feat(huya): ga k209202=16B块加密器+状态门打通 (R26)

- k209202 反汇编: len==16严格校验 + 0x24334状态化块加密核心
- mfa 0x48C18=单例字段 补非零后 b87_全链LIVE (XXTEA+inflate执行!)
- 定论: 捕获密文密钥=设备材料派生(非静态), 传输链静态解=需ga IDA导出
- 下一步: 用户导 turingga.so / 或抓服务器 resp 旁路

tools/unidbg/hydev/src/hydev/TuringProbe.java

@@ -280,6 +280,13 @@ public class TuringProbe {
             DvmObject<?> sa = vm.resolveClass("android/util/SparseArray").newObject(null);
             DvmObject<?> dba = vm.resolveClass("[B").newObject(blob);
             DvmObject<?> map = vm.resolveClass("java/util/HashMap").newObject(null);
+            // 补 0x48C18 门 (单例字段 a1+64) — 非零即可过 b87_ 的 qword_48C18 检查
+            try {
+                com.github.unidbg.pointer.UnidbgPointer st = emulator.getMemory().mmap(0x100, 7);
+                st.setMemory(0, 0x100, (byte) 0);
+                com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, m.base + 0x48C18).setPointer(0, st);
+                System.out.println("[TP] state 0x48C18 <- " + Long.toHexString(st.peer));
+            } catch (Throwable t3) { System.out.println("[TP] state EXC " + t3); }
             // 直调 impl: module.base + 0x25c98; 参数: env, null, 局部引用句柄(int), ..., 1
             long fn = m.base + 0x25c98;
             int hsa = vm.addLocalObject(sa);
@@ -288,7 +295,7 @@ public class TuringProbe {
             System.out.println("[TP] calling b87_ @ " + Long.toHexString(fn) + " blob=" + blob.length
                     + " refs hsa=" + hsa + " hba=" + hba + " hmap=" + hmap);
             int iv = Integer.parseInt(System.getenv().getOrDefault("TP_INT", "1"));
-            Number ret = m.callFunction(emulator, fn, vm.getJavaVM(), null, hsa, hba, hmap, iv);
+            Number ret = m.callFunction(emulator, fn, ((com.github.unidbg.pointer.UnidbgPointer) vm.getJNIEnv()).peer, 0, hsa, hba, hmap, iv);
             System.out.println("[TP] b87_ ret=" + ret + " int=" + iv + " blob=" + blobPath);
         } catch (Throwable t) {
             System.out.println("[TP] callEnc EXC " + t);
@@ -426,6 +433,15 @@ public class TuringProbe {
                 com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, ggap).setMemory(0, 0x720, (byte) 0);
             } catch (Throwable t) {}
             try { dm.callJNI_OnLoad(emulator); } catch (Throwable t) {}
+            // 补 ga 0x48c18 状态指针 (ldr w8,[x8] 解引用) + 邻近槽
+            try {
+                com.github.unidbg.pointer.UnidbgPointer gst = emulator.getMemory().mmap(0x40, 7);
+                gst.setMemory(0, 0x40, (byte) 0);
+                gst.setInt(0, 1);
+                com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, gm.base + 0x48c18).setPointer(0, gst);
+                com.github.unidbg.pointer.UnidbgPointer.pointer(emulator, gm.base + 0x48c20).setPointer(0, gst);
+                System.out.println("[TP] ga state 0x48c18 <- " + Long.toHexString(gst.peer));
+            } catch (Throwable t) {}
             byte[] blob = new java.io.FileInputStream(blobPath).readAllBytes();
             DvmObject<?> byteObj = vm.resolveClass("[B").newObject(blob);
             long env = ((com.github.unidbg.pointer.UnidbgPointer) vm.getJNIEnv()).peer;