yml2213
0c6aff6a6d
核心结论:
- 32hex hdid (WUP 登录帧 field1.tag0) = com.huya.security.hydeviceid.NativeEntry.getGUID()
- 金样本 ed0db8 为金样本设备 GUID; 当前真机 M2102J2SC getGUID()=0a7dfaa882938a6ab502511452142c57(稳定)
- NativeEntry 全字段: getGUID(32hex)/getCDID(40hex)/getHDID(40hex)/getMID(16hex)/getSDID(base64 safedeviceid)
- 单机不可铸造: 改 serialno/ANDROID_ID/删files/hydevice持久化 均不变(硬锚底层硬件)
- libhydeviceid.so 为 OLLVM+datadiv 壳; 用 dlopen->JNI_OnLoad->RegisterNatives(env表索引215) 绕开混淆
脚本: phone_probe_registernatives2(注册表)/phone_java_call_nativeentry(Java读getGUID)/phone_read_hdid(native hook)
phone_dump_hydev(dump解密so)/phone_probe_login_frame(登录帧)/arm64_disasm(反汇编)
证据: hdid_regtable/java_nativeentry/hdid_read/login_frames/hdid_probe* + libhydeviceid_{original,dump}.so
43 lines
1.5 KiB
Python
43 lines
1.5 KiB
Python
#!/usr/bin/env python3
|
|
"""通用 aarch64 反汇编工具: 分析内存 dump 的 libhydeviceid.so (解密后).
|
|
|
|
用法:
|
|
arm64_disasm.py <dump.so> <模块基址> <偏移hex> [长度字节]
|
|
例:
|
|
反汇编 JNI_OnLoad(0x22c4c8) 前 0x300 字节:
|
|
arm64_disasm.py evidence/diag_phone/libhydeviceid_dump.so 0x7814211000 0x22c4c8 0x300
|
|
打印所有 BL/BLR 分支目标到模块偏移.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import sys
|
|
from capstone import Cs, CS_ARCH_ARM64, CS_MODE_ARM
|
|
|
|
|
|
def load(fn):
|
|
with open(fn, "rb") as f:
|
|
return f.read()
|
|
|
|
|
|
def main():
|
|
dump_path = sys.argv[1]
|
|
base = int(sys.argv[2], 16)
|
|
start_off = int(sys.argv[3], 16) # 相对模块基址的偏移 (内存态文件里约等于文件偏移)
|
|
length = int(sys.argv[4], 16) if len(sys.argv) > 4 else 0x200
|
|
data = load(dump_path)
|
|
md = Cs(CS_ARCH_ARM64, CS_MODE_ARM)
|
|
md.detail = True
|
|
code = data[start_off:start_off + length]
|
|
print(f"# base=0x{base:x} start_off=0x{start_off:x} len=0x{length:x}")
|
|
for insn in md.disasm(code, base + start_off):
|
|
disp = ""
|
|
if insn.mnemonic.startswith(("b.", "b ")) or insn.mnemonic in ("bl", "br", "blr", "cbz", "cbnz"):
|
|
if insn.operands:
|
|
disp = f" ; -> 0x{insn.operands[0].imm:x}"
|
|
elif insn.mnemonic == "blr":
|
|
disp = " ; [indirect call]"
|
|
print(f" 0x{insn.address:x}\t{insn.mnemonic:8s} {insn.op_str}{disp}")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main() |