Files
live-hub-py/evidence/diag_phone/hdid_regtable.json
T
yml2213 0c6aff6a6d docs(huya): 逆向定位 32hex hdid = NativeEntry.getGUID() + 真机注入通道证据
核心结论:
- 32hex hdid (WUP 登录帧 field1.tag0) = com.huya.security.hydeviceid.NativeEntry.getGUID()
- 金样本 ed0db8 为金样本设备 GUID; 当前真机 M2102J2SC getGUID()=0a7dfaa882938a6ab502511452142c57(稳定)
- NativeEntry 全字段: getGUID(32hex)/getCDID(40hex)/getHDID(40hex)/getMID(16hex)/getSDID(base64 safedeviceid)
- 单机不可铸造: 改 serialno/ANDROID_ID/删files/hydevice持久化 均不变(硬锚底层硬件)
- libhydeviceid.so 为 OLLVM+datadiv 壳; 用 dlopen->JNI_OnLoad->RegisterNatives(env表索引215) 绕开混淆

脚本: phone_probe_registernatives2(注册表)/phone_java_call_nativeentry(Java读getGUID)/phone_read_hdid(native hook)
      phone_dump_hydev(dump解密so)/phone_probe_login_frame(登录帧)/arm64_disasm(反汇编)
证据: hdid_regtable/java_nativeentry/hdid_read/login_frames/hdid_probe* + libhydeviceid_{original,dump}.so
2026-08-28 12:30:34 +08:00

802 lines
15 KiB
JSON

{
"regs": [
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "getCDID",
"sig": "()Ljava/lang/String;",
"mod": "libhydeviceid.so",
"off": "0x20eb08"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "getSDID",
"sig": "()Ljava/lang/String;",
"mod": "libhydeviceid.so",
"off": "0x20ede8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "getHDID",
"sig": "()Ljava/lang/String;",
"mod": "libhydeviceid.so",
"off": "0x20f0c8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "init",
"sig": "()V",
"mod": "libhydeviceid.so",
"off": "0x20e6e4"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "getGUID",
"sig": "()Ljava/lang/String;",
"mod": "libhydeviceid.so",
"off": "0x20f8c8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "getMID",
"sig": "()Ljava/lang/String;",
"mod": "libhydeviceid.so",
"off": "0x20fba8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "linkId",
"sig": "()Z",
"mod": "libhydeviceid.so",
"off": "0x20fe88"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "setPrivacyMode",
"sig": "(Z)V",
"mod": "libhydeviceid.so",
"off": "0x20f3a8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "setUserAction",
"sig": "(Ljava/lang/String;)V",
"mod": "libhydeviceid.so",
"off": "0x20f3b4"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "setAppStatus",
"sig": "(I)V",
"mod": "libhydeviceid.so",
"off": "0x20f888"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "setPhoneInfo",
"sig": "(Ljava/lang/String;)Z",
"mod": "libhydeviceid.so",
"off": "0x2107f0"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "doReportAgain",
"sig": "(Ljava/lang/String;)V",
"mod": "libhydeviceid.so",
"off": "0x20fea0"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "delayCollect",
"sig": "(Ljava/lang/String;)V",
"mod": "libhydeviceid.so",
"off": "0x210348"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "setMotionEvent",
"sig": "(Ljava/lang/String;Ljava/lang/String;)Z",
"mod": "libhydeviceid.so",
"off": "0x210c20"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "uploadScreenRecord",
"sig": "()V",
"mod": "libhydeviceid.so",
"off": "0x2114f8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "uploadScreenShot",
"sig": "()V",
"mod": "libhydeviceid.so",
"off": "0x2114fc"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "updateDisplayInfo",
"sig": "(Ljava/lang/String;)V",
"mod": "libhydeviceid.so",
"off": "0x211500"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "addApplist",
"sig": "(Ljava/lang/String;Ljava/lang/String;)V",
"mod": "libhydeviceid.so",
"off": "0x2119a8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "requestConfig",
"sig": "()V",
"mod": "libhydeviceid.so",
"off": "0x212a5c"
},
{
"type": "reg",
"cls": "com.huyaudb.HuyaAuthCore",
"name": "init",
"sig": "()V",
"mod": "libudbauthunify.so",
"off": "0x2621d4"
},
{
"type": "reg",
"cls": "com.huyaudb.HuyaAuthCore",
"name": "unInit",
"sig": "()V",
"mod": "libudbauthunify.so",
"off": "0x26238c"
},
{
"type": "reg",
"cls": "com.huyaudb.HuyaAuthCore",
"name": "sendMsg",
"sig": "(J[B)[B",
"mod": "libudbauthunify.so",
"off": "0x26244c"
},
{
"type": "reg",
"cls": "com.huyaudb.HuyaAuthCore",
"name": "receiveNet",
"sig": "([BIII)V",
"mod": "libudbauthunify.so",
"off": "0x2626b0"
}
],
"fns_scan": [
{
"type": "fns-scan",
"dump": [
{
"i": 200,
"a": "0x7895f37840",
"mod": "libart.so",
"off": "0x3ee840"
},
{
"i": 201,
"a": "0x7895f38004",
"mod": "libart.so",
"off": "0x3ef004"
},
{
"i": 202,
"a": "0x7895f387c8",
"mod": "libart.so",
"off": "0x3ef7c8"
},
{
"i": 203,
"a": "0x7895f38f8c",
"mod": "libart.so",
"off": "0x3eff8c"
},
{
"i": 204,
"a": "0x7895f39750",
"mod": "libart.so",
"off": "0x3f0750"
},
{
"i": 205,
"a": "0x7895f39f14",
"mod": "libart.so",
"off": "0x3f0f14"
},
{
"i": 206,
"a": "0x7895f3a6d8",
"mod": "libart.so",
"off": "0x3f16d8"
},
{
"i": 207,
"a": "0x7895f3ae9c",
"mod": "libart.so",
"off": "0x3f1e9c"
},
{
"i": 208,
"a": "0x7895f3b660",
"mod": "libart.so",
"off": "0x3f2660"
},
{
"i": 209,
"a": "0x7895f3be24",
"mod": "libart.so",
"off": "0x3f2e24"
},
{
"i": 210,
"a": "0x7895f3c5e8",
"mod": "libart.so",
"off": "0x3f35e8"
},
{
"i": 211,
"a": "0x7895f3cdac",
"mod": "libart.so",
"off": "0x3f3dac"
},
{
"i": 212,
"a": "0x7895f3d570",
"mod": "libart.so",
"off": "0x3f4570"
},
{
"i": 213,
"a": "0x7895f3dd34",
"mod": "libart.so",
"off": "0x3f4d34"
},
{
"i": 214,
"a": "0x7895f3e4f8",
"mod": "libart.so",
"off": "0x3f54f8"
},
{
"i": 215,
"a": "0x7895f3ecbc",
"mod": "libart.so",
"off": "0x3f5cbc"
},
{
"i": 216,
"a": "0x7895f3fbb4",
"mod": "libart.so",
"off": "0x3f6bb4"
},
{
"i": 217,
"a": "0x7895f40488",
"mod": "libart.so",
"off": "0x3f7488"
},
{
"i": 218,
"a": "0x7895f40bc4",
"mod": "libart.so",
"off": "0x3f7bc4"
},
{
"i": 219,
"a": "0x7895f41300",
"mod": "libart.so",
"off": "0x3f8300"
},
{
"i": 220,
"a": "0x7895f41354",
"mod": "libart.so",
"off": "0x3f8354"
},
{
"i": 221,
"a": "0x7895f41b34",
"mod": "libart.so",
"off": "0x3f8b34"
},
{
"i": 222,
"a": "0x7895f4232c",
"mod": "libart.so",
"off": "0x3f932c"
},
{
"i": 223,
"a": "0x7895f42b54",
"mod": "libart.so",
"off": "0x3f9b54"
},
{
"i": 224,
"a": "0x7895f43320",
"mod": "libart.so",
"off": "0x3fa320"
},
{
"i": 225,
"a": "0x7895f43b08",
"mod": "libart.so",
"off": "0x3fab08"
},
{
"i": 226,
"a": "0x7895f44244",
"mod": "libart.so",
"off": "0x3fb244"
},
{
"i": 227,
"a": "0x7895f44934",
"mod": "libart.so",
"off": "0x3fb934"
},
{
"i": 228,
"a": "0x7895f44948",
"mod": "libart.so",
"off": "0x3fb948"
},
{
"i": 229,
"a": "0x7895f4495c",
"mod": "libart.so",
"off": "0x3fb95c"
},
{
"i": 230,
"a": "0x7895f44a14",
"mod": "libart.so",
"off": "0x3fba14"
}
]
}
],
"events": [
{
"type": "dlopen-hooked",
"fn": "android_dlopen_ext"
},
{
"type": "dlopen-hydev",
"name": "/data/app/~~8yCINTbsGdM-Ig8T11hF2Q==/com.duowan.kiwi-sandFFuGVgsZjumsNfkf1A==/lib/arm64/libhydeviceid.so"
},
{
"type": "jni-onload-hooked"
},
{
"type": "jni-onload-enter",
"tid": 30763
},
{
"type": "fns-scan",
"dump": [
{
"i": 200,
"a": "0x7895f37840",
"mod": "libart.so",
"off": "0x3ee840"
},
{
"i": 201,
"a": "0x7895f38004",
"mod": "libart.so",
"off": "0x3ef004"
},
{
"i": 202,
"a": "0x7895f387c8",
"mod": "libart.so",
"off": "0x3ef7c8"
},
{
"i": 203,
"a": "0x7895f38f8c",
"mod": "libart.so",
"off": "0x3eff8c"
},
{
"i": 204,
"a": "0x7895f39750",
"mod": "libart.so",
"off": "0x3f0750"
},
{
"i": 205,
"a": "0x7895f39f14",
"mod": "libart.so",
"off": "0x3f0f14"
},
{
"i": 206,
"a": "0x7895f3a6d8",
"mod": "libart.so",
"off": "0x3f16d8"
},
{
"i": 207,
"a": "0x7895f3ae9c",
"mod": "libart.so",
"off": "0x3f1e9c"
},
{
"i": 208,
"a": "0x7895f3b660",
"mod": "libart.so",
"off": "0x3f2660"
},
{
"i": 209,
"a": "0x7895f3be24",
"mod": "libart.so",
"off": "0x3f2e24"
},
{
"i": 210,
"a": "0x7895f3c5e8",
"mod": "libart.so",
"off": "0x3f35e8"
},
{
"i": 211,
"a": "0x7895f3cdac",
"mod": "libart.so",
"off": "0x3f3dac"
},
{
"i": 212,
"a": "0x7895f3d570",
"mod": "libart.so",
"off": "0x3f4570"
},
{
"i": 213,
"a": "0x7895f3dd34",
"mod": "libart.so",
"off": "0x3f4d34"
},
{
"i": 214,
"a": "0x7895f3e4f8",
"mod": "libart.so",
"off": "0x3f54f8"
},
{
"i": 215,
"a": "0x7895f3ecbc",
"mod": "libart.so",
"off": "0x3f5cbc"
},
{
"i": 216,
"a": "0x7895f3fbb4",
"mod": "libart.so",
"off": "0x3f6bb4"
},
{
"i": 217,
"a": "0x7895f40488",
"mod": "libart.so",
"off": "0x3f7488"
},
{
"i": 218,
"a": "0x7895f40bc4",
"mod": "libart.so",
"off": "0x3f7bc4"
},
{
"i": 219,
"a": "0x7895f41300",
"mod": "libart.so",
"off": "0x3f8300"
},
{
"i": 220,
"a": "0x7895f41354",
"mod": "libart.so",
"off": "0x3f8354"
},
{
"i": 221,
"a": "0x7895f41b34",
"mod": "libart.so",
"off": "0x3f8b34"
},
{
"i": 222,
"a": "0x7895f4232c",
"mod": "libart.so",
"off": "0x3f932c"
},
{
"i": 223,
"a": "0x7895f42b54",
"mod": "libart.so",
"off": "0x3f9b54"
},
{
"i": 224,
"a": "0x7895f43320",
"mod": "libart.so",
"off": "0x3fa320"
},
{
"i": 225,
"a": "0x7895f43b08",
"mod": "libart.so",
"off": "0x3fab08"
},
{
"i": 226,
"a": "0x7895f44244",
"mod": "libart.so",
"off": "0x3fb244"
},
{
"i": 227,
"a": "0x7895f44934",
"mod": "libart.so",
"off": "0x3fb934"
},
{
"i": 228,
"a": "0x7895f44948",
"mod": "libart.so",
"off": "0x3fb948"
},
{
"i": 229,
"a": "0x7895f4495c",
"mod": "libart.so",
"off": "0x3fb95c"
},
{
"i": 230,
"a": "0x7895f44a14",
"mod": "libart.so",
"off": "0x3fba14"
}
]
},
{
"type": "rn-addr",
"rn": "0x7895f3ecbc",
"mod": {
"n": "libart.so",
"off": "0x3f5cbc"
}
},
{
"type": "rn-hooked"
},
{
"type": "reg-call",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"count": 19,
"tid": 30763
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "getCDID",
"sig": "()Ljava/lang/String;",
"mod": "libhydeviceid.so",
"off": "0x20eb08"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "getSDID",
"sig": "()Ljava/lang/String;",
"mod": "libhydeviceid.so",
"off": "0x20ede8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "getHDID",
"sig": "()Ljava/lang/String;",
"mod": "libhydeviceid.so",
"off": "0x20f0c8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "init",
"sig": "()V",
"mod": "libhydeviceid.so",
"off": "0x20e6e4"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "getGUID",
"sig": "()Ljava/lang/String;",
"mod": "libhydeviceid.so",
"off": "0x20f8c8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "getMID",
"sig": "()Ljava/lang/String;",
"mod": "libhydeviceid.so",
"off": "0x20fba8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "linkId",
"sig": "()Z",
"mod": "libhydeviceid.so",
"off": "0x20fe88"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "setPrivacyMode",
"sig": "(Z)V",
"mod": "libhydeviceid.so",
"off": "0x20f3a8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "setUserAction",
"sig": "(Ljava/lang/String;)V",
"mod": "libhydeviceid.so",
"off": "0x20f3b4"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "setAppStatus",
"sig": "(I)V",
"mod": "libhydeviceid.so",
"off": "0x20f888"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "setPhoneInfo",
"sig": "(Ljava/lang/String;)Z",
"mod": "libhydeviceid.so",
"off": "0x2107f0"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "doReportAgain",
"sig": "(Ljava/lang/String;)V",
"mod": "libhydeviceid.so",
"off": "0x20fea0"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "delayCollect",
"sig": "(Ljava/lang/String;)V",
"mod": "libhydeviceid.so",
"off": "0x210348"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "setMotionEvent",
"sig": "(Ljava/lang/String;Ljava/lang/String;)Z",
"mod": "libhydeviceid.so",
"off": "0x210c20"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "uploadScreenRecord",
"sig": "()V",
"mod": "libhydeviceid.so",
"off": "0x2114f8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "uploadScreenShot",
"sig": "()V",
"mod": "libhydeviceid.so",
"off": "0x2114fc"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "updateDisplayInfo",
"sig": "(Ljava/lang/String;)V",
"mod": "libhydeviceid.so",
"off": "0x211500"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "addApplist",
"sig": "(Ljava/lang/String;Ljava/lang/String;)V",
"mod": "libhydeviceid.so",
"off": "0x2119a8"
},
{
"type": "reg",
"cls": "com.huya.security.hydeviceid.NativeEntry",
"name": "requestConfig",
"sig": "()V",
"mod": "libhydeviceid.so",
"off": "0x212a5c"
},
{
"type": "reg-call",
"cls": "com.huyaudb.HuyaAuthCore",
"count": 4,
"tid": 30763
},
{
"type": "reg",
"cls": "com.huyaudb.HuyaAuthCore",
"name": "init",
"sig": "()V",
"mod": "libudbauthunify.so",
"off": "0x2621d4"
},
{
"type": "reg",
"cls": "com.huyaudb.HuyaAuthCore",
"name": "unInit",
"sig": "()V",
"mod": "libudbauthunify.so",
"off": "0x26238c"
},
{
"type": "reg",
"cls": "com.huyaudb.HuyaAuthCore",
"name": "sendMsg",
"sig": "(J[B)[B",
"mod": "libudbauthunify.so",
"off": "0x26244c"
},
{
"type": "reg",
"cls": "com.huyaudb.HuyaAuthCore",
"name": "receiveNet",
"sig": "([BIII)V",
"mod": "libudbauthunify.so",
"off": "0x2626b0"
}
],
"detached": [
{
"reason": "process-terminated",
"detail": "None"
}
]
}