diag(huya): 实例注入实验 - config非AES + s4拷贝段新unmapped(SSO布局细节)

tools/unidbg/hydev/src/hydev/AesProbe.java

@@ -345,6 +345,13 @@ public class AesProbe {
             writeStrAt(pv, 0x40, "");                                          // mobileMask ""
             writeStrAt(pv, 0x58, "");                                          // passport ""
             writeStrAt(pv, 0x70, "*hZrPb62GskrEeTYcLeUTL1fJ1OR8ky3x9qXQq0s6ICJV5v9T");
+            // 注入登录数据到 BusinessCfg 实例 +0x10/+0x40 (s4/s3 源)
+            try {
+                UnidbgPointer ip = UnidbgPointer.pointer(emulator, thisPtr);
+                writeStrAt(ip, 0x10, "hy_300023887");
+                writeStrAt(ip, 0x40, "772ed992b0e161276f44ec63671e60155c506294");
+                System.out.println("[getOtp] injected login-data into instance");
+            } catch (Throwable ti) { System.out.println("[getOtp] inject err " + ti); }
             // 调用 getOtp(AppLoginData&) @0x26916c
             module.callFunction(emulator, 0x26916cL, thisPtr, UnidbgPointer.nativeValue(pv));
             byte[] rb = new byte[0x60];
@@ -602,6 +609,13 @@ public class AesProbe {
         String so = args.length > 0 ? args[0] : "so/libudbauthunify_merged.so";
         AesProbe p = new AesProbe(so);
         p.callGetOtp();
+        // 112B config 7 块 × C2 钥 (前3块 + 2钥)
+        p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7", "SHBfgytjtoikooruhogji7ER");
+        p.callDecodeAes("e53bbc17664c15641fc5a55e89ddc7ae", "SHBfgytjtoikooruhogji7ER");
+        p.callDecodeAes("0813e92f73ae6b1c9b6e4dace608b4f4", "SHBfgytjtoikooruhogji7ER");
+        p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7", "KNSDNjfohweeromnmkladj3g");
+        p.callDecodeAes("e53bbc17664c15641fc5a55e89ddc7ae", "KNSDNjfohweeromnmkladj3g");
+        p.callDecodeAes("d8042af68502099f0c812d6a8491c5a7", "xnkdDFIERRIPT5dfhfgiJ0FD");
         // 基准: 已知 16B 明文 + 24B 钥
         // 64B 钥材料测试 (KeyExpansion 以 16B 步长读!!)
         String k64_zmhav = "ZMHAVPRaxJ3MtXDjduUnXAKQ" + "\0".repeat(0);