#!/usr/bin/env python3 """nonce链路动态hook —— 与静态反汇编互相验证。 抓取 getQUrlData 触发证书生成时的完整运行时实参链: nonce_next(m) -> 64位OTP计数 getServiceTime() -> 服务时间 hyudb_crypt_util::xxtea_encrypt(out, data, key) -> 20B rnd 的直接来源 enpack_header(h, key, out) -> cert 头 [0x0c][key_idx] enpack_body(h, a,b,c,d, out) -> P1 明文组装 gen_biz_token(struct, uid, k1, k2, out) -> 总装 encode_aes(p1, key, out) -> AES加密 getOtpEx(uid, idx, a3, out) -> 入口 目的: 拿到 xxtea 的 data/key 原文与输出, 验证 20B rnd 是否 = f(serviceTime, nonce, uid, 设备常量), 从而判定"信封nonce能否脱离设备本地复算"。 时序(不可变, 同 hook_cert_keycap): force-stop -> spawn挂起 -> 双bypass -> resume -> 10s -> patch_guard -> 装hook -> Java桥触发 getQUrlData。 """ from __future__ import annotations import json import subprocess import time from pathlib import Path import frida RE = Path("/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0") UID = 1199666914671 JS = r""" 'use strict'; Process.setExceptionHandler(function(d){ send({type:'segv', info:{type:d.type, addr:String(d.address)}}); return true; }); var base = Process.getModuleByName('libudbauthunify.so').base; send({type:'armed', base:String(base)}); function rdStr(p){ try{ var b0=p.readU8(); if((b0&1)===0){ var l=b0>>1; if(l>8192) return {t:'s?',len:l,v:''}; return {t:'s',len:l,v:l?Array.from(new Uint8Array(p.add(1).readByteArray(l))).map(x=>('0'+x.toString(16)).slice(-2)).join(''):''}; } var len=parseInt(p.add(8).readU64().toString()); if(len>65536) return {t:'l?',len:len,v:''}; var dp=p.add(16).readPointer(); return {t:'l',len:len,v:Array.from(new Uint8Array(dp.readByteArray(len))).map(x=>('0'+x.toString(16)).slice(-2)).join('')}; }catch(e){ return {t:'err',len:-1,v:String(e)}; } } function hx(p,n){ try{ return Array.from(new Uint8Array(p.readByteArray(n))).map(x=>('0'+x.toString(16)).slice(-2)).join(''); }catch(e){ return 'ERR'; } } function ascii(h){ if(!h) return ''; var s=''; for(var i=0;i=32&&c<127)?String.fromCharCode(c):'.'; } return s; } function bt(ctx){ return Thread.backtrace(ctx, Backtracer.ACCURATE).map(function(a){ return DebugSymbol.fromAddress(a).toString().slice(0,90); }).slice(0,5); } // ---------- 1) nonce_next(m) ---------- try { Interceptor.attach(base.add(0x32ff10), { onEnter: function(a){ this.m=a[0]; }, onLeave: function(r){ send({type:'nonce_next', m:'0x'+this.m.toString(16), ret:'0x'+r.toString(16)}); } }); } catch(e){ send({type:'hookerr',where:'nonce_next',msg:''+e}); } // ---------- 2) getServiceTime() ---------- try { Interceptor.attach(base.add(0x268070), { onLeave: function(r){ send({type:'service_time', v:'0x'+r.toString(16), dec:r.toString()}); } }); } catch(e){ send({type:'hookerr',where:'getServiceTime',msg:''+e}); } // ---------- 3) hyudb_crypt_util::xxtea_encrypt(out&, data, key) ---------- try { Interceptor.attach(base.add(0x32e83c), { onEnter: function(a){ this.out=a[0]; this.d=rdStr(a[1]); this.k=rdStr(a[2]); send({type:'xxtea_in', data:this.d, key:this.k, data_ascii:ascii(this.d.v), key_ascii:ascii(this.k.v)}); }, onLeave: function(r){ var o=rdStr(this.out); send({type:'xxtea_out', out:o, out_ascii:ascii(o.v)}); } }); } catch(e){ send({type:'hookerr',where:'xxtea_encrypt',msg:''+e}); } // ---------- 4) enpack_header(h, NEWKEY, out&) ---------- try { Interceptor.attach(base.add(0x32ff44), { onEnter: function(a){ this.out=a[2]; this.h=a[0]; this.k=a[1]; }, onLeave: function(r){ var o=rdStr(this.out); send({type:'enpack_header', h:'0x'+this.h.toInt32().toString(16), key:'0x'+this.k.toInt32().toString(16), out:o}); } }); } catch(e){ send({type:'hookerr',where:'enpack_header',msg:''+e}); } // ---------- 5) enpack_body(h, a,b,c,d, out&) ---------- try { Interceptor.attach(base.add(0x3300c8), { onEnter: function(a){ this.out=a[5]; this.h=a[0]; this.a=rdStr(a[1]); this.b=rdStr(a[2]); this.c=rdStr(a[3]); this.d=rdStr(a[4]); send({type:'enpack_body_in', h:'0x'+this.h.toInt32().toString(16), a:this.a, b:this.b, c:this.c, d:this.d, a_ascii:ascii(this.a.v).slice(0,80), c_ascii:ascii(this.c.v).slice(0,80)}); }, onLeave: function(r){ var o=rdStr(this.out); send({type:'enpack_body_out', out:o}); } }); } catch(e){ send({type:'hookerr',where:'enpack_body',msg:''+e}); } // ---------- 6) gen_biz_token(struct, uid, k1, k2, out&) ---------- try { Interceptor.attach(base.add(0x3307e4), { onEnter: function(a){ this.out=a[4]; // BIZTOKEN struct 前0x60字节: [0]=type [1]=key_idx [2]=1 [8..]=str1 [0x20]=st [0x28]=nonce [0x30]=str2 [0x48]=str3 send({type:'gbt_in', struct:hx(a[0],0x60), struct_ascii:ascii(hx(a[0],0x60)), uid:rdStr(a[1]), k1:rdStr(a[2]), k2:rdStr(a[3]), k1_ascii:ascii(rdStr(a[2]).v).slice(0,80), k2_ascii:ascii(rdStr(a[3]).v).slice(0,80)}); }, onLeave: function(r){ var o=rdStr(this.out); send({type:'gbt_out', out:o}); } }); } catch(e){ send({type:'hookerr',where:'gen_biz_token',msg:''+e}); } // ---------- 7) encode_aes(p1, key, out&) ---------- try { Interceptor.attach(base.add(0x330218), { onEnter: function(a){ this.out=a[2]; this.p1=rdStr(a[0]); this.key=rdStr(a[1]); }, onLeave: function(r){ var o=rdStr(this.out); send({type:'encode_aes', p1:this.p1, key:this.key, key_ascii:ascii(this.key.v).slice(0,60), out:o}); } }); } catch(e){ send({type:'hookerr',where:'encode_aes',msg:''+e}); } // ---------- 8) getOtpEx(uid, idx, a3, out&) ---------- try { Interceptor.attach(base.add(0x2681b4), { onEnter: function(a){ this.out=a[4]; this.uid=a[1]; this.idx=a[2]; this.a3=rdStr(a[3]); }, onLeave: function(r){ var o=rdStr(this.out); send({type:'getOtpEx', uid:'0x'+this.uid.toString(16), idx:this.idx.toInt32(), a3:this.a3, out:o}); } }); } catch(e){ send({type:'hookerr',where:'getOtpEx',msg:''+e}); } // ---------- 9) AESkeyMgr::getkey ---------- try { Interceptor.attach(base.add(0x454350), { onEnter: function(a){ this.a0=a[0]; this.i1=a[1]; this.i2=a[2]; }, onLeave: function(r){ // getkey 返回 std::string (sret in x8), 但 onLeave x8 不可靠; 读 x0 若为短串 try { var s=rdStr(this.a0.add(0)); if(s.len>0 && s.len<64) send({type:'getkey', i1:this.i1.toInt32(), i2:this.i2.toInt32(), key:s}); } catch(e){} } }); } catch(e){ send({type:'hookerr',where:'getkey',msg:''+e}); } // ---------- 触发 ---------- Java.perform(function(){ var n=0; function go(){ try{ var seed=Java.use('com.duowan.kiwi.base.login.udb.HuyaLoginProxy'); var F=Java.ClassFactory.get(seed.class.getClassLoader()); var inst=F.use('com.hysdkproxy.LoginProxy').getInstance(); send({type:'stage', msg:'call #1'}); var q1=inst.getQUrlData(__UID__, "", ""); send({type:'qurl_done', idx:1, len:q1?q1.length:0, data:q1||''}); var q2=inst.getQUrlData(__UID__, "", ""); send({type:'qurl_done', idx:2, len:q2?q2.length:0, data:q2||''}); }catch(e){ n+=1; if(n%4===0) send({type:'retry',n:n,err:String(e).slice(0,120)}); setTimeout(go,5000); } } setTimeout(go, 18000); }); """.replace('__UID__', str(UID)) def main(): d = frida.get_device_manager().add_remote_device('127.0.0.1:31877') pid = d.spawn(['com.duowan.kiwi']) print(f'spawned {pid}') s = d.attach(pid) s.create_script((RE / "evidence/scripts/bypass_msaoaid_maps_art_callsite.js").read_text()).load() s.create_script((RE / "evidence/scripts/mask_frida_maps_only.js").read_text()).load() d.resume(pid) print('resumed') time.sleep(11) s.create_script((RE / "evidence/scripts/patch_guard_block_termination.js").read_text()).load() print('patch_guard on') sc = s.create_script(JS) events = [] got_armed = [] def on_msg(m, _): if m.get('type') == 'error': print('JS ERR:', str(m)[:200]); return if m.get('type') != 'send': return p = m.get('payload') or {} t = p.get('type') if t != 'retry': events.append(p) if t == 'armed': got_armed.append(1); print('[armed]') elif t == 'nonce_next': print(f"[nonce_next] m={p['m']} ret={p['ret']}") elif t == 'service_time': print(f"[service_time] {p['v']} ({p['dec']})") elif t == 'xxtea_in': print(f"[xxtea.in] data len={p['data']['len']} {p['data']['v'][:40]}") print(f" key len={p['key']['len']} {p['key']['v'][:60]} ascii={p['key_ascii'][:50]}") elif t == 'xxtea_out': print(f"[xxtea.out] len={p['out']['len']} {p['out']['v'][:48]}") elif t == 'enpack_header': print(f"[enpack_header] h={p['h']} key={p['key']} out len={p['out']['len']} {p['out']['v'][:20]}") elif t == 'enpack_body_in': print(f"[enpack_body] h={p['h']}") print(f" a(len{p['a']['len']})={p['a']['v'][:60]} ascii={p['a_ascii']}") print(f" b(len{p['b']['len']})={p['b']['v'][:48]}") print(f" c(len{p['c']['len']})={p['c']['v'][:60]} ascii={p['c_ascii']}") print(f" d(len{p['d']['len']})={p['d']['v'][:24]}") elif t == 'enpack_body_out': print(f"[enpack_body.out] len={p['out']['len']} {p['out']['v'][:80]}") elif t == 'gbt_in': print(f"[gen_biz_token.in] struct={p['struct'][:100]}") print(f" uid(len{p['uid']['len']})={p['uid']['v'][:40]}") print(f" k1(len{p['k1']['len']})={p['k1']['v'][:60]} ascii={p['k1_ascii']}") print(f" k2(len{p['k2']['len']})={p['k2']['v'][:60]} ascii={p['k2_ascii']}") elif t == 'gbt_out': print(f"[gen_biz_token.out] len={p['out']['len']} {p['out']['v'][:60]}") elif t == 'encode_aes': print(f"[encode_aes] p1 len={p['p1']['len']} {p['p1']['v'][:70]}") print(f" key={p['key_ascii'][:50]} out len={p['out']['len']}") elif t == 'getOtpEx': print(f"[getOtpEx] uid={p['uid']} idx={p['idx']} a3(len{p['a3']['len']}) out len={p['out']['len']}") elif t == 'getkey': print(f"[getkey] i1={p['i1']} i2={p['i2']} key={p['key']['v'][:40]} ascii={ascii_short(p['key']['v'])}") elif t == 'qurl_done': print(f"[qurl#{p['idx']}] len={p['len']} head={(p.get('data') or '')[:40]}") elif t == 'stage': print('[stage]', p['msg']) def ascii_short(h): s = '' for i in range(0, len(h), 2): c = int(h[i:i+2], 16) s += chr(c) if 32 <= c < 127 else '.' return s[:40] sc.on('message', on_msg) sc.load() assert got_armed deadline = time.time() + 120 while time.time() < deadline: time.sleep(2) if sum(1 for e in events if e.get('type') == 'qurl_done') >= 2: time.sleep(5) break Path('/tmp/opencode/nonce_chain.json').write_text(json.dumps(events)) from collections import Counter print('saved:', Counter(e.get('type') for e in events)) if __name__ == '__main__': for attempt in range(3): print(f'===== 尝试 #{attempt+1} =====') try: main() break except frida.InvalidOperationError as e: print(f'session detached: {e}') subprocess.run(['adb', 'shell', 'am', 'force-stop', 'com.duowan.kiwi']) time.sleep(3) except Exception as e: print(f'err: {e}') subprocess.run(['adb', 'shell', 'am', 'force-stop', 'com.duowan.kiwi']) time.sleep(3)