From 0bba1e6af21cd225fd2cde26162a1bf6c8584086 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Tue, 25 Aug 2026 17:56:59 +0800
Subject: [PATCH] =?UTF-8?q?feat(huya):=20=E7=99=BB=E5=BD=95=E6=B5=81?=
 =?UTF-8?q?=E9=87=8F=E8=B5=B0wup.huya.com=E9=95=BF=E8=BF=9E=E6=8E=A5=20-?=
 =?UTF-8?q?=20=E9=94=81=E5=AE=9AcreateWupPackage@0x274ea4=E4=B8=BA?=
 =?UTF-8?q?=E5=B8=A7=E6=A0=BC=E5=BC=8F=E7=AA=81=E7=A0=B4=E5=8F=A3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/虎牙hyCred签发-侦察笔记.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md
index 450b839..1130adf 100644
--- a/docs/虎牙hyCred签发-侦察笔记.md
+++ b/docs/虎牙hyCred签发-侦察笔记.md
@@ -177,3 +177,12 @@ rodata: wupudbrequest_v0 与 huyaudbwebui 同池 => 任意udb消息HTTPS透传fu
   step1 复刻信封(huya_wup_encoder同构)
   step2 内层帧: id=0x1001+JSON, 盲发试错读错误码定位格式
   step3 响应解JSON取cred -> cert_forge -> bind -> cookie
+
+## 纯Python路线·传输层修正
+
+登录6.har实证: 护照登录走 CONNECT https://wup.huya.com TLS隧道(代理不可见),
+wsapi/wupudbrequest_v0 仅用于dfp等短连流程。
+内层帧突破口: createWupPackage(wup::UniPacket)@0x274ea4
+  - 函数体内引用 wupudbrequest_v0 与 huyaudbwebui
+下步: 反汇编该函数+其调用链(经PLT), 提取长连接帧格式(msgId+JSON的JCE摆放),
+然后 Python直连 wup.huya.com:443 组 TAF UniPacket 发送取cred。