yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(huya): OTP-OUT内容捕获成功!结构=[04][cnt][16B mid][16B tail] - 差分闭环就绪

Browse Source
This commit is contained in:
yml2213
2026-08-29 02:48:48 +08:00
parent d714249e24
commit dd883c02d8
2 changed files with 34 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/HUYA_HDID_ALGORITHM_GEN.md
+9
View File
@@ -858,3 +858,12 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a
- BusinessCfg 诸符号: load/saveLoginData/getLoginData@0x26984c etc. (+0x10/+0x40 = 登录数据字段源)
- 注入 +0x10/+0x40 (name/sha1) 后 getOtp 流程 269280-2692a4 段 = 新 UC_ERR_READ_UNMAPPED (s4 拷贝路径)
→ 实例字段注入 = SSO 布局细节需修 (s4 拷贝读 [x8+0x10+0x10] cap 越界?)
## §11.37 🎯 OTP-OUT 内容捕获成功! (R11c)
### getOtp 内部 OTP 输出完整读取:
content=0401 7c0e461e8c52e9360e90b5af264af667 0f127c3af8c69c3428ef3d1e9b7a8618 (34B)
结构 = [04=ver][cnt=1][16B mid][16B tail]
- libc++ 长串对象: [0-7]cap [8-15]size [16-23]ptr → 内容读取法定案
- SSO-only 注入 (s3=s4="hy_300023887") 后 getOtp 全流程 985 hooks 无错误!
### mid = f(in, cnt, s3, s4, s5) (s5 也入 mid!) — 差分闭环就绪
### 下步: 全组合爆破 (in/cnt/s3/s4/s5 候选族) → mid == ed0db8