diag(huya): 实例注入实验 - config非AES + s4拷贝段新unmapped(SSO布局细节)

docs/HUYA_HDID_ALGORITHM_GEN.md

@@ -852,3 +852,9 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a
 - 真实参数: x0=in串(预写) x1=2 x2=counter(1) x3/x4=BusinessCfg+0x40/+0x10 x5=len0-SSO x6=4 x7=nonce OUT@[sp]
 - OUT 槽=全零 + s3/s4 全空 → 根因: BusinessCfg 实例(0x12491540) 配置字段空 (真机=服务器 112B config 填充!)
 ### 下步: 112B config(2AQq9oUCCZ8M...) 解析→注入实例 +0x10/+0x40 → OTP-OUT 出现 → 差分进 ed0db8
+
+## §11.36 实例注入实验 (R11b)
+- 112B config × C2钥 decode = 全垃圾 (非AES)
+- BusinessCfg 诸符号: load/saveLoginData/getLoginData@0x26984c etc. (+0x10/+0x40 = 登录数据字段源)
+- 注入 +0x10/+0x40 (name/sha1) 后 getOtp 流程 269280-2692a4 段 = 新 UC_ERR_READ_UNMAPPED (s4 拷贝路径)
+  → 实例字段注入 = SSO 布局细节需修 (s4 拷贝读 [x8+0x10+0x10] cap 越界?)

tools/unidbg/hydev/src/hydev/AesProbe.java

@@ -345,6 +345,13 @@ public class AesProbe {
             writeStrAt(pv, 0x40, "");                                          // mobileMask ""
             writeStrAt(pv, 0x58, "");                                          // passport ""
             writeStrAt(pv, 0x70, "*hZrPb62GskrEeTYcLeUTL1fJ1OR8ky3x9qXQq0s6ICJV5v9T");
+            // 注入登录数据到 BusinessCfg 实例 +0x10/+0x40 (s4/s3 源)
+            try {
+                UnidbgPointer ip = UnidbgPointer.pointer(emulator, thisPtr);
+                writeStrAt(ip, 0x10, "hy_300023887");
+                writeStrAt(ip, 0x40, "772ed992b0e161276f44ec63671e60155c506294");
+                System.out.println("[getOtp] injected login-data into instance");
+            } catch (Throwable ti) { System.out.println("[getOtp] inject err " + ti); }
             // 调用 getOtp(AppLoginData&) @0x26916c
             module.callFunction(emulator, 0x26916cL, thisPtr, UnidbgPointer.nativeValue(pv));
             byte[] rb = new byte[0x60];
@@ -602,6 +609,13 @@ public class AesProbe {
         String so = args.length > 0 ? args[0] : "so/libudbauthunify_merged.so";
         AesProbe p = new AesProbe(so);
         p.callGetOtp();
+        // 112B config 7 块 × C2 钥 (前3块 + 2钥)
+        p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7", "SHBfgytjtoikooruhogji7ER");
+        p.callDecodeAes("e53bbc17664c15641fc5a55e89ddc7ae", "SHBfgytjtoikooruhogji7ER");
+        p.callDecodeAes("0813e92f73ae6b1c9b6e4dace608b4f4", "SHBfgytjtoikooruhogji7ER");
+        p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7", "KNSDNjfohweeromnmkladj3g");
+        p.callDecodeAes("e53bbc17664c15641fc5a55e89ddc7ae", "KNSDNjfohweeromnmkladj3g");
+        p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7", "xnkdDFIERRIPT5dfhfgiJ0FD");
         // 基准: 已知 16B 明文 + 24B 钥
         // 64B 钥材料测试 (KeyExpansion 以 16B 步长读!!)
         String k64_zmhav = "ZMHAVPRaxJ3MtXDjduUnXAKQ" + "\0".repeat(0);