yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(huya): C2新钥表8x24B发现 + AppLoginData真布局(流程穿透2691c0) + 全爆破零命中定界

Browse Source
This commit is contained in:
yml2213
2026-08-29 02:34:01 +08:00
parent 702c6276fc
commit b60c7b78d1
2 changed files with 32 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HUYA_HDID_ALGORITHM_GEN.md
+11
View File
@@ -828,3 +828,14 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a
### 堆窗 pre/post 差分法就绪 (getOtp-pre/post 双扫描框架)
### R10: ① hook 2691a4 读 x20 (分支条件) + 读 0x26916c-0x2691a4 前导定 AppLoginData 布局
### ② 布局修正 → getOtp 走到 269324 → hook 抓 OTP 实参+OUT
## §11.33 C2 新钥表 + AppLoginData 真布局 + getOtp 流程走通 (R10)
### C2(getInstance) 注入的 AESkeyMgr 新钥表 (堆 0x127ddbe0, 8×24B, 与已知11钥族完全不同!):
SHBfgytjtoikooru+hogji7ER / KNSDNjfohweeromn+mkladj3g / xnkdDFIERRIPT5df+hfgiJ0FD
NDFiroqpmvd4JDIJ+hidtiwex / fNoMrJhbEMXm8nHc+HXTNovaL / novwSHidrhDg1ADU+KLkejnHR
hgtuiouilbsdjwEH+HMYU5gjt / masldDSIFGJjdfio+5hkhsSDF
→ 新钥 × enc/decode/md5/sha1/hmac 对 ed0db8 = 全零
### AppLoginData 真布局 (jadx): hyOpenId@0(8B) + userId@8(24B) + userIdState@0x20(4B) + emailMask@0x28 + ...
→ 重构后 getOtp 流程穿透: 26916c→…→2691c0 (x20=0 首串校验过) 不再早退!
### 未捕获: OTP 调用点 269324 hook 未触发 (流程在 2691c4-2692fb 未hook窗口内或 4542c0 getServiceTime 段)
### 状态: appSign 生成复刻仍未完成 - 差距仅剩"抓到 getOtp 内部真实 OTP 输出"
tools/unidbg/hydev/src/hydev/AesProbe.java
+21 -9
View File
@@ -251,7 +251,7 @@ public class AesProbe {
com.github.unidbg.arm.backend.CodeHook th = new com.github.unidbg.arm.backend.CodeHook() {
public void hook(com.github.unidbg.arm.backend.Backend backend, long address, int size, Object user) {
System.out.println("[hook] hit @0x" + Long.toHexString(address));
if (address == OTPC || address == ENTRY) {
if (true) {
try {
long a0 = backend.reg_read(Arm64Const.UC_ARM64_REG_X0).longValue();
long a1 = backend.reg_read(Arm64Const.UC_ARM64_REG_X1).longValue();
@@ -259,17 +259,25 @@ public class AesProbe {
long a3 = backend.reg_read(Arm64Const.UC_ARM64_REG_X3).longValue();
long a6 = backend.reg_read(Arm64Const.UC_ARM64_REG_X6).longValue();
long a7 = backend.reg_read(Arm64Const.UC_ARM64_REG_X7).longValue();
System.out.println("[hook-args] x0=" + Long.toHexString(a0) + " x1=" + a1 + " x2=" + Long.toHexString(a2)
+ " x3=" + Long.toHexString(a3) + " x6=" + a6 + " x7=" + Long.toHexString(a7));
long a4 = backend.reg_read(Arm64Const.UC_ARM64_REG_X4).longValue();
long a5 = backend.reg_read(Arm64Const.UC_ARM64_REG_X5).longValue();
long x23 = backend.reg_read(Arm64Const.UC_ARM64_REG_X23).longValue();
long x20 = backend.reg_read(Arm64Const.UC_ARM64_REG_X20).longValue();
System.out.println("[hook-args] x0=" + Long.toHexString(a0) + " x1=" + Long.toHexString(a1) + " x2=" + Long.toHexString(a2)
+ " x3=" + Long.toHexString(a3) + " x4=" + Long.toHexString(a4) + " x5=" + Long.toHexString(a5) + " x6=" + a6
+ " x7=" + Long.toHexString(a7) + " x20=" + Long.toHexString(x20) + " x23=" + Long.toHexString(x23));
} catch (Throwable t) { System.out.println("[hook-args] err " + t); }
}
}
public void onAttach(com.github.unidbg.arm.backend.UnHook unHook) {}
public void detach() {}
};
emulator.getBackend().hook_add_new(th, OTPC, OTPC, null);
emulator.getBackend().hook_add_new(th, ENTRY, ENTRY, null);
System.out.println("[hook] installed @0x26916c + @0x269324");
emulator.getBackend().hook_add_new(th, module.base + 0x2691a4L, module.base + 0x2691acL, null);
emulator.getBackend().hook_add_new(th, module.base + 0x2691b0L, module.base + 0x2691c0L, null);
emulator.getBackend().hook_add_new(th, module.base + 0x2692fcL, module.base + 0x269330L, null);
emulator.getBackend().hook_add_new(th, module.base + 0x4543a0L, module.base + 0x4543a4L, null);
System.out.println("[hook] installed flow-traces");
scanHeapWindow("[getOtp-pre]");
// BusinessCfg::getInstance @0x281270
Number inst = module.callFunction(emulator, 0x281270L);
@@ -280,10 +288,14 @@ public class AesProbe {
com.github.unidbg.memory.MemoryBlock mb = emulator.getMemory().malloc(0x1000, false);
UnidbgPointer pv = mb.getPointer();
pv.write(0, new byte[0x1000], 0, 0x1000);
writeStrAt(pv, 0x8, "hy_300023887");
writeStrAt(pv, 0x20, "772ed992b0e161276f44ec63671e60155c506294");
writeStrAt(pv, 0x38, "1e8bdf7d4f7a01d3");
writeStrAt(pv, 0x50, "*hZrPb62GskrEeTYcLeUTL1fJ1OR8ky3x9qXQq0s6ICJV5v9T");
// 真布局 (jadx): hyOpenId@0, userId@8, userIdState@0x20, emailMask@0x28, mobileMask@0x40
pv.write(0, new byte[8], 0, 8); // hyOpenId=0
writeStrAt(pv, 0x8, "hy_300023887"); // userId
pv.write(0x20, new byte[4], 0, 4); // userIdState=0
writeStrAt(pv, 0x28, ""); // emailMask ""
writeStrAt(pv, 0x40, ""); // mobileMask ""
writeStrAt(pv, 0x58, ""); // passport ""
writeStrAt(pv, 0x70, "*hZrPb62GskrEeTYcLeUTL1fJ1OR8ky3x9qXQq0s6ICJV5v9T");
// 调用 getOtp(AppLoginData&) @0x26916c
module.callFunction(emulator, 0x26916cL, thisPtr, UnidbgPointer.nativeValue(pv));
byte[] rb = new byte[0x60];