多账号设备画像: 设备/指纹/风控数据归类 + 每账号独立画像全链接入

- 实测校验矩阵: hdid+app_version 硬锚(APP_SIGN_NOT_MATCH), fingerprint
  换→safe_auth滑块(自动过), device_id/机型/safedeviceid 直接过
- 定位注册接口: df/token+collect(sdid每次新值), wsapi dfpReport链(未破解)
- tools/huya_device_profile.py: 每账号画像生成/持久化(幂等)
- app_login_flow.login_cred / full_web_cookie 接入画像, 端到端出全套cookie

tools/app_login_flow.py

@@ -92,14 +92,25 @@ _DEV = {
 }
 
 
-def wup_password_login_raw(account: str, password: str, timeout: int = 15) -> bytes:
-    """发送WUP密码登录, 返回原始响应字节(不解析)。"""
+def wup_password_login_raw(account: str, password: str, timeout: int = 15,
+                           device_info: dict | None = None,
+                           safedeviceid: str | None = None,
+                           hdid: str | None = None) -> bytes:
+    """发送WUP密码登录, 返回原始响应字节(不解析)。
+
+    device_info: 每账号设备画像 (tools/huya_device_profile.get_profile);
+      缺省用金样本设备 _DEV。换 fingerprint/device_id/机型 会触发
+      safe_auth 滑块 (自动可过); hdid/app_version 是设备注册硬锚, 不可换
+      (实测换之 → APP_SIGN_NOT_MATCH)。
+    """
     uid = account[3:] if account.startswith("hy_") else account
     mj, ua, sd = _golden_assets()
+    dev = device_info or _DEV
     pkt = build_password_login_wup(
-        uid, hashlib.sha1(password.encode()).hexdigest(), sd,
-        "ed0db8334cadd236c00cadf7e11ab5a5",
-        mj["session"], mj["traceId"], ua, _DEV)
+        uid, hashlib.sha1(password.encode()).hexdigest(),
+        safedeviceid or dev.get("safedeviceid") or sd,
+        hdid or dev.get("hdid") or "ed0db8334cadd236c00cadf7e11ab5a5",
+        mj["session"], mj["traceId"], ua, dev)
     r = requests.post(
         WUP_URL, data=pkt,
         headers={"Content-Type": "application/multipart-formdata; charset=UTF-8",
@@ -185,10 +196,15 @@ def solve_safe_auth(risk_url: str, proxies=None, max_retry: int = 2) -> dict:
     raise AppLoginError(f"safe_auth 过验失败: {last_err or '无authId'}")
 
 
-def login_cred(account: str, password: str, max_rounds: int = 3) -> bytes:
-    """账号密码 -> 新鲜cred。触发safe_auth时自动解滑块并重发登录。"""
+def login_cred(account: str, password: str, max_rounds: int = 3,
+               device_info: dict | None = None) -> bytes:
+    """账号密码 -> 新鲜cred。触发safe_auth时自动解滑块并重发登录。
+
+    device_info: 每账号独立设备画像 (tools/huya_device_profile.get_profile),
+      多账号时让每个账号呈现不同设备指纹/机型, 避免统一画像被风控关联。
+    """
     for rnd in range(max_rounds):
-        resp = wup_password_login_raw(account, password)
+        resp = wup_password_login_raw(account, password, device_info=device_info)
         cred = parse_cred(resp)
         if cred:
             return cred