294 lines
12 KiB
Plaintext
294 lines
12 KiB
Plaintext
diff --git a/core/huya/app_login.py b/core/huya/app_login.py
|
|
index afa33a4..86e18a9 100644
|
|
--- a/core/huya/app_login.py
|
|
+++ b/core/huya/app_login.py
|
|
@@ -9,7 +9,8 @@
|
|
6. POST /web/cookie/verify 兑换获取全套网页 Cookie
|
|
注册链不再重放旧 dfpReport 密文。登录帧的 32hex hdid 仍是服务端硬锚，
|
|
-当前继续使用已注册样本；新注册链动态更新的是 safedeviceid 和 device_id。
|
|
+登录帧中的 HDID32 是 app 版本级协议常量；二维码信封的 ACTION、设备字段、
|
|
+UID、证书和会话元数据均在本次登录中动态生成或由注册链签发。
|
|
注册链（``core/huya/dfp_register``）每次登录前执行，失败即抛错终止（``HuyaAppLoginError``），
|
|
不读取画像里的旧固定值，也不静默回退旧链。
|
|
@@ -35,7 +36,7 @@ from urllib.parse import parse_qs, quote, urlparse
|
|
import requests
|
|
from loguru import logger
|
|
-from .cert_forge import build_p1, decrypt_cert, forge_cert, parse_p1
|
|
+from .cert_forge import build_p1, forge_cert
|
|
from .cookie_utils import normalize_huya_cookie
|
|
from .device_fingerprint import account_state_dir, get_huya_sdid, reset_account_state
|
|
from .device_profile import get_profile, mobile_user_agent
|
|
@@ -270,7 +271,8 @@ def login_cred_with_flow(
|
|
max_rounds: int = 3,
|
|
device_info: dict | None = None,
|
|
proxies: dict | None = None,
|
|
-) -> tuple[bytes, int]:
|
|
+ include_device_token: bool = False,
|
|
+) -> tuple[bytes, int] | tuple[bytes, int, str]:
|
|
"""新注册设备后登录，返回 ``(新鲜 cred, 真实 uid)``。
|
|
注册只执行一次；safe_auth 通过后的重发继续使用同一组设备字段。
|
|
@@ -305,6 +307,8 @@ def login_cred_with_flow(
|
|
)
|
|
if cred:
|
|
uid = parse_real_uid(resp)
|
|
+ if include_device_token:
|
|
+ return cred, uid, safedeviceid
|
|
return cred, uid
|
|
if risk_url:
|
|
kind = (
|
|
@@ -462,11 +466,12 @@ class HuyaAppPasswordLogin:
|
|
# 1) 获取新鲜 cred 与 真实 uid (自动过 safe_auth 滑块)
|
|
try:
|
|
- cred, uid = login_cred_with_flow(
|
|
+ cred, uid, safedeviceid = login_cred_with_flow(
|
|
acct,
|
|
self.password,
|
|
device_info=self.device_info,
|
|
proxies=self.proxies,
|
|
+ include_device_token=True,
|
|
)
|
|
except HuyaAppQrAuthRequiredError as exc:
|
|
return HuyaLoginResult(
|
|
@@ -485,30 +490,27 @@ class HuyaAppPasswordLogin:
|
|
# 2) 本地生成 nonce 铸造证书 (P1 指纹与该账号设备画像一致)
|
|
try:
|
|
- env = Envelope.load()
|
|
- orig = base64.b64decode(env.cert_b64)
|
|
- f = parse_p1(decrypt_cert(orig))
|
|
st = int(time.time() * 1000)
|
|
rnd = gen_nonce(uid, K1_DEFAULT, service_time_ms=st, counter=0)
|
|
fp_bytes = self.device_info["fingerprint"].encode("ascii")
|
|
- p1 = build_p1(f["app_id"], fp_bytes, cred, rnd=rnd)
|
|
- cert = base64.b64encode(forge_cert(p1, key_idx=orig[1])).decode()
|
|
-
|
|
- # 3) 信封补丁
|
|
- raw = bytearray(env.raw)
|
|
- if env.cert_off is None or env.uid_off is None:
|
|
- raise ValueError("信封缺少证书或 uid 偏移")
|
|
- raw[env.cert_off : env.cert_off + env.cert_len] = cert.encode("ascii")
|
|
- if env.uid != uid:
|
|
- struct.pack_into(">Q", raw, env.uid_off, uid)
|
|
- # QR 信封只保留协议结构；不要重放抓包里的旧会话值。
|
|
+ p1 = build_p1(b"5008", fp_bytes, cred, rnd=rnd)
|
|
+ # 证书头和 app_id 是协议版本常量，不从抓包信封读取。
|
|
+ cert = base64.b64encode(forge_cert(p1, key_idx=0x20)).decode()
|
|
+
|
|
+ # 3) 按当前账号画像和本次注册令牌重编码二维码信封。
|
|
qr_session = random.randint(1_000_000, 9_999_999)
|
|
qr_trace = (
|
|
f"{uuid.uuid4().hex[:16]}-{random.randint(10000, 99999)}-"
|
|
f"{time.time_ns():020d}"
|
|
)
|
|
- env.raw = raw
|
|
- env.patch_session(qr_session).patch_meta(qr_session, qr_trace)
|
|
+ env = Envelope.build_qr(
|
|
+ uid=uid,
|
|
+ cert_b64=cert,
|
|
+ safedeviceid=safedeviceid,
|
|
+ session=qr_session,
|
|
+ trace_id=qr_trace,
|
|
+ device_info=self.device_info,
|
|
+ )
|
|
wup = base64.b64encode(bytes(env.raw)).decode("ascii")
|
|
except Exception as exc: # noqa: BLE001 外部接口与任务边界需要保留宽泛异常兜底
|
|
return HuyaLoginResult(
|
|
diff --git a/core/huya/envelope_forge.py b/core/huya/envelope_forge.py
|
|
index c5d66ab..0d2e8b1 100644
|
|
--- a/core/huya/envelope_forge.py
|
|
+++ b/core/huya/envelope_forge.py
|
|
@@ -1,6 +1,7 @@
|
|
"""wupData 信封构造与补丁工具。
|
|
-解析与改写 WUP 信封中的 cert、uid、session 等字段。
|
|
+生产二维码信封由 :meth:`Envelope.build_qr` 按当前账号状态编码；
|
|
+:meth:`Envelope.load` 仅保留协议结构模板兼容测试和离线分析。
|
|
"""
|
|
from __future__ import annotations
|
|
@@ -10,7 +11,8 @@ import json
|
|
import struct
|
|
from pathlib import Path
|
|
-from loguru import logger
|
|
+from .taf_protocol import TafOutputStream
|
|
+from .wup_protocol import WupRequest
|
|
INT8, INT16, INT32, INT64 = 0x00, 0x01, 0x02, 0x03
|
|
STRING1, STRING4 = 0x06, 0x07
|
|
@@ -119,24 +121,106 @@ class Envelope:
|
|
@classmethod
|
|
def load(cls, path: str | Path | None = None) -> Envelope:
|
|
- """加载信封模板，支持从文件加载或使用内嵌金样本。"""
|
|
+ """加载显式模板，或使用内嵌协议结构模板。
|
|
+
|
|
+ 不自动扫描 ``evidence/``，避免历史抓包成为隐式生产输入。
|
|
+ """
|
|
if path:
|
|
p = Path(path)
|
|
if p.exists():
|
|
return cls._load_from_path(p)
|
|
- # 尝试查找 evidence/cert_keycap.json
|
|
- candidate = (
|
|
- Path(__file__).resolve().parent.parent.parent
|
|
- / "evidence"
|
|
- / "cert_keycap.json"
|
|
- )
|
|
- if candidate.exists():
|
|
- try:
|
|
- return cls._load_from_path(candidate)
|
|
- except Exception as exc: # noqa: BLE001
|
|
- logger.debug(f"加载证书信封候选文件失败: {candidate}: {exc}")
|
|
return cls(base64.b64decode(PROTOCOL_QURL_TEMPLATE_B64))
|
|
+ @classmethod
|
|
+ def build_qr(
|
|
+ cls,
|
|
+ *,
|
|
+ uid: int,
|
|
+ cert_b64: str,
|
|
+ safedeviceid: str,
|
|
+ session: int,
|
|
+ trace_id: str,
|
|
+ device_info: dict[str, str],
|
|
+ ) -> Envelope:
|
|
+ """按当前账号状态编码二维码绑定信封。
|
|
+
|
|
+ 生产二维码请求不应从抓包信封复制字段。这里仅复用已知的 TAF/WUP
|
|
+ 字段布局；证书、ACTION、UID、会话和全部设备画像都由本次登录提供。
|
|
+ """
|
|
+ if len(cert_b64) != 260:
|
|
+ raise ValueError(f"证书 base64 长度异常: {len(cert_b64)} != 260")
|
|
+ if len(safedeviceid) != 180:
|
|
+ raise ValueError(f"safedeviceid 长度异常: {len(safedeviceid)} != 180")
|
|
+ dev = {k: str(v) for k, v in (device_info or {}).items()}
|
|
+ meta = json.dumps(
|
|
+ {
|
|
+ "associationId": 184549392,
|
|
+ "funcName": "",
|
|
+ "group": 0,
|
|
+ "id": 184549392,
|
|
+ "session": int(session),
|
|
+ "step": 0,
|
|
+ "stillLogin": False,
|
|
+ "traceId": str(trace_id),
|
|
+ "type": 2,
|
|
+ "uid": 0,
|
|
+ "userContext": "",
|
|
+ },
|
|
+ ensure_ascii=False,
|
|
+ separators=(",", ":"),
|
|
+ )
|
|
+ body = TafOutputStream()
|
|
+ body.write_struct_begin(0)
|
|
+ body.write_struct_begin(0)
|
|
+ body.write_int8(0, 0)
|
|
+ body.write_string(1, "1.0")
|
|
+ body.write_string(2, meta)
|
|
+ body.write_string(3, "5008")
|
|
+ body.write_int8(4, 3)
|
|
+ body.write_string(5, safedeviceid)
|
|
+ body.write_string(6, "")
|
|
+ body.write_string(7, "")
|
|
+ body.write_string(8, "")
|
|
+ body.write_string(9, "")
|
|
+ body.write_struct_end()
|
|
+
|
|
+ body.write_struct_begin(1)
|
|
+ body.write_string(0, dev.get("hdid", ""))
|
|
+ body.write_string(1, dev.get("app_version", "13.4.22"))
|
|
+ body.write_string(2, dev.get("sdk_version", "1.0.80138"))
|
|
+ body.write_string(3, "")
|
|
+ body.write_string(4, dev.get("ip", "127.0.0.1"))
|
|
+ body.write_string(5, dev.get("vendor", "android"))
|
|
+ body.write_string(6, "")
|
|
+ body.write_struct_end()
|
|
+
|
|
+ body.write_struct_begin(2)
|
|
+ body.write_int8(0, 1)
|
|
+ body.write_string(1, dev.get("model", ""))
|
|
+ body.write_string(2, dev.get("fingerprint", ""))
|
|
+ body.write_string(3, dev.get("os", "android"))
|
|
+ body.write_string(4, dev.get("screen", ""))
|
|
+ body.write_string(6, dev.get("width", "1080"))
|
|
+ body.write_string(7, dev.get("height", "2120"))
|
|
+ body.write_string(8, dev.get("device_id", ""))
|
|
+ body.write_struct_end()
|
|
+ body.write_uint64(3, int(uid))
|
|
+ body.write_string(4, cert_b64)
|
|
+ body.write_string(5, "")
|
|
+ body.write_string(6, "")
|
|
+ body.write_struct_end()
|
|
+
|
|
+ req = TafOutputStream()
|
|
+ req.write_int32(0, int(session))
|
|
+ wup = WupRequest()
|
|
+ wup.iTimeout = 0
|
|
+ wup.setRequestId(int(session))
|
|
+ wup.setServant("huyaudbwebui")
|
|
+ wup.setFunc("default")
|
|
+ wup.newdata["_wup_data"] = body.get_bytes()
|
|
+ wup.newdata["wupudbrequest_v0"] = req.get_bytes()
|
|
+ return cls(wup.encode())
|
|
+
|
|
@classmethod
|
|
def _load_from_path(cls, p: Path) -> Envelope:
|
|
if p.suffix == ".json":
|
|
diff --git a/tests/test_huya_app_login.py b/tests/test_huya_app_login.py
|
|
index 3512a14..0c897bb 100644
|
|
--- a/tests/test_huya_app_login.py
|
|
+++ b/tests/test_huya_app_login.py
|
|
@@ -26,6 +26,7 @@ from core.huya.login import HuyaLoginResult
|
|
from core.huya.nonce_forge import K1_DEFAULT, gen_nonce
|
|
from core.huya.udb_aes import udb_decrypt, udb_encrypt
|
|
from core.huya.wup_encoder import _make_name, build_password_login_wup
|
|
+from core.huya.wup_protocol import WupResponse
|
|
from web.backend.database import Base
|
|
from web.backend.models import HuyaAccount, User
|
|
from web.backend.routers.huya import (
|
|
@@ -102,6 +103,38 @@ class TestHuyaAppLogin:
|
|
assert b'"session":7654321' in current
|
|
assert (b'"traceId":"' + new_trace.encode() + b'"') in current
|
|
+ def test_qr_envelope_is_fully_dynamic(self):
|
|
+ profile = {
|
|
+ "hdid": "h" * 32,
|
|
+ "app_version": "13.4.22",
|
|
+ "sdk_version": "1.0.80138",
|
|
+ "ip": "10.0.0.8",
|
|
+ "vendor": "vivo",
|
|
+ "model": "V2370A",
|
|
+ "fingerprint": "f" * 40,
|
|
+ "os": "android",
|
|
+ "screen": "V2370A,34,13",
|
|
+ "width": "1080",
|
|
+ "height": "2412",
|
|
+ "device_id": "d" * 40,
|
|
+ }
|
|
+ env = Envelope.build_qr(
|
|
+ uid=1199664135026,
|
|
+ cert_b64="A" * 260,
|
|
+ safedeviceid="B" * 180,
|
|
+ session=7654321,
|
|
+ trace_id="t" * 16 + "-12345-" + "9" * 20,
|
|
+ device_info=profile,
|
|
+ )
|
|
+ wup = WupResponse()
|
|
+ wup.decode(bytes(env.raw))
|
|
+ body = wup.newdata["_wup_data"]
|
|
+ for value in (b"B" * 180, b"h" * 32, b"f" * 40, b"V2370A", b"d" * 40):
|
|
+ assert value in body
|
|
+ assert b"PQwemAN9NHkZKoMq" not in body
|
|
+ assert b"02df398797432eadefcc12767119ad5e80999389" not in body
|
|
+ assert b"7c5387e0539c023c31c4ff0e807e7256117385ee" not in body
|
|
+
|
|
def test_device_profile_generation(self):
|
|
p1 = generate_profile()
|
|
assert p1["os"] == "android"
|
|
@@ -271,10 +304,13 @@ class TestHuyaAppLogin:
|
|
patch("core.huya.app_login.solve_safe_auth", return_value={"authId": "id"}),
|
|
patch("core.huya.app_login.parse_real_uid", return_value=1199666914671),
|
|
):
|
|
- cred, uid = login_cred_with_flow("300023887", "pw")
|
|
+ cred, uid, safedeviceid = login_cred_with_flow(
|
|
+ "300023887", "pw", include_device_token=True
|
|
+ )
|
|
assert cred == b"c" * 114
|
|
assert uid == 1199666914671
|
|
+ assert safedeviceid == "A" * 180
|
|
assert calls == [assets, assets]
|
|
def test_login_cred_flow_maps_invalid_password_response(self):
|