diff --git a/xposed/src/main/java/moe/fuqiuluo/qqinterface/servlet/BaseSvc.kt b/xposed/src/main/java/moe/fuqiuluo/qqinterface/servlet/BaseSvc.kt
index 03bf15d..6efa17a 100644
--- a/xposed/src/main/java/moe/fuqiuluo/qqinterface/servlet/BaseSvc.kt
+++ b/xposed/src/main/java/moe/fuqiuluo/qqinterface/servlet/BaseSvc.kt
@@ -11,6 +11,7 @@ import kotlinx.coroutines.DelicateCoroutinesApi
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.GlobalScope
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.suspendCancellableCoroutine
 import kotlinx.coroutines.withTimeoutOrNull
 import moe.fuqiuluo.proto.protobufOf
 import moe.fuqiuluo.shamrock.utils.PlatformUtils
@@ -37,9 +38,9 @@ internal abstract class BaseSvc {
         }
 
         suspend fun sendOidbAW(cmd: String, cmdId: Int, serviceId: Int, data: ByteArray, trpc: Boolean = false, timeout: Long = 5000L): ByteArray? {
+            val seq = MsfCore.getNextSeq()
             return withTimeoutOrNull(timeout) {
-                suspendCoroutine { continuation ->
-                    val seq = MsfCore.getNextSeq()
+                suspendCancellableCoroutine { continuation ->
                     GlobalScope.launch(Dispatchers.Default) {
                         DynamicReceiver.register(IPCRequest(cmd, seq) {
                             val buffer = it.getByteArrayExtra("buffer")!!
@@ -49,13 +50,16 @@ internal abstract class BaseSvc {
                     if (trpc) sendTrpcOidb(cmd, cmdId, serviceId, data, seq)
                     else sendOidb(cmd, cmdId, serviceId, data, seq)
                 }
+            }.also {
+                if (it == null)
+                    DynamicReceiver.unregister(seq)
             }?.copyOf()
         }
 
         suspend fun sendBufferAW(cmd: String, isPb: Boolean, data: ByteArray, timeout: Long = 5000L): ByteArray? {
+            val seq = MsfCore.getNextSeq()
             return withTimeoutOrNull<ByteArray?>(timeout) {
-                suspendCoroutine { continuation ->
-                    val seq = MsfCore.getNextSeq()
+                suspendCancellableCoroutine { continuation ->
                     GlobalScope.launch(Dispatchers.Default) {
                         DynamicReceiver.register(IPCRequest(cmd, seq) {
                             val buffer = it.getByteArrayExtra("buffer")!!
@@ -64,6 +68,9 @@ internal abstract class BaseSvc {
                         sendBuffer(cmd, isPb, data, seq)
                     }
                 }
+            }.also {
+                if (it == null)
+                    DynamicReceiver.unregister(seq)
             }?.copyOf()
         }
 
diff --git a/xposed/src/main/java/moe/fuqiuluo/qqinterface/servlet/transfile/RichProtoSvc.kt b/xposed/src/main/java/moe/fuqiuluo/qqinterface/servlet/transfile/RichProtoSvc.kt
index 28cc774..50f72cc 100644
--- a/xposed/src/main/java/moe/fuqiuluo/qqinterface/servlet/transfile/RichProtoSvc.kt
+++ b/xposed/src/main/java/moe/fuqiuluo/qqinterface/servlet/transfile/RichProtoSvc.kt
@@ -63,24 +63,30 @@ internal object RichProtoSvc: BaseSvc() {
     suspend fun getC2CFileDownUrl(
         fileId: String,
         subId: String,
+        retryCnt: Int = 0
     ): String {
-        val uid = ContactHelper.getUidByUinAsync(app.currentUin.toLong())
-        val buffer = sendOidbAW("OidbSvcTrpcTcp.0xe37_1200", 3639, 1200, protobufOf(
+        val buffer = sendOidbAW("OidbSvc.0xe37_1200", 3639, 1200, protobufOf(
             1 to 1200,
             2 to 1 /* QRoute.api(IAudioHelperApi::class.java).genDebugSeq().toInt() */, /* seq */
             14 to mapOf(
-                10 to uid,
+                10 to app.longAccountUin,
                 20 to fileId,
                 30 to 2, /* ver */
                 60 to subId,
                 601 to 0
             ),
-            101 to 3,
+            101 to 3, // uint32_business_id
             102 to 104, /* client_type */
-            200 to 1, /* url_type */
-            99999 to 90200 to 1
-        ).toByteArray(), trpc = true)
+            200 to 1, /* uint32_flag_support_mediaplatform */
+            99999 to mapOf(
+                90200 to 1 // uint32_download_url_type
+            )
+        ).toByteArray())
+
         if (buffer == null) {
+            if (retryCnt < 3) {
+                return getC2CFileDownUrl(fileId, subId, retryCnt + 1)
+            }
             return ""
         } else {
             val body = oidb_sso.OIDBSSOPkg()