From e042307f0437e4469eae63869cd82dc5b559e741 Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Sat, 29 Aug 2026 01:32:47 +0800
Subject: [PATCH] =?UTF-8?q?feat(huya):=20OTP=20mid=E6=8E=92=E5=88=97?=
 =?UTF-8?q?=E7=88=86=E7=A0=B45040=E5=BA=8F=E9=9B=B6=E5=91=BD=E4=B8=AD=20-?=
 =?UTF-8?q?=20=E7=BB=84=E5=90=88=E5=90=AB=E9=95=BF=E5=BA=A6=E5=89=8D?=
 =?UTF-8?q?=E7=BC=80=E5=BA=8F=E5=88=97=E5=8C=96(cred=5Fpackls=E7=BB=93?=
 =?UTF-8?q?=E6=9E=84)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/HUYA_HDID_ALGORITHM_GEN.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md
index f505db5..0ae5681 100644
--- a/docs/HUYA_HDID_ALGORITHM_GEN.md
+++ b/docs/HUYA_HDID_ALGORITHM_GEN.md
@@ -758,3 +758,7 @@ UdbAESUtilC1(…) + encrypt           ← 后段
 - appSign 未知收敛: {encode_aes 钥目录 11 把 × 明文族} ∪ {config 直解 3 钥} = 零命中
 - 下步候选: ①hdid 走非 encode_aes 路径 (GetHDID native 40hex 体系周边/initSDID-Java 回填)
   ②OTP 消息结构串池 (MsgRegSendSms) 完整排序后 md5 组合验证 ③config 文件层双钥 (xxtea 前垫)
+
+### §11.26b OTP mid 组合排列爆破 (5040 序 × 4 输入) = 零命中
+- 串池 7 元素全排列拼接 md5-char16 无一命中 → 组合含长度前缀/TAF 序列化 (池对象带 0x1b/0x17/0x31 头值)
+- mid 材料 = cred_packls 编码产物 (len-prefix 字段流), 非裸拼接