From 0e262ada7c1116a1a8d6c2a279e8542ea2df3967 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Tue, 25 Aug 2026 16:36:17 +0800
Subject: [PATCH] =?UTF-8?q?feat(huya):=20LoginPassport=E6=B3=A8=E5=86=8C?=
 =?UTF-8?q?=E5=B8=B8=E9=87=8F0x20=E4=B8=8E=E8=AF=81=E4=B9=A6key=5Fidx?=
 =?UTF-8?q?=E5=90=8C=E5=80=BC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/虎牙hyCred签发-侦察笔记.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md
index f19c05c..4260a3d 100644
--- a/docs/虎牙hyCred签发-侦察笔记.md
+++ b/docs/虎牙hyCred签发-侦察笔记.md
@@ -109,3 +109,11 @@ UdbRequestMsg<RequestLoginPassport>::unPackageMsg(@0x2a57cc) =
 => 疑似 (方向类型<<12)|序号 或注册type常量; 完整id需反汇编
    UdbObjCreator_MsgInit::C2 的 registerMsg(id,className,creator) 调用序列。
 已知参照: MsgGetH5InfoEx=184549387(0x0B00000B)。
+
+## Round4: 注册常量=0x20
+
+Request/Response LoginPassport 两个 Creator::C2 均以 movz w0,#0x20 构造
+(UdbClassFactory), 地址 0x289b28/0x289c2c。0x20 与证书 key_idx 字节(0x20)同值!
+=> 猜测: 0x20 是该消息族的类型号, 线上完整 msgId 需结合工厂注册表;
+   或 key_idx 本就是消息族类型号的镜像(服务端按它选处理分支/密钥)。
+捷径备选: 设备hook UdbMsgHandler::sendMessage 抓真实线上id(需用户重登一次)。