diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md
index 7bc7770..9535640 100644
--- a/docs/HUYA_HDID_ALGORITHM_GEN.md
+++ b/docs/HUYA_HDID_ALGORITHM_GEN.md
@@ -867,3 +867,8 @@ hypasswordLogin/MsgLoginReq/LogLoginReq → mid 各异, tail 恒定 8b38f1 → a
 - SSO-only 注入 (s3=s4="hy_300023887") 后 getOtp 全流程 985 hooks 无错误!
 ### mid = f(in, cnt, s3, s4, s5) (s5 也入 mid!) — 差分闭环就绪
 ### 下步: 全组合爆破 (in/cnt/s3/s4/s5 候选族) → mid == ed0db8
+
+## §11.38 首次全组合爆破 (R11d)
+- 30976 combos (in×cnt×s3×s4×s5 候选族交叉) = 8.1s, 零命中
+- 结论: 真实输入不在候选族内 → 需 s3/s4/s5 真源 (loadLoginData 持久化数据 / AppLoginData 真实 x20-s5)
+- 差分引擎就绪 (30K calls/8s, 可 10 倍扩容)
diff --git a/tools/unidbg/hydev/src/hydev/AesProbe.java b/tools/unidbg/hydev/src/hydev/AesProbe.java
index c0ed9c2..818e751 100644
--- a/tools/unidbg/hydev/src/hydev/AesProbe.java
+++ b/tools/unidbg/hydev/src/hydev/AesProbe.java
@@ -176,6 +176,37 @@ public class AesProbe {
         return "";
     }
 
+    void burstOtp() {
+        String[] S3 = {"", "hy_300023887", "300023887", "772ed992b0e161276f44ec63671e60155c506294",
+            "1e8bdf7d4f7a01d3", "13.4.22", "1.0.80138", "5008", "xiaomi", "127.0.0.1", "7c5387e0539c023c31c4ff0e807e7256117385ee"};
+        String[] S5 = {"", "1e8bdf7d4f7a01d3", "00000000000000000000000000000000",
+            "7c5387e0539c023c31c4ff0e807e7256117385ee",
+            "hZrPb62GskrEeTYcLeUTL1fJ1OR8ky3x9qXQq0s6ICJV5v9T",
+            "*hZrPb62GskrEeTYcLeUTL1fJ1OR8ky3x9qXQq0s6ICJV5v9T", "13.4.22", "02df398797432eadefcc12767119ad5e80999389"};
+        String[] IN = {"0", "1", "3251699", "300023887", "1724464550000", "1724464550", "", "13.4.22"};
+        long[] CNT = {0, 1, 2, 3};
+        String G = "ed0db8334cadd236c00cadf7e11ab5a5";
+        int n = 0, hit = 0;
+        long t0 = System.currentTimeMillis();
+        for (String s3 : S3) for (String s4 : S3) for (String s5 : S5) for (String in : IN) for (long cnt : CNT) {
+            n++;
+            UnidbgPointer pa = writeStdString(in), ps3 = writeStdString(s3), ps4 = writeStdString(s4), ps5 = writeStdString(s5), pout = writeStdString("");
+            try {
+                module.callFunction(emulator, 0x32fa24L,
+                    UnidbgPointer.nativeValue(pa), 2L, cnt,
+                    UnidbgPointer.nativeValue(ps3), UnidbgPointer.nativeValue(ps4), UnidbgPointer.nativeValue(ps5),
+                    4L, 0L, UnidbgPointer.nativeValue(pout));
+                String out = readStdString(pout);
+                if (out.length() >= 36) {
+                    String mid = toHex(out).substring(4, 36);
+                    if (mid.equals(G)) { System.out.println("!!! HIT in=" + in + " cnt=" + cnt + " s3=" + s3 + " s4=" + s4 + " s5=" + s5 + " out=" + toHex(out)); hit++; }
+                }
+            } catch (Throwable tx) {}
+        }
+        long dt = System.currentTimeMillis() - t0;
+        System.out.println("[burst] n=" + n + " hits=" + hit + " in " + dt + "ms");
+    }
+
     String callOtp(String a, String b) {
         UnidbgPointer pa = writeStdString(a);
         UnidbgPointer pb = writeStdString(b);
@@ -636,6 +667,7 @@ public class AesProbe {
         p.callOtpReal("0", 1L, "", "", "00000000000000000000000000000000", 0L);
         p.callOtpReal("0", 1L, "hy_300023887", "772ed992b0e161276f44ec63671e60155c506294", "00000000000000000000000000000000", 0L);
         p.callOtpReal("1724464550000", 0L, "", "", "", 0L);
+        p.burstOtp();
         // 基准: 已知 16B 明文 + 24B 钥
         // 64B 钥材料测试 (KeyExpansion 以 16B 步长读!!)
         String k64_zmhav = "ZMHAVPRaxJ3MtXDjduUnXAKQ" + "\0".repeat(0);