diff --git a/binary/jce/structs.go b/binary/jce/structs.go
index 77905475..30e648e7 100644
--- a/binary/jce/structs.go
+++ b/binary/jce/structs.go
@@ -101,6 +101,30 @@ type (
 		ServiceType int32        `jceId:"4"`
 	}
 
+	SvcReqGetDevLoginInfo struct {
+		IJceStruct
+		Guid           []byte `jceId:"0"`
+		AppName        string `jceId:"1"`
+		LoginType      int64  `jceId:"2"`
+		Timestamp      int64  `jceId:"3"`
+		NextItemIndex  int64  `jceId:"4"`
+		RequireMax     int64  `jceId:"5"`
+		GetDevListType int64  `jceId:"6"` // 1: getLoginDevList 2: getRecentLoginDevList 4: getAuthLoginDevList
+	}
+
+	SvcDevLoginInfo struct {
+		AppId          int64
+		Guid           []byte
+		LoginTime      int64
+		LoginPlatform  int64
+		LoginLocation  string
+		DeviceName     string
+		DeviceTypeInfo string
+		TerType        int64
+		ProductType    int64
+		CanBeKicked    int64
+	}
+
 	DelMsgInfo struct {
 		IJceStruct
 		FromUin    int64  `jceId:"0"`
@@ -473,6 +497,20 @@ func (pkt *PushMessageInfo) ReadFrom(r *JceReader) {
 	pkt.FromName = r.ReadString(17)
 }
 
+func (pkt *SvcDevLoginInfo) ReadFrom(r *JceReader) {
+	pkt.AppId = r.ReadInt64(0)
+	pkt.Guid = []byte{}
+	r.ReadSlice(&pkt.Guid, 1)
+	pkt.LoginTime = r.ReadInt64(2)
+	pkt.LoginPlatform = r.ReadInt64(3)
+	pkt.LoginLocation = r.ReadString(4)
+	pkt.DeviceName = r.ReadString(5)
+	pkt.DeviceTypeInfo = r.ReadString(6)
+	pkt.TerType = r.ReadInt64(8)
+	pkt.ProductType = r.ReadInt64(9)
+	pkt.CanBeKicked = r.ReadInt64(10)
+}
+
 func (pkt *SvcRespPushMsg) ToBytes() []byte {
 	w := NewJceWriter()
 	w.WriteJceStructRaw(pkt)
@@ -484,3 +522,9 @@ func (pkt *ModifyGroupCardRequest) ToBytes() []byte {
 	w.WriteJceStructRaw(pkt)
 	return w.Bytes()
 }
+
+func (pkt *SvcReqGetDevLoginInfo) ToBytes() []byte {
+	w := NewJceWriter()
+	w.WriteJceStructRaw(pkt)
+	return w.Bytes()
+}
diff --git a/client/builders.go b/client/builders.go
index 7bad83b0..eb2e178d 100644
--- a/client/builders.go
+++ b/client/builders.go
@@ -116,6 +116,7 @@ func (c *QQClient) buildCaptchaPacket(result string, sign []byte) (uint16, []byt
 	req := packets.BuildOicqRequestPacket(c.Uin, 0x810, crypto.ECDH, c.RandomKey, func(w *binary.Writer) {
 		w.WriteUInt16(2) // sub command
 		w.WriteUInt16(4)
+
 		w.Write(tlv.T2(result, sign))
 		w.Write(tlv.T8(2052))
 		w.Write(tlv.T104(c.t104))
@@ -196,6 +197,29 @@ func (c *QQClient) buildConfPushRespPacket(t int32, pktSeq int64, jceBuf []byte)
 	return seq, packet
 }
 
+// StatSvc.GetDevLoginInfo
+func (c *QQClient) buildDeviceListRequestPacket() (uint16, []byte) {
+	seq := c.nextSeq()
+	req := &jce.SvcReqGetDevLoginInfo{
+		Guid:           SystemDeviceInfo.Guid,
+		LoginType:      1,
+		AppName:        "com.tencent.mobileqq",
+		RequireMax:     20,
+		GetDevListType: 2,
+	}
+	buf := &jce.RequestDataVersion3{Map: map[string][]byte{"SvcReqGetDevLoginInfo": packRequestDataV3(req.ToBytes())}}
+	pkt := &jce.RequestPacket{
+		IVersion:     3,
+		SServantName: "StatSvc",
+		SFuncName:    "SvcReqGetDevLoginInfo",
+		SBuffer:      buf.ToBytes(),
+		Context:      make(map[string]string),
+		Status:       make(map[string]string),
+	}
+	packet := packets.BuildUniPacket(c.Uin, seq, "StatSvc.GetDevLoginInfo", 1, c.OutGoingPacketSessionId, []byte{}, c.sigInfo.d2Key, pkt.ToBytes())
+	return seq, packet
+}
+
 // friendlist.getFriendGroupList
 func (c *QQClient) buildFriendGroupListRequestPacket(friendStartIndex, friendListCount, groupStartIndex, groupListCount int16) (uint16, []byte) {
 	seq := c.nextSeq()
@@ -681,7 +705,7 @@ func (c *QQClient) buildGroupPttStorePacket(groupCode int64, md5 []byte, size, c
 func (c *QQClient) buildSystemMsgNewGroupPacket() (uint16, []byte) {
 	seq := c.nextSeq()
 	req := &structmsg.ReqSystemMsgNew{
-		MsgNum:    5,
+		MsgNum:    10,
 		Version:   100,
 		Checktype: 3,
 		Flag: &structmsg.FlagInfo{
diff --git a/client/client.go b/client/client.go
index d29e5de9..fb07eb42 100644
--- a/client/client.go
+++ b/client/client.go
@@ -89,6 +89,8 @@ type loginSigInfo struct {
 	tgt         []byte
 	tgtKey      []byte
 
+	srmToken           []byte // study room manager | 0x16a
+	t133               []byte
 	userStKey          []byte
 	userStWebSig       []byte
 	sKey               []byte
@@ -118,34 +120,35 @@ func NewClientMd5(uin int64, passwordMd5 [16]byte) *QQClient {
 		RandomKey:               make([]byte, 16),
 		OutGoingPacketSessionId: []byte{0x02, 0xB0, 0x5B, 0x8B},
 		decoders: map[string]func(*QQClient, uint16, []byte) (interface{}, error){
-			"wtlogin.login":                                decodeLoginResponse,             // 登录操作包
-			"StatSvc.register":                             decodeClientRegisterResponse,    // 客户端注册包
-			"StatSvc.ReqMSFOffline":                        decodeMSFOfflinePacket,          // 强制离线
-			"MessageSvc.PushNotify":                        decodeSvcNotify,                 // 好友消息通知包
-			"OnlinePush.PbPushGroupMsg":                    decodeGroupMessagePacket,        // 群消息通知包
-			"OnlinePush.ReqPush":                           decodeOnlinePushReqPacket,       // 群组相关事件包
-			"OnlinePush.PbPushTransMsg":                    decodeOnlinePushTransPacket,     // QQ相关事件包
-			"ConfigPushSvc.PushReq":                        decodePushReqPacket,             // 配置文件推送包
-			"MessageSvc.PbGetMsg":                          decodeMessageSvcPacket,          // 除群组以外消息拉取包
-			"MessageSvc.PbSendMsg":                         decodeMsgSendResponse,           // 消息发送包
-			"MessageSvc.PushForceOffline":                  decodeForceOfflinePacket,        // 强制离线
-			"friendlist.getFriendGroupList":                decodeFriendGroupListResponse,   // 获取好友列表包
-			"friendlist.GetTroopListReqV2":                 decodeGroupListResponse,         // 获取群组列表包
-			"friendlist.GetTroopMemberListReq":             decodeGroupMemberListResponse,   // 获取群成员列表包
-			"group_member_card.get_group_member_card_info": decodeGroupMemberInfoResponse,   // 获取群成员资料包
-			"ImgStore.GroupPicUp":                          decodeGroupImageStoreResponse,   // 请求群组图片上传包
-			"PttStore.GroupPttUp":                          decodeGroupPttStoreResponse,     // 请求群组语音上传包
-			"LongConn.OffPicUp":                            decodeOffPicUpResponse,          // 查询好友图片包
-			"ProfileService.Pb.ReqSystemMsgNew.Group":      decodeSystemMsgGroupPacket,      // 获取群组成员变动事件包
-			"ProfileService.Pb.ReqSystemMsgNew.Friend":     decodeSystemMsgFriendPacket,     // 获取好友变动事件包
-			"MultiMsg.ApplyUp":                             decodeMultiApplyUpResponse,      // 长消息/合并转发请求上传包
-			"MultiMsg.ApplyDown":                           decodeMultiApplyDownResponse,    // 长消息/合并转发请求下载包
-			"OidbSvc.0x6d6_2":                              decodeOIDB6d6Response,           // 群文件操作包
-			"OidbSvc.0x88d_0":                              decodeGroupInfoResponse,         // 获取群资料包
-			"OidbSvc.0xe07_0":                              decodeImageOcrResponse,          // 图片OCR请求包
-			"SummaryCard.ReqSummaryCard":                   decodeSummaryCardResponse,       // 获取用户卡片资料包
-			"PttCenterSvr.ShortVideoDownReq":               decodePttShortVideoDownResponse, // 短视频下载请求包
-			"LightAppSvc.mini_app_info.GetAppInfoById":     decodeAppInfoResponse,           // 获取小程序资料包
+			"wtlogin.login":                                decodeLoginResponse,
+			"StatSvc.register":                             decodeClientRegisterResponse,
+			"StatSvc.ReqMSFOffline":                        decodeMSFOfflinePacket,
+			"StatSvc.GetDevLoginInfo":                      decodeDevListResponse,
+			"MessageSvc.PushNotify":                        decodeSvcNotify,
+			"OnlinePush.PbPushGroupMsg":                    decodeGroupMessagePacket,
+			"OnlinePush.ReqPush":                           decodeOnlinePushReqPacket,
+			"OnlinePush.PbPushTransMsg":                    decodeOnlinePushTransPacket,
+			"ConfigPushSvc.PushReq":                        decodePushReqPacket,
+			"MessageSvc.PbGetMsg":                          decodeMessageSvcPacket,
+			"MessageSvc.PbSendMsg":                         decodeMsgSendResponse,
+			"MessageSvc.PushForceOffline":                  decodeForceOfflinePacket,
+			"friendlist.getFriendGroupList":                decodeFriendGroupListResponse,
+			"friendlist.GetTroopListReqV2":                 decodeGroupListResponse,
+			"friendlist.GetTroopMemberListReq":             decodeGroupMemberListResponse,
+			"group_member_card.get_group_member_card_info": decodeGroupMemberInfoResponse,
+			"ImgStore.GroupPicUp":                          decodeGroupImageStoreResponse,
+			"PttStore.GroupPttUp":                          decodeGroupPttStoreResponse,
+			"LongConn.OffPicUp":                            decodeOffPicUpResponse,
+			"ProfileService.Pb.ReqSystemMsgNew.Group":      decodeSystemMsgGroupPacket,
+			"ProfileService.Pb.ReqSystemMsgNew.Friend":     decodeSystemMsgFriendPacket,
+			"MultiMsg.ApplyUp":                             decodeMultiApplyUpResponse,
+			"MultiMsg.ApplyDown":                           decodeMultiApplyDownResponse,
+			"OidbSvc.0x6d6_2":                              decodeOIDB6d6Response,
+			"OidbSvc.0x88d_0":                              decodeGroupInfoResponse,
+			"OidbSvc.0xe07_0":                              decodeImageOcrResponse,
+			"SummaryCard.ReqSummaryCard":                   decodeSummaryCardResponse,
+			"PttCenterSvr.ShortVideoDownReq":               decodePttShortVideoDownResponse,
+			"LightAppSvc.mini_app_info.GetAppInfoById":     decodeAppInfoResponse,
 		},
 		sigInfo:                &loginSigInfo{},
 		requestPacketRequestId: 1921334513,
@@ -1052,8 +1055,9 @@ func (c *QQClient) netLoop() {
 		}
 		payload := pkt.Payload
 		if pkt.Flag2 == 2 {
-			payload, err = pkt.DecryptPayload(c.RandomKey)
+			payload, err = pkt.DecryptPayload(c.RandomKey, c.sigInfo.wtSessionTicketKey)
 			if err != nil {
+				c.Error("decrypt payload error: %v", err)
 				continue
 			}
 		}
diff --git a/client/decoders.go b/client/decoders.go
index 3458c177..963af379 100644
--- a/client/decoders.go
+++ b/client/decoders.go
@@ -33,6 +33,7 @@ var (
 	groupLeaveLock = new(sync.Mutex)
 )
 
+// wtlogin.login
 func decodeLoginResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	reader := binary.NewReader(payload)
 	reader.ReadUInt16() // sub command
@@ -117,6 +118,7 @@ func decodeLoginResponse(c *QQClient, _ uint16, payload []byte) (interface{}, er
 	return nil, nil // ?
 }
 
+// StatSvc.register
 func decodeClientRegisterResponse(_ *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	request := &jce.RequestPacket{}
 	request.ReadFrom(jce.NewJceReader(payload))
@@ -125,6 +127,7 @@ func decodeClientRegisterResponse(_ *QQClient, _ uint16, payload []byte) (interf
 	return nil, nil
 }
 
+// ConfigPushSvc.PushReq
 func decodePushReqPacket(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	request := &jce.RequestPacket{}
 	request.ReadFrom(jce.NewJceReader(payload))
@@ -164,6 +167,7 @@ func decodePushReqPacket(c *QQClient, _ uint16, payload []byte) (interface{}, er
 	return nil, c.send(pkt)
 }
 
+// MessageSvc.PbGetMsg
 func decodeMessageSvcPacket(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	rsp := msg.GetMessageResponse{}
 	err := proto.Unmarshal(payload, &rsp)
@@ -278,6 +282,7 @@ func decodeMessageSvcPacket(c *QQClient, _ uint16, payload []byte) (interface{},
 	return nil, err
 }
 
+// OnlinePush.PbPushGroupMsg
 func decodeGroupMessagePacket(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	pkt := msg.PushMessagePacket{}
 	err := proto.Unmarshal(payload, &pkt)
@@ -314,6 +319,7 @@ func decodeGroupMessagePacket(c *QQClient, _ uint16, payload []byte) (interface{
 	return nil, nil
 }
 
+// MessageSvc.PbSendMsg
 func decodeMsgSendResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	rsp := msg.SendMessageResponse{}
 	if err := proto.Unmarshal(payload, &rsp); err != nil {
@@ -325,6 +331,7 @@ func decodeMsgSendResponse(c *QQClient, _ uint16, payload []byte) (interface{},
 	return nil, nil
 }
 
+// MessageSvc.PushNotify
 func decodeSvcNotify(c *QQClient, _ uint16, _ []byte) (interface{}, error) {
 	c.msgSvcLock.Lock()
 	defer c.msgSvcLock.Unlock()
@@ -332,12 +339,31 @@ func decodeSvcNotify(c *QQClient, _ uint16, _ []byte) (interface{}, error) {
 	return nil, err
 }
 
+// StatSvc.GetDevLoginInfo
+func decodeDevListResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
+	request := &jce.RequestPacket{}
+	request.ReadFrom(jce.NewJceReader(payload))
+	data := &jce.RequestDataVersion2{}
+	data.ReadFrom(jce.NewJceReader(request.SBuffer))
+	rsp := jce.NewJceReader(data.Map["SvcRspGetDevLoginInfo"]["QQService.SvcRspGetDevLoginInfo"][1:])
+	d := []jce.SvcDevLoginInfo{}
+	ret := rsp.ReadInt64(3)
+	rsp.ReadSlice(&d, 5)
+	return ret, nil
+}
+
+// SummaryCard.ReqSummaryCard
 func decodeSummaryCardResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	request := &jce.RequestPacket{}
 	request.ReadFrom(jce.NewJceReader(payload))
 	data := &jce.RequestDataVersion2{}
 	data.ReadFrom(jce.NewJceReader(request.SBuffer))
-	rsp := jce.NewJceReader(data.Map["RespSummaryCard"]["SummaryCard.RespSummaryCard"][1:])
+	rsp := func() *jce.JceReader {
+		if r, ok := data.Map["RespSummaryCard"]["SummaryCard.RespSummaryCard"]; ok {
+			return jce.NewJceReader(r[1:])
+		}
+		return jce.NewJceReader(data.Map["RespSummaryCard"]["SummaryCard_Old.RespSummaryCard"][1:])
+	}()
 	return &SummaryCardInfo{
 		Sex:       rsp.ReadByte(1),
 		Age:       rsp.ReadByte(2),
@@ -351,6 +377,7 @@ func decodeSummaryCardResponse(c *QQClient, _ uint16, payload []byte) (interface
 	}, nil
 }
 
+// friendlist.getFriendGroupList
 func decodeFriendGroupListResponse(_ *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	request := &jce.RequestPacket{}
 	request.ReadFrom(jce.NewJceReader(payload))
@@ -376,6 +403,7 @@ func decodeFriendGroupListResponse(_ *QQClient, _ uint16, payload []byte) (inter
 	return rsp, nil
 }
 
+// friendlist.GetTroopListReqV2
 func decodeGroupListResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	request := &jce.RequestPacket{}
 	request.ReadFrom(jce.NewJceReader(payload))
@@ -409,6 +437,7 @@ func decodeGroupListResponse(c *QQClient, _ uint16, payload []byte) (interface{}
 	return l, nil
 }
 
+// OidbSvc.0x88d_0
 func decodeGroupInfoResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	pkg := oidb.OIDBSSOPkg{}
 	rsp := oidb.D88DRspBody{}
@@ -434,6 +463,7 @@ func decodeGroupInfoResponse(c *QQClient, _ uint16, payload []byte) (interface{}
 	}, nil
 }
 
+// friendlist.GetTroopMemberListReq
 func decodeGroupMemberListResponse(_ *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	request := &jce.RequestPacket{}
 	request.ReadFrom(jce.NewJceReader(payload))
@@ -468,6 +498,7 @@ func decodeGroupMemberListResponse(_ *QQClient, _ uint16, payload []byte) (inter
 	}, nil
 }
 
+// group_member_card.get_group_member_card_info
 func decodeGroupMemberInfoResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	rsp := pb.GroupMemberRspBody{}
 	if err := proto.Unmarshal(payload, &rsp); err != nil {
@@ -499,6 +530,7 @@ func decodeGroupMemberInfoResponse(c *QQClient, _ uint16, payload []byte) (inter
 	}, nil
 }
 
+// ImgStore.GroupPicUp
 func decodeGroupImageStoreResponse(_ *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	pkt := pb.D388RespBody{}
 	err := proto.Unmarshal(payload, &pkt)
@@ -526,6 +558,7 @@ func decodeGroupImageStoreResponse(_ *QQClient, _ uint16, payload []byte) (inter
 	}, nil
 }
 
+// PttStore.GroupPttUp
 func decodeGroupPttStoreResponse(_ *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	pkt := pb.D388RespBody{}
 	err := proto.Unmarshal(payload, &pkt)
@@ -550,6 +583,7 @@ func decodeGroupPttStoreResponse(_ *QQClient, _ uint16, payload []byte) (interfa
 	}, nil
 }
 
+// LongConn.OffPicUp
 func decodeOffPicUpResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	rsp := cmd0x352.RspBody{}
 	if err := proto.Unmarshal(payload, &rsp); err != nil {
@@ -587,6 +621,7 @@ func decodeOffPicUpResponse(c *QQClient, _ uint16, payload []byte) (interface{},
 	}, nil
 }
 
+// OnlinePush.ReqPush
 func decodeOnlinePushReqPacket(c *QQClient, seq uint16, payload []byte) (interface{}, error) {
 	request := &jce.RequestPacket{}
 	request.ReadFrom(jce.NewJceReader(payload))
@@ -738,6 +773,7 @@ func decodeOnlinePushReqPacket(c *QQClient, seq uint16, payload []byte) (interfa
 	return nil, nil
 }
 
+// OnlinePush.PbPushTransMsg
 func decodeOnlinePushTransPacket(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	info := msg.TransMsgInfo{}
 	err := proto.Unmarshal(payload, &info)
@@ -844,6 +880,7 @@ func decodeOnlinePushTransPacket(c *QQClient, _ uint16, payload []byte) (interfa
 	return nil, nil
 }
 
+// ProfileService.Pb.ReqSystemMsgNew.Group
 func decodeSystemMsgGroupPacket(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	rsp := structmsg.RspSystemMsgNew{}
 	if err := proto.Unmarshal(payload, &rsp); err != nil {
@@ -892,6 +929,7 @@ func decodeSystemMsgGroupPacket(c *QQClient, _ uint16, payload []byte) (interfac
 	return nil, nil
 }
 
+// ProfileService.Pb.ReqSystemMsgNew.Friend
 func decodeSystemMsgFriendPacket(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	rsp := structmsg.RspSystemMsgNew{}
 	if err := proto.Unmarshal(payload, &rsp); err != nil {
@@ -913,6 +951,7 @@ func decodeSystemMsgFriendPacket(c *QQClient, _ uint16, payload []byte) (interfa
 	return nil, nil
 }
 
+// MessageSvc.PushForceOffline
 func decodeForceOfflinePacket(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	request := &jce.RequestPacket{}
 	request.ReadFrom(jce.NewJceReader(payload))
@@ -927,6 +966,7 @@ func decodeForceOfflinePacket(c *QQClient, _ uint16, payload []byte) (interface{
 	return nil, nil
 }
 
+// StatSvc.ReqMSFOffline
 func decodeMSFOfflinePacket(c *QQClient, _ uint16, _ []byte) (interface{}, error) {
 	if c.Online {
 		c.lastLostMsg = "服务器端强制下线."
@@ -935,6 +975,7 @@ func decodeMSFOfflinePacket(c *QQClient, _ uint16, _ []byte) (interface{}, error
 	return nil, nil
 }
 
+// MultiMsg.ApplyUp
 func decodeMultiApplyUpResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	body := multimsg.MultiRspBody{}
 	if err := proto.Unmarshal(payload, &body); err != nil {
@@ -953,6 +994,7 @@ func decodeMultiApplyUpResponse(c *QQClient, _ uint16, payload []byte) (interfac
 	return nil, errors.New("failed")
 }
 
+// MultiMsg.ApplyDown
 func decodeMultiApplyDownResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	body := multimsg.MultiRspBody{}
 	if err := proto.Unmarshal(payload, &body); err != nil {
@@ -995,6 +1037,7 @@ func decodeMultiApplyDownResponse(c *QQClient, _ uint16, payload []byte) (interf
 	return &mt, nil
 }
 
+// OidbSvc.0x6d6_2
 func decodeOIDB6d6Response(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	pkg := oidb.OIDBSSOPkg{}
 	rsp := oidb.D6D6RspBody{}
@@ -1009,6 +1052,7 @@ func decodeOIDB6d6Response(c *QQClient, _ uint16, payload []byte) (interface{},
 	return fmt.Sprintf("http://%s/ftn_handler/%s/", ip, url), nil
 }
 
+// OidbSvc.0xe07_0
 func decodeImageOcrResponse(_ *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	pkg := oidb.OIDBSSOPkg{}
 	rsp := oidb.DE07RspBody{}
@@ -1042,6 +1086,7 @@ func decodeImageOcrResponse(_ *QQClient, _ uint16, payload []byte) (interface{},
 	}, nil
 }
 
+// PttCenterSvr.ShortVideoDownReq
 func decodePttShortVideoDownResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	rsp := pttcenter.ShortVideoRspBody{}
 	if err := proto.Unmarshal(payload, &rsp); err != nil {
@@ -1053,6 +1098,7 @@ func decodePttShortVideoDownResponse(c *QQClient, _ uint16, payload []byte) (int
 	return rsp.PttShortVideoDownloadRsp.DownloadAddr.Host[0] + rsp.PttShortVideoDownloadRsp.DownloadAddr.UrlArgs, nil
 }
 
+// LightAppSvc.mini_app_info.GetAppInfoById
 func decodeAppInfoResponse(c *QQClient, _ uint16, payload []byte) (interface{}, error) {
 	pkg := qweb.QWebRsp{}
 	rsp := qweb.GetAppInfoByIdRsp{}
diff --git a/client/tlv_decoders.go b/client/tlv_decoders.go
index 1671af56..dea1858f 100644
--- a/client/tlv_decoders.go
+++ b/client/tlv_decoders.go
@@ -81,6 +81,8 @@ func (c *QQClient) decodeT119(data []byte) {
 
 	c.sigInfo = &loginSigInfo{
 		loginBitmap:        0,
+		srmToken:           m[0x16a],
+		t133:               m[0x133],
 		tgt:                m[0x10a],
 		tgtKey:             m[0x10d],
 		userStKey:          m[0x10e],
diff --git a/protocol/crypto/crypto.go b/protocol/crypto/crypto.go
index 335198eb..ea435785 100644
--- a/protocol/crypto/crypto.go
+++ b/protocol/crypto/crypto.go
@@ -12,6 +12,10 @@ type EncryptECDH struct {
 	PublicKey       []byte
 }
 
+type EncryptSession struct {
+	T133 []byte
+}
+
 var ECDH = &EncryptECDH{}
 
 var tenKeyX = new(big.Int).SetBytes([]byte{ // pubkey[1:24]
@@ -56,3 +60,20 @@ func (e *EncryptECDH) DoEncrypt(d, k []byte) []byte {
 func (e *EncryptECDH) Id() byte {
 	return 7
 }
+
+func NewEncryptSession(t133 []byte) *EncryptSession {
+	return &EncryptSession{T133: t133}
+}
+
+func (e *EncryptSession) DoEncrypt(d, k []byte) []byte {
+	return binary.NewWriterF(func(w *binary.Writer) {
+		encrypt := binary.NewTeaCipher(k).Encrypt(d)
+		w.WriteUInt16(uint16(len(e.T133)))
+		w.Write(e.T133)
+		w.Write(encrypt)
+	})
+}
+
+func (e *EncryptSession) Id() byte {
+	return 69
+}
diff --git a/protocol/crypto/ecdh.go b/protocol/crypto/ecdh.go
deleted file mode 100644
index 5871506e..00000000
--- a/protocol/crypto/ecdh.go
+++ /dev/null
@@ -1 +0,0 @@
-package crypto
diff --git a/protocol/packets/global.go b/protocol/packets/global.go
index fb38fbf0..e7cd5140 100644
--- a/protocol/packets/global.go
+++ b/protocol/packets/global.go
@@ -166,7 +166,7 @@ func parseSsoFrame(payload []byte, flag2 byte) (*IncomingPacket, error) {
 	}, nil
 }
 
-func (pkt *IncomingPacket) DecryptPayload(random []byte) ([]byte, error) {
+func (pkt *IncomingPacket) DecryptPayload(random, sessionKey []byte) ([]byte, error) {
 	reader := binary.NewReader(pkt.Payload)
 	if reader.ReadByte() != 2 {
 		return nil, ErrUnknownFlag
@@ -193,6 +193,12 @@ func (pkt *IncomingPacket) DecryptPayload(random []byte) ([]byte, error) {
 		}()
 		return data, nil
 	}
+	if encryptType == 3 {
+		return func() []byte {
+			d := reader.ReadBytes(reader.Len() - 1)
+			return binary.NewTeaCipher(sessionKey).Decrypt(d)
+		}(), nil
+	}
 	if encryptType == 4 {
 		panic("todo")
 	}
diff --git a/protocol/tlv/t108.go b/protocol/tlv/t108.go
new file mode 100644
index 00000000..dbf1679f
--- /dev/null
+++ b/protocol/tlv/t108.go
@@ -0,0 +1,10 @@
+package tlv
+
+import "github.com/Mrs4s/MiraiGo/binary"
+
+func T108(arr []byte) []byte {
+	return binary.NewWriterF(func(w *binary.Writer) {
+		w.WriteUInt16(0x108)
+		w.WriteTlv(arr)
+	})
+}
diff --git a/protocol/tlv/t10a.go b/protocol/tlv/t10a.go
new file mode 100644
index 00000000..482adb01
--- /dev/null
+++ b/protocol/tlv/t10a.go
@@ -0,0 +1,10 @@
+package tlv
+
+import "github.com/Mrs4s/MiraiGo/binary"
+
+func T10A(arr []byte) []byte {
+	return binary.NewWriterF(func(w *binary.Writer) {
+		w.WriteUInt16(0x10A)
+		w.WriteTlv(arr)
+	})
+}
diff --git a/protocol/tlv/t143.go b/protocol/tlv/t143.go
new file mode 100644
index 00000000..8ce9b624
--- /dev/null
+++ b/protocol/tlv/t143.go
@@ -0,0 +1,10 @@
+package tlv
+
+import "github.com/Mrs4s/MiraiGo/binary"
+
+func T143(arr []byte) []byte {
+	return binary.NewWriterF(func(w *binary.Writer) {
+		w.WriteUInt16(0x143)
+		w.WriteTlv(arr)
+	})
+}
diff --git a/protocol/tlv/t16a.go b/protocol/tlv/t16a.go
new file mode 100644
index 00000000..27a23690
--- /dev/null
+++ b/protocol/tlv/t16a.go
@@ -0,0 +1,10 @@
+package tlv
+
+import "github.com/Mrs4s/MiraiGo/binary"
+
+func T16A(arr []byte) []byte {
+	return binary.NewWriterF(func(w *binary.Writer) {
+		w.WriteUInt16(0x16A)
+		w.WriteTlv(arr)
+	})
+}