From e5aee00a9c11f84f3ace5d66b096cd6bb8524d97 Mon Sep 17 00:00:00 2001 From: yml2213 Date: Fri, 28 Aug 2026 23:27:36 +0800 Subject: [PATCH] =?UTF-8?q?feat(huya):=20jadx=E6=98=A0=E5=B0=84HDID32=20Ja?= =?UTF-8?q?va=E9=93=BE(NativeEntry.getHDID@0x20f0c8)=20+=20b()=E5=85=A8?= =?UTF-8?q?=E8=AF=AD=E4=B9=89=E8=A1=A8=20+=20=E7=AD=BE=E5=90=8D=E9=94=9A?= =?UTF-8?q?=E5=AE=9A=E5=AE=9E=E9=AA=8C(=E4=BB=85HDID32=E9=94=9A,DEVID40?= =?UTF-8?q?=E8=87=AA=E7=94=B1)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - b(1)=5008/b(2)=ver/b(3)=1.14.68/b(107/108)=qimei → unidbg 桩补全 - 实验: 金样本hdid+随机DEVID40=1571B cred / 换hdid恒APP_SIGN - docs §11.12 --- docs/HUYA_HDID_ALGORITHM_GEN.md | 26 ++++++++++++++++++ .../mint/login_pair_golden_hdid_control.bin | Bin 0 -> 1571 bytes tools/unidbg/hydev/src/hydev/HyDeviceId.java | 6 ++++ 3 files changed, 32 insertions(+) create mode 100644 evidence/mint/login_pair_golden_hdid_control.bin diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md index 36bbc72..f7c6ec0 100644 --- a/docs/HUYA_HDID_ALGORITHM_GEN.md +++ b/docs/HUYA_HDID_ALGORITHM_GEN.md @@ -478,3 +478,29 @@ mid = LiveUserbase→tUAEx→t5=sMId (16hex)，**可任意铸造** → doLaunch 1. libhydeviceid 内定位 32hex-hdid 生成函数 (unidbg 枚举 32hex 返回的导出/偏移) 2. 若存在: 输入=?(androidId/config/MID 模型已有) → 铸币设备独立 hdid → 登录 3. 若不存在: 登录 hdid = 设备级私钥证书, 纯代码不可达 → 每账号独立设备需真机/模拟器池 + +## §11.12 Java 侧 HDID32 链全映射 + 签名锚定实验 (2026-08-28 夜) + +### Java 调用链 (jadx classes5.dex 实证) +``` +HuyaAuth.initSDID() (com/huyaudbunify/HuyaAuth.java:1261) + ├─ sdid = dj3.getSDID() → HyDeviceProxy.g() → NativeEntry.getSDID() ← ACTION(注册链t2) + └─ hdid = dj3.getHDID() → HyDeviceProxy.e() → NativeEntry.getHDID() ← native getHDID@0x20f0c8 + (setSafeDeviceId(sdid, hdid) → WUP 帧绑定) +NativeBridge.b(i) 语义全表 (b→fj3.c): + 1=APPID(5008) 2=versionName(13.4.22) 3=SDK版本(1.14.68) 5=安装时间json + 100=GUID 101/102=MID(ANDROID_ID) 104/105=空 106=64hex + 107=qimei16 108=qimei36 300/303/304=... +``` +- 登录帧 t1.t0(HDID32) 的 JAVA 源头 = NativeEntry.getHDID() (registerNative@0x20f0c8)。 +- unidbg 收集器 b(3)=SDK版本 已补桩 (此前 null 导致收集不完整), 但 getter 仍读缓存 + (GUID/HDID 均为缓存读, 缓存由 JAVA 侧 doLaunch/注册链回填) —— 下步: 仿真 JAVA 回填序。 + +### 签名锚定实验 (金样本账号, 逐变量) +| 变量 | hdid(t1.t0) | device_id(t2.t8) | 结果 | +|---|---|---|---| +| 全金样本 | ed0db8334cadd236c00cadf7e11ab5a5 | 7c5387e0…(40hex) | ✅ 1571B cred | +| 换 device_id | ed0db8… | **deadbeef…(随机40hex)** | ✅ **1571B cred** | +| 换 hdid | **0a7dfa…(手机当前GUID32)** | 7c5387e0… | ❌ APP_SIGN_NOT_MATCH | +| 换 hdid | **0a7d91…(铸币sGuid)** | 7c5387e0… | ❌ APP_SIGN_NOT_MATCH | +**定论: 登录 APP_SIGN 唯一锚 = HDID32(t1.t0); DEVID40 自由; GUID32(铸币)≠登录证书体系。** diff --git a/evidence/mint/login_pair_golden_hdid_control.bin b/evidence/mint/login_pair_golden_hdid_control.bin new file mode 100644 index 0000000000000000000000000000000000000000..96d194149b6e14e6532d6c5d52dba362ae259317 GIT binary patch literal 1571 zcmd^9{cjUx9KUv3$6j#bWhLT5wT}yl2*0tT%7trq7Uf`wh#-)`KrqpWlPNC?kU?N$W*dnI`V0OGKEFJ9o;=^r z=kt8OpL_s7Ft0dE1Ou&A0KEHgQ=x}Vk*w36pzN&IRpd#9Nrp+#QD+V9_J&#jUe47i zK$ZX~0{~v3AkUUy!!{=wBg+6@_Nn}QfG5m?7eVFyt3j@gc6iB{mkw#1U?m3QhzNAC zAx9kKhU5EbVq463|7J-(90D_ARHBe48<@U0$7QNrLYXgxtkdE&m$)04FsOc z0xMl)fT2WSEJ`}4XKWy3$6OGOxm+>{DYZKt6=Fn!A{Dp<#SjcZPz;sgQWzCWq%g-E zONBW}oIds$GsNu-6;;ro7?q51U|`Eq72x20+@=0`axe}Q%+BHtv-Bq@dIkW@1!nFX zE-Nqeq-+QTL1F~M&}9G+&2Meny<%SJcl}LT`6>x~Y+;{E%(VsHi1s_Zf7(VMC&S~Co zwPg{mzjkKT!9o6e>Q~Nfy}fXHYOwyJS(^u2cNHz~`rw-U>#<{NR&Dxp!`&@>PqTl) zcr@KRVUjLR)@3$M3C1rkS#$G~Lth{_+)q5NB`oI4n=lx0N zNP$%_6^3zKCX?Z?M25n`7us0<%uFcPYqMN0*ZajmL`M_hCZ*fR=#rGDk&vl0YP$p# zSFl=!tcs+xRD?jS@qnq;P^C4+tWJ5Irorc^G8*EkFj|{%27|I-T-oRfR1>Jr5Yfvu zI@(;3Hd_e0%c%2)RR*O4XCqp;R)gBC1OZt*VcdoKoEERjV3nDjm?G*_C}TB}xLHPc zHLOOPwyC{xR_amu{XP%ov(VZ|QXx~BHC|VfMh=riES*S4tPwgCZ_q~7eiEhX6^xzK zHP%Ox^%{t(GbvCbg!pNP&ZHzlh@PPXF|&ciA_UtYu5H8;=?Y7eqgrZ#0wFVr)p)H| zL}8Na8bVH~HBhHf8cce%6j7UM!je$h9ZD(^Ze6us8=`|@e}hGf>0w;0tO+~3>Z%0n zkN8-^UhS?`s%Vpn2N$@eLJ++0`9h^)N&CM>zuwuE_XY19z!T)L4jU6AV-zFg!B>H7 z04VJ(HQwMqDSBaAPl|yj(|`iJu$D95m;75Fe|u>?|DJOdwASTbvatEJBW)#mPAbX;8Zh*K$+M2_h5NZVPd92-)X8gXMx~)iqfpum$_611`WvCDGB5xD literal 0 HcmV?d00001 diff --git a/tools/unidbg/hydev/src/hydev/HyDeviceId.java b/tools/unidbg/hydev/src/hydev/HyDeviceId.java index d61b386..f1412ca 100644 --- a/tools/unidbg/hydev/src/hydev/HyDeviceId.java +++ b/tools/unidbg/hydev/src/hydev/HyDeviceId.java @@ -140,11 +140,17 @@ public class HyDeviceId extends AbstractJni { System.out.println("[JNI] NativeBridge.b FALLBACK-STUB (native not registered?)"); int i = vaList.getIntArg(0); // 真机实测值 (2026-08-28): 100=GUID 101= MID 102= MID 106=64hex, 99/103=null, 104/105="" + // b()-语义来自 jadx (NativeBridge.b -> fj3.c): 1=APPID(5008) 2=versionName 3=SDK版本(1.14.68) + // 102=l5h.a=ANDROID_ID 104=l5h.f 105=pnc.f 106=l5h.i 107=qimei16 108=qimei36 String v = null; if (i == 100) v = "0a7dfaa882938a6ab502511452142c57"; else if (i == 101 || i == 102) v = "1e8bdf7d4f7a01d3"; else if (i == 106) v = "a71a0917ab6d0d6a61947a007591cfb97290f88972b047252c0ec7baddcd57df"; else if (i == 104 || i == 105) v = ""; + else if (i == 1) v = "5008"; + else if (i == 2) v = "13.4.22"; + else if (i == 3) v = "1.14.68"; + else if (i == 107 || i == 108) v = "67453f5aef55f776967c748a10001c318101"; System.out.println("[JNI] NativeBridge.b(" + i + ") -> " + v); return v == null ? null : new StringObject(vm, v); }