From 47bc38d6382e8e4b7147f6ac62969b56264ff0a1 Mon Sep 17 00:00:00 2001 From: yml2213 Date: Sat, 29 Aug 2026 07:07:59 +0800 Subject: [PATCH] =?UTF-8?q?test(huya):=20b87=5F=20harness=E7=9B=B4?= =?UTF-8?q?=E8=B0=83=E6=89=A7=E8=A1=8C=E9=80=9A=E8=BF=87(ret=3D-1=3D?= =?UTF-8?q?=E5=88=9D=E5=A7=8B=E5=8C=96=E6=80=81=E7=BC=BA=E5=A4=B1)=20(R21?= =?UTF-8?q?=E8=A1=A5)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/HUYA_HDID_ALGORITHM_GEN.md | 6 ++++++ tools/unidbg/hydev/src/hydev/TuringProbe.java | 13 +++++++++---- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md index 5bfe6ab..acbd84a 100644 --- a/docs/HUYA_HDID_ALGORITHM_GEN.md +++ b/docs/HUYA_HDID_ALGORITHM_GEN.md @@ -1221,3 +1221,9 @@ dfpReport: tReq = [10B 魔数 57 18 82 cf 66 4b b3 94 01 ee][3988B 加密采 1. **直调 b87_@0x25c98** (JNI 封送: vaList/int-handle) — 喂真实捕获 blob → 输出 SparseArray = 证据事件 = 明文! 2. JNI_OnLoad x0: 追踪 onLoad 内部分配链 (0x12b6c 原子函数的调用者) 3. ga 侧 JNI 表 (turingga.so 同法解剖) → a209202_ 族入口 + +### R21-补充: b87_ harness 直调结果 (2026-08-29) +- addLocalObject 句柄封送 (int 句柄作 jobject) — **调用执行成功** (不再 Unsupported arg) +- 三种输入 (全POST/cipher-only/magic+cipher) × int{0,1} = 全部确定性 **ret=-1** +- 判定: jobject 封送通; -1 = turing 全局初始化态缺失 (config/dat 未载入) 或 SparseArray 内容格式不符 +- 下一步: (a) onLoad 初始化链修复后直调 (x0 原子问题先解), (b) 或喂 SparseArray 事件内容探格式 diff --git a/tools/unidbg/hydev/src/hydev/TuringProbe.java b/tools/unidbg/hydev/src/hydev/TuringProbe.java index c61aec2..5edb4fc 100644 --- a/tools/unidbg/hydev/src/hydev/TuringProbe.java +++ b/tools/unidbg/hydev/src/hydev/TuringProbe.java @@ -123,11 +123,16 @@ public class TuringProbe { DvmObject sa = vm.resolveClass("android/util/SparseArray").newObject(null); DvmObject dba = vm.resolveClass("[B").newObject(blob); DvmObject map = vm.resolveClass("java/util/HashMap").newObject(null); - // 直调 impl: module.base + 0x25c98; 参数: env, null, sa, dba, map, 1 + // 直调 impl: module.base + 0x25c98; 参数: env, null, 局部引用句柄(int), ..., 1 long fn = m.base + 0x25c98; - System.out.println("[TP] calling b87_ @ " + Long.toHexString(fn) + " blob=" + blob.length + "B"); - Number ret = m.callFunction(emulator, fn, vm.getJavaVM(), null, sa, dba, map, 1); - System.out.println("[TP] b87_ ret=" + ret); + int hsa = vm.addLocalObject(sa); + int hba = vm.addLocalObject(dba); + int hmap = vm.addLocalObject(map); + System.out.println("[TP] calling b87_ @ " + Long.toHexString(fn) + " blob=" + blob.length + + " refs hsa=" + hsa + " hba=" + hba + " hmap=" + hmap); + int iv = Integer.parseInt(System.getenv().getOrDefault("TP_INT", "1")); + Number ret = m.callFunction(emulator, fn, vm.getJavaVM(), null, hsa, hba, hmap, iv); + System.out.println("[TP] b87_ ret=" + ret + " int=" + iv + " blob=" + blobPath); } catch (Throwable t) { System.out.println("[TP] callEnc EXC " + t); t.printStackTrace(System.out);