From 76de9c3e398b66ab934ae6ffef5331066ee7a9ce Mon Sep 17 00:00:00 2001 From: yml2213 Date: Sat, 29 Aug 2026 02:34:55 +0800 Subject: [PATCH] =?UTF-8?q?diag(huya):=20getOtp=E6=B5=81=E7=A8=8B=E6=AD=BB?= =?UTF-8?q?=E7=82=B9=3Dto=5Fstring@0x4543c0(serviceTime=3D0)=20-=20OTP?= =?UTF-8?q?=E8=B0=83=E7=94=A8=E5=B7=AE=E6=9C=80=E5=90=8E=E4=B8=80=E6=AD=A5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/HUYA_HDID_ALGORITHM_GEN.md | 6 ++++++ tools/unidbg/hydev/src/hydev/AesProbe.java | 20 +++++++++++++------- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md index fee615c..f291f44 100644 --- a/docs/HUYA_HDID_ALGORITHM_GEN.md +++ b/docs/HUYA_HDID_ALGORITHM_GEN.md @@ -839,3 +839,9 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a → 重构后 getOtp 流程穿透: 26916c→…→2691c0 (x20=0 首串校验过) 不再早退! ### 未捕获: OTP 调用点 269324 hook 未触发 (流程在 2691c4-2692fb 未hook窗口内或 4542c0 getServiceTime 段) ### 状态: appSign 生成复刻仍未完成 - 差距仅剩"抓到 getOtp 内部真实 OTP 输出" + +## §11.34 getOtp 全流程钩子追踪定界 (R10b) +- 全覆盖 hook (0x2691a4-0x269330) 40 命中: 流程走通到 **0x269278 (bl to_string@0x4543c0, to_string(serviceTime=0))** 后无后续 +- OTP 调用点 0x269324 未达 → **流程死在 to_string-CALL (libc++-PLT 0x4543c0)** +- x0=serviceTime=0 (仿真时钟 0) — 需查 0x4543c0 解析/或给 getServiceTime 注入真实时间 +- 剩余步骤: ① 过 to_string (hook 0x4543c0 验证) ② OTP 调用 0x269324 [sp]=OUT& ③ 输出 vs ed0db8 diff --git a/tools/unidbg/hydev/src/hydev/AesProbe.java b/tools/unidbg/hydev/src/hydev/AesProbe.java index 3234edf..b089fce 100644 --- a/tools/unidbg/hydev/src/hydev/AesProbe.java +++ b/tools/unidbg/hydev/src/hydev/AesProbe.java @@ -263,9 +263,16 @@ public class AesProbe { long a5 = backend.reg_read(Arm64Const.UC_ARM64_REG_X5).longValue(); long x23 = backend.reg_read(Arm64Const.UC_ARM64_REG_X23).longValue(); long x20 = backend.reg_read(Arm64Const.UC_ARM64_REG_X20).longValue(); - System.out.println("[hook-args] x0=" + Long.toHexString(a0) + " x1=" + Long.toHexString(a1) + " x2=" + Long.toHexString(a2) - + " x3=" + Long.toHexString(a3) + " x4=" + Long.toHexString(a4) + " x5=" + Long.toHexString(a5) + " x6=" + a6 - + " x7=" + Long.toHexString(a7) + " x20=" + Long.toHexString(x20) + " x23=" + Long.toHexString(x23)); + long sp = backend.reg_read(Arm64Const.UC_ARM64_REG_SP).longValue(); + long outPtr = 0, x19r = 0; + if (address == module.base + 0x269324L) { + UnidbgPointer spP = UnidbgPointer.pointer(emulator, sp); + if (spP != null) { outPtr = spP.getLong(0); x19r = backend.reg_read(Arm64Const.UC_ARM64_REG_X19).longValue(); } + } + System.out.println("[hook-args] @0x" + Long.toHexString(address) + " x0=" + Long.toHexString(a0) + " x1=" + Long.toHexString(a1) + + " x2=" + Long.toHexString(a2) + " x3=" + Long.toHexString(a3) + " x4=" + Long.toHexString(a4) + " x5=" + Long.toHexString(a5) + + " x6=" + a6 + " x7=" + Long.toHexString(a7) + " sp=" + Long.toHexString(sp) + + (address == module.base + 0x269324L ? (" OUT@[sp]=0x" + Long.toHexString(outPtr) + " x19=" + Long.toHexString(x19r)) : "")); } catch (Throwable t) { System.out.println("[hook-args] err " + t); } } } @@ -273,11 +280,10 @@ public class AesProbe { public void detach() {} }; emulator.getBackend().hook_add_new(th, ENTRY, ENTRY, null); - emulator.getBackend().hook_add_new(th, module.base + 0x2691a4L, module.base + 0x2691acL, null); - emulator.getBackend().hook_add_new(th, module.base + 0x2691b0L, module.base + 0x2691c0L, null); - emulator.getBackend().hook_add_new(th, module.base + 0x2692fcL, module.base + 0x269330L, null); + emulator.getBackend().hook_add_new(th, module.base + 0x2691a4L, module.base + 0x2691d8L, null); + emulator.getBackend().hook_add_new(th, module.base + 0x26921cL, module.base + 0x269330L, null); emulator.getBackend().hook_add_new(th, module.base + 0x4543a0L, module.base + 0x4543a4L, null); - System.out.println("[hook] installed flow-traces"); + System.out.println("[hook] installed full-flow 0x2691a4->0x269330"); scanHeapWindow("[getOtp-pre]"); // BusinessCfg::getInstance @0x281270 Number inst = module.callFunction(emulator, 0x281270L);