yml2213
97e6d14139
动态hook实锤(scripts/hook_nonce_chain.py): rnd = XXTEA(pack(st) + pack(counter|st<<16), key=MD5hex(uid_str + k1)[:16]) - st=毫秒时间戳, counter同st内递增 - k1=设备常量865a4924...(不随账号变, evidence/nonce_k1.json) - Python复刻(tools/nonce_forge.py)对设备两轮rnd逐字节MATCH 推翻v2误判(X2'nonce账号绑定令牌'实为nonce内编码uid): - 换账号用目标uid重算nonce而非复用旧nonce! - 纯随机nonce必40020因解不出合法st/counter结构 实测: 同账号+跨账号(hy_300024708从未设备登录)本地nonce铸证bind均通过, full_web_cookie/full_auto_safe 任意账号密码->全套cookie(udb_cred/udb_biztoken)
8 lines
383 B
JSON
8 lines
383 B
JSON
{
|
|
"k1": "865a4924a40897ac1fcfe6b4c2cbb0e3",
|
|
"source": "BusinessCfg::this+0x10, 动态hook自真机(scripts/hook_nonce_chain.py)",
|
|
"account_independent": true,
|
|
"note": "跨账号不变(uid 1199666914671 vs 1199666911746 均同值); 设备级常量, 一次采集永久可用",
|
|
"usage": "tools/nonce_forge.py gen_nonce(uid, k1) 本地重算20B nonce, 任意账号可铸证"
|
|
}
|