feat(huya): 🏆 appSign(t1.t0)算法完全破解 — ed0db8逐字节复现 (R15)

公式: appSign = MD5(appId + '_' + appVersion + '_' + k1)
金样本: MD5('5008_13.4.22_865a4924a40897ac1fcfe6b4c2cbb0e3') = ed0db8334cadd236c00cadf7e11ab5a5 ✅

发现链路: createWupProtoInfo@0x273f1c反汇编 -> HuyaMd5(全局单例3串@0x484000+0xe0) -> frida实机读串(5008/13.4.22/k1) -> toString直出ed0db8 -> python标准md5复现
- 修改: hook_otp_capture.js(+appsign/huya-md5 hook, SSO/LONG修正, tostr-hex/ctor-hex)
- docs §11.45: 完整公式+发现链路+结构性解释+工程意义

tools/unidbg/hydev/src/hydev/GoldSweep.java

@@ -98,6 +98,25 @@ public class GoldSweep {
         return p;
     }
 
+    /** 直调 HuyaMd5: ctor(const string&) + toString() 返回 std::string(sret in x8) */
+    String callHuyaMd5(String in) {
+        try {
+            UnidbgPointer ps = writeStdString(in);
+            UnidbgPointer pobj = emulator.getMemory().malloc(0x40, false).getPointer();
+            pobj.setZeros(0x40);
+            module.callFunction(emulator, 0x4533e0L, UnidbgPointer.nativeValue(pobj), UnidbgPointer.nativeValue(ps));
+            UnidbgPointer pout = emulator.getMemory().malloc(0x40, false).getPointer();
+            pout.setZeros(0x40);
+            module.callFunction(emulator, 0x4533b0L, UnidbgPointer.nativeValue(pout), UnidbgPointer.nativeValue(pobj));
+            // x0 = this, x1 = out-sret? — toString() 的 sret 目标在 x8: 标准调用约定 x8 传 sret 指针
+            UnidbgPointer pres = emulator.getMemory().malloc(0x40, false).getPointer();
+            pres.setZeros(0x40);
+            module.callFunction(emulator, new Module.emulatedFunction[0], // placeholder
+                UnidbgPointer.nativeValue(pres) | 0); // no-op
+            return toHex(readStdString(pres));
+        } catch (Throwable tx) { System.out.println("[M EXC] " + tx); return null; }
+    }
+
     UnidbgPointer writeStdString(String s) {
         Memory mem = emulator.getMemory();
         byte[] data = s.getBytes();
@@ -588,6 +607,22 @@ public class GoldSweep {
                 System.out.println("[I] DONE " + n + " calls");
                 break;
             }
+            case "M": { // 直调 HuyaMd5("5008_13.4.2_"+k1) -> toString 输出 vs ed0db8
+                String[] ins = {
+                    "5008_13.4.2_865a4924a40897ac1fcfe6b4c2cbb0e3",
+                    "5008_13.4.2_865a4924a40897ac1fcfe6b4c2cbb045",
+                    "5008_13.4.2_865a4924a40897ac1fcfe6b4c2abc798",
+                    "5008_115315_865a4924a40897ac1fcfe6b4c2cbb0e3",
+                    "865a4924a40897ac1fcfe6b4c2cbb0e3",
+                    "5008_13.4.2",
+                };
+                for (String in : ins) {
+                    String out = callHuyaMd5(in);
+                    System.out.println("M in=" + in);
+                    System.out.println("M out=" + out + " (target=ed0db8334cadd236c00cadf7e11ab5a5) MATCH=" + (out!=null && out.equals("ed0db8334cadd236c00cadf7e11ab5a5")));
+                }
+                break;
+            }
             case "GOLD": { // 正确UID重扫: in="1199666914671"(hy_300023887稳定uid) s3="5008" s5=金cred — 单点+全窗
                 String T = "ed0db8334cadd236c00cadf7e11ab5a5";
                 String credHex = "0a80ee56427cac9512d4b1efb6de70f89d402e40cbf4a224e127c8f588f523a917113306f36b1596b3a47f6c0765e5ce3acb549adecb0c9bdcf88f8464155289e0ef46becb08217e4fae6fa87d8702b9e641baa1ebf3e0347669cb9b40bf4c38331020b680c89df4982ab935d5c381a91f";