docs(huya): 逆向定位 32hex hdid = NativeEntry.getGUID() + 真机注入通道证据

核心结论:
- 32hex hdid (WUP 登录帧 field1.tag0) = com.huya.security.hydeviceid.NativeEntry.getGUID()
- 金样本 ed0db8 为金样本设备 GUID; 当前真机 M2102J2SC getGUID()=0a7dfaa882938a6ab502511452142c57(稳定)
- NativeEntry 全字段: getGUID(32hex)/getCDID(40hex)/getHDID(40hex)/getMID(16hex)/getSDID(base64 safedeviceid)
- 单机不可铸造: 改 serialno/ANDROID_ID/删files/hydevice持久化 均不变(硬锚底层硬件)
- libhydeviceid.so 为 OLLVM+datadiv 壳; 用 dlopen->JNI_OnLoad->RegisterNatives(env表索引215) 绕开混淆

脚本: phone_probe_registernatives2(注册表)/phone_java_call_nativeentry(Java读getGUID)/phone_read_hdid(native hook)
      phone_dump_hydev(dump解密so)/phone_probe_login_frame(登录帧)/arm64_disasm(反汇编)
证据: hdid_regtable/java_nativeentry/hdid_read/login_frames/hdid_probe* + libhydeviceid_{original,dump}.so

scripts/arm64_disasm.py

@@ -0,0 +1,43 @@
+#!/usr/bin/env python3
+"""通用 aarch64 反汇编工具: 分析内存 dump 的 libhydeviceid.so (解密后).
+
+用法:
+  arm64_disasm.py <dump.so> <模块基址> <偏移hex> [长度字节]
+例:
+  反汇编 JNI_OnLoad(0x22c4c8) 前 0x300 字节:
+  arm64_disasm.py evidence/diag_phone/libhydeviceid_dump.so 0x7814211000 0x22c4c8 0x300
+  打印所有 BL/BLR 分支目标到模块偏移.
+"""
+from __future__ import annotations
+
+import sys
+from capstone import Cs, CS_ARCH_ARM64, CS_MODE_ARM
+
+
+def load(fn):
+    with open(fn, "rb") as f:
+        return f.read()
+
+
+def main():
+    dump_path = sys.argv[1]
+    base = int(sys.argv[2], 16)
+    start_off = int(sys.argv[3], 16)   # 相对模块基址的偏移 (内存态文件里约等于文件偏移)
+    length = int(sys.argv[4], 16) if len(sys.argv) > 4 else 0x200
+    data = load(dump_path)
+    md = Cs(CS_ARCH_ARM64, CS_MODE_ARM)
+    md.detail = True
+    code = data[start_off:start_off + length]
+    print(f"# base=0x{base:x} start_off=0x{start_off:x} len=0x{length:x}")
+    for insn in md.disasm(code, base + start_off):
+        disp = ""
+        if insn.mnemonic.startswith(("b.", "b ")) or insn.mnemonic in ("bl", "br", "blr", "cbz", "cbnz"):
+            if insn.operands:
+                disp = f"  ; -> 0x{insn.operands[0].imm:x}"
+            elif insn.mnemonic == "blr":
+                disp = "  ; [indirect call]"
+        print(f"  0x{insn.address:x}\t{insn.mnemonic:8s} {insn.op_str}{disp}")
+
+
+if __name__ == "__main__":
+    main()