546 lines
22 KiB
Python
546 lines
22 KiB
Python
"""纯 HTTP 快手滑块验证码求解器（无浏览器）。
|
||
|
||
设计依据（out/captcha_net/js_08...deobf2.js 还原）:
|
||
- POST /rest/zt/captcha/sliding/config body={captchaSession: <key>} -> {captchaSn, bgPicUrl, cutPicUrl, bgPicWidth=686, bgPicHeight=400, cutPicWidth=122, cutPicHeight=122, disX=24, disY=122, verifyUrl2, ...}
|
||
- GET bgPic/cutPic?captchaSn=...
|
||
- 缺口: ddddocr slide_match(cut, bg) -> target_x (686 原生像素空间)
|
||
- verify payload u = {captchaSn, bgDisWidth, bgDisHeight, cutDisWidth, cutDisHeight, relativeX, relativeY, trajectory, gpuInfo, captchaExtraParam}
|
||
- verifyParam = base64(Jose.$encrypt(utf8(JSON.stringify(u)), KEY)) KEY=c7b645db-...
|
||
- POST <verifyUrl2> body={verifyParam} -> {result, captchaToken|...}
|
||
|
||
坐标关键点: 配置响应处理把所有 *Img 字段乘 scaleRatio(=containerWidth/bgPicWidth)。
|
||
服务端校验的是比例(relativeX/bgDisWidth == gap/686)，比例与 scale 无关，
|
||
故取 scaleRatio=1（全原生坐标）即可：bgDisWidth=686, relativeX=target_x+offset, relativeY=disY。
|
||
|
||
relativeX/relativeY/trajectory 取自 Vue 的 sliderImgX/sliderImgY/trajectory（原生空间）。
|
||
"""
|
||
from __future__ import annotations
|
||
|
||
import json
|
||
import math
|
||
import random
|
||
import subprocess
|
||
import sys
|
||
import time
|
||
from pathlib import Path
|
||
from typing import Any
|
||
from urllib.parse import quote
|
||
|
||
ROOT = Path(__file__).resolve().parent.parent
|
||
JOSE_JS = ROOT / "tools" / "jose_encrypt.js"
|
||
JOSE_RAW_JS = ROOT / "tools" / "jose_encrypt_raw.js" # form-encode 明文加密（不做 JSON 包装）
|
||
NODE = sys.executable if Path(sys.executable).name.lower().startswith("node") else "node"
|
||
|
||
# 三坐标空间（deobf2 JS + 浏览器 Jose.call hook 实测互证）：
|
||
# NATIVE 图像 686×400（ddddocr target_x、config bgPicWidth）
|
||
# DISPLAY CSS 316×184（浏览器 bgDisWidth/relativeX；APP WebView 控件布局常量，config 不返回）
|
||
# PHYSICAL DPR=3 948×552（浏览器 trajectory 终点 ~920）
|
||
# native→physical = (DISPLAY_BG_W/NATIVE_BG_W)*DPR = (316/686)*3 = 1.382
|
||
NATIVE_BG_W = 686
|
||
DISPLAY_BG_W = 316 # 浏览器 hook 实测的 WebView 控件 CSS 宽
|
||
DISPLAY_BG_H = 184
|
||
DISPLAY_REL_Y = 70 # 浏览器 relativeY 实测
|
||
DPR = 3
|
||
NATIVE_TO_PHYS = (DISPLAY_BG_W / NATIVE_BG_W) * DPR # ≈1.382
|
||
|
||
# verifyParam 明文字段固定序（deobf2 JS: .join("=")/.join("&") on encodeURIComponent）
|
||
_VERIFY_FIELD_ORDER = (
|
||
"captchaSn", "bgDisWidth", "bgDisHeight",
|
||
"cutDisWidth", "cutDisHeight",
|
||
"relativeX", "relativeY", "trajectory",
|
||
"gpuInfo", "captchaExtraParam",
|
||
)
|
||
|
||
CAPTCHA_HOST = "https://captcha.zt.kuaishou.com"
|
||
CONFIG_URL = CAPTCHA_HOST + "/rest/zt/captcha/sliding/config"
|
||
BGPIC_URL = CAPTCHA_HOST + "/rest/zt/captcha/sliding/bgPic"
|
||
CUTPIC_URL = CAPTCHA_HOST + "/rest/zt/captcha/sliding/cutPic"
|
||
|
||
# 关键: error_url 里的整数 key 不能直接喂给 /sliding/config（会 350004 session err）。
|
||
# APP 的 captcha.html 页面先走 JS 桥 /rest/wd/captcha/get，用 {type,uri,key} 换出
|
||
# 真正的 protobuf captchaSession blob（base64，前缀 "Cgp6dC5jYXB0Y2hh" = \n\x0a zt.captcha），
|
||
# 再拿 blob 去 config。纯 HTTP 必须复刻这一步。
|
||
MINT_HOST = "https://app.m.kuaishou.com"
|
||
MINT_URL = MINT_HOST + "/rest/wd/captcha/get"
|
||
DEFAULT_CAPTCHA_TYPE = 7
|
||
DEFAULT_LOGIN_URI = "/rest/nebula/user/login/mobileVerifyCode"
|
||
|
||
KEY = "c7b645db-65e8-401f-b38c-4c07c5fff247"
|
||
|
||
# 真机 OnePlus PJZ110 / Adreno 830 的 WebView WebGL 指纹（dumpsys SurfaceFlinger 实测）
|
||
GPU_INFO = {
|
||
"glRenderer": "Adreno (TM) 830",
|
||
"glVendor": "Qualcomm",
|
||
"unmaskRenderer": "Adreno (TM) 830",
|
||
"unmaskVendor": "Qualcomm",
|
||
}
|
||
|
||
MOBILE_UA = (
|
||
"Mozilla/5.0 (Linux; Android 16; PJZ110 Build/UKQ1.230917.001; wv) "
|
||
"AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/126.0.6478.134 "
|
||
"Mobile Safari/537.36"
|
||
)
|
||
|
||
|
||
def jose_encrypt(payload: dict[str, Any]) -> str:
|
||
"""调用 tools/jose_encrypt.js 把 payload 加密成 base64 verifyParam。"""
|
||
proc = subprocess.run(
|
||
[NODE, str(JOSE_JS), json.dumps(payload, ensure_ascii=False)],
|
||
capture_output=True,
|
||
text=True,
|
||
timeout=60,
|
||
cwd=str(ROOT),
|
||
)
|
||
if proc.returncode != 0:
|
||
raise RuntimeError(f"jose_encrypt 进程失败 rc={proc.returncode}: {proc.stderr.strip()}")
|
||
out = proc.stdout.strip()
|
||
if out.startswith("ERR:") or not out:
|
||
raise RuntimeError(f"jose_encrypt 错误: {out or '(空)'}")
|
||
return out
|
||
|
||
|
||
def _enc(v: Any) -> str:
|
||
"""form-encode 单值：dict/list 先 compact json.dumps，再 encodeURIComponent。
|
||
|
||
与浏览器 encodeURIComponent 一致：space→%20(非+)，|→%7C，,→%2C，
|
||
"→%22，:→%3A，{→%7B。gpuInfo/captchaExtraParam 传 dict，内层引号自动变 %22。
|
||
"""
|
||
s = (
|
||
json.dumps(v, ensure_ascii=False, separators=(",", ":"))
|
||
if isinstance(v, (dict, list))
|
||
else str(v)
|
||
)
|
||
return quote(s, safe="")
|
||
|
||
|
||
def jose_encrypt_form(fields: dict[str, Any]) -> str:
|
||
"""把 verify payload 按 10 字段固定序 form-encode 后喂 jose_encrypt_raw.js。
|
||
|
||
返回 base64 verifyParam。镜像 jose_encrypt()，但不做 JSON 包装——
|
||
明文是 `captchaSn=<enc>&bgDisWidth=<enc>&...&captchaExtraParam=<enc>`。
|
||
"""
|
||
missing = [k for k in _VERIFY_FIELD_ORDER if k not in fields]
|
||
if missing:
|
||
raise KeyError(f"verifyParam 缺字段: {missing}")
|
||
plaintext = "&".join(f"{k}={_enc(fields[k])}" for k in _VERIFY_FIELD_ORDER)
|
||
proc = subprocess.run(
|
||
[NODE, str(JOSE_RAW_JS), plaintext],
|
||
capture_output=True,
|
||
text=True,
|
||
timeout=60,
|
||
cwd=str(ROOT),
|
||
)
|
||
if proc.returncode != 0:
|
||
raise RuntimeError(f"jose_encrypt_raw rc={proc.returncode}: {proc.stderr.strip()}")
|
||
out = proc.stdout.strip()
|
||
if not out or out.startswith("ERR:"):
|
||
raise RuntimeError(f"jose_encrypt_raw 错误: {out or '(空)'}")
|
||
return out
|
||
|
||
|
||
def gap_target_x(bg_bytes: bytes, cut_bytes: bytes) -> int:
|
||
"""ddddocr 滑块缺口检测，返回缺口在 686 原生背景图里的 x。"""
|
||
import ddddocr
|
||
|
||
det = ddddocr.DdddOcr(det=False, ocr=False, show_ad=False)
|
||
res = det.slide_match(cut_bytes, bg_bytes)
|
||
tx = res.get("target_x")
|
||
if tx is None:
|
||
target = res.get("target") or [0]
|
||
tx = target[0] if target else 0
|
||
return int(tx)
|
||
|
||
|
||
def build_trajectory(
|
||
drag_distance: float,
|
||
*,
|
||
y: float = 0.0,
|
||
x0: float = 0.0,
|
||
seed: int | None = None,
|
||
) -> str:
|
||
"""拟人轨迹 -> "x|y|dt,x|y|dt,..."（dt 相对首样本）。
|
||
|
||
x 从 x0 到 x0+drag_distance（绝对指针 clientX 空间；浏览器实测终点 ~920 含按钮屏原点）。
|
||
余弦缓动 + 过冲回正 + 垂直抖动，对齐 captcha_assist._human_drag 的节奏。
|
||
"""
|
||
rnd = random.Random(seed)
|
||
steps = 44
|
||
total_ms = 820
|
||
peak = drag_distance + rnd.uniform(3.0, 9.0)
|
||
pts: list[list[float]] = []
|
||
t_cursor = rnd.randint(120, 260)
|
||
base = total_ms / steps
|
||
for i in range(1, steps + 1):
|
||
t = i / steps
|
||
ease = 0.5 * (1 - math.cos(math.pi * t))
|
||
x = x0 + peak * ease
|
||
yy = y + rnd.uniform(-2.0, 2.0)
|
||
t_cursor += int(base) + rnd.randint(0, 9)
|
||
pts.append([round(x, 2), round(yy, 2), t_cursor])
|
||
# 过冲后回正到 drag_distance
|
||
for j in range(1, 7):
|
||
t = j / 6
|
||
x = x0 + peak + (drag_distance - peak) * t
|
||
yy = y + rnd.uniform(-1.5, 1.5)
|
||
t_cursor += rnd.randint(14, 26)
|
||
pts.append([round(x, 2), round(yy, 2), t_cursor])
|
||
t_cursor += rnd.randint(90, 180)
|
||
pts.append([round(x0 + float(drag_distance), 2), round(y, 2), t_cursor])
|
||
|
||
base_t = pts[0][2]
|
||
return ",".join(f"{p[0]}|{p[1]}|{int(p[2] - base_t)}" for p in pts)
|
||
|
||
|
||
def captcha_extra_param() -> dict[str, Any]:
|
||
"""captchaExtraParam = merge(ua(), collectEnvInfo()) 的极简 Android 视图。
|
||
|
||
服务端对 captchaExtraParam 宽松（桌面 Chromium 也能 kSecretApiVerify result=1），
|
||
故给出与设备身份自洽的 Android WebView 环境即可。
|
||
"""
|
||
return {
|
||
"ua": MOBILE_UA,
|
||
"language": "zh-cn",
|
||
"platform": "Linux armv8l",
|
||
"devicePixelRatio": 3,
|
||
"screenWidth": 1080,
|
||
"screenHeight": 2376,
|
||
"colorDepth": 24,
|
||
"timezone": -480,
|
||
"hardwareConcurrency": 8,
|
||
"deviceMemory": 12,
|
||
"touchSupport": "1",
|
||
"mod": "OnePlus(PJZ110)",
|
||
"sys": "ANDROID_16",
|
||
"appver": "14.5.50.11631",
|
||
"kpn": "NEBULA",
|
||
}
|
||
|
||
|
||
def _new_session():
|
||
from curl_cffi import requests as cffi_requests
|
||
|
||
# captcha.zt.kuaishou.com 服务于 APP 内 WebView（Chrome/126 系 TLS），
|
||
# 不需要登录链路的 OkHttp4 指纹。impersonate=chrome120 匹配 UA 的 JA3。
|
||
sess = cffi_requests.Session(impersonate="chrome120")
|
||
sess.headers.update(
|
||
{
|
||
"User-Agent": MOBILE_UA,
|
||
"Referer": "https://app.m.kuaishou.com/",
|
||
"Origin": "https://app.m.kuaishou.com",
|
||
"Accept-Language": "zh-CN,zh;q=0.9",
|
||
}
|
||
)
|
||
return sess
|
||
|
||
|
||
def _device_session(profile_path: str | None = None, verbose: bool = False):
|
||
"""带设备 cookie 的 session（mint 需要 did/egid）。
|
||
|
||
复用 core.captcha_assist.sync_browser_cookies 把 build_captcha_browser_cookies(profile)
|
||
灌进 curl_cffi session；domain=.kuaishou.com 同时覆盖 captcha.zt 与 mint 主机 app.m。
|
||
默认加载 out/devices/device_001.json（可复现）。
|
||
"""
|
||
if str(ROOT) not in sys.path:
|
||
sys.path.insert(0, str(ROOT))
|
||
from core.captcha_assist import build_captcha_browser_cookies, sync_browser_cookies
|
||
from core.device_profile import DeviceProfileGenerator, load_device_profile
|
||
|
||
sess = _new_session()
|
||
default_profile = ROOT / "out" / "devices" / "device_001.json"
|
||
path = profile_path or str(default_profile)
|
||
profile = load_device_profile(path) if Path(path).is_file() else DeviceProfileGenerator().new_profile()
|
||
n = sync_browser_cookies(sess, build_captcha_browser_cookies(profile))
|
||
if verbose:
|
||
print(f"[solver] 注入 {n} 个设备 cookie did={getattr(profile, 'did', '?')}", flush=True)
|
||
return sess, profile
|
||
|
||
|
||
def _is_blob(s: str) -> bool:
|
||
"""protobuf captchaSession blob 的 base64 固定前缀（field1="zt.captcha"）。"""
|
||
return s.startswith("Cgp6dC5jYXB0Y2hh")
|
||
|
||
|
||
def _safe_json(resp: Any) -> tuple[dict | None, str]:
|
||
"""安全解析 JSON 响应。非 dict（如耗尽 key 返字面 "result:501" 字符串）→ (None, raw)。"""
|
||
try:
|
||
obj = resp.json()
|
||
except Exception:
|
||
return None, (resp.text or "")[:300]
|
||
if not isinstance(obj, dict):
|
||
return None, repr(obj)[:300]
|
||
return obj, ""
|
||
|
||
|
||
def mint_captcha_session(
|
||
session: Any,
|
||
key: str,
|
||
*,
|
||
uri: str = DEFAULT_LOGIN_URI,
|
||
captchatype: int = DEFAULT_CAPTCHA_TYPE,
|
||
) -> tuple[str, str]:
|
||
"""把 error_url 的整数 key 换成 protobuf captchaSession blob。
|
||
|
||
复刻 APP captcha.html 页面的 `/rest/wd/captcha/get` 调用（application/json）。
|
||
返回 (captchaSession_blob, config_url)。
|
||
"""
|
||
m = session.post(
|
||
MINT_URL,
|
||
json={"type": captchatype, "uri": uri, "key": key},
|
||
headers={"Content-Type": "application/json; charset=utf-8"},
|
||
timeout=15,
|
||
)
|
||
mj, raw = _safe_json(m)
|
||
if mj is None:
|
||
raise RuntimeError(f"mint 非 dict/无效响应: {raw}")
|
||
if mj.get("result") != 1 or not mj.get("data"):
|
||
raise RuntimeError(f"mint /rest/wd/captcha/get 失败 result={mj.get('result')} desc={mj.get('desc')}")
|
||
d_raw = mj["data"]
|
||
try:
|
||
d = json.loads(d_raw) if isinstance(d_raw, str) else d_raw
|
||
except Exception:
|
||
raise RuntimeError(f"mint data 不可解析: {repr(str(d_raw)[:200])}")
|
||
if not isinstance(d, dict) or not d.get("captchaSession"):
|
||
raise RuntimeError(f"mint 无 captchaSession: {repr(str(d)[:200])}")
|
||
return d["captchaSession"], d.get("url") or CONFIG_URL
|
||
|
||
|
||
def solve_captcha(
|
||
session: Any | None = None,
|
||
captcha_session: str = "",
|
||
*,
|
||
error_url: str = "",
|
||
uri: str = DEFAULT_LOGIN_URI,
|
||
captchatype: int = DEFAULT_CAPTCHA_TYPE,
|
||
offset: int = -48,
|
||
geom_space: str = "display",
|
||
traj_scale: float = NATIVE_TO_PHYS,
|
||
traj_y: float = 0.0,
|
||
traj_x_base: float = 0.0,
|
||
verbose: bool = True,
|
||
) -> dict[str, Any]:
|
||
"""对一个 captcha key/error_url/blob 跑完整纯 HTTP 流程，返回诊断 dict。
|
||
|
||
captcha_session 可为: error_url 里的整数 key、完整 error_url、或已 mint 出的 blob。
|
||
整数 key 会先经 /rest/wd/captcha/get 换成 blob（复刻 APP captcha.html 的桥调用）。
|
||
|
||
session 可空（自建匿名 session）；正式接入登录时传入【与登录同一个】
|
||
curl_cffi session，使 captcha token 与登录设备身份(did/egid cookies)绑定。
|
||
"""
|
||
own_session = session is None
|
||
if own_session:
|
||
session, _profile = _device_session(verbose=verbose)
|
||
if error_url:
|
||
from urllib.parse import parse_qs, urlsplit
|
||
|
||
qs = parse_qs(urlsplit(error_url).query)
|
||
if not captcha_session:
|
||
captcha_session = (qs.get("key") or qs.get("captchaSession") or [""])[0]
|
||
if qs.get("type"):
|
||
captchatype = int(qs["type"][0])
|
||
if qs.get("uri"):
|
||
uri = qs["uri"][0]
|
||
if not captcha_session:
|
||
return {"ok": False, "stage": "input", "error": "缺少 captchaSession/key"}
|
||
|
||
def log(msg: str) -> None:
|
||
if verbose:
|
||
print(f"[solver] {msg}", flush=True)
|
||
|
||
try:
|
||
# 0) 整数 key -> protobuf blob（若已是 blob 则跳过）
|
||
if _is_blob(captcha_session):
|
||
cfg_url = CONFIG_URL
|
||
else:
|
||
log(f"mint key->blob type={captchatype} uri={uri}")
|
||
captcha_session, cfg_url = mint_captcha_session(
|
||
session, captcha_session, uri=uri, captchatype=captchatype
|
||
)
|
||
log(f"mint ok blob[:32]={captcha_session[:32]}...")
|
||
|
||
# 1) config
|
||
log(f"POST config captchaSession={captcha_session[:24]}...")
|
||
cfg_r = session.post(
|
||
cfg_url,
|
||
data={"captchaSession": captcha_session},
|
||
headers={"Content-Type": "application/x-www-form-urlencoded"},
|
||
timeout=15,
|
||
)
|
||
cfg, cfg_raw = _safe_json(cfg_r)
|
||
if cfg is None:
|
||
return {"ok": False, "stage": "config", "status": cfg_r.status_code, "body": cfg_raw}
|
||
log(f"config result={cfg.get('result')} desc={cfg.get('desc')}")
|
||
if cfg.get("result") != 1:
|
||
return {"ok": False, "stage": "config", "raw": cfg}
|
||
|
||
sn = cfg["captchaSn"]
|
||
bg_w = int(cfg.get("bgPicWidth") or 686)
|
||
bg_h = int(cfg.get("bgPicHeight") or 400)
|
||
cut_w = int(cfg.get("cutPicWidth") or 122)
|
||
cut_h = int(cfg.get("cutPicHeight") or 122)
|
||
dis_x = int(cfg.get("disX") or 24)
|
||
dis_y = int(cfg.get("disY") or 122)
|
||
verify_url2 = cfg.get("verifyUrl2") or (CAPTCHA_HOST + "/rest/zt/captcha/sliding/kSecretApiVerify")
|
||
bg_url = (cfg.get("bgPicUrl") or BGPIC_URL) + f"?captchaSn={sn}"
|
||
cut_url = (cfg.get("cutPicUrl") or CUTPIC_URL) + f"?captchaSn={sn}"
|
||
|
||
# 2) bg/cut bytes
|
||
bg = session.get(bg_url, timeout=15).content
|
||
cut = session.get(cut_url, timeout=15).content
|
||
log(f"bg={len(bg)}B cut={len(cut)}B")
|
||
|
||
# 3) gap (原生 686 空间)
|
||
target_x = gap_target_x(bg, cut)
|
||
gap_native = target_x + offset # 缺口在原生图里的 x（已含 ddddocr 右偏修正）
|
||
log(f"target_x={target_x} offset={offset} gap_native={gap_native} geom={geom_space} traj_scale={traj_scale:.3f}")
|
||
|
||
# 4) 几何空间 + trajectory 空间（浏览器实测：几何 DISPLAY，trajectory PHYSICAL，混合空间）
|
||
if geom_space == "display":
|
||
scale_d = DISPLAY_BG_W / NATIVE_BG_W # 0.4606
|
||
payload_bg_w, payload_bg_h = DISPLAY_BG_W, DISPLAY_BG_H
|
||
relative_x = round(gap_native * scale_d)
|
||
relative_y = DISPLAY_REL_Y
|
||
cut_dw, cut_dh = int(cut_w * scale_d), int(cut_h * scale_d)
|
||
else: # native（control，旧全原生行为）
|
||
payload_bg_w, payload_bg_h = bg_w, bg_h
|
||
relative_x = gap_native
|
||
relative_y = dis_y
|
||
cut_dw, cut_dh = cut_w, cut_h
|
||
# trajectory 在物理像素空间：drag_native × traj_scale（默认 1.382）
|
||
drag_native = gap_native - dis_x
|
||
drag_physical = drag_native * traj_scale
|
||
trajectory = build_trajectory(drag_physical, y=traj_y, x0=traj_x_base, seed=int(time.time()) & 0xFFFF)
|
||
|
||
# 5) captchaExtraParam = key1-39, 含拖拽相关传感器(合成, 与 trajectory 时间相关)
|
||
try:
|
||
from captcha_env import build_captcha_extra_param
|
||
except ImportError:
|
||
from tools.captcha_env import build_captcha_extra_param
|
||
extra_param = build_captcha_extra_param(
|
||
drag_physical=drag_physical,
|
||
slider_x=traj_x_base,
|
||
slider_y=float(dis_y) * (NATIVE_TO_PHYS if geom_space == "display" else 1.0) + 720.0,
|
||
duration_ms=820.0,
|
||
seed=int(time.time()) & 0xFFFF,
|
||
)
|
||
|
||
# 6) payload — gpuInfo/captchaExtraParam 传 dict（jose_encrypt_form 内部 compact json + form-encode）
|
||
payload = {
|
||
"captchaSn": sn,
|
||
"bgDisWidth": payload_bg_w,
|
||
"bgDisHeight": payload_bg_h,
|
||
"cutDisWidth": cut_dw,
|
||
"cutDisHeight": cut_dh,
|
||
"relativeX": relative_x,
|
||
"relativeY": relative_y,
|
||
"trajectory": trajectory,
|
||
"gpuInfo": GPU_INFO,
|
||
"captchaExtraParam": extra_param,
|
||
}
|
||
log(f"payload geom={geom_space} relX={relative_x} drag_native={drag_native} drag_phys={drag_physical:.1f}")
|
||
|
||
# 6) encrypt（form-encode 明文，非 JSON）
|
||
verify_param = jose_encrypt_form(payload)
|
||
log(f"verifyParam len={len(verify_param)}")
|
||
|
||
# 7) verify (inner iframe: axios.post(url,{verifyParam},{Content-Type:application/json}))
|
||
verify_r = session.post(
|
||
verify_url2,
|
||
json={"verifyParam": verify_param},
|
||
headers={"Content-Type": "application/json"},
|
||
timeout=15,
|
||
)
|
||
vj, vj_raw = _safe_json(verify_r)
|
||
if vj is None:
|
||
vj = {"_text": vj_raw}
|
||
log(f"verify status={verify_r.status_code} body={str(vj)[:200]}")
|
||
|
||
# result==1 且含 captchaToken 才算成功
|
||
token = ""
|
||
if isinstance(vj, dict):
|
||
token = str(vj.get("captchaToken") or vj.get("token") or "")
|
||
return {
|
||
"ok": isinstance(vj, dict) and vj.get("result") == 1 and bool(token),
|
||
"stage": "verify",
|
||
"result": vj.get("result") if isinstance(vj, dict) else None,
|
||
"captcha_token": token,
|
||
"target_x": target_x,
|
||
"relativeX": relative_x,
|
||
"verifyParam": verify_param,
|
||
"raw": vj,
|
||
}
|
||
finally:
|
||
if own_session:
|
||
try:
|
||
session.close()
|
||
except Exception:
|
||
pass
|
||
|
||
|
||
def _default_session() -> str:
|
||
"""error_url 的整数 key（dummy-code submit 免 SMS 回收），可反复 mint。"""
|
||
return "-7707052661950021982"
|
||
|
||
|
||
def sweep_solve(
|
||
key: str,
|
||
*,
|
||
session: Any | None = None,
|
||
offsets: tuple[int, ...] = (-60, -48, -36, -24, -12, 0),
|
||
traj_scales: tuple[float, ...] = (NATIVE_TO_PHYS, 1.0, 3.0),
|
||
geom_space: str = "display",
|
||
uri: str = DEFAULT_LOGIN_URI,
|
||
captchatype: int = DEFAULT_CAPTCHA_TYPE,
|
||
stop_on_success: bool = True,
|
||
verbose: bool = True,
|
||
) -> list[dict[str, Any]]:
|
||
"""对一个 key 扫描 (offset, traj_scale) 网格，找返回 result=1 的 cell（350002 调参）。
|
||
|
||
一个设备 cookie session 复用所有 cell；每次 solve_captcha 内部重 mint 新
|
||
captchaSession（captchaSn 是否单用未知，保守重 mint；offset 是 ddddocr 系统性
|
||
右偏的每图常量修正，会跨图泛化）。
|
||
"""
|
||
own_session = session is None
|
||
if own_session:
|
||
session, _profile = _device_session(verbose=verbose)
|
||
results: list[dict[str, Any]] = []
|
||
try:
|
||
for traj_scale in traj_scales:
|
||
for off in offsets:
|
||
res = solve_captcha(
|
||
session, key,
|
||
offset=off, traj_scale=traj_scale, geom_space=geom_space,
|
||
uri=uri, captchatype=captchatype, verbose=verbose,
|
||
)
|
||
cell = {
|
||
"offset": off, "traj_scale": round(traj_scale, 3), "geom": geom_space,
|
||
"ok": res.get("ok"), "result": res.get("result"),
|
||
"stage": res.get("stage"), "target_x": res.get("target_x"),
|
||
"token": (res.get("captcha_token") or "")[:16],
|
||
}
|
||
results.append(cell)
|
||
print(f"[sweep] off={off:+d} scale={traj_scale:.3f} geom={geom_space} "
|
||
f"-> result={cell['result']} stage={cell['stage']}", flush=True)
|
||
if cell["ok"] and stop_on_success:
|
||
print(f"[sweep] ✅ 命中 off={off:+d} scale={traj_scale:.3f}", flush=True)
|
||
return results
|
||
finally:
|
||
if own_session:
|
||
try:
|
||
session.close()
|
||
except Exception:
|
||
pass
|
||
return results
|
||
|
||
|
||
if __name__ == "__main__":
|
||
args = sys.argv[1:]
|
||
sweep = "--sweep" in args
|
||
positional = [a for a in args if a != "--sweep"]
|
||
key = positional[0] if positional else _default_session()
|
||
if sweep:
|
||
rows = sweep_solve(key, verbose=True)
|
||
print(json.dumps(rows, ensure_ascii=False, indent=2))
|
||
else:
|
||
res = solve_captcha(captcha_session=key, verbose=True)
|
||
print(json.dumps(res, ensure_ascii=False, indent=2))
|