diff --git a/QUICK_START.pdf b/QUICK_START.pdf
index ab77acc..6e19a07 100644
Binary files a/QUICK_START.pdf and b/QUICK_START.pdf differ
diff --git a/assets/ljq_web_driver.user.js b/assets/ljq_web_driver.user.js
index 1cad405..c5642c8 100644
--- a/assets/ljq_web_driver.user.js
+++ b/assets/ljq_web_driver.user.js
@@ -1,7 +1,7 @@
 // ==UserScript==
 // @name         ljq_web_driver
 // @namespace    http://tampermonkey.net/
-// @version      0.3
+// @version      0.31
 // @description  Execute JS via ljq_web_driver
 // @require      https://code.jquery.com/jquery-3.6.0.min.js
 // @author       You
diff --git a/memory/tmwebdriver_sop.md b/memory/tmwebdriver_sop.md
index d5fb9dc..f03e209 100644
--- a/memory/tmwebdriver_sop.md
+++ b/memory/tmwebdriver_sop.md
@@ -48,4 +48,13 @@ fetch('PDF_URL').then(r=>r.blob()).then(b=>{
 - 优先：JS `canvas.toDataURL()` 直接拿base64（验证码是canvas/img时最干净，无需截屏）
 - 备选：`window.open(location.href,'_blank')` 前台开新标签→win32截图→完后close
   - GM_openInTab在web_execute_js不可用（非油猴上下文）
-  - 浏览器无JS API切标签页，只能开新的来保证前台
\ No newline at end of file
+  - 浏览器无JS API切标签页，只能开新的来保证前台
+
+## 跨域iframe操控(postMessage中继)
+- 跨域iframe的contentDocument不可访问，web_execute_js只在顶层执行
+- TM脚本已改造：iframe内不return，改为监听postMessage并eval执行+回传结果
+- 顶层发送：`iframe.contentWindow.postMessage({type:'ljq_exec', id, code}, '*')`
+- iframe回传：`{type:'ljq_result', id, result}` 通过window.addEventListener('message')接收
+- ⚠只能eval表达式，不支持return/函数体包装，构造代码时注意
+- 流程：发postMessage→等→读window._ljqResults[id]获取结果
+- 已验证：读取iframe内DOM(document.title)、填写input均成功
\ No newline at end of file