From 3811f1419220209fcb91db29ae1fa398553071f5 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Tue, 25 Aug 2026 18:31:33 +0800
Subject: [PATCH] =?UTF-8?q?feat(huya):=20=E5=93=8D=E5=BA=94bean=E8=A7=A3?=
 =?UTF-8?q?=E6=9E=90=E6=88=90=E5=8A=9F=20-=20114B=20hyCred=E4=B8=8E344B=20?=
 =?UTF-8?q?biztoken=E5=AE=9A=E4=BD=8D!?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/虎牙hyCred签发-侦察笔记.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md
index 218fa01..6403f80 100644
--- a/docs/虎牙hyCred签发-侦察笔记.md
+++ b/docs/虎牙hyCred签发-侦察笔记.md
@@ -236,3 +236,14 @@ tag2=name, tag3=BYTES, tag7=INT... 解析器在type=0xe(LIST)处断掉。
 与请求同构。旧dump在该bean的tag5(LIST元素为struct)处解析器断掉。
 下步: 直接用core.huya.taf_protocol切出915B slice完整递归解析,
 按BusBeansAppLoginData字段表(regOrigin..cred@?)对号取cred。
+
+## R6 ★★★ 响应bean完整解析 - cred字段定位!
+
+BusBeansAppLoginData响应结构(纯Python解析):
+  t0{头:ver/meta/timestamp}, t1{业务bean}:
+    t0=i64 uid(1199666914671)
+    t3=BYTES[114] 起始0a50 => hyCred本体!
+    t5子struct: t3=STR4[344]"AQA1Ie6L1o..."(biztoken/cookie)
+    mobileMask/uc_states齐全
+=> 纯Python链路全通: 密码->TAF包->wup.huya.com->cred+token!
+下轮: 精确切片cred(处理长度前缀) -> cert_forge -> 活体bind验证 -> 目标完结。