Aegis Authenticator / REA / EN
Understand a login code's 30-second cycle from an APK
ENGLISH SUMMARY
Understand a login code's 30-second cycle from an APK
Trace code-generation methods in an Aegis release APK and demonstrate the recovered time-step rule with an adjustable clock.
The question
Why does the six-digit code change over time, and how is it calculated?
The workflow
- Statically inspect the release APK and locate generating methods.
- Trace time grouping and code calculation.
- Observe changes across time steps with a demonstration clock.
Findings & output
The official case connects APK methods to the TOTP rule and provides an interactive clock demonstration.
Evidence scope
This examines a known algorithm and its implementation; it does not recover real account keys or demonstrate authentication bypass.
中文摘要
从 APK，理解验证码的 30 秒周期
从 Aegis 发布的 APK 追踪验证码生成方法，恢复时间步长与六位数字的关系，再用可调时钟演示。
调查的问题
为什么验证码会随时间变化，六位数字如何生成？
怎么做的
- 对发布 APK 做静态分析，定位生成方法。
- 追踪时间分组与验证码计算。
- 用示例时钟观察跨时间步长的结果。
发现与产出
官方案例用 APK 内的方法解释 TOTP 生成规则，并提供交互式时钟示例。
证据范围
这是已知算法与应用实现的分析，不代表能获取真实账户密钥或绕过认证。
Original sources / 原始来源
Checked / 核对 2026-10-12 · Official investigation / 官方调查