From d714249e24cf14fc21047499ef95b46c4e1ecfba Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Sat, 29 Aug 2026 02:45:28 +0800
Subject: [PATCH] =?UTF-8?q?diag(huya):=20=E5=AE=9E=E4=BE=8B=E6=B3=A8?=
 =?UTF-8?q?=E5=85=A5=E5=AE=9E=E9=AA=8C=20-=20config=E9=9D=9EAES=20+=20s4?=
 =?UTF-8?q?=E6=8B=B7=E8=B4=9D=E6=AE=B5=E6=96=B0unmapped(SSO=E5=B8=83?=
 =?UTF-8?q?=E5=B1=80=E7=BB=86=E8=8A=82)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/HUYA_HDID_ALGORITHM_GEN.md            |  6 ++++++
 tools/unidbg/hydev/src/hydev/AesProbe.java | 14 ++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md
index 81d7a32..0b46e4e 100644
--- a/docs/HUYA_HDID_ALGORITHM_GEN.md
+++ b/docs/HUYA_HDID_ALGORITHM_GEN.md
@@ -852,3 +852,9 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a
 - 真实参数: x0=in串(预写) x1=2 x2=counter(1) x3/x4=BusinessCfg+0x40/+0x10 x5=len0-SSO x6=4 x7=nonce OUT@[sp]
 - OUT 槽=全零 + s3/s4 全空 → 根因: BusinessCfg 实例(0x12491540) 配置字段空 (真机=服务器 112B config 填充!)
 ### 下步: 112B config(2AQq9oUCCZ8M...) 解析→注入实例 +0x10/+0x40 → OTP-OUT 出现 → 差分进 ed0db8
+
+## §11.36 实例注入实验 (R11b)
+- 112B config × C2钥 decode = 全垃圾 (非AES)
+- BusinessCfg 诸符号: load/saveLoginData/getLoginData@0x26984c etc. (+0x10/+0x40 = 登录数据字段源)
+- 注入 +0x10/+0x40 (name/sha1) 后 getOtp 流程 269280-2692a4 段 = 新 UC_ERR_READ_UNMAPPED (s4 拷贝路径)
+  → 实例字段注入 = SSO 布局细节需修 (s4 拷贝读 [x8+0x10+0x10] cap 越界?)
diff --git a/tools/unidbg/hydev/src/hydev/AesProbe.java b/tools/unidbg/hydev/src/hydev/AesProbe.java
index f8af5ab..bd6d71b 100644
--- a/tools/unidbg/hydev/src/hydev/AesProbe.java
+++ b/tools/unidbg/hydev/src/hydev/AesProbe.java
@@ -345,6 +345,13 @@ public class AesProbe {
             writeStrAt(pv, 0x40, "");                                          // mobileMask ""
             writeStrAt(pv, 0x58, "");                                          // passport ""
             writeStrAt(pv, 0x70, "*hZrPb62GskrEeTYcLeUTL1fJ1OR8ky3x9qXQq0s6ICJV5v9T");
+            // 注入登录数据到 BusinessCfg 实例 +0x10/+0x40 (s4/s3 源)
+            try {
+                UnidbgPointer ip = UnidbgPointer.pointer(emulator, thisPtr);
+                writeStrAt(ip, 0x10, "hy_300023887");
+                writeStrAt(ip, 0x40, "772ed992b0e161276f44ec63671e60155c506294");
+                System.out.println("[getOtp] injected login-data into instance");
+            } catch (Throwable ti) { System.out.println("[getOtp] inject err " + ti); }
             // 调用 getOtp(AppLoginData&) @0x26916c
             module.callFunction(emulator, 0x26916cL, thisPtr, UnidbgPointer.nativeValue(pv));
             byte[] rb = new byte[0x60];
@@ -602,6 +609,13 @@ public class AesProbe {
         String so = args.length > 0 ? args[0] : "so/libudbauthunify_merged.so";
         AesProbe p = new AesProbe(so);
         p.callGetOtp();
+        // 112B config 7 块 × C2 钥 (前3块 + 2钥)
+        p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7", "SHBfgytjtoikooruhogji7ER");
+        p.callDecodeAes("e53bbc17664c15641fc5a55e89ddc7ae", "SHBfgytjtoikooruhogji7ER");
+        p.callDecodeAes("0813e92f73ae6b1c9b6e4dace608b4f4", "SHBfgytjtoikooruhogji7ER");
+        p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7", "KNSDNjfohweeromnmkladj3g");
+        p.callDecodeAes("e53bbc17664c15641fc5a55e89ddc7ae", "KNSDNjfohweeromnmkladj3g");
+        p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7", "xnkdDFIERRIPT5dfhfgiJ0FD");
         // 基准: 已知 16B 明文 + 24B 钥
         // 64B 钥材料测试 (KeyExpansion 以 16B 步长读!!)
         String k64_zmhav = "ZMHAVPRaxJ3MtXDjduUnXAKQ" + "\0".repeat(0);