From d4f4e825932c150b1172b2e3eaba978ba563678a Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Sat, 29 Aug 2026 02:53:54 +0800
Subject: [PATCH] =?UTF-8?q?diag(huya):=20R12=20s5=E9=95=BF=E5=BA=A6?=
 =?UTF-8?q?=E6=97=8F23K=E9=9B=B6=E5=91=BD=E4=B8=AD=20-=20=E7=B4=AF?=
 =?UTF-8?q?=E8=AE=A153K=E5=B7=AE=E5=88=86=E9=9B=B6,=20s3/s4=E7=9C=9F?=
 =?UTF-8?q?=E6=BA=90=E5=BE=85=E6=B3=A8=E5=85=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/HUYA_HDID_ALGORITHM_GEN.md            |  3 ++
 tools/unidbg/hydev/src/hydev/AesProbe.java | 35 +++++++++++++++++++++-
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md
index 9535640..9fccec7 100644
--- a/docs/HUYA_HDID_ALGORITHM_GEN.md
+++ b/docs/HUYA_HDID_ALGORITHM_GEN.md
@@ -872,3 +872,6 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a
 - 30976 combos (in×cnt×s3×s4×s5 候选族交叉) = 8.1s, 零命中
 - 结论: 真实输入不在候选族内 → 需 s3/s4/s5 真源 (loadLoginData 持久化数据 / AppLoginData 真实 x20-s5)
 - 差分引擎就绪 (30K calls/8s, 可 10 倍扩容)
+
+## §11.39 R12: s5 零串长度族 (0-40) × S3精选 × in × cnt = 23616 combos / 5s / 零命中
+- 累计差分 53K+ combos 零命中; s3/s4 真源 = native BusinessCfg (Java 无类), 需 loadLoginData/配置注入路线
diff --git a/tools/unidbg/hydev/src/hydev/AesProbe.java b/tools/unidbg/hydev/src/hydev/AesProbe.java
index 818e751..d90ccc6 100644
--- a/tools/unidbg/hydev/src/hydev/AesProbe.java
+++ b/tools/unidbg/hydev/src/hydev/AesProbe.java
@@ -176,6 +176,39 @@ public class AesProbe {
         return "";
     }
 
+    void burstOtp2() {
+        String[] S3 = {"", "hy_300023887", "300023887", "1e8bdf7d4f7a01d3"};
+        String[] IN = {"0", "1", "3251699", "300023887", "1724464550000", "1724464550", "", "13.4.22", "hypasswordLogin"};
+        long[] CNT = {0, 1, 2, 3};
+        String G = "ed0db8334cadd236c00cadf7e11ab5a5";
+        int n = 0, hit = 0;
+        long t0 = System.currentTimeMillis();
+        for (String s3 : S3) for (String s4 : S3) {
+            for (int zlen = 0; zlen <= 40; zlen++) {
+                StringBuilder zb = new StringBuilder();
+                for (int i = 0; i < zlen; i++) zb.append('\u0000');
+                String s5 = zb.toString();
+                for (String in : IN) for (long cnt : CNT) {
+                    n++;
+                    UnidbgPointer pa = writeStdString(in), ps3 = writeStdString(s3), ps4 = writeStdString(s4), ps5 = writeStdString(s5), pout = writeStdString("");
+                    try {
+                        module.callFunction(emulator, 0x32fa24L,
+                            UnidbgPointer.nativeValue(pa), 2L, cnt,
+                            UnidbgPointer.nativeValue(ps3), UnidbgPointer.nativeValue(ps4), UnidbgPointer.nativeValue(ps5),
+                            4L, 0L, UnidbgPointer.nativeValue(pout));
+                        String out = readStdString(pout);
+                        if (out.length() >= 36) {
+                            String mid = toHex(out).substring(4, 36);
+                            if (mid.equals(G)) { System.out.println("!!! HIT in=" + in + " cnt=" + cnt + " s3=" + s3 + " s4=" + s4 + " zlen=" + zlen); hit++; }
+                        }
+                    } catch (Throwable tx) {}
+                }
+            }
+        }
+        long dt = System.currentTimeMillis() - t0;
+        System.out.println("[burst2] n=" + n + " hits=" + hit + " in " + dt + "ms");
+    }
+
     void burstOtp() {
         String[] S3 = {"", "hy_300023887", "300023887", "772ed992b0e161276f44ec63671e60155c506294",
             "1e8bdf7d4f7a01d3", "13.4.22", "1.0.80138", "5008", "xiaomi", "127.0.0.1", "7c5387e0539c023c31c4ff0e807e7256117385ee"};
@@ -667,7 +700,7 @@ public class AesProbe {
         p.callOtpReal("0", 1L, "", "", "00000000000000000000000000000000", 0L);
         p.callOtpReal("0", 1L, "hy_300023887", "772ed992b0e161276f44ec63671e60155c506294", "00000000000000000000000000000000", 0L);
         p.callOtpReal("1724464550000", 0L, "", "", "", 0L);
-        p.burstOtp();
+        p.burstOtp2();
         // 基准: 已知 16B 明文 + 24B 钥
         // 64B 钥材料测试 (KeyExpansion 以 16B 步长读!!)
         String k64_zmhav = "ZMHAVPRaxJ3MtXDjduUnXAKQ" + "\0".repeat(0);