diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md
index 095d8ae..a26a0a4 100644
--- a/docs/虎牙hyCred签发-侦察笔记.md
+++ b/docs/虎牙hyCred签发-侦察笔记.md
@@ -202,3 +202,14 @@ build_password_login_wup(前会话复刻包) POST https://wup.huya.com
   body=原始TAF字节(非b64!), CT=application/multipart-formdata, Dalvik UA
 → HTTP200 588B结构化TAF响应(huyaudbwebui/hypasswordLogin回显)!
 假密码测试通过=帧格式实锤。下步: 解响应取rc/cred字段,真密码登录取cred->铸证->cookie。
+
+## R2: 响应解析+签名缺口定位
+
+TAF响应解析成功: _wup_data/_wup_header 双map, JSON上下文回显
+  {id:4097(=0x1001!), associationId:8193(0x2001), session, traceId, step:1}
+错误码: APP_SIGN_NOT_MATCH "APP签名不匹配" + SIGNAL_SERVICE_RET。
+签名密钥候选: KFWAH2cbkkNgFAgQPzriFPcU (24字符) 注册于AESkeyMgr::C2@0x26fcc8!
+  (与证书钥4VYc/xXED/3FMH同管理体系,疑为请求签名专用钥)
+另发现 ybEWdvkjGjPQa2ugireHJCLL 邻串。
+下步: 反汇编AESkeyMgr::C2取全部钥表+id; 结合登录时bigaes钩子事件复刻sign算法。
+注: 发包body=raw TAF字节(b64是旧文档误导); HTTP200帧已通。