Hi3-Patcher/docs/rsa.md

Passport RSA patch

Replaces the passport login RSA public key so credentials are encrypted for the server's Passport:RsaPrivateKey. Input: a single-line Base64 DER SubjectPublicKeyInfo body (no PEM markers), 2048-bit, exponent 65537; empty uses the built-in PemukulPaku key.

Windows (rsa/windows.rs)

Target: BH3_Data/Native/UserAssembly.dll (x64 PE), after confirming the region from ChannelConfig.

1. Find the shared XML RSA routine (prefix CRYPTO) in the executable il2cpp section and the nearby account/password encryption CALL pair that targets it. A missing or ambiguous match aborts before any write.
2. Base64-encode the key's modulus (344 characters).
3. Append a .hi3rsa code section: an HI3RSA01 header (the two original call RVAs and the routine RVA), the wrapper, and the modulus. Redirect both login CALLs into the wrapper; the routine and its other callers are untouched.
4. Update the section count, code/image sizes and certificate directory offset (the certificate is kept; its signature no longer matches), re-verify the image, and write via util::replace::verified.

At runtime the wrapper receives the managed XML key in RCX. If the key is non-null, 505 UTF-16 chars long, and has the <Modulus> tags at the expected offsets, it writes the new modulus at byte offset 0xE2; in every case it then calls the original routine.

A repeat run validates the existing .hi3rsa section and redirected calls and replaces only the modulus. A single known 80-byte jk98… overlay before the certificate is preserved; other overlays are rejected.

Android overseas (rsa/android.rs)

…oversea.sdk.internal.shared.crypto.RSAUtils.getRSA_PUBLIC_KEY references three environment keys (398-byte, newline-wrapped 2048-bit) via const-string. All three are replaced in place with the chosen key; wrapping at 63/64/65 characters keeps the strings distinct and in sort order. String order is re-validated and checksums are recomputed.

Android CN (rsa/cn_android.rs)

…account.sdk.utils.RSAUtils holds a 1024-bit key string. A 398-byte wrapped 2048-bit replacement is appended (format::dex::append_string), the key and its two neighbor string ids are reordered to keep sort order, and the field, both const-string references and both static values are remapped. Checksums are recomputed; unknown layouts are rejected.

An APK containing both CN and overseas SDKs is rejected.