docs(huya): R16 dfpReport加密体侦察 — turing反欺诈定位+全链结构解码

- 结构: getDfpConfig(81B密文配置)->selectOperator(SDID+hyudb_ts)->dfpReport(10B魔数+3988B密文体)->服务端回t1/SDID
- 魔数/协议串147库全零: 运行时装配/turing混淆; Java无dfp类
- 关键材料: mpdc_108298_1=32hex设备号0399ED0B...; ga2 1860B; .turing.dat 76B
- Java全量hook方案弃用(闪退); turing=工业级SDK, 建议独立子项目

tools/frida/scan_magic.js

@@ -0,0 +1,19 @@
+'use strict';
+// 扫描进程内魔数 571882cf664bb39401ee
+const PATTERN = '57 18 82 cf 66 4b b3 94 01 ee';
+const mods = Process.enumerateModules();
+const hits = [];
+for (const m of mods) {
+  if (m.size > 300 * 1024 * 1024) continue;
+  try {
+    Memory.scan(m.base, m.size, PATTERN, {
+      onMatch(addr, size) {
+        const mm = Process.findModuleByAddress(addr);
+        const off = mm ? addr.sub(mm.base) : addr;
+        hits.push({ mod: mm ? mm.name : '?', off: off.toString() });
+      },
+      onComplete() {},
+    });
+  } catch (e) {}
+}
+send({ event: 'magic-scan', hits: hits.slice(0, 40), total: hits.length });