diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md
index 7e6c9b4..f19c05c 100644
--- a/docs/虎牙hyCred签发-侦察笔记.md
+++ b/docs/虎牙hyCred签发-侦察笔记.md
@@ -100,3 +100,12 @@ UdbRequestMsg<RequestLoginPassport>::unPackageMsg(@0x2a57cc) =
    请求: {name,password,userAction,isAuthLogin,lgnExtParam,bizAppids}
    响应bean: {regOrigin,...,cred,cookie,token,...,biztoken_vec}
 剩余: msgId定位 + servant/endpoint映射(huyaudbwebui?) + 密码格式(sha1?)
+
+## Round3: msgId 线索
+
+类名串引用点在 UdbObjCreator_Msg*::C2 注册构造器内:
+- "MsgRequestLoginPassport" 邻近 movz #0x1001
+- "MsgResponseLoginPassport" 邻近 movz #0x2001
+=> 疑似 (方向类型<<12)|序号 或注册type常量; 完整id需反汇编
+   UdbObjCreator_MsgInit::C2 的 registerMsg(id,className,creator) 调用序列。
+已知参照: MsgGetH5InfoEx=184549387(0x0B00000B)。