639423767647967486e6836346e58565a4e524a43614d7453385132722d734651392d5862764532587948524145434a4558387570376c6b722d75494f53555136635f62594b495a353178414c764139475a77474171463671776144594d6d5f326f50582d5a5a596154657354704b725f4d7441436371566457794a304f4a5777446649416b49315751796166454d494138726a7962564f726b435832643151554863746352436a4c7137697553686861484e59445843593262553454426870463069627a6478476b4838636c4a774343795f712d784f69595a6c7766715f3235475f6b37635457544e6356624e4b317a4e665658496775704f52697974744c654b567061515f4458317a586c534c616e7a6456637541674962656b4872674255515f624f6449716363534132446d555047382d39635435486d49222c2270617373706f7274223a22222c22737461747573223a22222c22756964223a2231343731323539313836303234222c2276657273696f6e223a22312e30227d2c2263726564223a22436f426d6831636f72466142544446754b6b5a6c456355437658625048653156526c653352796d48624c6e3343427a784d7872645770393678556545354e45337a586d36424f416539306f7477574e7962447038375879527530367a6841646279557a692f66336a4a32706b7777432f7656324375582b51585854477944715676454b5754526632765272466b734e7a416153626f6c6449222c22656d61696c4d61736b223a22222c2268794f70656e4964223a302c2268796964223a302c22697348757961223a302c226d6f62696c654d61736b223a22222c2270617373706f7274223a22222c227265674f726967696e223a302c22737461747573223a302c22737562556964223a302c227468697264506172616d73223a7b2275635f737461746573223a2231227d2c227469", "preSize": 0, "preHex": "", "pid": 18573, "tid": 18720, "ts": 1787952430254}
|
||||
{"event": "crypto-aes", "stage": "leave", "outSize": 1120, "outHex": "d0cb6d14bc320cc61757862632e7be04b8a242c9546465cbdcdbbd29b54c1cd96549a83404552a57ea502313a23de0c25c30b879c8a64daf7ac90d7c3911054315f185a5bd4c0dfa94e3e4ca8a68b154a9197dcd02eb227abf470e7968112d68d2421a12abf9f866431ee0c6b9b18d34a07fc033b927f494650bcdb31b3a46b9263ad5dcaceef00397a68cf0bcf241e76bc2c62d4c85393bd6d62e1bde58a09ccb24b1a0dfc5dc3e300088a43e76b42b83558d61df62f9c9ca5310fd484382ce79001e5abb54e96b085817290a28ce69c9f046fb0934b99bad464e7853f591b7a9584470e8bf5962fc74ebb06f40a0cc5b36fc6c3e1889d44c36d24b813808fe6f3d4fda68fef006566027c917828301c4fd75e505d8bee6a7ca7b3594ed415a937d5be3c9d1d29dd96cc1dc7e5ffe8a55d1946616c0619fab3edc1c23e710ce1478194b39886f1e108b7f9aa6ee9f0699d984f9294bcc5771f0242df99161efb2fc65af840c08fd2e5e315ef3c36799ac23ec04be5209ea71d1904c6a61d02c5d6ec3b707fe697cb76538a13e654f661abf36a2c752ebc93d7c611e54ccf7164a350b93a5cfc1393dab1e7c1ae834bb7e9d1b2865fd06a4ddcad191246f2f91dec1377e5ad5a8a205f6b60c15c5aa9fefb8687df549aa3cd79af28132a12b017ad15ac86dee39f3563afd575dcc4ef96a1d76778e592110e5fea79655dc86c15a4ba36cbf4dc6a931650afd1dace63b0259d6fb49111c1b9ba3a037701b7a91ab9d159e438e6a2eb8e0141379f348d0f944b0e54cc28433ab77f668dc2a68f7a9841743120e3bf43427e415fb76ae5eb4543b22d1de375ebaf6f7a43a56ecb2ebbb5868c9d530ec1d0f9235c30c7024b58358760b3a85fe1f4ee53359d5bec8bd1c577366bfe52ba01f3205cceb85038d89d1de3c98426716da012df5d901cf3f535f366c6d38900b02ed98880063188d3b14034b621cc1f24a9974344170fbb9fd9bc284ce9781690bf8e416c62ad1f58761f7205764348abcea263b88f3b7f76ab11a8e9260655e4fbfc27440001abc4c34c8c019c3deca5d4454f58f03dbb07778edfc596cb97207579b939627c806660af94fbbe58ebe0aa7eb8a054aefc0bffe1f97a97265028736e8918a9c9e12c587c193dcd6b50c4c582b91fd210e6143d465408647fa92ac5a9c3c1e8b20bb05813f3c3865d3ba59febaeda322fdae6227faf35359ad1792b5e26a606bd312d3f53ccc89cd33a6d125e5f2174f620403b3620506c735ee2a0312c8a06e558f2a1d57dd5a9c21b33a9fa2e9e0edd092d3cf458179ed0ba4fb48c628daf0a584aa92247fcdadff19e94c1f9c6ecb568ebfa9d031f13d52f7bb8beda14c39b5f98c15bba68efccbf4923a2f86cf948279541b3f290ed8d7f13c7b86e66639d8f81212a2d8dd7e10fcbcd3f698567d31", "pid": 18573, "tid": 18720, "ts": 1787952430256}
|
||||
{"event": "crypto-getotp", "stage": "enter", "uidLo": 2706847056, "uidHi": 3019898993, "pid": 18573, "tid": 18720, "ts": 1787952441737}
|
||||
{"event": "crypto-otp", "stage": "enter", "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2": 3, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a20a2415d8b6aabfa9bf3bf77bf9aed6f02f19e6e9423fe3898ac1d77ae8ff7f0f8461f798abbd3d5b3db6c646dc8790eff9052bb3e36fabe9fecab26f98afaaa359a7ed6848a3a1f74d8c260c9932ea6bedf74b9cc4f2fe8f5cdcf17205a23f6df43169653c9a02fe853b91f2ac64089f1", "arg6": 4, "arg7_ulong": "1a04a452bc80000", "pid": 18573, "tid": 18720, "ts": 1787952441740}
|
||||
{"event": "crypto-xxtea", "stage": "enter", "layer": "crypt_util", "keyStr": null, "keyHex": "", "inSize": 0, "inHex": "", "rawIn": "100000c82b454aa001000000000000000000000000000000", "rawKey": "1a31313939363636393134363731002e0000000000000000", "pid": 18573, "tid": 18720, "ts": 1787952441740}
|
||||
{"event": "crypto-xxtea", "stage": "leave", "layer": "crypt_util", "outSize": 0, "outHex": "", "pid": 18573, "tid": 18720, "ts": 1787952441740}
|
||||
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 3, "pid": 18573, "tid": 18720, "ts": 1787952441740}
|
||||
{"event": "crypto-aeskey", "stage": "leave", "key": "nskdI7MDGKSDJsnadjdoonvs", "keyHex": "6e736b6449374d44474b53444a736e61646a646f6f6e7673", "pid": 18573, "tid": 18720, "ts": 1787952441740}
|
||||
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3nskdI7MDGKSDJsnadjdoonvs", "inHex": "38363561343932346134303839376163316663666536623463326362623065336e736b6449374d44474b53444a736e61646a646f6f6e7673", "inSize": 56, "pid": 18573, "tid": 18720, "ts": 1787952441741}
|
||||
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "keySize": 0, "pid": 18573, "tid": 18720, "ts": 1787952441742}
|
||||
{"event": "crypto-aes", "stage": "enter", "thisHex": "9087f7ff71000000637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0", "inSize": 131, "inHex": "020c0028111f9bc19a05f6375e6d0472000a20a2415d8b6aabfa9bf3bf77bf9aed6f02f19e6e9423fe3898ac1d77ae8ff7f0f8461f798abbd3d5b3db6c646dc8790eff9052bb3e36fabe9fecab26f98afaaa359a7ed6848a3a1f74d8c260c9932ea6bedf74b9cc4f2fe8f5cdcf17205a23f6df43169653c9a02fe853b91f2ac64089f1", "preSize": 0, "preHex": "", "pid": 18573, "tid": 18720, "ts": 1787952441743}
|
||||
{"event": "crypto-aes", "stage": "leave", "outSize": 144, "outHex": "7d556cac5a2f9cd2d8dc7ed30ec8e67cec511e84e1d485f7735c61576170ec37166e7db8310163f9e66a72ae048900b244a19df36b64d0978d2e82bbf50796b71e29fad066e7dc77b6729ebd28bfbd73958a84d09f4c6bf0316529b27d768c5883a1eca2c7cd260709235513b6d7cba6f12c8e55bd8d70f9d18b9060bad33941e54d2f41f1d5e95be69cf9d41d460089", "pid": 18573, "tid": 18720, "ts": 1787952441743}
|
||||
{"event": "crypto-otp", "stage": "leave", "outStr": null, "outHex": "", "outSize": 0, "pid": 18573, "tid": 18720, "ts": 1787952441743}
|
||||
{"event": "crypto-aes", "stage": "enter", "thisHex": "9087f7ff71000000637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0", "inSize": 2530, "inHex": "7b226c6f67696e486973746f7279223a5b7b22617070436f6d6d6f6e44617461223a2241414144575241444c4478414156594d614856355958566b596e646c596e56705a67396e5a58524263484244623231766255526864474639414145444a6767414167594a583364316346396b59585268485141424176734b43677757417a45754d4359505a325630515842775132397462323145595852684e6751314d44413451414e57744642526432567451553435546b6872576b74765458464c4e444e746357684a655842785456526855555650636d3159636a4d336546465761464661635464714e585644533342544d44467564477856616d7068617938325933557a6548644b593251305a5870724e544e725643745654577777526c4a324b335253527a4a77613070355546463051314e3357584633616b6b33616e42764d57387a61476c32516b30794d325a6e52474a446156566964576471566c5a47536a51354e306c4b5a6e426b5a6e5a61536d4a7264693831526b3033626d3834546c426f596e427656455a53566e686d6431706c61586b775057594164674347414a594143786f474947566b4d4752694f444d7a4e474e685a4751794d7a5a6a4d44426a5957526d4e3255784d5746694e574531466763784d7934304c6a49794a676b784c6a41754f4441784d7a67324145594a4d5449334c6a41754d43347856675a346157467662576c6d4141737141414557435530794d544179536a4a545179596f4e5749304d7a526a4e7a63344e446b774f4467354e6a6b334d5463775a5449794e5441794f5759314e6d466d5a6a4535593245304e7a59485957356b636d39705a455950545449784d444a4b4d6c4e444c444d774c4445785a6751784d446777646751794d54497768696733597a557a4f44646c4d44557a4f574d774d6a4e6a4d7a466a4e475a6d4d4755344d44646c4e7a49314e6a45784e7a4d344e57566c437a4d41414145585562686c62306341414145304e564645616b46425255524251554642596a4a584e46565359304a42515546435155316e636c4a566357644255564642546c5242643039445a30464f56306b7754587053616b3536597a524f524774335430526e4e553571617a4e4e56474e33576c524a6555355551586c5056316b78546d3147625670715254565a4d6b5577546e64525155355551586450536b6c42516b464f4f565a5865584e586153746a4d48527159325a305455393554316f344e305a465a5768505346566f5a6d52365745644757466c5952484e4f654670315a6d4a6e654546585544553162584235636d6454536b464d536b5676576a4e3659544a55555777304d48566e636e5978516a56684d306870626a597752324a754d30686c4d6d4e774e6a6c4c54437335597a56585332684f51", "preSize": 0, "preHex": "", "pid": 18573, "tid": 18720, "ts": 1787952441745}
|
||||
{"event": "crypto-aes", "stage": "leave", "outSize": 2544, "outHex": "2c02e414c627170e33e83cb05123e88e88839918362eee4fec760ae1ef59b22d878b8cce9165af12e1f2d68538cf6cf6ab72cff4b5343fd9d478345f2bf12d4e902ea0a5225ffd48120ef358f2227e8f161d7c64a5461265edffd89e832bc4c07fbf803d45425173171017241a5a3475e549ef81f4de47ac31202c45c9aa626712b7a397002c9319e3d1f006de44c2f80c2fa631e5671c44c06b5ed7085654594f3594092212b3cf2b11961a7429268ffe9643df17b2eb2a7e670118264534fd7828a83d0cd922c20eb73342282765b9ec45e0af010bc15b327afb3529b34bc665be7c99bff5ed6191f6561572ba550a7b305f4184a7daafe069df60a2859394178a73cca29f9ff1f6b1b9fe8b9813a31dcdbb222251bbb73baaa32f84751bab13a3d6e90675db150ec6ebfe3e9ad7565656c034cf1cbc59a7aad825570af663f725b89ad9a515b0be8f8a03d05b20b418eea66d60dfb302cb416e24968dbfc3f44e3e9c110ba144e2be22b09b39c3a5be9a8d7da40a703359824fcea4df6cd484c57fa3a47e25f32f5edb09322bdf91dd84f9731de94b93d3c7184f8811ab936fc9845e7aab780c79232cbe5b1b7ba0a4aa3b48519882da7d48d43d35b6353445e2a71bc9c5f2ffcc40f91d6ff2fbe8666beedf4e5d8572c6d575622db7e104e466c7aa13cc132741eec8241a05a5f1ea01b4700d55ea501a5901c45eb8c495868040bb00ce1a80f71af373ce665c7b91cbc4047ac43b6cafe700eb9d667cc68c61733243ec10b8aecf5e5dbf725dc0709ed44ce9a2205fb4a79273f38c332fc58d0b85fb53e6cf84662a9d7f77ba68f4d0ca2095733ca6ba47328922fcdd66c738d9b8d568dbf447573daf84698cc86681217441e768aa0cf0c49fb223db70480db03b97a4d8d5f923c70f974479bce8e06fa13b7ec283e506be2a220f9388daf025c12938a99e1dcebf10cfcb938b7665fa6b7460a3c91946307c94354877988d5379af267b4d21d40f9b5ad85254deab4b08279b4a0e380ae068c804c5bd265a659bb7b4020ef2801b30851d17857c328aec2fe3afaadbfc951a79384efeb05bd89ebc43be65f60a84719452e9d16a7a624834ad45e3be4429f8e73acd10ee272b87410dacdd41021c4bf954b883a5acadd8d6e197f04ef1701b22271a1083ef9ba60446bd1d8e9eec797f5c6c9902e5a2320d05bc4e3efe56abc2c328f5af2b47552bebd1fefacd7e642f1e1326bfff86f2a4a149943734185460f88f5eda6e2768d189506c472649a8cefddac607767be13216b4d725dde4e8b89e71016beddffabef34818a8f575b77dcc2a02d90320ba0d461c9b7795393e8ec42bf88d123d3107c2ab8e8bd20de8a920d5b2b4eb1fba0a504b3e9efd3484f87ebc20781c4f9829cc4dca241226ad82be16942f1331fcd603efeb3e8b35b05cd7b4b9", "pid": 18573, "tid": 18720, "ts": 1787952441749}
|
||||
{"event": "crypto-xxtea", "stage": "enter", "layer": "crypt_util", "keyStr": null, "keyHex": "", "inSize": 2928, "inHex": "7b226c6f67696e44617461223a7b22617070436f6d6d6f6e44617461223a2241414144575241444c4478414156594d614856355958566b596e646c596e56705a67396e5a58524263484244623231766255526864474639414145444a6767414167594a583364316346396b59585268485141424176734b43677757417a45754d4359505a325630515842775132397462323145595852684e6751314d44413451414e57744642526432567451553435546b6872576b74765458464c4e444e746357684a655842785456526855555650636d3159636a4d336546465761464661635464714e585644533342544d44467564477856616d7068617938325933557a6548644b593251305a5870724e544e725643745654577777526c4a324b335253527a4a77613070355546463051314e3357584633616b6b33616e42764d57387a61476c32516b30794d325a6e52474a446156566964576471566c5a47536a51354e306c4b5a6e426b5a6e5a61536d4a7264693831526b3033626d3834546c426f596e427656455a53566e686d6431706c61586b775057594164674347414a594143786f474947566b4d4752694f444d7a4e474e685a4751794d7a5a6a4d44426a5957526d4e3255784d5746694e574531466763784d7934304c6a49794a676b784c6a41754f4441784d7a67324145594a4d5449334c6a41754d43347856675a346157467662576c6d4141737141414557435530794d544179536a4a545179596f4e5749304d7a526a4e7a63344e446b774f4467354e6a6b334d5463775a5449794e5441794f5759314e6d466d5a6a4535593245304e7a59485957356b636d39705a455950545449784d444a4b4d6c4e444c444d774c4445785a6751784d446777646751794d54497768696733597a557a4f44646c4d44557a4f574d774d6a4e6a4d7a466a4e475a6d4d4755344d44646c4e7a49314e6a45784e7a4d344e57566c437a4d41414145585562686c62306341414145304e564645616b46425255524251554642596a4a584e46565359304a42515546435155316e636c4a566357644255564642546c5242643039445a30464f56306b7754587053616b3536597a524f524774335430526e4e553571617a4e4e56474e33576c524a6555355551586c5056316b78546d3147625670715254565a4d6b5577546e64525155355551586450536b6c42516b464f4f565a5865584e586153746a4d48527159325a305455393554316f344e305a465a5768505346566f5a6d52365745644757466c5952484e4f654670315a6d4a6e654546585544553162584235636d6454536b464d536b5676576a4e3659544a55555777304d48566e636e5978516a56684d306870626a597752324a754d30686c4d6d4e774e6a6c4c54437335597a56585332684f51325a5552", "rawIn": "790b000000000000700b000000000000003c4cfe710000b4", "rawKey": "206e4c4642333056756f254b367a694d21004cfe710000b4", "pid": 18573, "tid": 18720, "ts": 1787952441752}
|
||||
{"event": "crypto-xxtea", "stage": "leave", "layer": "crypt_util", "outSize": 2932, "outHex": "5cbec97f53c1c67639156ddd709d1fc92498d6d14ee67529a78010731d5aac46514150db7037e1e4341496b21cb9abfb9b4ffdfca15c22589d0287289e5aefbcd6fa442ea321ea1d4f201e7e2687af42c58ce2cecd012130badd6cef8c454ce2cd4050795f017ccc018efdddf3b08643566db398ede04e05ed6b03255de918901594714a5f2077c842775c94d417b5dc3b12a6e753f0d5976e9f1350657ab86b593896309de7acef6ea5376c3f365fe269c3ff1c59763d4db24b78095b7b8c889e646a394c648f7864e9e14527e98a9c1cf1d40b07b9f5f79af8d8a0fff43b04758fbc26e944f26847377092b6a64355cd6289af4b9aa982a2323d6e15507e754999dfae0669f4bef708da345225a99a2cf46cc3f7b38c024de4b1b398707c691dd0f51b6fc9a00bb33216492e7aedf5c8b42d7a08d27fcf0ff631b4e1df62ed5ff97ee61d91057b2389c10d91226b2e434f2f45dff5f208b9d24e83c1a4b3ad9ff546c02ae62e7a57e22c560d07278dbefb1c881c208a14b220594d06a016a737e938fe43b3e7ebc9b8a7708a3b5bc8247c10f4da91971752dd6827c4374644a51974a7dc8ad63d596dc28e45aee918c01357ff4c61d52f8b2dd7bf72a5f9892090b0d992270b0733e1a9424438325f955af6da1ccd86f968b91cdc7e9de72f60812aae13e327cc7b58dc11cb215d40af3e78804548828c2a62377566eeb7a9660cdfac859d416d594d7851bd70d07492d0035c8bc0d52df4b76edcc5a5fe9f5edc05f21cf04311a2caa5a5fdce21d4b9fa48b3a94ea24774decb46ba44653eae7f47008e89dc66d04707a6cc30e0d2a1e7dc051a619496fc31718f2e9a0b867650e4e86a65eb8a9b327ea5ce2f2589f97e5d5886ca1380fceaeabfec1fb079ad734a3fefb42393014a03188f39dc3499c2312cde53db3a849e6ce96969cc43421d0f80aa8efe595849661f6f6645cacb87e69c822607a3f3fd7c99f6733a771c8a80ede1eee588b3f43a502f79ce6f57110f01fc69e8d8235d71c761506a0bd6bd8fb694266cdb5059288e65bbfd74cda28b4ff4d3440a090487497e359eb64f6eb2623e67b0c78e61173de220c37b22dcd29f663e458917b6853bbb6eba2d0e5248ead3bbe2c5fc922ced65c65f12d41585f0de12e4c506c24c530540b75f8b6a0ea1ad8a6ecebc6158ffbecadcb3e352c4d2e07e43fc1a5b2312b33ee6c3b60200463b3aed63ad2e87e0af62b034c182d792879e495d3dde5d9c0a2f0a90499284c3d7568d77a3ccb95ab486b8882294c6a079b6518e5248b3f8c049ffa6b73fb481027d1d02405370a9f3ddb74e7cd6a4827dc112cf25bb0a738912411f4df3bf2b0750a1acd419ea412e66b958bf18452ec2840d8819e37dd7af2f3d4fb61ffd8f90a8ea95d6a053b15434c0d94fa1c78ea4c14c54b15385dba5ba4a3d", "pid": 18573, "tid": 18720, "ts": 1787952441753}
|
||||
{"event": "crypto-aes", "stage": "enter", "thisHex": "9087f7ff71000000637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0", "inSize": 3912, "inHex": "584c374a66315042786e593546573364634a3066795353593174464f356e5570703441516378316172455a525156446263446668354451556c724963756176376d302f392f4b4663496c6964416f636f6e6c7276764e62365243366a49656f64547941656669614872304c466a4f4c4f7a5145684d4c7264624f2b4d52557a697a55425165563842664d77426a7633643837434751315a7473356a7434453446375773444a563370474a41566c48464b5879423379454a33584a5455463758634f784b6d35315077315a64756e784e515a58713461316b346c6a436435367a766271553362443832582b4a70772f38635758593954624a4c65416c62653479496e6d52714f55786b6a33686b366546464a2b6d4b6e427a7831417348756658336d766a596f502f304f7752316a37776d3655547961456333634a4b32706b4e567a574b4a7230756171594b694d6a31754656422b64556d5a333634476166532b39776a614e46496c715a6f7339477a4439374f4d416b336b73624f59634878704864443147322f4a6f41757a4d685a4a4c6e7274396369304c586f49306e2f50442f5978744f4866597531662b58376d485a454665794f4a77513252496d73755130387652642f3138676935306b36447761537a725a2f315273417135693536562b4973566730484a34322b2b7879494843434b464c4967575530476f42616e4e2b6b342f6b4f7a352b764a754b6477696a746279435238455054616b5a63585574316f4a385133526b536c4758536e3349725750566c74776f354672756b5977424e582f30786831532b4c4c64652f6371583569534351734e6d534a7773484d2b4770516b51344d6c2b5657766261484d32472b576935484e782b6e656376594945717268506a4a387837574e775279794664514b382b6549424653494b4d4b6d49336457627574366c6d444e2b73685a314262566c4e65464739634e42306b7441445849764131533330743237637861582b6e3137634266496338454d526f73716c7066334f496453352b6b697a7155366952335465793061365247552b726e39484149364a334762515277656d7a4444673071486e33415561595a53572f4446786a79366143345a32554f546f616d5872697073796671584f4c79574a2b5835645749624b453444383675712f37422b776561317a536a2f7674434f5441556f44474938353344535a776a4573336c50624f6f5365624f6c706163784451683050674b714f2f6c6c595357596662325a4679737548357079434a67656a382f31386d665a7a4f6e6363696f44743465376c694c50304f6c4176656335765678455041667870364e676a5858484859564271433961396a3761554a6d7a6255466b6f6a6d57372f58544e6f6f7450394e4e4543676b4568306c2b4e5a3632", "preSize": 0, "preHex": "", "pid": 18573, "tid": 18720, "ts": 1787952441754}
|
||||
{"event": "crypto-aes", "stage": "leave", "outSize": 3920, "outHex": "a28269088ef6e4a05cba776b7eb68930fa420b0590ef4d41835d6dd6073733ac07417f187c9de3af41262631a1fd8ba4f5e9f76ab88e96365e4bd94b6e47bb2b2f281f5f87f4f457397621fb3fa7314c58f3d9f8bd7d8eac1e328f1a6fcbda99fe1b9ef3c300f6653c1c620229118af5f7ffb2a868cae371140904eb5ab4d25f60dcf9ef3add7b1a8ff529bdfde2199a0c1c00b419cb11974f8d7876ef291993587e61caff116eb68bda93ec516a1c67795f2011d8fe01d8a7fc00aa5553bf62ae779370031b60e0361f99e854dcdb967ccfe873abd0fca31e8aae56714f87463d2e9f934903a6a87f75bf3da321e25569077d9ce6742b7b00d56602d3a640112ea27786e08e4fde72d6014fe4eee07546b9abfb952c50fe34b9e8dad6b5554cf5a15e50a53968426c8d872a535c566526da1752124b7d66533d7f13c7307d770dbf269801c5c4aff19fe3a49cf1e0d693f3859df5436fd4ad95f918248d8099bd6252250fb746bd51dc291c88d1d44905ee17bb2953809fb217f0786e522519ae98539a51d73b9b45020c6d4f2b8e10c2a81686794f8c0cdbdd469c62cfae93c9a7dc81df55d9b6d69c50110b370f0b42ae0eb66f347b71dc3c62a82b217fad17cf0cded1fa40b196d6c0754b7d67937c997126e809f6587ec85015d801845da5528c253d3de62c550d22cfd338dca17bd400e1a8d82c8fe4d4fcba5335bfcfb223c4bcf4fddc67504ff71500577a29e2fd00e9c5fd32746d451d9e665f41ac87c9d4df3b987775d044c8adf45bc9701318eff1da063590103ea0769fc04516c3947027d42049b9e27527663529382aaeee09a6db24ff9af8eb739cbaa9fe71e75ad351645e63828cc66fbd33ff756a1a57d6ad2f709552de278072d14c34d36b66256362129fcf0d20d66bcd9c406614e8e1b42b171e9d981d3b4c1f1860615026e471c3f10e31a9ba8183e88ec325c7e776915d9ea4460ca729b345a1cd63701a7901a468e443a58a8fd29c29f2db1c761685f0e32e384c0e76a6539ba78c9027587e87f6591976b7b4335e14da27d3045266db0ebad300ffde41c2464e5e14f8de9b2cd0d2ecb27bbf04e3195b13d6e7d7cf9cbc22c3d006b4ff936a4557e81dfa23eb65175769f046a2c091a974ceffed9723f8ed2dcef99029e04568d7237034792a847b45a419ee03cdc7443965ad964c2d8b571356c19995ecbda57f612d1f57eef31e55f13bfd753e71a43f2d5e33178ae2a6428fc3a883ad35b211dce44f1f7bc2042aa85ea2b70c002b5008f2ac7998c607c96c21de4aef635928a15e32ee1981cc591acea7a932f9045fdb63b825c242b081472ad91aa2c53cdef8ebcb8195078508b8302b97d26673b6640608243a6abe524169be4a816cf821ef18f1ec9c911ae53e20b87e4f80e0f63cb822ade2c7e7ee76de03766a9f7d29", "pid": 18573, "tid": 18720, "ts": 1787952441756}
|
||||
@@ -114,9 +114,9 @@ function hookByName(needle, event, onEnterFn, onLeaveFn) {
|
||||
}
|
||||
}
|
||||
|
||||
// 栈上 std::string& 出参: 入口 sp 指向返回地址, 出参指针在 sp+8
|
||||
// 栈上 std::string& 出参 (第9+个参数): AAPCS64 栈上首槽 = [sp] (返回地址在 x30/lr)
|
||||
function stackStrPtr(ctx) {
|
||||
try { return ctx.sp.add(8).readPointer(); } catch (_) { return null; }
|
||||
try { return ctx.sp.readPointer(); } catch (_) { return null; }
|
||||
}
|
||||
|
||||
function install() {
|
||||
|
||||
@@ -26,7 +26,7 @@ PKG = "com.duowan.kiwi"
|
||||
SERVER_PATH = "/data/local/tmp/fs152"
|
||||
SERVER_PORT = "31878"
|
||||
BYpass_RE = "/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0/evidence/scripts/bypass_msaoaid_maps_art_callsite.js"
|
||||
HOOK_LOCAL = os.path.join(HERE, "hook_otp_capture.js")
|
||||
HOOK_LOCAL = os.environ.get("CAP_HOOK", "/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0/evidence/scripts/hook_huya_crypto.js")
|
||||
|
||||
MAX_ATTEMPTS = int(os.environ.get("CAP_MAX_ATTEMPTS", "8"))
|
||||
WINDOW_SEC = int(os.environ.get("CAP_WINDOW", "150"))
|
||||
|
||||
@@ -72,6 +72,32 @@ public class GoldSweep {
|
||||
return p;
|
||||
}
|
||||
|
||||
/** 空串按 LONG 形态写 (cap=1/size=0/data->0x1400) — libc++ 经典布局 */
|
||||
UnidbgPointer writeStdStringEmptyLong(String tag) {
|
||||
Memory mem = emulator.getMemory();
|
||||
UnidbgPointer p = mem.malloc(24, false).getPointer();
|
||||
byte[] buf = new byte[24];
|
||||
buf[0] = 1; // cap=1, LSB=1 (long)
|
||||
p.write(0, buf, 0, 22);
|
||||
UnidbgPointer heap = mem.malloc(8, false).getPointer();
|
||||
heap.write(0, tag.getBytes(), 0, Math.min(1, tag.length()));
|
||||
p.write(16, new byte[8], 0, 8); // data ptr slot
|
||||
byte[] ptrBytes = new byte[8];
|
||||
long pv = UnidbgPointer.nativeValue(heap);
|
||||
for (int i = 0; i < 8; i++) ptrBytes[i] = (byte) (pv >> (8 * i));
|
||||
p.write(16, ptrBytes, 0, 8);
|
||||
return p;
|
||||
}
|
||||
|
||||
/** 空串按 SSO 形态写 */
|
||||
UnidbgPointer writeStdStringEmptySso() {
|
||||
Memory mem = emulator.getMemory();
|
||||
UnidbgPointer p = mem.malloc(24, false).getPointer();
|
||||
byte[] buf = new byte[24];
|
||||
p.write(0, buf, 0, 24); // 全零: byte0=0 -> SSO len0
|
||||
return p;
|
||||
}
|
||||
|
||||
UnidbgPointer writeStdString(String s) {
|
||||
Memory mem = emulator.getMemory();
|
||||
byte[] data = s.getBytes();
|
||||
@@ -140,6 +166,17 @@ public class GoldSweep {
|
||||
}
|
||||
|
||||
/** 直调 OTP, 返回 [04][cnt][16B mid][16B tail] 的 hex; 出错返回 null */
|
||||
String otpHexPtrs(UnidbgPointer pa, long cnt, UnidbgPointer ps3, UnidbgPointer ps4, UnidbgPointer ps5, long nonce) {
|
||||
UnidbgPointer pout = writeStdString("");
|
||||
try {
|
||||
module.callFunction(emulator, 0x32fa24L,
|
||||
UnidbgPointer.nativeValue(pa), 2L, cnt,
|
||||
UnidbgPointer.nativeValue(ps3), UnidbgPointer.nativeValue(ps4), UnidbgPointer.nativeValue(ps5),
|
||||
4L, nonce, UnidbgPointer.nativeValue(pout));
|
||||
return toHex(readStdString(pout));
|
||||
} catch (Throwable tx) { System.out.println("[otpHexPtrs EXC] " + tx); return null; }
|
||||
}
|
||||
|
||||
String otpHex(String in, long cnt, String s3, String s4, String s5, long nonce) {
|
||||
UnidbgPointer pa = writeStdString(in);
|
||||
UnidbgPointer ps3 = writeStdString(s3);
|
||||
@@ -152,7 +189,7 @@ public class GoldSweep {
|
||||
UnidbgPointer.nativeValue(ps3), UnidbgPointer.nativeValue(ps4), UnidbgPointer.nativeValue(ps5),
|
||||
4L, nonce, UnidbgPointer.nativeValue(pout));
|
||||
return toHex(readStdString(pout));
|
||||
} catch (Throwable tx) { return null; }
|
||||
} catch (Throwable tx) { System.out.println("[otpHex EXC] " + tx); return null; }
|
||||
}
|
||||
|
||||
/** 直调 OTP (s5 二进制) */
|
||||
@@ -168,7 +205,7 @@ public class GoldSweep {
|
||||
UnidbgPointer.nativeValue(ps3), UnidbgPointer.nativeValue(ps4), UnidbgPointer.nativeValue(ps5),
|
||||
4L, nonce, UnidbgPointer.nativeValue(pout));
|
||||
return toHex(readStdString(pout));
|
||||
} catch (Throwable tx) { return null; }
|
||||
} catch (Throwable tx) { System.out.println("[otpHexB EXC] " + tx); return null; }
|
||||
}
|
||||
|
||||
static byte[] hexBytes(String h) {
|
||||
@@ -551,6 +588,35 @@ public class GoldSweep {
|
||||
System.out.println("[I] DONE " + n + " calls");
|
||||
break;
|
||||
}
|
||||
case "GOLD": { // 正确UID重扫: in="1199666914671"(hy_300023887稳定uid) s3="5008" s5=金cred — 单点+全窗
|
||||
String T = "ed0db8334cadd236c00cadf7e11ab5a5";
|
||||
String credHex = "0a80ee56427cac9512d4b1efb6de70f89d402e40cbf4a224e127c8f588f523a917113306f36b1596b3a47f6c0765e5ce3acb549adecb0c9bdcf88f8464155289e0ef46becb08217e4fae6fa87d8702b9e641baa1ebf3e0347669cb9b40bf4c38331020b680c89df4982ab935d5c381a91f";
|
||||
byte[] cb = hexBytes(credHex);
|
||||
long[] sts = {1787595090906L, 1787595102531L, 1787595167182L, 1787595172449L, 1787595172452L, 1787595172455L, 1787595172458L};
|
||||
for (long st : sts)
|
||||
for (long cnt = 1; cnt <= 15; cnt++)
|
||||
for (long nc = 0; nc <= 2; nc++) {
|
||||
long nonce = (nc & 0xffffL) | (st << 16);
|
||||
String out = p.otpHexB("1199666914671", cnt, "5008", K1C, cb, nonce);
|
||||
if (out != null && out.length() >= 34 && out.substring(2, 34).equals(T)) {
|
||||
System.out.println("!!! REAL-HIT cnt=" + cnt + " st=" + st + " nc=" + nc);
|
||||
}
|
||||
}
|
||||
System.out.println("[K] singles done");
|
||||
long n = 0;
|
||||
for (long cnt = 1; cnt <= 15; cnt++)
|
||||
for (long st = 1787595165000L; st <= 1787595172700L; st += 1)
|
||||
for (long nc = 0; nc <= 2; nc++) {
|
||||
long nonce = (nc & 0xffffL) | (st << 16);
|
||||
String out = p.otpHexB("1199666914671", cnt, "5008", K1C, cb, nonce);
|
||||
if (out != null && out.length() >= 34 && out.substring(2, 34).equals(T)) {
|
||||
System.out.println("!!! REAL-HIT cnt=" + cnt + " st=" + st + " nc=" + nc);
|
||||
}
|
||||
if (++n % 50000 == 0) System.out.println("[K] " + n + " (st=" + st + ")");
|
||||
}
|
||||
System.out.println("[K] DONE " + n + " calls");
|
||||
break;
|
||||
}
|
||||
case "J": { // 正确语义: in="", s3="", s4=k1, s5=金样本cred — 单点+全窗
|
||||
String T = "ed0db8334cadd236c00cadf7e11ab5a5";
|
||||
String credHex = "0a80ee56427cac9512d4b1efb6de70f89d402e40cbf4a224e127c8f588f523a917113306f36b1596b3a47f6c0765e5ce3acb549adecb0c9bdcf88f8464155289e0ef46becb08217e4fae6fa87d8702b9e641baa1ebf3e0347669cb9b40bf4c38331020b680c89df4982ab935d5c381a91f";
|
||||
@@ -608,6 +674,33 @@ public class GoldSweep {
|
||||
System.out.println("[J2] DONE " + n + " calls");
|
||||
break;
|
||||
}
|
||||
case "K3": { // 复验 live 捕获: otp("",2,"",k1, s5=0a30fb..., nonce=0x1a04a405a7c0000) == 0402bfe6496f...
|
||||
byte[] s5 = hexBytes("0a30fb7b0617ae74fd0a4defe5e1059ff6e2781dd245bbfa304133d379f3465fc49bf462bc7c96678b1f314c26fc87ebc9adf05983500435bed7a0310856c995a30ca1a41af034236445b1c48478378c1181d7186e763c18794ba9a4335c2ac5b381fbf6f99830f26ffc3c4a4c2046c642eb");
|
||||
String out = p.otpHexB("", 2L, "", K1C, s5, 0x1a04a405a7c0000L);
|
||||
System.out.println("K3 out=[" + out + "]");
|
||||
// 空串变体测试: SSO-empty vs LONG-empty
|
||||
UnidbgPointer paL = p.writeStdStringEmptyLong("k");
|
||||
UnidbgPointer ps3L = p.writeStdStringEmptyLong("s");
|
||||
UnidbgPointer paS = p.writeStdStringEmptySso();
|
||||
UnidbgPointer ps3S = p.writeStdStringEmptySso();
|
||||
UnidbgPointer ps4 = p.writeStdString(K1C);
|
||||
UnidbgPointer ps5 = p.writeStdStringBytes(s5);
|
||||
long nonce = 0x1a04a405a7c0000L;
|
||||
String[] outs = new String[4];
|
||||
outs[0] = p.otpHexPtrs(paS, 2L, ps3S, ps4, ps5, nonce); // SSO/SSO
|
||||
outs[1] = p.otpHexPtrs(paL, 2L, ps3S, ps4, ps5, nonce); // LONG/SSO
|
||||
outs[2] = p.otpHexPtrs(paS, 2L, ps3L, ps4, ps5, nonce); // SSO/LONG
|
||||
outs[3] = p.otpHexPtrs(paL, 2L, ps3L, ps4, ps5, nonce); // LONG/LONG
|
||||
for (int i = 0; i < 4; i++) {
|
||||
System.out.println("K3-var" + i + " -> [" + (outs[i]==null?"null":outs[i].substring(0, Math.min(16, outs[i].length()))) + "]");
|
||||
}
|
||||
if (out != null) {
|
||||
System.out.println("K3 firstblock=" + out.substring(2, 34));
|
||||
System.out.println("K3 need =bfe6496f781fa7005df2051bea5e0dce");
|
||||
System.out.println("K3 MATCH=" + out.substring(2, 34).equals("bfe6496f781fa7005df2051bea5e0dce"));
|
||||
}
|
||||
break;
|
||||
}
|
||||
case "V2": { // 复验: 真实 146B, s5=完整 114B cred, 精确 nonce — 比对输出[2:34](真值 首块=cipher[0:16])
|
||||
String credHex = "0a6028ce6a24d74b0e9b503050db127e3390d37d4a696ef46530804aaec7f9fa6ddc2142035729b8cecd102bf9402930aac60f21c293697e3b9b54fdbf976819b70078c2fa8b64bd9d14246eb4adc807ecf6bfdcc585f9a7b39524f88bea62135eb229e65512e6acd7a831ba772d5f374bf3";
|
||||
byte[] s5 = hexBytes(credHex);
|
||||
|
||||
Reference in New Issue
Block a user