某红薯App风控参数分析

app参数很多，这里主要说x-mini系列，还有一个shield参数，这里不会从头开始分析，若抓包或者其它可以看之前的文章，会简单说明一下算法过程，主要详细介绍相关风控设备指纹，以及这些信息是如何参与算法过程

本文章只供交流学习，若有侵权请联系作者及时删除！！！

1.libtiny.so中BR花指令去除

2.字符串解密

3.x-mini系列等算法概括

3.1 x-mini-mua

3.2 x-mini-s1

3.3 x-mini-sig

3.4 shield

4.设备指纹上传分析

4.1 x-mini-mua中的设备指纹

4.2 /api/v1/profile/android接口上传

4.3 补充深入分析

—

libtiny.so中BR花指令去除

要想比较舒服的分析第一步肯定是分析花指令并去除

类型一：常量地址构造后 BR

特征是目标寄存器由 ADR/ADRP/ADRL、MOV/MOVK/MOVN、ADD/SUB 等构造，最后 BR Xt：

ADRP X8, #target@PAGEADD  X8, X8, #target@PAGEOFFBR   X8

或：

MOV  X9, #immMOVK X9, #imm, LSL #16ADD  X8, X8, X9BR   X8

处理方式：

从局部块入口模拟到 BR
如果 BR 寄存器值是 .text 内确定地址，继续 normalize

normalize 后不是纯垃圾块，直接把 BR Xt 改为 B final_targe

类型二：静态表项读取后 BR

典型形式：

ADRP X13, #off_xxx@PAGEADD  X13, X13, #off_xxx@PAGEOFFLDR  X9, [X13,#off]ADD  X9, X9, W10,SXTWBR   X9

处理方式：

解析 ADRP + ADD 得到表基址。
从 ELF/重定位读取表项。
模拟后续加减偏移。
得到确定 .text 地址后 patch 为 B。

如果表索引来自 CSEL/CSET，进入条件分发处理

类型三：CSEL/CSET 条件分发

典型形式：

CMP  W8, #0CSEL W10, W11, W10, NESUB  W10, W10, W8ADD  X9, X9, W10,SXTWBR   X9

处理方式：

在 CMP/TST/CMN 处记录 flags。
遇到 CSEL/CSET/CSINV/CSINC/CSNEG 时分裂 true/false 两个状态。
两个状态分别模拟到同一个 BR。
如果两个目标都能静态证明，改写成：

B.cond target_trueB      target_false

类型四：BR 前有真实副作用

有些条件分发在 BR 前夹了真实副作用，例如：

ADD  X8, X9, W8,SXTWSTR  X15, [X19,#0x468]MOV  X12, X15BR   X8

处理方式：

识别 BR 前可以安全移动的尾部副作用。
将这些指令前移到 patch 区域最前面。
后面写入 B.cond + B。
原位置写 NOP，避免重复执行。

例子：

0x3AC8E0 STR X15, [X19,#0x468]0x3AC8E4 MOV X12, X150x3AC8E8 B.NE 0x404E140x3AC8EC B    0x367A3C0x3AC8F0 NOP0x3AC8F4 NOP

类型五：纯 carrier 垃圾块

这类块本身不做业务，只把外部 carrier 寄存器再加减一个常量后跳走。它们不应该有业务静态分支跳入。

形式一：

MOV  X8, #negative_constADD  X8, X9, X8BR   X8或：LDR X9, [X19,#field]MOV X8, #negative_constADD X8, X9, X8BR  X8

形式二：

ADRP X8, #off_xxx@PAGELDR  X8, [X8,#off_xxx@PAGEOFF]MOV  X10, #const_aMOV  X9,  #const_bMOVK X10, #...MOVK X9,  #...ADD  X8,  X8,  X10ADD  X12, X12, X9BR   X12

处理方式：

如果上层业务块解析出的第一层目标是这类 carrier 块，继续带着当前寄存器状态穿透。
能穿透到最终业务块时，只改上层跳转到 final target。
纯 carrier 块自己的尾部 BR 不强行改成 B，避免生成错误静态 xref。
穿不透时宁可保留原始 BR，不生成 B first_thunk。

因此这些地址保留 BR 是预期行为：

0x19FDBC BR X80x37C7D4 BR X80x3FF9AC BR X8

如果静态 B 跳入纯 carrier 垃圾块，并且前驱块里有 CSEL/CSET 导致单状态模拟把 carrier 合并成 UNKNOWN，脚本会对这个前驱块做多状态模拟，再直接重写前驱分支。

例子 0x4AAD3C：

0x4AAD34 CMP  W10, #00x4AAD38 CSEL X8, X8, X9, NE0x4AAD3C B    0x4AAE000x4AAE00 LDR  X9, [X28,#0xB50]0x4AAE14 ADD  X9, X9, X110x4AAE18 ADD  X8, X8, X100x4AAE1C BR   X9

0x4AAE00 本身是纯 carrier 中转块。X28 在函数入口 anchor 中稳定为 0x772000，[0x772000 + 0xB50] + const 先跳到下一层 carrier；同时 X8 的两路 CSEL 值继续决定最终目标。

改写后：

0x4AAD38 B.NE 0x4AA6A80x4AAD3C B    0x4AA62C

这样不会再产生静态边 0x4AAD3C -> 0x4AAE00

类型六：saved-field chain

有些跳转先把候选目标写入对象字段或栈符号字段，后续块再读出来继续计算：

STR X10, [X19,#field]B   mid_blockmid_block:LDR X9, [X19,#field]ADD X8, X9, #offsetBR  X8

处理方式：

自定义模拟器把 [寄存器 + offset] 表达为符号内存 key。
如果写入值是确定地址，后续读取同一 key 时恢复该值。
支持多层 B -> mid -> carrier -> BR 链式穿透。
只允许已确认的 saved-field key 参与穿透，防止误把真实对象字段当静态值。

类型七：调用返回后的纯分发尾块

有些块是正常调用后紧接一个 dispatcher tail：

BL  some_func...ADD X9, X9, W10,SXTWBR  X9

处理方式：

普通纯 carrier 块自己的 BR 默认不 patch。
但如果该纯分发尾块是 BL/BLR 后的顺序续块，说明它是当前业务路径的一部分。
允许 patch 这个尾部 BR，例如 0x185F40 -> B 0x19E0E4。

类型八：angr 小型 indexed switch fallback

用于处理“非垃圾块里计算跳到后续语句块”的小跳表。典型形式：

ADRP X10, #table@PAGEADD  X10, X10, #table@PAGEOFFLDR  X8, [X10,X8,LSL#3]MOV  X10, #constMOVK X10, #const, LSL#16SUB  X1, X9, #1          ; 真实副作用，需要保留ADD  X8, X8, X10BR   X8

处理条件很严格：

必须是 indexed LDR Xt, [base,index,scale]，且 Xt 最终进入同一个 BR Xt。
表基址必须能由静态模拟得到。
枚举表项后，目标必须是 2 到 3 个 .text 内地址。
目标必须是 BR 后面很近的前向语句块，当前限制跨度为 0x100。
patch 区域必须放得下 副作用指令 + CMP/B.EQ + B。
中间真实副作用只能是可安全前移的简单指令，且不能依赖目标计算临时寄存器。
使用 angr 从 indexed LDR 开始单步到 BR 验证每个索引的目标。
angr 使用 SYMBOL_FILL_UNCONSTRAINED_*，不使用 zero-fill，避免未知值被 0 填充后误算。

例子 0x1A5788：

0x1A5774 LDR X8, [X10,X8,LSL#3]0x1A5778 MOV X10, #...0x1A577C MOVK X10, #...0x1A5780 SUB X1, X9, #10x1A5784 ADD X8, X8, X100x1A5788 BR X8

静态枚举 + angr 确认：

index 0 -> 0x1A578Cindex 1 -> 0x1A5798index 2 -> 0x1A57A4

改写后：

0x1A5774 SUB X1, X9, #10x1A5778 CMP X8, #00x1A577C B.EQ 0x1A578C0x1A5780 CMP X8, #10x1A5784 B.EQ 0x1A57980x1A5788 B    0x1A57A4

结果：

这种垃圾代码块需要保证没有任何节点跳转到该区域，同时此处的BR也无需跳转到目标区域

—

字符串解密

字符串解密非常重要，这能能够了解so大概流程，为了方便分析，还打印相关json处理，因为需要观察设备指纹的处理

字符串解密函数的特征：

#	特征	IDA 中怎么看
1	两个参数	反编译 `result, a2`
2	Magic 右移	`0xBD69BD22 >> (8 * (x & 3))`
3	i % 5 分支	`switch(i % 5)` 或类似的条件比较
4	5 种操作	eor、mvn、sub、lsl(含shift)、lsr(含shift)
5	do-while 循环	cbz/cbnz + 比较指令
6	原地解密	`ptr = ptr ^ key` 写回原地址

在 IDA 应该看到：

do {    v8 = *v_counter;    v9 = 8 * (v8 & 3);    v10 = MAGIC >> v9;    v11 = v10 - 7 * ...;    v12 = v11 + 1;    switch (v8 % 5) {        case 0: *out = *in ^ v10; break;        case 1: *out = *in ^ ~v10; break;        case 2: *out = *in - v10; break;        case 3: *out = ROTL(*in, v12); break;        case 4: *out = ROTR(*in, v12); break;    }    *in = *out;} while (++i < len);

这里找到10个相关字符串解密相关函数

JSON 树结构

SSO (Small String Optimization) 字符串格式

libtiny.so 使用 SSO 格式存储字符串，24 字节（0x18）结构：

小字符串 (hdr 为偶数):  [hdr(1 byte)] [data(23 bytes)]  len = hdr >> 1  数据紧跟在 hdr 后面 (ptr+1)大字符串 (hdr & 1 != 0):  [hdr(1 byte)] [pad(7 bytes)] [len(8 bytes)] [data_ptr(8 bytes)]  len 在 ptr+8 (QWORD)  数据指针在 ptr+16

读取函数

function readSmallStr(ptr) {    if (ptr.isNull()) return "";    try {        var hdr = ptr.readU8();        var len, buf;        if ((hdr & 1) !== 0) {            len = ptr.add(8).readU64().toNumber();            buf = ptr.add(16).readPointer();        } else {            len = (hdr >>> 1);            buf = ptr.add(1);        }        if (len === 0) return "";        if (len > 0x100000) return "";  // 垃圾数据保护        return buf.readUtf8String(len);    } catch (e) {        return "";    }}

json节点布局

每个节点 0x48 (72) 字节：

偏移    大小    含义+0x00   8      left child 指针+0x08   8      right child 指针+0x10   8      parent 指针+0x18   8      颜色/元数据+0x20   24     key (SSO 字符串, 24字节)+0x38   1      value type (类型标记)+0x40   8      value data (值数据)

Value 类型:

type	含义	value data
0	null	-
1	object	指向子树容器的指针
2	array	指向 vector 的指针
3	string	指向 SSO 字符串的指针
4	boolean	指针非零 = true
5	int64	直接读 I64
6	uint64	直接读 U64
7	double	直接读 Double

—

x-mini系列等算法概括

x-mini-mua

最基础的设备签名参数，所有其他算法的前置依赖。

X25519 ECDH 密钥协商：客户端随机生成 32 字节私钥 → 对 Basepoint 9 做 X25519 得到 client_pub；再与硬编码的服务端公钥做 X25519 得到 shared_secret密钥派生：shared_secret 前 16 字节 = AES Key，后 16 字节 = CBC IV设备指纹压缩：200+ 项的 JSON 设备指纹 → zlib 压缩AES-128-CBC 加密：压缩后的指纹用标准 AES 加密输出格式：base64url(header_json).base64url(ciphertext).

x-mini-s1

魔改 AES-128-CBC：基于查表法（行/列混淆矩阵变换），非标准 mix_columns，带自定义 shift_perm 排列。Round keys 和 Prewhiten key 均为固定常量签名原文构建：METHOD\nPATH\nQUERY\nSHA256(BODY).hex()\nMUA_JWThash32 混淆：SHA256 → 行置换 → 字节变换（0xD0/0xF4/0x8B/0x4E XOR + nibble swap）raw44 包装：4字节时间戳 + 2字节编码 + 2字节编码 + hash32 + CRC32 tail随机数洗牌：用 libc rand() 生成的洗牌索引对固定 pair_table 重排输出格式：Base64(packet) = [counter][ciphertext][crc_a][crc_b]

x-mini-sig

签名原文：与 x-mini-s1 相同（5 段换行分隔）算法核心：sig = transform_16(SHA256(plain)[0:16]) || SHA256(plain)[16:32]transform_16 是 GF(2) 上的 128-bit 仿射变换：输出 128 位 = 128 个输入位的 XOR 组合 + 16 字节常量偏移。等价于将 5288 条 ARM64 NEON 向量指令压缩成一个 128×128 的二元矩阵输出：64 字符 hex

shield

HMAC Key 解密：调用 aes_decrypt_main_hmac 解密得到 64 字节 HMAC 密钥（与设备绑定）HMAC-MD5：对 URL query 参数做 魔改 MD5 HMAC（Round 1-4 的 shift 量和 K 常量均与标准 MD5 不同，且初始 IV 也有差异），中间涉及 NEON 128-bit 字节反转RC4 加密：用 "std::abort();" 作为 13 字节 RC4 Key 加密一个 83 字节的结构体（version + app_id + type + build + deviceId + hmac_digest）输出格式："XY" + Base64(16字节header + RC4密文)Shield 的 HMAC Key 解密前置模块。自定义 AES-128-CBC 解密：不是标准 AES。KeySchedule 由 DeviceId[:16] + 自定义 XOR 常量 + 魔改 Rcon + 非标准 WordRotate/SubWord 派生11 个轮密钥全部从 ARM64 trace 中提取并写死只被 shield.py 调用，用于解密 main_hmac 字符串获得 64 字节 HMAC 密钥

—

设备指纹上传分析

这里设备指纹包括前面x-mini-mua，以及：

/api/v1/register/android/api/v1/cfg/android/api/v1/profile/android

4.1 这里先分析x-mini-mua中的设备指纹

在整个密文 "xxx.aaa."是这种结构，这里aaa就是指纹json数据加密而来

例如：

{  "x0": "com.xingin.xhs",  "x1": "9.24.0",  "x10": "google/oriole/oriole:13/TQ3A.230901.001.C2/10753682:user/release-keys",  "x11": "abfarm-release-2004-0177",  "x12": "TQ3A.230901.001.C2",  "x120": "0",  "x13": "release-keys",  "x131": "0",  "x14": "user",  "x146": "7c8f82689eba549d1ca466eff097d287a8248d294735998677b2d849",  "x15": "10753682",  "x16": "13",  "x17": 33,  "x18": "2023-09-01",  "x185": "IiGgSsKkCVvEePp",  "x186": -1,  "x187": -1,  "x19": "oriole",  "x194": "1",  "x2": 9240811,  "x20": "google",  "x202": "1",  "x203": "1",  "x206": 0,  "x207": 0,  "x21": "arm64-v8a,armeabi-v7a,armeabi",  "x22": "oriole",  "x23": "Google",  "x231": 118396899328,  "x232": 118396899328,  "x234": {    "1": 1763286961761,    "2": 1763286951020,    "3": 1763286950944  },  "x235": 4262000,  "x236": 69230530560,  "x237": 69230530560,  "x238": "cn",  "x24": "Pixel 6",  "x242": [],  "x243": 1778219998657,  "x247": {    "0": 14.285714285714286,    "1": 0.0,    "2": 0.0,    "3": 0.0,    "4": 14.285714285714286,    "5": 0.0  },  "x25": "oriole",  "x258": 6,  "x259": 1,  "x26": "aarch64",  "x260": 1778220090870,  "x261": 1,  "x263": 0,  "x264": 0,  "x267": 1,  "x269": 1230768000000,  "x27": "5.10.157-android13-4-00003-g776d0a76f6aa-ab10208116",  "x272": 0,  "x28": "#1 SMP PREEMPT Thu May 25 12:11:12 UTC 2023",  "x289": 1778220091027,  "x29": "g5123b-145971-250708-B-13746081",  "x290": 1,  "x293": 6319943,  "x296": "",  "x3": 1777894891697,  "x30": "1080,2400,420",  "x301": "LOADED",  "x302": "CE65F4E2D70C2B48E869BF712E1574C4",  "x303": "MEYCIQDS/VBMwGMPNKX14sdePbMeTx7MojyQc9JcMbTSSaK62gIhAICFkZu1ysGQUE4EzGymicc3heb0yStShhE6E0L2gMXI",  "x304": 1,  "x305": -3,  "x31": 31,  "x32": 1,  "x33": 5,  "x34": 100,  "x35": 100,  "x36": 2,  "x37": 0,  "x38": 1,  "x4": 1777894891697,  "x40": 5,  "x41": "Mobile Duck",  "x42": "45412",  "x43": "wifi",  "x44": 1778220090864,  "x45": 270,  "x5": "Vivo",  "x6": 1777893226942,  "x7": "gs101",  "x70": 35,  "x72": 1778148854107,  "x73": 1778219906896,  "x78": 10396,  "x79": 28625,  "x8": 1693618695000,  "x80": 833,  "x87": 1778219998851,  "x9": "TQ3A.230901.001.C2",  "x92": 35,  "x93": 3,  "x97": "{\"d1\":\"\",\"d10\":\"\",\"d11\":\"\",\"d12\":\"\",\"d13\":\"\",\"d4\":\"\",\"d6\":\"\",\"d9\":\"\",\"s1\":\"0|0|0|0|*|0|0\",\"s10\":\"0|*|0|*|*\",\"s11\":\"*|0|0\",\"s2\":\"1|*|0\",\"s3\":\"*|0|0|0|0|0|0\",\"s4\":\"*|*|*|*\",\"s5\":\"0|*|*|*|0|0|0|0|0|*|0|0\",\"s6\":\"*|0|*|*|0|0|0|0|0|*|0|0\",\"s7\":\"0|0|0|0\",\"s8\":\"0|0|0|0|0|0|0\",\"s9\":\"*|0|0|0\"}",  "x98": "0",  "x99": "3106481332"}

应用基础信息 (x0-x4, x92)

字段	值	含义
`x0`	`com.xingin.xhs`	应用包名
`x1`	`9.24.0`	versionName
`x2`	`9240811`	versionCode (`0x8D00EB`)
`x3`	`1777894891697`	首次安装时间戳 (约2026-04-28)
`x4`	`1777894891697`	最近更新时间戳 (与 x3 一致=未更新)
`x92`	`35`	targetSdkVersion

厂商/型号伪装 (x5, x20, x23, x24)

字段	值	含义
`x5`	`Vivo`	设备厂商 (伪装值) — 硬编码 `create_string("Vivo")`
`x20`	`google`	BRAND
`x23`	`Google`	真实厂商 (MANUFACTURER)
`x24`	`Pixel 6`	真实型号 (MODEL)

`x5`=Vivo 与 `x23`=Google/`x7`=gs101(Tensor)/`x24`=Pixel 6 完全矛盾, 证明 libtiny.so 主动伪造了设备厂商字段。在分析的日志中发现显示 SDK 尝试连接小米/酷派 OAID 服务失败后硬编码为 "Vivo"

Build 系统属性 (x6-x19, x21-x22, x25-x29)

全部来自 `getprop` / `android.os.Build.*`, 构成 ROM 完整指纹:

字段	值	属性来源
`x6`	`1777893226942`	ro.build.date.utc (2023-09-02)
`x7`	`gs101`	ro.board.platform -> Tensor
`x8`	`1693618695000`	ro.build.date.utc x1000
`x9`	`TQ3A.230901.001.C2`	ro.build.display.id
`x10`	`google/oriole/oriole:13/.../10753682:user/release-keys`	ro.build.fingerprint
`x11`	`abfarm-release-2004-0177`	ro.build.host
`x12`	`TQ3A.230901.001.C2`	ro.build.id
`x13`	`release-keys`	ro.build.tags
`x14`	`user`	ro.build.type
`x15`	`10753682`	ro.build.version.incremental
`x16`	`13`	ro.build.version.release
`x17`	`33`	ro.build.version.sdk
`x18`	`2023-09-01`	ro.build.version.security_patch
`x19`	`oriole`	ro.product.device
`x21`	`arm64-v8a,armeabi-v7a,armeabi`	SUPPORTED_ABIS
`x22`	`oriole`	ro.product.name
`x25`	`oriole`	ro.hardware
`x26`	`aarch64`	ro.product.cpu.abi
`x27`	`5.10.157-android13-4-00003-g776d0a76f6aa-ab10208116`	uname -r
`x28`	`#1 SMP PREEMPT Thu May 25 12:11:12 UTC 2023`	uname -v
`x29`	`g5123b-145971-250708-B-13746081`	基带版本

屏幕与电池 (x30-x38)

字段	值	含义
`x30`	`1080,2400,420`	分辨率,刷新率,dpi
`x31`	`31`	MEDIA_PERFORMANCE_CLASS
`x32`	`1`	充电中
`x33`	`5`	电池充满
`x34`	`100`	电量%
`x35`	`100`	电量(冗余)
`x36`	`2`	USB 充电
`x37`	`0`	未知
`x38`	`1`	电池健康

网络信息 (x40-x45)

字段	值	含义
`x40`	`5`	网络类型=MOBILE
`x41`	`Mobile Duck`	运营商名称 (非标准)
`x42`	`45412`	MCC+MNC (454=香港, 12=CMHK)
`x43`	`wifi`	当前连接=WiFi
`x44`	`1778220090864`	本次网络连接时间戳
`x45`	`270`	连接持续时长(ms)

进程信息 (x78-x80)

字段	值	含义
`x78`	`10396`	App Linux UID
`x79`	`28625`	主线程 TID
`x80`	`833`	进程线程总数

存储信息 (x231-x232, x235-x237)

字段	值	含义
`x231`	`118396899328` (约110 GB)	总存储(A)
`x232`	`118396899328` (约110 GB)	总存储(B/冗余)
`x235`	`4262000` (约4.1 GB)	已用存储
`x236`	`69230530560` (约64.5 GB)	空闲存储(A)
`x237`	`69230530560` (约64.5 GB)	空闲存储(B/冗余)

CPU 使用率 (x247)

采样 6 核心 (`/proc/stat` 差值): `{0:14.29%, 1~3:0%, 4:14.29%, 5:0%}`。Pixel 6 Tensor 有 8 核, 只有活跃核心被采样

时间戳体系

字段	值	含义
`x8`	`1693618695000`	ROM 构建时间 (2023-09-02)
`x70`	`35`	上报间隔(秒)
`x72`	`1778148854107`	App 冷启动时间戳
`x73`	`1778219906896`	上一次操作时间
`x87`	`1778219998851`	本次采集入口
`x93`	`3`	第 3 次采集
`x234`	`{"1":1763286961761,"2":1763286951020,"3":1763286950944}`	SDK 初始化三阶段
`x243`	`1778219998657`	事件基准时间
`x258`	`6`	全局请求计数器 (第6次请求, 跨会话)
`x259`	`1`	非首次运行
`x260`	`1778220090870`	采集完成时间戳
`x269`	`1230768000000`	基准时间戳 (2009-01-01 epoch偏移)
`x289`	`1778220091027`	HTTP 发送时间戳
`x293`	`6319943`	采集耗时(ms) 约6.3秒

安全/环境检测

字段	值	含义
`x97`	11项 s1~s11 服务检测JSON	系统服务可用性签名
`x98`	`"0"`	模拟器检测 (0=非模拟器)
`x120`	`"0"`	多开/虚拟环境
`x131`	`"0"`	Frida 检测
`x194`	`"1"`	SDK 已初始化
`x202`	`"1"`	安全标志
`x203`	`"1"`	安全标志
`x206`	`0`	签名匹配 (非重打包)
`x207`	`0`	签名校验(冗余)
`x261`	`1`	正常启动
`x263`	`0`	ART 正常
`x264`	`0`	运行正常
`x267`	`1`	进程存活
`x272`	`0`	无热修复篡改
`x290`	`1`	官方 ROM (release-keys)
`x301`	`LOADED`	SDK 加载成功
`x304`	`1`	TEE 密钥有效
`x305`	`-3`	错误码=OK

设备标识与密钥

字段	值	含义
`x146`	`7c8f82689eba549d1ca466eff097d287a8248d294735998677b2d849`	APK 签名 SHA384 (GID)
`x185`	`IiGgSsKkCVvEePp`	会话 Token (16字符 Base64, 大小写交错模式)
`x302`	`CE65F4E2D70C2B48E869BF712E1574C4`	密钥标识 KK (MD5 指纹)
`x303`	`MEYCIQDS/VBMwGMPNKX14sdePbMeTx7MojyQc9JcMbTSSaK62gIhAICFkZu1ysGQUE4EzGymicc3heb0yStShhE6E0L2gMXI`	ECDSA P-256 DER 签名 (72字节)
`x296`	`""`	预留

杂项字段

字段	值	含义
`x99`	`3106481332`	蓝牙状态 CRC32
`x186`	`-1`	ADB 状态(未读取)
`x187`	`-1`	开发者选项(未读取)
`x238`	`cn`	SIM 国家代码
`x242`	`[]`	外设列表(空)

字段分组总结

维度	核心字段	猜测风控目的
应用身份	x0, x1, x2, x3, x4, x92	验证 App 版本与安装时间合法性
硬件指纹	x7, x21, x26, x247, x231-x237	防模拟器 -- 真机 Tensor/Mali vs 模拟器 x86/VirGL
系统指纹	x6-x29	防 ROM 修改 -- build.prop 全量校验
网络环境	x40-x45	防代理/VPN -- 检测异常运营商和连接方式
环境安全	x97, x98, x120, x131, x186-x187, x290, x301-x305	防逆向 -- Root/Frida/ADB/模拟器多维度检测
会话认证	x185, x146, x302, x303, x258	防重放 -- TEE 密钥签名 + 请求计数器

4.2 /api/v1/profile/android接口上传

{    "a": "ECFAAF01",  // App ID, 固定值    "c": 82,          // 请求计数器/序列号    d：这个是最重要的：加密的设备指纹, 包含 300+ 字段    "d": "QaHznUsBrVF709N5FMwvNexevmqwkjM8-1e2f98-fNVnlFlvnHUasds6O9WUJHwo-Cu6SiqFUdNuPBaaNoCJwMwLICZ1n3Eqo5oWf5U4pBD1nJZntgU3rcGbEjG0Qlvr-s-iit47hzlWujt1cFtI-ZGxWRYG-CWiHcnzVpxHtRSIbd02aDRHxEq2c7G51Px44kjSb0jRPrBPuPOckhHLAHyAjveuIsuQ5cBnV3NyUwOyrekJWLlsvKFg83nFikBpQtVrPkwwFlQn2DPq4fNndlxewoht_4mulkMSNo-Njgp-ooRb2hSqffLq6DQnPjeNcCtq_uyjOPRY4gbcVf3Phbrjiy6ZYTHxQTKVEaC23wQQuZw2G9-C5jKX_Cas5Ub9RmF8msHzwLGIrQR1JMG7dSU7Q4F5Jj-MwIOxwk749UPUlAeivLfeyYV9fAAbmLRWHBPTREwbM5coIciF2-1z0xJSSyDDSm3F6oLChs0TCAH5u1FWswvMJLdHijLPdjkxk8SIAcZjx6cov2LHZXIiBS_vbQYPE5ctfO5GIMvq_rtsErAV5xPSMB7IRiff4M6KwgqlYecjeyoHS9EZ8ND9HayzyHkwM3F6XnxbKOSQXLDJyTIOZ-7Ybf-rfpVanW7h3LH2q9VV5snBVtOgA3IyzoEJIncd2Ht9wDNfO8yTWXwMBlvsTEeJ-z4AQJNfKrOQTOs0UKeZGCC-MB2kbpZ0epuOrNaZBymVLNcYlcJBLbEkp0xNdgW6e_nfPAqNhe5rzNOM6VKP1lTvfmFXx0DIxWvgj6R1EEd6tB9ElY8ti9fcgXxeFu2QC4n8i9jnZTVe2yaVKvJGEtMnCV23KpizWWjUl-SOD78glp370uS-DoxFNfaIQ5foM63S10ySeZ3XsO6Xy9p4QAPqJppI3y5L0iKMLb2rBwc80ua7act-7xwTvj489OZRoTAIbq8ugFY90RHjH1pI_OhmSKTb5D5gdee5epkP3CjTBW1YcKTAPHttWEag7WKXElerUhTmt_ahQTGVp-MAiF7WGN9CRsyP7kJEpBjnZZOE8TE21mtxPy870nwZgE1IvRDi-j-_gMrkY507ZzQSfGSi8a_4GHFMj61i26PSjU0U_TXe4nzQXZjlyikMnIeeTmAZE8WAef6sErCuVGVrI_9rFpiAjTVnYoC9r2GhR6QkrTjwsUPDZTCvaZTM6WhIIB25QfZooMoTFOSZOVkcptBUoTj8p-nkeMiZnhpV10i39BP8HM087W9cgHmvpMVVP1kFGr0mDp2tcrAW9DqqUlI551ZvR9t8v13icl_z71bOcFnBbCqKksea8xiQfQVC9KwofiANWeEYNvjuBZE4Mhn4fwA9M_91kZZX-OV7WQYkvhFeJn_J_Zwq1vXaquyzisRJunHMWKEyi7mdGUImOLY6xPPXPbATTt01zmzMXHEOs1E8qt277uevkITF72wZ_sPyNIfW8FqMxEnK3VAqLb8MVazY1Xb3AyAJHjY8iIjgfO7Q6lRDVgXUd6c6OKpY57Vb1yO4qYY2rYJZd4vHv8d0tZ1YdwD7Ds0tvVnXFyIg8Nyov5otXBr0P8hQp7gKBXJ6mCZ11hSWOz5jppmKED63P2a8xcZAXgR0_sA0UBo6SqZAGatYp5SkvsSImzq7dJti1c1le0pBMCjhegIPQhBBy2ovlcDYyGQljY-LmXSxVBJ_T-5Z9Lv3bC2ML0HWZJr_cpy6IOR5JvIkb6BEEit0Aab_uH9Y5Lw1aylFOY56j0u_I4ycvwgjczRgJelNCWRUu9Vyy_H-Cr1VAOz67WDW8XOmv2v13hz8m1WfNHx-ZneGeyS-WL-VUNPVMGoeADbHRE64aZnRo4-8J8mt9naJiRz0D5g11bFUnmnte1RI_DsC__fkSoBOfLPrgTbyMT2tLfB54nIn96Depp0zjtlNwml2r1E1eL1NQcVATNC_mgIgijzDkblQGgJSZU0Y6LzTglGmpu-fHOVo0tLD4m_n-cEP09TQbKrefXP0fVt_r1AWElu8XgYrWPyMqe-pMyP5iQYUtp7UULzfPp-zm4Uk6-BQkEa23dWKdjzBMi45JerjVgMsc3XerEzFEwsU0x76NQf2y-CvkBoCjGOkzQ6i5WWGRBkMnbIfJcRuPfsmIr_1ScVbpUaA6K7u5USdVZPqFVv7vXy7LnbPhb2W4jqU-8C_RAJGvtuhdbLfVnYw31Udqy9Izx4qEFZ4snOC7srJO81Jn_uN8v-KuYbsphpTisFdL0BSjdBTnXLPucxzxyLOt9pKI--Qpf0vnSVdrIgf03Ja2KFp7qe2ir5RAwSrXp2hFuonI7pJ4Tt5hqUrbDz6pKN97d3CFsppYWaSr7RX1jWPnaU7FHkt9vKHwg-yR7fIzbLpzYnxXiRQCw7Qo-HRVSWYZMHww4kgOE4biUQElhbSW9MbJbPW2Q5BSb6v1lauZd3BNc-vvLztmlIk9Rz5DFTn7TteUUSW5bbbZtv8CmLOnhhJjCMTIZHvziwuSX1OFpq_KtVu6SjFlbUpvAbVNV1BtKuEWADrFx8AHDGJKhJWJBSdhC_xBvy0JRo3G8aj7ag_OzDx7HLlqg8JGnP5q9soa5CcniT-6x9Ruz-gYPBSCRFsQRJEApAsJPd2DKGp6qSjI8easVHoTJsCde4eOrsNdR-YBA4wubYMvqVA99YuLgB9Bg-VHbZVq7avwBXlB1L9NC2hkepsIy7uix1fMHPhGyvoeMtgekhR_n1xooUdzABqJFGg2Ocx_mCzZMGbcmzqVmueoK-nNhv6Sh7A27tFoqB-iPie5zjR_mQJ0AsZC2-DUDyNauwmh3AYgNSHgAZZ233pkyf02euHfTDpqQf1tRe0MXrzNakSdADaRdN9b0LnJDi-AqCzOYIB_RxW0ZlRWMXvFdJC3keTc31PY9MuMEn4hIGeR7w1QvDgb6Vt7WCVpURfjxeiK6-T_Gqwy467TgUZpRZtR410Ea4fEWu8CNufgY9DVRbQvZlwzAkzs3Up8a_XqE5-NEACZlZFKaSpFaUZ7IXnzfPotVCyqupNniWGvWXw7LwGUT77Wf_2rjzMT-sv4OuXVWcK9bcoc1yLOKU2DxAq-UVajBJjh7y-L9h8W3dpq85iG7F7Y5B2YIf5bhJXsU7qq94Z2mN_-N7TugoBHME2X24xfpwaRNi133sXfQTKmIEl2VjYecdzby5e-mVHYAHk-NMRUSdR2DujmiVFsOEYpz9OQivHGH6RASuihpxyQHlOOLpLLb2jLon7djfDV_raLBc2hCCt8jK3VPlVYTbUNKdov7DGNBk1I-P24sTukK6qObSkT5jvGRvmAEVYcqBW3lKmxnuSUT6B13RekDC0-d643KTijLN33N-L80Sl4TwIn2F5tKuMrFGfhluIsz34m4AvNp3A_Syt7kDT0yjygtZzqq7MZrcqxulbabtSNKihI_AV462EuE4zuvlTHwOosgLMRRUSEJjJjQn8tnrrrkpTFpMN6lVg51KBWmor0DP4RLmQTgBAKTbA7uMSCTPoR8gq0k7eJpKm-eJbgORRqO_9wTkm6ioaqbPgZ7ZhBWGjBqgkymDv1m6c3Dd9_UEWXGMZKLM_zLs4lErV59u70qk2fRm3AlRTuMpawkbvYZjfInhpS_idm02vw62uf-kYo1lbWzjhFZvbE6SiWrztH6Rzzwsg-QQxTBRh_6qKmnRynBrmenuSM87SkuymVOAGi03SmCpRHkMY7203ca8-MH1vC35bx37jZrU_zTzkHCicU7NpZtYVZb2CosCNXMs9qfUNjVhA1tIcoyf1KP4z0nv3DVLe3883xNfkIpS8dQlGhj0A_PkpdZro5HgJaUUEnvOTQQBdTsfmlBiJ-NB2FGhdhLNoC-NICkfOWnzVyW8hsneGD9TExod3ilPbVSEfFzYdcnvbuXZfhHEwqkWKj-zy-1oTE6nxK7vYEWiHmMKy-kueZ4RMzJw2eLnyLBywzncnQ0c6Ugxelf4ZOO6JCPyYtSAX5vuqQGNVx-3zweRhPbCKmUeANCka1sri5jFRXoM1h6VGAPZxhChqauirTJXjBOYOyqvzo7OW3ZgzxQsUZ886RjIgzm7_3UinEGSGsflO4rtcGSf9b2qJnLvy-tZ9ubBewVuvPGqfKOfLoXaqNxpj6PeVB1_VJ6_OPhkoroZmWBpt6tqczrQY6ocxlyfjRt8fv24UoJXsLzzfVGwrpHUwU_A_mt0jCo2MyVfNAqgEiuj82TE94RB5d3jM93-4aCNmDpbWNMNKXH49OAUiSL9c-GFEmzRP8JWKc83XZs5Bj9Ts2Ole5lmCjnIWyvoDNr9eKtcsw2WUuC83TdUKDKqMocJRQ7w6m74iY2hKfEYABapsnNsqWP-rB6GoCMHpjcEm2Yof2giiZK9Fo-Tz1RkcUTUt3lV557mqpeXpv3jk592KsuOAW9sfqSWMu-xXX9gXI05hv9PitWBaUHyOjCGFWm5sPXdLW1JZJM6QNssYKRU21LQwLCvScXx4EYELOYmdwW0wnwef_6MOsUNYR4lOmOQG94URhneEKLE5B_jJhVD8sL_QAokm6lVcb1U5d-eQeii-0eJlpm3DBM-a5vo2ad8KD3Vyt3pAoSKPnN6j3rLwCIjJrtVTNGTPgqMwlmJDy7k9nUns7TCOOnL7Rg3tR8irms4Wi0Pj84sinw0i0EW6Bw_rREbe0WvEC8JZ83Hd2MfrIRxhbQoeuQllV9E67xMMr9rhs0jtmGghj8LWBzHsrNRBUdL4rnkx_-oJJfhu8yuchlYuXYl7ua73WPZnx3QY_sI3aFRYqpUGSDatWaQC1UfVH0mWzZRD9FCNnNB5Iru6wIvpjSDBZKzFJ6PbnRMhq6hMT5a1MZKnHw6_XmGaSnBGe-ST0rMhOtQiaPTVLiBJ7expDElXXndKTobigL2Pnil9Z089L0KMh1AFfw6w2ppzBfHtIYf6u9cV618ynO2zh7WcKLXdI0Ks4tPWc1gySaszAnjvHuvxyE8dtFQKqBjv8U6YJmqaZNCQZI3VFlRYSH8CeDLBMupb-04fLHjwp1MjMxeZyNzYI4Wd1xHOAUzyP5cNjcRUToRCfkzvn9XOduEeKt1QkwHnRQvVjGeIeoMFxNMmla2a8STE30RWIX79k9hpV9jZi4CXZ05mGiTYhxMqV28BsgG9mI_CgQyBXqrQ5CakO9rkI-muXV0VZiT-xt4aE3hhLyJDGRCHqetu_udPuhNDOoS2mDwG6AIbvrfJPf9dgddqa7_9HdqZIeSb35-qq0-zUKlkNUwQ1x5x61QNqb82KkOUYi_37I3K9uZ9Lqu8ZdQ8RsUDTVF3mDeIZYd1ANWG2ppEiTemUffosda63mnmWfh5Mf284OF19rOE5JN24wwixJYbbVrO-znlGtwS2ITbhQ-FXJtU59Qms_xikWSzYBzLJk4VhNMHLsZOlKmbNSBFYDxXjh-UscCBQXKofBssF3j6p3vRQZ80xH6Q3f-_M1RLy1ZVU76Ue2y2kA2IdsAyyb3FSLA7K5Zx0L3XXtGO7JDFnGzNAosgbN8OAUhwOcQWi5hbwrmMbp2OtLU2mHCGIkZjgilALjrN_hahsJAYz2u4x9o_LxJ6aiSc5awV872aIKRY2Wm3V2ulThHKTyK0gJHA9OuxHJX58FAKa6_F2SzU-skd6PDa-yyUKUi8Z326hkGIX5BlceZk3mEcg0GNZEgTScHrBrWAWZOjS8nbFp-yMRPNQ29v_OcRQyNDcwI2-Py4nNWFkPU4nIPXheRm3r7mlpWSWvvEa-aSI-xrPzUpUu254g2_UCr14DiNZGW6LObImpaTFgOLnap9QebJLEBUFwIwz5RtHllLdNWJx1-mHD6IHcX5hlw6roS8CwvHXLCrDh5B_30x7n2TwA2LyssuYD6mWWlYdJOtgI5AXIrJZRCwdyma3ojeMH_YWUTn-RVwmOyL_W23mZtdXE_vEVcOLA-lakAExYjETUYmEJAIv7ECx7YyfOOXIT1fnSVWcleirvbJvcrLr4Y3VSnar6Vp-CFS__42LhP7w4ZdhQl513xcUHZmd6mxwT7nmLkdJvOwUOrp0RfHaqWFFEw9040rQlTxR4hkBk7znYE8vGSos9hTbKGufIFB2OxcCndBR6NDuM1ZBSDKHdW177yzndJ707iJOst_CKb-ck7FeNBrAIYBkxKRSlM6aUTtZMhVcf7j8ymeHmfdT2kQqG8rN6lOWAUbtDSdnfb-SYpN5FR-R457HoTVZovYsYzlzMHpPeLeoObI-uWbDGWuAO1qmhBNfROs_4X0FWhCdpMZnEEHV52NwiRCAw6Gz_7vsO0R1Jh_1_cTXSUH1Tfgt58wqVWFhfH8lS41HJ9066icmJdHRv8Cx_8pKOYw54ZP9TEOMf2zLwPoJIpTP2jImdVgDQOQH40rn6BMrk_P-kwThTvxBQ9QXRMEWuZJCPWNjWR26qi4sHw_mWyM9_AwXMowCLhpALSuN7Dp6BIUNc-kVl7KBMPOd7d-qBHYUTaqa5TGztPVQckePw9Ds3HWVGmZmJELGDWXrYR2O9aGymycGF0yp_5-BCbG_eIH1LEDufuhSYWtrp5jsf14yBCJva32JQg9NgrVK-puZsFT4eiX91-evvN8ZyFDBiNPNBvHWoKoWaJPC4kpxY8G1BdcJ3GiRaWUTliyXW6m0ojrVKYNaWKrT0lfgJl1KbpWl3sI4EjGFz98epzZM40RuXaOIbH6nHi8nRqHVlsAFUGfqwnWarfkMkG0Sd1Q_0cBrzibjGpihNBKdpU3m1PRO-OzzoTl0v1Po48NF0IFlG6Yp1g0qmW-xpF9d9hrgntG51cMTlJsdGiIYQyBZkQ31gaGyLnCNEm9_Xpvj7S37ICgsTpp2b03v5s1ikqpT58hXDFwE2gr8Ai4DUv7Gupp6LNQ-SNlqlRVp0xs8qXb1-ZtX1c8nPzUNGptUx8WMUHD2G4yxan6Y09jEgZ8AAHrJOByLlNhhlJ6kmwKxohtFBTRTmrFec3k4hsWQwhZzrG3r743yctwpJBoDDod9tSVJf9CBrjfmmkRM-8MCGypNQW4_dRIskma6VTFeHvIbVnlMN47Wmyd_4QK6sy4wEcw0KxqVONoe26PNa-0NrX4Iky66DA3hslwM1xna22qTsHzz6RCWs-GtcjQsEU9j-QHhYfrkxHlbCLobwgx6Ax7c2Otv3LkkHPjhJ77i_HHNPVIxuFhW7U_4RBahJ5gPrrmTnQ0f8BJPyfxbS-GHJhlReFFIInnNHpoMoTW-s91-w_StRSazekwXiJEQdajlIOkBKhxsdUakGb3aEWx9fO24wdzy0mLFXHFfwCGFHvccdd8U0RNhrNlGs3o4PecJfJdecz7PxkwSjXLh1bETTRh-yDdhP3bIidVrgQ5xThOQAWFRONNZkW700qAmzzc_Seqe6R1WJJEqS31aeWGTML9G_rVQ9YriHa6ZzK9MN5q46wqGX8Nkot80fcf9eNhamgzv4PsWZFDKnXHDZSm8beH-yBZjJbWvYJacfH6MBOUJgA8DMr2gov_7IkyRPd3lCr5m4Bt4NRDIGfNB1ISPcQL9_P52vbbh1TKlIrXf7DbuV1j25sprVc25P89n_xW6yQYxpItJyjv3AQQ9ZFmwURoKcGXW7fdb6RsmRI4UO90YWs-1XoXMT8bxZjellznHT2sS5TYbIoUHKAfIU9jzRVY20gPxH4ul_KuOj_RDDCQtXRm5j_cuuUwyOUV0WAQH4oum-Rhhy2dlNGgxHh9eO2pXMZMoMoSq6hRVC5-V9qL4O86tRjVjoIW13wjEseg6Zhpo-fnPuHZn1u7NB7eKgIJ4UXqrL7zk8afsXmxrLIxWAS_OFOSRVw1MgscAL31iPL_pdKoGn60kM73moIuC-dExrKqymEjPikfHpVMgKso3ssXtBPbnIAKpsoFlZURbC86tpteySwUef9wLrbxO7T50hVQoET786LvetD8RjeBfTh8yudohhOOfqKK_TE8jHhI1YiZLxxRSAOtVoTmdmbBUzGQaTfhbtvZO4ennYcaGnFThtZyJk3T1H2vFfQrLFnCIHc2ru1IblI0RFMnfA1t5hVejPG7_QaIIBeW1PS6fQor_rVoBeWxljZOqzgGnaon8oFTtxm2hMnNPEteV9UovX419x0MPA35hkFcd4dUPB5idgqEok2Wy2ZNS1oYVnYGDPl4gWcZDvwW6oH3JkJu_1wyznT-URO8BqYajjxLf8zRY_cjqBQBYRvULYapoMLZT365ywMOLseforKQ8-rtACKBlh0yLb_WrM1o358I2TI0jopaJN5uXwv1NQM5r60mTIbORHXjTNLEohIGqFVscQGMlh_EV5Iwce6OfFu0IyBpHhuyILxiAYG7_TPaK3Y5nDbzUBZCojoPweidgO6A1Uu1u1LzKYMMj9bUDoQlgztRgWYsbfljdAKcU_d9GAEc6lAXxrCPfgwbbAbjxFCw6DiOXUEjeGjMQaNKmosomzUhLOa46Q6G2xy_s9vmDNiArXnI1axonIdvTkOS4cqq7ORRCNPh3BeScq8_8DBVZzvq22_hVhwAMT1vbIQNLIG-6QJ5exvILCKrFH5kJ5KnXT0z8PsiMaWKa7i_PacNPvLRuwphU6gpB3FQL1mL-hzPpOYm02YP47VSvt59yJLn3vcZePxUzz_5d4_thFtuFB1mgUmqVPLWIVAzcWP5IGiWlScUgIw5aw_HNDbTqadPqtglLQ-EgnZNa3--sRZw0A_51HLjCJTa7ru_T_BYuIRJ1NKgk1eCTegG2oJQJkpLTqXyIvkIBQDHzqeZm8jERSbPflhdd4FEI_n8wXP2H7UKyfEoSlC5QS2_46ubS3LiZdu3Pz5RfsOFd6_TgIOnme34kVtjCz757N1GzCceX6PjJNtGEnrAEx-v8UD7R6l31fmiNB0RK2jrp961ikkbwXI0bGU6_SfxpTGuRjltVWgCjSTDw45zI7jNS-Dlvm9gK1as_hUyDulqNzeMlWKHJTZ-QkVVfd39FEGeote1xIPgVkaN1moaBe9_c7ljA8lpL-5Xq1IJf1tC3AdmKvM70fObZm228k_slCvA6rdSceUDCMj40NV72hxUAvZ5IHh06EA18mAYUveCx3a2u7Qu9FtSUEHZRpWELU2OO6ZTGqmQsGkRguQDna1ZvtarzOdfKj6eqHpUBhuxLMWaA6QtmuSAha8Eb4oBqsBELp8NfaLxT2CH8FTUxLiPPaM-iWy7EmwXhcwTkyuGnOFuAjDRWo8LzyWH6KrhfnKhdiz47_bfG07srKTemcXPjWYRJpx61TE4cfGq6fj6aPk74tRLqYWii1XjMJisVhE1EHZtxvAtLmvpseN9p4sZi2HpZvD7RqtdH8AwWh0ToG8Xxpa1OT54YyQasUI89M3mGNKL6uuPNZeGu5LDy2Qxu7yDxafgYPgiYByVN0xnlrNoPNeT2QrN2G1k5wkFyQ6rYIfAb2wDJfCNeA4Tm1pUab1qpNdMlMBSdREu_iuwTfwMIAhkUNRQHWdGwoVJVsOHLlwmLB8DdAu8pf_bpN4j3yjWkCpi9WMZXr338exRRtNnlTXE3M60ZF3qOgy0CD-s4Ujpe498EKqyWXP2cqqqgw4J42nQeMsYXW2VXDt_u40okA9ZkjGZbKEqWJkSYAbdsoAc2D6PatIwQRJUt08Rerf1tQ4oWyo10smLL9MLhLlQ9zYljzHFAKevUOuW-tOlnaHl14ZlTQjGunxhTk6c5znjdzt_8eY85tqhyvdBSOBiTm6Fb4tDbV52sZrVVgJmRofYA4xAMcu8Yn1KNzjFGIo_6lb7F1WghBH6VoMzy0j0ad8sAnx-3P5FHTpeSfwwK9GNkbFZKyMprDpZe5tsm_MOzFXilVbTps_KmutIuwfi_7zAPPM-SXl5E0N5YiFeICziRV7RXg3Vcs2bU8_Np4o-Xo8D2ZNUEju2zDRSjH0l2dfC9PJ3S6udM3jluGrbVy4FTS0BqVMjf6bghYmo1KmQ6NpCWMKVX2hZZqCdpyKcB3NUnMebmocGhCCF9gJArkbIujFnodfXhyTJScZrnubNZwFM6uZcnQE2Arpoz8qviejGGOs1vcJY1tDHX9Xutxtrb_Y8M4uzAgg62X68_SrRBBEk3vY3-tp1D5gpNAND28NDv4IcGVpF2AhcXrb9X0cV3eriRZ-rIFDOfHOJXpmPQ0yVbbaRNk0RJ-NBBFFEDVsm6LvDvSQcQ_Ks9Z1Yvd1IPKscosLjqScrDGV7qvJc3j6fN4v76E9Tr3_ej35LMglcZs4XE_b2uKW4V1aOCbplbWzrwPa236QnbAo8uXGwj_n87Y8ZAX3hPK9gcFgtjhfgnsvj5POL3TfLiYAOAgFCBYIi7q9NRf7tnmGyDs2jL2vD5YEAUZUS88jRrE85tnQWefUDWFTJDaHrNwQMtTqRDhB7Nb6VDnU2sTshNAx7kl8xLh6Ib_ytx8nq9WZc4E8K6nN4Td5Rtg7IZybvHWePhYcnJlNu5uHfbW-gaXNaIjodKiWGxXeEWU9rtVOCWEBp3md4Oo6_VSRtwCXcn5TBwaz5_hBmXzUuzGhk2zRG76piJylae_31bQLC5i3O58Z2-NaEWAyuVmRkANKyd82n55AjXISgL3y-1xWB8feRan1cz8WHnVaYxaYA0JZ-hYXn-2D0cOjgKwA1Zms-_up8E47XHc0Y0H8O2mMahdSF1O_0b28DF-MjZ0kej8G4TzSSrdqr_MazT7p3F9U9MzgqhWUiQsRYwaJoD0ODyekiE-kkxz68s2PEfDX5Ucwy97pu4qbUEQRywn-NB0Y716bdBMy9ZU0YyXznQFf23JB6S6izFIdWQ5sql7FcBKwf2Q_tSdmgp-d77Rpok-OuzqJP0CfhImtC9rWgwdkd26AyOiEiXXi6LNxK3upJiuy9QnYRMVz8w6mH1OkpKwnvOnJcbWMNs0NzNT6heEtG5TNlI_7cxdj-Aq7wktOSh-upBabHVdGRHcnWYGTSY4Jn44GWKgUQkEEBRgc2jVRRK37Afyn5IspnkCpXeDuLcZbErnC5_vW1v3I4ONxSbyIO1fgN1om-wrjlU9rWcS_dN0THnmpYOFCNAoRWoENVt-XVbMEKYS22gjlC7AYxoRIu7v4F1lkybFnWiudIOTswC-sb4HYfJlJ_2P6SiVTFbdLz0fz8dEC6w7QsTmIoaQqCSs38QZpeGJBFotRf-ZDpO8qwSDRGwl-FGvHxUTPbdSayybvQwZ08vGd0KIt6twpwM9LUSdgmuLlhAjh8xNdQYeKle4JB85tgKKxEIZHUfsGawk-4GtWec91ppYTywLpNmx9DO75HJDSahriLAhz4Z1qnrEJA2aCVhadb4BxPeMmJR0NEuj7Yo61LIzLjJpM3eus24ZK-dkhV96XX93SfoojAVRQB58WHcgfC0u29Jal62jtXrHgzcaZaWSdT99NQFu6nNIhquF1hw7wt_4OZOcNxVioEv7IUvLDchAR34_j7cwx06ogkBwdoISaoifEA1rKa7p5vyspt5QSFqhpK3KNEslU2X413FoIVFtG1oTkW8m1pQgZpYcLNc0cQLbJfdzcVT03a9zBAsP8-v2qnJCjd0d91FYJEhbvAGpCb3FpZruVrrHibOK_EFQFBDusuHEVqfPB1KABPY3pTDoRguz_OPQQDiI1Edx3x077lL59l2jVCzdZfa87rK-dbOP2BfhIXYzx1XvU8TkkuPrSbgY0dXkhh5F7YPVJIGoVmBx_jhisYk5m9s_kP7IQORvMgK-dgaqRDI4eB8JEoiUXjsTL7BxL7oGjYQFbR4ScV7FyFqJJ1MRsrVZIWXLJCBvZtyQabD6Cm0rOHEVkAG7T3i_AInlnbDWeU3E3ZX2YcU3gLonoF6uQAC5PQoeJtpNUVm-iXBvMFn0N4UCKuPzSKjxYc8W2gJ4YNuHzMEqmAN02lW2aRCqXjxY9IHRJ1PvTaEKgibnGS4vAyUVq-hyOk8cexAxZN47N1_9_Ui3b3Zk2q8y_G7f3ZAhposu0kRjGUCzoGMhUAwU5tMoPRZC5UfZcUj13V1r4WVysQyPF5lY2wWpfj0wmzQo98Hzza3xK-O0lV1FraWwxC4BI-88mos0j5CmWVkT9xMu6FTlCKzO_QuZmMsBi1qeQYyQpjBkK74Sq9SfjbUb1BW9j55zcJq2KUN3Agcwb9W8V7Yzw5DL5dYXyOkDzHWCUA9jTfQC5YRnN7LRaFBSOmRNDuFXVQhkpTOXXQ9htErU-uztlPsAtzPTimPISNy0Tgx47hgnPiblkFfHqQti55bQlGgnfr8WE4XHfbhj_Xlm9hQZS8R5zclLq7ySFuY54U4jeBEyH4l9a56m9OofghV9pQWU8vMfc8J8XcQQ13WZPO4ze79rzFjV8mUjSKY_NcKP3QoQ1PoCQNaEVZRzViV4gUZJw_Bhnj7u_UaqmIBaDW4DQqL97Gwvyz_HIBWvvjCRPPgE3WDMVJ6L3xsitgQB2bmOmhxSQ5JPWSYbdqGq9a0qYaa2l7uS-zcf0Rfn2ZmfhT5YRYthBsDcJvnaiFtjSJgF2OA9odbJoqgEqHJKmJdTTz2sjrkNl9bdVUyw4Ch6C63fYFZEZFhcAoCjs9nE5rFd9hA0Wn0DFZcFsBbcJ5weMLzWVPcPLLoNbgjw6qCw67XjrRVawWgd-dmgqQh0SKMLG7fSG3DYCDZXBs8I3hxWWbB0t_sGvilJLb9Ly-G-KhLFjB1B-Wzze3IHqYsfToNAqpFAGvl-n5LeFzzADVmIHUscGUohJI5e61Uu-urIgRwpmn6-EUGyew0BZDeL2YJUT34UGftiYD2NJAQF-0IM-iZ1A37lbrCynh6rXdGghZhkuSEeyeHMY_XvrZ_tLby0PROhiXSeJVYQeVwHo51lxOJOKVAwQ2unYjlNMivVDRYHkZZi4VVvcpy70bVOD0XevKAg0Osx6Xs3z4rS-yzU3v6cggr_HUX5ftoePC_UcrIhQRtoRVQwU1hNnghP3WR0sDG8mRCz5Hc18MR1N4HrIbmp353aoJeTsORLAhQPJDGUVP9RRYc2cvpLXszVlSRpuQSE6fwHl5_Sgu19Ps_JEhif-wLgKt0v8-3Lhx_taVqBY4z3l_1Qa0_ETMr6Jz61NbmBjTnZ3dltwy6bLzIW0pb7pXmLrQQ-Mr4e-_DAAl4cNRHVxdDNjeyi4VMZH6XCMGh17r2vsAnzG_5d5qtUU7sinXY4z-V_29Brwc23jzkk1A7GoO_OZ31B1l9MdB7Bm1lSpVC854l6AROtOTsmdZ2y5U9dELRYq1SJuc9UqnRXQuCkj-Ckh7WpEP6L9X_D68IfdJ7Ruwqjvym4GFXagCOrTSm2auxo-WTu2PNB8ibrs15Zq-rskVbeWug6OjGChqjhUBNGK4crSDc7uDWoi0alu7cxf_oVTZA8QYpzdXBWjnlTk3ogaU6GY5iYZOI3GROy_ytnEsbtMiTEZals-AvjLYGpQczgTfZ6HKYdaQMUT3Z_fxKYPHaGkN4REfnzxUqn6Oeo_dkcHce9SWYhc1EK0sQOeruNQgS5qbcac32fEdoAdzIL7meGPNDmTHkcuAq0iZv5Rwk_vuhreBa5YhdDS-MCI0qEZTbZ-cPzSqKz0SaDV2yDT-GfImaJVIZKXIR7zqRhAP-NobfwLfHoUevlGoufLyEk_F15svBMJLLBWLXbvGDolp1bhjhg4sjvGSgrwJvSOqKg_zZWzTnlyiH_VhGnioF7bfg3c2FW4HgNEmRQXnjGagEzVm2WRN-DF0yHKQuy6BUNNt69LZeC0e5KWPJiVmky8rnJF0QYen2QJcmd9qttwx0Sz9vXAsnDGIRBN9Jno3G-u_mKIwxorkahEKL8u4Lq8",    "e": {        "dd": 1778219998657,   // 设备时间戳 (ms), 即指纹采集时间        "device_id": "c2a88145-b110-31f7-b034-d8b42786844a",  // 设备 UUID, 跨请求不变        "kk": "CE65F4E2D70C2B48E869BF712E1574C4",  // 完整性校验哈希 (MD5), 对应 x302        "now": 1778220001118,  // 请求发起时间戳 (ms), 通常比 dd 晚 1-2 秒        "rr": "0",  // 预留字段, 固定为 "0"        "sid": "session.1778149057347685101536",  // 会话 ID, 格式 session.<timestamp>        "tt": "MEYCIQDS/VBMwGMPNKX14sdePbMeTx7MojyQc9JcMbTSSaK62gIhAICFkZu1ysGQUE4EzGymicc3heb0yStShhE6E0L2gMXI",  // ECDSA 签名 (ASN.1 DER), 对应 x303        "uid": "68529ca9000000001d0099d1",  // 用户 ID (24 字符 hex)        "vv": 1   // 版本标识, 固定为 1    },    "g": "7c8f82689eba549d1ca466eff097d287a8248d294735998677b2d849",    "k": "e7ccb8795a4fefd2828bcb5df67f5153b6d7c32dff5345ef1d418f1cb67c7431",    "p": "a",    "s": "cfb67fedd3ae5b28bbcd77ea377904904da66a0360ca295f2bec5905a63676daba3dcebc00ddee205cef2a85af720844b1db9e51b842473477ff26ea140b229a",    "u": "0000000077911a7adadc60c1d3b19f59dfe0bd82",    "v": "2.9.63"    // SDK 版本号}

g: 设备唯一标识 (GID), SHA256 截断

k: X25519 ECDH 客户端公钥 (32字节)

p: 平台标识: a=Android, i=iOS

s: 请求签名 (x-mini-sig), 64字节

u: 用户 ID (UID)

这里主要是分析d这个密文是什么，这里它的加密流程跟mini-mua的过程一样，key、iv也一样

总上传：

{  "x0": "com.xingin.xhs",  "x1": "9.24.0",  "x10": "google/oriole/oriole:13/TQ3A.230901.001.C2/10753682:user/release-keys",  "x100": "0",  "x102": "0",  "x103": "Samsung S.LSI Vendor RIL V2.3 Build 2023-09-02 02:30:35",  "x104": "c4e07d6bafb78d45ca0960bdfa734cce35c4ccc89c777b1758e12700fe9a8dd1",  "x105": "Your_new_adventure.ogg",  "x11": "abfarm-release-2004-0177",  "x110": "aa132d61-c2c0-4380-acc7-8afae8ebc8b",  "x112": [    "10.13.168.132",    "10.13.200.132",    "10.177.20.4",    "10.177.20.5"  ],  "x113": true,  "x114": 90.0,  "x115": "2.9.63",  "x118": "running",  "x12": "TQ3A.230901.001.C2",  "x120": "0",  "x122": "1",  "x123": "Dalvik/2.1.0 (Linux; U; Android 13; Pixel 6 Build/TQ3A.230901.001.C2)",  "x125": 2836229131,  "x126": [    "/apex/com.android.adservices/javalib/framework-adservices.jar",    "/apex/com.android.adservices/javalib/framework-sdksandbox.jar",    "/apex/com.android.appsearch/javalib/framework-appsearch.jar",    "/apex/com.android.art/javalib/bouncycastle.jar",    "/apex/com.android.art/javalib/core-libart.jar",    "/apex/com.android.art/javalib/core-oj.jar",    "/apex/com.android.art/javalib/okhttp.jar",    "/apex/com.android.btservices/javalib/framework-bluetooth.jar",    "/apex/com.android.conscrypt/javalib/conscrypt.jar",    "/apex/com.android.i18n/javalib/core-icu4j.jar",    "/apex/com.android.ipsec/javalib/android.net.ipsec.ike.jar",    "/apex/com.android.media/javalib/updatable-media.jar",    "/apex/com.android.mediaprovider/javalib/framework-mediaprovider.jar",    "/apex/com.android.ondevicepersonalization/javalib/framework-ondevicepersonalization.jar",    "/apex/com.android.os.statsd/javalib/framework-statsd.jar",    "/apex/com.android.permission/javalib/framework-permission-s.jar",    "/apex/com.android.permission/javalib/framework-permission.jar",    "/apex/com.android.scheduling/javalib/framework-scheduling.jar",    "/apex/com.android.sdkext/javalib/framework-sdkextensions.jar",    "/apex/com.android.tethering/javalib/framework-connectivity-t.jar",    "/apex/com.android.tethering/javalib/framework-connectivity.jar",    "/apex/com.android.tethering/javalib/framework-tethering.jar",    "/apex/com.android.uwb/javalib/framework-uwb.jar",    "/apex/com.android.wifi/javalib/framework-wifi.jar",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes10.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes11.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes12.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes13.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes14.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes15.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes16.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes17.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes18.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes19.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes2.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes20.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes21.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes22.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes3.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes4.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes5.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes6.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes7.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes8.dex",    "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk!classes9.dex",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1001476499.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1131303526.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1167019547.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1238062830.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1366317582.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1373327367.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1392203253.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1457279863.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1524060168.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1879068706.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1949717394.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@1993886551.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@2446349231.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@2516408359.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@2750046593.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@3401470314.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@3714797707.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@408048806.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@4255730826.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@575889714.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@694965025.jar",    "/data/user/0/com.xingin.xhs/Anonymous-DexFile@814372062.jar",    "/data/user/0/com.xingin.xhs/app_cache/c4d121c215evx1s51d.dex",    "/data/user/0/com.xingin.xhs/app_petal/animation_widgets/9240.84.1/animation_widgets-9240811.apk",    "/data/user/0/com.xingin.xhs/app_petal/antom/9240.89.1/antom-9240811.apk",    "/data/user/0/com.xingin.xhs/app_petal/dev_tool_plugin/9240.84.1/dev_tool_plugin-9240811.apk",    "/data/user/0/com.xingin.xhs/app_petal/dingding_proxy/9240.88.1/dingding_proxy-9240811.apk",    "/data/user/0/com.xingin.xhs/app_petal/hey/9240.84.1/hey-9240811.apk",    "/data/user/0/com.xingin.xhs/app_petal/map_gaode/9240.86.1/map_gaode-9240811.apk",    "/data/user/0/com.xingin.xhs/app_petal/redscanner/9240.84.1/redscanner-9240811.apk",    "/data/user/0/com.xingin.xhs/app_petal/xymap/9240.84.1/xymap-9240811.apk",    "/data/user/0/com.xingin.xhs/app_xy_robust/9240811/4/X64/9240811-4-patch.apk",    "/data/user/0/com.xingin.xhs/app_xy_robust/9240811/8/X64/9240811-8-patch.apk",    "/system/framework/ext.jar",    "/system/framework/framework-graphics.jar",    "/system/framework/framework.jar",    "/system/framework/framework.jar!classes2.dex",    "/system/framework/framework.jar!classes3.dex",    "/system/framework/framework.jar!classes4.dex",    "/system/framework/ims-common.jar",    "/system/framework/telephony-common.jar",    "/system/framework/voip-common.jar",    "Anonymous-DexFile@1605196164",    "Anonymous-DexFile@207971884",    "Anonymous-DexFile@2272611152",    "Anonymous-DexFile@3019821854!classes3.dex",    "Anonymous-DexFile@3019821854!classes5.dex",    "Anonymous-DexFile@3096405338",    "Anonymous-DexFile@4275122275"  ],  "x127": ".",  "x128": "config: mcc454-mnc12-b+zh+Hans+CN-ldltr-sw411dp-w411dp-h842dp-normal-long-notround-widecg-highdr-port-night-420dpi-finger-keysexposed-nokeys-navhidden-nonav-2209x1080-v33\nabi: arm64-v8a,armeabi-v7a,armeabi\n",  "x129": "Cannot bind netlink socket: Permission denied\n",  "x13": "release-keys",  "x131": "0",  "x135": {    "1": "D0A6434F1A804AA847205FCC7577C4CB",    "7": "1CB30AAA8213C8A4F92B6C3A1BB52B85"  },  "x136": "1",  "x137": "2B5B8058A71980B71CC29053DDB755F6",  "x138": "AD733CD1696F6AF0D5807C5361BA7CC4",  "x14": "user",  "x143": "520C5CADC78FF706950762279995A50F",  "x144": [    "google/oriole/oriole:13/TQ3A.230901.001.C2/10753682:user/release-keys",    "google/oriole/oriole:13/TQ3A.230901.001.C2/10753682:user/release-keys",    "google/oriole/oriole:13/TQ3A.230901.001.C2/10753682:user/release-keys",    "google/oriole/oriole:13/TQ3A.230901.001.C2/10753682:user/release-keys",    "google/oriole/oriole:13/TQ3A.230901.001.C2/10753682:user/release-keys"  ],  "x145": {    "com.xingin.xhs": "7c8f82689eba549d1ca466eff097d287a8248d294735998677b2d849"  },  "x146": "7c8f82689eba549d1ca466eff097d287a8248d294735998677b2d849",  "x15": "10753682",  "x16": "13",  "x165": {    "1": "1778220000837398546-129-65066-0000fe2a00000000-4076150800",    "10": "1778220005157398548-11826252-18-0000000000000000-16914836",    "11": "1778219998777398545-11799826-18-0000000000000000-16914836",    "12": "1230768000000000000-46-65030-0000000000000000-1702057286",    "2": "1778219995009398543-1-52-0000000000000000-16914836",    "4": "1777877906247033951-1099-65066-0000fe2a00000000-4076150800",    "6": "1778213497029395371-3853-65066-0000fe2a00000000-4076150800",    "7": "1777893234948000000-273-16-0000000000000000-16914836",    "9": "1777893234948000000-155-16-0000000000000000-16914836"  },  "x17": 33,  "x18": "2023-09-01",  "x180": "7e288ef3-48ad-4d69-8e20-43a28279c137",  "x185": "IiGgSsKkCVvEePp",  "x186": -1,  "x187": -1,  "x189": "1777877906247033951-1099-65066-0000fe2a00000000-4076150800",  "x19": "oriole",  "x193": {    "0": "ims",    "1": ""  },  "x194": "1",  "x198": {    "com.xingin.xhs.index.v2.IndexActivityV2": [      "android"    ]  },  "x199": "[]",  "x2": 9240811,  "x20": "google",  "x202": "1",  "x203": "1",  "x205": {    "x3": "1DBC5CCC5C7E78CC14E300CF9838267B40CE0847"  },  "x206": 0,  "x207": 0,  "x208": {    "c": 312,    "d": 4,    "f": 0,    "s": 4098,    "t": 96730950,    "tt": [      1    ]  },  "x209": "unknown",  "x21": "arm64-v8a,armeabi-v7a,armeabi",  "x210": "TQ3A.230901.001.C2",  "x213": "locked",  "x214": "green",  "x215": "enforcing",  "x22": "oriole",  "x226": "Cannot bind netlink socket: Permission denied\n",  "x227": [    "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US",    "CN=DNSPod TLS RSA CA 2025, O=\"DNSPod, Inc.\", C=CN",    "CN=*.xiaohongshu.com, O=行吟信息科技（上海）有限公司, ST=上海市, C=CN",    "unknown",    "CN=*.askdiandian.com"  ],  "x228": [],  "x23": "Google",  "x230": [    {      "a": true,      "d": "a718a782d34bc767f4689c232d64d527998ea7fd",      "e": false,      "k": 2,      "n": "Virtual",      "pi": 0,      "s": "0x301",      "v": true,      "vi": 0    },    {      "a": true,      "d": "b7b9c5afc0b05e8bbf15d2ca5b330d3bc3d421d4",      "e": false,      "k": 1,      "n": "goodix_fingerprint",      "pi": 0,      "s": "0x101",      "v": false,      "vi": 0    },    {      "a": true,      "d": "485d69228e24f5e46da1598745890b214130dbc4",      "e": false,      "k": 1,      "n": "gpio_keys",      "pi": 1,      "s": "0x101",      "v": false,      "vi": 1    },    {      "a": true,      "d": "fd5f142920b1e837e5309578d75f66c4a6dfac18",      "e": false,      "k": 0,      "n": "fts",      "pi": 2,      "s": "0x1002",      "v": false,      "vi": 1    }  ],  "x231": 118396899328,  "x232": 118396899328,  "x234": {    "1": 1763286961761,    "2": 1763286951020,    "3": 1763286950944  },  "x235": 4262000,  "x236": 69230530560,  "x237": 69230530560,  "x238": "cn",  "x239": true,  "x24": "Pixel 6",  "x240": {    "wlan0": [      {        "i": "10.181.152.253",        "m": "a8:d4:e0:08:c1:0e"      }    ]  },  "x241": {    "1": "F60A57A73D63FE64E320D0A0456E909B",    "10": "C70E2F7857E5E43962DB39679CB0413E",    "11": "C5E7AA60157EAD517D1E5BD6DD414C37",    "12": "E8E6985E93F33782EFBAEF667599DB36",    "2": "B5CABC988DB65E49FC0040A2E2F61CFA",    "3": "E58C306E58272ACDC0A10260DB5EC978",    "4": "49159E6C11FCA8F50B748125F1305082",    "5": "088588D4E471C9ACEA8874B20F00CB48",    "6": "3881C7CE1B1B32BB4C8329E6CC35D9B8",    "7": "64DD85F19A9BEFEF80D154E8BE6E47C6",    "8": "9F2D0C0B6D427BBF0DC1D83C8A3B98AA",    "9": "E0F0109218283D54DC5005960A64145A"  },  "x242": [],  "x243": 1778219998657,  "x244": 0,  "x247": {    "0": 14.285714285714286,    "1": 0.0,    "2": 0.0,    "3": 0.0,    "4": 14.285714285714286,    "5": 0.0  },  "x248": "{\"BOARD\":\"oriole\",\"SOC_MANUFACTURER\":\"Google\",\"CPU_ABI2\":\"\",\"HOST\":\"abfarm-release-2004-0177\",\"IS_TREBLE_ENABLED\":true,\"SUPPORTED_64_BIT_ABIS\":[\"arm64-v8a\"],\"CPU_ABI\":\"arm64-v8a\",\"PERMISSIONS_REVIEW_REQUIRED\":true,\"IS_USERDEBUG\":false,\"DISPLAY\":\"TQ3A.230901.001.C2\",\"HW_TIMEOUT_MULTIPLIER\":1,\"IS_ARC\":false,\"SUPPORTED_ABIS\":[\"arm64-v8a\",\"armeabi-v7a\",\"armeabi\"],\"FINGERPRINT\":\"google/oriole/oriole:13/TQ3A.230901.001.C2/10753682:user/release-keys\",\"PRODUCT\":\"oriole\",\"ID\":\"TQ3A.230901.001.C2\",\"SOC_MODEL\":\"Tensor\",\"TYPE\":\"user\",\"SERIAL\":\"unknown\",\"Partition\":{\"PARTITION_NAME_OEM\":\"oem\",\"PARTITION_NAME_ODM\":\"odm\",\"PARTITION_NAME_SYSTEM\":\"system\",\"PARTITION_NAME_PRODUCT\":\"product\",\"PARTITION_NAME_SYSTEM_EXT\":\"system_ext\",\"PARTITION_NAME_VENDOR\":\"vendor\",\"PARTITION_NAME_BOOTIMAGE\":\"bootimage\"},\"IS_ENG\":false,\"DEVICE\":\"oriole\",\"ODM_SKU\":\"GB7N6\",\"TIME\":1693618695000,\"IS_USER\":true,\"MODEL\":\"Pixel 6\",\"MANUFACTURER\":\"Google\",\"USER\":\"android-build\",\"BRAND\":\"google\",\"VERSION_CODES\":{\"LOLLIPOP_MR1\":22,\"CUPCAKE\":3,\"JELLY_BEAN_MR1\":17,\"JELLY_BEAN_MR2\":18,\"JELLY_BEAN\":16,\"L\":21,\"N_MR1\":25,\"M\":23,\"TIRAMISU\":33,\"N\":24,\"BASE\":1,\"O\":26,\"P\":28,\"Q\":29,\"R\":30,\"S\":31,\"HONEYCOMB_MR2\":13,\"HONEYCOMB_MR1\":12,\"FROYO\":8,\"ECLAIR_0_1\":6,\"KITKAT_WATCH\":20,\"CUR_DEVELOPMENT\":10000,\"DONUT\":4,\"GINGERBREAD_MR1\":10,\"BASE_1_1\":2,\"ICE_CREAM_SANDWICH_MR1\":15,\"LOLLIPOP\":21,\"ECLAIR_MR1\":7,\"ECLAIR\":5,\"KITKAT\":19,\"S_V2\":32,\"O_MR1\":27,\"HONEYCOMB\":11,\"ICE_CREAM_SANDWICH\":14,\"GINGERBREAD\":9},\"SUPPORTED_32_BIT_ABIS\":[\"armeabi-v7a\",\"armeabi\"],\"HARDWARE\":\"oriole\",\"IS_DEBUGGABLE\":false,\"BOOTLOADER\":\"slider-16.3-13642543\",\"VERSION\":{\"ALL_CODENAMES\":[\"REL\"],\"ACTIVE_CODENAMES\":[],\"MIN_SUPPORTED_TARGET_SDK_INT\":23,\"RESOURCES_SDK_INT\":33,\"SECURITY_PATCH\":\"2023-09-01\",\"BASE_OS\":\"\",\"RELEASE\":\"13\",\"MEDIA_PERFORMANCE_CLASS\":31,\"CODENAME\":\"REL\",\"RELEASE_OR_CODENAME\":\"13\",\"RELEASE_OR_PREVIEW_DISPLAY\":\"13\",\"KNOWN_CODENAMES\":[\"HoneycombMr1\",\"HoneycombMr2\",\"Lollipop\",\"Kitkat\",\"Tiramisu\",\"Gingerbread\",\"Cupcake\",\"IceCreamSandwichMr1\",\"JellyBean\",\"IceCreamSandwich\",\"LollipopMr1\",\"M\",\"N\",\"O\",\"P\",\"Q\",\"R\",\"S\",\"Sv2\",\"Base\",\"NMr1\",\"OMr1\",\"JellyBeanMr1\",\"JellyBeanMr2\",\"Donut\",\"Froyo\",\"GingerbreadMr1\",\"EclairMr1\",\"Honeycomb\",\"Eclair01\",\"KitkatWatch\",\"Base11\",\"Eclair\"],\"SDK_INT\":33,\"PREVIEW_SDK_FINGERPRINT\":\"REL\",\"DEVICE_INITIAL_SDK_INT\":31,\"PREVIEW_SDK_INT\":0,\"SDK\":\"33\",\"INCREMENTAL\":\"10753682\"},\"RADIO\":\"unknown\",\"TAG\":\"Build\",\"UNKNOWN\":\"unknown\",\"IS_EMULATOR\":false,\"SKU\":\"GB7N6\",\"TAGS\":\"release-keys\"}",  "x249": "com.xingin.xhs",  "x25": "oriole",  "x251": "",  "x256": "Linux localhost 5.10.157-android13-4-00003-g776d0a76f6aa-ab10208116 #1 SMP PREEMPT Thu May 25 12:11:12 UTC 2023 aarch64 Toybox\n",  "x258": 1,  "x259": 1,  "x26": "aarch64",  "x260": 1778220045352,  "x261": 1,  "x263": 0,  "x264": 0,  "x265": "78:32",  "x266": 1778164075590,  "x267": 1,  "x268": 0,  "x269": 1230768000000,  "x27": "5.10.157-android13-4-00003-g776d0a76f6aa-ab10208116",  "x272": 0,  "x273": "0",  "x274": {    "c": [      {        "k": "MIICIjCCAaigAwIBAgIRAISp0Cl7DrWK5/8OgN52BgUwCgYIKoZIzj0EAwMwUjEcMBoGA1UEAwwTS2V5IEF0dGVzdGF0aW9uIENBMTEQMA4GA1UECwwHQW5kcm9pZDETMBEGA1UECgwKR29vZ2xlIExMQzELMAkGA1UEBhMCVVMwHhcNMjUwNzE3MjIzMjE4WhcNMzUwNzE1MjIzMjE4WjBSMRwwGgYDVQQDDBNLZXkgQXR0ZXN0YXRpb24gQ0ExMRAwDgYDVQQLDAdBbmRyb2lkMRMwEQYDVQQKDApHb29nbGUgTExDMQswCQYDVQQGEwJVUzB2MBAGByqGSM49AgEGBSuBBAAiA2IABCPaI3FO3z5bBQo8cuiEas4HjqCtG/mLFfRT0MsIssPBEEU5Cfbt6sH5yOAxqEi5QagpU1yX4HwnGb7OtBYpDTB57uH5Eczm34A5FNijV3s0/f0UPl7zbJcTx6xwqMIRq6NCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFFIyuyz7RkOb3NaBqQ5lZuA0QepAMAoGCCqGSM49BAMDA2gAMGUCMETfjPO/HwqReR2CS7p0ZWoD/LHs6hDi422opifHEUaYLxwGlT9SLdjkVpz0UUOR5wIxAIoGyxGKRHVTpqpGRFiJtQEOOTp/+s1GcxeYuR2zh/80lQyu9vAFCj6E4AXc+osmRg=="      },      {        "k": "MIICZjCCAeugAwIBAgIRAJJCUBkZA+O6ZTIO/WoghfswCgYIKoZIzj0EAwMwUjEcMBoGA1UEAwwTS2V5IEF0dGVzdGF0aW9uIENBMTEQMA4GA1UECwwHQW5kcm9pZDETMBEGA1UECgwKR29vZ2xlIExMQzELMAkGA1UEBhMCVVMwHhcNMjYwMjA5MTk1OTE4WhcNMjkwMjA4MTk1OTE4WjApMRMwEQYDVQQKEwpHb29nbGUgTExDMRIwEAYDVQQDEwlEcm9pZCBDQTIwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARC/mEw6jlnw7u6Y3iPUoD+niBmQFeHqMWXxFO+uTvgfD3YGRzTqP8Z2XPFg6PFuS1cAmLULwQWegHx10nmqBn7u0IgjwDxFCQRV1oAGLDqvOxBNS5j/oYHAn9qyT+vsLWjga0wgaowHwYDVR0jBBgwFoAUUjK7LPtGQ5vc1oGpDmVm4DRB6kAwRwYDVR0fBEAwPjA8oDqgOIY2aHR0cHM6Ly9hbmRyb2lkLmdvb2dsZWFwaXMuY29tL2F0dGVzdGF0aW9uL2tleV9jYTEuY3JsMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUzMpQhkxr20oG6qXsTCtLYmzbXZMwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNpADBmAjEA9NvAWPq1mST9Uj/1NzxJOcBNWj3lBKBS0ww1CsdIx17MPWJV9+LsbjeSz6QYc1SOAjEAsBfNai09FaG9SgfRCCk3UDT9scDP7+DYqvoQMTGR4/68u32l2b1oEkEukrwYXHsi"      },      {        "k": "MIIC7zCCAnWgAwIBAgITH5G9DqIpJhqVHUIDbl7wTM2lwDAKBggqhkjOPQQDAzApMRMwEQYDVQQKEwpHb29nbGUgTExDMRIwEAYDVQQDEwlEcm9pZCBDQTIwHhcNMjYwNTA1MTgzNDI1WhcNMjYwNzE0MTgzNDI0WjApMRMwEQYDVQQKEwpHb29nbGUgTExDMRIwEAYDVQQDEwlEcm9pZCBDQTMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQelZgbORheh3PfygvTU0Elw3SG53N3+28VfZjnHmWg3XjmGX83RgRQkIEzTKI+WiLz/BXHn3IKrOkpNJnSgU1/o4IBejCCAXYwDgYDVR0PAQH/BAQDAgIEMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMCKnR5JGd8MEwWv+4SalgteZwwPMB8GA1UdIwQYMBaAFMzKUIZMa9tKBuql7EwrS2Js212TMIGNBggrBgEFBQcBAQSBgDB+MHwGCCsGAQUFBzAChnBodHRwOi8vcHJpdmF0ZWNhLWNvbnRlbnQtNjk4ZTEwYTktMDAwMC0yMjc2LWJkMTAtODgzZDI0ZjJlNjdjLnN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vZmNmY2I2NTgxZDI3MzlkZDEzNmEvY2EuY3J0MIGCBgNVHR8EezB5MHegdaBzhnFodHRwOi8vcHJpdmF0ZWNhLWNvbnRlbnQtNjk4ZTEwYTktMDAwMC0yMjc2LWJkMTAtODgzZDI0ZjJlNjdjLnN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vZmNmY2I2NTgxZDI3MzlkZDEzNmEvY3JsLmNybDAKBggqhkjOPQQDAwNoADBlAjEAh8dS10VkzJxVVZm0RVyFWfWIda2PDcA9QDJefvm9HSqAmYK1tJlV18yS3R8e0By2AjAWQSLoeLhjkvUWR3p/0N8Hq2+KvGcdlPOLGp+cKZ3Y+JRNslj4rQwGcOZsNFeO3po="      },      {        "k": "MIIB2TCCAX6gAwIBAgIRAKu3UKam+x8HZRtK+1fmdBowCgYIKoZIzj0EAwIwKTETMBEGA1UEChMKR29vZ2xlIExMQzESMBAGA1UEAxMJRHJvaWQgQ0EzMB4XDTI2MDUwNDA3NDYzNVoXDTI2MDUxNjIxMjQyMVowOTEMMAoGA1UEChMDVEVFMSkwJwYDVQQDEyBhYmI3NTBhNmE2ZmIxZjA3NjUxYjRhZmI1N2U2NzQxYTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLTeR6n2mQDeUUWtmU9Ex4lJwlVCr7hLuu12by6D6ihYgmni8IozJtUp+uauHiBOwCmI3jDKrYPuXm8k67wi+lKjdzB1MB0GA1UdDgQWBBSCZe1Nl2/owvgl4lAwbq0TFuGaZDAfBgNVHSMEGDAWgBTAip0eSRnfDBMFr/uEmpYLXmcMDzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwICBDASBgorBgEEAdZ5AgEeBAShARhAMAoGCCqGSM49BAMCA0kAMEYCIQC7H8M9hqBAhXguP9DNrrOZqkYq3jDUKrHO+VZYHJ6wjAIhAOtOOMut2FOvbfaQftXcBb0FFKp2snQodzOpzZuHKit5"      },      {        "k": "MIIC7TCCApSgAwIBAgIBATAKBggqhkjOPQQDAjA5MQwwCgYDVQQKEwNURUUxKTAnBgNVBAMTIGFiYjc1MGE2YTZmYjFmMDc2NTFiNGFmYjU3ZTY3NDFhMB4XDTI2MDUwNzEwMTQxNloXDTQ4MDEwMTAwMDAwMFowHzEdMBsGA1UEAxMUQW5kcm9pZCBLZXlzdG9yZSBLZXkwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAASvDW9r736MaiStUgJX7VlMYbQOEVNmDtwfcu1ntGMJzTtmgfTn14JFTQewmUHk+Tp84dVBjIa4QxG5gluEoKxco4IBpTCCAaEwDgYDVR0PAQH/BAQDAgeAMIIBjQYKKwYBBAHWeQIBEQSCAX0wggF5AgIBkAoBAQICAZAKAQEEMjE3NzgxNDg4NTQxMDdfYzJhODgxNDUtYjExMC0zMWY3LWIwMzQtZDhiNDI3ODY4NDRhBAAwUr+FPQgCBgGeAe5RS7+FRUIEQDA+MRgwFgQOY29tLnhpbmdpbi54aHMCBACNAOsxIgQg83Xw9q98lMNks1zW9qZtZK765m4y+TW0h3PA+q0EwSEwgd6hBTEDAgECogMCAQOjBAICAQClBTEDAgEEqgMCAQG/g3cCBQC/hT4DAgEAv4VATDBKBCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAAoBAgQgxOB9a6+3jUXKCWC9+nNMzjXEzMicd3sXWOEnAP6ajdG/hUEFAgMB+9C/hUIFAgMDFkW/hUYIBAZnb29nbGW/hUcIBAZvcmlvbGW/hUgIBAZvcmlvbGW/hUwIBAZHb29nbGW/hU0JBAdQaXhlbCA2v4VOBgIEATSy9b+FTwYCBAE0svUwCgYIKoZIzj0EAwIDRwAwRAIgcIlrFLdhvv395MTAEoY+B3Vke6H1ZzbgepU13Mw27zgCIB1ybZf8kOPZFci2tlpyeP6slekxaap/2IgSjoyRVpF0"      }    ],    "f": 1,    "g": "1778148854107_c2a88145-b110-31f7-b034-d8b42786844a",    "h": 1,    "v": 0,    "z": 1  },  "x276": "3:cpuset:/top-app\n2:cpu:/system\n1:blkio:/\n0::/uid_10396/pid_28625",  "x277": 0.0,  "x278": "0xd44",  "x279": "0x41",  "x28": "#1 SMP PREEMPT Thu May 25 12:11:12 UTC 2023",  "x280": "0x00000000412fd050",  "x281": "0x0000000000000000",  "x282": {    "x1": 1778219998804,    "x3": 1778220041835,    "x4": 1778220047574  },  "x283": 16,  "x284": 21,  "x287": [    5,    6,    9,    11,    13,    14  ],  "x288": [    0,    1,    2,    3,    4,    5,    6,    7  ],  "x289": 1778220047120,  "x29": "g5123b-145971-250708-B-13746081",  "x290": 1,  "x291": 0,  "x293": 6768726,  "x294": "",  "x295": "S8l6pNIn3D21M+7WSHSz6Qa5MIY7ihI78DtNyvu60wUD6FBtWHqJJjn2F4aXki31w+suUKlbc8nkrsBfE8SgsyMiae67CwldeEmNV7GDK+sfaDvDO/l3pfMiEe6AYGsaCXKfq4UZY9asDSbikB20HQ/nFibtPwMY8SvAQYGBFNUbBsyZS6HUIPRjOSCNkihwAolVkN6np9rhVyTAviM0mmd76DbLgIfBdsBLa87oGLu4SEiuTSdy2bPXGh9ETjePc/UtOJZvo1bbhseoD2skRlzo9/ZxqeFn0E9ZO9q0Nvk9Rd78HYMxNGEjSOlcRKLWKYU8FL58ezFsvUj73oe+Nfoc4ii3TorBcAplfRsUq2lI4eUJwCUXkuBZgTmkhTp8vhVbhW647vRb38Mx6u3r/hI6CYsFoAMVmJ09isZO3ctjishCnVVj6Dhb8copYQgBkio9ulx0t9IYI9+Ax3J1QVWB2mpMBNxdruZ6PGq8XIMW/d3dN7suYeANglYqiQl88eGyCeAdGwMYNrd3n+xyQ0PV+Qi+23sdB0c2xLIO+DrVSvuFw6AAVWYFaA5Tq3GZLncw1MY9LQajQkivLzup4LdHNiCltck7aNL2XLLdzN0AUCikLvo+LPhBhYs2Fn3YNbxXTs8teJTb55lUFQ2bE/JCH3GrJOnNg1DfZLvDXyiRwZR5mWKLZZ5rRgFLdkoF5Bp+1FFQc01ISC5rycZxV0NuckUQJVe8j1z4OtOMaGeamBs6j5uG3I6OgSwZfBC8bAI+lxWPa6oyu4moKEmQczuqNbn5xFFdfWT+Zh67BiumxVYVsi5beOwwEkQUtNGiWF0hyJloVjH7iFitR4hBzXKVGp6eBNUQ3Gn3+Mwv+Bc2CL73kz2lzc4ySVolGZ41k2HaOKnjdRyZlof5aV9uZYFctxENVJqDoT+uOD1ECpN4ketGxgytqDIou49Ugwxw/HAs3OknWg4I553giRxdFZIRZNBQFw13kHHPkHAZPsfK0mDdUahIH7C8fG6J6o3i25t4aE7LXj1p9DXbI77C5kDHuWymgOLuJQxG/vsknx2lQa0IYpwggxCKikZ9IWycqvZTxSqZSlK6Gcmy/UvlIs5+zIabEo4MR9D+7j3E4ESQyhIdOK2qSNZqExD2Vt8rRU1PJQnBDiZWVL8A5Jlve5VG2MwTYPjaB7xC4THrnj11/fdREXH1V1Cm7mMoLS7soIcSlFzZ5ZGl4j/BOOem0LtN5ELpHgdu6g8teCLF3sTuWhxqSEKRpiBrrNGBxa1WCHNfjpIDA2TVOcrrfLhjj3Xva0ju6GsdAobWcfo1TSY/RraXcJ89/8YuGgVSr4d1zj2UkloRzwqWzFYmQOJcI4h7+qXjrzvXwnkIryxfZ6TI2MGZtsGhJolRwGtex0l7a9mG2at4zORnoFfflxLWru4Z3HJZ4QjGUqu4Ppw+abRts+AxFWfo2Jh/+pzcyruQrwmPsvBwNJ5jqjkqso4Yjg==",  "x296": "",  "x3": 1777894891697,  "x30": "1080,2400,420",  "x301": "LOADED",  "x302": "CE65F4E2D70C2B48E869BF712E1574C4",  "x303": "MEYCIQDS/VBMwGMPNKX14sdePbMeTx7MojyQc9JcMbTSSaK62gIhAICFkZu1ysGQUE4EzGymicc3heb0yStShhE6E0L2gMXI",  "x304": 1,  "x305": -3,  "x306": {    "deviceID": -1845362672,    "eglImplementation": "mali",    "error": "",    "maxRenderbufferSize": 0,    "maxTextureSize": 0,    "renderer": "Mali-G78",    "shadingLanguageVersion": "OpenGL ES GLSL ES 3.20",    "success": true,    "totalMemory": 8081297408,    "vendor": "ARM",    "vendorID": 5045,    "version": "OpenGL ES 3.2 v1.r38p1-01eac0.1a610aadd6bd0e3c95c856461c1c5ef1"  },  "x307": 3,  "x308": {    "3": "8BF13E48D110014717A45FEAD4E9BF79",    "s": 0  },  "x31": 31,  "x32": 1,  "x33": 5,  "x34": 100,  "x35": 100,  "x36": 2,  "x37": 0,  "x38": 1,  "x4": 1777894891697,  "x40": 5,  "x41": "Mobile Duck",  "x42": "45412",  "x43": "wifi",  "x44": 1778220045353,  "x45": 44057,  "x46": "234d0862cdd1a2ce",  "x47": "571fb9be-7190-4884-8639-613232981ee",  "x48": "/data/user/0/com.xingin.xhs",  "x49": "/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk",  "x5": "Vivo",  "x50": 0,  "x51": "com.google.android.inputmethod.latin/com.android.inputmethod.latin.LatinIME",  "x52": "com.google.android.inputmethod.latin/com.android.inputmethod.latin.LatinIME:com.google.android.tts/com.google.android.apps.speech.tts.googletts.settings.asr.voiceime.VoiceInputMethodService",  "x53": 1,  "x54": 0,  "x55": 0,  "x56": "<unknown ssid>",  "x57": "02:00:00:00:00:00",  "x58": [    {      "n": "Dynamic Sensor Manager",      "t": 32,      "v": "Google",      "ve": 1    },    {      "n": "LSM6DSR Accelerometer",      "t": 1,      "v": "STMicro",      "ve": 1    },    {      "n": "MMC56X3X Magnetometer",      "t": 2,      "v": "MEMSIC",      "ve": 1    },    {      "n": "Orientation Sensor",      "t": 3,      "v": "Google",      "ve": 1    },    {      "n": "LSM6DSR Gyroscope",      "t": 4,      "v": "STMicro",      "ve": 1    },    {      "n": "TMD3719 Ambient Light",      "t": 5,      "v": "AMS",      "ve": 1    },    {      "n": "ICP10101 Pressure Sensor",      "t": 6,      "v": "InvenSense",      "ve": 1    },    {      "n": "TMD3719 Proximity (wake-up)",      "t": 8,      "v": "AMS",      "ve": 1    },    {      "n": "Gravity Sensor",      "t": 9,      "v": "Google",      "ve": 1    },    {      "n": "Linear Acceleration Sensor",      "t": 10,      "v": "Google",      "ve": 1    },    {      "n": "Rotation Vector Sensor",      "t": 11,      "v": "Google",      "ve": 1    },    {      "n": "MMC56X3X Magnetometer-Uncalibrated",      "t": 14,      "v": "MEMSIC",      "ve": 1    },    {      "n": "Game Rotation Vector Sensor",      "t": 15,      "v": "Google",      "ve": 1    },    {      "n": "LSM6DSR Gyroscope-Uncalibrated",      "t": 16,      "v": "STMicro",      "ve": 1    },    {      "n": "Significant Motion (wake-up)",      "t": 17,      "v": "Google",      "ve": 1    },    {      "n": "Step Detector",      "t": 18,      "v": "Google",      "ve": 1    },    {      "n": "Step Counter",      "t": 19,      "v": "Google",      "ve": 1    },    {      "n": "Geomagnetic Rotation Vector Sensor",      "t": 20,      "v": "Google",      "ve": 1    },    {      "n": "Tilt Sensor (wake-up)",      "t": 22,      "v": "Google",      "ve": 1    },    {      "n": "Device Pickup Sensor (wake-up)",      "t": 25,      "v": "Google",      "ve": 1    },    {      "n": "Device Orientation",      "t": 27,      "v": "Google",      "ve": 1    },    {      "n": "LSM6DSR Accelerometer-Uncalibrated",      "t": 35,      "v": "STMicro",      "ve": 1    },    {      "n": "LSM6DSR Temperature",      "t": 65538,      "v": "STMicro",      "ve": 1    },    {      "n": "ICP10101 Temperature",      "t": 65539,      "v": "InvenSense",      "ve": 1    },    {      "n": "Camera V-Sync 0",      "t": 65541,      "v": "Google",      "ve": 1    },    {      "n": "Camera V-Sync 1",      "t": 65541,      "v": "Google",      "ve": 1    },    {      "n": "Camera V-Sync 2",      "t": 65541,      "v": "Google",      "ve": 1    },    {      "n": "Camera V-Sync 3",      "t": 65541,      "v": "Google",      "ve": 1    },    {      "n": "VD6282 Rear Light Sensor",      "t": 65545,      "v": "STMicro",      "ve": 1    },    {      "n": "Double Twist (wake-up)",      "t": 131073,      "v": "Google",      "ve": 1    },    {      "n": "Binned Brightness (wake-up)",      "t": 131077,      "v": "Google",      "ve": 1    },    {      "n": "Proximity Gated Single Tap Gesture (wake-up)",      "t": 131083,      "v": "Google",      "ve": 1    },    {      "n": "Proximity Gated Long Press Gesture (wake-up)",      "t": 131085,      "v": "Google",      "ve": 1    },    {      "n": "Quick Pickup Sensor (wake-up)",      "t": 131087,      "v": "Google",      "ve": 1    },    {      "n": "Auto Brightness",      "t": 131088,      "v": "Google",      "ve": 1    }  ],  "x59": 0,  "x6": 1777893226942,  "x62": "",  "x65": 1,  "x66": "adb",  "x67": "c4e07d6bafb78d45ca0960bdfa734cce35c4ccc89c777b1758e12700fe9a8dd1",  "x7": "gs101",  "x70": 35,  "x71": 1778219998804,  "x72": 1778148854107,  "x73": 1778219906896,  "x76": 8,  "x77": "oriole",  "x78": 10396,  "x79": 28625,  "x8": 1693618695000,  "x80": 833,  "x81": 7976439808,  "x82": 3476316160,  "x83": "02:00:00:00:00:00",  "x85": "6d8eb6410861e7a9b2135e4d2418a9f037590e9dc8ef15dec09f4bd9ec4ccfa0",  "x86": "01D9D0368E96A0CDDDEF7D06BE35C61D10EC97D4",  "x87": 1778219998851,  "x89": "10.181.153.87",  "x9": "TQ3A.230901.001.C2",  "x90": 3,  "x92": 35,  "x93": 3,  "x97": "{\"d1\":\"\",\"d10\":\"\",\"d11\":\"\",\"d12\":\"\",\"d13\":\"\",\"d4\":\"\",\"d6\":\"\",\"d9\":\"\",\"s1\":\"0|0|0|0|*|0|0\",\"s10\":\"0|*|0|*|*\",\"s11\":\"*|0|0\",\"s2\":\"1|*|0\",\"s3\":\"*|0|0|0|0|0|0\",\"s4\":\"*|*|*|*\",\"s5\":\"0|*|*|*|0|0|0|0|0|*|0|0\",\"s6\":\"*|0|*|*|0|0|0|0|0|*|0|0\",\"s7\":\"0|0|0|0\",\"s8\":\"0|0|0|0|0|0|0\",\"s9\":\"*|0|0|0\"}",  "x98": "0",  "x99": "3106481332"}

应用基础 (x0-x4, x92)

字段	值	含义
`x0`	`com.xingin.xhs`	应用包名
`x1`	`9.24.0`	versionName
`x2`	`9240811`	versionCode (`0x8D00EB`)
`x3`	`1777894891697`	首次安装时间戳 (约2026-04-28)
`x4`	`1777894891697`	最近更新时间戳 (与 x3 一致=未更新)
`x92`	`35`	targetSdkVersion

厂商伪装与真实设备 (x5, x20, x23-x24, x77)

字段	值	含义
`x5`	`Vivo`	设备厂商 (伪装值) — 硬编码
`x20`	`google`	BRAND
`x23`	`Google`	真实厂商 (MANUFACTURER)
`x24`	`Pixel 6`	真实型号 (MODEL)
`x77`	`oriole`	DEVICE 代号

Build 系统属性 (x6-x19, x21-x22, x25-x29, x210, x248)

全部来自 getprop / android.os.Build.*:

字段	值	属性来源
`x6`	`1777893226942`	ro.build.date.utc
`x7`	`gs101`	ro.board.platform (Tensor)
`x8`	`1693618695000`	ro.build.date.utc x1000
`x9`	`TQ3A.230901.001.C2`	ro.build.display.id
`x10`	`google/oriole/oriole:13/TQ3A.230901.001.C2/10753682:user/release-keys`	ro.build.fingerprint
`x11`	`abfarm-release-2004-0177`	ro.build.host
`x12`	`TQ3A.230901.001.C2`	ro.build.id
`x13`	`release-keys`	ro.build.tags
`x14`	`user`	ro.build.type
`x15`	`10753682`	ro.build.version.incremental
`x16`	`13`	ro.build.version.release
`x17`	`33`	ro.build.version.sdk
`x18`	`2023-09-01`	ro.build.version.security_patch
`x19`	`oriole`	ro.product.device
`x21`	`arm64-v8a,armeabi-v7a,armeabi`	SUPPORTED_ABIS
`x22`	`oriole`	ro.product.name
`x25`	`oriole`	ro.hardware
`x26`	`aarch64`	ro.product.cpu.abi
`x27`	`5.10.157-android13-4-00003-g776d0a76f6aa-ab10208116`	uname -r
`x28`	`#1 SMP PREEMPT Thu May 25 12:11:12 UTC 2023`	uname -v
`x29`	`g5123b-145971-250708-B-13746081`	基带版本
`x210`	`TQ3A.230901.001.C2`	Build.DISPLAY 副本
`x248`	`{"BOARD":"oriole","SOC_MANUFACTURER":"Google",...}`	完整 Build 静态字段 JSON
`x209`	`unknown`	Build.SERIAL (Android 10+ 返回 unknown)

x248 关键字段: SOC_MODEL=Tensor, BOOTLOADER=slider-16.3-13642543, SKU=GB7N6, ODM_SKU=GB7N6, IS_EMULATOR=false, Partition(7个分区名), VERSION_CODES(全部版本代号映射表)

屏幕与UI (x30-x31, x128, x265)

字段	值	含义
`x30`	`1080,2400,420`	分辨率,刷新率,dpi
`x31`	`31`	MEDIA_PERFORMANCE_CLASS
`x128`	`config: mcc454-mnc12-b+zh+Hans+CN-ldltr-sw411dp-...`	完整 Configuration.toString()
`x265`	`78:32`	RSS/VSIZE 比值 (约 41% 驻留率)

x128 包含: mcc454/mnc12(香港CMHK), zh+Hans+CN(简体中文), sw411dp(最小宽度), 2209x1080(物理分辨率), v33(API33), port(竖屏), 420dpi, finger(指纹传感器), keysexposed+nokeys(虚拟导航栏)

电池 (x32-x38)

字段	值	含义
`x32`	`1`	充电中 (STATUS_CHARGING)
`x33`	`5`	充满 (STATUS_FULL)
`x34`	`100`	电量%
`x35`	`100`	电量(冗余)
`x36`	`2`	USB充电 (PLUGGED_USB)
`x37`	`0`
`x38`	`1`	电池健康

网络 (x40-x45, x56-x57, x83, x89-x90, x112-x114, x240)

字段	值	含义
`x40`	`5`	网络类型=MOBILE
`x41`	`Mobile Duck`	运营商名称
`x42`	`45412`	MCC+MNC (454=香港, 12=CMHK)
`x43`	`wifi`	当前连接=WiFi
`x44`	`1778220045353`	连接开始时间戳
`x45`	`44057`	连接持续时长(ms) ≈44秒
`x56`	`<unknown ssid>`	WiFi SSID (未获取)
`x57`	`02:00:00:00:00:00`	WiFi BSSID (Android 隐私匿名化)
`x83`	`02:00:00:00:00:00`	本机 WiFi MAC
`x89`	`10.181.153.87`	本机 IP
`x90`	`3`	NetworkCapabilities 位掩码
`x112`	`["10.13.168.132","10.13.200.132","10.177.20.4","10.177.20.5"]`	DNS 服务器 (4个内网地址)
`x113`	`true`	HTTP 代理已启用 (抓包/Fiddler 特征)
`x114`	`90.0`	信号强度 %
`x240`	`{"wlan0":[{"i":"10.181.152.253","m":"a8:d4:e0:08:c1:0e"}]}`	网卡 IP/MAC 映射

蓝牙/无线电 (x99, x103, x115, x118, x143-x144)

字段	值	含义
`x99`	`3106481332`	蓝牙状态 CRC32
`x103`	`Samsung S.LSI Vendor RIL V2.3 Build 2023-09-02 02:30:35`	RIL 版本 (Samsung Exynos 基带, 非 Tensor)
`x115`	`2.9.63`	SDK 版本
`x118`	`running`	RIL 守护进程存活
`x143`	`520C5CADC78FF706950762279995A50F`	x103 的 MD5
`x144`	5x 相同 fingerprint	交叉验证 (5次读取一致)

存储与内存 (x46-x49, x81-x82, x208, x231-x237)

字段	值	含义
`x46`	`234d0862cdd1a2ce`	应用数据目录路径 hash
`x47`	`571fb9be-7190-4884-8639-613232981ee`	设备+应用 UUID5
`x48`	`/data/user/0/com.xingin.xhs`	应用私有数据目录
`x49`	`/data/app/~~ChWn3rqyWB0yo6npq8ge3g==/com.xingin.xhs-CE_o9mf-ZBsPZXSAgprFdg==/base.apk`	APK 安装路径
`x50`	`0`	非系统应用
`x81`	`7976439808` (7.4 GB)	设备总 RAM
`x82`	`3476316160` (3.2 GB)	可用 RAM
`x208`	`{"c":312,"d":4,"f":0,"s":4098,"t":96730950,"tt":[1]}`	statfs (block 计数/大小/空闲/总大小/类型)
`x231`	`118396899328` (110 GB)	总存储(A)
`x232`	`118396899328`	总存储(B/冗余)
`x235`	`4262000` (4.1 GB)	已用存储
`x236`	`69230530560` (64.5 GB)	空闲存储(A)
`x237`	`69230530560`	空闲存储(B/冗余)

CPU (x247, x277-x281, x283-x284, x287-x288)

字段	值	含义
`x247`	`{0:14.29%, 1~3:0%, 4:14.29%, 5:0%}`	6核心使用率采样 (/proc/stat)
`x277`	`0.0`	15分钟负载
`x278`	`0xd44`	CPU 特性A
`x279`	`0x41`	CPU implementer=0x41 (ARM)
`x280`	`0x00000000412fd050`	sched_getaffinity()
`x281`	`0x0000000000000000`	CPU 空闲亲和性
`x283`	`16`	availableProcessors()
`x284`	`21`	可用频率步进数
`x287`	`[5,6,9,11,13,14]`	在线核心
`x288`	`[0..7]`	全部8核心

进程 (x78-x80, x276)

字段	值	含义
`x78`	`10396`	UID
`x79`	`28625`	TID
`x80`	`833`	线程总数
`x276`	`3:cpuset:/top-app\n2:cpu:/system\n1:blkio:/\n0::/uid_10396/pid_28625`	cgroup 层级 (4 级)

GPU / OpenGL ES (x306)

字段	值	含义
`vendor`	`ARM`	GPU 厂商
`renderer`	`Mali-G78`	GPU 型号 (Tensor 集成)
`version`	`OpenGL ES 3.2 v1.r38p1-...`	驱动版本
`totalMemory`	`8081297408` (7.5 GB)	GPU 显存
`vendorID`	`5045`	ARM 厂商 ID
`eglImplementation`	`mali`	Mali 驱动
`shadingLanguageVersion`	`GLSL ES 3.20`	着色器版本

GPU 指纹是防模拟器核心: 真机=Mali-G78(ARM 5045), 模拟器=Swiftshader/ANGLE/VirGL

传感器列表 (x58)

传感器	厂商	类型
LSM6DSR Accelerometer	STMicro	1
MMC56X3X Magnetometer	MEMSIC	2
LSM6DSR Gyroscope	STMicro	4
TMD3719 Ambient Light	AMS	5
ICP10101 Pressure	InvenSense	6
TMD3719 Proximity (wake-up)	AMS	8
VD6282 Rear Light Sensor	STMicro	65545
Camera V-Sync 0/1/2/3	Google	65541
LSM6DSR/ICP10101 Temperature	STMicro/InvenSense	65538/65539
Dynamic Sensor Manager	Google	32
虚拟合成传感器 (Gravity/RotationVector/GameRot/Orientation/Geomag/LinearAccel)	Google	9-20
唤醒传感器 (SignificantMotion/Tilt/StepDetector/StepCounter/DevicePickup/QuickPickup/DoubleTwist/BinnedBrightness/ProxTap/Press)	Google	17-131087
Auto Brightness	Google	131088

输入设备 (x230)

来自 /proc/bus/input/devices:

设备	总线	类型	说明
Virtual	0x301	k=2	合成输入
goodix_fingerprint	0x101(I2C)	k=1	指纹模组
gpio_keys	0x101(I2C)	k=1	物理按键 (pi=1)
fts	0x1002(SPI)	k=0	触摸屏 (意法 FingerTip, pi=2)

设备标识 (x67, x85-x86, x104, x110, x180, x145-x146, x302-x303)

字段	值	说明
`x67`	`c4e07d6b...` (SHA256 64h)	设备主 ID
`x85`	`6d8eb641...` (SHA256 64h)	设备子 ID
`x86`	`01D9D036...` (SHA1 40h)	设备短 ID
`x104`	同 x67	主 ID 副本
`x110`	`aa132d61-c2c0-4380-acc7-8afae8ebc8b`	OAID
`x180`	`7e288ef3-48ad-4d69-8e20-43a28279c137`	设备 UUID
`x145`	`{"com.xingin.xhs":"7c8f82689eba..."}`	APK 签名 SHA384
`x146`	`7c8f82689eba549d1ca466eff097d287a8248d294735998677b2d849`	GID (同 x145)
`x302`	`CE65F4E2D70C2B48E869BF712E1574C4`	KK (MD5 密钥指纹)
`x303`	`MEYCIQDS/VBMwGMPNKX14sdePbMeTx7MojyQc9JcM...`	ECDSA P-256 DER 签名

文件完整性哈希 (x135, x137-x138, x165, x205, x241)

字段	说明
`x135`	`{"1":"D0A...","7":"1CB..."}` — 系统分区 MD5
`x137`	`2B5B...` — build.prop MD5
`x138`	`AD733C...` — default.prop MD5
`x205`	`{"x3":"1DBC..."}` — 关键路径 SHA1
`x241`	12 个关键文件的 MD5 校验值
`x165`	9 项文件 inode/timestamp 序列 (`timestamp-inode-devid-mode-offset`)

DEX/JAR 完整性 (x126, x127)

x126 列举了 80+ 条运行时加载的全部 dex/jar 路径:

类别	数量	示例
系统 APEX Jar	24	`/apex/com.android.art/javalib/core-oj.jar`
应用 dex	22	`base.apk!classes2.dex` ~ `classes22.dex`
热修复插件	21	`Anonymous-DexFile@1001476499.jar` (Robust)
小程序插件	8	`app_petal/animation_widgets/9240.84.1/...apk`
系统框架	7	`/system/framework/framework.jar`
未知 dex	7	`Anonymous-DexFile@1605196164` (无物理路径)

x127=. 表示所有 DEX 均通过完整性校验。

时间戳体系

字段	值	说明
`x70`	`35`	上报间隔(秒)
`x71`	`1778219998804`	SO 加载时刻
`x72`	`1778148854107`	App 冷启动
`x73`	`1778219906896`	上次操作
`x87`	`1778219998851`	本次采集入口
`x93`	`3`	第3次采集
`x234`	`{1:1763286961761,2:1763286951020,3:1763286950944}`	SDK 初始化三阶段
`x243`	`1778219998657`	事件基准
`x258`	`1`	请求计数器
`x260`	`1778220045352`	采集完成
`x266`	`1778164075590`	上次启动
`x282`	`{x1:...,x3:...,x4:...}`	三阶段耗时
`x289`	`1778220047120`	HTTP 发送
`x293`	`6768726` (约6.8秒)	采集耗时

安全/环境检测 (x65-x66, x97-x131, x213-x215, x226, x239)

字段	值	含义
`x65`	`1`	`FLAG_DEBUGGABLE` (可调试)
`x66`	`adb`	ADB 连接存在
`x97`	11项 s1~s11 + d1~d13	系统服务可用性签名 (详见第5节)
`x98`	`"0"`	模拟器检测 0=否
`x100`	`"0"`	Root 检测
`x102`	`"0"`	注入检测
`x120`	`"0"`	多开/虚拟环境
`x122`	`"1"`	Hook 框架检测触发
`x131`	`"0"`	Frida 检测
`x136`	`"1"`	无障碍服务检测
`x194`	`"1"`	SDK 已初始化
`x213`	`locked`	屏幕锁定
`x214`	`green`	Verified Boot 绿色
`x215`	`enforcing`	SELinux
`x226`	Netlink socket denied	SELinux 拦截
`x239`	`true`	Treble 支持
`x256`	`Linux localhost 5.10.157-...aarch64 Toybox`	uname -a
`x290`	`1`	官方 ROM
`x301`	`LOADED`	SDK 就绪

输入法/用户行为 (x51-x55, x123, x198-x199)

字段	值	含义
`x51`	`com.google.android.inputmethod.latin/...LatinIME`	当前输入法
`x52`	LatinIME + VoiceIME	已启用输入法
`x53`	`1`	语音输入存在
`x54`	`0`	非自动化
`x55`	`0`	触摸自然
`x123`	`Dalvik/2.1.0 (Linux; U; Android 13; Pixel 6 Build/...)`	WebView UA
`x198`	`{"IndexActivityV2":["android"]}`	Activity 启动源
`x199`	`[]`	触摸序列(正常)

TLS 证书链 (x227-x228)

x227 = DigiCert Global Root G2 → DNSPod TLS RSA CA 2025 → *.xiaohongshu.com → *.askdiandian.com。x228=[]=无 MITM 检测

TEE 密钥认证链 (x274)

5 级 Key Attestation 证书链:

层级	算法	签发者
Key Attestation CA	EC P-384	Google LLC
Droid CA2	EC P-384	Key Attestation CA
Droid CA3	EC P-256	Droid CA2
TEE 应用证书	EC P-256	Droid CA3
Android Keystore Key	EC P-256	TEE (自签名)

元数据: f=1(成功), h=1(TEE硬件), v=0(TrustedEnvironment), z=1(通过)。第5级证书扩展嵌入: com.xingin.xhs, google, oriole, oriole, Google, Pixel 6

加密负载与杂项

字段	值	含义
`x295`	约5.5KB Base64	加密的设备指纹校验负载
`x303`	72字节 DER	ECDSA P-256 签名
`x308`	`{"3":"8BF13E...","s":0}`	环境摘要
`x307`	`3`	请求类型=指纹上报
`x185`	`IiGgSsKkCVvEePp`	会话 Token
`x186`-`x187`	`-1`	ADB/开发者选项(未读取)
`x189`	inode 引用	文件时间戳引用
`x193`	`{"0":"ims","1":""}`	IMS 注册状态
`x238`	`cn`	国家代码
`x242`	`[]`	外设(空)
`x244`	`0`	标志
`x249`	`com.xingin.xhs`	包名(副本)
`x251`	`""`	预留
`x261`	`1`	正常启动
`x263`-`x264`	`0`	ART/运行正常
`x267`	`1`	进程存活
`x268`	`0`	崩溃计数
`x272`	`0`	无热修复篡改
`x273`	`"0"`	标志
`x291`	`0`	安全
`x294`	`""`	预留
`x296`	`""`	预留
`x304`	`1`	TEE 有效
`x305`	`-3`	错误码=OK

mini-mua 指纹对比

维度	mini-mua	完整指纹
字段数	≈90	≈200
传感器	无	34 个完整列表
GPU 信息	无	Mali-G78 全参数
DEX 列表	无	80+ 路径
输入设备	无	4 个设备详情
TEE 证书链	无	5 级 X.509 证书
文件哈希	无	12 个 MD5 + 9 个 inode
网络详情	简化	DNS/IP/MAC/代理全量
加密负载	无	x295(5.5KB) + x303 签名

对于总上传中x295是一串加密：

这里继续回到日志观察：

找到如下：

{    "global": {        "code-patch-check": [            "detect tiny code patch!",            "hash[0] = 4374629818410490178 hash[1] = 4645753627478656280",            "hash[0] = 5413470446597402419 hash[1] = 8056311877987315933",            "hash[0] = 10375212707557656182 hash[1] = 8208716317797788442",            "hash[0] = 14789127626113654434 hash[1] = 6362402964521876721",            "hash[0] = 17540343258695014053 hash[1] = 9019156388800152406",            "hash[0] = 2332245349839540828 hash[1] = 15792192795412816771",            "hash[0] = 4421864420400602596 hash[1] = 6671147805527458612",            "hash[0] = 1230701200501964179 hash[1] = 2093930530577762092",            "hash[0] = 1785509536373080354 hash[1] = 10386807068207794068"        ],        "code-patch-prepare": [            "",            "sections[0] = 0x0000007677557e80 - 0x0000007677558a00",            "sections[1] = 0x0000007676f1c300 - 0x0000007676f2e540",            "sections[2] = 0x0000007676f5cbb0 - 0x0000007677557e80",            "sections[3] = 0x0000007676f2e540 - 0x0000007676f37154",            "sections[4] = 0x0000007676f37158 - 0x0000007676f5cbac",            "sections[5] = 0x0000007676e1b288 - 0x0000007676e1c710",            "sections[6] = 0x0000007676e1d028 - 0x0000007676e1d9b8",            "sections[7] = 0x0000007676e1d9b8 - 0x0000007676f1b1d0",            "sections[8] = 0x0000007676f1b1d0 - 0x0000007676f1c2e0"        ]    },    "s1": {},    "s11": {},    "s6": {        "9": [            "",            "FD 7B BF A9"        ]    },    "s7": {        "4": [            "",            "package name: com.xingin.xhs"        ]    },    "t": {        "26": [            "",            "/data/data/com.xingin.xhs",            "/data/data/./../user/0/com.xingin.xhs",            "/proc/self/maps"        ],        "29": [            "zkqsExVMbegb.ZpIkGBRG.XvFWWExBridge$HookerCallback"        ]    }}

代码完整性校验系统

code-patch-prepare → code-patch-check → [detect tiny code patch!]

code-patch-prepare：准备 9 个内存段的地址范围
code-patch-check：计算 9 对哈希值验证代码完整性
detect tiny code patch!：检测到代码补丁

SDK 读取函数入口点的原始指令字节进行对比：

FD 7B BF A9  →  STP X29, X30, [SP, #-16]!  (ARM64 函数序言)

如果此处被替换为 Frida trampoline 指令，则检测到 hook

—

补充深入分析

5.1 心跳 `t` 字段与能力位掩码

字段两阶段行为

心跳请求中的 t 字段反映 SDK 的运行状态：

初始化阶段（c=1~99）：

"t": {"c":0, "d":0, "f":0, "s":4098, "t":0, "tt":[]}

所有计数器归零
s=4098 始终不变
tt 数组为空

活跃阶段（c≥100）：

"t": {"c":45, "d":4, "f":0, "s":4098, "t":68577897, "tt":[1]}

c=45：已完成的风控检测周期数
d=4：检测到的状态变化数
f=0：始终为零（此 trace 中）
t=68577897 (0x4166A69)：单调递增的计时器/事件计数器
tt=[1]：触发的检测类型标志

5.2 API 端点与数据上报

除 register/profile 外，还发现以下 API 端点：

端点	用途	特征
`https://apm-native.xiaohongshu.com/api/collect`	APM 性能监控上报	gzip 压缩，UA: okhttp/3.14.9.033
`https://t2.xiaohongshu.com/api/collect`	数据采集上报	gzip 压缩，879 字节
`https://edith.xiaohongshu.com/api/...`	主业务 API	OkHttp CacheInterceptor

SSO (Small String Optimization) 字符串格式

应用基础信息 (x0-x4, x92)

x5=Vivo 与 x23=Google/x7=gs101(Tensor)/x24=Pixel 6 完全矛盾, 证明 libtiny.so 主动伪造了设备厂商字段。在分析的日志中发现 显示 SDK 尝试连接小米/酷派 OAID 服务失败后硬编码为 "Vivo"

Build 系统属性 (x6-x19, x21-x22, x25-x29)

全部来自 getprop / android.os.Build.*, 构成 ROM 完整指纹:

屏幕与电池 (x30-x38)

网络信息 (x40-x45)

进程信息 (x78-x80)

存储信息 (x231-x232, x235-x237)

CPU 使用率 (x247)

采样 6 核心 (/proc/stat 差值): {0:14.29%, 1~3:0%, 4:14.29%, 5:0%}。Pixel 6 Tensor 有 8 核, 只有活跃核心被采样

时间戳体系

安全/环境检测

设备标识与密钥

杂项字段

字段分组总结

4.2 /api/v1/profile/android接口上传

应用基础 (x0-x4, x92)

厂商伪装与真实设备 (x5, x20, x23-x24, x77)

Build 系统属性 (x6-x19, x21-x22, x25-x29, x210, x248)

屏幕与UI (x30-x31, x128, x265)

电池 (x32-x38)

网络 (x40-x45, x56-x57, x83, x89-x90, x112-x114, x240)

蓝牙/无线电 (x99, x103, x115, x118, x143-x144)

存储与内存 (x46-x49, x81-x82, x208, x231-x237)

GPU 指纹是防模拟器核心: 真机=Mali-G78(ARM 5045), 模拟器=Swiftshader/ANGLE/VirGL

传感器列表 (x58)

设备标识 (x67, x85-x86, x104, x110, x180, x145-x146, x302-x303)

文件完整性哈希 (x135, x137-x138, x165, x205, x241)

DEX/JAR 完整性 (x126, x127)

时间戳体系

安全/环境检测 (x65-x66, x97-x131, x213-x215, x226, x239)

输入法/用户行为 (x51-x55, x123, x198-x199)

TLS 证书链 (x227-x228)

TEE 密钥认证链 (x274)

5 级 Key Attestation 证书链:

加密负载与杂项

SDK 读取函数入口点的原始指令字节进行对比：

5.1 心跳 t 字段与能力位掩码

字段两阶段行为

5.2 API 端点与数据上报

`x5`=Vivo 与 `x23`=Google/`x7`=gs101(Tensor)/`x24`=Pixel 6 完全矛盾, 证明 libtiny.so 主动伪造了设备厂商字段。在分析的日志中发现显示 SDK 尝试连接小米/酷派 OAID 服务失败后硬编码为 "Vivo"

全部来自 `getprop` / `android.os.Build.*`, 构成 ROM 完整指纹:

采样 6 核心 (`/proc/stat` 差值): `{0:14.29%, 1~3:0%, 4:14.29%, 5:0%}`。Pixel 6 Tensor 有 8 核, 只有活跃核心被采样

5.1 心跳 `t` 字段与能力位掩码