From cc8589a7aa848819e47044cb97fa51d05ece01e8 Mon Sep 17 00:00:00 2001 From: yml2213 Date: Tue, 25 Aug 2026 18:16:09 +0800 Subject: [PATCH] =?UTF-8?q?feat(huya):=20=E5=93=8D=E5=BA=94=E8=A7=A3?= =?UTF-8?q?=E6=9E=90=E9=80=9A=E8=BF=87(id=3D4097=E5=9B=9E=E6=98=BE)=20-=20?= =?UTF-8?q?APP=5FSIGN=E7=BC=BA=E5=8F=A3=E5=AE=9A=E4=BD=8D=E5=88=B0AESkeyMg?= =?UTF-8?q?r=E9=92=A5KFWAH?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/虎牙hyCred签发-侦察笔记.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md index 095d8ae..a26a0a4 100644 --- a/docs/虎牙hyCred签发-侦察笔记.md +++ b/docs/虎牙hyCred签发-侦察笔记.md @@ -202,3 +202,14 @@ build_password_login_wup(前会话复刻包) POST https://wup.huya.com body=原始TAF字节(非b64!), CT=application/multipart-formdata, Dalvik UA → HTTP200 588B结构化TAF响应(huyaudbwebui/hypasswordLogin回显)! 假密码测试通过=帧格式实锤。下步: 解响应取rc/cred字段,真密码登录取cred->铸证->cookie。 + +## R2: 响应解析+签名缺口定位 + +TAF响应解析成功: _wup_data/_wup_header 双map, JSON上下文回显 + {id:4097(=0x1001!), associationId:8193(0x2001), session, traceId, step:1} +错误码: APP_SIGN_NOT_MATCH "APP签名不匹配" + SIGNAL_SERVICE_RET。 +签名密钥候选: KFWAH2cbkkNgFAgQPzriFPcU (24字符) 注册于AESkeyMgr::C2@0x26fcc8! + (与证书钥4VYc/xXED/3FMH同管理体系,疑为请求签名专用钥) +另发现 ybEWdvkjGjPQa2ugireHJCLL 邻串。 +下步: 反汇编AESkeyMgr::C2取全部钥表+id; 结合登录时bigaes钩子事件复刻sign算法。 +注: 发包body=raw TAF字节(b64是旧文档误导); HTTP200帧已通。