diff --git a/har/1ms_dianxuan/PROGRESS.md b/har/1ms_dianxuan/PROGRESS.md
index d7b43ac..b83ee9e 100644
--- a/har/1ms_dianxuan/PROGRESS.md
+++ b/har/1ms_dianxuan/PROGRESS.md
@@ -43,6 +43,11 @@
 | 11 | 密钥字**既不是立即数、也不是字面字符串**（无论明文、大端字节序列、base64 都不在 tdc.js/字节码里）| 立即数 1.3e9~1.9e9 区间为空；`ldFPRVkjJCKeigfH` 及其 base64 均搜不到 | 确证 |
 | 12 | 密钥数组在 XTEA 轮里通过**寄存器间接寻址**读取，且经闭包捕获传入 | 反汇编 `reg7[(sum>>>11)&3]`；`@09463 CREATE_CLOSURE target=@9109 caps=[r7=r8]` | 确证 |
 | 13 | 轮加盐**每次构建都不同**（但都是可见立即数）| 本构建 = `723726`(j==2) / `855311`(j==3)；台账另一构建 = `2829068` / `328986` | 确证 |
+| 14 | **密钥字的构造算法（已完全还原）**：`word = Σ ((charCodeAt(源串,k) + off_i) & 0xFF) << (8k)`，4 个源串各自一个**独立偏移常量**，常量是打包点的立即数 | 神谕二分 + DUMP_PC 取到源串；反汇编读出常量：<br>`("IA_t", -8)` `("9:%!", +49)` `("nTLS", -9)` `("7XYf", +3)` | 确证 |
+| 15 | **有效密钥 = base 字 + 两个轮加盐** | `real[0]-base[0]=855311`、`real[3]-base[3]=723726`（XTEA 轮里的立即数） | 确证 |
+| 16 | **纯 Python 可完整复算密钥，与 `extract_xtea_key` 逐字一致** | `base=[1817655617,1381395306,1245924197,1767660346]` → 折盐 → `[1818510928,1381395306,1245924197,1768384072]` == Node 结果 | 确证 |
+| 17 | 密钥链路的运行时位置（神谕实测） | 逐字首次出现 PC：7740/7526/7895/8852(均 reg9)；数组组装 @8886(reg7)；进 XTEA 闭包 @9030 `CALL_FUNC[2]`；入口 @9109 | 确证 |
+| 18 | `extract_xtea_key`（Node）本身正确 | 其密钥把 probe 的真实 collect 解成 `{"cd":[0,10,"top",[360,360],"MacIntel",1,"undefined?rand…` | 确证 |
 
 ---
 
diff --git a/tools/tdc_probe.js b/tools/tdc_probe.js
index f1db10f..b10b09d 100644
--- a/tools/tdc_probe.js
+++ b/tools/tdc_probe.js
@@ -91,6 +91,10 @@ function probeTdc(tdcFilePath, options = {}) {
     + "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
     + "if(v&&v.length===4&&v[0]===window.__W[0]&&v[1]===window.__W[1]&&v[2]===window.__W[2]&&v[3]===window.__W[3])"
     + "{window.__ARR={at:H,reg:i,prev:window.__PC.slice(-120)};break;}}}"
+    + "if(!window.__WP){window.__WP=[null,null,null,null];}"
+    + "for(var q=0;q<4;q++){if(window.__WP[q])continue;"
+    + "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
+    + "if(typeof v==='number'&&v===window.__W[q]){window.__WP[q]={at:H,reg:i};break;}}}"
     + "if(H<=" + TARGET_PC + "&&!window.__WRD){var f=-1;"
     + "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
     + "if(typeof v==='number'&&v===window.__W[0]){f=i;break;}}"
@@ -99,11 +103,11 @@ function probeTdc(tdcFilePath, options = {}) {
   // 可选: 在指定 PC dump 全部寄存器 (神谕二分/定位用)
   const DUMP_PC = parseInt(process.env.DUMP_PC || "-1", 10);
   if (DUMP_PC >= 0) {
-    tdcCode = "window.__DPC=" + DUMP_PC + ";window.__DUMP=null;(function(){var _h=window.__H;"
-      + "window.__H=function(H,E){_h(H,E);if(H===window.__DPC&&!window.__DUMP){var o=[];"
+    tdcCode = "window.__DPC=" + DUMP_PC + ";window.__DUMP=[];(function(){var _h=window.__H;"
+      + "window.__H=function(H,E){_h(H,E);if(H===window.__DPC&&window.__DUMP.length<8){var o=[];"
       + "for(var i=0;i<E.length;i++){var c=E[i];var v=(c&&c.length===1)?c[0]:c;"
       + "o.push(typeof v==='string'?'str:'+v:(typeof v==='number'?'num:'+v:String(v)));}"
-      + "window.__DUMP=o;}}})();" + tdcCode;
+      + "window.__DUMP.push(o);}}})();" + tdcCode;
   }
   const NEEDLE = "M=G[z[H++]]()";
   if (tdcCode.includes(NEEDLE)) {
@@ -328,6 +332,7 @@ function probeTdc(tdcFilePath, options = {}) {
     __arr: sandbox.__ARR || null,
     __wrd: sandbox.__WRD || null,
     __dump: sandbox.__DUMP || null,
+    __wp: sandbox.__WP || null,
   };
 
   return result;