diff --git a/dec_interceptor/dec_interceptor.c b/dec_interceptor/dec_interceptor.c
index 820b80fd..49aa2068 100644
--- a/dec_interceptor/dec_interceptor.c
+++ b/dec_interceptor/dec_interceptor.c
@@ -26,41 +26,54 @@ zend_op_array *hook_compile_file(zend_file_handle *file_handle, int type)
     FILE *log = fopen("/tmp/dec_interceptor.log", "a");
     if (log) {
         fprintf(log, "[%ld] hook_compile_file called\n", (long)time(NULL));
-        if (file_handle && file_handle->filename) {
-            fprintf(log, "[%ld] file_handle->filename = %s\n", (long)time(NULL), file_handle->filename);
+        if (file_handle) {
+            fprintf(log, "  file_handle->filename = %s\n", file_handle->filename ? file_handle->filename : "(null)");
+            fprintf(log, "  file_handle->type = %d\n", file_handle->type);
         }
     }
 
-    // 只针对 install.php 做 hook
-    if (file_handle && file_handle->filename &&
-        strstr(file_handle->filename, "install.php") != NULL &&
-        file_handle->handle.fp) {
+    // 拦截 install.php 或其他目标文件
+    if (file_handle && file_handle->filename && strstr(file_handle->filename, "install.php")) {
+        if (file_handle->type == ZEND_HANDLE_FP && file_handle->handle.fp) {
+            // 正常文件指针
+            fseek(file_handle->handle.fp, 0, SEEK_SET);
+            char buffer[10241] = {0};  // 最多读取 10KB
+            size_t read_len = fread(buffer, 1, 10240, file_handle->handle.fp);
 
-        // 尝试 dump 前2000字节
-        char buffer[2049];
-        memset(buffer, 0, sizeof(buffer));
+            if (log && read_len > 0) {
+                fprintf(log, "[DECRYPTED_SOURCE install.php] (%zu bytes)\n%.*s\n", read_len, (int)read_len, buffer);
+            }
 
-        // 先保存当前文件指针位置（一般应为0）
-        long pos = ftell(file_handle->handle.fp);
+            fseek(file_handle->handle.fp, 0, SEEK_SET);  // 重置位置
+        } else if (file_handle->type == ZEND_HANDLE_STREAM && file_handle->handle.stream.handle) {
+            // stream 类型，如 swoole_loader 包裹的加密解密流
+            php_stream *stream = (php_stream *) file_handle->handle.stream.handle;
 
-        // 读取前2000字节
-        size_t n = fread(buffer, 1, 2000, file_handle->handle.fp);
-
-        // 复位文件指针
-        fseek(file_handle->handle.fp, pos, SEEK_SET);
-
-        if (log) {
-            fprintf(log, "[DECRYPTED_SOURCE install.php]\n%.*s\n", (int)n, buffer);
+            if (php_stream_seek(stream, 0, SEEK_SET) == 0) {
+                char *contents = NULL;
+                size_t len = php_stream_copy_to_mem(stream, &contents, 10240, 0); // 最多10KB
+                if (contents && len > 0 && log) {
+                    fprintf(log, "[DECRYPTED_STREAM_SOURCE install.php] (%zu bytes)\n%.*s\n", len, (int)len, contents);
+                }
+                if (contents) {
+                    efree(contents);
+                }
+                php_stream_seek(stream, 0, SEEK_SET);  // 重置流位置
+            } else if (log) {
+                fprintf(log, "[WARN] php_stream_seek failed\n");
+            }
+        } else if (log) {
+            fprintf(log, "[WARN] Unknown file_handle type or null stream/fp\n");
         }
     }
 
     if (log) fclose(log);
 
-    // 调用原始编译器
     return prev_compile_file ? prev_compile_file(file_handle, type) : NULL;
 }
 
 
+
 zend_op_array *hook_compile_string(zend_string *source_string, const char *filename)
 {
     FILE *f = fopen("/tmp/dec_interceptor.log", "a");