docs(huya): 终局总结 - 3账号×2路径验收矩阵 + 达成/边界如实 + 落地模式与未来路线

- 铸币GUID32恒APP_SIGN / 金样本HDID32签名通过进风控(3账号全一致)
- encode_aes复刻15/15位精确; HDID32独立铸造={getkey派生钥,明文}未达
- 落地: 每账号独立{GUID32,ACTION,DEVID40}+共享HDID32 → cred; 关联代价明示
- docs/HUYA_铸币机-终局总结.md

tools/unidbg/hydev/src/hydev/DiffProbe.java

@@ -13,6 +13,7 @@ import com.github.unidbg.pointer.UnidbgPointer;
 
 import java.io.File;
 import java.util.Arrays;
+import unicorn.UnicornConst;
 
 /**
  * 差分探针: 与 huya_aes_replica.py 对拍 encode_aes@0x330218
@@ -132,5 +133,26 @@ public class DiffProbe {
         System.out.println("[KAA] in=0123456789abcdef key='A'*64 -> " + p.enc("0123456789abcdef", "A".repeat(64)));
         // 24B 短钥 (short string, flag 参与装载?)
         System.out.println("[K24] in=0123456789abcdef key=0123456789abcdef(16B short) -> " + p.enc("0123456789abcdef", "0123456789abcdef"));
+        probeGetkey(args.length > 0 ? args[0] : "so/libudbauthunify_merged.so");
     }
+
+    static void probeGetkey(String soPath) throws Exception {
+        DiffProbe p = new DiffProbe(soPath);
+        com.github.unidbg.memory.Memory mem = p.emulator.getMemory();
+        UnidbgPointer self = mem.malloc(0x100, false).getPointer();
+        byte[] zb = new byte[0x100]; self.write(0, zb, 0, zb.length);
+        // C2 构造 (AESkeyMgrC2Ev)
+        try { p.module.callFunction(p.emulator, 0x26fcc8L, UnidbgPointer.nativeValue(self)); System.out.println("[getkey] C2 done"); }
+        catch (Throwable t) { System.out.println("[getkey] C2 err " + t); return; }
+        for (int id1 = 0; id1 <= 4; id1++) {
+            try {
+                p.module.callFunction(p.emulator, 0x26871cL, UnidbgPointer.nativeValue(self), (long) id1, 0L);
+                long x0 = p.emulator.getBackend().reg_read(UnicornConst.UC_ARM64_REG_X0);
+                long x2 = p.emulator.getBackend().reg_read(UnicornConst.UC_ARM64_REG_X2);
+                System.out.println("[getkey] id1=" + id1 + " x0=" + Long.toHexString(x0) + " x2=" + Long.toHexString(x2));
+            } catch (Throwable t) { System.out.println("[getkey] id1=" + id1 + " err " + t); }
+        }
+        p.emulator.close();
+    }
+
 }