From 65a284eac5a94a6863e227584674f1ee0c50c94e Mon Sep 17 00:00:00 2001 From: yml2213 Date: Sat, 29 Aug 2026 01:32:03 +0800 Subject: [PATCH] =?UTF-8?q?feat(huya):=20config112B=E5=85=A8=E9=92=A5?= =?UTF-8?q?=E7=9B=B4=E8=A7=A3=3D=E5=9E=83=E5=9C=BE=20+=20appSign=E6=9C=AA?= =?UTF-8?q?=E7=9F=A5=E6=94=B6=E6=95=9B=E8=A1=A8=20+=20=E4=B8=89=E5=80=99?= =?UTF-8?q?=E9=80=89=E6=96=B9=E5=90=91=E5=AE=9A=E6=A1=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/HUYA_HDID_ALGORITHM_GEN.md | 7 +++++++ tools/unidbg/hydev/src/hydev/AesProbe.java | 4 ++++ 2 files changed, 11 insertions(+) diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md index 5da742e..f505db5 100644 --- a/docs/HUYA_HDID_ALGORITHM_GEN.md +++ b/docs/HUYA_HDID_ALGORITHM_GEN.md @@ -751,3 +751,10 @@ UdbAESUtilC1(…) + encrypt ← 后段 - **appSign 加密钥 ∉ AESkeyMgr 24B 目录(11把) ∪ 文件钥(27B list)** - decode_aes 输出 = 32B (16B 入双块) → ed0db8 = 16B 密文块 (32hex ✓) 但钥 = 他处 - 方向修正: 找 32hex-hdid 的真正生产方 (encode_aes 之调用者三处已列: OTP/文件/encode — 若 hdid 不走 encode_aes → 查 GetHDID 注册原语周边 + initSDID 的 Java 侧回填) + +## §11.26 hydeviceid_config(112B) 直解 = 全钥垃圾 (R3) +- 服务端 config b64→112B; decode_aes(HuyaUdb27B/ZMHAV/owNMia) → ef1a5bb2…/全无明文 +- config 加密 = 文件层多密钥组合 (writeFileEx@2523fc 周边) — 非单钥 AES +- appSign 未知收敛: {encode_aes 钥目录 11 把 × 明文族} ∪ {config 直解 3 钥} = 零命中 +- 下步候选: ①hdid 走非 encode_aes 路径 (GetHDID native 40hex 体系周边/initSDID-Java 回填) + ②OTP 消息结构串池 (MsgRegSendSms) 完整排序后 md5 组合验证 ③config 文件层双钥 (xxtea 前垫) diff --git a/tools/unidbg/hydev/src/hydev/AesProbe.java b/tools/unidbg/hydev/src/hydev/AesProbe.java index 915344c..47f3c4e 100644 --- a/tools/unidbg/hydev/src/hydev/AesProbe.java +++ b/tools/unidbg/hydev/src/hydev/AesProbe.java @@ -389,6 +389,10 @@ public class AesProbe { p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "owNMiaCgcHmqoTr3iRamFuHj"); p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "KFWAH2cbkkNgFAgQPzriFPcU"); p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "4VYcPdvKKqjBHZtCmbroRXHk"); + // hydeviceid_config 112B 直解 (7块) + p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7e53bbc17664c15641fc5a55e89ddc7ae0813e92f73ae6b1c9b6e4dace608b4f467b15840456ea2c7cc99c94939e42b23b3cb940861658539757a1808a409effcded72e55e83be8ce56595102c6f63828349e24744c848b74106af4d019d8a891", "HuyaUdb1928374650qwertyuiop"); + p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7e53bbc17664c15641fc5a55e89ddc7ae0813e92f73ae6b1c9b6e4dace608b4f467b15840456ea2c7cc99c94939e42b23b3cb940861658539757a1808a409effcded72e55e83be8ce56595102c6f63828349e24744c848b74106af4d019d8a891", "ZMHAVPRaxJ3MtXDjduUnXAKQ"); + p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7e53bbc17664c15641fc5a55e89ddc7ae0813e92f73ae6b1c9b6e4dace608b4f467b15840456ea2c7cc99c94939e42b23b3cb940861658539757a1808a409effcded72e55e83be8ce56595102c6f63828349e24744c848b74106af4d019d8a891", "owNMiaCgcHmqoTr3iRamFuHj"); p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "xXEDWqiKLGwEZ6HubEiswCqK"); p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "3FMHubdKosFrhmXNLHTNHZwe"); p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "ybEWdvkjGjPQa2ugireHJCLL");