yml2213
9aed5847dd
- 实验C: 原nonce+原指纹+旧轮换hyCred -> 全新密文证书 -> bind stage=2 uid=1199666914671 + 344B biztoken - 证明: 服务端校验nonce合法性但不校验时效; 身份完全由cert内cred决定 - gen_biz_token trace: enum=0x78, 入参(uid串,sessHex32), xxtea明文16B=[t][t<<16]结构, enpack_body组装P1顺序实锤 - => 拿到任意账号有效hyCred(114B)即可铸其证书
1 line
2.0 KiB
JSON
1 line
2.0 KiB
JSON
[{"type": "armed", "base": "0x7881c19000"}, {"type": "hdr", "h": 12, "newkey": {"t": "err", "len": -1, "v": "Error: access violation accessing 0x20"}, "r": "0x7881f49850 libudbauthunify.so!_Z13gen_biz_token8BIZTOKENRKNSt6__ndk112basic_st"}, {"type": "xxtea", "r": "0x7881f4997c libudbauthunify.so!_Z13gen_biz_token8BIZTOKENRKNSt6__ndk112basic_st", "out_len": 0, "inp": {"t": "s", "len": 16, "v": "03b9d337a0010000000003b9d337a001"}, "key": {"t": "l", "len": 45, "v": "313139393636363931343637313836356134393234613430383937616331666366653662346332636262306533"}}, {"type": "body", "h": 1, "p1": {"t": "s", "len": 4, "v": "35303038"}, "p2": {"t": "s", "len": 20, "v": "debc950d5e36bb6ea9db12e81fa2a76fb66a12ae"}, "p3": {"t": "l", "len": 40, "v": "30326466333938373937343332656164656663633132373637313139616435653830393939333839"}, "p4": {"t": "l", "len": 114, "v": "0a803f868f615aaf55b3ec701133b66e71b039a0d65a195af4dafe86f783bb5cd0616c5628078f8e1ea2f5320de1c70af8d1b5004b6d4369e9dd0354a240c954a91c32cb2682299ac61e908c822f7f59e1f3118342c3cb021415f68c9a1a57e70f04f00b05d5f9d9ca3d484ac74cd13668cf"}, "r": "0x7881f49a44 libudbauthunify.so!_Z13gen_biz_token8BIZTOKENRKNSt6__ndk112basic_st"}, {"type": "encode_aes", "p0": {"t": "l", "len": 187, "v": "010400353030381400debc950d5e36bb6ea9db12e81fa2a76fb66a12ae28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a803f868f615aaf55b3ec701133b66e71b039a0d65a195af4dafe86f783bb5cd0616c5628078f8e1ea2f5320de1c70af8d1b5004b6d4369e9dd0354a240c954a91c32cb2682299ac61e908c822f7f59e1f3118342c3cb021415f68c9a1a57e70f04f00b05d5f9d9ca3d484ac74cd13668cf"}, "p1": {"t": "l", "len": 24, "v": "345659635064764b4b716a42485a74436d62726f5258486b"}}, {"type": "genbiz", "enum": 120, "r": "0x7881e81498 libudbauthunify.so!_ZN11BusinessCfg8getOtpExEyiRNSt6__ndk112basic_s", "s1": {"t": "s", "len": 13, "v": "31313939363636393134363731"}, "s2": {"t": "l", "len": 32, "v": "3836356134393234613430383937616331666366653662346332636262306533"}}, {"type": "qurl_done"}] |