feat(huya): 💎 JAVA侧全逆! Cprivate XXTEA+会话密钥架构+Lyra TLV格式 (R30)

- Cprivate.java 加密/解密器全文 (XXTEA+MD5密钥变换+尾字长度)
- 密钥=SecureRandom 16字符[A-Za-z0-9] (guava.c内存明文! RSA封装上送)
- Lyra TLV: (type<<4)|tag, type 0-13 全表
- 捕获密文可用 Cprivate.a(data,会话key) 解密 - key在内存!
- 下一步: frida抓guava.c → 真key解密明文

tools/frida/hook_cprivate_b.js

@@ -0,0 +1,22 @@
+// 轻量 Java hook: Cprivate.b(byte[] data, byte[] key) — 抓明文+密钥 (单点 hook, 不扫内存!)
+setTimeout(function(){
+  try {
+    Java.perform(function(){
+      try {
+        var Cpr = Java.use('com.tencent.turingfd.sdk.ams.ga.Cprivate');
+        var Melon = Java.use('com.tencent.turingfd.sdk.ams.ga.Melon');
+        Cpr.b.overload('[B','[B').implementation = function(a, b){
+          try {
+            var plainHex = Melon.a(a);   // a() = byte[] -> hex? (Melon.a(byte[]) = hex!)
+            var keyHex = Melon.a(b);
+            console.log('[CPR] Cprivate.b data-len=' + a.length + ' key-len=' + b.length);
+            console.log('[CPR] key=' + keyHex);
+            console.log('[CPR] data-head=' + (plainHex ? plainHex.substring(0, 160) : 'null'));
+          } catch(e) { console.log('[CPR] dump-exc ' + e); }
+          return this.b(a, b);
+        };
+        console.log('[CPR] hooked Cprivate.b');
+      } catch(e2) { console.log('[CPR] no Cprivate: ' + e2); }
+    });
+  } catch(e) { console.log('[CPR] perm-exc ' + e); }
+}, 1500);