yml2213
0c6aff6a6d
核心结论:
- 32hex hdid (WUP 登录帧 field1.tag0) = com.huya.security.hydeviceid.NativeEntry.getGUID()
- 金样本 ed0db8 为金样本设备 GUID; 当前真机 M2102J2SC getGUID()=0a7dfaa882938a6ab502511452142c57(稳定)
- NativeEntry 全字段: getGUID(32hex)/getCDID(40hex)/getHDID(40hex)/getMID(16hex)/getSDID(base64 safedeviceid)
- 单机不可铸造: 改 serialno/ANDROID_ID/删files/hydevice持久化 均不变(硬锚底层硬件)
- libhydeviceid.so 为 OLLVM+datadiv 壳; 用 dlopen->JNI_OnLoad->RegisterNatives(env表索引215) 绕开混淆
脚本: phone_probe_registernatives2(注册表)/phone_java_call_nativeentry(Java读getGUID)/phone_read_hdid(native hook)
phone_dump_hydev(dump解密so)/phone_probe_login_frame(登录帧)/arm64_disasm(反汇编)
证据: hdid_regtable/java_nativeentry/hdid_read/login_frames/hdid_probe* + libhydeviceid_{original,dump}.so
366 lines
7.1 KiB
JSON
366 lines
7.1 KiB
JSON
{
|
|
"events": [
|
|
{
|
|
"type": "hydev",
|
|
"base": "0x7813011000",
|
|
"size": 4124672
|
|
},
|
|
{
|
|
"type": "hydev-exports",
|
|
"count": 76,
|
|
"exports": [
|
|
{
|
|
"off": "0xff854",
|
|
"name": ".datadiv_decode13377393303060931696"
|
|
},
|
|
{
|
|
"off": "0x30bf3c",
|
|
"name": "hy_syscall"
|
|
},
|
|
{
|
|
"off": "0x2c671c",
|
|
"name": ".datadiv_decode8394649184240089179"
|
|
},
|
|
{
|
|
"off": "0xc452c",
|
|
"name": ".datadiv_decode12715880952929850959"
|
|
},
|
|
{
|
|
"off": "0x22c6b4",
|
|
"name": ".datadiv_decode17756744967214589151"
|
|
},
|
|
{
|
|
"off": "0x206530",
|
|
"name": ".datadiv_decode16142768320442664775"
|
|
},
|
|
{
|
|
"off": "0x10fe18",
|
|
"name": ".datadiv_decode13935584199325042899"
|
|
},
|
|
{
|
|
"off": "0x1c91dc",
|
|
"name": ".datadiv_decode4182082414496431548"
|
|
},
|
|
{
|
|
"off": "0x19b5f0",
|
|
"name": ".datadiv_decode14514111528646739931"
|
|
},
|
|
{
|
|
"off": "0x26d7b0",
|
|
"name": ".datadiv_decode3186372685042885857"
|
|
},
|
|
{
|
|
"off": "0x212b04",
|
|
"name": ".datadiv_decode13001096679939917798"
|
|
},
|
|
{
|
|
"off": "0xec484",
|
|
"name": ".datadiv_decode7272451282499632790"
|
|
},
|
|
{
|
|
"off": "0x2880fc",
|
|
"name": ".datadiv_decode5662830498276606612"
|
|
},
|
|
{
|
|
"off": "0x111490",
|
|
"name": ".datadiv_decode4441042267327943258"
|
|
},
|
|
{
|
|
"off": "0x27f610",
|
|
"name": ".datadiv_decode16021085630626535143"
|
|
},
|
|
{
|
|
"off": "0x30ae48",
|
|
"name": ".datadiv_decode17316226923494143690"
|
|
},
|
|
{
|
|
"off": "0x1d5f4c",
|
|
"name": ".datadiv_decode7531359686248698545"
|
|
},
|
|
{
|
|
"off": "0x247144",
|
|
"name": ".datadiv_decode17780086335141721104"
|
|
},
|
|
{
|
|
"off": "0x1adfd0",
|
|
"name": ".datadiv_decode16904853521236949932"
|
|
},
|
|
{
|
|
"off": "0xf013c",
|
|
"name": ".datadiv_decode3639556092286127407"
|
|
},
|
|
{
|
|
"off": "0x21f98c",
|
|
"name": ".datadiv_decode8476215815990549556"
|
|
},
|
|
{
|
|
"off": "0x30bf00",
|
|
"name": "hy_write"
|
|
},
|
|
{
|
|
"off": "0xea848",
|
|
"name": ".datadiv_decode5013095055348382358"
|
|
},
|
|
{
|
|
"off": "0x2bf894",
|
|
"name": ".datadiv_decode6552120278544488220"
|
|
},
|
|
{
|
|
"off": "0x245be0",
|
|
"name": ".datadiv_decode16449743662515666302"
|
|
},
|
|
{
|
|
"off": "0x11b930",
|
|
"name": ".datadiv_decode15631854437821104344"
|
|
},
|
|
{
|
|
"off": "0xe7a5c",
|
|
"name": ".datadiv_decode15220286527488363869"
|
|
},
|
|
{
|
|
"off": "0x189ed0",
|
|
"name": ".datadiv_decode971716066137475299"
|
|
},
|
|
{
|
|
"off": "0x235fd4",
|
|
"name": ".datadiv_decode2240554284615242758"
|
|
},
|
|
{
|
|
"off": "0xbbf90",
|
|
"name": ".datadiv_decode930153296716187306"
|
|
},
|
|
{
|
|
"off": "0x17f75c",
|
|
"name": ".datadiv_decode18193155687921697907"
|
|
},
|
|
{
|
|
"off": "0xef9c4",
|
|
"name": ".datadiv_decode7208817035916333614"
|
|
},
|
|
{
|
|
"off": "0x22c4c8",
|
|
"name": "JNI_OnLoad"
|
|
},
|
|
{
|
|
"off": "0xbdb4c",
|
|
"name": ".datadiv_decode9718679232209877219"
|
|
},
|
|
{
|
|
"off": "0x9f9d8",
|
|
"name": ".datadiv_decode2415276826024734045"
|
|
},
|
|
{
|
|
"off": "0xf3360",
|
|
"name": "hyftell"
|
|
},
|
|
{
|
|
"off": "0x242918",
|
|
"name": ".datadiv_decode1813700997626276425"
|
|
},
|
|
{
|
|
"off": "0x116020",
|
|
"name": ".datadiv_decode2127118722610622943"
|
|
},
|
|
{
|
|
"off": "0xf80c8",
|
|
"name": ".datadiv_decode6313363124510466600"
|
|
},
|
|
{
|
|
"off": "0x1d4e54",
|
|
"name": ".datadiv_decode16229027793617600142"
|
|
},
|
|
{
|
|
"off": "0x1d0580",
|
|
"name": ".datadiv_decode10115291355877817959"
|
|
},
|
|
{
|
|
"off": "0x30bae8",
|
|
"name": ".datadiv_decode10203504059392997873"
|
|
},
|
|
{
|
|
"off": "0xf1298",
|
|
"name": "hyfopen64"
|
|
},
|
|
{
|
|
"off": "0x2c321c",
|
|
"name": ".datadiv_decode15986889750731987093"
|
|
},
|
|
{
|
|
"off": "0x23e338",
|
|
"name": ".datadiv_decode11861954481925470588"
|
|
},
|
|
{
|
|
"off": "0x2fae08",
|
|
"name": ".datadiv_decode13370067802168070091"
|
|
},
|
|
{
|
|
"off": "0x2332d4",
|
|
"name": ".datadiv_decode5223443461034991902"
|
|
},
|
|
{
|
|
"off": "0x30bef0",
|
|
"name": "hy_read"
|
|
},
|
|
{
|
|
"off": "0x2ccc64",
|
|
"name": ".datadiv_decode8208694899043494479"
|
|
},
|
|
{
|
|
"off": "0x227b50",
|
|
"name": ".datadiv_decode18104751532030584008"
|
|
},
|
|
{
|
|
"off": "0x278c40",
|
|
"name": ".datadiv_decode8389934691053754807"
|
|
},
|
|
{
|
|
"off": "0x274bbc",
|
|
"name": ".datadiv_decode381523612705756801"
|
|
},
|
|
{
|
|
"off": "0x10923c",
|
|
"name": ".datadiv_decode11326397958007879543"
|
|
},
|
|
{
|
|
"off": "0x22ed90",
|
|
"name": ".datadiv_decode15748246807707687162"
|
|
},
|
|
{
|
|
"off": "0x307350",
|
|
"name": ".datadiv_decode14652163487098383068"
|
|
},
|
|
{
|
|
"off": "0x2823e0",
|
|
"name": ".datadiv_decode10168130846246250133"
|
|
},
|
|
{
|
|
"off": "0xfe1f4",
|
|
"name": ".datadiv_decode8274439441013259658"
|
|
},
|
|
{
|
|
"off": "0xb5a18",
|
|
"name": ".datadiv_decode2818691867109853035"
|
|
},
|
|
{
|
|
"off": "0x284a38",
|
|
"name": ".datadiv_decode17937343329166821664"
|
|
},
|
|
{
|
|
"off": "0x23755c",
|
|
"name": ".datadiv_decode8740858567082904038"
|
|
},
|
|
{
|
|
"off": "0xe1968",
|
|
"name": ".datadiv_decode15148178244621190089"
|
|
},
|
|
{
|
|
"off": "0x1094ec",
|
|
"name": ".datadiv_decode10096756759899255764"
|
|
},
|
|
{
|
|
"off": "0x2c2b28",
|
|
"name": ".datadiv_decode5687050107175613243"
|
|
},
|
|
{
|
|
"off": "0x1e4048",
|
|
"name": ".datadiv_decode10091502229593795971"
|
|
},
|
|
{
|
|
"off": "0x1107c8",
|
|
"name": ".datadiv_decode16105350321006291378"
|
|
},
|
|
{
|
|
"off": "0xf0078",
|
|
"name": ".datadiv_decode13805690131605262795"
|
|
},
|
|
{
|
|
"off": "0x308e64",
|
|
"name": ".datadiv_decode13481575639147657934"
|
|
},
|
|
{
|
|
"off": "0x25df2c",
|
|
"name": ".datadiv_decode5869377321246282402"
|
|
},
|
|
{
|
|
"off": "0xec6d8",
|
|
"name": ".datadiv_decode5215474294857803928"
|
|
},
|
|
{
|
|
"off": "0x23c534",
|
|
"name": ".datadiv_decode15714924883407080113"
|
|
},
|
|
{
|
|
"off": "0x27fc5c",
|
|
"name": ".datadiv_decode16454361570808326355"
|
|
},
|
|
{
|
|
"off": "0x27df10",
|
|
"name": ".datadiv_decode15924187094028544261"
|
|
},
|
|
{
|
|
"off": "0x23532c",
|
|
"name": ".datadiv_decode4448295952963935447"
|
|
},
|
|
{
|
|
"off": "0x141914",
|
|
"name": ".datadiv_decode5332962653989896249"
|
|
},
|
|
{
|
|
"off": "0x1106a8",
|
|
"name": ".datadiv_decode7627883646358325318"
|
|
},
|
|
{
|
|
"off": "0x2c80ac",
|
|
"name": ".datadiv_decode10053382265862873780"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": "jni-onload-hooked"
|
|
},
|
|
{
|
|
"type": "jni-onload-enter",
|
|
"tid": 27101
|
|
},
|
|
{
|
|
"type": "jni-onload-leave",
|
|
"ret": "0x10006"
|
|
},
|
|
{
|
|
"type": "udb",
|
|
"base": "0x77bf3d4000"
|
|
},
|
|
{
|
|
"type": "hdid-hooked"
|
|
},
|
|
{
|
|
"type": "setsd-hooked"
|
|
},
|
|
{
|
|
"type": "hdid",
|
|
"str": "",
|
|
"tid": 27267
|
|
},
|
|
{
|
|
"type": "hdid",
|
|
"str": "",
|
|
"tid": 27267
|
|
},
|
|
{
|
|
"type": "hdid",
|
|
"str": "",
|
|
"tid": 27267
|
|
},
|
|
{
|
|
"type": "hdid",
|
|
"str": "",
|
|
"tid": 27101
|
|
},
|
|
{
|
|
"type": "hdid",
|
|
"str": "",
|
|
"tid": 27101
|
|
}
|
|
],
|
|
"detached": []
|
|
} |