From 93365e22c7a741a50607b3f5e9f0e7fb59a29a87 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Tue, 25 Aug 2026 18:00:15 +0800
Subject: [PATCH] =?UTF-8?q?feat(huya):=20createWupPackage=E7=AD=BE?=
 =?UTF-8?q?=E5=90=8D=E7=A0=B4=E8=A7=A3=20-=20TAF=20RequestPacket=E7=BB=93?=
 =?UTF-8?q?=E6=9E=84=E5=AF=B9=E4=B8=8A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/虎牙hyCred签发-侦察笔记.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md
index 1130adf..fe4793a 100644
--- a/docs/虎牙hyCred签发-侦察笔记.md
+++ b/docs/虎牙hyCred签发-侦察笔记.md
@@ -186,3 +186,12 @@ wsapi/wupudbrequest_v0 仅用于dfp等短连流程。
   - 函数体内引用 wupudbrequest_v0 与 huyaudbwebui
 下步: 反汇编该函数+其调用链(经PLT), 提取长连接帧格式(msgId+JSON的JCE摆放),
 然后 Python直连 wup.huya.com:443 组 TAF UniPacket 发送取cred。
+
+## 新目标R1: createWupPackage签名破解
+
+_Z16createWupPackageP...PKci @0x274ea4 (0x610B):
+  args=(UniPacket* pkt, const char* payload, int id)
+  pkt+0x0=u16 3, +0x8=id(w8<-arg), +0xc0=u16 3;
+  func硬编码"wupudbrequest_v0"; payload=x1。
+=> 对应TAF RequestPacket{iVer,cPktType,iReqId,servant,func,sBuffer,...}
+下步: 找PLT调用点看运行时实参(payload格式/id值), 复刻帧->Python直连wup.huya.com:443。