feature(huya): nonce算法破解(nonce=counter|serviceTime<<16)+直调逐字节复现getOtp内部 - 差分靶向化

2026-08-29 03:04:58 +08:00
parent 4d1d959c8a
commit 4c7f27468a
2 changed files with 116 additions and 0 deletions
@@ -880,3 +880,11 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a
 - direct(nonce=0)=f0012daf / nonce=1=34bd49f5 / nonce=real(0x1a049abb20b0000)=561269ff
 - nonce=real 仍 ≠ getOtp 内部 7c0e461e → 剩余差异 = s5 槽 junk 字节 / OTP 内部状态
 - 差分空间扩展: mid = f(in, cnt, s3, s4, s5, nonce)
+
+## §11.41 🏆 nonce 算法反汇编破解 (R12): nonce = counter | (serviceTime << 16)
+### nonce_next@0x32ff10 直读:
+  [0x4933b0] 存 base; 若 arg0(serviceTime) 变化→counter 清零+存新 base; 否则 counter++
+  return counter | (serviceTime << 16)
+### 验证完美: 直调 (in="0",cnt=1,s3=s4="hy_300023887",s5="",nonce=0x1a049befebf0000) = getOtp 内部 04c7537f 逐字节一致!!
+### 差分靶向化 (5184 combos: ST×cnt×s3×s4) = 零命中
+- 遗留: ①金样本真实 serviceTime (13位ms) ②s3/s4 真值 (BusinessCfg 登录数据)