feat(huya): 头结构破译(版本/会话ID)+密钥候选批量否定 (R28)

- 13B头=[2B魔数][1B版本01/11][7B会话ID(身份相关!)][3B动态]
- 20密钥候选全灭 (lencheck全False) - 派生含未知变换
- 加密链底座已验证; 密钥派生=ga内部需IDA导出

tools/unidbg/hydev/src/hydev/TuringProbe.java

@@ -346,8 +346,17 @@ public class TuringProbe {
             int n = blob.length / 4;
             com.github.unidbg.pointer.UnidbgPointer vp = emulator.getMemory().mmap(blob.length + 32, 7);
             for (int i=0;i<blob.length;i++) vp.setByte(i, blob[i]);
-            // key @ 3DF88 (LOAD-1 identity fileoff==vaddr)
+            // key @ 3DF88 (LOAD-1 identity fileoff==vaddr); 或 TP_KEY 文件
             long keyPtr = m.base + 0x3DF88;
+            String kf = System.getenv("TP_KEY");
+            if (kf != null && !kf.isEmpty()) {
+                byte[] kb = new java.io.FileInputStream(kf).readAllBytes();
+                byte[] k16 = java.util.Arrays.copyOf(kb, 16);
+                com.github.unidbg.pointer.UnidbgPointer kp = emulator.getMemory().mmap(32, 7);
+                for (int i=0;i<16;i++) kp.setByte(i, k16[i]);
+                keyPtr = kp.peer;
+                System.out.println("[TP] key override: " + java.util.HexFormat.of().formatHex(k16));
+            }
             System.out.println("[TP] xtest " + (enc ? "ENC" : "DEC") + " sub_24D58 n=" + n + " key@" + Long.toHexString(keyPtr));
             Number ret = m.callFunction(emulator, 0x24D58, vp.peer, enc ? n : -n, keyPtr);
             System.out.println("[TP] xtest ret=" + ret);