探讨关于整个字节全息的X-bogus和A-bogus

mcl

探讨关于整个字节全系的X-bogus和A-bogus。算了直接给代码了：

1. import hashlib
   
2. import random
   
3. from time import time
   
4. from urllib.parse import urlencode
   
5. 
   
6. # SM3 哈希（Python 3.11+ 标准库支持；更低版本可装 gmssl 替代）
   
7. def sm3_hex(data: bytes) -> str:
   
8.     return hashlib.new('sm3', data).hexdigest()
   
9. 
   
10. 
    
11. def sm3_to_array(data) -> list:
    
12.     """把 str/list 做 sm3 后输出 32 字节的 int 列表"""
    
13.     if isinstance(data, str):
    
14.         b = data.encode('utf-8')
    
15.     else:
    
16.         b = bytes(data)
    
17.     h = sm3_hex(b)
    
18.     return [int(h[i:i + 2], 16) for i in range(0, len(h), 2)]
    
19. 
    
20. 
    
21. class ABogus:
    
22.     __end_string = "cus"
    
23.     __str = {
    
24.         "s0": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
    
25.         "s1": "Dkdpgh4ZKsQB80/Mfvw36XI1R25+WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=",
    
26.         "s2": "Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=",
    
27.         "s3": "ckdp1h4ZKsUB80/Mfvw36XIgR25+WQAlEi7NLboqYTOPuzmFjJnryx9HVGDaStCe",
    
28.         "s4": "Dkdpgh2ZmsQB80/MfvV36XI1R45-WUAlEixNLwoqYTOPuzKFjJnry79HbGcaStCe",
    
29.     }
    
30. 
    
31.     def __init__(self, user_agent: str = "", platform: str = None):
    
32.         self.user_agent = user_agent
    
33.         self.ua_code = self.generate_ua_code(user_agent)
    
34.         self.browser = self.generate_browser_info(platform)
    
35.         self.browser_len = len(self.browser)
    
36.         self.browser_code = self.char_code_at(self.browser)
    
37. 
    
38.     # ---------- UA 指纹 ----------
    
39.     def generate_ua_code(self, user_agent: str) -> list:
    
40.         numbers = [0.00390625, 1, 14]
    
41.         key_string = ''.join(chr(int(num)) for num in numbers)
    
42.         return sm3_to_array(self.generate_result(self.rc4_encrypt(user_agent, key_string), "s3"))
    
43. 
    
44.     # ---------- 随机列表 ----------
    
45.     def list_1(self, a=170, b=85, c=45) -> list:
    
46.         return self.random_list(a, b, 1, 2, 5, c & a)
    
47. 
    
48.     def list_2(self, a=170, b=85) -> list:
    
49.         return self.random_list(a, b, 1, 0, 0, 0)
    
50. 
    
51.     def list_3(self, a=170, b=85) -> list:
    
52.         return self.random_list(a, b, 1, 0, 5, 0)
    
53. 
    
54.     def random_list(self, b=170, c=85, d=0, e=0, f=0, g=0) -> list:
    
55.         r = random.random() * 10000
    
56.         v = [r, int(r) & 255, int(r) >> 8]
    
57.         v.append(v[1] & b | d)
    
58.         v.append(v[1] & c | e)
    
59.         v.append(v[2] & b | f)
    
60.         v.append(v[2] & c | g)
    
61.         return v[-4:]
    
62. 
    
63.     def from_char_code(self, *args):
    
64.         return "".join(chr(code) for code in args)
    
65. 
    
66.     def generate_string_1(self):
    
67.         return (self.from_char_code(*self.list_1())
    
68.                 + self.from_char_code(*self.list_2())
    
69.                 + self.from_char_code(*self.list_3()))
    
70. 
    
71.     # ---------- 参数指纹 ----------
    
72.     def generate_string_2(self, url_params: str, method="GET") -> str:
    
73.         a = self.generate_string_2_list(url_params, method)
    
74.         e = self.end_check_num(a)
    
75.         a.extend(self.browser_code)
    
76.         a.append(e)
    
77.         return self.rc4_encrypt(self.from_char_code(*a), "y")
    
78. 
    
79.     def generate_string_2_list(self, url_params: str, method="GET") -> list:
    
80.         start_time = int(time() * 1000)
    
81.         end_time = start_time + random.randint(4, 8)
    
82.         params_array = self.generate_params_code(url_params)
    
83.         method_array = self.generate_method_code(method)
    
84.         return self.list_4(
    
85.             (end_time >> 24) & 255,
    
86.             params_array[21],
    
87.             self.ua_code[23],
    
88.             (end_time >> 16) & 255,
    
89.             params_array[22],
    
90.             self.ua_code[24],
    
91.             (end_time >> 8) & 255,
    
92.             (end_time >> 0) & 255,
    
93.             (start_time >> 24) & 255,
    
94.             (start_time >> 16) & 255,
    
95.             (start_time >> 8) & 255,
    
96.             (start_time >> 0) & 255,
    
97.             method_array[21],
    
98.             method_array[22],
    
99.             int(end_time / 256 / 256 / 256 / 256) >> 0,
    
100.             int(start_time / 256 / 256 / 256 / 256) >> 0,
     
101.             self.browser_len,
     
102.         )
     
103. 
     
104.     def list_4(self, a, b, c, d, e, f, g, h, i, j, k, m, n, o, p, q, r) -> list:
     
105.         return [
     
106.             44, a, 0, 0, 0, 0, 24, b, n, 0, c, d, 0, 0, 0, 1, 0, 239, e, o, f, g, 0, 0,
     
107.             0, 0, h, 0, 0, 14, i, j, 0, k, m, 3, p, 1, q, 1, r, 0, 0, 0]
     
108. 
     
109.     def end_check_num(self, a: list):
     
110.         r = 0
     
111.         for i in a:
     
112.             r ^= i
     
113.         return r
     
114. 
     
115.     # ---------- base64 变体 ----------
     
116.     def generate_result(self, s, e="s4"):
     
117.         r = []
     
118.         for i in range(0, len(s), 3):
     
119.             if i + 2 < len(s):
     
120.                 n = (ord(s[i]) << 16) | (ord(s[i + 1]) << 8) | ord(s[i + 2])
     
121.             elif i + 1 < len(s):
     
122.                 n = (ord(s[i]) << 16) | (ord(s[i + 1]) << 8)
     
123.             else:
     
124.                 n = ord(s[i]) << 16
     
125.             for j, k in zip(range(18, -1, -6), (0xFC0000, 0x03F000, 0x0FC0, 0x3F)):
     
126.                 if j == 6 and i + 1 >= len(s):
     
127.                     break
     
128.                 if j == 0 and i + 2 >= len(s):
     
129.                     break
     
130.                 r.append(self.__str[e][(n & k) >> j])
     
131.         r.append("=" * ((4 - len(r) % 4) % 4))
     
132.         return "".join(r)
     
133. 
     
134.     def generate_method_code(self, method: str = "GET") -> list:
     
135.         return sm3_to_array(sm3_to_array(method + self.__end_string))
     
136. 
     
137.     def generate_params_code(self, params: str) -> list:
     
138.         return sm3_to_array(sm3_to_array(params + self.__end_string))
     
139. 
     
140.     # ---------- 浏览器指纹 ----------
     
141.     def generate_browser_info(self, platform: str = "Win32") -> str:
     
142.         inner_width = random.randint(1280, 1920)
     
143.         inner_height = random.randint(720, 1080)
     
144.         outer_width = random.randint(inner_width, 1920)
     
145.         outer_height = random.randint(inner_height, 1080)
     
146.         screen_x = 0
     
147.         screen_y = random.choice((0, 30))
     
148.         value_list = [
     
149.             inner_width, inner_height, outer_width, outer_height,
     
150.             screen_x, screen_y, 0, 0,
     
151.             outer_width, outer_height, outer_width, outer_height,
     
152.             inner_width, inner_height, 24, 24, platform,
     
153.         ]
     
154.         return "|".join(str(i) for i in value_list)
     
155. 
     
156.     def char_code_at(self, s):
     
157.         return [ord(char) for char in s]
     
158. 
     
159.     # ---------- rc4 ----------
     
160.     def rc4_encrypt(self, plaintext, key):
     
161.         s = list(range(256))
     
162.         j = 0
     
163.         for i in range(256):
     
164.             j = (j + s[i] + ord(key[i % len(key)])) % 256
     
165.             s[i], s[j] = s[j], s[i]
     
166.         i = 0
     
167.         j = 0
     
168.         cipher = []
     
169.         for k in range(len(plaintext)):
     
170.             i = (i + 1) % 256
     
171.             j = (j + s[i]) % 256
     
172.             s[i], s[j] = s[j], s[i]
     
173.             t = (s[i] + s[j]) % 256
     
174.             cipher.append(chr(s[t] ^ ord(plaintext[k])))
     
175.         return ''.join(cipher)
     
176. 
     
177.     # ---------- 对外接口 ----------
     
178.     def generate_a_bogus(self, url_params: dict | str) -> str:
     
179.         if isinstance(url_params, dict):
     
180.             url_params = urlencode(url_params)
     
181.         string_1 = self.generate_string_1()
     
182.         string_2 = self.generate_string_2(url_params)
     
183.         string = string_1 + string_2
     
184.         return self.generate_result(string, "s4")
     
185. 
     
186. 
     
187. if __name__ == "__main__":
     
188.     bogus = ABogus("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36")
     
189.     print(bogus.generate_a_bogus({"aweme_id": "7400044629845970202", "cursor": "0", "count": "20"}))
     

复制代码

这是X-bogus:

1. import hashlib
   
2. import random
   
3. 
   
4. 
   
5. def rc4_bytes(key: bytes, data: bytes) -> bytes:
   
6.     S = list(range(256))
   
7.     j = 0
   
8.     for i in range(256):
   
9.         j = (j + S[i] + key[i % len(key)]) % 256
   
10.         S[i], S[j] = S[j], S[i]
    
11.     i = j = 0
    
12.     result = bytearray()
    
13.     for byte in data:
    
14.         i = (i + 1) % 256
    
15.         j = (j + S[i]) % 256
    
16.         S[i], S[j] = S[j], S[i]
    
17.         k = S[(S[i] + S[j]) % 256]
    
18.         result.append(byte ^ k)
    
19.     return bytes(result).decode('iso-8859-1')
    
20. 
    
21. 
    
22. qlist = {'bogusIndex': 0, 'envcode': 1}
    
23. ucode = {'ubcode': 0}
    
24. 
    
25. 
    
26. def action_valid():
    
27.     bits = [random.getrandbits(1) for _ in range(8)]
    
28.     ucode['ubcode'] = bits[0] | bits[1] | bits[2] | bits[3] | bits[4] | bits[5] | bits[6] | bits[7]
    
29.     ucode['ubcode'] &= ~126
    
30. 
    
31. 
    
32. def xbogus_fun(protocol, revent_flag, arg3, in_salt, data):
    
33.     """生成 X-Bogus。data 是 query 字符串的 md5 字节"""
    
34.     action_valid()
    
35.     in_salt = in_salt or ''
    
36.     in_salt_md5 = hashlib.md5(in_salt.encode('utf-8')).digest()
    
37.     if data is None:
    
38.         data = b'00000000000000000000000000000000'
    
39. 
    
40.     uArray = bytearray(9)
    
41.     pad_string = (protocol << 6) | (revent_flag << 5) | ((int(random.random() * 100) & 1) << 4) | 0
    
42.     qlist['bogusIndex'] += 1
    
43.     bogusIndex = qlist['bogusIndex'] & 0x3f
    
44.     uArray[0] = (arg3 << 6) | bogusIndex
    
45.     uArray[1] = (qlist['envcode'] >> 8) & 255
    
46.     uArray[2] = qlist['envcode'] & 255
    
47.     uArray[3] = ucode['ubcode']
    
48.     in_salt_md5_md5 = hashlib.md5(in_salt_md5).digest()
    
49.     uArray[4] = in_salt_md5_md5[14]
    
50.     uArray[5] = in_salt_md5_md5[15]
    
51.     data_md5 = hashlib.md5(data).digest()
    
52.     uArray[6] = data_md5[14]
    
53.     uArray[7] = data_md5[15]
    
54.     uArray[8] = int(random.random() * 255) & 255
    
55.     return xcrypto(pad_string, uArray)
    
56. 
    
57. 
    
58. def xcrypto(pad_string, ostring):
    
59.     length = len(ostring)
    
60.     uarray = bytearray(length + 1)
    
61.     ieor = 0
    
62.     for i in range(length):
    
63.         uarray[i] = ostring[i]
    
64.         ieor ^= ostring[i]
    
65.     uarray[length] = ieor
    
66.     random_key = random.randint(0, 255)
    
67.     crypted_text = rc4_bytes(bytes([random_key]), bytes(uarray))
    
68.     result = chr(pad_string) + chr(random_key) + crypted_text
    
69.     return dy_base64(result, 's1')
    
70. 
    
71. 
    
72. def dy_base64(data: str, mindex: str, pad: str = "=") -> str:
    
73.     letters = {
    
74.         "s1": "Dkdpgh4ZKsQB80/Mfvw36XI1R25+WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=",
    
75.         "s4": "Dkdpgh2ZmsQB80/MfvV36XI1R45-WUAlEixNLwoqYTOPuzKFjJnry79HbGcaStCe",
    
76.     }
    
77.     ua_table = letters[mindex]
    
78.     data_bytes = data.encode('iso-8859-1')
    
79.     out = ""
    
80.     i = 0
    
81.     while i < len(data_bytes):
    
82.         c1 = data_bytes[i]; i += 1
    
83.         c2 = data_bytes[i] if i < len(data_bytes) else None; i += 1
    
84.         c3 = data_bytes[i] if i < len(data_bytes) else None; i += 1
    
85.         combined = ((c1 & 0xff) << 16) | ((c2 & 0xff) << 8 if c2 is not None else 0) | (c3 & 0xff if c3 is not None else 0)
    
86.         out += ua_table[(combined >> 18) & 0x3f]
    
87.         out += ua_table[(combined >> 12) & 0x3f]
    
88.         out += ua_table[(combined >> 6) & 0x3f] if c2 is not None else pad
    
89.         out += ua_table[combined & 0x3f] if c3 is not None else pad
    
90.     return out
    
91. 
    
92. 
    
93. def generate(params: dict) -> str:
    
94.     """便捷接口：传入参数字典，返回 X-Bogus"""
    
95.     query = '&'.join(f'{k}={v}' for k, v in params.items())
    
96.     data_md5 = hashlib.md5(query.encode()).digest()
    
97.     return xbogus_fun(1, False, 0, None, data_md5)
    
98. 
    
99. 
    
100. if __name__ == "__main__":
     
101.     print(generate({'device_platform': 'android', 'aid': '6383', 'count': '1'}))
     

复制代码