feat(huya): 💎💎 R31 活体重抓3密文+Java全逆+native零调用铁证

- 配方: frida-server -l 0.0.0.0 + 清状态(保留登录) + str_magic → 40s命中
- 3新POST (4384/4267/4261B, cipher@70) 存 evidence/dfp_live/
- Java Cprivate XXTEA + Perseus 会话密钥 + Lyra TLV 全解
- 报告加密 = 第三路径 (JNI族+XTEA核心+Java三重钩子全0调用!)
- cprivate.py 解密器就绪 (key一到即解)

tools/frida/run_capture.py

@@ -39,6 +39,19 @@ def adb(*args):
     return subprocess.run(["adb"] + list(args), capture_output=True, text=True)
 
 
+def clear_turing_state():
+    """清 turing 状态 -> 自动重注册触发报告 (文档配方 §11.49)."""
+    try:
+        subprocess.run(["adb","shell","am","force-stop","com.duowan.kiwi"], capture_output=True, text=True)
+        time.sleep(1)
+        for path in ["app_turingdfp","app_turingfd","resinfo","app_turingdmp","cocos","turing_files"]:
+            r = subprocess.run(["adb","shell","run-as","com.duowan.kiwi","rm","-rf",f"/data/data/com.duowan.kiwi/{path}"], capture_output=True, text=True)
+            if r.returncode == 0:
+                print(f"[runner] cleared {path}", flush=True)
+        print("[runner] turing state cleared -> expect auto re-register report", flush=True)
+    except Exception as e:
+        print(f"[runner] clear-EXC {e}", flush=True)
+
 def run_once(fout, out_path):
     """单次 spawn 捕获一轮; 返回该轮事件数 (0 = 该轮无捕获)."""
     import frida
@@ -65,6 +78,7 @@ def run_once(fout, out_path):
     adb("shell", "am", "force-stop", PKG)
     time.sleep(1.0)
     try:
+        clear_turing_state()
         pid = dev.spawn([PKG])
         print(f"[runner] spawned pid={pid}", flush=True)
     except Exception as e: