feat(huya): nonce生成机制完全破解 - 任意账号零设备出完整CK闭环

动态hook实锤(scripts/hook_nonce_chain.py): rnd = XXTEA(pack(st) + pack(counter|st<<16), key=MD5hex(uid_str + k1)[:16]) - st=毫秒时间戳, counter同st内递增 - k1=设备常量865a4924...(不随账号变, evidence/nonce_k1.json) - Python复刻(tools/nonce_forge.py)对设备两轮rnd逐字节MATCH 推翻v2误判(X2'nonce账号绑定令牌'实为nonce内编码uid): - 换账号用目标uid重算nonce而非复用旧nonce! - 纯随机nonce必40020因解不出合法st/counter结构实测: 同账号+跨账号(hy_300024708从未设备登录)本地nonce铸证bind均通过, full_web_cookie/full_auto_safe 任意账号密码->全套cookie(udb_cred/udb_biztoken)
2026-08-26 00:49:01 +08:00
parent da9937707c
commit 97e6d14139
16 changed files with 1831 additions and 127 deletions
@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""定位 k1 存储: hook getInstance(0x281270) 拿单例, 读 +0x10; 内存搜 k1 出现位置看周边结构。"""
+from __future__ import annotations
+
+import json
+import subprocess
+import time
+from pathlib import Path
+
+import frida
+
+RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0")
+K1 = "865a4924a40897ac1fcfe6b4c2cbb0e3"
+
+JS = r"""
+'use strict';
+Process.setExceptionHandler(function(d){ send({type:'segv', info:{type:d.type, addr:String(d.address)}}); return true; });
+var base = Process.getModuleByName('libudbauthunify.so').base;
+send({type:'armed', base:String(base)});
+
+function rdStr(p){
+  try{
+    var b0=p.readU8();
+    if((b0&1)===0){ var l=b0>>1; if(l>8192) return {t:'s?',len:l,v:''};
+      return {t:'s',len:l,v:l?Array.from(new Uint8Array(p.add(1).readByteArray(l))).map(x=>('0'+x.toString(16)).slice(-2)).join(''):''}; }
+    var len=parseInt(p.add(8).readU64().toString());
+    if(len>65536) return {t:'l?',len:len,v:''};
+    var dp=p.add(16).readPointer();
+    return {t:'l',len:len,v:Array.from(new Uint8Array(dp.readByteArray(len))).map(x=>('0'+x.toString(16)).slice(-2)).join('')};
+  }catch(e){ return {t:'err',len:-1,v:String(e)}; }
+}
+
+// 1) getInstance -> 单例地址 + 读 +0x10
+try {
+  Interceptor.attach(base.add(0x281270), {
+    onLeave: function(r){
+      var s = rdStr(r.add(0x10));
+      send({type:'cfg', addr:String(r), k1:s, k1ascii:(function(h){var o='';for(var i=0;i<h.length;i+=2){var c=parseInt(h.substr(i,2),16);o+=(c>=32&&c<127)?String.fromCharCode(c):'.';}return o;})(s.v)});
+      // dump 前 0x60 成员指针(可能含其它 string)
+      try {
+        var hex='';
+        for (var off=0; off<0x60; off+=8) hex += hx(r.add(off),8);
+        send({type:'cfg_dump', hex:hex});
+      } catch(e){}
+    }
+  });
+} catch(e){ send({type:'hookerr', where:'getInstance', msg:''+e}); }
+
+// 2) hook loadLoginData(未知地址) 跳过; 直接定时 dump
+setTimeout(function(){
+  try {
+    // 找已缓存的单例: getInstance 是懒加载, 定时再调一次读
+    var f = new NativeFunction(base.add(0x281270), 'pointer', []);
+    var inst = f();
+    var s = rdStr(inst.add(0x10));
+    send({type:'tick_k1', addr:String(inst), k1:s});
+  } catch(e){ send({type:'tick_err', msg:''+e}); }
+}, 30000);
+
+function hx(p,n){ try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(x=>('0'+x.toString(16)).slice(-2)).join(''); }catch(e){ return 'ERR'; } }
+"""
+
+
+def main():
+    d = frida.get_device_manager().add_remote_device('127.0.0.1:31877')
+    pid = d.spawn(['com.duowan.kiwi'])
+    print(f'spawned {pid}')
+    s = d.attach(pid)
+    s.create_script((RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()).load()
+    s.create_script((RE / "evidence/scripts/mask_frida_maps_only.js").read_text()).load()
+    d.resume(pid)
+    print('resumed')
+    time.sleep(11)
+    s.create_script((RE / "evidence/scripts/patch_guard_block_termination.js").read_text()).load()
+    print('patch_guard on')
+
+    sc = s.create_script(JS)
+    events = []
+    got_armed = []
+
+    def on_msg(m, _):
+        if m.get('type') == 'error':
+            print('JS ERR:', str(m)[:240]); return
+        if m.get('type') != 'send':
+            return
+        p = m.get('payload') or {}
+        t = p.get('type')
+        events.append(p)
+        if t == 'armed':
+            got_armed.append(1); print('[armed]')
+        elif t == 'cfg':
+            print(f"[cfg] addr={p['addr']} k1len={p['k1']['len']} k1ascii={p['k1ascii']}")
+        elif t == 'cfg_dump':
+            print(f"[cfg_dump] {p['hex']}")
+        elif t == 'tick_k1':
+            print(f"[tick_k1] addr={p['addr']} k1={p['k1']['v'][:40]}({p['k1']['len']})")
+        elif t == 'tick_err':
+            print('[tick_err]', p['msg'][:120])
+        elif t == 'hookerr':
+            print('[hookerr]', p)
+
+    sc.on('message', on_msg)
+    sc.load()
+    assert got_armed
+
+    deadline = time.time() + 90
+    while time.time() < deadline:
+        time.sleep(2)
+        if any(e.get('type') == 'tick_k1' for e in events):
+            time.sleep(3)
+            break
+    Path('/tmp/opencode/k1_cfg.json').write_text(json.dumps(events))
+    print('saved /tmp/opencode/k1_cfg.json')
+
+
+if __name__ == '__main__':
+    for attempt in range(3):
+        print(f'===== 尝试 #{attempt+1} =====')
+        try:
+            main()
+            break
+        except frida.InvalidOperationError as e:
+            print(f'session detached: {e}')
+            subprocess.run(['adb', 'shell', 'am', 'force-stop', 'com.duowan.kiwi'])
+            time.sleep(3)
+        except Exception as e:
+            print(f'err: {e}')
+            subprocess.run(['adb', 'shell', 'am', 'force-stop', 'com.duowan.kiwi'])
+            time.sleep(3)