From c2b9954214bba6a25e2c36e6eb79f77a0b3f45cb Mon Sep 17 00:00:00 2001 From: yml2213 Date: Sat, 29 Aug 2026 00:13:02 +0800 Subject: [PATCH] =?UTF-8?q?feat(huya):=20OTP=E5=B7=AE=E5=88=86=E5=AE=9A?= =?UTF-8?q?=E6=80=A7=20-=2032hex=E5=B0=BE=3D=E9=9D=99=E6=80=81=E9=92=A5?= =?UTF-8?q?=E6=9D=90=E6=96=99=E8=AE=A1=E7=AE=97(=E9=9D=9E=E5=B5=8C?= =?UTF-8?q?=E5=85=A5)=20+=20=E4=B8=AD=E6=AE=B5=3Df(=E8=BE=93=E5=85=A5)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/HUYA_HDID_ALGORITHM_GEN.md | 10 ++++++++++ tools/unidbg/hydev/src/hydev/AesProbe.java | 3 +++ 2 files changed, 13 insertions(+) diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md index 7ad6e80..2b83379 100644 --- a/docs/HUYA_HDID_ALGORITHM_GEN.md +++ b/docs/HUYA_HDID_ALGORITHM_GEN.md @@ -652,3 +652,13 @@ UdbAESUtilC1 + encrypt ← AES 层 1. OTP 输入差分 (变 in/变 key → 可变为/尾变?) 2. 固定尾溯源 (8b38f1… = md5/aes(静态钥材料)?) 3. 32hex-HDID32 (ed0db8) vs OTP 体系对拍 (登录帧 t1.t0 可能 = OTP 输出的某段!) + +### §11.19b OTP 差分定性 (2026-08-28 夜) +| in | key | 中段(输入依赖) | 32hex 尾 | +|---|---|---|---| +| abc | ZMHAV… | 0088fa6ee519d52f61348e01d6e74c81cd | 8b38f113056fe498b0c7de2ffd52c7b0 | +| abcX | ZMHAV… | 00bc4882b312f73d5c6f6dcbc15681db76 | **同** | +| abc | owNMia… | 0088fa6e…(同 abc!) | **同** (key 参数被忽略/固定位) | +- 32hex 尾 = **静态钥材料计算值** (非嵌入: so 全文件无 8b38f1/ed0db8 字节) +- 中段 = f(输入) (变输入即变) — 待定性为 md5/xxtea/AES 哪层 +- 32hex-HDID32 (ed0db8) 与 OTP 尾 = 同族 MAC 理论的验证对象 (下轮) diff --git a/tools/unidbg/hydev/src/hydev/AesProbe.java b/tools/unidbg/hydev/src/hydev/AesProbe.java index aa4a4e4..d9fa99f 100644 --- a/tools/unidbg/hydev/src/hydev/AesProbe.java +++ b/tools/unidbg/hydev/src/hydev/AesProbe.java @@ -184,6 +184,9 @@ public class AesProbe { // hyudb_otp_encrypt@0x32fa24 (string, h,h, string,string,string, h,m, string&) p.callOtp("abc", "ZMHAVPRaxJ3MtXDjduUnXAKQ"); p.callOtp("1e8bdf7d4f7a01d3", "KFWAH2cbkkNgFAgQPzriFPcU"); + p.callOtp("abcX", "ZMHAVPRaxJ3MtXDjduUnXAKQ"); + p.callOtp("abc", "owNMiaCgcHmqoTr3iRamFuHj"); + p.callOtp("", "ZMHAVPRaxJ3MtXDjduUnXAKQ"); p.emulator.close(); p.emulator.close(); }