Obtaining the miyoushe Salt (LK2 & K2)

1
{-74, 60, -78, 204, 96, -88, -82, 78, 162, 54, -68, 78, -84, 84, -80, 66, 216, -80, 180, 90, MediaPlayer.MEDIA_PLAYER_OPTION_ABR_AVERAGE_BITRATE, C5432a.f120322i, -74, 66, 114, -98, -116, 54, 84, 204, 204, C5432a.f120320g}

1
{-74, 60, -78, 204, 96, -88, -82, 78, 162, 54, -68, 78, -84, 84, -80, 66, 216, -80, 180, 90, 174, -106, -74, 66, 114, -98, -116, 54, 84, 204, 204, -104}

1
{-98, -66, 192, 120, 60, 198, 168, -68, 216, 66, 168, 126, -108, -76, 126, -82, 114, -88, -88, -122, 162, -112, -66, 180, -122, 72, 108, 180, 78, -108, -106, -116}

1
    public static String m61080b(int[] intArr) {
2
        int i12;
3
        StringBuilder sb2 = new StringBuilder();
4
        ArrayList<Integer> arrayList = new ArrayList<>(intArr.length);
5
        for (int i13 : intArr) {
6
            if (i13 < 0) {
7
                i12 = ((double) (-i13)) >= Math.pow(3.0d, 6.0d) ? (int) (((Math.log(-i13) / Math.log(3.0d)) - 6) + 48) : ~i13;
8
            } else {
9
                i12 = (i13 / 3) + 48;
10
            }
11
            arrayList.add(i12);
12
        }
13
        for (Integer integer : arrayList) {
14
            sb2.append((char) integer.intValue());
15
        }
16
        return sb2.toString();
17
    }

1
    public static final int[] k2 = {-98, -66, 192, 120, 60, 198, 168, -68, 216, 66, 168, 126, -108, -76, 126, -82, 114, -88, -88, -122, 162, -112, -66, 180, -122, 72, 108, 180, 78, -108, -106, -116};
2
    public static final int[] lk2 = {-74, 60, -78, 204, 96, -88, -82, 78, 162, 54, -68, 78, -84, 84, -80, 66, 216, -80, 180, 90, 174, -106, -74, 66, 114, -98, -116, 54, 84, 204, 204, -104};
3
    public static void main(String[] args) {
4
        System.out.println(m61080b(k2));
5
        System.out.println(m61080b(lk2));
6
    }

1
aApXDrhCxFhZkKZQVWWyfoAlyHTlJkis
2
IDMtPWQJfBCJSLOFxOlNjiIFVasBLttg

1
---
2
name: find-miyoushe-ds-salt
3
description: >
4
  Extract the DS signature parameters (K2/LK2 salt) from the miyoushe (miyoushe/hyperion) APK.
5
  Use this skill when the user asks to analyze the DS signature mechanism of miyoushe, find the K2/LK2 salt,
6
  reverse-engineer the miyoushe network request signature, or analyze the com.mihoyo.hyperion package via
7
  jadx-mcp-server. Applies to any version of the miyoushe APK; variable names differ due to obfuscation,
8
  but the logical structure remains unchanged.
9
---
10

11
# miyoushe DS Signature Parameter Extraction Guide
12

13
## Background
14

15
The miyoushe APK uses a DS (Dynamic Signature) mechanism to sign network requests. The DS is generated by a native (JNI) method; the Java layer is responsible for assembling the parameters and injecting them into the HTTP request headers. The core parameters K2 and LK2 are int[] arrays, which are decoded into salt strings by the AManager class and then passed to the native method.
16

17
## Prerequisites
18

19
-   jadx-mcp-server is started and connected to JADX-GUI
20
-   JADX-GUI has opened the target APK and decompilation is complete
21
-   Verify the connection is normal via `curl http://127.0.0.1:8650/health`
22

23
## Locating Procedure
24

25
The class names and field names in each step will vary by APK version (obfuscated renaming), but the logical structure is always consistent. Each step gives identifying characteristics; do not hardcode class names.
26

27
### Step 1: Find the native JNI wrapper class
28

29
The core DS signature implementation is in the native layer. First find the native wrapper class under the `com.mihoyo.hyperion.net` package.
30

31
> ⚠️ **Search API Caveats (Must Read)**: The `search-classes-by-keyword` endpoint with `search_in=class` splits class names by `.` and performs prefix/whole-word matching on **individual tokens**. Therefore, **any qualified package name containing `.`** (e.g., `com.mihoyo.hyperion.net`, `com.mihoyo`, `hyperion.net`) will return 0 results.
32
> The correct approach is to use a **single token** (e.g., `mihoyo`/`hyperion`/`net`), or switch to `search_in=code` to search for code-level features.
33

34
**Recommended query (most precise, directly hits the native library load point):**
35

36
```bash
37
# Search for System.loadLibrary in code, then filter results for com.mihoyo.hyperion.net.* classes
38
curl -s "http://127.0.0.1:8650/search-classes-by-keyword?search_term=loadLibrary&search_in=code&offset=0&count=20"
39
```
40

41
**Alternative query (single-token package name fragment; requires manual filtering with the `com.mihoyo.hyperion.net` prefix):**
42

43
```bash
44
curl -s "http://127.0.0.1:8650/search-classes-by-keyword?search_term=net&search_in=class&offset=0&count=40"
45
```
46

47
Identifying characteristics: there are usually 2 classes in this package that meet the following conditions:
48

49
-   `static { System.loadLibrary("xxx"); }` loads the native library
50
-   contains a `native` method whose parameters and return value are both `String`
51
-   the class name is extremely short (obfuscated), e.g., `aaaaa`, `bbbbb`
52

53
Record these two classes as **Class A** and **Class B** respectively. Each has a native method that accepts 1-2 String parameters and returns a String (usually with the same name, e.g., `a2222`).
54

55
### Step 2: Find the DS Interceptor (OkHttp Interceptor)
56

57
Use cross-references to find who calls these native methods.
58

59
```bash
60
# Perform xrefs on the native signing methods of Class A and Class B respectively
61
curl -s "http://127.0.0.1:8650/xrefs-to-method?class_name=<Class A full name>&method_name=<method name>&offset=0&count=20"
62
curl -s "http://127.0.0.1:8650/xrefs-to-method?class_name=<Class B full name>&method_name=<method name>&offset=0&count=20"
63
```
64

65
Identifying characteristics: among the xrefs there will be a class implementing `Interceptor` (OkHttp's `InterfaceC18926w`), and its `intercept` method contains `chain.proceed(...)` and the `"DS"` string.
66

67
This class is the **DS Interceptor**. However, in practice **the interceptor is often an inner class** (e.g., `hn.C33707m`), and MCP's `class-source` and `xrefs-to-class` will return "Class not found" for classes with inner-class suffixes (like `C33707m`); only `xrefs-to-method` (by method) can resolve them. Also note that **there is no `/method-source` endpoint**; do not attempt to call it.
68

69
> ✅ **Recommended programmatic approach (no manual GUI interaction needed)**: Perform `xrefs-to-method` on the native method to find the **caller** (typically an Application initialization class like `xxx.app.xxxApplicationHelper`), then read the **caller's** `class-source` (which can be fetched normally). Search within it for `new <InterceptorClass>(K22)` / `int[] K22 = ...` to reverse-trace the salt array. This bypasses the issue of being unable to fetch the interceptor source code directly.
70

71
Fallback (when the caller source is also unavailable): manually open the interceptor class in JADX-GUI, then read it via the `current-class` API:
72

73
```bash
74
curl -s "http://127.0.0.1:8650/current-class"
75
```
76

77
### Step 3: Analyze the DS Interceptor Logic
78

79
From the interceptor's `intercept` method you can see:
80

81
1.  **DS type determination**: decide whether to use DS1 or DS2 based on the request tag or path
82
2.  **DS1 path**: call a native method, passing in a salt string
83
3.  **DS2 path**: call another native method, passing in the request body and query string
84
4.  **salt source**: the salt is decoded from an `int[]` array by some manager class
85

86
Key code pattern:
87

88
```java
89
// DS2 path (special requests)
90
if (isDS2) {
91
    ds = nativeMethod2(requestBody, queryString);
92
} else {
93
    // DS1 path (normal requests)
94
    ds = nativeMethod1(manager.decode(intArray));
95
}
96
chain.proceed(request.addHeader("DS", ds).build());
97
```
98

99
### Step 4: Find Where the Salt Array Is Defined
100

101
Prefer the "programmatic approach" from Step 2: read the interceptor **caller's** `class-source` and search for `new <Interceptor>(K22)` to locate the salt array. If you insist on using xrefs, note that `xrefs-to-class` may also return "not found" for inner-class interceptors:
102

103
```bash
104
curl -s "http://127.0.0.1:8650/xrefs-to-class?class_name=<DS interceptor class name>&offset=0&count=20"
105
```
106

107
> ⚠️ **K2/LK2 are NOT necessarily in BuildConfig**: `com.mihoyo.hyperion.utils.BuildConfig` is just a standard Gradle artifact (containing only `BUILD_TYPE`, etc.). The two `int[]` arrays actually reside in a different class (e.g., `p232Df.C1989a`). Do not hardcode "find BuildConfig"; instead, look for **a class containing two adjacent `public static final int[]` static fields**, with obfuscated field names (e.g., `f37869p`/`f37870q`). The order is fixed: upper = **K2**, lower = **LK2**.
108

109
Identifying characteristics: instantiation usually happens in the Application initialization method (such as `initAppEnv` or similar name). Look for code like:
110

111
```java
112
int[] K22 = SomeClass.K2_FIELD;     // Upper field = K2
113
new DSInterceptor(K22);
114
// Same class also contains LK2_FIELD = LK2 below
115
```
116

117
Record the two `int[]` fields of that class (names are obfuscated). Usually the two array fields are defined adjacent to each other; the upper one is **K2** and the lower one is **LK2** (the order is fixed). You can cross-confirm using the JS Bridge class from Step 5.
118

119
If the class is accessible via the API, fetch it directly:
120

121
```bash
122
curl -s "http://127.0.0.1:8650/class-source?class_name=<salt array class name>"
123
```
124

125
### Step 5: Confirm the Correspondence Between K2 and LK2
126

127
Find another place that uses these arrays via xrefs or search. `GetDSMethodImpl` (the JS Bridge implementation) uses LK2, which can be confirmed by searching for the array references within it:
128

129
```bash
130
# Search for classes containing both native method names (typically the JS Bridge)
131
curl -s "http://127.0.0.1:8650/search-classes-by-keyword?search_term=getDS&search_in=code&offset=0&count=10"
132
```
133

134
That class will contain code like this to explicitly identify LK2:
135

136
```java
137
int[] LK2 = SomeClass.LK2_FIELD;    // Same class as in Step 4
138
data.put("DS", nativeMethod(manager.decode(LK2)));
139
```
140

141
### Step 6: Decode the Salt
142

143
Find the `AManager` class (a utility class responsible for decoding `int[]` into String).
144

145
Identifying characteristics:
146
- the package name is usually under the bn package
147
- contains two methods with identical parameters and return values (one for K2, one for LK2)
148
- method logic: iterate over the int array, apply a mathematical operation to each element to convert it to a char
149

150
Decode algorithm (unchanged across versions):
151
```javascript
152
function decodeSalt(intArr) {
153
    return intArr.map(x => {
154
        if (x < 0) {
155
            return Math.abs(x) >= 729
156
                ? String.fromCharCode(Math.floor(Math.log(-x) / Math.log(3) - 6 + 48))
157
                : String.fromCharCode(~x);
158
        }
159
        return String.fromCharCode(Math.floor(x / 3) + 48);
160
    }).join('');
161
}
162
```
163

164
Execute directly:
165
```bash
166
node -e "
167
const k2 = [<K2 array values>];
168
const lk2 = [<LK2 array values>];
169
function d(a){return a.map(x=>x<0?Math.abs(x)>=729?String.fromCharCode(Math.floor(Math.log(-x)/Math.log(3)-6+48)):String.fromCharCode(~x):String.fromCharCode(Math.floor(x/3)+48)).join('');}
170
console.log('K2 salt:', d(k2));
171
console.log('LK2 salt:', d(lk2));
172
"
173
```
174

175
## Version Differences
176

177
| Element                     | Changes?   | Description                                                                                                                              |
178
| :-------------------------- | :--------- | :--------------------------------------------------------------------------------------------------------------------------------------- |
179
| Package structure           | No         | `com.mihoyo.hyperion.net` always exists                                                                                                  |
180
| Native wrapper class name   | Yes        | Obfuscated to short names, e.g., `aaaaa`/`bbbbb`                                                                                         |
181
| Native method name          | Yes        | Obfuscated to short names, e.g., `a2222`/`b5555`                                                                                         |
182
| Native library name         | Yes        | Obfuscated to short names, e.g., `libdddd.so`                                                                                            |
183
| DS interceptor class name   | Yes        | Obfuscated, but always implements the Interceptor interface                                                                              |
184
| Salt array host class name  | Yes        | Package/class name is obfuscated, and it is **NOT necessarily BuildConfig** (tested in `p232Df.C1989a` for this version); always contains two adjacent `int[]` fields |
185
| K2/LK2 array values         | **Yes**    | Each version has a different salt                                                                                                        |
186
| AManager decode algorithm   | No         | Mathematical logic is fixed                                                                                                              |
187
| DS header name              | No         | Always `"DS"`                                                                                                                            |
188
| DS1/DS2 determination logic | No         | Determined by tag or path                                                                                                                |
189

190
## Quick Reference
191

192
The complete call chain of DS generation:
193
```
194
OkHttp request → DS interceptor.intercept()
195
  ├─ DS2: nativeMethod(body, query) → encrypt signature
196
  └─ DS1: nativeMethod(AManager.decode(K2/LK2)) → encrypt signature
197
       └─ int[] → decode algorithm → salt string
198
Final: request.addHeader("DS", signature value)
199
```
200

201
K2 is used by the main API interceptor, and LK2 is used by the WebView JS Bridge's `getDS` method. The decoding method for both is exactly the same; only the application scenario differs.