diff --git a/tools/tdc_probe.js b/tools/tdc_probe.js
index 7ac51a5..f1db10f 100644
--- a/tools/tdc_probe.js
+++ b/tools/tdc_probe.js
@@ -84,9 +84,27 @@ function probeTdc(tdcFilePath, options = {}) {
 
   // ---- 神谕钩子(自包含, 写在沙箱内的 window 上): 记录 PC, 并在进入 XTEA 例程时 dump 密钥寄存器 ----
   const TARGET_PC = parseInt(process.env.XTEA_PC || "9109", 10);
-  const HOOK = "window.__PC=window.__PC||[];window.__H=function(H,E){window.__PC.push(H);"
-    + "if(H===" + TARGET_PC + "&&!window.__XT){var c=E[7];window.__XT={at:H,"
-    + "r7:Array.isArray(c)?JSON.stringify(c).slice(0,300):String(c),prev:window.__PC.slice(-260)};}};";
+  const BASE = (process.env.BASE_KEY || "1817655617,1381395306,1245924197,1767660346");
+  const HOOK = "window.__PC=window.__PC||[];window.__W=[" + BASE + "];"
+    + "window.__H=function(H,E){window.__PC.push(H);"
+    + "if(H<=" + TARGET_PC + "&&!window.__ARR){"
+    + "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
+    + "if(v&&v.length===4&&v[0]===window.__W[0]&&v[1]===window.__W[1]&&v[2]===window.__W[2]&&v[3]===window.__W[3])"
+    + "{window.__ARR={at:H,reg:i,prev:window.__PC.slice(-120)};break;}}}"
+    + "if(H<=" + TARGET_PC + "&&!window.__WRD){var f=-1;"
+    + "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
+    + "if(typeof v==='number'&&v===window.__W[0]){f=i;break;}}"
+    + "if(f>=0)window.__WRD={at:H,reg:f,prev:window.__PC.slice(-120)};}"
+    + "};";
+  // 可选: 在指定 PC dump 全部寄存器 (神谕二分/定位用)
+  const DUMP_PC = parseInt(process.env.DUMP_PC || "-1", 10);
+  if (DUMP_PC >= 0) {
+    tdcCode = "window.__DPC=" + DUMP_PC + ";window.__DUMP=null;(function(){var _h=window.__H;"
+      + "window.__H=function(H,E){_h(H,E);if(H===window.__DPC&&!window.__DUMP){var o=[];"
+      + "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
+      + "o.push(typeof v==='string'?'str:'+v:(typeof v==='number'?'num:'+v:String(v)));}"
+      + "window.__DUMP=o;}}})();" + tdcCode;
+  }
   const NEEDLE = "M=G[z[H++]]()";
   if (tdcCode.includes(NEEDLE)) {
     tdcCode = HOOK + tdcCode.replace(NEEDLE, "M=(window.__H(H,E),G[z[H++]]())");
@@ -307,6 +325,9 @@ function probeTdc(tdcFilePath, options = {}) {
     accesses: Array.from(accesses).sort(),
     __pc_len: (sandbox.__PC || []).length,
     __xtea: sandbox.__XT || null,
+    __arr: sandbox.__ARR || null,
+    __wrd: sandbox.__WRD || null,
+    __dump: sandbox.__DUMP || null,
   };
 
   return result;