diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md
index c6ded87..58655da 100644
--- a/docs/HUYA_HDID_ALGORITHM_GEN.md
+++ b/docs/HUYA_HDID_ALGORITHM_GEN.md
@@ -1399,3 +1399,25 @@ m209202(SparseArray,Context,Map)@0x21bdc n209202(SparseArray,[B,I,String,J)@0x43
 1. 候选密钥批量解: mpdc-16B / ga2 / turing.dat / sha256(materials) / 13B-nonce
 2. 13B 头语义解码 → nonce→key 关系 (R24 已证: 同 nonce 对 13B 头相同!)
 3. ga k209202-16B 块 = 设备材料块加密器 (状态补全后 = 主密钥源!)
+
+## §11.59 R28: 头结构破译 + 密钥候选批量否定 (2026-08-29)
+
+### 13B 头结构 (4 样本对比!)
+```
+0625: 7c da | 11 | 69 c9 f5 28 9c 4d 46 | a1 de 05 | 43 48 82
+0647: 7c da | 11 | 69 c9 f5 28 9c 4d 46 | a1 de 05 | 11 bb 80
+0649: 7c da | 01 | 89 c8 f5 08 9e 4c 48 | e3 ec 07 | 13 55 a7   (fresh-identity-B!)
+full: 7c da | 11 | 69 c9 f5 28 9c 4d 46 | 95 6f 21 | 10 bb 80
+```
+- [2B 魔数 7cda][1B 版本: 01=首次/11=重注册][7B 会话ID (同会话 3 样本相同!)] [3B 会话动态][...]
+- 0649 (fresh-B) 会话ID 完全不同 → 会话ID = 身份相关 (非纯随机!)
+
+### 密钥候选批量解码 (真 sub_24D58, 20 密钥 × off-11 3920B)
+- mpdc/mpdc_rev/md5/sha1/sha256(mpdc|sess/mpdc|sess|turing)/sess7pad/sess7trace/
+  mpdc_xor_sess/sha256(sess)/dat 派生 — **全部 lencheck=False** (尾字非长度!)
+- 结论: 密钥 ≠ 简单材料哈希组合 — 派生逻辑含未知变换 (版本化/轮换!)
+
+### 判定
+- 完整加密链已验证 (deflate→pad+len→XTEA@24D58!) = 纯代码铸造的可执行底座
+- **密钥派生 = ga 传输层内部 (k209202-16B块/0x24334 状态机!) — 需 turingga.so 的 IDA 导出**
+  (同 mfa 方法论: 反编译 = 派生逻辑可读!)
diff --git a/tools/unidbg/hydev/src/hydev/TuringProbe.java b/tools/unidbg/hydev/src/hydev/TuringProbe.java
index 8721d02..75bdeac 100644
--- a/tools/unidbg/hydev/src/hydev/TuringProbe.java
+++ b/tools/unidbg/hydev/src/hydev/TuringProbe.java
@@ -346,8 +346,17 @@ public class TuringProbe {
             int n = blob.length / 4;
             com.github.unidbg.pointer.UnidbgPointer vp = emulator.getMemory().mmap(blob.length + 32, 7);
             for (int i=0;i<blob.length;i++) vp.setByte(i, blob[i]);
-            // key @ 3DF88 (LOAD-1 identity fileoff==vaddr)
+            // key @ 3DF88 (LOAD-1 identity fileoff==vaddr); 或 TP_KEY 文件
             long keyPtr = m.base + 0x3DF88;
+            String kf = System.getenv("TP_KEY");
+            if (kf != null && !kf.isEmpty()) {
+                byte[] kb = new java.io.FileInputStream(kf).readAllBytes();
+                byte[] k16 = java.util.Arrays.copyOf(kb, 16);
+                com.github.unidbg.pointer.UnidbgPointer kp = emulator.getMemory().mmap(32, 7);
+                for (int i=0;i<16;i++) kp.setByte(i, k16[i]);
+                keyPtr = kp.peer;
+                System.out.println("[TP] key override: " + java.util.HexFormat.of().formatHex(k16));
+            }
             System.out.println("[TP] xtest " + (enc ? "ENC" : "DEC") + " sub_24D58 n=" + n + " key@" + Long.toHexString(keyPtr));
             Number ret = m.callFunction(emulator, 0x24D58, vp.peer, enc ? n : -n, keyPtr);
             System.out.println("[TP] xtest ret=" + ret);