From 9488522be4b2e041da5a61bdaad49b4ead6e62e6 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Tue, 25 Aug 2026 16:20:57 +0800
Subject: [PATCH] =?UTF-8?q?feat(huya):=20B1=E9=9D=99=E6=80=81=E9=A6=96?=
 =?UTF-8?q?=E9=93=B2=20-=20=E7=99=BB=E5=BD=95=E6=80=81JSON=E5=AD=97?=
 =?UTF-8?q?=E6=AE=B5=E5=90=8D=E9=9B=86=E7=BE=A4+=E6=96=B024=E5=AD=97?=
 =?UTF-8?q?=E7=AC=A6=E5=AF=86=E9=92=A5=E5=8F=91=E7=8E=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/虎牙hyCred签发-侦察笔记.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md
index a9ce6f7..72d790f 100644
--- a/docs/虎牙hyCred签发-侦察笔记.md
+++ b/docs/虎牙hyCred签发-侦察笔记.md
@@ -73,3 +73,11 @@ BusinessCfg::saveLoginData ← _Z13saveLoginDataiR17BusBeansLoginData
   下一步：静态对比 HandlerRequestLoginPassport 组包 vs huya_wup_encoder 差异；
   或 mitmproxy 抓一次 App 真实密码登录流量对照。
 - 若确认必须长连接 → 路线 C（WSP 客户端）或路线 A（混合采集）兜底。
+
+## ★ B1 静态第一铲（rodata 字符串集群 @0x1c36db）
+
+登录态 JSON 字段名: appId / sdkVer / cred / timestamp / biztoken_vec
+新发现 24 字符密钥: ViDjMAKmkzvYEUFmrMdk9YPd (@0x1c3704, 疑似登录态文件AES钥或密钥表第4条)
+消息类名串: MsgRequestLgnCred(@0x1c385a) / hyAppOtpLogin / LgnOtpLogin
+下一步: 反汇编 BusBeansRequestLoginPassport::toString(JsonUtil)@0x2a6118 提取请求全字段,
+对照 huya_wup_encoder 补齐 → 试发 HTTPS 端点看响应是否带 cred。