diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md
index 27c776e..f2e5256 100644
--- a/docs/虎牙hyCred签发-侦察笔记.md
+++ b/docs/虎牙hyCred签发-侦察笔记.md
@@ -273,3 +273,13 @@ hy_300023887/aa778899 SHA1=金样本哈希(同一账号历史登录)。
 => 该t3 bytes[114]与桥采cred格式有差异(桥采0a20开头), 或非plain cred
    (可能为加密态/hyid), 需对照BusBeansAppLoginData精确tag定位真cred字段。
 纯Python链路已通到最后一环; 差异点已锁定在响应bean的cred字段识别。
+
+## 终验结论(本轮)
+
+真密码登录返回的t3 bytes[114](0a40开头)铸证被拒(40020), 新旧nonce均拒。
+对照桥采有效cred(0a20开头,bind通过): 该字段非plain cred。
+可能性: ①响应中cred经会话钥加密(需解密) ②该字段为hyid/其他
+③真cred在bean其他位置(t2 bytes[162]? t4 bytes[177]?)。
+下一步(精确): 设备登录时hook HandlerResponseLoginPassport::onHandler+
+saveLoginData, 对照同账号纯Python响应字节, 直接对出cred真实位置/形态。
+全部传输+组包+解析代码已就绪且验证通过。
diff --git a/evidence/forge_bind_result.json b/evidence/forge_bind_result.json
index 45dc833..557fa44 100644
--- a/evidence/forge_bind_result.json
+++ b/evidence/forge_bind_result.json
@@ -8,5 +8,5 @@
   }
  },
  "p1_new_hex": "010400353030381400c25220f81f60cf64ee54e83ef1eab6bdd047b5af28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a4003ef982e01399335f13e9ae294ebdf18a91fc43e6be883c67a7e19784689ec2d38b5c55b79048d8bec1ab66e55749605a86eb6eae62805a708910655b0be91056b9d7159d2bf116eaed44ded41d7b7fe810d0fbd6e3a689dcd2daa8477c304a49ab2b17d2512b9bc99e33f7d6e99daec",
- "ts": 1787654460.378764
+ "ts": 1787654648.662272
 }
\ No newline at end of file
diff --git a/evidence/hycred_real_cert.json b/evidence/hycred_real_cert.json
index 39deee5..5a11826 100644
--- a/evidence/hycred_real_cert.json
+++ b/evidence/hycred_real_cert.json
@@ -1 +1 @@
-{"p1": "010400353030381400c25220f81f60cf64ee54e83ef1eab6bdd047b5af28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a4003ef982e01399335f13e9ae294ebdf18a91fc43e6be883c67a7e19784689ec2d38b5c55b79048d8bec1ab66e55749605a86eb6eae62805a708910655b0be91056b9d7159d2bf116eaed44ded41d7b7fe810d0fbd6e3a689dcd2daa8477c304a49ab2b17d2512b9bc99e33f7d6e99daec", "cert_hex": "0c201aeb9aa1d4c9e6fc6d5628b1cb936a3b0c360b3914ed9b94f2cf4808490594202cbaa481870772fe2a4df9a94fdb8a0e41312514470c77cbfa586558f87309beb2b589f1bbf2525d5e923160b44986640f1b396e0a8ccb54ac0098dc9600ec17ffdd7cffebfab130cd3c2de0f9237b6b987e114996076e9b902dc91968ffd7489e099358d3e3c2bc03e957065afe88957a96e65bcc4b5a83e3832c66d92b41db9cbefe52baa2811e2d4befbbaa532a320bff5c13f3184e373fea8004b1ec7cbf", "cred_hex": "0a4003ef982e01399335f13e9ae294ebdf18a91fc43e6be883c67a7e19784689ec2d38b5c55b79048d8bec1ab66e55749605a86eb6eae62805a708910655b0be91056b9d7159d2bf116eaed44ded41d7b7fe810d0fbd6e3a689dcd2daa8477c304a49ab2b17d2512b9bc99e33f7d6e99daec"}
\ No newline at end of file
+{"p1": "01040035303038140001a03884d80400003884d804000000000000000028003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a4003ef982e01399335f13e9ae294ebdf18a91fc43e6be883c67a7e19784689ec2d38b5c55b79048d8bec1ab66e55749605a86eb6eae62805a708910655b0be91056b9d7159d2bf116eaed44ded41d7b7fe810d0fbd6e3a689dcd2daa8477c304a49ab2b17d2512b9bc99e33f7d6e99daec", "cert_hex": "0c209283d4c65ecf8dc5306aa0ae52b8141851af613d915376f5c7024c14199c6b352cbaa481870772fe2a4df9a94fdb8a0e41312514470c77cbfa586558f87309beb2b589f1bbf2525d5e923160b44986640f1b396e0a8ccb54ac0098dc9600ec17ffdd7cffebfab130cd3c2de0f9237b6b987e114996076e9b902dc91968ffd7489e099358d3e3c2bc03e957065afe88957a96e65bcc4b5a83e3832c66d92b41db9cbefe52baa2811e2d4befbbaa532a320bff5c13f3184e373fea8004b1ec7cbf", "cred_hex": "0a4003ef982e01399335f13e9ae294ebdf18a91fc43e6be883c67a7e19784689ec2d38b5c55b79048d8bec1ab66e55749605a86eb6eae62805a708910655b0be91056b9d7159d2bf116eaed44ded41d7b7fe810d0fbd6e3a689dcd2daa8477c304a49ab2b17d2512b9bc99e33f7d6e99daec"}
\ No newline at end of file