diag(huya): getOtp流程死点=to_string@0x4543c0(serviceTime=0) - OTP调用差最后一步

docs/HUYA_HDID_ALGORITHM_GEN.md

@@ -839,3 +839,9 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a
   → 重构后 getOtp 流程穿透: 26916c→…→2691c0 (x20=0 首串校验过) 不再早退!
 ### 未捕获: OTP 调用点 269324 hook 未触发 (流程在 2691c4-2692fb 未hook窗口内或 4542c0 getServiceTime 段)
 ### 状态: appSign 生成复刻仍未完成 - 差距仅剩"抓到 getOtp 内部真实 OTP 输出"
+
+## §11.34 getOtp 全流程钩子追踪定界 (R10b)
+- 全覆盖 hook (0x2691a4-0x269330) 40 命中: 流程走通到 **0x269278 (bl to_string@0x4543c0, to_string(serviceTime=0))** 后无后续
+- OTP 调用点 0x269324 未达 → **流程死在 to_string-CALL (libc++-PLT 0x4543c0)**
+- x0=serviceTime=0 (仿真时钟 0) — 需查 0x4543c0 解析/或给 getServiceTime 注入真实时间
+- 剩余步骤: ① 过 to_string (hook 0x4543c0 验证) ② OTP 调用 0x269324 [sp]=OUT& ③ 输出 vs ed0db8

tools/unidbg/hydev/src/hydev/AesProbe.java

@@ -263,9 +263,16 @@ public class AesProbe {
                             long a5 = backend.reg_read(Arm64Const.UC_ARM64_REG_X5).longValue();
                             long x23 = backend.reg_read(Arm64Const.UC_ARM64_REG_X23).longValue();
                             long x20 = backend.reg_read(Arm64Const.UC_ARM64_REG_X20).longValue();
-                            System.out.println("[hook-args] x0=" + Long.toHexString(a0) + " x1=" + Long.toHexString(a1) + " x2=" + Long.toHexString(a2)
+                            long sp = backend.reg_read(Arm64Const.UC_ARM64_REG_SP).longValue();
-                                + " x3=" + Long.toHexString(a3) + " x4=" + Long.toHexString(a4) + " x5=" + Long.toHexString(a5) + " x6=" + a6
+                            long outPtr = 0, x19r = 0;
-                                + " x7=" + Long.toHexString(a7) + " x20=" + Long.toHexString(x20) + " x23=" + Long.toHexString(x23));
+                            if (address == module.base + 0x269324L) {
+                                UnidbgPointer spP = UnidbgPointer.pointer(emulator, sp);
+                                if (spP != null) { outPtr = spP.getLong(0); x19r = backend.reg_read(Arm64Const.UC_ARM64_REG_X19).longValue(); }
+                            }
+                            System.out.println("[hook-args] @0x" + Long.toHexString(address) + " x0=" + Long.toHexString(a0) + " x1=" + Long.toHexString(a1)
+                                + " x2=" + Long.toHexString(a2) + " x3=" + Long.toHexString(a3) + " x4=" + Long.toHexString(a4) + " x5=" + Long.toHexString(a5)
+                                + " x6=" + a6 + " x7=" + Long.toHexString(a7) + " sp=" + Long.toHexString(sp)
+                                + (address == module.base + 0x269324L ? (" OUT@[sp]=0x" + Long.toHexString(outPtr) + " x19=" + Long.toHexString(x19r)) : ""));
                         } catch (Throwable t) { System.out.println("[hook-args] err " + t); }
                     }
                 }
@@ -273,11 +280,10 @@ public class AesProbe {
                 public void detach() {}
             };
             emulator.getBackend().hook_add_new(th, ENTRY, ENTRY, null);
-            emulator.getBackend().hook_add_new(th, module.base + 0x2691a4L, module.base + 0x2691acL, null);
+            emulator.getBackend().hook_add_new(th, module.base + 0x2691a4L, module.base + 0x2691d8L, null);
-            emulator.getBackend().hook_add_new(th, module.base + 0x2691b0L, module.base + 0x2691c0L, null);
+            emulator.getBackend().hook_add_new(th, module.base + 0x26921cL, module.base + 0x269330L, null);
-            emulator.getBackend().hook_add_new(th, module.base + 0x2692fcL, module.base + 0x269330L, null);
             emulator.getBackend().hook_add_new(th, module.base + 0x4543a0L, module.base + 0x4543a4L, null);
-            System.out.println("[hook] installed flow-traces");
+            System.out.println("[hook] installed full-flow 0x2691a4->0x269330");
             scanHeapWindow("[getOtp-pre]");
             // BusinessCfg::getInstance @0x281270
             Number inst = module.callFunction(emulator, 0x281270L);