feat(huya): R32 8密文集+三重钩全零调用定论+known-pair校准
- 8活体POST存 evidence (magic 10B@70 一致, 头同族7cda11) - 25 JNI + 2 XTEA核 + 2 Java = 全0调用 (报告=隐藏native路径!) - rtk_known/ 44B known pair (native ct 45542bb3...) 后续差分用
This commit is contained in:
@@ -1504,3 +1504,26 @@ full: 7c da | 11 | 69 c9 f5 28 9c 4d 46 | 95 6f 21 | 10 bb 80
|
||||
1. hook mfa b87_@25c98/27DA4 + ga 27DBC/23DF8 (JNI impl 直挂!) — 关键参数 (byte[], map, mode!)
|
||||
2. 或: mfa 动态符号/内部调用大范围探 (OLLVM 静态已尽)
|
||||
3. 解密器待 key: cprivate.py (Cprivate.a 全等直译) 已就绪 — key 一到即解 3 个新密文!
|
||||
|
||||
## §11.63 R32: 8 密文集 + 全钩零调用定论 + Java/native 差分 (2026-08-29)
|
||||
|
||||
### 8 密文集 (存 evidence/dfp_live/)
|
||||
4384/4267/4261/4263/4267/4261/4261/4263...B POSTs + bodies (magic 10B 一致 @70!)
|
||||
- 0647-0856: 8 个活体 POST (同配方重注册触发!)
|
||||
- 头部同族: 7cda 11 {session} {cnt} {stable} — 计数位 28/34 递增等
|
||||
|
||||
### 三重钩全零调用铁证 (原生 25 JNI + XTEA 2 核 + Java 2 钩!)
|
||||
- mfa 11 JNI (a87_@25680..k87_@27b74) + ga 14 JNI (a209202@1fcb8..n209202@43900) = 全部安装且 0 次触发!
|
||||
- mfa sub_24D58 + ga sub_1F1CC XTEA 核心 = 0 次!
|
||||
- Java ga.private(Cprivate).b + Perseus.a = 0 次!
|
||||
- → 报告密文 = 隐藏 native 路径 (JNI 方法族之外!)
|
||||
|
||||
### Java Cprivate 与 native sub_24D58 差分
|
||||
- Java (decompile 直读) = 标准 XXTEA (sum-=DELTA!)
|
||||
- native (OLLVM 模糊!) — known pair 校准失败 (44B: native ct 45542bb3... vs python 全部变体)
|
||||
- → native 核心 = 变体 (OLLVM 掩码深处) 或 harness 参数语义差异 (raw-core vs envelope-len-word)
|
||||
- rtk_known/ 存校准对 — 后续对照用
|
||||
|
||||
### 下一步 (R33)
|
||||
1. native 信封/收集器全钩: mfa 2E164/2E250/25234/252EC/34B98/34A00/2E4A4 + ga 1F918/1F9C8/27DBC/27CE0/23DF8!
|
||||
2. 或用已知对差分出 native 变体的确切公式 (再校验 Java 解密器)
|
||||
|
||||
Reference in New Issue
Block a user