feat(huya): 登录路径OTP全链LIVE验证 + appSign≠getOtp结构性证伪 (R14)

- 决定性捕获(hook_huya_crypto.js全链): xxtea密钥=账号稳定uid(1199666914671)
  getkey(1,2)=MKDK/1,3=nskdI7, md5输入=k1+getkey, AES明文=[02][0c00][12B xxtea][7200][114B cred] 逐字节验证
- frida入口arg0读""为误读(SSO读取bug), 内部xxtea钩子为真值
- GOLD模式(正确uid)346k+J2 6.2M+I 6.3M+H 1.39M 全零 -> ~14.3M差分终态
- 结构性证明: appSign跨账号稳定 vs getOtp账号级(cred轮换) -> t1.t0≠OTP-mid QED
- 更正旧文档: in=uid非空串; 登录可带frida; 金样本uid=1199666914671
- 下一步: createWupRequestData@0x38dab0 appSign填充点反汇编

tools/frida/run_capture.py

@@ -26,7 +26,7 @@ PKG = "com.duowan.kiwi"
 SERVER_PATH = "/data/local/tmp/fs152"
 SERVER_PORT = "31878"
 BYpass_RE = "/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0/evidence/scripts/bypass_msaoaid_maps_art_callsite.js"
-HOOK_LOCAL = os.path.join(HERE, "hook_otp_capture.js")
+HOOK_LOCAL = os.environ.get("CAP_HOOK", "/Users/yml/codes/Reverse-Engineering-Agent-Universal-v3.0/evidence/scripts/hook_huya_crypto.js")
 
 MAX_ATTEMPTS = int(os.environ.get("CAP_MAX_ATTEMPTS", "8"))
 WINDOW_SEC = int(os.environ.get("CAP_WINDOW", "150"))