From 4c7f27468afc3e617def21343de2c73800432553 Mon Sep 17 00:00:00 2001 From: yml2213 Date: Sat, 29 Aug 2026 03:04:58 +0800 Subject: [PATCH] =?UTF-8?q?feature(huya):=20nonce=E7=AE=97=E6=B3=95?= =?UTF-8?q?=E7=A0=B4=E8=A7=A3(nonce=3Dcounter|serviceTime<<16)+=E7=9B=B4?= =?UTF-8?q?=E8=B0=83=E9=80=90=E5=AD=97=E8=8A=82=E5=A4=8D=E7=8E=B0getOtp?= =?UTF-8?q?=E5=86=85=E9=83=A8=20-=20=E5=B7=AE=E5=88=86=E9=9D=B6=E5=90=91?= =?UTF-8?q?=E5=8C=96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/HUYA_HDID_ALGORITHM_GEN.md | 8 ++ tools/unidbg/hydev/src/hydev/AesProbe.java | 108 +++++++++++++++++++++ 2 files changed, 116 insertions(+) diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md index aa6e713..2687333 100644 --- a/docs/HUYA_HDID_ALGORITHM_GEN.md +++ b/docs/HUYA_HDID_ALGORITHM_GEN.md @@ -880,3 +880,11 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a - direct(nonce=0)=f0012daf / nonce=1=34bd49f5 / nonce=real(0x1a049abb20b0000)=561269ff - nonce=real 仍 ≠ getOtp 内部 7c0e461e → 剩余差异 = s5 槽 junk 字节 / OTP 内部状态 - 差分空间扩展: mid = f(in, cnt, s3, s4, s5, nonce) + +## §11.41 🏆 nonce 算法反汇编破解 (R12): nonce = counter | (serviceTime << 16) +### nonce_next@0x32ff10 直读: + [0x4933b0] 存 base; 若 arg0(serviceTime) 变化→counter 清零+存新 base; 否则 counter++ + return counter | (serviceTime << 16) +### 验证完美: 直调 (in="0",cnt=1,s3=s4="hy_300023887",s5="",nonce=0x1a049befebf0000) = getOtp 内部 04c7537f 逐字节一致!! +### 差分靶向化 (5184 combos: ST×cnt×s3×s4) = 零命中 +- 遗留: ①金样本真实 serviceTime (13位ms) ②s3/s4 真值 (BusinessCfg 登录数据) diff --git a/tools/unidbg/hydev/src/hydev/AesProbe.java b/tools/unidbg/hydev/src/hydev/AesProbe.java index fee1438..6e05cb6 100644 --- a/tools/unidbg/hydev/src/hydev/AesProbe.java +++ b/tools/unidbg/hydev/src/hydev/AesProbe.java @@ -209,6 +209,104 @@ public class AesProbe { System.out.println("[burst2] n=" + n + " hits=" + hit + " in " + dt + "ms"); } + void goldBurst(long nonce) { + String G = "ed0db8334cadd236c00cadf7e11ab5a5"; + String[] A = {"", "hy_300023887", "300023887", "772ed992b0e161276f44ec63671e60155c506294", + "1e8bdf7d4f7a01d3", "13.4.22", "1.0.80138", "7c5387e0539c023c31c4ff0e807e7256117385ee", + "5008", "xiaomi", "127.0.0.1"}; + String[] I = {"0", "1", "3251699", "300023887", "1724464550000", "1724464550", "", "13.4.22"}; + long[] C = {0, 1, 2, 3}; + int n = 0; + for (String s3 : A) for (String s4 : A) for (String in : I) for (long cnt : C) { + n++; + UnidbgPointer pa = writeStdString(in), ps3 = writeStdString(s3), ps4 = writeStdString(s4), ps5 = writeStdString(""), pout = writeStdString(""); + try { + module.callFunction(emulator, 0x32fa24L, UnidbgPointer.nativeValue(pa), 2L, cnt, + UnidbgPointer.nativeValue(ps3), UnidbgPointer.nativeValue(ps4), UnidbgPointer.nativeValue(ps5), + 4L, nonce, UnidbgPointer.nativeValue(pout)); + String out = readStdString(pout); + if (out.length() >= 36) { + String mid = toHex(out).substring(4, 36); + if (mid.equals(G)) { System.out.println("!!! GOLD-HIT nonce=" + Long.toHexString(nonce) + " in=" + in + " cnt=" + cnt + " s3=" + s3 + " s4=" + s4); } + } + } catch (Throwable tx) {} + } + System.out.println("[gold] nonce=" + Long.toHexString(nonce) + " n=" + n + " done"); + } + + void goldBurst2() { + String G = "ed0db8334cadd236c00cadf7e11ab5a5"; + String[] A = {"", "hy_300023887", "300023887", "772ed992b0e161276f44ec63671e60155c506294", + "1e8bdf7d4f7a01d3", "13.4.22", "1.0.80138", "duowan", "5008", "xiaomi", "127.0.0.1", "ED"}; + long[] ST = {1724464550000L, 1724464550000L + 1, 1724464550L, 1724464550L + 1, + 1724464000000L, 1724465000000L, 1724464550123L, 12916753251699L, 0L}; + long[] CNT = {0, 1, 2, 3}; + int n = 0, hit = 0; + for (long st : ST) { + long nonceBase = st << 16; + for (long cnt : CNT) for (String s3 : A) for (String s4 : A) { + n++; + String in = Long.toString(st); + long nonce = nonceBase + cnt; + UnidbgPointer pa = writeStdString(in), ps3 = writeStdString(s3), ps4 = writeStdString(s4), ps5 = writeStdString(""), pout = writeStdString(""); + try { + module.callFunction(emulator, 0x32fa24L, UnidbgPointer.nativeValue(pa), 2L, cnt, + UnidbgPointer.nativeValue(ps3), UnidbgPointer.nativeValue(ps4), UnidbgPointer.nativeValue(ps5), + 4L, nonce, UnidbgPointer.nativeValue(pout)); + String out = readStdString(pout); + if (out.length() >= 36) { + String mid = toHex(out).substring(4, 36); + if (mid.equals(G)) { System.out.println("!!! GOLD-HIT st=" + st + " cnt=" + cnt + " s3=" + s3 + " s4=" + s4 + " nonce=" + Long.toHexString(nonce)); hit++; } + else if (n % 1000 == 0) { } + } + } catch (Throwable tx) {} + } + } + System.out.println("[gold2] n=" + n + " hits=" + hit); + } + + void seqOtp() { + String G = "ed0db8334cadd236c00cadf7e11ab5a5"; + String inT = "1724464550000"; String s3T = "hy_300023887"; String s4T = "300023887"; + for (int pre = 0; pre <= 12; pre++) { + // 先跑 pre 次任意预调用 (推进状态) + for (int i = 0; i < pre; i++) { + UnidbgPointer ppa = writeStdString(inT), pp3 = writeStdString(s3T), pp4 = writeStdString(s4T), pp5 = writeStdString(""), ppo = writeStdString(""); + try { module.callFunction(emulator, 0x32fa24L, UnidbgPointer.nativeValue(ppa), 2L, (long)(i + 1), + UnidbgPointer.nativeValue(pp3), UnidbgPointer.nativeValue(pp4), UnidbgPointer.nativeValue(pp5), + 4L, 0x1a049abb20b0000L + (long)(i * 7 + 1), UnidbgPointer.nativeValue(ppo)); } catch (Throwable tx) {} + } + // 目标调用 + UnidbgPointer pa = writeStdString(inT), ps3 = writeStdString(s3T), ps4 = writeStdString(s4T), ps5 = writeStdString(""), pout = writeStdString(""); + try { + module.callFunction(emulator, 0x32fa24L, UnidbgPointer.nativeValue(pa), 2L, (long)(pre + 1), + UnidbgPointer.nativeValue(ps3), UnidbgPointer.nativeValue(ps4), UnidbgPointer.nativeValue(ps5), + 4L, 0x1a049abb20b0000L + (long)(pre * 7 + 1), UnidbgPointer.nativeValue(pout)); + String out = readStdString(pout); + String mid = out.length() >= 36 ? toHex(out).substring(4, 36) : ""; + System.out.println("[seq] pre=" + pre + " mid=" + mid + (mid.equals(G) ? " <<< HIT!!! in=" + inT + " s3=" + s3T + " s4=" + s4T : "")); + } catch (Throwable tx) { System.out.println("[seq] pre=" + pre + " err"); } + } + } + + String reproJunk(String in, long cnt, String s3, String s4, long nonce) { + UnidbgPointer pa = writeStdString(in), ps3 = writeStdString(s3), ps4 = writeStdString(s4), pout = writeStdString(""); + // 手工 junk 24B 串对象 (flag=0 SSO + 字节1=0x01 + 字[16]=0x1256528c) + com.github.unidbg.memory.MemoryBlock mbj = emulator.getMemory().malloc(64, false); + UnidbgPointer jp = mbj.getPointer(); + byte[] jobj = new byte[24]; + jobj[0] = 0x00; jobj[8] = 0x01; + for (int k = 0; k < 4; k++) jobj[16 + k] = (byte)((0x1256528cL >>> (8 * k)) & 0xff); + jp.write(0, jobj, 0, 24); + try { + module.callFunction(emulator, 0x32fa24L, + UnidbgPointer.nativeValue(pa), 2L, cnt, + UnidbgPointer.nativeValue(ps3), UnidbgPointer.nativeValue(ps4), UnidbgPointer.nativeValue(jp), + 4L, nonce, UnidbgPointer.nativeValue(pout)); + return toHex(readStdString(pout)); + } catch (Throwable tx) { return "err:" + tx; } + } + String reproOtp(String in, long cnt, String s3, String s4, String s5, long nonce) { UnidbgPointer pa = writeStdString(in), ps3 = writeStdString(s3), ps4 = writeStdString(s4), ps5 = writeStdString(s5), pout = writeStdString(""); try { @@ -698,6 +796,14 @@ public class AesProbe { public static void main(String[] args) throws Exception { String so = args.length > 0 ? args[0] : "so/libudbauthunify_merged.so"; AesProbe p = new AesProbe(so); + p.seqOtp(); + String gChk = p.reproOtp("1724464550000", 1L, "hy_300023887", "300023887", "", 0x1a049abb20b0000L); + System.out.println("[check] single=" + (gChk.length() >= 36 ? gChk.substring(4, 36) : gChk) + " raw=" + gChk); + // 精确 nonce 复现 getOtp 内部 (nonce=0x1a049befebf0000, s5=junk) + String gN = p.reproOtp("0", 1L, "hy_300023887", "hy_300023887", "", 0x1a049befebf0000L); + System.out.println("[verifyN] direct(nonce=0x1a049befebf0000) mid=" + (gN.length() >= 36 ? gN.substring(4, 36) : gN) + " expect 04c7537f5b40b45ed13e89ec3f8b1b89"); + // 金样本族 × 真 nonce (0x1a049abb20b0000 = 首值!!) + p.goldBurst2(); p.callGetOtp(); // 112B config 7 块 × C2 钥 (前3块 + 2钥) p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7", "SHBfgytjtoikooruhogji7ER"); @@ -717,6 +823,8 @@ public class AesProbe { System.out.println("[verify] direct(nonce=real) mid=" + (g.length() >= 36 ? g.substring(4, 36) : g) + " expect 7c0e461e8c52e9360e90b5af264af667"); String g2 = p.reproOtp("0", 1L, "hy_300023887", "hy_300023887", "", 1L); System.out.println("[verify] direct(nonce=1) mid=" + (g2.length() >= 36 ? g2.substring(4, 36) : g2)); + String gj = p.reproJunk("0", 1L, "hy_300023887", "hy_300023887", 0x1a049abb20b0000L); + System.out.println("[verify] direct(junk-s5) mid=" + (gj.length() >= 36 ? gj.substring(4, 36) : gj) + " expect 7c0e461e8c52e9360e90b5af264af667"); // 基准: 已知 16B 明文 + 24B 钥 // 64B 钥材料测试 (KeyExpansion 以 16B 步长读!!) String k64_zmhav = "ZMHAVPRaxJ3MtXDjduUnXAKQ" + "\0".repeat(0);