yml2213
1ef819b48d
做了什么
- 从「签到成功-1.har」提取该次会话的 tdc.js, 提取密钥解密出
errorCode=0 那次 collect 的完整明文 (1360 字节), 存为
tcaptcha/models/success_collect_template.b64
- 新增 generate_collect_success(): 以成功样本为结构模板, Python 只回填
轨迹/当前时间戳/随机盐, 其余环境字段 (canvas/WebGL/屏幕/语言/sd.ft) 原样保留
- 新增 _success_style_trajectory(): 按成功样本实测统计生成轨迹
(61 点, dt 均值 30.6ms, 50% 在 0~16ms, 途经 3 个目标, 驻留抖动)
—— 修正了统计正则不允许负增量的 bug (真实 61 点, 此前误数成 18)
- 发现成功样本用 \x00 填充 (不是空格), sd 多一个 ft 字段
- telemetry_mode=python_keyed 默认走该路径; Node 仅提取每构建 XTEA 密钥
- ANALYSIS.md 第七节重写为 v2 证据账本, 显式撤回 4 个无证据结论
验证
- 纯 Python 密文 == 真实 tdc.js 密文 (逐字节)
- 回归: test_xtea_key 11 项、test_glyph_solver 8/8
- 端到端 1ms 实测: 仍 errorCode=12 (诚实记录, 未解决)
结论(见 ANALYSIS.md 7.5-7.7)
- 12 不是"检测到机器人": 同 IP 有成功样本、参数逐字段一致、
真 Chrome 网络栈/真人点击/CDP 均排除
- 剩余假设: H1 需已登录业务会话(未用 auth_token 调 captcha/params 复测)
H3 需有效 qcloud.com cookie(过期 skey 复测不能定论)
- 下一步: 用登录态 auth_token 调 /api/v1/captcha/params,
对比返回是否多出鉴权字段 —— 这是唯一未做且成本低的关键实验
1 line
1.8 KiB
Plaintext
1 line
1.8 KiB
Plaintext
eyJjZCI6WzI1NjAsIk1hY0ludGVsIiwiR2dvQUFBQU5TVWhFVWdBQUFTd0FBQUNXQ0FZQUFBVGYzdjhiaCtyeVdjZlNCU0xrbU4zTjFQUWluUEw3QmkzVEcwcUUyQ29nQUFBQUJKUlU1RXJrSmdnZz09IiwiVVRGLTgiLDIsMCwwLDE1OTAyOTkxNzgsImh0dHBzOi8vMW1zLnJ1bi9jb25zb2xlL3BlcnNvbmFsL2JlbmVmaXRzL2NoZWNrLWluIiwiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTVfNykgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE1NS4wLjAuMCBTYWZhcmkvNTM3LjM2IiwwLDI0LFtdLCIiLDE0NDAsIkFOR0xFIChBcHBsZSwgQU5HTEUgTWV0YWwgUmVuZGVyZXI6IEFwcGxlIE00LCBVbnNwZWNpZmllZCBWZXJzaW9uKSIsMTAsIiswOCIsIkdvb2dsZSBJbmMuIChBcHBsZSkiLDE3OTE3MTU1MDEsICAgICAgICAgICAgICAgW1szMjMsNTksNjAxXSxbLTI3LDgsMTddLFstNSwxLDE4XSxbLTIsMSwxNl0sWy0yLDAsMThdLFswLDAsMTA0XSxbMCwwLDM0XSxbLTEsMSwxNF0sWy0zLDMsMTVdLFstMiwxLDE3XSxbLTEyLDEzLDE3XSxbLTEzLDE2LDE2XSxbLTExLDE1LDE4XSxbLTEzLDE0LDE2XSxbLTE0LDE0LDE2XSxbLTMsMywxN10sWy0zLDMsMTddLFswLDAsMTZdLFstMSwzLDE3XSxbMCwxLDE3XSxbLTEsMSwyMV0sWzAsMCwxNjJdLFswLDAsMTddLFswLDAsMTddLFswLDMsMTZdLFstMSwzLDE3XSxbLTEyLDIzLDE2XSxbLTUsOCwxN10sWy04LDEzLDE2XSxbLTIsMywxN10sWy0yLDUsMTddLFstMyw0LDE1XSxbLTIsNCwxN10sWy03LDcsMTZdLFstMTIsOSwzNV0sWy0xMCw0LDBdLFstNiwyLDE0XSxbLTEsMCwxN10sWy00LDEsMTddLFswLDAsMTZdLFstMSwwLDE4XSxbMCwwLDE2XSxbMCwwLDE3XSxbLTMsLTEsMTZdLFstMSwwLDI1XSxbLTYsLTEsOF0sWy0xLDAsMTddLFstNCwtMSwxNl0sWy01LDAsMTddLFstMiwwLDE4XSxbLTQsMCwxNl0sWy01LDAsMTddLFswLDAsMTZdLFstMywxLDE2XSxbLTEsMCwxOV0sWzAsMCwxNV0sWy0xLDAsMTddLFswLDAsMTddLFswLDAsMzNdLFswLDAsMThdLFsxLDEsMTJdXSAgICAgICAgLFsiemgtQ04iLCJ6aCIsImZyIiwiZGUiLCJlbiJdLDE3OTE3MTU1MDgsImh0dHBzOi8vdHVyaW5nLmNhcHRjaGEuZ3RpbWcuY29tLzEvdGVtcGxhdGUvZHJhZ19lbGUuaHRtbD9yYW5kPTE1MTk3MTM2MjQzNDciLDAsIjk4ayIsNjk5MTI5ODA1LDE3OTE3MDYzMjYsIjI1NjAtMTQ0MC0xMzQ1LTI0LSotKi18LSoiLDEsWzM2MCwzNjBdLCJpZnJhbWUiLDEwMjMsMSwiIiwwLDAsIiJdLCAgICAgICAgICAgICAgICAgICAgICAgInNkIjp7Im9kIjoiQyIsImZ0IjoicWZfN1BmX19IIn19 |