From b2bf747e7a64bb5e74f61362eec1fc9f34d41808 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Sat, 29 Aug 2026 00:50:13 +0800
Subject: [PATCH] =?UTF-8?q?docs(huya):=20=E7=BB=88=E5=B1=80=E6=80=BB?=
 =?UTF-8?q?=E7=BB=93=20-=203=E8=B4=A6=E5=8F=B7=C3=972=E8=B7=AF=E5=BE=84?=
 =?UTF-8?q?=E9=AA=8C=E6=94=B6=E7=9F=A9=E9=98=B5=20+=20=E8=BE=BE=E6=88=90/?=
 =?UTF-8?q?=E8=BE=B9=E7=95=8C=E5=A6=82=E5=AE=9E=20+=20=E8=90=BD=E5=9C=B0?=
 =?UTF-8?q?=E6=A8=A1=E5=BC=8F=E4=B8=8E=E6=9C=AA=E6=9D=A5=E8=B7=AF=E7=BA=BF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 铸币GUID32恒APP_SIGN / 金样本HDID32签名通过进风控(3账号全一致)
- encode_aes复刻15/15位精确; HDID32独立铸造={getkey派生钥,明文}未达
- 落地: 每账号独立{GUID32,ACTION,DEVID40}+共享HDID32 → cred; 关联代价明示
- docs/HUYA_铸币机-终局总结.md
---
 docs/HUYA_铸币机-终局总结.md                |  61 ++++++++++++++++++++
 evidence/mint/final_golden_300024708.bin    | Bin 0 -> 2094 bytes
 evidence/mint/final_golden_300029555.bin    | Bin 0 -> 2107 bytes
 evidence/mint/final_golden_300030430.bin    | Bin 0 -> 2094 bytes
 evidence/mint/final_mint_300024708.bin      | Bin 0 -> 652 bytes
 evidence/mint/final_mint_300029555.bin      | Bin 0 -> 652 bytes
 evidence/mint/final_mint_300030430.bin      | Bin 0 -> 652 bytes
 tools/unidbg/hydev/src/hydev/DiffProbe.java |  22 +++++++
 8 files changed, 83 insertions(+)
 create mode 100644 docs/HUYA_铸币机-终局总结.md
 create mode 100644 evidence/mint/final_golden_300024708.bin
 create mode 100644 evidence/mint/final_golden_300029555.bin
 create mode 100644 evidence/mint/final_golden_300030430.bin
 create mode 100644 evidence/mint/final_mint_300024708.bin
 create mode 100644 evidence/mint/final_mint_300029555.bin
 create mode 100644 evidence/mint/final_mint_300030430.bin

diff --git a/docs/HUYA_铸币机-终局总结.md b/docs/HUYA_铸币机-终局总结.md
new file mode 100644
index 0000000..bb5431f
--- /dev/null
+++ b/docs/HUYA_铸币机-终局总结.md
@@ -0,0 +1,61 @@
+# 虎牙设备铸币机 — 终局总结 (2026-08-28/29, goal rounds 1-10)
+
+> 命名规范前置: GUID32=doLaunch sGuid | HDID32=登录帧t1.t0.appSign(32hex设备证书) | DEVID40=注册链t5/t2.t8 | MID16=mid | 规范详见 HUYA_ID_NOMENCLATURE.md
+
+## 一、终局验收矩阵 (3 测试账号, 密码 aa778899)
+
+| 账号 | 铸币 GUID32 作 hdid | 金样本 HDID32 作 hdid |
+|---|---|---|
+| hy_300030430 | ❌ APP_SIGN_NOT_MATCH (652B) | ⚠️ RISK-slider (2094B, 签名通过) |
+| hy_300024708 | ❌ APP_SIGN_NOT_MATCH (652B) | ⚠️ RISK-slider (2094B) |
+| hy_300029555 | ❌ APP_SIGN_NOT_MATCH (652B) | ⚠️ RISK-slider (2107B) |
+
+3 账号 × 2 路径全部一致复现 —— 服务端接受度全貌定案:
+- **GUID32 (doLaunch 铸币产物) 永远不是合法登录 hdid** (APP_SIGN 硬拒)
+- **金样本 HDID32 签名通过** → 进入风控滑块 (fresh 账号首登; 滑块 solve → cred,
+  历史实证过: dfpReport 矩阵 "fingerprint 随机 → slider → solver → cred ✅")
+
+## 二、目标达成状态 (如实)
+
+### ✅ 达成 (纯 Python 可用, 全部在线复现)
+1. **GUID32 铸币机**: doLaunch 按 MID16 确定性签发 sGuid (5 mid × 多跑全同值,
+   含任意 mid=aabbccdd00112233) —— tools/huya_launch_mint.py::mint_sguid ✓
+2. **零设备注册链**: getDfpConfig→selectOperator→dfpReport, 随机加密体一律 200,
+   每账号新鲜 ACTION + DEVID40 —— 零设备、无真机 ✓
+3. **登录管线**: 金样本 HDID32 + 新鲜 ACTION → 1571B cred (多次复现; 金样本账号级连出 cred) ✓
+4. **原生加密复刻**: encode_aes@0x330218 纯 Python 逐指令复刻, 15/15 位精确
+   (AES-128 变异: 64B 钥材取[0..15]+4×4转置+列旋转链扩展+无独立ShiftRows)
+   —— tools/huya_aes_replica.py ✓
+5. **device_mint.py 编排器** + 命名规范全库落地 ✓
+
+### ❌ 未达成 (边界如实)
+**HDID32 独立铸造**: 登录帧 t1.t0.appSign (32hex 设备证书) = native 私有派生
+(AESkeyMgr.getkey 双 id 派生钥 × 设备材料明文, AES 密文 16B) ——
+{派生钥, 明文格式} 经多轮爆破 (钥族×转置×b64×md5×明文组合 ×10³) + decode_aes 直解
+全部零命中; 无上行明文通道 (§11.10 全链路不可见)。→ 纯代码不可达 (当前技术)。
+
+## 三、落地模式 (deployable)
+```
+每账号: MID16(任意铸) → doLaunch → GUID32(铸币)     [身份旁证]
+         随机加密体 → 注册链 → ACTION+DEVID40        [登录授权, 每账号新鲜]
+         共享金样本 HDID32 (ed0db8…)                 [唯一签名锚, 全账号复用]
+         → hypasswordLogin → 风险滑块 → solve → cred
+```
+- ✅ 每账号独立: GUID32/ACTION/DEVID40/fingerprint 全独立
+- ⚠️ 共享: HDID32 (服务端可设备维度关联账号 —— 唯一代价)
+- 若需真隔离: 真机/模拟器设备池 (每池一 HDID32) 或 unidbg 全链native仿真
+  (getkey 派生钥 + 明文序列化 = 未来的进阶攻坚点)
+
+## 四、未来可攻路线 (按价值排序)
+1. **getkey 派生钥提取**: unidbg 正确调用 AESkeyMgr::getkey (SSO 返回 x0/x1/x2 读取,
+   需修 DiffProbe 寄存器 API) → 钥定案 → 复刻 appSign → 每账号原生级独立证书
+2. **OTP 组合链复刻**: xxtea+md5_char16+AES 全链 Python 化 (md5字符中段16已识别)
+3. **hyns 5008 帧 Java 构建器**: appSign 明文序列化格式 (ProtoInfo 对应已定案!)
+
+## 五、仓库状态
+- 提交: 铸币修复(ccfa742) → device_mint(9ff5721) → §11.9-§11.22 全档 → 命名规范(eccc00e)
+  → AES复刻(1afbd58+) — 全在 git log
+- 证据: evidence/mint/ (final_*.bin 6 组终局矩阵 + login_* + doLaunch rsp)
+- 工具: tools/device_mint.py / huya_launch_mint.py / huya_device_register.py /
+  core/huya/wup_encoder.py / huya_aes_replica.py / unidbg 双探针 (AesProbe/DiffProbe)
+- 约束遵守: 全程禁 pm clear/attach; 差分全在 PC/unidbg; 手机 13.4.22 身份未破坏
\ No newline at end of file
diff --git a/evidence/mint/final_golden_300024708.bin b/evidence/mint/final_golden_300024708.bin
new file mode 100644
index 0000000000000000000000000000000000000000..440031615182443cc2879822f33d4b4c9f2e05f7
GIT binary patch
literal 2094
zcmd^AYmXae6&`1!CD~1sCY0?(R5UKy(z4#2vFGM(w_!Y<@s4L~&y4NyC8Wb^d+Zt8
zbMaj4v6H|?qUA$d(W)Yf6p#uHt0Ec@poA?*R9u7vU#dhc^de{}q1pze5jWALD#8ih
z_zRpbM>=}X^E~g-(Rm<f&+;uZO9-@)f{?HMP1&ahV-U0&Bdrk_?F0JQ0iHLq-Iic?
z4C^Em`N;40Kr^$@T@V!6H@jCI1&-PRKDY~t%zkff4vH+yAj|OLOUI+rKD%iE->@yN
z6<sBfWMV1W4y<M#m|Ao-`ajUorD(^s11GwQEJclJ0}3aJrKqQQ-V`Canuucvo=i?F
zzV_coo^SN~H)Tav+o11hOHtniP3;C-6mF1hI7znKI0~>vs~L+YP$Cgaq6C>B6A6MO
zuq1{MaTG(Q%>LM!N}B2mZZN~s>}f7-TfP?hQ?Tes<lbc#Qa<+XS2wmdPi?<=_R7}A
zJLkW-{hf2$-#yiwj^Y`PrLZA1pM)ZF&}Tk6t=uMU)pspIIK)EYZWD^^#&zF!yw#Nz
zFj&4Z<mIMqt~e_mXlp76e0|07Z{}s)H~U9)qooyf;A*MB_ibwpS#*F4%r%2jOqQ%G
zh?`3{O4V^4jmhOP@C1vK<Dyxq^?I5lfE?`5vOtLw6RuT&fW;ka(t!<)0J$tqVmQTh
z(Min&`LrtqwN^ls2Ra$I(*W;uFnYu^!bEN8N@XQgRe6e0vh@l`<ud|-m28DCg7pMV
zx+%t$aU!Ie!w}@0L_<*WWj`sfxkA`0Xtg|B)QbkwG2l#t&-8e4l8cFCIBF|Gy&mFJ
zhN=~kKFTCQj#P;lH&POmCiQbhYf`OGa;%o+Rb5lNg{}a`?P0)3>qTr7lQTNZ^gP(b
z(voV4dKs@8p-T*l0^z9ZDSbFJ?M@i4k&IUfVq;sBeAE_`o?vI(8t+qfeL(Q8m!Z6J
zzBMp(j+Ilxu*OyGQBB5!tSMG)s*o(BW)i`M6(u_X@$&SW?S4q|=`Po<<CY`XnCv5!
zge9}hWO35XGMN&SqS>()%ZPMbqB5YSlbAE%N|=Qtvb8}sX~g($8AW5YoIS2pYIz9{
zDov5He15b(s2X{K4$!RajS6BZlv5elVCrK<?KZk}-S*lQli)`f$K&F<F7^i=?90+9
z#sNEN)a{^LrC6#GP%fv%vPLzXV^}*hIta|VveL{8^dOgv`?l?*X~j^(>ewn&+Jq2y
z8r?chAxO5sINd}83sb}4fE)}$KBkfai_|+_k>DEfVbh3pvXZF!Y6hS*)l7M;%4TVW
zXmu=@S2L_C2?`$TRKx59AGS*Q3`4nwUMi5Ph=PXVhagmN%f=+6fwELv>xp_dXrnED
zR2qbOoC>NV()Sv+qb4|$!<eG1q~wI!mmGf-@)es1v@SjI&7#>JQ?{$bs};N#AG<vO
z3!KH{zCGx8bSOB8RW2y`JeJQ|4cX9Rq*JMl^6Q8Qv=pJ2jdrR4L_CdfHfp5ugI=LR
zV{J>55lR~Lt@66aB$*aAHY&upK$IwlXsBIn9Z+$}lqfzW_$*#A!)l8hDglkylT=N%
znvUs90%wpzYpBKgbSEcRjTWDtZoVg{Gt#2h)GVzuy)tX)B5)k8wT8hkxoFxAqpz*O
zFmnIRAYhnS1pU4}lC`$0dHNcB;_=ha^Yb|<5|MVn%}akLz|$|BdhJee&!JCKpMCx*
zC(m7d`6oa9+#fcNv(Mh~sm5PsHlFyvdw2gQ+CPfF{>mh?a?7>qedk;7!v|_lzK<Vy
zGkxcW$oBr~*B?87_uX{i-yb~st1p-YedRR$rG*zy-XY(6wsYjb+cQ6ZnkE*MH~;+X
zhws$qiwCzJyS1}3_ovvIO*#7DW#uaePyC|wgJbpIe&esqnE;#r^3J!O+IucoJa~z`
z@J2<@?tc&c<mZ2PC4KaP*RI<aMNv4qfA{74c7DxV`{y<45_{zE!p2Ko2Y$%Q-@enm
zr@Qy#qhCH(S-P|}5HjCB_v$N0Pai(c^Yn=)b{)>Y@yvx1`TErd&@08}S%6=ENC#U#
z+p8tLxBf_P7WN#whui+*gV?`b*nSkfs3Yf7zll9^`^B9@XWwhh(YFptse}Irude2Q
z{PwH2J#yjl^|!wNWY2k6n63Qq*!wSUE?=CVoxf>dx&~UBJGHRL^m_lFJJ{oA_B}WC
Y@<T-~lcxl=$jAyuGpfv#79#L}0PJ1YbN~PV

literal 0
HcmV?d00001

diff --git a/evidence/mint/final_golden_300029555.bin b/evidence/mint/final_golden_300029555.bin
new file mode 100644
index 0000000000000000000000000000000000000000..c5569efb4ccb2bd2d1f9441cc37e99c9f90ca880
GIT binary patch
literal 2107
zcmd^A>yI0E6&)uf-Ry2jNks{QsMHcmnyz<eJns$LFdmP+9^2#b*d9N4OlRz|XZ)Do
zcpmoHX&@UAgf>*INFr29645q^2yGBTA}!F+LV31O)SyxkQd&Z~EEP|+NJwdM!Z-c}
z?w2cF-Fwc_{csKhP3^jI<2(ZGi$Ta&{wdEI{z&y3+ECYgv$@3>*{bUffz!x<mTB#U
zLf8L!3fi~{+73aX*-e|3p>Hb<)l;`ap-oRtPeY-bHzEu0+%NZpCwHK3s-6j~R3p4Z
zAv8K4Zu(YTP<wiKDf~as;rVdO0lpnxLgvHf<N$+daz5<pt~)^pFQHK!A!vFs@$~;L
zxt`hWUXvAGYN}mVpAUPETGy|#g<*|q!Zg)v5}1l>jd~=CVk8=&F_J<l6eTGVr*VXg
zVmLBk_D1$Z(nOzsl^LFNS9e%od3xYYz`}cx4=p4h`Q3kdaNpXA)wOe9zI1lq<wqY`
zd+g!0GpqH<D~_iUF>V0O&`@X^`p8X_$$Ro=_k3p#BA^5$Ue|*{*Rh7@+3wQfqS{}$
z`s9T==q=iduG-WU)%T1=+q>2m46oPSZI}(cV5p8B^F0q(%gCIqI%;p(WaM6gs>z6x
zjcdiqsD?$P(nxhPR!WMBy>gY~iusJ1g>6>KFygoeSIcS!kJ=Tq0~btE&GH0=6HKa&
zjjKIXh&y?|+VIIz-=Ly^1w^Zb>n*Mx48g$3m*iMQNi&?x*UD;4NM=a92;_7@T|rsO
ziE)lZkO5O41ZvhswTvv3JUWxe=7LU6uL_BRQ82ld2`9C5vXd4q%Foh)tH&cqt<z+Z
zrD~4G8ypp+D22#nhcYS)351W<lPfjLuJe3aF?6M!YiHC^bKrCNl>$DDNJ#_cIxg(s
z@w{S*Mv17HfkO@o8PZl(V#Z+51Faxhr8u|jM@B%*dl(RDHv^JRHSIB=)+f`Bn`GRQ
z(CC{+Dj~%NK{ZtY!>UC1d{3+ZCP$aB9*y9GvdoXwXo(n<w01!0OdII@pn~v#?+)NH
zYDtMYT^P4{E?MMaY+|HGk|G<;GfA~-P`Eu#6>$qe`D(vSn~`+8gkh0t7L2Ops*orA
za$RIBFFjo8S4@FqeT)b0FeerRDVBsyt~QdDw$^5Az-^X$WO|6F(uBBTh~2&mds2QF
zNvVJ~Yrrp6m;_Vy87HMjc(W4EatRQaEd)+Dl3W)uY(Gm!Jpk-DE1ODC8Ckh<lgvbI
ztz9D+1mSa>-9|M$hz$mPAo^%J;wYIe%p>(2o^n{PVMbbfUQ|3KsbVZskGTmY!Lu^i
zXjyPtNhXwhMkXSyO2ChaL8B-nImR)KVvbToOx0vBPy?B;0G>xQEWtGOj%c*~Ce}y~
zi~YceGJa)9d9DU*1x@u*I9HJ5n1m|byzLExbQzGo-e$*Muh46b7~sg!N}1?HM@~nD
zGbt-gc%a{M*&t&hRw*Y70xs~DCYeTrvdh(>u!4xH9wUvC*^K2>k%%KHfSEC&-^rC(
zylLqY!sPp1tF$6=G}jo9*&aR0kwwNPHKmwlG$xuSR$_2NY^``>Kd5L%GtI{lJlV-f
zR$b|N`MzGkvGG8Uw9HmETXCA1aW$!dEG>ayp@(E~%1a`u2j<+mZt2B|<t$@!s%@tl
z%Qy^Eb3LG$U40pbk)79S;!*IN+U<g&q&FSiHJ0JK4jzHNK9hw)q5OuYUilhwI=%Y+
zslykB_8YaIZ#Q2SH@<f0S3BaJ{ClUt#SJHf*R!+VzU%J~IgKm#V>c}fzW2=enEdu>
z{?o$If1h~P5)K|vZg}Ix+kZd({zLDYCcd@bIeekM<LC`Xu54b<Q!lO``ov4EouM<U
zo7pWtKJb(0p1*W#-xJffzxCM%pMEU2U4Qef^5=j0?82q{R?ofmw@*Eu+I<mydGXc6
z!Q<7_rNML0KYaAbO<U)djh7xjwZo5H|Mu`7TOYYa#P9s>CvT&EJ0*NGs9gT|&%W@$
zwkOv1Z~Mc=-@Ndq@>I6d|KR$ahYz1W=HI&e8?*b>zuZ%cE|;D;@asFKPTeiP^08Yt
z?D{}RLq9ycviG*oZ0qDL>&MZPJI}lKZF%*=JMYl%T`bHj<L4f@C!(MI+?7Ln=)28-
z#m{VuWH(R!=<@G&c`tl1h8+3hFR<nhKNC52@}aN(^`qz0H@?q*{rC?aU4MGv9W$F|
vuBDlws}0?m<XLE9<^Sh#cJNEHrzXL^wU9~*OhzeilAK~WMdFG#hv5GJ$_C?s

literal 0
HcmV?d00001

diff --git a/evidence/mint/final_golden_300030430.bin b/evidence/mint/final_golden_300030430.bin
new file mode 100644
index 0000000000000000000000000000000000000000..0509c68268ef61ad3db2daeb9006320424d3c317
GIT binary patch
literal 2094
zcmd^A{g2xQ8FqHnQSJ&Gl(ko}N;JCO(e83*C;q(cMxDgTIdKx(Nt_Q5#!l?mN&FFi
zBu=`Hj!i{q*9|6C4Yi$)QAWkKmVF2f7y>5BD1re$04f>-33~0+ZUa@Nn?N0D`Hg>p
z_m@|C^}f&Z=+&$D0f5bmw@oZSz`-~G9ls)M(fpz0H|2pM`?`9oHnb(z9av72v0A!$
z00@2Hjm^NsB(M_zLR%(3C=PsEY)YQA69`Q{H#G%>woO2b;M}kGhsSePLzg_=GU;Y`
z8Hb42LRj_9MqV<M@N)Qnpu-E{mSg#Lco|v<>*E0!B(R0BtGMnMA-o)mA`nUt<BF&J
zx5@SNZuh3F@Ukj(U1cHcIZ{Kp!4?K(Tm=bSRZ&<%<YprhjlozfLckav!(%ZF#}ER6
zuqcc`V`gt?k0p)u`8Sxsads6aVVRy1cw?~e0cd_P1qipldF<fDr|!S_qoaR&>EOn*
z-@JJ0#KqJ1H^!@2r&Ig(^?_*u2u%U|wvH>?xtBa_4nTnvz-}^t&?Z##JlkDfT9SH;
zH<rBEu#6>p$(2+^lzdNHvb~#mQS*%Mr!>8(6gA0F;=bou<_a`tOO9l$=%iqz@VWpw
zxujgG4(o7)FApV`F=;-^8iEAkC61ADpq=0uk{uafts*f<)HbVaa9G5oTn5Dvl%(76
zsAfp{q}%Z+uTPeH1n$rY8#Qqx$x&)B$n_nrEX1o~mZXGCy&}c)X$C_|mXIw<tFZ*`
z#3_eIv4Cv!11V?6WJbuBJ%UN)3PGo!)bgpKR@AAM4yNU7x|3ytx>F;-ZiZBv^+0SE
zlW>86VG0juID-1zpc-q^DY6dJX<0S!l$^<mnj*FfZAKcZeV^i1i^w3tr!|o3xS%uE
zDVnTSMyq<@VErP4+2U$k>-P<-6+~+|<yQR2&|*0cwphYtth7_hdZbnFVOhsblWsZR
z?CBbv;^Y0GMpvytjYs{A!B#D@K$KyFfRKJg$c&_D8TC7AXM|@9?OI9c4=n}HQIS?O
zX7Z^9Q5>~1RJugP6RDvRNwbM4N2aBkh9mZfE+Hlq%hY;pLXTwIWf+dsa@Md`spUD;
zuQXWF^s<B1URBRy2_Mc_?x4Vy0zRGwb*erT#J1c{)Gb%77+7|I&{>pS)!1&&1wEb{
zL}<w(^t$Djt7M9-_@qNCk&IqV=BShv=q(6LIlR!wGl^b~h<cV~Cli7$2GyZisHhkd
zwdHmlB_SwNpzL-`MuK?1-?PQufR2a(BOnTdl>CO@#xsdXE5os(C#EGhK{n!UN=#)E
z0@iGqU{*}0M2->ANUIuTMrglT%BLyP(X~<m7g<=61uu{S0W~dzgJd{Gs!E5|+P(@m
zvx8DE(4wSY9pIiTTecXZ4H}_}yb$MOVwbbML6EIjn6I=GBhM%r>X5V?AzH1Vo#@c%
zNFYO-S=6(7EjJM`He{9yLOze=Gp5YzS_HQ%wLyLrVkISxX=PoF7bF%<LbL_z@qDjS
zs3Z{8RCtKwdR?=;%2EW?M230=8y2t<X=Ae3R#qi4${8G)jWb>ftr$VIiT4FR0a>GX
zjW-*%;c*PD<9)NQM7oJqjxptCHaWh0mrtg-Ik%yhN@@IMR^U0ww&~^y0)qIQVaa+|
zSph+4@68}kn3$8gU2DKAs-w8t3V83@5#X8W91sd|w@l7nn7ZD4Zr(e${PN+cJ*WRT
z`p0`$9zMDK^JluV!s1p|56x`(-oGEpKmXVf7kcFC^_hK(`nO-XaP9rKZ;Q^QzPo(+
z_0u~CJCKccAKf+OAA9AFUv@8DLMtDa(1TZhv3uv!`=@`3ouB;N<^2ecT;03t!Dm1D
zbocB%rw$!^?b4|e&evYpUi|T{lP}+4UcTqy7fyWTkv$t#`tEIafBJXe8AU$&{F8rn
z{_?|#+n@aT^+S(tJof&-+Gn}-`Ma8{_nx?X%bq{1U3%xAUw?3N{jJ@nCf~5n{tEi)
zN@2bly7k5TL@kTYu3R{Dcx`s#6K6hi-~5Z^Yl+uhKm5dwZ*`JS9KUn=%6jAa((!Mc
z+sb|9?`LN3I&hR)AKrQ7%MZPJp8mn?n-4s-|6{-T;yd4YVDpEbIsg5&^npM5?@e*%
zYJ2J5H(s57ckr{&3^AjMZ(pfx`s<f=JihVanccsA>&R#2FI@XccY1RArh#dS)Kr|Y
mg@wl7`~Td*)*jz-a_r?FEz;>c$%sXY7w7~f@>FSC2>cJ88{aYj

literal 0
HcmV?d00001

diff --git a/evidence/mint/final_mint_300024708.bin b/evidence/mint/final_mint_300024708.bin
new file mode 100644
index 0000000000000000000000000000000000000000..ea828722c199256b2bc5a21445723ef17e55ed77
GIT binary patch
literal 652
zcmeH@y-vbV7=}-6QU#i57}!|O;8aWxZRt;3kf4$v5+JP2X?qGyYTNWjB!<Mr4H8Ee
zcNceEyajJUVw|}FPjT}aoWA7E_x|JoU}t&23JBbt0Q9sO^V4jOGsl_{EA!m_={&+o
zG7Dp;8&14n0hpcRJ-~9H3IM}%1#^}~rh`*l1q@Rt7WoQ`j>N-{TS#r8?cvl5gN_3Y
z4e62q-7K(s_=-RS{z--coWx-kK?4cUqXt>jRRJa>NoWEzq`HC{x=xjp{5~bA=lk1L
z&~UMz5CNt!wn^RwMN4x<U31-rj1|kVYjsIhrJ63QnxsjRs;P>uAhj+lh&HG5h)$yW
zvb<TOHz9E=3{rBF(lEF{?B=xG?Dx%K=d5S;E=T4?bJRK?=i1lH`}$$^`MO#!-@flx
u{xv9-xY8EPlwgO%Ihx&nGFvjsNB$WwTsi01?3%;&VBBf7%|UxqVZ<Lc3CM>4

literal 0
HcmV?d00001

diff --git a/evidence/mint/final_mint_300029555.bin b/evidence/mint/final_mint_300029555.bin
new file mode 100644
index 0000000000000000000000000000000000000000..ea828722c199256b2bc5a21445723ef17e55ed77
GIT binary patch
literal 652
zcmeH@y-vbV7=}-6QU#i57}!|O;8aWxZRt;3kf4$v5+JP2X?qGyYTNWjB!<Mr4H8Ee
zcNceEyajJUVw|}FPjT}aoWA7E_x|JoU}t&23JBbt0Q9sO^V4jOGsl_{EA!m_={&+o
zG7Dp;8&14n0hpcRJ-~9H3IM}%1#^}~rh`*l1q@Rt7WoQ`j>N-{TS#r8?cvl5gN_3Y
z4e62q-7K(s_=-RS{z--coWx-kK?4cUqXt>jRRJa>NoWEzq`HC{x=xjp{5~bA=lk1L
z&~UMz5CNt!wn^RwMN4x<U31-rj1|kVYjsIhrJ63QnxsjRs;P>uAhj+lh&HG5h)$yW
zvb<TOHz9E=3{rBF(lEF{?B=xG?Dx%K=d5S;E=T4?bJRK?=i1lH`}$$^`MO#!-@flx
u{xv9-xY8EPlwgO%Ihx&nGFvjsNB$WwTsi01?3%;&VBBf7%|UxqVZ<Lc3CM>4

literal 0
HcmV?d00001

diff --git a/evidence/mint/final_mint_300030430.bin b/evidence/mint/final_mint_300030430.bin
new file mode 100644
index 0000000000000000000000000000000000000000..ea828722c199256b2bc5a21445723ef17e55ed77
GIT binary patch
literal 652
zcmeH@y-vbV7=}-6QU#i57}!|O;8aWxZRt;3kf4$v5+JP2X?qGyYTNWjB!<Mr4H8Ee
zcNceEyajJUVw|}FPjT}aoWA7E_x|JoU}t&23JBbt0Q9sO^V4jOGsl_{EA!m_={&+o
zG7Dp;8&14n0hpcRJ-~9H3IM}%1#^}~rh`*l1q@Rt7WoQ`j>N-{TS#r8?cvl5gN_3Y
z4e62q-7K(s_=-RS{z--coWx-kK?4cUqXt>jRRJa>NoWEzq`HC{x=xjp{5~bA=lk1L
z&~UMz5CNt!wn^RwMN4x<U31-rj1|kVYjsIhrJ63QnxsjRs;P>uAhj+lh&HG5h)$yW
zvb<TOHz9E=3{rBF(lEF{?B=xG?Dx%K=d5S;E=T4?bJRK?=i1lH`}$$^`MO#!-@flx
u{xv9-xY8EPlwgO%Ihx&nGFvjsNB$WwTsi01?3%;&VBBf7%|UxqVZ<Lc3CM>4

literal 0
HcmV?d00001

diff --git a/tools/unidbg/hydev/src/hydev/DiffProbe.java b/tools/unidbg/hydev/src/hydev/DiffProbe.java
index e05bdcd..f2b4968 100644
--- a/tools/unidbg/hydev/src/hydev/DiffProbe.java
+++ b/tools/unidbg/hydev/src/hydev/DiffProbe.java
@@ -13,6 +13,7 @@ import com.github.unidbg.pointer.UnidbgPointer;
 
 import java.io.File;
 import java.util.Arrays;
+import unicorn.UnicornConst;
 
 /**
  * 差分探针: 与 huya_aes_replica.py 对拍 encode_aes@0x330218
@@ -132,5 +133,26 @@ public class DiffProbe {
         System.out.println("[KAA] in=0123456789abcdef key='A'*64 -> " + p.enc("0123456789abcdef", "A".repeat(64)));
         // 24B 短钥 (short string, flag 参与装载?)
         System.out.println("[K24] in=0123456789abcdef key=0123456789abcdef(16B short) -> " + p.enc("0123456789abcdef", "0123456789abcdef"));
+        probeGetkey(args.length > 0 ? args[0] : "so/libudbauthunify_merged.so");
     }
+
+    static void probeGetkey(String soPath) throws Exception {
+        DiffProbe p = new DiffProbe(soPath);
+        com.github.unidbg.memory.Memory mem = p.emulator.getMemory();
+        UnidbgPointer self = mem.malloc(0x100, false).getPointer();
+        byte[] zb = new byte[0x100]; self.write(0, zb, 0, zb.length);
+        // C2 构造 (AESkeyMgrC2Ev)
+        try { p.module.callFunction(p.emulator, 0x26fcc8L, UnidbgPointer.nativeValue(self)); System.out.println("[getkey] C2 done"); }
+        catch (Throwable t) { System.out.println("[getkey] C2 err " + t); return; }
+        for (int id1 = 0; id1 <= 4; id1++) {
+            try {
+                p.module.callFunction(p.emulator, 0x26871cL, UnidbgPointer.nativeValue(self), (long) id1, 0L);
+                long x0 = p.emulator.getBackend().reg_read(UnicornConst.UC_ARM64_REG_X0);
+                long x2 = p.emulator.getBackend().reg_read(UnicornConst.UC_ARM64_REG_X2);
+                System.out.println("[getkey] id1=" + id1 + " x0=" + Long.toHexString(x0) + " x2=" + Long.toHexString(x2));
+            } catch (Throwable t) { System.out.println("[getkey] id1=" + id1 + " err " + t); }
+        }
+        p.emulator.close();
+    }
+
 }
\ No newline at end of file