From 092fd5a04f86d5e99816453a8ad29d6c68a6a085 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Tue, 25 Aug 2026 18:27:55 +0800
Subject: [PATCH] =?UTF-8?q?feat(huya):=20=E5=93=8D=E5=BA=94sBuffer?=
 =?UTF-8?q?=E5=B8=83=E5=B1=80=E7=B2=BE=E7=A1=AE=E5=AF=B9=E9=BD=90(915B=20b?=
 =?UTF-8?q?ean)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/虎牙hyCred签发-侦察笔记.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md
index a3b0987..218fa01 100644
--- a/docs/虎牙hyCred签发-侦察笔记.md
+++ b/docs/虎牙hyCred签发-侦察笔记.md
@@ -228,3 +228,11 @@ _wup_data 响应map解析(部分): tag0=INT uid(1199666914671), tag1=INT,
 tag2=name, tag3=BYTES, tag7=INT... 解析器在type=0xe(LIST)处断掉。
 原始流中含b64url长串(AQA1Ie6L1o...)即token/cookie形态字段。
 下步: 补全taf_dump的0xe/嵌套处理, 完整映射BusBeansAppLoginData取cred。
+
+## R5: 响应sBuffer精确定位
+
+响应外层map: key"_wup_data"(06 09..) -> val head 1d 00, 长度JCE优化编码
+(01 04 bf => 实际915B, taf_dump已证实len=915)。bean体起于 0a 0a(tag0嵌套struct)
+与请求同构。旧dump在该bean的tag5(LIST元素为struct)处解析器断掉。
+下步: 直接用core.huya.taf_protocol切出915B slice完整递归解析,
+按BusBeansAppLoginData字段表(regOrigin..cred@?)对号取cred。