yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(huya): 🏆 appSign(t1.t0)算法完全破解 — ed0db8逐字节复现 (R15)

Browse Source 
公式: appSign = MD5(appId + '_' + appVersion + '_' + k1)
金样本: MD5('5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3') = ed0db8334cadd236c00cadf7e11ab5a5 ✅

发现链路: createWupProtoInfo@0x273f1c反汇编 -> HuyaMd5(全局单例3串@0x484000+0xe0) -> frida实机读串(5008/13.4.22/k1) -> toString直出ed0db8 -> python标准md5复现
- 修改: hook_otp_capture.js(+appsign/huya-md5 hook, SSO/LONG修正, tostr-hex/ctor-hex)
- docs §11.45: 完整公式+发现链路+结构性解释+工程意义
This commit is contained in:
yml2213
2026-08-29 05:45:05 +08:00
parent 3abded94eb
commit cc00915e7f
7 changed files with 404 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HUYA_HDID_ALGORITHM_GEN.md
+36
View File
@@ -1036,3 +1036,39 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a
### 5) 下一步 (appSign 真源)
- 反汇编登录 WUP 构建器 createWupRequestData<AppCommonData>@0x38dab0 → ProtoInfo.appSign 填充点 → 找 32hex getter
- 或 frida 全 hook BusinessCfg 设备 getters + setDeviceInfo 链直接读 appSign 来源
---
## ★ §11.45 R15: 🏆 appSign(t1.t0) 算法完全破解 — ed0db8 逐字节复现 (2026-08-29)
### 公式 (实机全链捕获 + 复现验证)
```
t1.t0 appSign (32hex, "hdid") = MD5( appId + "_" + appVersion + "_" + k1 )
金样本: MD5("5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3")
= ed0db8334cadd236c00cadf7e11ab5a5 ✅ 逐字节命中
```
- appId = "5008" (byte-appId), appVersion = 版本名 ("13.4.22"), k1 = BusinessCfg+0x10 设备钥 (865a49...cbb0e3)
- 与网页 appSign 公式同族: web=md5(appId+vCode+k1)[:8] (60576904) — native 用版本名+完整32hex
- HuyaMd5 类 = 标准 MD5 封装 (实机 toString 输出 = ed0db8 直接命中)
### 发现链路 (本轮)
1. createWupProtoInfo(ProtoInfo&)@0x273f1c 反汇编 → appSign = HuyaMd5(拼接串) — 3 个全局单例串 @base+0x484000+0xe0 (+0x10/+0x28/+0x40)
2. frida 读全局串: "5008" / "13.4.22" / k1 (SSO 旗标字节混读修正后)
3. HuyaMd5::toString() 实机输出 = **ed0db8334cadd236c00cadf7e11ab5a5** (WUP 公共帧构建时触发, 无需登录)
4. python: md5("5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3") = ed0db8 ✅
### 结构性解释 (与 R14 证伪一致)
- appSign 只依赖 {appId, appVersion, k1} — 无账号输入 → **跨账号稳定** ✓ (device_profiles 多账号共用)
- k1 = 设备级键 (dfp t1/ channelKey 同族: cbb045/cbb0e3) → 版本更新则 appSign 变化 → 服务端按版本校验
- 与 web appSign 公式同族: web=md5(appId+vCode+k1)[:8] (60576904) — native 用版本名+完整32hex
- OTP 链 (getOtp) = 账号级 (s5=cred) — 与 appSign 职责分离 ✓
### 工程意义
- 制造任意 (appVersion, k1) 组合的合法 appSign — 登录帧 t1.t0 可自铸
- 现有多账号方案 (金样本 hdid/shareConfig) 可升级为"按设备钥动态计算"
- 设备身份 (dfpReport 加密体) 仍是仅剩的铸造缺口 (#2)
### 工具/证据
- tools/frida/hook_otp_capture.js: createWupProtoInfo@0x273f1c + HuyaMd5C1/toString 全链 hook
- capture_20260829_054317.jsonl: ctor inHex=353030385f31332e342e32325f383635... (5008_13.4.22_k1) + tostr=ed0db8...
- 复核: md5("5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3") = ed0db8334cadd236c00cadf7e11ab5a5 ✅
tools/frida/capture_20260829_053822.jsonl
+58
View File
@@ -0,0 +1,58 @@
{"event": "hook-installed", "needle": "createWupProtoInfo", "address": "0x71fd103f1c", "pid": 24428, "tid": 24450, "ts": 1787953111360, "seq": 1}
{"event": "hook-installed", "needle": "HuyaMd5C1", "pid": 24428, "tid": 24450, "ts": 1787953111362, "seq": 2}
{"event": "hook-installed", "needle": "HuyaMd58toString", "pid": 24428, "tid": 24450, "ts": 1787953111363, "seq": 3}
{"event": "module-found", "name": "libudbauthunify.so", "base": "0x71fce90000", "size": 4812800, "pid": 24428, "tid": 24450, "ts": 1787953111363, "seq": 4}
{"event": "hook-installed", "needle": "hyudb_otp_encrypt", "address": "0x71fd1bfa24", "pid": 24428, "tid": 24450, "ts": 1787953111391, "seq": 5}
{"event": "hook-installed", "needle": "BusinessCfg6getOtp", "address": "0x71fd0f916c", "pid": 24428, "tid": 24450, "ts": 1787953111410, "seq": 6}
{"event": "hook-installed", "needle": "setSafeDeviceId", "address": "0x71fd0fa2e0", "pid": 24428, "tid": 24450, "ts": 1787953111427, "seq": 7}
{"event": "hook-installed", "needle": "getHdid", "address": "0x71fd0fa484", "pid": 24428, "tid": 24450, "ts": 1787953111443, "seq": 8}
{"event": "hook-installed", "needle": "AESkeyMgr6getkey", "address": "0x71fd0f871c", "pid": 24428, "tid": 24450, "ts": 1787953111458, "seq": 9}
{"event": "hook-installed", "needle": "md5_char16", "address": "0x71fd1be71c", "pid": 24428, "tid": 24450, "ts": 1787953111472, "seq": 10}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a7f34 (_ZN14WupDataPackageIN3wup13UserLogoffReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a755c (_ZN22HandlerRequestLoginOut9onHandlerEP10UdbMsgBase+0x248) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b1e4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xeb4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 24428, "tid": 24582, "ts": 1787953128333, "seq": 11}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953128333, "seq": 12}
{"event": "appsign", "stage": "enter", "proto": "0x720dea9938", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "<err:access violation accessing 0x3>", "joined": "\b500_\u000e13.4.2_<err:access violation accessing 0x3>", "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128334, "seq": 13}
{"event": "huya-md5", "stage": "ctor", "in": null, "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128334, "seq": 14}
{"event": "huya-md5", "stage": "tostr", "out": null, "pid": 24428, "tid": 24582, "ts": 1787953128334, "seq": 15}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x336314 (_ZN14WupDataPackageIN3wup24AppLgnCredentialLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3341d8 (_ZN28HandlerRequestAnonyLoginCred9onHandlerEP10UdbMsgBase+0x558) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bae4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x17b4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 24428, "tid": 24582, "ts": 1787953128363, "seq": 16}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953128363, "seq": 17}
{"event": "appsign", "stage": "enter", "proto": "0x720dea9818", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "<err:access violation accessing 0x3>", "joined": "\b500_\u000e13.4.2_<err:access violation accessing 0x3>", "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128363, "seq": 18}
{"event": "huya-md5", "stage": "ctor", "in": null, "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128363, "seq": 19}
{"event": "huya-md5", "stage": "tostr", "out": null, "pid": 24428, "tid": 24582, "ts": 1787953128363, "seq": 20}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a7be0 (_ZN23HandlerResponseLoginOut9onHandlerEP10UdbMsgBase+0xc8) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b244 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xf14) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 24428, "tid": 24582, "ts": 1787953128461, "seq": 21}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953128461, "seq": 22}
{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2570448208, "uidHi": 3019898993, "pid": 24428, "tid": 24582, "ts": 1787953128488, "seq": 23}
{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 2, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a8066875728ac56814c316e2a466511c502bd76cf1ded554657b74729876cb9f7081cf1331add5a9f7ac54784e4d137cd79ba04e01ef74a2dc163726c3a7ced7c91bb4eb384075bc94ce2fdfde3276a64c300bfbd5d82b97f905d74c6c83a95bc42964d17f6bd1ac592c37301a49ba25748", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a4faa240000", "stMs": "1787953130020", "nc": 0, "pid": 24428, "tid": 24582, "ts": 1787953128495, "seq": 24}
{"event": "huya-md5", "stage": "tostr", "out": "<err:can't decode byte 0xc0 in posi>", "pid": 24428, "tid": 24582, "ts": 1787953128495, "seq": 25}
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 2, "pid": 24428, "tid": 24582, "ts": 1787953128496, "seq": 26}
{"event": "crypto-aeskey", "stage": "leave", "key": "MKDKeridjing7avnsasdSDHI", "pid": 24428, "tid": 24582, "ts": 1787953128496, "seq": 27}
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3MKDKeridjing7avnsasdSDHI", "pid": 24428, "tid": 24582, "ts": 1787953128496, "seq": 28}
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 24428, "tid": 24582, "ts": 1787953128496, "seq": 29}
{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "04027c8fe60a97a9c80fef4ae365ab8d404850a03b3877c0e5458cbcb2b2f8a97d07cb2cd37264f6fd9dcc92ac53966f8e565bf5895d65cc67c641a346df23df3e2e0af22f9ff84947b20e887687d9d38ef107fac73da5c45dc943a645989bc0ffa37464444fd7e07a228d30cad91d19d58957a52d6417372e1670ec9527e8df77dec01050c60bf18dde25e524bf854d65da", "outSize": 146, "pid": 24428, "tid": 24582, "ts": 1787953128503, "seq": 30}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 24428, "tid": 24582, "ts": 1787953128524, "seq": 31}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953128524, "seq": 32}
{"event": "appsign", "stage": "enter", "proto": "0x720dea93f0", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "<err:access violation accessing 0x3>", "joined": "\b500_\u000e13.4.2_<err:access violation accessing 0x3>", "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128524, "seq": 33}
{"event": "huya-md5", "stage": "ctor", "in": null, "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953128524, "seq": 34}
{"event": "huya-md5", "stage": "tostr", "out": null, "pid": 24428, "tid": 24582, "ts": 1787953128524, "seq": 35}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x334be4 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x368) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 24428, "tid": 24582, "ts": 1787953128562, "seq": 36}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953128562, "seq": 37}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a9b04 (_ZN14WupDataPackageIN3wup22AppLgnPasswordLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a8b04 (_ZN27HandlerRequestLoginPassport9onHandlerEP10UdbMsgBase+0x4e0) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b664 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1334) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 24428, "tid": 24582, "ts": 1787953155033, "seq": 38}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953155033, "seq": 39}
{"event": "appsign", "stage": "enter", "proto": "0x720dea98b8", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "<err:access violation accessing 0x3>", "joined": "\b500_\u000e13.4.2_<err:access violation accessing 0x3>", "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953155034, "seq": 40}
{"event": "huya-md5", "stage": "ctor", "in": null, "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953155034, "seq": 41}
{"event": "huya-md5", "stage": "tostr", "out": null, "pid": 24428, "tid": 24582, "ts": 1787953155034, "seq": 42}
{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2570749264, "uidHi": 3019898993, "pid": 24428, "tid": 24582, "ts": 1787953155225, "seq": 43}
{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 3, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a808cc19be90021734459ce575524b7c4190b85bd57b396a921b4be0f701848cbb34aeb65009f5eac2ca9e0dd922e5197f3e7c6492663984e8616d3e5f8964e6710ecb03603d3567518b80bd74776439d749c02407193390c35e7e02c6e6bdc8add6fb39036954eb5cd420f8cb23e1e48cc", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a500ec40000", "stMs": "1787953155780", "nc": 0, "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 44}
{"event": "huya-md5", "stage": "tostr", "out": "<err:can't decode byte 0xc0 in posi>", "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 45}
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 3, "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 46}
{"event": "crypto-aeskey", "stage": "leave", "key": "nskdI7MDGKSDJsnadjdoonvs", "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 47}
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3nskdI7MDGKSDJsnadjdoonvs", "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 48}
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 24428, "tid": 24582, "ts": 1787953155231, "seq": 49}
{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "0403bc9f0a0563ca62ffbe2a1731207f1761bc3cd47cd82a849bbe21ea3ddd0f47ddd84b33cbf7e38ed36db4d8842992975be2392eb2a27d1d6a85b7b396bffaf2ed2f20b88ef4c38dddf3c8854961e8de7754b255ac2e6358f8afc5e26f09a66b97ac33d7616d4561252d0a995e44894256f010327785a561ef4af9e71f0542f2652aa323d92e2252511096c48a39788520", "outSize": 146, "pid": 24428, "tid": 24582, "ts": 1787953155239, "seq": 50}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 24428, "tid": 24582, "ts": 1787953155256, "seq": 51}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953155256, "seq": 52}
{"event": "appsign", "stage": "enter", "proto": "0x720dea9170", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "<err:access violation accessing 0x3>", "joined": "\b500_\u000e13.4.2_<err:access violation accessing 0x3>", "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953155256, "seq": 53}
{"event": "huya-md5", "stage": "ctor", "in": null, "bt": "", "pid": 24428, "tid": 24582, "ts": 1787953155256, "seq": 54}
{"event": "huya-md5", "stage": "tostr", "out": null, "pid": 24428, "tid": 24582, "ts": 1787953155256, "seq": 55}
{"event": "huya-md5", "stage": "tostr", "out": "<err:can't decode byte 0x00 in posi>", "pid": 24428, "tid": 24582, "ts": 1787953155257, "seq": 56}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a965c (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x46c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 24428, "tid": 24582, "ts": 1787953155289, "seq": 57}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 24428, "tid": 24582, "ts": 1787953155289, "seq": 58}
tools/frida/capture_20260829_053940.jsonl
+58
View File
@@ -0,0 +1,58 @@
{"event": "hook-installed", "needle": "createWupProtoInfo", "address": "0x720ce74f1c", "pid": 27894, "tid": 27916, "ts": 1787953188461, "seq": 1}
{"event": "hook-installed", "needle": "HuyaMd5C1", "pid": 27894, "tid": 27916, "ts": 1787953188462, "seq": 2}
{"event": "hook-installed", "needle": "HuyaMd58toString", "pid": 27894, "tid": 27916, "ts": 1787953188463, "seq": 3}
{"event": "module-found", "name": "libudbauthunify.so", "base": "0x720cc01000", "size": 4812800, "pid": 27894, "tid": 27916, "ts": 1787953188464, "seq": 4}
{"event": "hook-installed", "needle": "hyudb_otp_encrypt", "address": "0x720cf30a24", "pid": 27894, "tid": 27916, "ts": 1787953188489, "seq": 5}
{"event": "hook-installed", "needle": "BusinessCfg6getOtp", "address": "0x720ce6a16c", "pid": 27894, "tid": 27916, "ts": 1787953188509, "seq": 6}
{"event": "hook-installed", "needle": "setSafeDeviceId", "address": "0x720ce6b2e0", "pid": 27894, "tid": 27916, "ts": 1787953188531, "seq": 7}
{"event": "hook-installed", "needle": "getHdid", "address": "0x720ce6b484", "pid": 27894, "tid": 27916, "ts": 1787953188551, "seq": 8}
{"event": "hook-installed", "needle": "AESkeyMgr6getkey", "address": "0x720ce6971c", "pid": 27894, "tid": 27916, "ts": 1787953188567, "seq": 9}
{"event": "hook-installed", "needle": "md5_char16", "address": "0x720cf2f71c", "pid": 27894, "tid": 27916, "ts": 1787953188583, "seq": 10}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a7f34 (_ZN14WupDataPackageIN3wup13UserLogoffReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a755c (_ZN22HandlerRequestLoginOut9onHandlerEP10UdbMsgBase+0x248) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b1e4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xeb4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 27894, "tid": 28033, "ts": 1787953248894, "seq": 11}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953248895, "seq": 12}
{"event": "appsign", "stage": "enter", "proto": "0x720057b938", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953248895, "seq": 13}
{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953248895, "seq": 14}
{"event": "huya-md5", "stage": "tostr", "out": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 27894, "tid": 28033, "ts": 1787953248895, "seq": 15}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x336314 (_ZN14WupDataPackageIN3wup24AppLgnCredentialLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3341d8 (_ZN28HandlerRequestAnonyLoginCred9onHandlerEP10UdbMsgBase+0x558) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bae4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x17b4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 27894, "tid": 28033, "ts": 1787953248917, "seq": 16}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953248918, "seq": 17}
{"event": "appsign", "stage": "enter", "proto": "0x720057b818", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953248918, "seq": 18}
{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953248918, "seq": 19}
{"event": "huya-md5", "stage": "tostr", "out": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 27894, "tid": 28033, "ts": 1787953248918, "seq": 20}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a7be0 (_ZN23HandlerResponseLoginOut9onHandlerEP10UdbMsgBase+0xc8) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b244 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xf14) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 27894, "tid": 28033, "ts": 1787953248989, "seq": 21}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953248989, "seq": 22}
{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2567710032, "uidHi": 3019898993, "pid": 27894, "tid": 28033, "ts": 1787953249008, "seq": 23}
{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 2, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a8066875728ac56814c316e2a466511c502bd76cf1ded554657b74729876cb9f7081cf1331add5a9f7ac54784e4d137cd79ba04e01ef74a2dc163726c3a7ced7c91bb4eb384075bc94ce2fdfde3276a64c300bfbd5d82b97f905d74c6c83a95bc42964d17f6bd1ac592c37301a49ba25748", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a517d210000", "stMs": "1787953249569", "nc": 0, "pid": 27894, "tid": 28033, "ts": 1787953249022, "seq": 24}
{"event": "huya-md5", "stage": "tostr", "out": "3615b2447588061a682a03dd7b6d4a69", "pid": 27894, "tid": 28033, "ts": 1787953249022, "seq": 25}
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 2, "pid": 27894, "tid": 28033, "ts": 1787953249022, "seq": 26}
{"event": "crypto-aeskey", "stage": "leave", "key": "MKDKeridjing7avnsasdSDHI", "pid": 27894, "tid": 28033, "ts": 1787953249022, "seq": 27}
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3MKDKeridjing7avnsasdSDHI", "pid": 27894, "tid": 28033, "ts": 1787953249023, "seq": 28}
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 27894, "tid": 28033, "ts": 1787953249023, "seq": 29}
{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "0402720228f531a599f3392bb491eac5f0e350a03b3877c0e5458cbcb2b2f8a97d07cb2cd37264f6fd9dcc92ac53966f8e565bf5895d65cc67c641a346df23df3e2e0af22f9ff84947b20e887687d9d38ef107fac73da5c45dc943a645989bc0ffa37464444fd7e07a228d30cad91d19d58957a52d6417372e1670ec9527e8df77dec01050c60bf18dde25e524bf854d65da", "outSize": 146, "pid": 27894, "tid": 28033, "ts": 1787953249037, "seq": 30}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 27894, "tid": 28033, "ts": 1787953249061, "seq": 31}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953249061, "seq": 32}
{"event": "appsign", "stage": "enter", "proto": "0x720057b3f0", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953249061, "seq": 33}
{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953249061, "seq": 34}
{"event": "huya-md5", "stage": "tostr", "out": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 27894, "tid": 28033, "ts": 1787953249061, "seq": 35}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x334be4 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x368) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 27894, "tid": 28033, "ts": 1787953249077, "seq": 36}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953249077, "seq": 37}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a9b04 (_ZN14WupDataPackageIN3wup22AppLgnPasswordLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a8b04 (_ZN27HandlerRequestLoginPassport9onHandlerEP10UdbMsgBase+0x4e0) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b664 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1334) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 27894, "tid": 28033, "ts": 1787953252555, "seq": 38}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953252556, "seq": 39}
{"event": "appsign", "stage": "enter", "proto": "0x720057b8b8", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953252556, "seq": 40}
{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953252556, "seq": 41}
{"event": "huya-md5", "stage": "tostr", "out": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 27894, "tid": 28033, "ts": 1787953252556, "seq": 42}
{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2567712080, "uidHi": 3019898993, "pid": 27894, "tid": 28033, "ts": 1787953252705, "seq": 43}
{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 3, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a10f5b703224d37ca72b01f021d3bd9d49019a9befda60cfb3ecfb23db37ff8e07d3b11d6954001204d6f54e7bc921f96a60ba95d2fabfa0d3b0b6c1a213e72d13326c598e739469a2987bd08bb1b7da0f891e15a4fa4bb542f9da21cf7b54069a87b6381aa144ef8f9a14a75beac5f91e1", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a518b960000", "stMs": "1787953253270", "nc": 0, "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 44}
{"event": "huya-md5", "stage": "tostr", "out": "5bee376c74d1ee7c77e43e11495d8b2d", "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 45}
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 3, "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 46}
{"event": "crypto-aeskey", "stage": "leave", "key": "nskdI7MDGKSDJsnadjdoonvs", "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 47}
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3nskdI7MDGKSDJsnadjdoonvs", "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 48}
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 27894, "tid": 28033, "ts": 1787953252724, "seq": 49}
{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "0403cdf6f080bacc302ed38dc761d3c396b18738685a249c0bf82a77b54db86c38a2b19e6b1ecb3a546dfac33fd8032ad8b8f6d188e34ce57a1a6ae9fd7461969e4b43083bffc77781b523b048a8e00d09a3f58d2517026d87f1a5d9ff6dfd8683def9a165ac6ab63a4398951f522c5040264d0e5cf8cf156ba6f5760328c5c6dc63e2ffd8b110fd9d002b084ec731244ce2", "outSize": 146, "pid": 27894, "tid": 28033, "ts": 1787953252742, "seq": 50}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 27894, "tid": 28033, "ts": 1787953252766, "seq": 51}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953252767, "seq": 52}
{"event": "appsign", "stage": "enter", "proto": "0x720057b170", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953252767, "seq": 53}
{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 27894, "tid": 28033, "ts": 1787953252767, "seq": 54}
{"event": "huya-md5", "stage": "tostr", "out": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 27894, "tid": 28033, "ts": 1787953252767, "seq": 55}
{"event": "huya-md5", "stage": "tostr", "out": "a5bf123a22a1032812370046d03fb95a", "pid": 27894, "tid": 28033, "ts": 1787953252768, "seq": 56}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a965c (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x46c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 27894, "tid": 28033, "ts": 1787953252785, "seq": 57}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 27894, "tid": 28033, "ts": 1787953252785, "seq": 58}
tools/frida/capture_20260829_054207.jsonl
+58
View File
@@ -0,0 +1,58 @@
{"event": "hook-installed", "needle": "createWupProtoInfo", "address": "0x720c8f6f1c", "pid": 32433, "tid": 32455, "ts": 1787953336136, "seq": 1}
{"event": "hook-installed", "needle": "HuyaMd5C1", "pid": 32433, "tid": 32455, "ts": 1787953336138, "seq": 2}
{"event": "hook-installed", "needle": "HuyaMd58toString", "pid": 32433, "tid": 32455, "ts": 1787953336139, "seq": 3}
{"event": "module-found", "name": "libudbauthunify.so", "base": "0x720c683000", "size": 4812800, "pid": 32433, "tid": 32455, "ts": 1787953336139, "seq": 4}
{"event": "hook-installed", "needle": "hyudb_otp_encrypt", "address": "0x720c9b2a24", "pid": 32433, "tid": 32455, "ts": 1787953336166, "seq": 5}
{"event": "hook-installed", "needle": "BusinessCfg6getOtp", "address": "0x720c8ec16c", "pid": 32433, "tid": 32455, "ts": 1787953336186, "seq": 6}
{"event": "hook-installed", "needle": "setSafeDeviceId", "address": "0x720c8ed2e0", "pid": 32433, "tid": 32455, "ts": 1787953336208, "seq": 7}
{"event": "hook-installed", "needle": "getHdid", "address": "0x720c8ed484", "pid": 32433, "tid": 32455, "ts": 1787953336229, "seq": 8}
{"event": "hook-installed", "needle": "AESkeyMgr6getkey", "address": "0x720c8eb71c", "pid": 32433, "tid": 32455, "ts": 1787953336248, "seq": 9}
{"event": "hook-installed", "needle": "md5_char16", "address": "0x720c9b171c", "pid": 32433, "tid": 32455, "ts": 1787953336267, "seq": 10}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a7f34 (_ZN14WupDataPackageIN3wup13UserLogoffReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a755c (_ZN22HandlerRequestLoginOut9onHandlerEP10UdbMsgBase+0x248) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b1e4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xeb4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 32433, "tid": 32573, "ts": 1787953349644, "seq": 11}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953349645, "seq": 12}
{"event": "appsign", "stage": "enter", "proto": "0x720bf38938", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349645, "seq": 13}
{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349645, "seq": 14}
{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 32433, "tid": 32573, "ts": 1787953349645, "seq": 15}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x336314 (_ZN14WupDataPackageIN3wup24AppLgnCredentialLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3341d8 (_ZN28HandlerRequestAnonyLoginCred9onHandlerEP10UdbMsgBase+0x558) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bae4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x17b4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 32433, "tid": 32573, "ts": 1787953349684, "seq": 16}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953349684, "seq": 17}
{"event": "appsign", "stage": "enter", "proto": "0x720bf38818", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349685, "seq": 18}
{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349685, "seq": 19}
{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 32433, "tid": 32573, "ts": 1787953349685, "seq": 20}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a7be0 (_ZN23HandlerResponseLoginOut9onHandlerEP10UdbMsgBase+0xc8) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b244 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xf14) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 32433, "tid": 32573, "ts": 1787953349769, "seq": 21}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953349769, "seq": 22}
{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2566992208, "uidHi": 3019898993, "pid": 32433, "tid": 32573, "ts": 1787953349804, "seq": 23}
{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 2, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a8066875728ac56814c316e2a466511c502bd76cf1ded554657b74729876cb9f7081cf1331add5a9f7ac54784e4d137cd79ba04e01ef74a2dc163726c3a7ced7c91bb4eb384075bc94ce2fdfde3276a64c300bfbd5d82b97f905d74c6c83a95bc42964d17f6bd1ac592c37301a49ba25748", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a5306ba0000", "stMs": "1787953350330", "nc": 0, "pid": 32433, "tid": 32573, "ts": 1787953349826, "seq": 24}
{"event": "huya-md5", "stage": "tostr", "outHex": "3336313562323434373538383036316136383261303364643762366434613639", "outStr": "3615b2447588061a682a03dd7b6d4a69", "pid": 32433, "tid": 32573, "ts": 1787953349826, "seq": 25}
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 2, "pid": 32433, "tid": 32573, "ts": 1787953349826, "seq": 26}
{"event": "crypto-aeskey", "stage": "leave", "key": "MKDKeridjing7avnsasdSDHI", "pid": 32433, "tid": 32573, "ts": 1787953349826, "seq": 27}
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3MKDKeridjing7avnsasdSDHI", "pid": 32433, "tid": 32573, "ts": 1787953349826, "seq": 28}
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 32433, "tid": 32573, "ts": 1787953349827, "seq": 29}
{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "04020ddd147d02993f50cc8cd7179d5c8a7b50a03b3877c0e5458cbcb2b2f8a97d07cb2cd37264f6fd9dcc92ac53966f8e565bf5895d65cc67c641a346df23df3e2e0af22f9ff84947b20e887687d9d38ef107fac73da5c45dc943a645989bc0ffa37464444fd7e07a228d30cad91d19d58957a52d6417372e1670ec9527e8df77dec01050c60bf18dde25e524bf854d65da", "outSize": 146, "pid": 32433, "tid": 32573, "ts": 1787953349848, "seq": 30}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 32433, "tid": 32573, "ts": 1787953349880, "seq": 31}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953349880, "seq": 32}
{"event": "appsign", "stage": "enter", "proto": "0x720bf383f0", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349880, "seq": 33}
{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953349880, "seq": 34}
{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 32433, "tid": 32573, "ts": 1787953349880, "seq": 35}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x334be4 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x368) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 32433, "tid": 32573, "ts": 1787953349912, "seq": 36}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953349912, "seq": 37}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a9b04 (_ZN14WupDataPackageIN3wup22AppLgnPasswordLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a8b04 (_ZN27HandlerRequestLoginPassport9onHandlerEP10UdbMsgBase+0x4e0) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b664 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1334) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 32433, "tid": 32573, "ts": 1787953357668, "seq": 38}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953357668, "seq": 39}
{"event": "appsign", "stage": "enter", "proto": "0x720bf388b8", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953357669, "seq": 40}
{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953357669, "seq": 41}
{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 32433, "tid": 32573, "ts": 1787953357669, "seq": 42}
{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 2566994256, "uidHi": 3019898993, "pid": 32433, "tid": 32573, "ts": 1787953357836, "seq": 43}
{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 3, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a10cdee6f3099629758408580bf0d2b99859797aadee395c03c7c89d1b4b426d3ed1aaa1b4f0a35425f7bb687fca71a7ad37f6e8b69be29c65720159545650672d58583b681ef9227c7db969be0ed50f12d9c240ed2040e6bb255886f0b47b9423a6e046cffc021873d0be4cf15816f744a", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a53263d0000", "stMs": "1787953358397", "nc": 0, "pid": 32433, "tid": 32573, "ts": 1787953357858, "seq": 44}
{"event": "huya-md5", "stage": "tostr", "outHex": "3562656533373663373464316565376337376534336531313439356438623264", "outStr": "5bee376c74d1ee7c77e43e11495d8b2d", "pid": 32433, "tid": 32573, "ts": 1787953357859, "seq": 45}
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 3, "pid": 32433, "tid": 32573, "ts": 1787953357859, "seq": 46}
{"event": "crypto-aeskey", "stage": "leave", "key": "nskdI7MDGKSDJsnadjdoonvs", "pid": 32433, "tid": 32573, "ts": 1787953357859, "seq": 47}
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3nskdI7MDGKSDJsnadjdoonvs", "pid": 32433, "tid": 32573, "ts": 1787953357859, "seq": 48}
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 32433, "tid": 32573, "ts": 1787953357859, "seq": 49}
{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "040394b29fcac3671c155c37567a8a9d62fbcd8bc979ef8b9e5d86a33797082e98cbc316c413bdce5fe9a887d92af19c5b37d39b6bbd6a88446bd60a027ca33479cfb2957c25f2ae1d51d1f413246433c08e8259cefe51e0fe060e2aa6480d0a66117b08d7bd7c141f72a690503445dc98350b7771ae6d334c21ffbf2ad23740c04fe2f2c5d0efc8bef02c8a8c9f1aaed1aa", "outSize": 146, "pid": 32433, "tid": 32573, "ts": 1787953357881, "seq": 50}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 32433, "tid": 32573, "ts": 1787953357913, "seq": 51}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953357913, "seq": 52}
{"event": "appsign", "stage": "enter", "proto": "0x720bf38170", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953357914, "seq": 53}
{"event": "huya-md5", "stage": "ctor", "in": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 32433, "tid": 32573, "ts": 1787953357914, "seq": 54}
{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 32433, "tid": 32573, "ts": 1787953357914, "seq": 55}
{"event": "huya-md5", "stage": "tostr", "outHex": "6135626631323361323261313033323831323337303034366430336662393561", "outStr": "a5bf123a22a1032812370046d03fb95a", "pid": 32433, "tid": 32573, "ts": 1787953357915, "seq": 56}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a965c (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x46c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 32433, "tid": 32573, "ts": 1787953357948, "seq": 57}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 32433, "tid": 32573, "ts": 1787953357948, "seq": 58}
tools/frida/capture_20260829_054317.jsonl
+58
View File
@@ -0,0 +1,58 @@
{"event": "hook-installed", "needle": "createWupProtoInfo", "address": "0x72095f3f1c", "pid": 5444, "tid": 5477, "ts": 1787953406376, "seq": 1}
{"event": "hook-installed", "needle": "HuyaMd5C1", "pid": 5444, "tid": 5477, "ts": 1787953406377, "seq": 2}
{"event": "hook-installed", "needle": "HuyaMd58toString", "pid": 5444, "tid": 5477, "ts": 1787953406378, "seq": 3}
{"event": "module-found", "name": "libudbauthunify.so", "base": "0x7209380000", "size": 4812800, "pid": 5444, "tid": 5477, "ts": 1787953406379, "seq": 4}
{"event": "hook-installed", "needle": "hyudb_otp_encrypt", "address": "0x72096afa24", "pid": 5444, "tid": 5477, "ts": 1787953406406, "seq": 5}
{"event": "hook-installed", "needle": "BusinessCfg6getOtp", "address": "0x72095e916c", "pid": 5444, "tid": 5477, "ts": 1787953406423, "seq": 6}
{"event": "hook-installed", "needle": "setSafeDeviceId", "address": "0x72095ea2e0", "pid": 5444, "tid": 5477, "ts": 1787953406439, "seq": 7}
{"event": "hook-installed", "needle": "getHdid", "address": "0x72095ea484", "pid": 5444, "tid": 5477, "ts": 1787953406455, "seq": 8}
{"event": "hook-installed", "needle": "AESkeyMgr6getkey", "address": "0x72095e871c", "pid": 5444, "tid": 5477, "ts": 1787953406469, "seq": 9}
{"event": "hook-installed", "needle": "md5_char16", "address": "0x72096ae71c", "pid": 5444, "tid": 5477, "ts": 1787953406484, "seq": 10}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a7f34 (_ZN14WupDataPackageIN3wup13UserLogoffReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a755c (_ZN22HandlerRequestLoginOut9onHandlerEP10UdbMsgBase+0x248) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b1e4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xeb4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 5444, "tid": 5646, "ts": 1787953427914, "seq": 11}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953427915, "seq": 12}
{"event": "appsign", "stage": "enter", "proto": "0x720ba62938", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953427915, "seq": 13}
{"event": "huya-md5", "stage": "ctor", "inHex": "353030385f31332e342e32325f3836356134393234613430383937616331666366653662346332636262306533", "inStr": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953427915, "seq": 14}
{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 5444, "tid": 5646, "ts": 1787953427915, "seq": 15}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x336314 (_ZN14WupDataPackageIN3wup24AppLgnCredentialLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3341d8 (_ZN28HandlerRequestAnonyLoginCred9onHandlerEP10UdbMsgBase+0x558) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bae4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x17b4) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 5444, "tid": 5646, "ts": 1787953427935, "seq": 16}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953427935, "seq": 17}
{"event": "appsign", "stage": "enter", "proto": "0x720ba62818", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953427936, "seq": 18}
{"event": "huya-md5", "stage": "ctor", "inHex": "353030385f31332e342e32325f3836356134393234613430383937616331666366653662346332636262306533", "inStr": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953427936, "seq": 19}
{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 5444, "tid": 5646, "ts": 1787953427936, "seq": 20}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a7be0 (_ZN23HandlerResponseLoginOut9onHandlerEP10UdbMsgBase+0xc8) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b244 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0xf14) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 5444, "tid": 5646, "ts": 1787953428017, "seq": 21}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953428017, "seq": 22}
{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 3733390672, "uidHi": 3019898993, "pid": 5444, "tid": 5646, "ts": 1787953428038, "seq": 23}
{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 2, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a8066875728ac56814c316e2a466511c502bd76cf1ded554657b74729876cb9f7081cf1331add5a9f7ac54784e4d137cd79ba04e01ef74a2dc163726c3a7ced7c91bb4eb384075bc94ce2fdfde3276a64c300bfbd5d82b97f905d74c6c83a95bc42964d17f6bd1ac592c37301a49ba25748", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a54386b0000", "stMs": "1787953428587", "nc": 0, "pid": 5444, "tid": 5646, "ts": 1787953428048, "seq": 24}
{"event": "huya-md5", "stage": "tostr", "outHex": "3336313562323434373538383036316136383261303364643762366434613639", "outStr": "3615b2447588061a682a03dd7b6d4a69", "pid": 5444, "tid": 5646, "ts": 1787953428048, "seq": 25}
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 2, "pid": 5444, "tid": 5646, "ts": 1787953428049, "seq": 26}
{"event": "crypto-aeskey", "stage": "leave", "key": "MKDKeridjing7avnsasdSDHI", "pid": 5444, "tid": 5646, "ts": 1787953428049, "seq": 27}
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3MKDKeridjing7avnsasdSDHI", "pid": 5444, "tid": 5646, "ts": 1787953428049, "seq": 28}
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 5444, "tid": 5646, "ts": 1787953428049, "seq": 29}
{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "0402271e882cff07143af4b8c06c21f9be4350a03b3877c0e5458cbcb2b2f8a97d07cb2cd37264f6fd9dcc92ac53966f8e565bf5895d65cc67c641a346df23df3e2e0af22f9ff84947b20e887687d9d38ef107fac73da5c45dc943a645989bc0ffa37464444fd7e07a228d30cad91d19d58957a52d6417372e1670ec9527e8df77dec01050c60bf18dde25e524bf854d65da", "outSize": 146, "pid": 5444, "tid": 5646, "ts": 1787953428059, "seq": 30}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x334aa8 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x22c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 5444, "tid": 5646, "ts": 1787953428082, "seq": 31}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953428082, "seq": 32}
{"event": "appsign", "stage": "enter", "proto": "0x720ba623f0", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953428082, "seq": 33}
{"event": "huya-md5", "stage": "ctor", "inHex": "353030385f31332e342e32325f3836356134393234613430383937616331666366653662346332636262306533", "inStr": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953428083, "seq": 34}
{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 5444, "tid": 5646, "ts": 1787953428083, "seq": 35}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x334be4 (_ZN29HandlerResponseAnonyLoginCred9onHandlerEP10UdbMsgBase+0x368) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27bb44 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1814) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 5444, "tid": 5646, "ts": 1787953428104, "seq": 36}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953428104, "seq": 37}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x3a9b04 (_ZN14WupDataPackageIN3wup22AppLgnPasswordLoginReqEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3a8b04 (_ZN27HandlerRequestLoginPassport9onHandlerEP10UdbMsgBase+0x4e0) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b664 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1334) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c)", "pid": 5444, "tid": 5646, "ts": 1787953432183, "seq": 38}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953432183, "seq": 39}
{"event": "appsign", "stage": "enter", "proto": "0x720ba628b8", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953432183, "seq": 40}
{"event": "huya-md5", "stage": "ctor", "inHex": "353030385f31332e342e32325f3836356134393234613430383937616331666366653662346332636262306533", "inStr": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953432183, "seq": 41}
{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 5444, "tid": 5646, "ts": 1787953432183, "seq": 42}
{"event": "crypto-getotp", "stage": "enter", "bt": "libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "uidLo": 3733392720, "uidHi": 3019898993, "pid": 5444, "tid": 5646, "ts": 1787953432376, "seq": 43}
{"event": "crypto-otp", "stage": "enter", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "xxteaKeyStr": null, "xxteaKeyHex": "", "xxteaKeySize": 0, "arg1": 2, "arg2_cnt": 3, "arg3": "", "arg4": "3836356134393234613430383937616331666366653662346332636262306533", "arg5": "0a5043ee1e2ceb0e35ed66f34b25546c651177cea1654281f71fd44b8354efcdcf35cff4c7b6e66c6fd5f8193ef4c6433ab3da81e7bf88b9c5221e14bc3ff1a4fcaf509116162aca335c5c3640cfbe89fdaa45d13633f8b188197b6df236925f9f281d0b41fe58a99abff0e3a3db8c2dae02", "arg5Size": 114, "arg6": 4, "arg7_nonce": "1a04a54495d0000", "stMs": "1787953432925", "nc": 0, "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 44}
{"event": "huya-md5", "stage": "tostr", "outHex": "3562656533373663373464316565376337376534336531313439356438623264", "outStr": "5bee376c74d1ee7c77e43e11495d8b2d", "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 45}
{"event": "crypto-aeskey", "stage": "enter", "a": 1, "b": 3, "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 46}
{"event": "crypto-aeskey", "stage": "leave", "key": "nskdI7MDGKSDJsnadjdoonvs", "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 47}
{"event": "crypto-md5", "stage": "enter", "inStr": "865a4924a40897ac1fcfe6b4c2cbb0e3nskdI7MDGKSDJsnadjdoonvs", "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 48}
{"event": "crypto-md5", "stage": "leave", "keyHex": "", "pid": 5444, "tid": 5646, "ts": 1787953432387, "seq": 49}
{"event": "crypto-otp", "stage": "leave", "bt": "libudbauthunify.so!0x269328 (_ZN11BusinessCfg6getOtpERN3wup12AppLoginDataE+0x1bc) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac) <- libudbauthunify.so!0x275980 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xac)", "outStr": null, "outHex": "04036fa48551d9dedf0104623d82385fa3fae56a0a43dc382db39b748e8872eb5868525829d26f293e0430a9e9ef1895e0665c72cd97c2e848f1a365fc7c261e26e386fa818c69d0ad6f506ba10d127a7519885e8d994b2019ae1a6c4769c7f598188b61526db5466ddc189c7bdfcf3d366cd02e3fdb0e45f02a177f93264b25e79f1c4de9c7e8ac3d11a49f4f2ee29a4cb7", "outSize": 146, "pid": 5444, "tid": 5646, "ts": 1787953432398, "seq": 50}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x2749e8 (_Z19createWupDeviceInfoPN3wup10DeviceInfoE+0x348) <- libudbauthunify.so!0x38dafc (_ZN14WupDataPackageIN3wup13AppCommonDataEE20createWupRequestDataERS1_RNSt6__ndk112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEPKcSD_i+0x4c) <- libudbauthunify.so!0x3e3af8 (_ZN18UdbUserFilterUtils15getAppComomDataENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEERN3wup12AppLoginDataE+0xd0) <- libudbauthunify.so!0x275994 (_Z19copyWupLoginToBeansRN3wup12AppLoginDataER17BusBeansLoginData+0xc0) <- libudbauthunify.so!0x3a9464 (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x274) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c)", "pid": 5444, "tid": 5646, "ts": 1787953432423, "seq": 51}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953432423, "seq": 52}
{"event": "appsign", "stage": "enter", "proto": "0x720ba62170", "g3": "\b500", "g2": "\u000e13.4.2", "g1": "865a4924a40897ac1fcfe6b4c2cbb0e3", "joined": "\b500_\u000e13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953432424, "seq": 53}
{"event": "huya-md5", "stage": "ctor", "inHex": "353030385f31332e342e32325f3836356134393234613430383937616331666366653662346332636262306533", "inStr": "5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3", "bt": "", "pid": 5444, "tid": 5646, "ts": 1787953432424, "seq": 54}
{"event": "huya-md5", "stage": "tostr", "outHex": "6564306462383333346361646432333663303063616466376531316162356135", "outStr": "ed0db8334cadd236c00cadf7e11ab5a5", "pid": 5444, "tid": 5646, "ts": 1787953432424, "seq": 55}
{"event": "huya-md5", "stage": "tostr", "outHex": "6135626631323361323261313033323831323337303034366430336662393561", "outStr": "a5bf123a22a1032812370046d03fb95a", "pid": 5444, "tid": 5646, "ts": 1787953432425, "seq": 56}
{"event": "gethdid", "stage": "enter", "bt": "libudbauthunify.so!0x3d60a8 (_ZN16BusinessLogBuild14buildLogHeaderER11BusinessLogi+0xec) <- libudbauthunify.so!0x3a965c (_ZN28HandlerResponseLoginPassport9onHandlerEP10UdbMsgBase+0x46c) <- libudbauthunify.so!0x24a5d8 (_ZN13UdbMsgHandler10handlerMsgEP10UdbMsgBase+0x3c) <- libudbauthunify.so!0x27b6c4 (_ZN16BusinessMsgChain5doMSGEP10UdbMsgBaseRPc+0x1394) <- libudbauthunify.so!0x2453cc (_ZN7MsgLoop5doMSGEP10UdbMsgBaseRPc+0x18c) <- libudbauthunify.so!0x245b40 (_ZN7MsgLoop14processWorkingEv+0xec)", "pid": 5444, "tid": 5646, "ts": 1787953432447, "seq": 57}
{"event": "gethdid", "stage": "leave", "slot1088": "37633533383765303533396330323363333163346666306538303765373235363131373338356565", "size": 40, "pid": 5444, "tid": 5646, "ts": 1787953432447, "seq": 58}
tools/frida/hook_otp_capture.js
+100
View File
@@ -271,3 +271,103 @@ for (const name of ['dlopen', 'android_dlopen_ext']) {
}
}
setImmediate(install);
// ---- 辅助 (appsign 段用) ----
function readStdString(addr) {
try {
const flag = addr.readU8();
if ((flag & 1) === 0) { // SSO
const len = flag >> 1;
return len === 0 ? '' : addr.readUtf8String(Math.min(len, 64));
}
// long (libc++ 经典布局: cap@0-LSB, size@8, data-ptr@16)
const size = addr.add(8).readU64();
const cap = addr.add(16).readU64();
if (size > 1024 * 1024 || cap > 16 * 1024 * 1024) return '<bad:' + size + '>';
const data = addr.add(16).readPointer();
return size === 0 ? '' : data.readUtf8String(Math.min(size, 4096));
} catch (e) { return '<err:' + e.message.slice(0, 30) + '>'; }
}
function btBrief() {
try {
return Thread.backtrace(this.context, Backtracer.ACCURATE)
.slice(0, 4).map(a => {
const m = Process.findModuleByAddress(a);
const off = m ? a.sub(m.base) : a;
return m ? m.name + '!' + off : a.toString();
}).join(' <- ');
} catch (e) { return ''; }
}
// ================== appSign 真源 hook ==================
// createWupProtoInfo(ProtoInfo&) @0x273f1c — appSign = HuyaMd5(全局单例3串 + "_" 拼接)
// 全局单例: base+0x484000+0xe0 → obj; 3 个 std::string @ obj+0x10 / +0x28 / +0x40
(function () {
const targetName = 'libudbauthunify.so';
const mod = Process.findModuleByName(targetName);
if (mod === null) return;
const offsets = [0x273f1c, 0x273f18]; // createWupProtoInfo 入口(含stp前)
const hookAddr = mod.base.add(0x273f1c);
Interceptor.attach(hookAddr, {
onEnter() {
const g = mod.base.add(0x484000 + 0xe0).readPointer();
if (g.isNull()) { emit({ event: 'appsign', stage: 'global-null', bt: btBrief() }); return; }
const s1 = readStdString(g.add(0x10));
const s2 = readStdString(g.add(0x28));
const s3 = readStdString(g.add(0x40));
emit({
event: 'appsign', stage: 'enter',
proto: this.context.x0.toString(),
g3: s3, g2: s2, g1: s1,
joined: (s3 || '') + '_' + (s2 || '') + '_' + (s1 || ''),
bt: btBrief(),
});
},
});
emit({ event: 'hook-installed', needle: 'createWupProtoInfo', address: hookAddr.toString(), pid: Process.id, tid: Process.getCurrentThreadId() });
// HuyaMd5(const string&) — 输入
const md5ctor = Process.getModuleByName(targetName).getExportByName('_ZN7HuyaMd5C1ERKNSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE');
if (md5ctor) {
Interceptor.attach(md5ctor, {
onEnter(args) {
let hex = '';
try {
const a = args[1];
const flag = a.readU8();
if ((flag & 1) === 0) {
const len = flag >> 1;
if (len > 0 && len <= 256) hex = Array.from(new Uint8Array(a.add(1).readByteArray(len))).map(b => b.toString(16).padStart(2, '0')).join('');
} else {
const size = a.add(8).readU64();
if (size <= 256) hex = Array.from(new Uint8Array(a.add(16).readPointer().readByteArray(Number(size)))).map(b => b.toString(16).padStart(2, '0')).join('');
}
} catch (e) { hex = '<err>'; }
emit({ event: 'huya-md5', stage: 'ctor', inHex: hex, inStr: readStdString(args[1]), bt: btBrief() });
},
});
emit({ event: 'hook-installed', needle: 'HuyaMd5C1' });
}
// HuyaMd5::toString() — 输出
const md5ts = Process.getModuleByName(targetName).getExportByName('_ZN7HuyaMd58toStringEv');
if (md5ts) {
Interceptor.attach(md5ts, {
onLeave(retval) {
let hex = '', str = '';
try {
const flag = retval.readU8();
if ((flag & 1) === 0) {
const len = flag >> 1;
if (len > 0) hex = retval.readByteArray(Math.min(len, 64)).then ? '' : Array.from(new Uint8Array(retval.readByteArray(Math.min(len, 64)))).map(b => b.toString(16).padStart(2, '0')).join('');
} else {
const size = retval.add(8).readU64();
const data = retval.add(16).readPointer();
if (size <= 96) hex = Array.from(new Uint8Array(data.readByteArray(Number(size)))).map(b => b.toString(16).padStart(2, '0')).join('');
}
str = readStdString(retval);
} catch (e) { hex = '<err:' + e.message.slice(0, 40) + '>'; }
emit({ event: 'huya-md5', stage: 'tostr', outHex: hex, outStr: str });
},
});
emit({ event: 'hook-installed', needle: 'HuyaMd58toString' });
}
})();
tools/unidbg/hydev/src/hydev/GoldSweep.java
+35
View File
@@ -98,6 +98,25 @@ public class GoldSweep {
return p;
}
/** 直调 HuyaMd5: ctor(const string&) + toString() 返回 std::string(sret in x8) */
String callHuyaMd5(String in) {
try {
UnidbgPointer ps = writeStdString(in);
UnidbgPointer pobj = emulator.getMemory().malloc(0x40, false).getPointer();
pobj.setZeros(0x40);
module.callFunction(emulator, 0x4533e0L, UnidbgPointer.nativeValue(pobj), UnidbgPointer.nativeValue(ps));
UnidbgPointer pout = emulator.getMemory().malloc(0x40, false).getPointer();
pout.setZeros(0x40);
module.callFunction(emulator, 0x4533b0L, UnidbgPointer.nativeValue(pout), UnidbgPointer.nativeValue(pobj));
// x0 = this, x1 = out-sret? — toString() 的 sret 目标在 x8: 标准调用约定 x8 传 sret 指针
UnidbgPointer pres = emulator.getMemory().malloc(0x40, false).getPointer();
pres.setZeros(0x40);
module.callFunction(emulator, new Module.emulatedFunction[0], // placeholder
UnidbgPointer.nativeValue(pres) | 0); // no-op
return toHex(readStdString(pres));
} catch (Throwable tx) { System.out.println("[M EXC] " + tx); return null; }
}
UnidbgPointer writeStdString(String s) {
Memory mem = emulator.getMemory();
byte[] data = s.getBytes();
@@ -588,6 +607,22 @@ public class GoldSweep {
System.out.println("[I] DONE " + n + " calls");
break;
}
case "M": { // 直调 HuyaMd5("5008_13.4.2_"+k1) -> toString 输出 vs ed0db8
String[] ins = {
"5008_13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3",
"5008_13.4.2_865a4924a40897ac1fcfe6b4c2cbb045",
"5008_13.4.2_865a4924a40897ac1fcfe6b4c2abc798",
"5008_115315_865a4924a40897ac1fcfe6b4c2cbb0e3",
"865a4924a40897ac1fcfe6b4c2cbb0e3",
"5008_13.4.2",
};
for (String in : ins) {
String out = callHuyaMd5(in);
System.out.println("M in=" + in);
System.out.println("M out=" + out + " (target=ed0db8334cadd236c00cadf7e11ab5a5) MATCH=" + (out!=null && out.equals("ed0db8334cadd236c00cadf7e11ab5a5")));
}
break;
}
case "GOLD": { // 正确UID重扫: in="1199666914671"(hy_300023887稳定uid) s3="5008" s5=金cred — 单点+全窗
String T = "ed0db8334cadd236c00cadf7e11ab5a5";
String credHex = "0a80ee56427cac9512d4b1efb6de70f89d402e40cbf4a224e127c8f588f523a917113306f36b1596b3a47f6c0765e5ce3acb549adecb0c9bdcf88f8464155289e0ef46becb08217e4fae6fa87d8702b9e641baa1ebf3e0347669cb9b40bf4c38331020b680c89df4982ab935d5c381a91f";