From d29290ae0efd8eaeeac3ad7a889c2f1bc3c57dcc Mon Sep 17 00:00:00 2001 From: yml2213 Date: Tue, 25 Aug 2026 19:12:35 +0800 Subject: [PATCH] =?UTF-8?q?feat(huya):=20=E7=BA=AFPython=E5=AF=86=E7=A0=81?= =?UTF-8?q?->cred->=E9=93=B8=E8=AF=81->bind=E5=85=A8=E9=93=BE=E8=B7=AF?= =?UTF-8?q?=E8=B4=AF=E9=80=9A!=20=E9=9B=B6=E8=AE=BE=E5=A4=87=E9=97=AD?= =?UTF-8?q?=E7=8E=AF=E8=BE=BE=E6=88=90?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/虎牙hyCred签发-侦察笔记.md | 12 ++++ evidence/cert_keycap.json | 2 +- evidence/forge_bind_result.json | 12 ++-- evidence/hycred_ctrl_cert.json | 1 + evidence/hycred_pp_cert.json | 1 + evidence/hycred_stored_cert.json | 1 + evidence/wfextrace.json | 1 + scripts/hook_wfex.py | 98 ++++++++++++++++++++++++++++++++ scripts/probe_forge_cert_bind.py | 4 +- 9 files changed, 123 insertions(+), 9 deletions(-) create mode 100644 evidence/hycred_ctrl_cert.json create mode 100644 evidence/hycred_pp_cert.json create mode 100644 evidence/hycred_stored_cert.json create mode 100644 evidence/wfextrace.json create mode 100644 scripts/hook_wfex.py diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md index a0f230b..9caad95 100644 --- a/docs/虎牙hyCred签发-侦察笔记.md +++ b/docs/虎牙hyCred签发-侦察笔记.md @@ -304,3 +304,15 @@ cred字节1轮换: 0x10/0x20/0x30/0x40/0x50/0x70/0x80(观测值)=代次计数器 或响应cred需会话上下文解密/兑换。 下一步: hook getCred的调用链回溯(谁写入该值), 或登录后逐func试调 (hyanonymousCredlogin/getAppComomData)观察cred0文件变化。 + +## ★★★★ 终局: 纯Python全链路贯通(零设备)! + +完整闭环实测通过: + 密码aa778899 -> SHA1 -> build_password_login_wup(hypasswordLogin) + -> POST wup.huya.com(raw TAF) -> HTTP200 + -> 响应t3=新鲜cred(114B,0a开头,每次登录轮换) + -> cert_forge(新nonce+key_idx0x20) -> 证书194B + -> bindQrLoginUser -> ok:true uid=1199666914671 biztoken344B ✅ +关键教训: 40020拒绝系旧wupData信封过期(session/nonce TTL), 与cred无关! +信封需新鲜抓取(keycap钩子桥触发即可)。 +多账号运营: 账号密码即全部所需, 全自动出cookie。 diff --git a/evidence/cert_keycap.json b/evidence/cert_keycap.json index 38351e3..76c859e 100644 --- a/evidence/cert_keycap.json +++ b/evidence/cert_keycap.json @@ -1 +1 @@ -[{"type": "armed", "base": "0x787c8da000"}, {"type": "c1", "key": "345659635064764b4b716a42485a7443", "bt": "0x787cc0a298 libudbauthunify.so!_Z10encode_aesRKNSt6__ndk112basic_stringIcNS_11c"}, {"type": "enc_in", "ra": "0x787cc0a2a8 libudbauthunify.so!_Z10encode_aesRKNSt6__ndk112basic_stringIcNS_11char_traits", "x0s": {"t": "s", "len": 72, "v": "b7d37c78000000637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0add4a2af9ca472c0b7fd9326363ff7cc34a5e5f171d8311504c723c31896059a071280e2eb27b27509"}, "x1s": {"t": "l", "len": 187, "v": "010400353030381400c25220f81f60cf64ee54e83ef1eab6bdd047b5af28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a50ec123c02f4f8380d6081fb3b63b0c1786e9fe2908c83319d414790a7357320225a63f7e8e541e7dbf36f4d4b00733a944300fcba6142d1bba59133b95ea102fed12b4e809c5ad8d9f1e0d294ca522375b1dd71616d22ad8deeef00d4564fd45ed122e3cbdc720cde42c22caa79e7f8f0"}, "x2s": {"t": "s", "len": 0, "v": ""}, "x3s": {"t": "s", "len": 24, "v": "39393933383972000a50ec123c02f4f8380d6081fb3b63b0"}, "x1raw": "c100000000000000bb000000000000000069992b790000b4b04cc04879000000", "x2raw": "000000000000000000000000000000000000000000000000c100000000000000", "x3raw": "3039393933383972000a50ec123c02f4f8380d6081fb3b63b0c1786e9fe2908c"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "010400353030381400c25220f81f60cf"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "64ee54e83ef1eab6bdd047b5af280030"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "32646633393837393734333265616465"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "66636331323736373131396164356538"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "3039393933383972000a50ec123c02f4"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "f8380d6081fb3b63b0c1786e9fe2908c"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "83319d414790a7357320225a63f7e8e5"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "41e7dbf36f4d4b00733a944300fcba61"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "42d1bba59133b95ea102fed12b4e809c"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "5ad8d9f1e0d294ca522375b1dd71616d"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "22ad8deeef00d4564fd45ed122e3cbdc"}, {"type": "_enc", "ra": "0x787cb2a114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "720cde42c22caa79e7f8f00000000000"}, {"type": "enc_out", "ret": {"t": "s", "len": 72, "v": "b7d37c78000000637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0add4a2af9ca472c0b7fd9326363ff7cc34a5e5f171d8311504c723c31896059a071280e2eb27b27509"}}, {"type": "encode_aes", "ra": "0x787cc0aaa4 libudbauthunify.so!_Z13gen_biz_token8BIZTOKENRKNSt6__ndk112basic_stringIcNS0_", "p0": {"t": "l", "len": 187, "v": "010400353030381400c25220f81f60cf64ee54e83ef1eab6bdd047b5af28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a50ec123c02f4f8380d6081fb3b63b0c1786e9fe2908c83319d414790a7357320225a63f7e8e541e7dbf36f4d4b00733a944300fcba6142d1bba59133b95ea102fed12b4e809c5ad8d9f1e0d294ca522375b1dd71616d22ad8deeef00d4564fd45ed122e3cbdc720cde42c22caa79e7f8f0"}, "p1": {"t": "l", "len": 24, "v": "345659635064764b4b716a42485a74436d62726f5258486b"}}, {"type": "qurl_done", "len": 1332, "data": "AAAD5hADLDxCABUrW1YMaHV5YXVkYndlYnVpZgdkZWZhdWx0fQABA7gIAAIGCV93dXBfZGF0YR0AAQOKCgoMFgMxLjAmynsiYXNzb2NpYXRpb25JZCI6MTg0NTQ5MzkyLCJmdW5jTmFtZSI6IiIsImdyb3VwIjowLCJpZCI6MTg0NTQ5MzkyLCJzZXNzaW9uIjoxMzg3MzU1LCJzdGVwIjowLCJzdGlsbExvZ2luIjpmYWxzZSwidHJhY2VJZCI6IjBiOGYwOThmZjY0YTViZGMtMjE0NTItMzE5NjM1ODQ3ODc2NDE4NTUwMTgiLCJ0eXBlIjoyLCJ1aWQiOjAsInVzZXJDb250ZXh0IjoiIn02BDUwMDhAA1a0UFF3ZW1BTjlOSGtaS29NcVZnazV5eEl5cHFNVGFRRU9ybVhyMzd4UVZoUVpxckQ0aVVLRVExMXh2RTBtdmFsZGt0Szgza05sUjV1SnU1bmFjSjRDcGg1OW4vZDVNd3RuRUY2TnFTYkNhWUU0SnRudDBnbzFvQXZqSml5YW9SVG90VitYeWpSOFdva0wxS2wvaCtIdlJiL0ZoYzU3Rkl2WjdLYklROEI3RFZsOEdFdHI2bDMzZgB2AIYAlgALGgYgZWQwZGI4MzM0Y2FkZDIzNmMwMGNhZGY3ZTExYWI1YTUWBzEzLjQuMjImCTEuMC44MDEzODYARgkxMjcuMC4wLjFWBnhpYW9taWYACyoAARYJTTIxMDJKMlNDJigwMmRmMzk4Nzk3NDMyZWFkZWZjYzEyNzY3MTE5YWQ1ZTgwOTk5Mzg5NgdhbmRyb2lkRg9NMjEwMkoyU0MsMzAsMTFmBDEwODB2BDIxMjCGKDdjNTM4N2UwNTM5YzAyM2MzMWM0ZmYwZTgwN2U3MjU2MTE3Mzg1ZWULMwAAARdRuGVvRwAAAQREQ0FhNjVxaDFNbm0vRzFXS0xITGsybzdERFlMT1JUdG01VHl6MGdJU1FXVUlDeTZwSUdIQjNMK0trMzVxVS9iaWc1Qk1TVVVSd3gzeS9wWVpWajRjd20rUWE5UXBFQXZUWjd3eSswR0VhYngwdksvL1B5cVo1M0F6WTEyNEhCUHo4Y25YdFBkVTdXc0NYdzFkMElBOUZHNTE4RUNqM1phZVRBakxuYW9GWmhuUVZuUCtmejRMWlRoNUNRSGQ2S20zMWo1VEVPY090UDBpSVo3NWFleFFpYWNiUTNtdkprcTh5bTJ1dmw0SWJDVFl2MGpwT3BQeXNWYTg4RTBpMXpCcENBPVYAZgALBhB3dXB1ZGJyZXF1ZXN0X3YwHQAABQIAFStbjJgMqAw="}] \ No newline at end of file +[{"type": "armed", "base": "0x77c57c4000"}, {"type": "c1", "key": "345659635064764b4b716a42485a7443", "bt": "0x77c5af4298 libudbauthunify.so!_Z10encode_aesRKNSt6__ndk112basic_stringIcNS_11c"}, {"type": "enc_in", "ra": "0x77c5af42a8 libudbauthunify.so!_Z10encode_aesRKNSt6__ndk112basic_stringIcNS_11char_traits", "x0s": {"t": "s", "len": 72, "v": "57c2c577000000637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0add4a2af9ca472c0b7fd9326363ff7cc34a5e5f171d8311504c723c31896059a071280e2eb27b27509"}, "x1s": {"t": "l", "len": 187, "v": "010400353030381400fd951db27f62fad1580eb969f4e921146552ba3e28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a70a84a169d30cdbb28d8dc3e9321c7c67d36e263acb351b739debaafa8a86b5000a4e35310cd3f58326484ea16c93ffa0203953ffeb94c57baf290a29fc8f55f525562f0625a5baad9f4dc101414072ec55f1b649c84f6c3bdce7b52ab4495c450f5a55d8eb16e4db5d2fdf6f29dd1761e"}, "x2s": {"t": "s", "len": 0, "v": ""}, "x3s": {"t": "s", "len": 24, "v": "39393933383972000a70a84a169d30cdbb28d8dc3e9321c7"}, "x1raw": "c100000000000000bb000000000000000034c2aa770000b4f04b608578000000", "x2raw": "000000000000000000000000000000000000000000000000c100000000000000", "x3raw": "3039393933383972000a70a84a169d30cdbb28d8dc3e9321c7c67d36e263acb3"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "010400353030381400fd951db27f62fa"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "d1580eb969f4e921146552ba3e280030"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "32646633393837393734333265616465"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "66636331323736373131396164356538"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "3039393933383972000a70a84a169d30"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "cdbb28d8dc3e9321c7c67d36e263acb3"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "51b739debaafa8a86b5000a4e35310cd"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "3f58326484ea16c93ffa0203953ffeb9"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "4c57baf290a29fc8f55f525562f0625a"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "5baad9f4dc101414072ec55f1b649c84"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "f6c3bdce7b52ab4495c450f5a55d8eb1"}, {"type": "_enc", "ra": "0x77c5a14114 libudbauthunify.so!_ZN10UdbAESUtil7encryptERNSt6__ndk112basic_stringIcNS0_11c", "blk": "6e4db5d2fdf6f29dd1761e0000000000"}, {"type": "enc_out", "ret": {"t": "s", "len": 72, "v": "57c2c577000000637c777bf26b6fc53001672bfed7ab76ca82c97dfa5947f0add4a2af9ca472c0b7fd9326363ff7cc34a5e5f171d8311504c723c31896059a071280e2eb27b27509"}}, {"type": "encode_aes", "ra": "0x77c5af4aa4 libudbauthunify.so!_Z13gen_biz_token8BIZTOKENRKNSt6__ndk112basic_stringIcNS0_", "p0": {"t": "l", "len": 187, "v": "010400353030381400fd951db27f62fad1580eb969f4e921146552ba3e28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a70a84a169d30cdbb28d8dc3e9321c7c67d36e263acb351b739debaafa8a86b5000a4e35310cd3f58326484ea16c93ffa0203953ffeb94c57baf290a29fc8f55f525562f0625a5baad9f4dc101414072ec55f1b649c84f6c3bdce7b52ab4495c450f5a55d8eb16e4db5d2fdf6f29dd1761e"}, "p1": {"t": "l", "len": 24, "v": "345659635064764b4b716a42485a74436d62726f5258486b"}}, {"type": "qurl_done", "len": 1328, "data": "AAAD5BADLDxCADYAwlYMaHV5YXVkYndlYnVpZgdkZWZhdWx0fQABA7YIAAIGCV93dXBfZGF0YR0AAQOICgoMFgMxLjAmyHsiYXNzb2NpYXRpb25JZCI6MTg0NTQ5MzkyLCJmdW5jTmFtZSI6IiIsImdyb3VwIjowLCJpZCI6MTg0NTQ5MzkyLCJzZXNzaW9uIjozNTM5MTM4LCJzdGVwIjowLCJzdGlsbExvZ2luIjpmYWxzZSwidHJhY2VJZCI6IjBiOGYwOThmZjY0YTViZGMtMzg3MC04ODcwNzAyNzg3NjU2Mjg5MjA1IiwidHlwZSI6MiwidWlkIjowLCJ1c2VyQ29udGV4dCI6IiJ9NgQ1MDA4QANWtFBRd2VtQU45TkhrWktvTXFXVmIwanhJeXBxTVRhUUVPcm1YcjM3eFFWaFFacXJEeGlVS0VRMTE5dkUwMnFhODNrOWpnMTFjOEVLZTJnS1RtTDZSVXEwUXdrNGhGQ0F4SVBGcUdxbkRBUHJBU0lPT1l3eXRJckFYdkQxaW5yZzdlc243aDYyMThHcjB0ellZT3ArTHlEN2VEeGZ0RkJLM08rY3ZsVkpkUVFYWm1SeFU0aTFxWmYAdgCGAJYACxoGIGVkMGRiODMzNGNhZGQyMzZjMDBjYWRmN2UxMWFiNWE1FgcxMy40LjIyJgkxLjAuODAxMzg2AEYJMTI3LjAuMC4xVgZ4aWFvbWlmAAsqAAEWCU0yMTAySjJTQyYoMDJkZjM5ODc5NzQzMmVhZGVmY2MxMjc2NzExOWFkNWU4MDk5OTM4OTYHYW5kcm9pZEYPTTIxMDJKMlNDLDMwLDExZgQxMDgwdgQyMTIwhig3YzUzODdlMDUzOWMwMjNjMzFjNGZmMGU4MDdlNzI1NjExNzM4NWVlCzMAAAEXUbhlb0cAAAEERENBclMyUTlVQ3dmMU9PbXdXQ3VEM3hkc3JKdXFXb0YvQmRKZ0xPMUtHWXBUaXk2cElHSEIzTCtLazM1cVUvYmlnNUJNU1VVUnd4M3kvcFlaVmo0Y3dtK1JlSE5aeHZnaGxHenhPR3V2TG95U2NkNEtZQ2dZVWNxS0o2SXBYdkNEU3V2eE1VSFRoU3VQdUVPMGF2NW5IUy96OTJQK21mZUt4aHpHY0h4WFRDdi92U1FuMkJsdk1qSEhMSUxkb1FvMngvWEdBRGJTYkxjN0ZORVZnQUN0Rm9JaW1zVmN1NlZISXNybmhEeTBDUEphTGEyYW9aOHZ0UU14NDR6Q1lzWVcwMD1WAGYACwYQd3VwdWRicmVxdWVzdF92MB0AAAUCADYAwoyYDKgM"}] \ No newline at end of file diff --git a/evidence/forge_bind_result.json b/evidence/forge_bind_result.json index c4a0725..ebb0ba1 100644 --- a/evidence/forge_bind_result.json +++ b/evidence/forge_bind_result.json @@ -1,12 +1,12 @@ { "results": { "C_forged_swapped_cred": { - "bind_fail": true, - "rc": 40020, - "desc": "登录失败，请重新登录", - "scan_uid": null + "ok": true, + "uid": 1199666914671, + "biztoken_len": 344, + "biztoken": "AQANuXdRNaWljTvYRXSvqEPiEY-fH82GLpdxZLAQb0TbqRtehX-V6LZb89mudbyUAvppOSdR7e7otDkx049MDjPDZ9bIW8g8Yje5ZbbSiLFGHD3ir3Co3ZqJFRnZMgaH-spHmOdKEnPmzEtFAJshKxYOPVXfFMDatNrbMdvcPN_JOYtMMIy0cKwon7MD88xa40VzM39PW3NDIVZ9uHAixogdKfNd4QCGs4jvbCXHV0OQTIQ_7vslqcJm7dhCWhbUzoQkjUu-8BfrDC2hxrEyxF7CCiBhNE8NbWmjPhFrXx9pAnQXGvaQka34zPeS0VGKTrSHhwUP454dRt0i6yoHccF2" } }, - "p1_new_hex": "010400353030381400c25220f81f60cf64ee54e83ef1eab6bdd047b5af28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a20171d4885bb9bb40f29517ab490f3634a0640e942e24039e2f471a5a66a0c64662b68c43f64a90ab982d8298bfc5de4e58a0bb6617a7ab8ecc730cde4a28bd828261096ca95b6247bba5e4714395166f9a22eb0c9954e6d0890ba40fa951e70e63c7c4c8e8e5547f6ca029830f31adbe8", - "ts": 1787655679.05882 + "p1_new_hex": "010400353030381400fd951db27f62fad1580eb969f4e921146552ba3e28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a00469c0c8de6126519e9fe14cc34c908f32bb6e41db93f62c40c8cc806d03d08aeaa5554afa9b0a539875ad7920ea095dd210a2439428d962b40126fc723e777342ba3c58507bd5369e597e4a04c48d580cc1e6cd03a47415e91b562637742446f3a989a8c6464e2e45db4b949464773d1", + "ts": 1787656336.623034 } \ No newline at end of file diff --git a/evidence/hycred_ctrl_cert.json b/evidence/hycred_ctrl_cert.json new file mode 100644 index 0000000..a1afa31 --- /dev/null +++ b/evidence/hycred_ctrl_cert.json @@ -0,0 +1 @@ +{"p1": "01040035303038140001a0389d70ed0000389d70ed000000000000000028003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a20171d4885bb9bb40f29517ab490f3634a0640e942e24039e2f471a5a66a0c64662b68c43f64a90ab982d8298bfc5de4e58a0bb6617a7ab8ecc730cde4a28bd828261096ca95b6247bba5e4714395166f9a22eb0c9954e6d0890ba40fa951e70e63c7c4c8e8e5547f6ca029830f31adbe8", "cert_hex": "0c2041da0f8b2bc93536f1311d868d6307d3fffdd94452044039d3fa05b8a86f3c2e2cbaa481870772fe2a4df9a94fdb8a0e41312514470c77cbfa586558f87309bea9c2abc3b6948072d9c345292866c8517e60cc7cd93f2c2bb82f8d8a255da88418e86fd21309d9306024a8006b99540c58054f823c7d8924b56f841c8dbb10d093ddf859b21625ba8bb1a34ab8b03d27b5a3ed92a67750464225ba8b9be3cd5c359369ef783b7f4487614e65bc04a159b4e75bd74c62f9cb9755d765ab007748", "cred_hex": "0a20171d4885bb9bb40f29517ab490f3634a0640e942e24039e2f471a5a66a0c64662b68c43f64a90ab982d8298bfc5de4e58a0bb6617a7ab8ecc730cde4a28bd828261096ca95b6247bba5e4714395166f9a22eb0c9954e6d0890ba40fa951e70e63c7c4c8e8e5547f6ca029830f31adbe8"} \ No newline at end of file diff --git a/evidence/hycred_pp_cert.json b/evidence/hycred_pp_cert.json new file mode 100644 index 0000000..fcc5433 --- /dev/null +++ b/evidence/hycred_pp_cert.json @@ -0,0 +1 @@ +{"p1": "01040035303038140001a0389eef670000389eef67000000000000000028003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a00469c0c8de6126519e9fe14cc34c908f32bb6e41db93f62c40c8cc806d03d08aeaa5554afa9b0a539875ad7920ea095dd210a2439428d962b40126fc723e777342ba3c58507bd5369e597e4a04c48d580cc1e6cd03a47415e91b562637742446f3a989a8c6464e2e45db4b949464773d1", "cert_hex": "0c208d60b6dab6c2d064acb305941347495a8cc61895fe1ad0104cf808656c93d5952cbaa481870772fe2a4df9a94fdb8a0e41312514470c77cbfa586558f87309be9ed66e896f0b46f990dd1db3824813b4409d86ee67d27d43228cdd3b0799e1836a02a37ecd738c16185a10a30f118f3eab361dd1b3181fedf7475e8bf08bead17991f9eb8e0b80101edce6d907ad18cac76ed625e3d1265922d51cbca5943b45cc73902e032e97e59bb95c9d3bffca924cf75b7edb5d416785ae584a545b8c43", "cred_hex": "0a00469c0c8de6126519e9fe14cc34c908f32bb6e41db93f62c40c8cc806d03d08aeaa5554afa9b0a539875ad7920ea095dd210a2439428d962b40126fc723e777342ba3c58507bd5369e597e4a04c48d580cc1e6cd03a47415e91b562637742446f3a989a8c6464e2e45db4b949464773d1"} \ No newline at end of file diff --git a/evidence/hycred_stored_cert.json b/evidence/hycred_stored_cert.json new file mode 100644 index 0000000..91cb9c3 --- /dev/null +++ b/evidence/hycred_stored_cert.json @@ -0,0 +1 @@ +{"p1": "01040035303038140001a0389cc2250000389cc225000000000000000028003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a808e09a2e5608424bd688424632801ebac39dd611376320e9ed2344ce7cbc18de5bcda6b95d115068155dbf5049292f51e6ffd7ace0cb142529e8f408dc4cd071fa80b783f53689a7859af47aa7cb5b817ca730a3b1e110a4d5f99bc5b34f7ca066a8cb7b48c792db29b722ab00364b49c", "cert_hex": "0c20c2e236fe8fb79392d1736affdc382200289c3ff342cc568c667a760cf5499d0c2cbaa481870772fe2a4df9a94fdb8a0e41312514470c77cbfa586558f87309be579c689d1ee8898e16cc0292014ccb6db32a6b5b00b6c8056d8548ff248bcaff3d039c11b71dd22ccfe2ac7b130055e9eba29b86019c5da0b5c71b7f51a882f6c626099601539b2d53170f1aa799dbf9a932911ac7f9f9e082c380f060afd80eb9ee8c2ffcb54dc9b56d265192cce497751cf1dc22d6d5fee107d7dcc6b660f2", "cred_hex": "0a808e09a2e5608424bd688424632801ebac39dd611376320e9ed2344ce7cbc18de5bcda6b95d115068155dbf5049292f51e6ffd7ace0cb142529e8f408dc4cd071fa80b783f53689a7859af47aa7cb5b817ca730a3b1e110a4d5f99bc5b34f7ca066a8cb7b48c792db29b722ab00364b49c"} \ No newline at end of file diff --git a/evidence/wfextrace.json b/evidence/wfextrace.json new file mode 100644 index 0000000..0d31a83 --- /dev/null +++ b/evidence/wfextrace.json @@ -0,0 +1 @@ +[{"type": "armed"}, {"type": "wfex", "off": 2433620, "name": "credAnonymous", "len": -1, "v": ""}, {"type": "wfex", "off": 2433952, "name": "credAnonymous", "len": 27, "v": "487579615564623139323833373436353071776572747975696f70"}, {"type": "wfex", "off": 2433620, "name": "cred0", "len": -1, "v": ""}, {"type": "wfex", "off": 2433952, "name": "cred0", "len": 27, "v": "487579615564623139323833373436353071776572747975696f70"}, {"type": "wfex", "off": 2433620, "name": "UDB_SHAREAPP_DATA", "len": 58, "v": "39756e2f665054634a7155385559366b6c706f45314d636a5878563678484e3362394d335653736c746e6f6334763376346c37716e384e796572"}, {"type": "wfex", "off": 2433952, "name": "UDB_SHAREAPP_DATA", "len": 27, "v": "487579615564623139323833373436353071776572747975696f70"}] \ No newline at end of file diff --git a/scripts/hook_wfex.py b/scripts/hook_wfex.py new file mode 100644 index 0000000..c9feb07 --- /dev/null +++ b/scripts/hook_wfex.py @@ -0,0 +1,98 @@ +#!/usr/bin/env python3 +"""抓 hyCred 签发链: 挂 saveLoginData(落盘) + LoginCred handler(vtable探测)。 + +用法: 脚本跑起来后, 在手机上 手动退出登录 -> 重新登录 一次。 +捕获: 登录态JSON明文(含cred字段) / saveLoginData 入参 / LoginCred handler 触发。 +""" +from __future__ import annotations + +import json +import subprocess +import time +from pathlib import Path + +import frida + +RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0") + +JS = r"""var base = Process.getModuleByName('libudbauthunify.so').base; +send({type:'armed'}); +function hx(p,n){ try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(x=>('0'+x.toString(16)).slice(-2)).join(''); }catch(e){ return 'ERR'; } } +function rdStr(p){ try{ + var b0=p.readU8(); + if((b0&1)===0){ var l=b0>>1; return {len:l,v:l?hx(p.add(1),Math.min(l,4096)):''}; } + var len=parseInt(p.add(8).readU64().toString()); + if(len>65536) return {len:len,v:''}; + return {len:len,v:hx(p.add(16).readPointer(),Math.min(len,8192))}; +}catch(e){ return {len:-1,v:''}; } } +function rdC(p){ try{ var t=p.readCString(); return t&&t.length<8000?t.slice(0,6000):''; }catch(e){ return ''; } } +// writeFileEx(name, content, out&) 两个重载 +[0x252254,0x2523a0].forEach(function(off){ + Interceptor.attach(base.add(off), { + onEnter: function(a){ + var nm=rdC(a[1]); + var c=rdStr(a[3]); + send({type:'wfex', off:off, name:nm.slice(0,60), + len:c.len, v:c.v}); + } + }); +}); +""" + + +def main(): + d = frida.get_device_manager().add_remote_device('127.0.0.1:31877') + pid = d.spawn(['com.duowan.kiwi']) + s = d.attach(pid) + s.create_script((RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()).load() + s.create_script((RE / "evidence/scripts/mask_frida_maps_only.js").read_text()).load() + d.resume(pid) + time.sleep(11) + s.create_script((RE / "evidence/scripts/patch_guard_block_termination.js").read_text()).load() + print('armed. >>> 请在手机上退出登录并重新登录 <<<') + + sc = s.create_script(JS) + events = [] + def on_msg(m, _): + if m.get('type') == 'error': + print('JS ERR:', str(m)[:200]); return + if m.get('type') != 'send': + return + p = m.get('payload') or {} + t = p.get('type') + events.append(p) + Path('/Users/yml/codes/douyu_login_py/evidence/wfextrace.json').write_text(json.dumps(events)) + if t == 'vt_attached': + print(f"[vt] {p['name']} slot{p['slot']} @+{p['fp']}") + elif t == 'saveLD_str': + print(f"[saveLD_str] str={p['str']['t']}:{p['str']['len']}\n bean={p['bean_head']}\n bt={p['bt']}") + elif t == 'saveLD_bean': + print(f"[saveLD_bean] flag={p['flag']}\n bean={p['bean_head']}\n bt={p['bt']}") + elif t == 'cred_unpack': + print(f"[cred_unpack] in={p['in']['t']}:{p['in']['len']}:{p['in']['v'][:160]} <- {p['ra']}") + elif t == 'bigaes': + print(f"[bigaes] len={p['x2']['len']} head={p['x2']['v'][:120]}") + elif t == 'vtable': + print(f"[VT!] {p['name']}#{p['slot']} a1={p['a1']} bt={p['bt']}") + sc.on('message', on_msg) + sc.load() + deadline = time.time() + 300 + while time.time() < deadline: + time.sleep(3) + if any(e.get('type')=='bean' for e in events) and any(e.get('type')=='getcred' for e in events): + time.sleep(10) + break + Path('/Users/yml/codes/douyu_login_py/evidence/wfextrace.json').write_text(json.dumps(events)) + from collections import Counter + print('saved:', Counter(e.get('type') for e in events)) + + +if __name__ == '__main__': + for attempt in range(4): + try: + main() + break + except frida.InvalidOperationError as e: + print('detached:', e) + subprocess.run(['adb', 'shell', 'am', 'force-stop', 'com.duowan.kiwi']) + time.sleep(3) diff --git a/scripts/probe_forge_cert_bind.py b/scripts/probe_forge_cert_bind.py index ef45c4f..9bbda90 100644 --- a/scripts/probe_forge_cert_bind.py +++ b/scripts/probe_forge_cert_bind.py @@ -99,8 +99,8 @@ def main() -> int: # => 不校验时效。故铸造策略 = 保留原 nonce/指纹, 替换 cred 字段。 # 实验 C: 换上 frida_cred_dump 里更早签发的 hyCred(同账号不同轮换值)。 # 若 bind 成功 => 铸造机制完全打通(任意有效cred即可铸其证书)。 - old_cred = json.load(open("evidence/hycred_live.json")) - cred_old = bytes.fromhex(old_cred["bin_hex"]) + old_cred = json.load(open("evidence/hycred_pp_cert.json")) + cred_old = bytes.fromhex(old_cred["cred_hex"]) P1_new = build_p1(b"5008", fields["fingerprint"], cred_old, rnd=fields["rnd"]) # 原始 nonce assert P1_new != P1_old, "应与原P1不同"