yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(huya): 💎 JAVA侧全逆! Cprivate XXTEA+会话密钥架构+Lyra TLV格式 (R30)

Browse Source 
- Cprivate.java 加密/解密器全文 (XXTEA+MD5密钥变换+尾字长度)
- 密钥=SecureRandom 16字符[A-Za-z0-9] (guava.c内存明文! RSA封装上送)
- Lyra TLV: (type<<4)|tag, type 0-13 全表
- 捕获密文可用 Cprivate.a(data,会话key) 解密 - key在内存!
- 下一步: frida抓guava.c → 真key解密明文
This commit is contained in:
yml2213
2026-08-29 08:12:10 +08:00
parent 9586eaa8a3
commit 5a138376ca
10 changed files with 193 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/unidbg/hydev/src/hydev/TuringProbe.java
+84
View File
@@ -351,6 +351,88 @@ public class TuringProbe {
}
}
/** kchain: 拆分 k209202 链 — 19378对象 + 24334状态 + Java-deflate + 1F918 XTEA(max=16B输入) */
void kchain(String keyPath) {
try {
DalvikModule dm = vm.loadLibrary(new File("/Users/yml/codes/douyu_login_py/evidence/dfp_live/turingga.so"), false);
com.github.unidbg.Module gm = dm.getModule();
try { emulator.getMemory().mmap2(gm.base + 0x48000, 0x720, 7, 0x32, -1, 0); } catch (Throwable t) {}
patchGaImports(gm);
try { dm.callJNI_OnLoad(emulator); } catch (Throwable t) {}
byte[] key = new java.io.FileInputStream(keyPath).readAllBytes();
// 1) sub_19378 对象
Number obj = gm.callFunction(emulator, 0x19378);
System.out.println("[TP] kchain obj=" + obj);
// 2) sub_24334(obj, &ptr, &len)
com.github.unidbg.pointer.UnidbgPointer outSlot = emulator.getMemory().mmap(16, 7);
com.github.unidbg.pointer.UnidbgPointer lenSlot = emulator.getMemory().mmap(16, 7);
Number r2 = gm.callFunction(emulator, 0x24334, obj.longValue(), outSlot.peer, lenSlot.peer);
long statePtr = outSlot.getLong(0); long stateLen = lenSlot.getLong(0);
System.out.println("[TP] kchain 24334 ret=" + r2 + " state=" + stateLen);
if (statePtr != 0 && stateLen > 0 && stateLen < 100000) {
byte[] state = com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, statePtr).getByteArray(0, (int) stateLen);
System.out.println("[TP] kchain state head=" + java.util.HexFormat.of().formatHex(java.util.Arrays.copyOf(state, Math.min(state.length, 32))));
// 3) Java deflate (raw ~ sub_2E904)
java.util.zip.Deflater def2 = new java.util.zip.Deflater(6, true);
def2.setInput(state); def2.finish();
byte[] zbuf = new byte[state.length * 2 + 64];
int zn = def2.deflate(zbuf);
byte[] z = java.util.Arrays.copyOf(zbuf, zn);
System.out.println("[TP] kchain deflate " + stateLen + "->" + zn);
// 4) 真 sub_1F918 XTEA-wrap (key = 16B 输入!)
com.github.unidbg.pointer.UnidbgPointer inPtr = emulator.getMemory().mmap(z.length + 32, 7);
for (int i=0;i<z.length;i++) inPtr.setByte(i, z[i]);
com.github.unidbg.pointer.UnidbgPointer kp = emulator.getMemory().mmap(32, 7);
for (int i=0;i<16;i++) kp.setByte(i, key[i]);
com.github.unidbg.pointer.UnidbgPointer o2s = emulator.getMemory().mmap(16, 7);
com.github.unidbg.pointer.UnidbgPointer l2s = emulator.getMemory().mmap(16, 7);
Number r3 = gm.callFunction(emulator, 0x1F918, inPtr.peer, z.length, o2s.peer, l2s.peer, kp.peer);
long co = o2s.getLong(0); long cl = l2s.getLong(0);
System.out.println("[TP] kchain 1F918 ret=" + r3 + " cipher=" + cl);
if (co != 0) {
byte[] c = com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, co).getByteArray(0, (int) cl);
java.io.FileOutputStream fos = new java.io.FileOutputStream("/tmp/kchain_out.bin"); fos.write(c); fos.close();
System.out.println("[TP] kchain cipher head=" + java.util.HexFormat.of().formatHex(java.util.Arrays.copyOf(c, Math.min(c.length, 24))));
}
}
} catch (Throwable t) {
System.out.println("[TP] kchain EXC " + t);
t.printStackTrace(System.out);
}
}
/** gacallb: 直调 ga b209202@0x20110 (a6=0 编码!) */
void gacallb(String blobPath) {
try {
DalvikModule dm = vm.loadLibrary(new File("/Users/yml/codes/douyu_login_py/evidence/dfp_live/turingga.so"), false);
com.github.unidbg.Module gm = dm.getModule();
try { emulator.getMemory().mmap2(gm.base + 0x48000, 0x720, 7, 0x32, -1, 0); } catch (Throwable t) {}
patchGaImports(gm);
try { dm.callJNI_OnLoad(emulator); } catch (Throwable t) {}
try {
com.github.unidbg.pointer.UnidbgPointer gst = emulator.getMemory().mmap(0x40, 7);
gst.setMemory(0, 0x40, (byte) 0); gst.setInt(0, 1);
com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, gm.base + 0x48c18).setPointer(0, gst);
com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, gm.base + 0x48c20).setPointer(0, gst);
} catch (Throwable t) {}
byte[] blob = new java.io.FileInputStream(blobPath).readAllBytes();
DvmObject<?> sa = vm.resolveClass("android/util/SparseArray").newObject(null);
DvmObject<?> dba = vm.resolveClass("[B").newObject(blob);
DvmObject<?> map = vm.resolveClass("java/util/HashMap").newObject(null);
long env = ((com.github.unidbg.pointer.UnidbgPointer) vm.getJNIEnv()).peer;
int hv = Integer.parseInt(System.getenv().getOrDefault("TP_INT", "0"));
int hsa = vm.addLocalObject(sa);
int hba = vm.addLocalObject(dba);
int hmap = vm.addLocalObject(map);
System.out.println("[TP] gacallb b209202@0x20110 in=" + blob.length + " a6=" + hv);
Number ret = gm.callFunction(emulator, 0x20110, env, 0, hsa, hba, hmap, hv);
System.out.println("[TP] gacallb ret=" + ret);
} catch (Throwable t) {
System.out.println("[TP] gacallb EXC " + t);
t.printStackTrace(System.out);
}
}
/** gaxtest: 直调 ga sub_1F1CC (XTEA) — (buf, ±n, key@5788) */
void gaxtest(String blobPath) {
try {
@@ -635,6 +717,8 @@ public class TuringProbe {
TuringProbe p = new TuringProbe();
String which = args.length > 0 ? args[0] : "both";
p.preResolveClasses();
if (which.equals("kchain")) { p.kchain(args[1]); return; }
if (which.equals("gacallb")) { p.gacallb(args[1]); return; }
if (which.equals("gaxtest")) { p.gaxtest(args[1]); return; }
if (which.equals("etest3")) { p.etest3(args[1]); return; }
if (which.equals("etest2")) { p.etest2(args[1]); return; }