feat(huya): 对照实验-每次登录铸新cred, 钥代次轮换模式发现(0x20/30/40/50)

docs/虎牙hyCred签发-侦察笔记.md

@@ -283,3 +283,13 @@ hy_300023887/aa778899 SHA1=金样本哈希(同一账号历史登录)。
 下一步(精确): 设备登录时hook HandlerResponseLoginPassport::onHandler+
 saveLoginData, 对照同账号纯Python响应字节, 直接对出cred真实位置/形态。
 全部传输+组包+解析代码已就绪且验证通过。
+
+## 对照实验定论
+
+设备当前cred(0a30开头,bind有效)不在纯Python登录响应中 => 每次登录铸新cred,
+响应t3即新鲜cred本体。但新鲜cred铸证bind仍40020。
+关键观察: cred第二字节 0x20/0x30/0x40/0x50 轮换 -- 与证书key_idx同域!
+=> cred内部含钥代次信息, 新鲜cred或绑定登录会话上下文(需配套session/sdid),
+   或响应态与存储态之间有一步转换(saveLoginData前?)。
+下一步: 设备登录时hook saveLoginData入参bean与getCred出口做同会话字节对照,
+精确定位 响应t3 -> 存储cred 的转换函数。

evidence/forge_bind_result.json

@@ -8,5 +8,5 @@
   }
  },
  "p1_new_hex": "010400353030381400c25220f81f60cf64ee54e83ef1eab6bdd047b5af28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a4003ef982e01399335f13e9ae294ebdf18a91fc43e6be883c67a7e19784689ec2d38b5c55b79048d8bec1ab66e55749605a86eb6eae62805a708910655b0be91056b9d7159d2bf116eaed44ded41d7b7fe810d0fbd6e3a689dcd2daa8477c304a49ab2b17d2512b9bc99e33f7d6e99daec",
- "ts": 1787654648.662272
+ "ts": 1787654957.844005
 }

evidence/getcred.json

@@ -1 +1 @@
-[{"type": "armed"}, {"type": "getcred", "uid": "0x11751b8656f", "out": {"len": 152, "v": "43694158485569467535753044796c526572535138324e4b426b447051754a414f654c306361576d6167786b5a69746f7844396b7151713567746770692f7864354f574b43375a68656e7134374d63777a6553696939676f4a684357797057324a487536586b63554f56466d2b614975734d6d56546d30496b4c70412b705565634f59386645794f6a6c564839736f436d44447a4774766f"}}, {"type": "java_cred", "cls": "com.huyaudbunify.HuyaAuth", "r": "com.huyaudbunify.bean.ResGetCred@9bed1cb"}]
+[{"type": "armed"}, {"type": "getcred", "uid": "0x11751b8656f", "out": {"len": 152, "v": "436a4442354845635149344e7677696839754d512f62686d7279484e6441715a7a32683257413253366b6b594d6d494437306a4165654f54777471423757507a2b7a42307669525a3668304a7058355542776a2f6479567954673569782f4a624b506d457642777a49416d2b382b64416d3943564c77616a4e6e58362b417373456e7849496a334f4e665051626e6d6c7556416d692f7866"}}, {"type": "java_cred", "cls": "com.huyaudbunify.HuyaAuth", "r": "com.huyaudbunify.bean.ResGetCred@e856602"}]