yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(huya): config112B全钥直解=垃圾 + appSign未知收敛表 + 三候选方向定档

Browse Source
This commit is contained in:
yml2213
2026-08-29 01:32:03 +08:00
parent 26dc74a661
commit 65a284eac5
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HUYA_HDID_ALGORITHM_GEN.md
+7
View File
@@ -751,3 +751,10 @@ UdbAESUtilC1(…) + encrypt ← 后段
- **appSign 加密钥 ∉ AESkeyMgr 24B 目录(11把) ∪ 文件钥(27B list)** - **appSign 加密钥 ∉ AESkeyMgr 24B 目录(11把) ∪ 文件钥(27B list)**
- decode_aes 输出 = 32B (16B 入双块) → ed0db8 = 16B 密文块 (32hex ✓) 但钥 = 他处 - decode_aes 输出 = 32B (16B 入双块) → ed0db8 = 16B 密文块 (32hex ✓) 但钥 = 他处
- 方向修正: 找 32hex-hdid 的真正生产方 (encode_aes 之调用者三处已列: OTP/文件/encode — 若 hdid 不走 encode_aes → 查 GetHDID 注册原语周边 + initSDID 的 Java 侧回填) - 方向修正: 找 32hex-hdid 的真正生产方 (encode_aes 之调用者三处已列: OTP/文件/encode — 若 hdid 不走 encode_aes → 查 GetHDID 注册原语周边 + initSDID 的 Java 侧回填)
## §11.26 hydeviceid_config(112B) 直解 = 全钥垃圾 (R3)
- 服务端 config b64→112B; decode_aes(HuyaUdb27B/ZMHAV/owNMia) → ef1a5bb2…/全无明文
- config 加密 = 文件层多密钥组合 (writeFileEx@2523fc 周边) — 非单钥 AES
- appSign 未知收敛: {encode_aes 钥目录 11 把 × 明文族} ∪ {config 直解 3 钥} = 零命中
- 下步候选: ①hdid 走非 encode_aes 路径 (GetHDID native 40hex 体系周边/initSDID-Java 回填)
②OTP 消息结构串池 (MsgRegSendSms) 完整排序后 md5 组合验证 ③config 文件层双钥 (xxtea 前垫)
tools/unidbg/hydev/src/hydev/AesProbe.java
+4
View File
@@ -389,6 +389,10 @@ public class AesProbe {
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "owNMiaCgcHmqoTr3iRamFuHj"); p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "owNMiaCgcHmqoTr3iRamFuHj");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "KFWAH2cbkkNgFAgQPzriFPcU"); p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "KFWAH2cbkkNgFAgQPzriFPcU");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "4VYcPdvKKqjBHZtCmbroRXHk"); p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "4VYcPdvKKqjBHZtCmbroRXHk");
// hydeviceid_config 112B 直解 (7块)
p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7e53bbc17664c15641fc5a55e89ddc7ae0813e92f73ae6b1c9b6e4dace608b4f467b15840456ea2c7cc99c94939e42b23b3cb940861658539757a1808a409effcded72e55e83be8ce56595102c6f63828349e24744c848b74106af4d019d8a891", "HuyaUdb1928374650qwertyuiop");
p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7e53bbc17664c15641fc5a55e89ddc7ae0813e92f73ae6b1c9b6e4dace608b4f467b15840456ea2c7cc99c94939e42b23b3cb940861658539757a1808a409effcded72e55e83be8ce56595102c6f63828349e24744c848b74106af4d019d8a891", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7e53bbc17664c15641fc5a55e89ddc7ae0813e92f73ae6b1c9b6e4dace608b4f467b15840456ea2c7cc99c94939e42b23b3cb940861658539757a1808a409effcded72e55e83be8ce56595102c6f63828349e24744c848b74106af4d019d8a891", "owNMiaCgcHmqoTr3iRamFuHj");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "xXEDWqiKLGwEZ6HubEiswCqK"); p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "xXEDWqiKLGwEZ6HubEiswCqK");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "3FMHubdKosFrhmXNLHTNHZwe"); p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "3FMHubdKosFrhmXNLHTNHZwe");
p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "ybEWdvkjGjPQa2ugireHJCLL"); p.callDecodeAes("ed0db8334cadd236c00cadf7e11ab5a5", "ybEWdvkjGjPQa2ugireHJCLL");