From 55a2d6fe166f45dbe8e236e45325e17242fcb7c6 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Tue, 25 Aug 2026 18:50:05 +0800
Subject: [PATCH] =?UTF-8?q?feat(huya):=20=E5=AF=B9=E7=85=A7=E5=AE=9E?=
 =?UTF-8?q?=E9=AA=8C-=E6=AF=8F=E6=AC=A1=E7=99=BB=E5=BD=95=E9=93=B8?=
 =?UTF-8?q?=E6=96=B0cred,=20=E9=92=A5=E4=BB=A3=E6=AC=A1=E8=BD=AE=E6=8D=A2?=
 =?UTF-8?q?=E6=A8=A1=E5=BC=8F=E5=8F=91=E7=8E=B0(0x20/30/40/50)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/虎牙hyCred签发-侦察笔记.md | 10 ++++++++++
 evidence/forge_bind_result.json |  2 +-
 evidence/getcred.json           |  2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md
index f2e5256..af33a39 100644
--- a/docs/虎牙hyCred签发-侦察笔记.md
+++ b/docs/虎牙hyCred签发-侦察笔记.md
@@ -283,3 +283,13 @@ hy_300023887/aa778899 SHA1=金样本哈希(同一账号历史登录)。
 下一步(精确): 设备登录时hook HandlerResponseLoginPassport::onHandler+
 saveLoginData, 对照同账号纯Python响应字节, 直接对出cred真实位置/形态。
 全部传输+组包+解析代码已就绪且验证通过。
+
+## 对照实验定论
+
+设备当前cred(0a30开头,bind有效)不在纯Python登录响应中 => 每次登录铸新cred,
+响应t3即新鲜cred本体。但新鲜cred铸证bind仍40020。
+关键观察: cred第二字节 0x20/0x30/0x40/0x50 轮换 -- 与证书key_idx同域!
+=> cred内部含钥代次信息, 新鲜cred或绑定登录会话上下文(需配套session/sdid),
+   或响应态与存储态之间有一步转换(saveLoginData前?)。
+下一步: 设备登录时hook saveLoginData入参bean与getCred出口做同会话字节对照,
+精确定位 响应t3 -> 存储cred 的转换函数。
diff --git a/evidence/forge_bind_result.json b/evidence/forge_bind_result.json
index 557fa44..5390564 100644
--- a/evidence/forge_bind_result.json
+++ b/evidence/forge_bind_result.json
@@ -8,5 +8,5 @@
   }
  },
  "p1_new_hex": "010400353030381400c25220f81f60cf64ee54e83ef1eab6bdd047b5af28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a4003ef982e01399335f13e9ae294ebdf18a91fc43e6be883c67a7e19784689ec2d38b5c55b79048d8bec1ab66e55749605a86eb6eae62805a708910655b0be91056b9d7159d2bf116eaed44ded41d7b7fe810d0fbd6e3a689dcd2daa8477c304a49ab2b17d2512b9bc99e33f7d6e99daec",
- "ts": 1787654648.662272
+ "ts": 1787654957.844005
 }
\ No newline at end of file
diff --git a/evidence/getcred.json b/evidence/getcred.json
index cb93687..36ecb37 100644
--- a/evidence/getcred.json
+++ b/evidence/getcred.json
@@ -1 +1 @@
-[{"type": "armed"}, {"type": "getcred", "uid": "0x11751b8656f", "out": {"len": 152, "v": "43694158485569467535753044796c526572535138324e4b426b447051754a414f654c306361576d6167786b5a69746f7844396b7151713567746770692f7864354f574b43375a68656e7134374d63777a6553696939676f4a684357797057324a487536586b63554f56466d2b614975734d6d56546d30496b4c70412b705565634f59386645794f6a6c564839736f436d44447a4774766f"}}, {"type": "java_cred", "cls": "com.huyaudbunify.HuyaAuth", "r": "com.huyaudbunify.bean.ResGetCred@9bed1cb"}]
\ No newline at end of file
+[{"type": "armed"}, {"type": "getcred", "uid": "0x11751b8656f", "out": {"len": 152, "v": "436a4442354845635149344e7677696839754d512f62686d7279484e6441715a7a32683257413253366b6b594d6d494437306a4165654f54777471423757507a2b7a42307669525a3668304a7058355542776a2f6479567954673569782f4a624b506d457642777a49416d2b382b64416d3943564c77616a4e6e58362b417373456e7849496a334f4e665051626e6d6c7556416d692f7866"}}, {"type": "java_cred", "cls": "com.huyaudbunify.HuyaAuth", "r": "com.huyaudbunify.bean.ResGetCred@e856602"}]
\ No newline at end of file