From 75e311afa21900ead4ca4338370c831ff79a1d20 Mon Sep 17 00:00:00 2001 From: yml2213 Date: Tue, 25 Aug 2026 16:39:47 +0800 Subject: [PATCH] =?UTF-8?q?feat(huya):=20=E7=A1=AE=E8=AE=A4LoginPassport?= =?UTF-8?q?=E8=B5=B0huyaudbwebui=20servant?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/虎牙hyCred签发-侦察笔记.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md index ad0684f..8b74f75 100644 --- a/docs/虎牙hyCred签发-侦察笔记.md +++ b/docs/虎牙hyCred签发-侦察笔记.md @@ -125,3 +125,12 @@ Request/Response LoginPassport 两个 Creator::C2 均以 movz w0,#0x20 构造 => MsgRequestLoginPassport id=0x1001(4097), Response=0x2001。 (前轮0x20为operator new大小, 红鲱鱼) 剩余: 传输端点+servant、password编码、活体发送测试。 + +## Round6: 传输通道确认 + +servant 字符串 huyaudbwebui 与 Handler 族类名同池出现在 libudbauthunify.so +(另见 wupudbrequest_v0 / KFWAH2cbkkNgFAgQPzriFPcU 等邻串)。 +=> MsgRequestLoginPassport(0x1001) 经 huyaudbwebui servant 走 WUP; + dfp 的 func 名不在本库(getDfpConfig 计数=0), func 名或由Java层/运行时拼接。 +下一步(需用户重登一次): hook UdbMsgHandler::sendMessage 抓真实线上包 +(id/servant/func/JSON载荷), 一次拿全所有待定参数。