# Passport RSA patch

Replaces the passport login RSA public key so credentials are encrypted
for the server's `Passport:RsaPrivateKey`. Input: a single-line Base64 DER
`SubjectPublicKeyInfo` body (no PEM markers), 2048-bit, exponent 65537;
empty uses the built-in PemukulPaku key.

## Windows (`rsa/windows.rs`)

Target: `BH3_Data/Native/UserAssembly.dll` (x64 PE), after confirming the
region from `ChannelConfig`.

1. Find the shared XML RSA routine (prefix `CRYPTO`) in the executable
   `il2cpp` section and the nearby account/password encryption `CALL`
   pair that targets it. A missing or ambiguous match aborts before any
   write.
2. Base64-encode the key's modulus (344 characters).
3. Append a `.hi3rsa` code section: an `HI3RSA01` header (the two
   original call RVAs and the routine RVA), the wrapper, and the modulus.
   Redirect both login `CALL`s into the wrapper; the routine and its
   other callers are untouched.
4. Update the section count, code/image sizes and certificate directory
   offset (the certificate is kept; its signature no longer matches),
   re-verify the image, and write via `util::replace::verified`.

At runtime the wrapper receives the managed XML key in `RCX`. If the key
is non-null, 505 UTF-16 chars long, and has the `<Modulus>` tags at the
expected offsets, it writes the new modulus at byte offset `0xE2`; in
every case it then calls the original routine.

A repeat run validates the existing `.hi3rsa` section and redirected
calls and replaces only the modulus. A single known 80-byte `jk98…`
overlay before the certificate is preserved; other overlays are rejected.

## Android overseas (`rsa/android.rs`)

`…oversea.sdk.internal.shared.crypto.RSAUtils.getRSA_PUBLIC_KEY`
references three environment keys (398-byte, newline-wrapped 2048-bit) via
`const-string`. All three are replaced in place with the chosen key;
wrapping at 63/64/65 characters keeps the strings distinct and in sort
order. String order is re-validated and checksums are recomputed.

## Android CN (`rsa/cn_android.rs`)

`…account.sdk.utils.RSAUtils` holds a 1024-bit key string. A 398-byte
wrapped 2048-bit replacement is appended (`format::dex::append_string`),
the key and its two neighbor string ids are reordered to keep sort order,
and the field, both `const-string` references and both static values are
remapped. Checksums are recomputed; unknown layouts are rejected.

An APK containing both CN and overseas SDKs is rejected.