From c426574b3ca802db794e8e7a934fcf4da2bb6e09 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Sat, 29 Aug 2026 01:37:18 +0800
Subject: [PATCH] =?UTF-8?q?feat(huya):=20harness=E5=A4=8D=E6=B4=BB(getGUID?=
 =?UTF-8?q?=E5=9B=9E0a7dfa)=20+=20GUID=E7=BC=93=E5=AD=98=E8=BE=93=E5=85=A5?=
 =?UTF-8?q?=E9=80=8F=E6=98=8E=E6=80=A7=E8=AF=81=E6=98=8E(b(100)=E7=9B=B4?=
 =?UTF-8?q?=E5=A1=AB)=20+=20merged=5Fr2=E4=BA=A7=E7=89=A9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/HUYA_HDID_ALGORITHM_GEN.md              | 8 ++++++++
 tools/unidbg/hydev/src/hydev/HyDeviceId.java | 4 ++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md
index 0ae5681..3d4a1a4 100644
--- a/docs/HUYA_HDID_ALGORITHM_GEN.md
+++ b/docs/HUYA_HDID_ALGORITHM_GEN.md
@@ -762,3 +762,11 @@ UdbAESUtilC1(…) + encrypt           ← 后段
 ### §11.26b OTP mid 组合排列爆破 (5040 序 × 4 输入) = 零命中
 - 串池 7 元素全排列拼接 md5-char16 无一命中 → 组合含长度前缀/TAF 序列化 (池对象带 0x1b/0x17/0x31 头值)
 - mid 材料 = cred_packls 编码产物 (len-prefix 字段流), 非裸拼接
+
+## §11.27 harness 复活 + GUID 缓存读取器输入透明性 (R4)
+- **重合并 so (merge_decrypted 重跑) → 70621 级: getGUID 回 0a7dfa MATCH!** (缓存恢复)
+- 修 b 桩 (101/102 接 System.getProperty) → 指纹可控
+- **透明性证明: getGUID/getMID = 直接返回输入值** (aabbccdd00112233 → 同值; 0000…→同值)
+  → GUID32 缓存 = Java b(100) 直填 (非 native 计算) — 与 §11.8-§11.10 缓存读取器定案闭环
+- 遗留: getHDID = 空 (40hex 缓存缺 b-cell) — 登录 32hex (ed0db8) 与 GUID/MID 缓存非同一格
+- 产物: so/libhydeviceid_merged_r2.so (缓存正常版)
diff --git a/tools/unidbg/hydev/src/hydev/HyDeviceId.java b/tools/unidbg/hydev/src/hydev/HyDeviceId.java
index 49713e8..528e6e5 100644
--- a/tools/unidbg/hydev/src/hydev/HyDeviceId.java
+++ b/tools/unidbg/hydev/src/hydev/HyDeviceId.java
@@ -143,8 +143,8 @@ public class HyDeviceId extends AbstractJni {
             // b()-语义来自 jadx (NativeBridge.b -> fj3.c): 1=APPID(5008) 2=versionName 3=SDK版本(1.14.68)
             // 102=l5h.a=ANDROID_ID 104=l5h.f 105=pnc.f 106=l5h.i 107=qimei16 108=qimei36
             String v = null;
-            if (i == 100) v = "0a7dfaa882938a6ab502511452142c57";
-            else if (i == 101 || i == 102) v = "1e8bdf7d4f7a01d3";
+            if (i == 100) v = System.getProperty("hydev.android_id", "1e8bdf7d4f7a01d3");
+            else if (i == 101 || i == 102) v = System.getProperty("hydev.android_id", "1e8bdf7d4f7a01d3");
             else if (i == 106) v = "a71a0917ab6d0d6a61947a007591cfb97290f88972b047252c0ec7baddcd57df";
             else if (i == 104 || i == 105) v = "";
             else if (i == 1) v = "5008";