yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

diag(huya): getOtp流程死点=to_string@0x4543c0(serviceTime=0) - OTP调用差最后一步

Browse Source
This commit is contained in:
yml2213
2026-08-29 02:34:55 +08:00
parent b60c7b78d1
commit 76de9c3e39
2 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/unidbg/hydev/src/hydev/AesProbe.java
+13 -7
View File
@@ -263,9 +263,16 @@ public class AesProbe {
long a5 = backend.reg_read(Arm64Const.UC_ARM64_REG_X5).longValue();
long x23 = backend.reg_read(Arm64Const.UC_ARM64_REG_X23).longValue();
long x20 = backend.reg_read(Arm64Const.UC_ARM64_REG_X20).longValue();
System.out.println("[hook-args] x0=" + Long.toHexString(a0) + " x1=" + Long.toHexString(a1) + " x2=" + Long.toHexString(a2)
+ " x3=" + Long.toHexString(a3) + " x4=" + Long.toHexString(a4) + " x5=" + Long.toHexString(a5) + " x6=" + a6
+ " x7=" + Long.toHexString(a7) + " x20=" + Long.toHexString(x20) + " x23=" + Long.toHexString(x23));
long sp = backend.reg_read(Arm64Const.UC_ARM64_REG_SP).longValue();
long outPtr = 0, x19r = 0;
if (address == module.base + 0x269324L) {
UnidbgPointer spP = UnidbgPointer.pointer(emulator, sp);
if (spP != null) { outPtr = spP.getLong(0); x19r = backend.reg_read(Arm64Const.UC_ARM64_REG_X19).longValue(); }
}
System.out.println("[hook-args] @0x" + Long.toHexString(address) + " x0=" + Long.toHexString(a0) + " x1=" + Long.toHexString(a1)
+ " x2=" + Long.toHexString(a2) + " x3=" + Long.toHexString(a3) + " x4=" + Long.toHexString(a4) + " x5=" + Long.toHexString(a5)
+ " x6=" + a6 + " x7=" + Long.toHexString(a7) + " sp=" + Long.toHexString(sp)
+ (address == module.base + 0x269324L ? (" OUT@[sp]=0x" + Long.toHexString(outPtr) + " x19=" + Long.toHexString(x19r)) : ""));
} catch (Throwable t) { System.out.println("[hook-args] err " + t); }
}
}
@@ -273,11 +280,10 @@ public class AesProbe {
public void detach() {}
};
emulator.getBackend().hook_add_new(th, ENTRY, ENTRY, null);
emulator.getBackend().hook_add_new(th, module.base + 0x2691a4L, module.base + 0x2691acL, null);
emulator.getBackend().hook_add_new(th, module.base + 0x2691b0L, module.base + 0x2691c0L, null);
emulator.getBackend().hook_add_new(th, module.base + 0x2692fcL, module.base + 0x269330L, null);
emulator.getBackend().hook_add_new(th, module.base + 0x2691a4L, module.base + 0x2691d8L, null);
emulator.getBackend().hook_add_new(th, module.base + 0x26921cL, module.base + 0x269330L, null);
emulator.getBackend().hook_add_new(th, module.base + 0x4543a0L, module.base + 0x4543a4L, null);
System.out.println("[hook] installed flow-traces");
System.out.println("[hook] installed full-flow 0x2691a4->0x269330");
scanHeapWindow("[getOtp-pre]");
// BusinessCfg::getInstance @0x281270
Number inst = module.callFunction(emulator, 0x281270L);