From 96d75462a59226dc28358825831838964225f4cb Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Fri, 28 Aug 2026 23:43:40 +0800
Subject: [PATCH] =?UTF-8?q?feat(huya):=20AESkeyMgr=E9=92=A5=E8=A1=A8?=
 =?UTF-8?q?=E6=8C=89id=E6=B3=A8=E5=86=8C=E5=AE=9A=E6=A1=88(ZMHAVPRaxJ3MtXD?=
 =?UTF-8?q?jduUnXAKQ=E4=B8=BA=E9=A6=96=E9=94=AE)=20+=20encode=5Faes=20API?=
 =?UTF-8?q?=E8=A7=A3=E7=A0=81=20+=20=E6=9C=B4=E7=B4=A0AES=E7=88=86?=
 =?UTF-8?q?=E7=A0=B4=E8=AF=81=E4=BC=AA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- C2@26fcc8=钥表构造: id1-4 键 VA 全定位
- encode_aes(IN,KEY,OUT) → UdbAESUtil(key).encrypt: 纯自研AES(KeyExpansion/Cipher自实现)
- 24B钥×多模式×10候选明文 与 ed0db8 零命中 → 密钥必经C1加工
---
 docs/HUYA_HDID_ALGORITHM_GEN.md | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md
index 97ede8d..85a4dde 100644
--- a/docs/HUYA_HDID_ALGORITHM_GEN.md
+++ b/docs/HUYA_HDID_ALGORITHM_GEN.md
@@ -527,3 +527,34 @@ hdid = md5(AID)/md5(MID)/md5(AID+MID)/md5(AID+CFG)/md5(AID+MID+CFG)/sha1(AID)[:3
 ### 下步 (unidbg 执行路线)
 C2/钥表已定位 → 下一步 = unidbg 调 AESkeyMgr/C2-相关 sign/AES 函数 (hyudb_otp_encrypt@0x32fa24,
 UdbAESUtil::encrypt, xxtea...) 以可控输入差分 → 复刻 32hex-HDID32 生成。
+
+## §11.14 AESkeyMgr 钥表按 id 注册 + encode_aes API 定案 (2026-08-28 夜)
+
+### AESkeyMgr::C2@0x26fcc8 = 钥表构造 (按 id 注册 24 字符钥)
+| id | 钥 | VA |
+|---|---|---|
+| 1 | `ZMHAVPRaxJ3MtXDjduUnXAKQ` | 0x1c155e |
+| 2 | `4VYcPdvKKqjBHZtCmbroRXHk` | 0x1bc810 |
+| 3 | `xXEDWqiKLGwEZ6HubEiswCqK` | 0x1bc829 |
+| 4 | `3FMHubdKosFrhmXNLHTNHZwe` | 0x1bc842 |
+| (C2 前置装载) | `owNMiaCgcHmqoTr3iRamFuHj` | 0x1b898b |
+| KFWAH/ybEWdv 族 | 0x1b9f27/0x1b9f40 | R2 旧线索 |
+
+### encode_aes API (0x330218) 完全解码
+```
+encode_aes(IN:std::string&, KEY:std::string&, OUT:std::string&)
+  1. OUT.assign(常量串@0x1ba000+0xa90)    ← 初始化输出
+  2. UdbAESUtilC1(KEY)                    ← 构造器吞 KEY
+  3. UdbAESUtil::encrypt(IN, OUT)         ← 加密
+```
+- lib 自带完整 AES 原语: KeyExpansion@0x24ebd4, Cipher@0x24f314, MixColumns/AddRoundKey/
+  InvSubBytes/InvShiftRows/InvMixColumns/FFmul — **纯自研 AES (非 openssl!)**
+- `UdbAESUtil::_encrypt@0x24f9f0` = 底层; `hyudb_otp_encrypt@0x32fa24` = OTP 封装
+
+### 朴素 AES 爆破实验 (证伪)
+24B 钥 × {ECB, CBC-zeroIV} × {md5(aid/mid/…), sha1, aid-bytes, cfg-b64…, 10 候选明文}
+→ 与 ed0db8 零命中。**key 必经 UdbAESUtilC1 加工 (派生/置换) 或自研变异 AES**。
+
+### 下步 (定位派生)
+A. unidbg 调 encode_aes(in, key) → 输出对拍 (可控输入差分)
+B. 静态读 UdbAESUtilC1/KeyExpansion(0x24ebd4) 取派生规则 → Python 复刻