yml/live-hub-py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(huya): md5_char16=MD5-hex中段16识别(非32hex本体) + 探针全家桶(encode_aes/md5/xxtea/otp可调)

Browse Source
This commit is contained in:
yml2213
2026-08-29 00:10:41 +08:00
parent bc9d827a60
commit ebdbd05217
2 changed files with 67 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/unidbg/hydev/src/hydev/AesProbe.java
+50 -2
View File
@@ -117,6 +117,45 @@ public class AesProbe {
return out;
}
String callMd5Char16(String in) {
UnidbgPointer pin = writeStdString(in);
UnidbgPointer pout = writeStdString("");
Number r = module.callFunction(emulator, 0x32e71cL, UnidbgPointer.nativeValue(pout), UnidbgPointer.nativeValue(pin));
String out = readStdString(pout);
System.out.println("[md5_char16] in=" + in + " -> " + out + " hex=" + toHex(out));
return out;
}
String callXxtea(String in, String key) {
UnidbgPointer pin = writeStdString(in);
UnidbgPointer pkey = writeStdString(key);
UnidbgPointer pout = writeStdString("");
Number r = module.callFunction(emulator, 0x32e83cL, UnidbgPointer.nativeValue(pout), UnidbgPointer.nativeValue(pin), UnidbgPointer.nativeValue(pkey));
String out = readStdString(pout);
System.out.println("[xxtea] in=" + in + " key=" + key + " -> hex=" + toHex(out));
return out;
}
String callOtp(String a, String b) {
UnidbgPointer pa = writeStdString(a);
UnidbgPointer pb = writeStdString(b);
UnidbgPointer pc = writeStdString("k");
UnidbgPointer pd = writeStdString("ivx");
UnidbgPointer pout = writeStdString("");
// 尝试 4 位置: arg0=in, arg1=?, arg2=?, arg3=key, arg4=?, arg5=?, arg6=h, arg7=m, arg8=out
try {
Number r = module.callFunction(emulator, 0x32fa24L,
UnidbgPointer.nativeValue(pa), 1L, 2L,
UnidbgPointer.nativeValue(pb), UnidbgPointer.nativeValue(pc), UnidbgPointer.nativeValue(pd),
3L, 4L, UnidbgPointer.nativeValue(pout));
String out = readStdString(pout);
System.out.println("[otp] a=" + a + " b=" + b + " -> hex=" + toHex(out));
} catch (Throwable t) {
System.out.println("[otp] err " + t);
}
return "";
}
static String toHex(String s) {
StringBuilder sb = new StringBuilder();
for (byte b : s.getBytes(java.nio.charset.StandardCharsets.ISO_8859_1)) sb.append(String.format("%02x", b));
@@ -135,8 +174,17 @@ public class AesProbe {
p.callEncodeAes("0123456789abcdef", k64_zmhav);
p.callEncodeAes("0123456789abcdef", k64_ow);
p.callEncodeAes("0123456789abcdef", k64_cfg0);
p.callEncodeAes("1e8bdf7d4f7a01d3", k64_zmhav);
p.callEncodeAes("1e8bdf7d4f7a01d3", k64_cfg0);
// md5_char16@0x32e71c (out&, in&) -- 32hex 形态验证
p.callMd5Char16("0123456789");
p.callMd5Char16("ZMHAVPRaxJ3MtXDjduUnXAKQ");
p.callMd5Char16("1e8bdf7d4f7a01d3");
p.callMd5Char16("");
// xxtea_encrypt@0x32e83c (out&, in&, key&)
p.callXxtea("0123456789abcdef", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
// hyudb_otp_encrypt@0x32fa24 (string, h,h, string,string,string, h,m, string&)
p.callOtp("abc", "ZMHAVPRaxJ3MtXDjduUnXAKQ");
p.callOtp("1e8bdf7d4f7a01d3", "KFWAH2cbkkNgFAgQPzriFPcU");
p.emulator.close();
p.emulator.close();
}
}