live-hub-py/evidence/nonce_bind_result.json at d46654438f06e63db6c9ec5c6843fd760af96756 - live-hub-py - Gitea: Git with a cup of tea

yml/live-hub-py

Files

T

yml2213 97e6d14139 feat(huya): nonce生成机制完全破解 - 任意账号零设备出完整CK闭环

动态hook实锤(scripts/hook_nonce_chain.py):
  rnd = XXTEA(pack(st) + pack(counter|st<<16), key=MD5hex(uid_str + k1)[:16])
  - st=毫秒时间戳, counter同st内递增
  - k1=设备常量865a4924...(不随账号变, evidence/nonce_k1.json)
  - Python复刻(tools/nonce_forge.py)对设备两轮rnd逐字节MATCH

推翻v2误判(X2'nonce账号绑定令牌'实为nonce内编码uid):
  - 换账号用目标uid重算nonce而非复用旧nonce!
  - 纯随机nonce必40020因解不出合法st/counter结构

实测: 同账号+跨账号(hy_300024708从未设备登录)本地nonce铸证bind均通过,
  full_web_cookie/full_auto_safe 任意账号密码->全套cookie(udb_cred/udb_biztoken)

2026-08-26 00:49:01 +08:00

12 lines

240 B

JSON

Raw Blame History

 {
  "local_nonce": {
   "ok": true,
   "uid": 1199666911746,
   "biztoken_len": 344
  },
  "env_uid": 1199666914671,
  "uid": 1199666911746,
  "st": 1787675927351,
  "nonce_hex": "e290e2aadec432280067c49234f9a79665a46bea",
  "ts": 1787675928.288748
 }