From cc00915e7f44a8d2b333f7cc6dba0b89273be56b Mon Sep 17 00:00:00 2001 From: yml2213 Date: Sat, 29 Aug 2026 05:45:05 +0800 Subject: [PATCH] =?UTF-8?q?feat(huya):=20=F0=9F=8F=86=20appSign(t1.t0)?= =?UTF-8?q?=E7=AE=97=E6=B3=95=E5=AE=8C=E5=85=A8=E7=A0=B4=E8=A7=A3=20?= =?UTF-8?q?=E2=80=94=20ed0db8=E9=80=90=E5=AD=97=E8=8A=82=E5=A4=8D=E7=8E=B0?= =?UTF-8?q?=20(R15)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 公式: appSign = MD5(appId + '_' + appVersion + '_' + k1) 金样本: MD5('5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3') = ed0db8334cadd236c00cadf7e11ab5a5 ✅ 发现链路: createWupProtoInfo@0x273f1c反汇编 -> HuyaMd5(全局单例3串@0x484000+0xe0) -> frida实机读串(5008/13.4.22/k1) -> toString直出ed0db8 -> python标准md5复现 - 修改: hook_otp_capture.js(+appsign/huya-md5 hook, SSO/LONG修正, tostr-hex/ctor-hex) - docs §11.45: 完整公式+发现链路+结构性解释+工程意义 --- docs/HUYA_HDID_ALGORITHM_GEN.md | 36 +++++++ tools/frida/capture_20260829_053822.jsonl | 58 +++++++++++ tools/frida/capture_20260829_053940.jsonl | 58 +++++++++++ tools/frida/capture_20260829_054207.jsonl | 58 +++++++++++ tools/frida/capture_20260829_054317.jsonl | 58 +++++++++++ tools/frida/hook_otp_capture.js | 102 +++++++++++++++++++- tools/unidbg/hydev/src/hydev/GoldSweep.java | 35 +++++++ 7 files changed, 404 insertions(+), 1 deletion(-) create mode 100644 tools/frida/capture_20260829_053822.jsonl create mode 100644 tools/frida/capture_20260829_053940.jsonl create mode 100644 tools/frida/capture_20260829_054207.jsonl create mode 100644 tools/frida/capture_20260829_054317.jsonl diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md index 522bc76..7230726 100644 --- a/docs/HUYA_HDID_ALGORITHM_GEN.md +++ b/docs/HUYA_HDID_ALGORITHM_GEN.md @@ -1036,3 +1036,39 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a ### 5) 下一步 (appSign 真源) - 反汇编登录 WUP 构建器 createWupRequestData@0x38dab0 → ProtoInfo.appSign 填充点 → 找 32hex getter - 或 frida 全 hook BusinessCfg 设备 getters + setDeviceInfo 链直接读 appSign 来源 + +--- + +## ★ §11.45 R15: 🏆 appSign(t1.t0) 算法完全破解 — ed0db8 逐字节复现 (2026-08-29) + +### 公式 (实机全链捕获 + 复现验证) +``` +t1.t0 appSign (32hex, "hdid") = MD5( appId + "_" + appVersion + "_" + k1 ) +金样本: MD5("5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3") + = ed0db8334cadd236c00cadf7e11ab5a5 ✅ 逐字节命中 +``` +- appId = "5008" (byte-appId), appVersion = 版本名 ("13.4.22"), k1 = BusinessCfg+0x10 设备钥 (865a49...cbb0e3) +- 与网页 appSign 公式同族: web=md5(appId+vCode+k1)[:8] (60576904) — native 用版本名+完整32hex +- HuyaMd5 类 = 标准 MD5 封装 (实机 toString 输出 = ed0db8 直接命中) + +### 发现链路 (本轮) +1. createWupProtoInfo(ProtoInfo&)@0x273f1c 反汇编 → appSign = HuyaMd5(拼接串) — 3 个全局单例串 @base+0x484000+0xe0 (+0x10/+0x28/+0x40) +2. frida 读全局串: "5008" / "13.4.22" / k1 (SSO 旗标字节混读修正后) +3. HuyaMd5::toString() 实机输出 = **ed0db8334cadd236c00cadf7e11ab5a5** (WUP 公共帧构建时触发, 无需登录) +4. python: md5("5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3") = ed0db8 ✅ + +### 结构性解释 (与 R14 证伪一致) +- appSign 只依赖 {appId, appVersion, k1} — 无账号输入 → **跨账号稳定** ✓ (device_profiles 多账号共用) +- k1 = 设备级键 (dfp t1/ channelKey 同族: cbb045/cbb0e3) → 版本更新则 appSign 变化 → 服务端按版本校验 +- 与 web appSign 公式同族: web=md5(appId+vCode+k1)[:8] (60576904) — native 用版本名+完整32hex +- OTP 链 (getOtp) = 账号级 (s5=cred) — 与 appSign 职责分离 ✓ + +### 工程意义 +- 制造任意 (appVersion, k1) 组合的合法 appSign — 登录帧 t1.t0 可自铸 +- 现有多账号方案 (金样本 hdid/shareConfig) 可升级为"按设备钥动态计算" +- 设备身份 (dfpReport 加密体) 仍是仅剩的铸造缺口 (#2) + +### 工具/证据 +- tools/frida/hook_otp_capture.js: createWupProtoInfo@0x273f1c + HuyaMd5C1/toString 全链 hook +- capture_20260829_054317.jsonl: ctor inHex=353030385f31332e342e32325f383635... (5008_13.4.22_k1) + tostr=ed0db8... +- 复核: md5("5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3") = ed0db8334cadd236c00cadf7e11ab5a5 ✅ diff --git a/tools/frida/capture_20260829_053822.jsonl b/tools/frida/capture_20260829_053822.jsonl new file mode 100644 index 0000000..2b0f78a --- /dev/null +++ b/tools/frida/capture_20260829_053822.jsonl @@ -0,0 +1,58 @@ +{"event": "hook-installed", "needle": "createWupProtoInfo", "address": "0x71fd103f1c", "pid": 24428, "tid": 24450, "ts": 1787953111360, "seq": 1} +{"event": "hook-installed", "needle": "HuyaMd5C1", "pid": 24428, "tid": 24450, "ts": 1787953111362, "seq": 2} +{"event": "hook-installed", "needle": "HuyaMd58toString", "pid": 24428, "tid": 24450, "ts": 1787953111363, "seq": 3} +{"event": "module-found", "name": "libudbauthunify.so", "base": "0x71fce90000", "size": 4812800, "pid": 24428, "tid": 24450, "ts": 1787953111363, "seq": 4} +{"event": "hook-installed", "needle": "hyudb_otp_encrypt", "address": "0x71fd1bfa24", "pid": 24428, "tid": 24450, "ts": 1787953111391, "seq": 5} +{"event": "hook-installed", "needle": "BusinessCfg6getOtp", "address": "0x71fd0f916c", "pid": 24428, "tid": 24450, "ts": 1787953111410, "seq": 6} +{"event": "hook-installed", "needle": "setSafeDeviceId", "address": "0x71fd0fa2e0", "pid": 24428, "tid": 24450, "ts": 1787953111427, "seq": 7} +{"event": "hook-installed", "needle": "getHdid", "address": "0x71fd0fa484", "pid": 24428, "tid": 24450, "ts": 1787953111443, "seq": 8} +{"event": "hook-installed", "needle": "AESkeyMgr6getkey", "address": "0x71fd0f871c", "pid": 24428, "tid": 24450, "ts": 1787953111458, "seq": 9} +{"event": "hook-installed", "needle": "md5_char16", "address": "0x71fd1be71c", "pid": 24428, "tid": 24450, "ts": 1787953111472, "seq": 10} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a7f34 (_ZN14WupDataPackageIN3wup13UserLogoffReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a755c (_ZN22HandlerRequestLoginOut9onHandlerEP10UdbMsgBase+0x248) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b1e4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xeb4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 24428, "tid": 24582, "ts": 1787953128333, "seq": 11} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953128333, "seq": 12} +{"event": "appsign", "stage": "enter", "proto": "0x720dea9938", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "", "joined": "\b500_\u000e13.4.2_", "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128334, "seq": 13} +{"event": "huya-md5", "stage": "ctor", "in": null, "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128334, "seq": 14} +{"event": "huya-md5", "stage": "tostr", "out": null, "pid": 24428, "tid": 24582, "ts": 1787953128334, "seq": 15} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x336314 (_ZN14WupDataPackageIN3wup24AppLgnCredentialLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3341d8 (_ZN28HandlerRequestAnonyLoginCred9onHandlerEP10UdbMsgBase+0x558) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bae4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x17b4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 24428, "tid": 24582, "ts": 1787953128363, "seq": 16} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953128363, "seq": 17} +{"event": "appsign", "stage": "enter", "proto": "0x720dea9818", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "", "joined": "\b500_\u000e13.4.2_", "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128363, "seq": 18} +{"event": "huya-md5", "stage": "ctor", "in": null, "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128363, "seq": 19} +{"event": "huya-md5", "stage": "tostr", "out": null, "pid": 24428, "tid": 24582, "ts": 1787953128363, "seq": 20} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a7be0 (_ZN23HandlerResponseLoginOut9onHandlerEP10UdbMsgBase+0xc8) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b244 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xf14) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 24428, "tid": 24582, "ts": 1787953128461, "seq": 21} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953128461, "seq": 22} +{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2570448208, "uidHi": 3019898993, "pid": 24428, "tid": 24582, "ts": 1787953128488, "seq": 23} +{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 2, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a8066875728ac56814c316e2a466511c502bd76cf1ded554657b74729876cb9f7081cf1331add5a9f7ac54784e4d137cd79ba04e01ef74a2dc163726c3a7ced7c91bb4eb384075bc94ce2fdfde3276a64c300bfbd5d82b97f905d74c6c83a95bc42964d17f6bd1ac592c37301a49ba25748", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a4faa240000", "stMs": "1787953130020", "nc": 0, "pid": 24428, "tid": 24582, "ts": 1787953128495, "seq": 24} +{"event": "huya-md5", "stage": "tostr", "out": "", "pid": 24428, "tid": 24582, "ts": 1787953128495, "seq": 25} +{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 2, "pid": 24428, "tid": 24582, "ts": 1787953128496, "seq": 26} +{"event": "crypto-aeskey", "stage": "leave", "key": "MKDKeridjing7avnsasdSDHI", "pid": 24428, "tid": 24582, "ts": 1787953128496, "seq": 27} +{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3MKDKeridjing7avnsasdSDHI", "pid": 24428, "tid": 24582, "ts": 1787953128496, "seq": 28} +{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 24428, "tid": 24582, "ts": 1787953128496, "seq": 29} +{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "04027c8fe60a97a9c80fef4ae365ab8d404850a03b3877c0e5458cbcb2b2f8a97d07cb2cd37264f6fd9dcc92ac53966f8e565bf5895d65cc67c641a346df23df3e2e0af22f9ff84947b20e887687d9d38ef107fac73da5c45dc943a645989bc0ffa37464444fd7e07a228d30cad91d19d58957a52d6417372e1670ec9527e8df77dec01050c60bf18dde25e524bf854d65da", "outSize": 146, "pid": 24428, "tid": 24582, "ts": 1787953128503, "seq": 30} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 24428, "tid": 24582, "ts": 1787953128524, "seq": 31} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953128524, "seq": 32} +{"event": "appsign", "stage": "enter", "proto": "0x720dea93f0", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "", "joined": "\b500_\u000e13.4.2_", "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128524, "seq": 33} +{"event": "huya-md5", "stage": "ctor", "in": null, "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128524, "seq": 34} +{"event": "huya-md5", "stage": "tostr", "out": null, "pid": 24428, "tid": 24582, "ts": 1787953128524, "seq": 35} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x334be4 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x368) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 24428, "tid": 24582, "ts": 1787953128562, "seq": 36} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953128562, "seq": 37} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a9b04 (_ZN14WupDataPackageIN3wup22AppLgnPasswordLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a8b04 (_ZN27HandlerRequestLoginPassport9onHandlerEP10UdbMsgBase+0x4e0) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b664 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1334) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 24428, "tid": 24582, "ts": 1787953155033, "seq": 38} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953155033, "seq": 39} +{"event": "appsign", "stage": "enter", "proto": "0x720dea98b8", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "", "joined": "\b500_\u000e13.4.2_", "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953155034, "seq": 40} +{"event": "huya-md5", "stage": "ctor", "in": null, "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953155034, "seq": 41} +{"event": "huya-md5", "stage": "tostr", "out": null, "pid": 24428, "tid": 24582, "ts": 1787953155034, "seq": 42} +{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2570749264, "uidHi": 3019898993, "pid": 24428, "tid": 24582, "ts": 1787953155225, "seq": 43} +{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 3, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a808cc19be90021734459ce575524b7c4190b85bd57b396a921b4be0f701848cbb34aeb65009f5eac2ca9e0dd922e5197f3e7c6492663984e8616d3e5f8964e6710ecb03603d3567518b80bd74776439d749c02407193390c35e7e02c6e6bdc8add6fb39036954eb5cd420f8cb23e1e48cc", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a500ec40000", "stMs": "1787953155780", "nc": 0, "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 44} +{"event": "huya-md5", "stage": "tostr", "out": "", "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 45} +{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 3, "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 46} +{"event": "crypto-aeskey", "stage": "leave", "key": "nskdI7MDGKSDJsnadjdoonvs", "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 47} +{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3nskdI7MDGKSDJsnadjdoonvs", "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 48} +{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 49} +{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "0403bc9f0a0563ca62ffbe2a1731207f1761bc3cd47cd82a849bbe21ea3ddd0f47ddd84b33cbf7e38ed36db4d8842992975be2392eb2a27d1d6a85b7b396bffaf2ed2f20b88ef4c38dddf3c8854961e8de7754b255ac2e6358f8afc5e26f09a66b97ac33d7616d4561252d0a995e44894256f010327785a561ef4af9e71f0542f2652aa323d92e2252511096c48a39788520", "outSize": 146, "pid": 24428, "tid": 24582, "ts": 1787953155239, "seq": 50} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 24428, "tid": 24582, "ts": 1787953155256, "seq": 51} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953155256, "seq": 52} +{"event": "appsign", "stage": "enter", "proto": "0x720dea9170", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "", "joined": "\b500_\u000e13.4.2_", "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953155256, "seq": 53} +{"event": "huya-md5", "stage": "ctor", "in": null, "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953155256, "seq": 54} +{"event": "huya-md5", "stage": "tostr", "out": null, "pid": 24428, "tid": 24582, "ts": 1787953155256, "seq": 55} +{"event": "huya-md5", "stage": "tostr", "out": "", "pid": 24428, "tid": 24582, "ts": 1787953155257, "seq": 56} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a965c (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x46c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 24428, "tid": 24582, "ts": 1787953155289, "seq": 57} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953155289, "seq": 58} diff --git a/tools/frida/capture_20260829_053940.jsonl b/tools/frida/capture_20260829_053940.jsonl new file mode 100644 index 0000000..bc06c9a --- /dev/null +++ b/tools/frida/capture_20260829_053940.jsonl @@ -0,0 +1,58 @@ +{"event": "hook-installed", "needle": "createWupProtoInfo", "address": "0x720ce74f1c", "pid": 27894, "tid": 27916, "ts": 1787953188461, "seq": 1} +{"event": "hook-installed", "needle": "HuyaMd5C1", "pid": 27894, "tid": 27916, "ts": 1787953188462, "seq": 2} +{"event": "hook-installed", "needle": "HuyaMd58toString", "pid": 27894, "tid": 27916, "ts": 1787953188463, "seq": 3} +{"event": "module-found", "name": "libudbauthunify.so", "base": "0x720cc01000", "size": 4812800, "pid": 27894, "tid": 27916, "ts": 1787953188464, "seq": 4} +{"event": "hook-installed", "needle": "hyudb_otp_encrypt", "address": "0x720cf30a24", "pid": 27894, "tid": 27916, "ts": 1787953188489, "seq": 5} +{"event": "hook-installed", "needle": "BusinessCfg6getOtp", "address": "0x720ce6a16c", "pid": 27894, "tid": 27916, "ts": 1787953188509, "seq": 6} +{"event": "hook-installed", "needle": "setSafeDeviceId", "address": "0x720ce6b2e0", "pid": 27894, "tid": 27916, "ts": 1787953188531, "seq": 7} +{"event": "hook-installed", "needle": "getHdid", "address": "0x720ce6b484", "pid": 27894, "tid": 27916, "ts": 1787953188551, "seq": 8} +{"event": "hook-installed", "needle": "AESkeyMgr6getkey", "address": "0x720ce6971c", "pid": 27894, "tid": 27916, "ts": 1787953188567, "seq": 9} +{"event": "hook-installed", "needle": "md5_char16", "address": "0x720cf2f71c", "pid": 27894, "tid": 27916, "ts": 1787953188583, "seq": 10} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a7f34 (_ZN14WupDataPackageIN3wup13UserLogoffReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a755c (_ZN22HandlerRequestLoginOut9onHandlerEP10UdbMsgBase+0x248) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b1e4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xeb4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 27894, "tid": 28033, "ts": 1787953248894, "seq": 11} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953248895, "seq": 12} +{"event": "appsign", "stage": "enter", "proto": "0x720057b938", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953248895, "seq": 13} +{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953248895, "seq": 14} +{"event": "huya-md5", "stage": "tostr", "out": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 27894, "tid": 28033, "ts": 1787953248895, "seq": 15} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x336314 (_ZN14WupDataPackageIN3wup24AppLgnCredentialLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3341d8 (_ZN28HandlerRequestAnonyLoginCred9onHandlerEP10UdbMsgBase+0x558) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bae4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x17b4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 27894, "tid": 28033, "ts": 1787953248917, "seq": 16} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953248918, "seq": 17} +{"event": "appsign", "stage": "enter", "proto": "0x720057b818", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953248918, "seq": 18} +{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953248918, "seq": 19} +{"event": "huya-md5", "stage": "tostr", "out": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 27894, "tid": 28033, "ts": 1787953248918, "seq": 20} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a7be0 (_ZN23HandlerResponseLoginOut9onHandlerEP10UdbMsgBase+0xc8) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b244 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xf14) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 27894, "tid": 28033, "ts": 1787953248989, "seq": 21} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953248989, "seq": 22} +{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2567710032, "uidHi": 3019898993, "pid": 27894, "tid": 28033, "ts": 1787953249008, "seq": 23} +{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 2, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a8066875728ac56814c316e2a466511c502bd76cf1ded554657b74729876cb9f7081cf1331add5a9f7ac54784e4d137cd79ba04e01ef74a2dc163726c3a7ced7c91bb4eb384075bc94ce2fdfde3276a64c300bfbd5d82b97f905d74c6c83a95bc42964d17f6bd1ac592c37301a49ba25748", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a517d210000", "stMs": "1787953249569", "nc": 0, "pid": 27894, "tid": 28033, "ts": 1787953249022, "seq": 24} +{"event": "huya-md5", "stage": "tostr", "out": "3615b2447588061a682a03dd7b6d4a69", "pid": 27894, "tid": 28033, "ts": 1787953249022, "seq": 25} +{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 2, "pid": 27894, "tid": 28033, "ts": 1787953249022, "seq": 26} +{"event": "crypto-aeskey", "stage": "leave", "key": "MKDKeridjing7avnsasdSDHI", "pid": 27894, "tid": 28033, "ts": 1787953249022, "seq": 27} +{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3MKDKeridjing7avnsasdSDHI", "pid": 27894, "tid": 28033, "ts": 1787953249023, "seq": 28} +{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 27894, "tid": 28033, "ts": 1787953249023, "seq": 29} +{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "0402720228f531a599f3392bb491eac5f0e350a03b3877c0e5458cbcb2b2f8a97d07cb2cd37264f6fd9dcc92ac53966f8e565bf5895d65cc67c641a346df23df3e2e0af22f9ff84947b20e887687d9d38ef107fac73da5c45dc943a645989bc0ffa37464444fd7e07a228d30cad91d19d58957a52d6417372e1670ec9527e8df77dec01050c60bf18dde25e524bf854d65da", "outSize": 146, "pid": 27894, "tid": 28033, "ts": 1787953249037, "seq": 30} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 27894, "tid": 28033, "ts": 1787953249061, "seq": 31} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953249061, "seq": 32} +{"event": "appsign", "stage": "enter", "proto": "0x720057b3f0", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953249061, "seq": 33} +{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953249061, "seq": 34} +{"event": "huya-md5", "stage": "tostr", "out": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 27894, "tid": 28033, "ts": 1787953249061, "seq": 35} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x334be4 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x368) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 27894, "tid": 28033, "ts": 1787953249077, "seq": 36} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953249077, "seq": 37} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a9b04 (_ZN14WupDataPackageIN3wup22AppLgnPasswordLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a8b04 (_ZN27HandlerRequestLoginPassport9onHandlerEP10UdbMsgBase+0x4e0) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b664 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1334) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 27894, "tid": 28033, "ts": 1787953252555, "seq": 38} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953252556, "seq": 39} +{"event": "appsign", "stage": "enter", "proto": "0x720057b8b8", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953252556, "seq": 40} +{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953252556, "seq": 41} +{"event": "huya-md5", "stage": "tostr", "out": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 27894, "tid": 28033, "ts": 1787953252556, "seq": 42} +{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2567712080, "uidHi": 3019898993, "pid": 27894, "tid": 28033, "ts": 1787953252705, "seq": 43} +{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 3, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a10f5b703224d37ca72b01f021d3bd9d49019a9befda60cfb3ecfb23db37ff8e07d3b11d6954001204d6f54e7bc921f96a60ba95d2fabfa0d3b0b6c1a213e72d13326c598e739469a2987bd08bb1b7da0f891e15a4fa4bb542f9da21cf7b54069a87b6381aa144ef8f9a14a75beac5f91e1", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a518b960000", "stMs": "1787953253270", "nc": 0, "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 44} +{"event": "huya-md5", "stage": "tostr", "out": "5bee376c74d1ee7c77e43e11495d8b2d", "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 45} +{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 3, "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 46} +{"event": "crypto-aeskey", "stage": "leave", "key": "nskdI7MDGKSDJsnadjdoonvs", "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 47} +{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3nskdI7MDGKSDJsnadjdoonvs", "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 48} +{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 49} +{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "0403cdf6f080bacc302ed38dc761d3c396b18738685a249c0bf82a77b54db86c38a2b19e6b1ecb3a546dfac33fd8032ad8b8f6d188e34ce57a1a6ae9fd7461969e4b43083bffc77781b523b048a8e00d09a3f58d2517026d87f1a5d9ff6dfd8683def9a165ac6ab63a4398951f522c5040264d0e5cf8cf156ba6f5760328c5c6dc63e2ffd8b110fd9d002b084ec731244ce2", "outSize": 146, "pid": 27894, "tid": 28033, "ts": 1787953252742, "seq": 50} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 27894, "tid": 28033, "ts": 1787953252766, "seq": 51} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953252767, "seq": 52} +{"event": "appsign", "stage": "enter", "proto": "0x720057b170", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953252767, "seq": 53} +{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953252767, "seq": 54} +{"event": "huya-md5", "stage": "tostr", "out": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 27894, "tid": 28033, "ts": 1787953252767, "seq": 55} +{"event": "huya-md5", "stage": "tostr", "out": "a5bf123a22a1032812370046d03fb95a", "pid": 27894, "tid": 28033, "ts": 1787953252768, "seq": 56} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a965c (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x46c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 27894, "tid": 28033, "ts": 1787953252785, "seq": 57} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953252785, "seq": 58} diff --git a/tools/frida/capture_20260829_054207.jsonl b/tools/frida/capture_20260829_054207.jsonl new file mode 100644 index 0000000..e92c98a --- /dev/null +++ b/tools/frida/capture_20260829_054207.jsonl @@ -0,0 +1,58 @@ +{"event": "hook-installed", "needle": "createWupProtoInfo", "address": "0x720c8f6f1c", "pid": 32433, "tid": 32455, "ts": 1787953336136, "seq": 1} +{"event": "hook-installed", "needle": "HuyaMd5C1", "pid": 32433, "tid": 32455, "ts": 1787953336138, "seq": 2} +{"event": "hook-installed", "needle": "HuyaMd58toString", "pid": 32433, "tid": 32455, "ts": 1787953336139, "seq": 3} +{"event": "module-found", "name": "libudbauthunify.so", "base": "0x720c683000", "size": 4812800, "pid": 32433, "tid": 32455, "ts": 1787953336139, "seq": 4} +{"event": "hook-installed", "needle": "hyudb_otp_encrypt", "address": "0x720c9b2a24", "pid": 32433, "tid": 32455, "ts": 1787953336166, "seq": 5} +{"event": "hook-installed", "needle": "BusinessCfg6getOtp", "address": "0x720c8ec16c", "pid": 32433, "tid": 32455, "ts": 1787953336186, "seq": 6} +{"event": "hook-installed", "needle": "setSafeDeviceId", "address": "0x720c8ed2e0", "pid": 32433, "tid": 32455, "ts": 1787953336208, "seq": 7} +{"event": "hook-installed", "needle": "getHdid", "address": "0x720c8ed484", "pid": 32433, "tid": 32455, "ts": 1787953336229, "seq": 8} +{"event": "hook-installed", "needle": "AESkeyMgr6getkey", "address": "0x720c8eb71c", "pid": 32433, "tid": 32455, "ts": 1787953336248, "seq": 9} +{"event": "hook-installed", "needle": "md5_char16", "address": "0x720c9b171c", "pid": 32433, "tid": 32455, "ts": 1787953336267, "seq": 10} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a7f34 (_ZN14WupDataPackageIN3wup13UserLogoffReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a755c (_ZN22HandlerRequestLoginOut9onHandlerEP10UdbMsgBase+0x248) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b1e4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xeb4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 32433, "tid": 32573, "ts": 1787953349644, "seq": 11} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953349645, "seq": 12} +{"event": "appsign", "stage": "enter", "proto": "0x720bf38938", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349645, "seq": 13} +{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349645, "seq": 14} +{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 32433, "tid": 32573, "ts": 1787953349645, "seq": 15} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x336314 (_ZN14WupDataPackageIN3wup24AppLgnCredentialLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3341d8 (_ZN28HandlerRequestAnonyLoginCred9onHandlerEP10UdbMsgBase+0x558) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bae4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x17b4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 32433, "tid": 32573, "ts": 1787953349684, "seq": 16} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953349684, "seq": 17} +{"event": "appsign", "stage": "enter", "proto": "0x720bf38818", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349685, "seq": 18} +{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349685, "seq": 19} +{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 32433, "tid": 32573, "ts": 1787953349685, "seq": 20} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a7be0 (_ZN23HandlerResponseLoginOut9onHandlerEP10UdbMsgBase+0xc8) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b244 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xf14) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 32433, "tid": 32573, "ts": 1787953349769, "seq": 21} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953349769, "seq": 22} +{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2566992208, "uidHi": 3019898993, "pid": 32433, "tid": 32573, "ts": 1787953349804, "seq": 23} +{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 2, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a8066875728ac56814c316e2a466511c502bd76cf1ded554657b74729876cb9f7081cf1331add5a9f7ac54784e4d137cd79ba04e01ef74a2dc163726c3a7ced7c91bb4eb384075bc94ce2fdfde3276a64c300bfbd5d82b97f905d74c6c83a95bc42964d17f6bd1ac592c37301a49ba25748", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a5306ba0000", "stMs": "1787953350330", "nc": 0, "pid": 32433, "tid": 32573, "ts": 1787953349826, "seq": 24} +{"event": "huya-md5", "stage": "tostr", "outHex": "3336313562323434373538383036316136383261303364643762366434613639", "outStr": "3615b2447588061a682a03dd7b6d4a69", "pid": 32433, "tid": 32573, "ts": 1787953349826, "seq": 25} +{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 2, "pid": 32433, "tid": 32573, "ts": 1787953349826, "seq": 26} +{"event": "crypto-aeskey", "stage": "leave", "key": "MKDKeridjing7avnsasdSDHI", "pid": 32433, "tid": 32573, "ts": 1787953349826, "seq": 27} +{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3MKDKeridjing7avnsasdSDHI", "pid": 32433, "tid": 32573, "ts": 1787953349826, "seq": 28} +{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 32433, "tid": 32573, "ts": 1787953349827, "seq": 29} +{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "04020ddd147d02993f50cc8cd7179d5c8a7b50a03b3877c0e5458cbcb2b2f8a97d07cb2cd37264f6fd9dcc92ac53966f8e565bf5895d65cc67c641a346df23df3e2e0af22f9ff84947b20e887687d9d38ef107fac73da5c45dc943a645989bc0ffa37464444fd7e07a228d30cad91d19d58957a52d6417372e1670ec9527e8df77dec01050c60bf18dde25e524bf854d65da", "outSize": 146, "pid": 32433, "tid": 32573, "ts": 1787953349848, "seq": 30} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 32433, "tid": 32573, "ts": 1787953349880, "seq": 31} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953349880, "seq": 32} +{"event": "appsign", "stage": "enter", "proto": "0x720bf383f0", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349880, "seq": 33} +{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349880, "seq": 34} +{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 32433, "tid": 32573, "ts": 1787953349880, "seq": 35} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x334be4 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x368) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 32433, "tid": 32573, "ts": 1787953349912, "seq": 36} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953349912, "seq": 37} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a9b04 (_ZN14WupDataPackageIN3wup22AppLgnPasswordLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a8b04 (_ZN27HandlerRequestLoginPassport9onHandlerEP10UdbMsgBase+0x4e0) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b664 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1334) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 32433, "tid": 32573, "ts": 1787953357668, "seq": 38} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953357668, "seq": 39} +{"event": "appsign", "stage": "enter", "proto": "0x720bf388b8", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953357669, "seq": 40} +{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953357669, "seq": 41} +{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 32433, "tid": 32573, "ts": 1787953357669, "seq": 42} +{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2566994256, "uidHi": 3019898993, "pid": 32433, "tid": 32573, "ts": 1787953357836, "seq": 43} +{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 3, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a10cdee6f3099629758408580bf0d2b99859797aadee395c03c7c89d1b4b426d3ed1aaa1b4f0a35425f7bb687fca71a7ad37f6e8b69be29c65720159545650672d58583b681ef9227c7db969be0ed50f12d9c240ed2040e6bb255886f0b47b9423a6e046cffc021873d0be4cf15816f744a", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a53263d0000", "stMs": "1787953358397", "nc": 0, "pid": 32433, "tid": 32573, "ts": 1787953357858, "seq": 44} +{"event": "huya-md5", "stage": "tostr", "outHex": "3562656533373663373464316565376337376534336531313439356438623264", "outStr": "5bee376c74d1ee7c77e43e11495d8b2d", "pid": 32433, "tid": 32573, "ts": 1787953357859, "seq": 45} +{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 3, "pid": 32433, "tid": 32573, "ts": 1787953357859, "seq": 46} +{"event": "crypto-aeskey", "stage": "leave", "key": "nskdI7MDGKSDJsnadjdoonvs", "pid": 32433, "tid": 32573, "ts": 1787953357859, "seq": 47} +{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3nskdI7MDGKSDJsnadjdoonvs", "pid": 32433, "tid": 32573, "ts": 1787953357859, "seq": 48} +{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 32433, "tid": 32573, "ts": 1787953357859, "seq": 49} +{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "040394b29fcac3671c155c37567a8a9d62fbcd8bc979ef8b9e5d86a33797082e98cbc316c413bdce5fe9a887d92af19c5b37d39b6bbd6a88446bd60a027ca33479cfb2957c25f2ae1d51d1f413246433c08e8259cefe51e0fe060e2aa6480d0a66117b08d7bd7c141f72a690503445dc98350b7771ae6d334c21ffbf2ad23740c04fe2f2c5d0efc8bef02c8a8c9f1aaed1aa", "outSize": 146, "pid": 32433, "tid": 32573, "ts": 1787953357881, "seq": 50} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 32433, "tid": 32573, "ts": 1787953357913, "seq": 51} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953357913, "seq": 52} +{"event": "appsign", "stage": "enter", "proto": "0x720bf38170", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953357914, "seq": 53} +{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953357914, "seq": 54} +{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 32433, "tid": 32573, "ts": 1787953357914, "seq": 55} +{"event": "huya-md5", "stage": "tostr", "outHex": "6135626631323361323261313033323831323337303034366430336662393561", "outStr": "a5bf123a22a1032812370046d03fb95a", "pid": 32433, "tid": 32573, "ts": 1787953357915, "seq": 56} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a965c (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x46c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 32433, "tid": 32573, "ts": 1787953357948, "seq": 57} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953357948, "seq": 58} diff --git a/tools/frida/capture_20260829_054317.jsonl b/tools/frida/capture_20260829_054317.jsonl new file mode 100644 index 0000000..738ce6f --- /dev/null +++ b/tools/frida/capture_20260829_054317.jsonl @@ -0,0 +1,58 @@ +{"event": "hook-installed", "needle": "createWupProtoInfo", "address": "0x72095f3f1c", "pid": 5444, "tid": 5477, "ts": 1787953406376, "seq": 1} +{"event": "hook-installed", "needle": "HuyaMd5C1", "pid": 5444, "tid": 5477, "ts": 1787953406377, "seq": 2} +{"event": "hook-installed", "needle": "HuyaMd58toString", "pid": 5444, "tid": 5477, "ts": 1787953406378, "seq": 3} +{"event": "module-found", "name": "libudbauthunify.so", "base": "0x7209380000", "size": 4812800, "pid": 5444, "tid": 5477, "ts": 1787953406379, "seq": 4} +{"event": "hook-installed", "needle": "hyudb_otp_encrypt", "address": "0x72096afa24", "pid": 5444, "tid": 5477, "ts": 1787953406406, "seq": 5} +{"event": "hook-installed", "needle": "BusinessCfg6getOtp", "address": "0x72095e916c", "pid": 5444, "tid": 5477, "ts": 1787953406423, "seq": 6} +{"event": "hook-installed", "needle": "setSafeDeviceId", "address": "0x72095ea2e0", "pid": 5444, "tid": 5477, "ts": 1787953406439, "seq": 7} +{"event": "hook-installed", "needle": "getHdid", "address": "0x72095ea484", "pid": 5444, "tid": 5477, "ts": 1787953406455, "seq": 8} +{"event": "hook-installed", "needle": "AESkeyMgr6getkey", "address": "0x72095e871c", "pid": 5444, "tid": 5477, "ts": 1787953406469, "seq": 9} +{"event": "hook-installed", "needle": "md5_char16", "address": "0x72096ae71c", "pid": 5444, "tid": 5477, "ts": 1787953406484, "seq": 10} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a7f34 (_ZN14WupDataPackageIN3wup13UserLogoffReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a755c (_ZN22HandlerRequestLoginOut9onHandlerEP10UdbMsgBase+0x248) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b1e4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xeb4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 5444, "tid": 5646, "ts": 1787953427914, "seq": 11} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953427915, "seq": 12} +{"event": "appsign", "stage": "enter", "proto": "0x720ba62938", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953427915, "seq": 13} +{"event": "huya-md5", "stage": "ctor", "inHex": "353030385f31332e342e32325f3836356134393234613430383937616331666366653662346332636262306533", "inStr": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953427915, "seq": 14} +{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 5444, "tid": 5646, "ts": 1787953427915, "seq": 15} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x336314 (_ZN14WupDataPackageIN3wup24AppLgnCredentialLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3341d8 (_ZN28HandlerRequestAnonyLoginCred9onHandlerEP10UdbMsgBase+0x558) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bae4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x17b4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 5444, "tid": 5646, "ts": 1787953427935, "seq": 16} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953427935, "seq": 17} +{"event": "appsign", "stage": "enter", "proto": "0x720ba62818", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953427936, "seq": 18} +{"event": "huya-md5", "stage": "ctor", "inHex": "353030385f31332e342e32325f3836356134393234613430383937616331666366653662346332636262306533", "inStr": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953427936, "seq": 19} +{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 5444, "tid": 5646, "ts": 1787953427936, "seq": 20} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a7be0 (_ZN23HandlerResponseLoginOut9onHandlerEP10UdbMsgBase+0xc8) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b244 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xf14) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 5444, "tid": 5646, "ts": 1787953428017, "seq": 21} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953428017, "seq": 22} +{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 3733390672, "uidHi": 3019898993, "pid": 5444, "tid": 5646, "ts": 1787953428038, "seq": 23} +{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 2, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a8066875728ac56814c316e2a466511c502bd76cf1ded554657b74729876cb9f7081cf1331add5a9f7ac54784e4d137cd79ba04e01ef74a2dc163726c3a7ced7c91bb4eb384075bc94ce2fdfde3276a64c300bfbd5d82b97f905d74c6c83a95bc42964d17f6bd1ac592c37301a49ba25748", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a54386b0000", "stMs": "1787953428587", "nc": 0, "pid": 5444, "tid": 5646, "ts": 1787953428048, "seq": 24} +{"event": "huya-md5", "stage": "tostr", "outHex": "3336313562323434373538383036316136383261303364643762366434613639", "outStr": "3615b2447588061a682a03dd7b6d4a69", "pid": 5444, "tid": 5646, "ts": 1787953428048, "seq": 25} +{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 2, "pid": 5444, "tid": 5646, "ts": 1787953428049, "seq": 26} +{"event": "crypto-aeskey", "stage": "leave", "key": "MKDKeridjing7avnsasdSDHI", "pid": 5444, "tid": 5646, "ts": 1787953428049, "seq": 27} +{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3MKDKeridjing7avnsasdSDHI", "pid": 5444, "tid": 5646, "ts": 1787953428049, "seq": 28} +{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 5444, "tid": 5646, "ts": 1787953428049, "seq": 29} +{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "0402271e882cff07143af4b8c06c21f9be4350a03b3877c0e5458cbcb2b2f8a97d07cb2cd37264f6fd9dcc92ac53966f8e565bf5895d65cc67c641a346df23df3e2e0af22f9ff84947b20e887687d9d38ef107fac73da5c45dc943a645989bc0ffa37464444fd7e07a228d30cad91d19d58957a52d6417372e1670ec9527e8df77dec01050c60bf18dde25e524bf854d65da", "outSize": 146, "pid": 5444, "tid": 5646, "ts": 1787953428059, "seq": 30} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 5444, "tid": 5646, "ts": 1787953428082, "seq": 31} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953428082, "seq": 32} +{"event": "appsign", "stage": "enter", "proto": "0x720ba623f0", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953428082, "seq": 33} +{"event": "huya-md5", "stage": "ctor", "inHex": "353030385f31332e342e32325f3836356134393234613430383937616331666366653662346332636262306533", "inStr": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953428083, "seq": 34} +{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 5444, "tid": 5646, "ts": 1787953428083, "seq": 35} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x334be4 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x368) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 5444, "tid": 5646, "ts": 1787953428104, "seq": 36} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953428104, "seq": 37} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a9b04 (_ZN14WupDataPackageIN3wup22AppLgnPasswordLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a8b04 (_ZN27HandlerRequestLoginPassport9onHandlerEP10UdbMsgBase+0x4e0) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b664 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1334) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 5444, "tid": 5646, "ts": 1787953432183, "seq": 38} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953432183, "seq": 39} +{"event": "appsign", "stage": "enter", "proto": "0x720ba628b8", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953432183, "seq": 40} +{"event": "huya-md5", "stage": "ctor", "inHex": "353030385f31332e342e32325f3836356134393234613430383937616331666366653662346332636262306533", "inStr": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953432183, "seq": 41} +{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 5444, "tid": 5646, "ts": 1787953432183, "seq": 42} +{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 3733392720, "uidHi": 3019898993, "pid": 5444, "tid": 5646, "ts": 1787953432376, "seq": 43} +{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 3, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a5043ee1e2ceb0e35ed66f34b25546c651177cea1654281f71fd44b8354efcdcf35cff4c7b6e66c6fd5f8193ef4c6433ab3da81e7bf88b9c5221e14bc3ff1a4fcaf509116162aca335c5c3640cfbe89fdaa45d13633f8b188197b6df236925f9f281d0b41fe58a99abff0e3a3db8c2dae02", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a54495d0000", "stMs": "1787953432925", "nc": 0, "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 44} +{"event": "huya-md5", "stage": "tostr", "outHex": "3562656533373663373464316565376337376534336531313439356438623264", "outStr": "5bee376c74d1ee7c77e43e11495d8b2d", "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 45} +{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 3, "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 46} +{"event": "crypto-aeskey", "stage": "leave", "key": "nskdI7MDGKSDJsnadjdoonvs", "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 47} +{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3nskdI7MDGKSDJsnadjdoonvs", "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 48} +{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 49} +{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "04036fa48551d9dedf0104623d82385fa3fae56a0a43dc382db39b748e8872eb5868525829d26f293e0430a9e9ef1895e0665c72cd97c2e848f1a365fc7c261e26e386fa818c69d0ad6f506ba10d127a7519885e8d994b2019ae1a6c4769c7f598188b61526db5466ddc189c7bdfcf3d366cd02e3fdb0e45f02a177f93264b25e79f1c4de9c7e8ac3d11a49f4f2ee29a4cb7", "outSize": 146, "pid": 5444, "tid": 5646, "ts": 1787953432398, "seq": 50} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 5444, "tid": 5646, "ts": 1787953432423, "seq": 51} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953432423, "seq": 52} +{"event": "appsign", "stage": "enter", "proto": "0x720ba62170", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953432424, "seq": 53} +{"event": "huya-md5", "stage": "ctor", "inHex": "353030385f31332e342e32325f3836356134393234613430383937616331666366653662346332636262306533", "inStr": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953432424, "seq": 54} +{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 5444, "tid": 5646, "ts": 1787953432424, "seq": 55} +{"event": "huya-md5", "stage": "tostr", "outHex": "6135626631323361323261313033323831323337303034366430336662393561", "outStr": "a5bf123a22a1032812370046d03fb95a", "pid": 5444, "tid": 5646, "ts": 1787953432425, "seq": 56} +{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a965c (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x46c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 5444, "tid": 5646, "ts": 1787953432447, "seq": 57} +{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953432447, "seq": 58} diff --git a/tools/frida/hook_otp_capture.js b/tools/frida/hook_otp_capture.js index d77be2e..bde2079 100644 --- a/tools/frida/hook_otp_capture.js +++ b/tools/frida/hook_otp_capture.js @@ -270,4 +270,104 @@ for (const name of ['dlopen', 'android_dlopen_ext']) { }); } } -setImmediate(install); \ No newline at end of file +setImmediate(install); +// ---- 辅助 (appsign 段用) ---- +function readStdString(addr) { + try { + const flag = addr.readU8(); + if ((flag & 1) === 0) { // SSO + const len = flag >> 1; + return len === 0 ? '' : addr.readUtf8String(Math.min(len, 64)); + } + // long (libc++ 经典布局: cap@0-LSB, size@8, data-ptr@16) + const size = addr.add(8).readU64(); + const cap = addr.add(16).readU64(); + if (size > 1024 * 1024 || cap > 16 * 1024 * 1024) return ''; + const data = addr.add(16).readPointer(); + return size === 0 ? '' : data.readUtf8String(Math.min(size, 4096)); + } catch (e) { return ''; } +} +function btBrief() { + try { + return Thread.backtrace(this.context, Backtracer.ACCURATE) + .slice(0, 4).map(a => { + const m = Process.findModuleByAddress(a); + const off = m ? a.sub(m.base) : a; + return m ? m.name + '!' + off : a.toString(); + }).join(' <- '); + } catch (e) { return ''; } +} + +// ================== appSign 真源 hook ================== +// createWupProtoInfo(ProtoInfo&) @0x273f1c — appSign = HuyaMd5(全局单例3串 + "_" 拼接) +// 全局单例: base+0x484000+0xe0 → obj; 3 个 std::string @ obj+0x10 / +0x28 / +0x40 +(function () { + const targetName = 'libudbauthunify.so'; + const mod = Process.findModuleByName(targetName); + if (mod === null) return; + const offsets = [0x273f1c, 0x273f18]; // createWupProtoInfo 入口(含stp前) + const hookAddr = mod.base.add(0x273f1c); + Interceptor.attach(hookAddr, { + onEnter() { + const g = mod.base.add(0x484000 + 0xe0).readPointer(); + if (g.isNull()) { emit({ event: 'appsign', stage: 'global-null', bt: btBrief() }); return; } + const s1 = readStdString(g.add(0x10)); + const s2 = readStdString(g.add(0x28)); + const s3 = readStdString(g.add(0x40)); + emit({ + event: 'appsign', stage: 'enter', + proto: this.context.x0.toString(), + g3: s3, g2: s2, g1: s1, + joined: (s3 || '') + '_' + (s2 || '') + '_' + (s1 || ''), + bt: btBrief(), + }); + }, + }); + emit({ event: 'hook-installed', needle: 'createWupProtoInfo', address: hookAddr.toString(), pid: Process.id, tid: Process.getCurrentThreadId() }); + + // HuyaMd5(const string&) — 输入 + const md5ctor = Process.getModuleByName(targetName).getExportByName('_ZN7HuyaMd5C1ERKNSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE'); + if (md5ctor) { + Interceptor.attach(md5ctor, { + onEnter(args) { + let hex = ''; + try { + const a = args[1]; + const flag = a.readU8(); + if ((flag & 1) === 0) { + const len = flag >> 1; + if (len > 0 && len <= 256) hex = Array.from(new Uint8Array(a.add(1).readByteArray(len))).map(b => b.toString(16).padStart(2, '0')).join(''); + } else { + const size = a.add(8).readU64(); + if (size <= 256) hex = Array.from(new Uint8Array(a.add(16).readPointer().readByteArray(Number(size)))).map(b => b.toString(16).padStart(2, '0')).join(''); + } + } catch (e) { hex = ''; } + emit({ event: 'huya-md5', stage: 'ctor', inHex: hex, inStr: readStdString(args[1]), bt: btBrief() }); + }, + }); + emit({ event: 'hook-installed', needle: 'HuyaMd5C1' }); + } + // HuyaMd5::toString() — 输出 + const md5ts = Process.getModuleByName(targetName).getExportByName('_ZN7HuyaMd58toStringEv'); + if (md5ts) { + Interceptor.attach(md5ts, { + onLeave(retval) { + let hex = '', str = ''; + try { + const flag = retval.readU8(); + if ((flag & 1) === 0) { + const len = flag >> 1; + if (len > 0) hex = retval.readByteArray(Math.min(len, 64)).then ? '' : Array.from(new Uint8Array(retval.readByteArray(Math.min(len, 64)))).map(b => b.toString(16).padStart(2, '0')).join(''); + } else { + const size = retval.add(8).readU64(); + const data = retval.add(16).readPointer(); + if (size <= 96) hex = Array.from(new Uint8Array(data.readByteArray(Number(size)))).map(b => b.toString(16).padStart(2, '0')).join(''); + } + str = readStdString(retval); + } catch (e) { hex = ''; } + emit({ event: 'huya-md5', stage: 'tostr', outHex: hex, outStr: str }); + }, + }); + emit({ event: 'hook-installed', needle: 'HuyaMd58toString' }); + } +})(); diff --git a/tools/unidbg/hydev/src/hydev/GoldSweep.java b/tools/unidbg/hydev/src/hydev/GoldSweep.java index fb02e43..9eda803 100644 --- a/tools/unidbg/hydev/src/hydev/GoldSweep.java +++ b/tools/unidbg/hydev/src/hydev/GoldSweep.java @@ -98,6 +98,25 @@ public class GoldSweep { return p; } + /** 直调 HuyaMd5: ctor(const string&) + toString() 返回 std::string(sret in x8) */ + String callHuyaMd5(String in) { + try { + UnidbgPointer ps = writeStdString(in); + UnidbgPointer pobj = emulator.getMemory().malloc(0x40, false).getPointer(); + pobj.setZeros(0x40); + module.callFunction(emulator, 0x4533e0L, UnidbgPointer.nativeValue(pobj), UnidbgPointer.nativeValue(ps)); + UnidbgPointer pout = emulator.getMemory().malloc(0x40, false).getPointer(); + pout.setZeros(0x40); + module.callFunction(emulator, 0x4533b0L, UnidbgPointer.nativeValue(pout), UnidbgPointer.nativeValue(pobj)); + // x0 = this, x1 = out-sret? — toString() 的 sret 目标在 x8: 标准调用约定 x8 传 sret 指针 + UnidbgPointer pres = emulator.getMemory().malloc(0x40, false).getPointer(); + pres.setZeros(0x40); + module.callFunction(emulator, new Module.emulatedFunction[0], // placeholder + UnidbgPointer.nativeValue(pres) | 0); // no-op + return toHex(readStdString(pres)); + } catch (Throwable tx) { System.out.println("[M EXC] " + tx); return null; } + } + UnidbgPointer writeStdString(String s) { Memory mem = emulator.getMemory(); byte[] data = s.getBytes(); @@ -588,6 +607,22 @@ public class GoldSweep { System.out.println("[I] DONE " + n + " calls"); break; } + case "M": { // 直调 HuyaMd5("5008_13.4.2_"+k1) -> toString 输出 vs ed0db8 + String[] ins = { + "5008_13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", + "5008_13.4.2_865a4924a40897ac1fcfe6b4c2cbb045", + "5008_13.4.2_865a4924a40897ac1fcfe6b4c2abc798", + "5008_115315_865a4924a40897ac1fcfe6b4c2cbb0e3", + "865a4924a40897ac1fcfe6b4c2cbb0e3", + "5008_13.4.2", + }; + for (String in : ins) { + String out = callHuyaMd5(in); + System.out.println("M in=" + in); + System.out.println("M out=" + out + " (target=ed0db8334cadd236c00cadf7e11ab5a5) MATCH=" + (out!=null && out.equals("ed0db8334cadd236c00cadf7e11ab5a5"))); + } + break; + } case "GOLD": { // 正确UID重扫: in="1199666914671"(hy_300023887稳定uid) s3="5008" s5=金cred — 单点+全窗 String T = "ed0db8334cadd236c00cadf7e11ab5a5"; String credHex = "0a80ee56427cac9512d4b1efb6de70f89d402e40cbf4a224e127c8f588f523a917113306f36b1596b3a47f6c0765e5ce3acb549adecb0c9bdcf88f8464155289e0ef46becb08217e4fae6fa87d8702b9e641baa1ebf3e0347669cb9b40bf4c38331020b680c89df4982ab935d5c381a91f";