feat(huya): cred来源定位 - HandlerResponseLoginPassport护照登录响应

- backtrace实锤: saveLoginData<-HandlerResponseLoginPassport<-JceInputStream
- cred随护照登录响应一次性下发(BusBeansLoginData), 非独立消息
- HTTPS passwordLogin简化通道响应无cred(二次扫描确认)
- 下一步: 对比App真实登录请求字段 / 长连接WSP复刻 / 混合采集兜底

scripts/hook_cred_issue.py

@@ -42,18 +42,27 @@ Interceptor.attach(base.add(0x250038), {
   }
 });
 
-// saveLoginData(string const&, BusBeansLoginData&, bool) 与 (BusBeansLoginData&, bool)
+// saveLoginData 全量版: bean dump 768B + backtrace 10帧
 Interceptor.attach(base.add(0x265fb0), {
   onEnter: function(a){
-    send({type:'saveLD_str', str:rdStr(a[1]), bean_head:hx(a[2],128), ra:ra(this)});
+    send({type:'saveLD_str', str:rdStr(a[1]), bean_head:hx(a[2],768),
+          bt:Thread.backtrace(this.context, Backtracer.FUZZY).slice(0,10)
+             .map(function(x){return DebugSymbol.fromAddress(x).toString().slice(0,64);})});
   }
 });
 Interceptor.attach(base.add(0x265a6c), {
   onEnter: function(a){
-    send({type:'saveLD_bean', bean_head:hx(a[1],160), b:rdStr(a[1]), flag:a[2].toInt32(), ra:ra(this)});
+    send({type:'saveLD_bean', bean_head:hx(a[1],768), flag:a[2].toInt32(),
+          bt:Thread.backtrace(this.context, Backtracer.FUZZY).slice(0,10)
+             .map(function(x){return DebugSymbol.fromAddress(x).toString().slice(0,64);})});
   }
 });
 
+// cred 打包/解包(网络侧明文必经)
+Interceptor.attach(base.add(0x333170), {
+  onEnter: function(a){ send({type:'cred_unpack', in:rdStr(a[1]), ra:ra(this)}); }
+});
+
 // HandlerRequestLoginCred / HandlerResponseLoginCred vtable 探测:
 // vtable+0x10 起为虚函数槽, 逐个attach前3个槽, 打印触发与backtrace首帧
 function probeVtable(name, vtAddr){
@@ -105,10 +114,11 @@ def main():
         if t == 'vt_attached':
             print(f"[vt] {p['name']} slot{p['slot']} @+{p['fp']}")
         elif t == 'saveLD_str':
-            print(f"[saveLD_str] str={p['str']['t']}:{p['str']['len']}:{p['str']['v'][:80]}")
+            print(f"[saveLD_str] str={p['str']['t']}:{p['str']['len']}\n  bean={p['bean_head']}\n  bt={p['bt']}")
         elif t == 'saveLD_bean':
-            print(f"[saveLD_bean] flag={p['flag']} bean={p['bean_head'][:96]}")
-            print(f"   asStr={p['b']}")
+            print(f"[saveLD_bean] flag={p['flag']}\n  bean={p['bean_head']}\n  bt={p['bt']}")
+        elif t == 'cred_unpack':
+            print(f"[cred_unpack] in={p['in']['t']}:{p['in']['len']}:{p['in']['v'][:160]} <- {p['ra']}")
         elif t == 'bigaes':
             print(f"[bigaes] len={p['x2']['len']} head={p['x2']['v'][:120]}")
         elif t == 'vtable':