From 92eb39cd9d20d604d91bd5825673ea8ffa22f954 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Sat, 29 Aug 2026 00:11:52 +0800
Subject: [PATCH] =?UTF-8?q?feat(huya):=20OTP=E5=87=BB=E7=A9=BF=20-=20arg?=
 =?UTF-8?q?=E8=AF=AD=E4=B9=89(arg1=3D2)=20+=20=E8=BE=93=E5=87=BA=E7=BB=93?=
 =?UTF-8?q?=E6=9E=84(0x03+=E5=8F=AF=E5=8F=98+=E5=9B=BA=E5=AE=9A32hex?=
 =?UTF-8?q?=E5=B0=BE8b38f1)=20-=2032hex=E5=BD=A2=E6=80=81=E5=AE=9E?=
 =?UTF-8?q?=E9=94=A4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/HUYA_HDID_ALGORITHM_GEN.md            | 20 ++++++++++++++++++++
 tools/unidbg/hydev/src/hydev/AesProbe.java |  2 +-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md
index 19a385d..7ad6e80 100644
--- a/docs/HUYA_HDID_ALGORITHM_GEN.md
+++ b/docs/HUYA_HDID_ALGORITHM_GEN.md
@@ -632,3 +632,23 @@ UdbAESUtilC1 + encrypt             ← AES 层
 ### 在途
 - 子代理静态复刻 KeyExpansion/Cipher → huya_aes_replica.py (3 验证向量)
 - 下步: OTP 参数语义 (读 32fa24 前半 arg 处理) + getkey 双 id 材料
+
+## §11.19 hyudb_otp_encrypt 击穿: 参数语义 (arg1 必须=2) + 32hex 结构现形 (2026-08-28 夜)
+
+### 参数语义 (静态)
+- arg1 (uint8) 必须 == 2 (cmp #2 b.ne early-return) — 探测值修正后链路全通
+- 32fa24 签名: (string-in, h=2, h, string, string, string, h, m, string&out)
+
+### OTP 权威输出 (unidbg)
+| 输入 | 输出 (hex) |
+|---|---|
+| in=abc key=ZMHAV… | `03 0088fa6ee519d52f61348e01d6e74c81cd8b38f113056fe498b0c7de2ffd52c7b0` |
+| in=1e8bdf7d… key=KFWAH… | `03 0043c5bf3f792216e249116c968c84ff3a8b38f113056fe498b0c7de2ffd52c7b0` |
+
+**结构: 0x03 + 可变(输入依赖) + 固定 32hex 尾 `8b38f113056fe498b0c7de2ffd52c7b0`** — 32hex 形态实锤,
+可变段 = 输入序列化 + AES/xxtea 层, 固定尾 = 静态钥派生 MAC (跨输入稳定!)。
+
+### 下步 (round7)
+1. OTP 输入差分 (变 in/变 key → 可变为/尾变?)
+2. 固定尾溯源 (8b38f1… = md5/aes(静态钥材料)?)
+3. 32hex-HDID32 (ed0db8) vs OTP 体系对拍 (登录帧 t1.t0 可能 = OTP 输出的某段!)
diff --git a/tools/unidbg/hydev/src/hydev/AesProbe.java b/tools/unidbg/hydev/src/hydev/AesProbe.java
index 54b18ff..aa4a4e4 100644
--- a/tools/unidbg/hydev/src/hydev/AesProbe.java
+++ b/tools/unidbg/hydev/src/hydev/AesProbe.java
@@ -145,7 +145,7 @@ public class AesProbe {
         // 尝试 4 位置: arg0=in, arg1=?, arg2=?, arg3=key, arg4=?, arg5=?, arg6=h, arg7=m, arg8=out
         try {
             Number r = module.callFunction(emulator, 0x32fa24L,
-                UnidbgPointer.nativeValue(pa), 1L, 2L,
+                UnidbgPointer.nativeValue(pa), 2L, 0L,
                 UnidbgPointer.nativeValue(pb), UnidbgPointer.nativeValue(pc), UnidbgPointer.nativeValue(pd),
                 3L, 4L, UnidbgPointer.nativeValue(pout));
             String out = readStdString(pout);