网易易盾滑动验证码破解(补充篇)

网易易盾破解补充篇

之前写了两篇易盾破解的文章,分别讲了fp、cb、data等参数的破解,以及额外的图像识别,但是实际上整个破解过程并不完整,我在文章中有提到watchman这块没有破解,这篇文章对此进行补充。

acToken

我在之前的文章中一直把acToken参数当做定值来处理的,但是实际上其并不是定值,我们先来看下其生成过程,点击check请求的调用栈(get请求是没有acToken参数的)

跳转到下面这里

然后在这行前面打上断点,滑动图片进行验证,可以看到右边的调用栈,这里不断去找acToken的源头(不细讲了,需要耐心),大概在我右边框的红框这个请求中,无法再进行上溯,找到的地方是这样的:

这里t._arg就是acToken的值,往上看一点,关键就是这个e的值,然后我们在这里打上断点(如图所示),注意这里要清除缓存,然后再滑动验证码定位在断点处

当看到e的值为acToken的值时,看右边的调用栈,不断寻找值的来源,在我右边红框的请求位置可以看到其跳入了watchman.min.js,位置内容是这样的

1
2
3
4
bc({
C: t,
ka: x
})

这个就是acToken,你可以在console中运行这段代码验证。

这些方法的名称不要过于纠结,这些名称是随机生成的,有可能每次调试都不一样

那么我们接下来的重点就放到watchman文件了,前面的断点可以全部清除,在这里打上新的断点调试,然后点进bc方法来分析一下:

bc方法有一个参数a,a有两个属性Cka,其中ka=false;再往下重新定义了一个a,包含三个属性,前面说了bc方法执行完的结果就是acToken的值,那么这里的返回值应该就是acToken的值,即

1
La(JSON[b[392]](a))

b[392]就是stringify,所以这里真正做的就是

1
2
3
4
5
6
var a = {
"r": 1,
"d": da().k(qa),
"b": 传入参数的C属性
}
La(JSON["stringify"](a))

于是存在三个问题,一个是传入参数的C属性哪里来?二是da().k(qa)运行结果是啥?三是La方法做了哪些操作。

这里La方法就进去扣就完事了,直接贴出来:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
var b = ["callPhantom", "floor", "__driver_unwrapped", "beta", "on", "RENDERER", "src", "DevalVRXCtrl.DevalVRXCtrl.1", "globalCompositeOperation", "addBehavior", " ", "spawn", "HIGH_INT", "rangeMax", "batteryInterval", "CAT_WEBGL", "(function(){return 123;})();", "20030107", "stringify", "compatMode", "Windows Phone", "isPrototypeOf", "extensions:", "🧥🐶🍏⚽️✂🈲🚗⌚️❤️🏁▶", " is not a function", "NEWatchmanError", "00000000", "removeChild", "webgl aliased line width range:", "webgl max texture size:", "webgl vertex shader low int precision rangeMax:", "useProgram", "domAutomation", "hostname", "XDomainRequest", "Watchman", "requestStart", "phantom.injectJs", "clearTimeout", "ERROR", "touchend", "state", "webgl max anisotropy:", "ShockwaveFlash.ShockwaveFlash", "height", "webgl vertex shader medium int precision rangeMin:", "EXT_texture_filter_anisotropic", "/v2/collect", "AgControl.AgControl", "touchmove", "d73f85d653b74a259fe620aac656670b", "decodeURI", "clientHeight", "Firefox", "input", "123", "__webdriver_script_func", "WMPlayer.OCX", "72px", "webgl vertex shader low float precision:", "propertyIsEnumerable", "safari", "onreadystatechange", "behavior api response wrong", "document", "dns_city", "webgl fragment shader high float precision rangeMax:", "deviceorientation", "-9999px", "userLanguage", "businessKey is illegal", "pointermove", "arc", "SHADING_LANGUAGE_VERSION", "min", "attack", "LOW_FLOAT", "sessionStorage", "Object prototype may only be an Object: ", "compileShader", "iframe", "escape", "mspointermove", "systemLanguage", "languages", "Skype.Detection", "2d", "ActiveXObject", "absolute", "offsetHeight", "STRING", "XMLHttpRequest", "The server has encountered an error", "colorDepth", "open", "gamma", "domain=", "webgl vertex shader medium float precision rangeMin:", "ratio", "Other", "RealVideo.RealVideo(tm) ActiveX Control (32-bit)", "OfflineAudioContext", "webgl blue bits:", "navigator", "mspointerdown", "#f60", "webgl fragment shader medium int precision:", "isNaN", "fillRect", "frequency", "loaded", "encodeURI", "attachEvent", "webgl max vertex texture image units:", "MAX_VERTEX_TEXTURE_IMAGE_UNITS", "2.7.1_7c08033d", "up", "webgl fragment shader high int precision rangeMax:", "device api response wrong", "createProgram", "GREEN_BITS", "isTrusted", "pageXOffset", "NUMBER", "innerHeight", "monospace", "clientY", "clientX", "constructor", "STATIC_DRAW", "productSub", "BOOLEAN", "opr", "MAX_TEXTURE_IMAGE_UNITS", "abort", "dAWsBhCqtOaNLLJ25hBzWbqWXwiK99Wd", "dns_province", "webgl aliased point size range:", "uniformOffset", "encodeURIComponent", "toLocaleString", "documentElement", "bindBuffer", "onerror", "string", "MEDIUM_FLOAT", "responseEnd", "MAX_COMBINED_TEXTURE_IMAGE_UNITS", "localStorage", "android", "canvas fp:", "destination", "description", "indexedDB", "createBuffer", "__driver_evaluate", "linkProgram", "button", "linux", "createShader", "Chrome", "normal", "webgl stencil bits:", "trident", "yes", "SWCtl.SWCtl", "Reduce of empty array with no initial value", "valueOf", "webgl vertex shader medium float precision:", "start", "WoeTpXnDDPhiAvsJUUIY3RdAo2PKaVwi", "createOscillator", "Does not support CORS", "detachEvent", "target", "parseInt", "gbk", "getUniformLocation", "WM_CONFIG", "\\((.+)\\)$", "shaderSource", "location", "HEX", "window", "initNEWatchman", "disconnect", "appVersion", "mousemove", "type", "webgl fragment shader medium float precision rangeMin:", "webgl vertex shader high int precision rangeMin:", "enableVertexAttribArray", "javaEnabled", "oscpu", "webgl fragment shader medium int precision rangeMax:", "options", "webgl vertex shader low float precision rangeMax:", "MAX_VARYING_VECTORS", "WM_NIKE", "openDatabase", "getParameter", "Buffer", "STENCIL_BITS", "canvas", "HIGH_FLOAT", "webgl vertex shader low int precision rangeMin:", ": ", "scroll", "batteryMax", "WM_NI", "DEPTH_BUFFER_BIT", "createDynamicsCompressor", "iphone", "webgl fragment shader low float precision:", "ip_province", "__selenium_evaluate", "Msxml2.XMLHTTP", "/v3/b", "pageYOffset", "GET", "style", "depthFunc", "Opera", "Can not find configuration", "::", "parseFloat", "webgl fragment shader low float precision rangeMin:", "getAttribLocation", "utf8", "webgl unmasked renderer:", "triangle", "unknown", "undefined", "\\.", "WM_DIV", "WM_TID", "event", "getExtension", "cache_", "offsetWidth", "userAgent", "QuickTime.QuickTime", "JSCookie", "experimental-webgl", "dischargingTime", "__nightmare", "ARRAY_BUFFER", "MEDIUM_INT", "request resource error", "withCredentials", "ip_city", "=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/", "Missing business key", "width", "webgl max fragment uniform vectors:", "VERSION", "TDCCtl.TDCCtl", "self", "lineHeight", "Sequentum", "span", "msg", "innerHTML", "cookieEnabled", "rhino", "firefox", "threshold", "appCodeName", "Netscape", "bb99db1_7", "bb99db1_6", "bb99db1_5", "protocol", "fontFamily", "bb99db1_4", "webgl max texture image units:", "bb99db1_9", "://", "scrollLeft", "bb99db1_3", "bb99db1_2", "bb99db1_1", "__fxdriver_evaluate", "[object Function]", "timing", "toSource", "CAT_FONTS", "Cwm fjordbank glyphs vext quiz, 😅😥👶😃🧥🐶🍏⚽️✂🈲🚗⌚️❤️🏁▶", "WM_DID", "application/x-www-form-urlencoded", "Response is empty", "0123456789abcdef", "sans-serif", "webgl max combined texture image units:", "webgl vertex shader high float precision rangeMin:", "history", "webgl vertex shader medium float precision rangeMax:", "webgl fragment shader high int precision rangeMin:", "scrollTop", "webgl vertex shader high int precision:", "FRAGMENT_SHADER", "ipad", "rgba(102, 204, 0, 0.2)", "MacromediaFlashPaper.MacromediaFlashPaper", "send", "domAutomationController", "screenX", "?&", "ALIASED_LINE_WIDTH_RANGE", "renderedBuffer", "Failed to load script(", "platform", "CSS1Compat", "clearColor", "getAttribute", "array", "setInterval", "This browser's implementation of Object.create is a shim and doesn't support a second argument.", "createEvent", "getBattery", "webgl vertex shader high int precision rangeMax:", "value", "win", "vertexAttribPointer", "__webdriver_script_function", "srcElement", "textBaseline", "#069", "__", "move", "orientation", "motion", "phantomjs", "__selenium_unwrapped", "match", "charging", "unescape", "responseStart", "LEQUAL", "webgl vertex shader low float precision rangeMin:", "Date", "decodeURIComponent", "async", "performance", "boolean", "inline", "32288785", "serif", "VENDOR", "CAT_CANVAS", "reduction", "emit", "getContext", "uniform2f", "webgl alpha bits:"]
var a = [64,13,29,43,7,23,11,90,43,92,37,0,75,56,94,79,0,2,1423857449,-2,1873313359,3,-3,1555261956,4,2847714899,-1444681467,-4,-1732584194,5,1163531501,-5,2714866558,1281953886,6,-6,198958881,1141124467,2970347812,7,-198630844,-7,3110523913,8,-8,2428444049,1272893353,9,-722521979,-9,10,-10,11,-11,2563907772,-12,12,2282248934,13,-13,2154129355,14,-14,15,-15,16,-16,17,-17,-18,18,-701558691,-19,19,20,-20,21,-21,22,-22,23,-23,24,-24,25,-25,-26,26,27,-27,28,-28,-29,29,30,-30,31,-31,32,33,-33,-32,-34,34,35,-35,37,-37,36,-36,39,-38,-39,38,40,41,-40,-41,-176418897,-43,42,-42,43,45,44,-44,-45,-47,-46,47,46,48,-49,49,-48,50,-50,51,-51,570562233,-52,-53,53,52,54,-54,55,-55,503444072,-57,56,57,-56,59,-58,58,-59,60,-60,61,-61,63,62,-63,-62,65,64,711928724,-65,-67,-64,67,-66,66,-70,71,70,68,-69,-68,-71,69,73,3686517206,75,-75,-74,72,74,-73,-72,77,-78,-79,78,-76,76,-77,79,3554079995,-82,81,83,-81,-83,80,82,-80,-85,86,87,-84,85,-87,-86,84,-91,-88,88,91,-89,90,89,-90,94,-95,92,-92,-93,93,95,-94,96,-99,99,-98,97,-97,-96,98,1735328473,3272380065,100,101,-103,103,-101,-102,102,-100,-107,107,105,106,104,-105,-106,-104,110,-109,-108,109,-110,-111,111,108,251722036,-115,114,-114,-112,115,112,113,-113,-119,118,-118,119,116,-117,-116,117,123,-122,122,121,-120,-121,120,-123,125,127,3412177804,-127,124,-125,-124,-126,126,-128,128,-129,130,1843258603,150,3803740692,984961486,3939845945,44100,4195302755,200,201,202,203,206,207,208,209,210,211,212,213,214,215,216,217,218,221,222,223,225,228,229,230,231,232,233,234,235,236,237,238,239,4066508878,240,241,242,243,255,1706088902,256,300,327,1969922972,2097651377,1291169091,376229701,400,401,402,403,404,405,606105819,420,450,451,470,853044451,500,512,701,702,703,707,704,705,706,708,709,710,711,712,713,752459403,800,801,802,803,804,658871167,1000,426522225,1236535329,3772115230,615818150,3904427059,4167216745,4027552580,2000,3654703836,1886057615,-145523070,879679996,3518719985,3000,3244367275,2013776290,3373015174,1390208809,4500,-1019803690,5000,1759359992,285281116,1622183637,1006888145,1231636301,10000,83908371,-155497632,1090812512,1732584193,2463272603,1373503546,2596254646,2321926636,1504918807,2181625025,2882616665,2747007092,-271733879,3009837614,60000,3138078467,-30611744,-2054922799,-1502002290,-42063,397917763,81470997,829329135,2657392035,956543938,2517215374,2262029012,40735498,2394877945,702138776,2808555105,38016083,2936675148,1258607687,1131014506,3218104598,3082640443,1404277552,-1926607734,565507253,4283543511,534414190,1541320221,1913087877,2053790376,-660478335,1789927666,3965973030,3826175755,4107580753,4240017532,1804603682,1658658271,3579855332,-1416354905,3708648649,3453421203,-358537222,3317316542,-1560198380,-1473231341,1873836001,1742555852,3608007406,1996959894,3747672003,-1990404162,-995338651,3485111705,2137656763,-2022574463,3352799412,213261112,3993919788,1.01,3865271297,4139329115,4275313526,-405537848,-1094730640,1549556828,282753626,1068828381,909522486,2768942443,2909243462,936918000,-1044525330,3183342108,141376813,3050360625,654459306,2617837225,1454621731,271733878,2489596804,76029189,2227061214,1591671054,2362670323,4294967296,4294967295,-40341101,1308918612,795835527,1181335161,414664567,4279200368,1661365465,1839030562,1037604311,4150417245,3887607047,1802195444,4023717930,2075208622,-165796510,1943803523,901097722,568446438,628085408,755167117,3322730930,3462522015,3736837829,3604390888,2366115317,-187363961,0.4,2238001368,2512341634,2647816111,-1120210379,-0.2,314042704,1510334235,-1069501632,1382605366,31158534,450548861,643717713,3020668471,1119000684,3160834842,2898065728,1256170817,2765210733,3060149565,3188396048,2932959818,124634137,2797360999,-373897302,-1894986606,-1530992060,366619977,62317068,-0.26,1200080426,1202900863,498536548,1340076626,1126891415,2405801727,-1051523,2265490386,1594198024,1466479909,2547177864,249268274,2680153253,2125561021,3294710456,855842277,3423369109,0.732134444,3705015759,3569037538,1994146192,-45705983,1711684554,1852507879,997073096,-421815835,289559509,733239954,4251122042,601450431,4111451223,167816743,3855990285,3981806797,3988292384,3369554304,3233442989,3495958263,3624741850,65535,453092731,-0.9,2094854071,1957810842,325883990,4057260610,1684777152,4189708143,3915621685,162941995,1812370925,3775830040,783551873,3134207493,1172266101,2998733608,2724688242,1303535960,2852801631,112637215,1567103746,444984403,651767980,1426400815,-1958414417,-51403784,-680876936,906185462,2211677639,1047427035,-57434055,2344532202,2607071920,681279174,2466906013,225274430,544179635,2176718541,2312317920,1483230225,1342533948,2567524794,2439277719,1088359270,1309151649,671266974,-343485551,1219638859,718787259,953729732,2277735313,3099436303,2966460450,817233897,2685067896,2825379669,-35309556,4089016648,530742520,4224994405,3943577151,3814918930,1700485571,0.25,-640364487,476864866,944331445,1634467795,335633487,1762050814,-378558,-1,1,2044508324,3401237130,3268935591,3524101629,3663771856,1770035416,1907459465,-389564586,3301882366]
var c = ["","parent","stack","plugins","getItem","getNdInfo","iOS","Microsoft Internet Explorer","mouseup","getSupportedExtensions","_battery","appendChild","evenodd","webgl max vertex uniform vectors:","\"","innerText","$","%","&","adsbox","'","(",")","rgb(255,255,0)","getShaderPrecisionFormat","textContent","+",",","iOs","windvane","version","click",".","_blur","/","18pt Arial","0","1","2","getChannelData","3","getContextAttributes","4","_focus","stop","5","left","6","7","domain","8","9",":",";","=","mousedown","object","?","webgl fragment shader medium float precision rangeMax:","__fxdriver_unwrapped","A","B","nstool.netease.com/info.js","MAX_VERTEX_ATTRIBS","C","D","E","F","G","H","webgl fragment shader medium int precision rangeMin:","I","blur","J","K","appMinorVersion","L","M","N","O","P","Q","R","Cwm fjordbank glyphs vext quiz, 😅😥👶😃","S","selenium","T","U","dns_isp","V","W","X","Y","LOW_INT","Z","[","fetchStart","getElementsByTagName","]","connect","^","cb","a","COLOR_BUFFER_BIT","b","__webdriver_script_fn","c","rmocx.RealPlayer G2 Control.1","d","Scripting.Dictionary","e","beginPath","couchjs","f","g","h","1010","i","j","k","webgl fragment shader low float precision rangeMax:","l","m","webgl version:","n","o","p","doNotTrack","q","chargingtimechange","setTimeout","r","1005","getTimezoneOffset","changedTouches","s","webgl fragment shader low int precision rangeMax:","t","1003","u","v","1001","w","x","This browser's implementation of Object.create is a shim and doesn't support 'null' as the first argument.","drawArrays","y","toString","z","~","1009","font","webgl fragment shader low int precision:","suffixes","POST","Shell.UIHelper","setRequestHeader","toDataURL","Safari","TouchEvent","language","down","insertBefore","div","acceleration","accelerationIncludingGravity","7c08033d","Internet Explorer","MAX_CUBE_MAP_TEXTURE_SIZE","text/javascript","webgl vertex shader high float precision:","webgl vertex shader high float precision rangeMax:","webdriver","MOZ_EXT_texture_filter_anisotropic","WEBGL_debug_renderer_info","chargingchange","webgl shading language version:","res","RealPlayer","chrome","RegExp","chargingTime","createElement","productNumber","parentNode","Array.prototype.reduce called on null or undefined","webgl fragment shader medium float precision:","webgl max varying vectors:","canvas winding:","rgb(255,0,255)","Content-type","DEPTH_TEST","external","eval","unknown error","Linux","dischargingtimechange","_scroll","QuickTimeCheckObject.QuickTimeCheck.1","7,0,1,d,7,3,7,3","Request timed out","removeItem","attachShader","webgl renderer:","startRendering","getTime","callSelenium","responseText","rangeMin","initWatchman","request api error","1.01","webgl depth bits:","nodejs","webgl max cube map texture size:","title","/v3/d","__wmjsonp_","devicePixelRatio","pointerup","random","setAttribute","_selenium","memoryStorage","fp_","alpha","webgl vendor:","__webdriver_evaluate","multiply","attribute vec2 attrVertexvarying vec2 varyinTexCoordinateuniform vec2 uniformOffsetvoid main(){varyinTexCoordinate=attrVertex+uniformOffsetgl_Position=vec4(attrVertex,0,1)}","%c","webgl fragment shader high float precision:","precision mediump floatvarying vec2 varyinTexCoordinatevoid main() {gl_FragColor=vec4(varyinTexCoordinate,0,1)}","',","windows phone","appName","cpuClass","parse","keydown","ip_isp","onload","removeEventListener","form","Msxml2.DOMDocument","/tool.min.js","webkitOfflineAudioContext",";expires=Tue, 19 Jan 2038 03:14:07 GMT;path=/;","webgl antialiasing:","levelchange","webgl unmasked vendor:","addEventListener","HI","Object.keys called on non-object","webgl vertex shader low int precision:","11pt Arial","closePath","release","WebGLRenderingContext","focus","ipod","_orientation","UPDATE_FUNC_TIMING","number","navigation","alphabetic","mspointerup","_motion","getOwnPropertyDescriptor","webgl fragment shader high float precision rangeMin:","__webdriver_unwrapped","attrVertex","webgl fragment shader low int precision rangeMin:","cookie","%22",").","webgl max render buffer size:","pike","ip","dns","%26","script","Mac","rgb(0,255,255)","driver","DEPTH_BITS","fontSize","fillStyle","PDF.PdfCtrl","interval","ALPHA_BITS","status","Interval","charset","webgl max vertex attribs:","webgl red bits:","Max"]
var Vc = ["A","B","C","D","E","F","G","H","I","J","K","L","M","N","O","P","Q","R","S","T","U","V","W","X","Y","Z","a","b","c","d","e","f","g","h","i","j","k","l","m","n","o","p","q","r","s","t","u","v","w","x","y","z","0","1","2","3","4","5","6","7","8","9","+","/"]
var Wc = "="

// actoken
function Vb(d) {
var e = [c[36], c[37], c[38], c[40], c[42], c[45], c[47], c[48], c[50], c[51], c[102], c[104], c[106], c[108], c[110], c[113]];
return c[0] + e[d >>> a[24] & a[63]] + e[d & a[63]]
}

function hb(a) {
void 0 === a && (a = []);
return a.map(function(a) {
return Vb(a)
}).join(c[0])
}

function C(d) {
if (d < a[300])
return C(a[301] - (a[300] - d));
if (d >= a[300] && d <= a[292])
return d;
if (d > a[292])
return C(a[302] + d - a[292]);
throw Error(c[141]);
}

function Mb(d) {
if (null === d || d.length === a[16])
return [];
d = typeof d === b[144] ? d : String(d);
for (var e = [], g = a[16], c = a[16], m = d.length / a[17]; c < m; c++) {
var h = parseInt(d.charAt(g++), a[65]) << a[24]
, l = parseInt(d.charAt(g++), a[65]);
e[c] = C(h + l)
}
return e
}

function za(d) {
if (null === d || void 0 === d)
return d;
d = encodeURIComponent(d);
for (var e = [], g = a[16], b = d.length; g < b; g++)
if (d.charAt(g) === c[17])
if (g + a[17] < b)
e.push(Mb(d.charAt(++g) + c[0] + d.charAt(++g))[0]);
else
throw Error(c[150]);
else
e.push(C(d.charCodeAt(g)));
return e
}

function La(d) {
if (!d)
return c[0];
var e = a[16]
, b = [a[96], a[291], a[55], a[157], a[98], a[131]];
d = za(d);
for (var t = [], m = a[16]; m < d.length; m++)
t[m] = C(d[m] ^ b[e++ % b.length]),
t[m] = C(a[16] - t[m]);
return hb(t)
}

然后我们复制一些固定的参数值来验证La方法是否可用:

1
2
3
4
5
6
7
8
9
10
function get_actoken(d_enc) {
var a = {
"r": 1,
"d": "M90axVkzDpIVVBFEEEdubh3TajN4egk3",
"b": "P0aHIMCivdpBFVVVAEZua1zRr7J7aSWZ"
}
return La(JSON["stringify"](a))
}
// console.log(a)
console.log(get_actoken())

变量a的b属性

上面说了要生成acToken存在三个问题,第三个问题现已解决,现在来看第一个问题

变量a的b属性是传入参数的C属性,回到之前的位置:

C属性的值就是t的值,点击调用栈可以定位到下这个图片最下面的位置(很多步骤这里轻描淡写,实际上需要仔细分析),接着往上面看一点可以看到变量t声明和赋值的地方:

1
var t = this.h.C = $b();

这样问题就很清楚了,C属性的值就是$b()的返回值,把$b()方法抠出来就好了。

这里直接贴出来

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
// b参数
function Rb(d, e, g, b, m) {
void 0 === g && (g = a[16]);
void 0 === b && (b = Sb);
void 0 === m && (m = eb);
var h, l = [];
switch (g) {
case a[690]:
g = d[e];
h = a[16];
l.push(b[g >>> a[17] & a[161]], b[(g << a[24] & a[131]) + (h >>> a[24] & a[63])], m, m);
break;
case a[17]:
g = d[e];
h = d[e + a[690]];
d = a[16];
l.push(b[g >>> a[17] & a[161]], b[(g << a[24] & a[131]) + (h >>> a[24] & a[63])], b[(h << a[17] & a[157]) + (d >>> a[34] & a[21])], m);
break;
case a[21]:
g = d[e];
h = d[e + a[690]];
d = d[e + a[17]];
l.push(b[g >>> a[17] & a[161]], b[(g << a[24] & a[131]) + (h >>> a[24] & a[63])], b[(h << a[17] & a[157]) + (d >>> a[34] & a[21])], b[d & a[161]]);
break;
default:
throw Error(c[116]);
}
return l.join(c[0])
}

function Tb(d, e, g) {
void 0 === e && (e = []);
void 0 === g && (g = eb);
if (!d)
return null;
if (d.length === a[16])
return c[0];
var b = a[21];
try {
for (var m = [], h = a[16]; h < d.length; )
if (h + b <= d.length)
m.push(Rb(d, h, b, e, g)),
h += b;
else {
m.push(Rb(d, h, d.length - h, e, g));
break
}
return m.join(c[0])
} catch (l) {
throw Error(c[116]);
}
}
function Ub(a) {
void 0 === a && (a = []);
return Tb(a, Vc, Wc)
}

function ib(d) {
void 0 === d && (d = c[0]);
d = typeof d === b[144] ? d : String(d);
for (var e = [], g = a[16], t = a[16], m = d.length / a[17]; g < m; g++) {
var h = parseInt(d.charAt(t++), a[65]) << a[24]
, l = parseInt(d.charAt(t++), a[65]);
e[g] = C(h + l)
}
return e
}

function ia(d, e) {
var c = (d & a[617]) + (e & a[617]);
return (d >> a[65]) + (e >> a[65]) + (c >> a[65]) << a[65] | c & a[617]
}

function I(d, e, c, b, m, h) {
d = ia(ia(e, d), ia(b, h));
return ia(d << m | d >>> a[98] - m, c)
}
function K(a, e, c, b, m, h, l) {
return I(e & c | ~e & b, a, e, m, h, l)
}
function L(a, e, c, b, m, h, l) {
return I(e & b | c & ~b, a, e, m, h, l)
}
function M(a, e, c, b, m, h, l) {
return I(c ^ (e | ~b), a, e, m, h, l)
}

function ac(d) {
var e = b[291], g = c[0], f, m;
for (m = a[16]; m < d.length; m += a[690])
f = d.charCodeAt(m),
g += e.charAt(f >>> a[24] & a[63]) + e.charAt(f & a[63]);
return g
}

function $b(d) {
var e, b = [];
b[(d.length >> a[17]) - a[690]] = void 0;
for (e = a[16]; e < b.length; e += a[690])
b[e] = a[16];
var t = d.length * a[43];
for (e = a[16]; e < t; e += a[43])
b[e >> a[29]] |= (d.charCodeAt(e / a[43]) & a[349]) << e % a[98];
d = d.length * a[43];
b[d >> a[29]] |= a[301] << d % a[98];
b[(d + a[166] >>> a[47] << a[24]) + a[61]] = d;
var m, h, l = a[423], p = a[432], f = a[28], k = a[514];
for (d = a[16]; d < b.length; d += a[65])
e = l,
t = p,
m = f,
h = k,
l = K(l, p, f, k, b[d], a[39], a[644]),
k = K(k, l, p, f, b[d + a[690]], a[56], a[698]),
f = K(f, k, l, p, b[d + a[17]], a[67], a[364]),
p = K(p, f, k, l, b[d + a[21]], a[78], a[507]),
l = K(l, p, f, k, b[d + a[24]], a[39], a[118]),
k = K(k, l, p, f, b[d + a[29]], a[56], a[578]),
f = K(f, k, l, p, b[d + a[34]], a[67], a[480]),
p = K(p, f, k, l, b[d + a[39]], a[78], a[599]),
l = K(l, p, f, k, b[d + a[43]], a[39], a[696]),
k = K(k, l, p, f, b[d + a[47]], a[56], a[642]),
f = K(f, k, l, p, b[d + a[50]], a[67], a[439]),
p = K(p, f, k, l, b[d + a[52]], a[78], a[486]),
l = K(l, p, f, k, b[d + a[56]], a[39], a[471]),
k = K(k, l, p, f, b[d + a[58]], a[56], a[522]),
f = K(f, k, l, p, b[d + a[61]], a[67], a[438]),
p = K(p, f, k, l, b[d + a[63]], a[78], a[394]),
l = L(l, p, f, k, b[d + a[690]], a[29], a[536]),
k = L(k, l, p, f, b[d + a[34]], a[47], a[556]),
f = L(f, k, l, p, b[d + a[52]], a[61], a[560]),
p = L(p, f, k, l, b[d], a[74], a[572]),
l = L(l, p, f, k, b[d + a[29]], a[29], a[71]),
k = L(k, l, p, f, b[d + a[50]], a[47], a[451]),
f = L(f, k, l, p, b[d + a[63]], a[61], a[465]),
p = L(p, f, k, l, b[d + a[24]], a[74], a[498]),
l = L(l, p, f, k, b[d + a[47]], a[29], a[539]),
k = L(k, l, p, f, b[d + a[61]], a[47], a[412]),
f = L(f, k, l, p, b[d + a[21]], a[61], a[547]),
p = L(p, f, k, l, b[d + a[43]], a[74], a[30]),
l = L(l, p, f, k, b[d + a[58]], a[29], a[26]),
k = L(k, l, p, f, b[d + a[17]], a[47], a[643]),
f = L(f, k, l, p, b[d + a[39]], a[61], a[240]),
p = L(p, f, k, l, b[d + a[56]], a[74], a[458]),
l = I(p ^ f ^ k, l, p, b[d + a[29]], a[24], a[688]),
k = I(l ^ p ^ f, k, l, b[d + a[43]], a[52], a[490]),
f = I(k ^ l ^ p, f, k, b[d + a[52]], a[65], a[529]),
p = I(f ^ k ^ l, p, f, b[d + a[61]], a[80], a[674]),
l = I(p ^ f ^ k, l, p, b[d + a[690]], a[24], a[574]),
k = I(l ^ p ^ f, k, l, b[d + a[24]], a[52], a[46]),
f = I(k ^ l ^ p, f, k, b[d + a[39]], a[65], a[421]),
p = I(f ^ k ^ l, p, f, b[d + a[50]], a[80], a[499]),
l = I(p ^ f ^ k, l, p, b[d + a[58]], a[24], a[651]),
k = I(l ^ p ^ f, k, l, b[d], a[52], a[477]),
f = I(k ^ l ^ p, f, k, b[d + a[21]], a[65], a[48]),
p = I(f ^ k ^ l, p, f, b[d + a[34]], a[80], a[516]),
l = I(p ^ f ^ k, l, p, b[d + a[47]], a[24], a[682]),
k = I(l ^ p ^ f, k, l, b[d + a[56]], a[52], a[603]),
f = I(k ^ l ^ p, f, k, b[d + a[63]], a[65], a[676]),
p = I(f ^ k ^ l, p, f, b[d + a[17]], a[80], a[487]),
l = M(l, p, f, k, b[d], a[34], a[40]),
k = M(k, l, p, f, b[d + a[39]], a[50], a[582]),
f = M(f, k, l, p, b[d + a[61]], a[63], a[474]),
p = M(p, f, k, l, b[d + a[29]], a[76], a[648]),
l = M(l, p, f, k, b[d + a[56]], a[34], a[680]),
k = M(k, l, p, f, b[d + a[21]], a[50], a[573]),
f = M(f, k, l, p, b[d + a[50]], a[63], a[584]),
p = M(p, f, k, l, b[d + a[690]], a[76], a[437]),
l = M(l, p, f, k, b[d + a[43]], a[34], a[20]),
k = M(k, l, p, f, b[d + a[63]], a[50], a[436]),
f = M(f, k, l, p, b[d + a[34]], a[63], a[479]),
p = M(p, f, k, l, b[d + a[58]], a[76], a[662]),
l = M(l, p, f, k, b[d + a[24]], a[34], a[403]),
k = M(k, l, p, f, b[d + a[52]], a[50], a[552]),
f = M(f, k, l, p, b[d + a[17]], a[63], a[666]),
p = M(p, f, k, l, b[d + a[47]], a[76], a[664]),
l = ia(l, e),
p = ia(p, t),
f = ia(f, m),
k = ia(k, h);
b = [l, p, f, k];
e = c[0];
t = b.length * a[98];
for (d = a[16]; d < t; d += a[43])
e += String.fromCharCode(b[d >> a[29]] >>> d % a[98] & a[349]);
return e
}

function ha(d, e, g, b, m) {
void 0 === d && (d = []);
void 0 === g && (g = []);
if (d.length) {
if (d.length < m)
throw Error(c[138]);
for (var h = a[16]; h < m; h++)
g[b + h] = d[e + h]
}
}

function Y(d) {
var e = [];
e[0] = C(d >>> a[82] & a[349]);
e[1] = C(d >>> a[65] & a[349]);
e[2] = C(d >>> a[43] & a[349]);
e[3] = C(d & a[349]);
return e
}

function bc() {
var d = (new Date)[c[205]]()
, e = Math[b[1]](d / a[520])
, g = d % a[520]
, d = Y(e)
, g = Y(g)
, e = [];
ha(d, a[16], e, a[16], a[24]);
ha(g, a[16], e, a[24], a[24]);
g = [];
for (d = a[16]; d < a[43]; d++)
g[d] = C(Math[b[1]](Math[c[220]]() * a[351]));
for (var d = [], f = a[16]; f < e.length * a[17]; f++) {
if (f % a[17] == a[16]) {
var m = f / a[17];
d[f] = d[f] | (g[m] & a[65]) >>> a[24] | (g[m] & a[98]) >>> a[21] | (g[m] & a[166]) >>> a[17] | (g[m] & a[301]) >>> a[690] | (e[m] & a[65]) >>> a[21] | (e[m] & a[98]) >>> a[17] | (e[m] & a[166]) >>> a[690] | (e[m] & a[301]) >>> a[16]
} else
m = Math[b[1]](f / a[17]),
d[f] = d[f] | (g[m] & a[690]) << a[16] | (g[m] & a[17]) << a[690] | (g[m] & a[24]) << a[17] | (g[m] & a[43]) << a[21] | (e[m] & a[690]) << a[690] | (e[m] & a[17]) << a[17] | (e[m] & a[24]) << a[21] | (e[m] & a[43]) << a[24];
d[f] = C(d[f])
}
e = hb(d);
e = ac($b(unescape(encodeURIComponent(e + b[135]))));
e = ib(e.substring(a[16], a[65]));
return Ub(e.concat(d))
}

这里方法名不用在意,入口是bc方法,实际就是本次调试的$b方法

变量a的d属性

上面已经解决了a的b属性,下面再看下d属性,网上说这里的b属性实际来自d请求返回的第三个参数值(指的是前面的序号为3,实际是第四个),调试的时候经过对比发现确实相同,至于如何得知这一信息感兴趣可以自行研究下,这里直接看d请求做了什么。

可以看到确实是从这里发起了d请求(只有在清除缓存的情况下才会发送d请求),Pc方法传入的c参数已经包含完整的POST请求参数,即:

1
2
3
d: yyxmP5t+dPzXZBse.tJ.L/vgNH1hGlI9ncjf6qRFDyQ4jvZI8e9apy5ygX+PWHoQxEeeVhtYwZ30ZWkDKNj6v6ZyqV9FMiIJ7o+Z9aImNe9pP.LjvQ7AHkMK.dSa0A3gpIis8X2+nLFPkwEVLTJy51jHubaXOmliK7n8VAzw2WG3qmZyy46LFEhgmqodIBpUB/a0+sgrlPDAKrONie+3.vUndID3kcIZvzKTJBO8uFMZlHPTHTEMsTr4.JaUcb9EOeNXjEKa6gNPXyJ6W/jXbcZKiVlONQEU63m.2FXGEjEK1GFX1p0OSpdwNUGVG/ngYYG7GenZIRXi9QTky6N4voHXzgZE72bxiK4j05UZQLfhQLj1nNRYqmKZ8.PX9.0snt+Fi4qIVcY/t4s023w7.f33.2wqsgQVykU1JYQ+g1p0BqjriKQDPa1hbbl1aWilTkwmWuiwQ.11v1KyK.JfipEMKlY4TFGnveBoo/WyfAW0Yn5RUfYKSzweWZScLUq.oOhwD+nfXaq4TivPEKI4IWhDfp9ZXndc3JYqvaZkjMKspsUp+XTs+0b1lMroxpb2hI6L7+dbPbsqZ+QR6TLzxAbbkSMoZnW.bfmNs01ZFADoH+BYn61wZBGjphswm6gNh7Ov81O1aoY3bY6YO.Ub8qAVNmzbnqd4xTulGyOUqx9zIuyqWZvYTYbTScUguFNRTQkv59NvQmlRvRe1NogpbZ5K2dp8fmLyYzx6giTA5.E5P58E9EQtLAB6mNF5/XI91XqBitAdRq3dvy0dw36BKj+WOn5tGLSEDF1mqslrpuz+ev5GIMhFFrFJdTYKvzoDM4NpBEQOgqkATVtL4s/Up5f3y4XOTXuK4H6EL0yfuOqv0M.InF6Bpe4/.bMZQoMf96M9lm5/B8jgSaVWsvuqWGXZ9ZxAiwDlGmP7kTTRagP.3bdR
v: eb045ea7
cb: __wmjsonp_80bc54c

经过追溯,我们可以找到d请求的d参数(v和cb不重要)的生成位置(下图的e):

这里我就没去一步步扣了,用的周围大佬扣好的,且b请求的d参数的生成方式也是类似的,只是多了一些鼠标行为验证的数据操作

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991

var c = ["","parent","stack","plugins","getItem","getNdInfo","iOS","Microsoft Internet Explorer","mouseup","getSupportedExtensions","_battery","appendChild","evenodd","webgl max vertex uniform vectors:","\"","innerText","$","%","&","adsbox","'","(",")","rgb(255,255,0)","getShaderPrecisionFormat","textContent","+",",","iOs","windvane","version","click",".","_blur","/","18pt Arial","0","1","2","getChannelData","3","getContextAttributes","4","_focus","stop","5","left","6","7","domain","8","9",":",";","=","mousedown","object","?","webgl fragment shader medium float precision rangeMax:","__fxdriver_unwrapped","A","B","nstool.netease.com/info.js","MAX_VERTEX_ATTRIBS","C","D","E","F","G","H","webgl fragment shader medium int precision rangeMin:","I","blur","J","K","appMinorVersion","L","M","N","O","P","Q","R","Cwm fjordbank glyphs vext quiz","S","selenium","T","U","dns_isp","V","W","X","Y","LOW_INT","Z","[","fetchStart","getElementsByTagName","]","connect","^","cb","a","COLOR_BUFFER_BIT","b","__webdriver_script_fn","c","rmocx.RealPlayer G2 Control.1","d","Scripting.Dictionary","e","beginPath","couchjs","f","g","h","1010","i","j","k","webgl fragment shader low float precision rangeMax:","l","m","webgl version:","n","o","p","doNotTrack","q","chargingtimechange","setTimeout","r","1005","getTimezoneOffset","changedTouches","s","webgl fragment shader low int precision rangeMax:","t","1003","u","v","1001","w","x","This browser's implementation of Object.create is a shim and doesn't support 'null' as the first argument.","drawArrays","y","toString","z","~","1009","font","webgl fragment shader low int precision:","suffixes","POST","Shell.UIHelper","setRequestHeader","toDataURL","Safari","TouchEvent","language","down","insertBefore","div","acceleration","accelerationIncludingGravity","7c08033d","Internet Explorer","MAX_CUBE_MAP_TEXTURE_SIZE","text/javascript","webgl vertex shader high float precision:","webgl vertex shader high float precision rangeMax:","webdriver","MOZ_EXT_texture_filter_anisotropic","WEBGL_debug_renderer_info","chargingchange","webgl shading language version:","res","RealPlayer","chrome","RegExp","chargingTime","createElement","productNumber","parentNode","Array.prototype.reduce called on null or undefined","webgl fragment shader medium float precision:","webgl max varying vectors:","canvas winding:","rgb(255,0,255)","Content-type","DEPTH_TEST","external","eval","unknown error","Linux","dischargingtimechange","_scroll","QuickTimeCheckObject.QuickTimeCheck.1","7,0,1,d,7,3,7,3","Request timed out","removeItem","attachShader","webgl renderer:","startRendering","getTime","callSelenium","responseText","rangeMin","initWatchman","request api error","1.01","webgl depth bits:","nodejs","webgl max cube map texture size:","title","/v3/d","__wmjsonp_","devicePixelRatio","pointerup","random","setAttribute","_selenium","memoryStorage","fp_","alpha","webgl vendor:","__webdriver_evaluate","multiply","attribute vec2 attrVertexvarying vec2 varyinTexCoordinateuniform vec2 uniformOffsetvoid main(){varyinTexCoordinate=attrVertex+uniformOffsetgl_Position=vec4(attrVertex,0,1)}","%c","webgl fragment shader high float precision:","precision mediump floatvarying vec2 varyinTexCoordinatevoid main() {gl_FragColor=vec4(varyinTexCoordinate,0,1)}","',","windows phone","appName","cpuClass","parse","keydown","ip_isp","onload","removeEventListener","form","Msxml2.DOMDocument","/tool.min.js","webkitOfflineAudioContext",";expires=Tue, 19 Jan 2038 03:14:07 GMT;path=/;","webgl antialiasing:","levelchange","webgl unmasked vendor:","addEventListener","HI","Object.keys called on non-object","webgl vertex shader low int precision:","11pt Arial","closePath","release","WebGLRenderingContext","focus","ipod","_orientation","UPDATE_FUNC_TIMING","number","navigation","alphabetic","mspointerup","_motion","getOwnPropertyDescriptor","webgl fragment shader high float precision rangeMin:","__webdriver_unwrapped","attrVertex","webgl fragment shader low int precision rangeMin:","cookie","%22",").","webgl max render buffer size:","pike","ip","dns","%26","script","Mac","rgb(0,255,255)","driver","DEPTH_BITS","fontSize","fillStyle","PDF.PdfCtrl","interval","ALPHA_BITS","status","Interval","charset","webgl max vertex attribs:","webgl red bits:","Max"]
var k = ["WEBKIT_EXT_texture_filter_anisotropic","MAX_FRAGMENT_UNIFORM_VECTORS","devicemotion","UPDATE_OPTIONS","mac","RealPlayer.RealPlayer(tm) ActiveX Control (32-bit)","xxxxxxxxxxxx4xxxyxxxxxxxxxxxxxxx","top","webgl vertex shader medium int precision rangeMax:","MAX_TEXTURE_SIZE","AcroPDF.PDF","MAX_VIEWPORT_DIMS"," this is null or not defined","MAX_VERTEX_UNIFORM_VECTORS","_Selenium_IDE_Recorder","java.lang.System.exit","max","touchstart","757c7093","hardwareConcurrency","knee","availWidth","documentMode",", ","MAX_TEXTURE_MAX_ANISOTROPY_EXT","rmocx.RealPlayer G2 Control","getToken","complete","availHeight","_phantom","auto","opera","ARRAY","webgl","RED_BITS","pointerdown","precision","screen","超时了","body","TRIANGLE_STRIP","MAX_RENDERBUFFER_SIZE","clientWidth","ontouchstart","function","context.hashCode","mmmmmmmmmmlli","readyState","oncomplete","VERTEX_SHADER","\"this\" is null or not defined","browserLanguage","level","UTF-8","webgl fragment shader high int precision:","__supportCaptcha__","Android","innerWidth","200"," - ","Failed to load ","UPDATE_TIME_OFFSET","position","send devicedata failed: ","cannot got value","no","[object Array]","webgl max viewport dims:","Windows","BLUE_BITS","webgl vertex shader medium int precision:","head","rect","hasOwnProperty","ALIASED_POINT_SIZE_RANGE","Adodb.Stream","webgl green bits:","BatteryManager"]
var a = [64,13,29,43,7,23,11,90,43,92,37,0,75,56,94,79,0,2,1423857449,-2,1873313359,3,-3,1555261956,4,2847714899,-1444681467,-4,-1732584194,5,1163531501,-5,2714866558,1281953886,6,-6,198958881,1141124467,2970347812,7,-198630844,-7,3110523913,8,-8,2428444049,1272893353,9,-722521979,-9,10,-10,11,-11,2563907772,-12,12,2282248934,13,-13,2154129355,14,-14,15,-15,16,-16,17,-17,-18,18,-701558691,-19,19,20,-20,21,-21,22,-22,23,-23,24,-24,25,-25,-26,26,27,-27,28,-28,-29,29,30,-30,31,-31,32,33,-33,-32,-34,34,35,-35,37,-37,36,-36,39,-38,-39,38,40,41,-40,-41,-176418897,-43,42,-42,43,45,44,-44,-45,-47,-46,47,46,48,-49,49,-48,50,-50,51,-51,570562233,-52,-53,53,52,54,-54,55,-55,503444072,-57,56,57,-56,59,-58,58,-59,60,-60,61,-61,63,62,-63,-62,65,64,711928724,-65,-67,-64,67,-66,66,-70,71,70,68,-69,-68,-71,69,73,3686517206,75,-75,-74,72,74,-73,-72,77,-78,-79,78,-76,76,-77,79,3554079995,-82,81,83,-81,-83,80,82,-80,-85,86,87,-84,85,-87,-86,84,-91,-88,88,91,-89,90,89,-90,94,-95,92,-92,-93,93,95,-94,96,-99,99,-98,97,-97,-96,98,1735328473,3272380065,100,101,-103,103,-101,-102,102,-100,-107,107,105,106,104,-105,-106,-104,110,-109,-108,109,-110,-111,111,108,251722036,-115,114,-114,-112,115,112,113,-113,-119,118,-118,119,116,-117,-116,117,123,-122,122,121,-120,-121,120,-123,125,127,3412177804,-127,124,-125,-124,-126,126,-128,128,-129,130,1843258603,150,3803740692,984961486,3939845945,44100,4195302755,200,201,202,203,206,207,208,209,210,211,212,213,214,215,216,217,218,221,222,223,225,228,229,230,231,232,233,234,235,236,237,238,239,4066508878,240,241,242,243,255,1706088902,256,300,327,1969922972,2097651377,1291169091,376229701,400,401,402,403,404,405,606105819,420,450,451,470,853044451,500,512,701,702,703,707,704,705,706,708,709,710,711,712,713,752459403,800,801,802,803,804,658871167,1000,426522225,1236535329,3772115230,615818150,3904427059,4167216745,4027552580,2000,3654703836,1886057615,-145523070,879679996,3518719985,3000,3244367275,2013776290,3373015174,1390208809,4500,-1019803690,5000,1759359992,285281116,1622183637,1006888145,1231636301,10000,83908371,-155497632,1090812512,1732584193,2463272603,1373503546,2596254646,2321926636,1504918807,2181625025,2882616665,2747007092,-271733879,3009837614,60000,3138078467,-30611744,-2054922799,-1502002290,-42063,397917763,81470997,829329135,2657392035,956543938,2517215374,2262029012,40735498,2394877945,702138776,2808555105,38016083,2936675148,1258607687,1131014506,3218104598,3082640443,1404277552,-1926607734,565507253,4283543511,534414190,1541320221,1913087877,2053790376,-660478335,1789927666,3965973030,3826175755,4107580753,4240017532,1804603682,1658658271,3579855332,-1416354905,3708648649,3453421203,-358537222,3317316542,-1560198380,-1473231341,1873836001,1742555852,3608007406,1996959894,3747672003,-1990404162,-995338651,3485111705,2137656763,-2022574463,3352799412,213261112,3993919788,1.01,3865271297,4139329115,4275313526,-405537848,-1094730640,1549556828,282753626,1068828381,909522486,2768942443,2909243462,936918000,-1044525330,3183342108,141376813,3050360625,654459306,2617837225,1454621731,271733878,2489596804,76029189,2227061214,1591671054,2362670323,4294967296,4294967295,-40341101,1308918612,795835527,1181335161,414664567,4279200368,1661365465,1839030562,1037604311,4150417245,3887607047,1802195444,4023717930,2075208622,-165796510,1943803523,901097722,568446438,628085408,755167117,3322730930,3462522015,3736837829,3604390888,2366115317,-187363961,0.4,2238001368,2512341634,2647816111,-1120210379,-0.2,314042704,1510334235,-1069501632,1382605366,31158534,450548861,643717713,3020668471,1119000684,3160834842,2898065728,1256170817,2765210733,3060149565,3188396048,2932959818,124634137,2797360999,-373897302,-1894986606,-1530992060,366619977,62317068,-0.26,1200080426,1202900863,498536548,1340076626,1126891415,2405801727,-1051523,2265490386,1594198024,1466479909,2547177864,249268274,2680153253,2125561021,3294710456,855842277,3423369109,0.732134444,3705015759,3569037538,1994146192,-45705983,1711684554,1852507879,997073096,-421815835,289559509,733239954,4251122042,601450431,4111451223,167816743,3855990285,3981806797,3988292384,3369554304,3233442989,3495958263,3624741850,65535,453092731,-0.9,2094854071,1957810842,325883990,4057260610,1684777152,4189708143,3915621685,162941995,1812370925,3775830040,783551873,3134207493,1172266101,2998733608,2724688242,1303535960,2852801631,112637215,1567103746,444984403,651767980,1426400815,-1958414417,-51403784,-680876936,906185462,2211677639,1047427035,-57434055,2344532202,2607071920,681279174,2466906013,225274430,544179635,2176718541,2312317920,1483230225,1342533948,2567524794,2439277719,1088359270,1309151649,671266974,-343485551,1219638859,718787259,953729732,2277735313,3099436303,2966460450,817233897,2685067896,2825379669,-35309556,4089016648,530742520,4224994405,3943577151,3814918930,1700485571,0.25,-640364487,476864866,944331445,1634467795,335633487,1762050814,-378558,-1,1,2044508324,3401237130,3268935591,3524101629,3663771856,1770035416,1907459465,-389564586,3301882366]
var b = ["callPhantom","floor","__driver_unwrapped","beta","on","RENDERER","src","DevalVRXCtrl.DevalVRXCtrl.1","globalCompositeOperation","addBehavior","&nbsp;","spawn","HIGH_INT","rangeMax","batteryInterval","CAT_WEBGL","(function(){return 123;})();","20030107","stringify","compatMode","Windows Phone","isPrototypeOf","extensions:",""," is not a function","NEWatchmanError","00000000","removeChild","webgl aliased line width range:","webgl max texture size:","webgl vertex shader low int precision rangeMax:","useProgram","domAutomation","hostname","XDomainRequest","Watchman","requestStart","phantom.injectJs","clearTimeout","ERROR","touchend","state","webgl max anisotropy:","ShockwaveFlash.ShockwaveFlash","height","webgl vertex shader medium int precision rangeMin:","EXT_texture_filter_anisotropic","/v2/collect","AgControl.AgControl","touchmove","d73f85d653b74a259fe620aac656670b","decodeURI","clientHeight","Firefox","input","123","__webdriver_script_func","WMPlayer.OCX","72px","webgl vertex shader low float precision:","propertyIsEnumerable","safari","onreadystatechange","behavior api response wrong","document","dns_city","webgl fragment shader high float precision rangeMax:","deviceorientation","-9999px","userLanguage","businessKey is illegal","pointermove","arc","SHADING_LANGUAGE_VERSION","min","attack","LOW_FLOAT","sessionStorage","Object prototype may only be an Object: ","compileShader","iframe","escape","mspointermove","systemLanguage","languages","Skype.Detection","2d","ActiveXObject","absolute","offsetHeight","STRING","XMLHttpRequest","The server has encountered an error","colorDepth","open","gamma","domain=","webgl vertex shader medium float precision rangeMin:","ratio","Other","RealVideo.RealVideo(tm) ActiveX Control (32-bit)","OfflineAudioContext","webgl blue bits:","navigator","mspointerdown","#f60","webgl fragment shader medium int precision:","isNaN","fillRect","frequency","loaded","encodeURI","attachEvent","webgl max vertex texture image units:","MAX_VERTEX_TEXTURE_IMAGE_UNITS","2.7.1_7c08033d","up","webgl fragment shader high int precision rangeMax:","device api response wrong","createProgram","GREEN_BITS","isTrusted","pageXOffset","NUMBER","innerHeight","monospace","clientY","clientX","constructor","STATIC_DRAW","productSub","BOOLEAN","opr","MAX_TEXTURE_IMAGE_UNITS","abort","dAWsBhCqtOaNLLJ25hBzWbqWXwiK99Wd","dns_province","webgl aliased point size range:","uniformOffset","encodeURIComponent","toLocaleString","documentElement","bindBuffer","onerror","string","MEDIUM_FLOAT","responseEnd","MAX_COMBINED_TEXTURE_IMAGE_UNITS","localStorage","android","canvas fp:","destination","description","indexedDB","createBuffer","__driver_evaluate","linkProgram","button","linux","createShader","Chrome","normal","webgl stencil bits:","trident","yes","SWCtl.SWCtl","Reduce of empty array with no initial value","valueOf","webgl vertex shader medium float precision:","start","WoeTpXnDDPhiAvsJUUIY3RdAo2PKaVwi","createOscillator","Does not support CORS","detachEvent","target","parseInt","gbk","getUniformLocation","WM_CONFIG","\\((.+)\\)$","shaderSource","location","HEX","window","initNEWatchman","disconnect","appVersion","mousemove","type","webgl fragment shader medium float precision rangeMin:","webgl vertex shader high int precision rangeMin:","enableVertexAttribArray","javaEnabled","oscpu","webgl fragment shader medium int precision rangeMax:","options","webgl vertex shader low float precision rangeMax:","MAX_VARYING_VECTORS","WM_NIKE","openDatabase","getParameter","Buffer","STENCIL_BITS","canvas","HIGH_FLOAT","webgl vertex shader low int precision rangeMin:",": ","scroll","batteryMax","WM_NI","DEPTH_BUFFER_BIT","createDynamicsCompressor","iphone","webgl fragment shader low float precision:","ip_province","__selenium_evaluate","Msxml2.XMLHTTP","/v3/b","pageYOffset","GET","style","depthFunc","Opera","Can not find configuration","::","parseFloat","webgl fragment shader low float precision rangeMin:","getAttribLocation","utf8","webgl unmasked renderer:","triangle","unknown","undefined","\\.","WM_DIV","WM_TID","event","getExtension","cache_","offsetWidth","userAgent","QuickTime.QuickTime","JSCookie","experimental-webgl","dischargingTime","__nightmare","ARRAY_BUFFER","MEDIUM_INT","request resource error","withCredentials","ip_city","=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/","Missing business key","width","webgl max fragment uniform vectors:","VERSION","TDCCtl.TDCCtl","self","lineHeight","Sequentum","span","msg","innerHTML","cookieEnabled","rhino","firefox","threshold","appCodeName","Netscape","bb99db1_7","bb99db1_6","bb99db1_5","protocol","fontFamily","bb99db1_4","webgl max texture image units:","bb99db1_9","://","scrollLeft","bb99db1_3","bb99db1_2","bb99db1_1","__fxdriver_evaluate","[object Function]","timing","toSource","CAT_FONTS","Cwm fjordbank glyphs vext quiz, ","WM_DID","application/x-www-form-urlencoded","Response is empty","0123456789abcdef","sans-serif","webgl max combined texture image units:","webgl vertex shader high float precision rangeMin:","history","webgl vertex shader medium float precision rangeMax:","webgl fragment shader high int precision rangeMin:","scrollTop","webgl vertex shader high int precision:","FRAGMENT_SHADER","ipad","rgba(102, 204, 0, 0.2)","MacromediaFlashPaper.MacromediaFlashPaper","send","domAutomationController","screenX","?&","ALIASED_LINE_WIDTH_RANGE","renderedBuffer","Failed to load script(","platform","CSS1Compat","clearColor","getAttribute","array","setInterval","This browser's implementation of Object.create is a shim and doesn't support a second argument.","createEvent","getBattery","webgl vertex shader high int precision rangeMax:","value","win","vertexAttribPointer","__webdriver_script_function","srcElement","textBaseline","#069","__","move","orientation","motion","phantomjs","__selenium_unwrapped","match","charging","unescape","responseStart","LEQUAL","webgl vertex shader low float precision rangeMin:","Date","decodeURIComponent","async","performance","boolean","inline","32288785","serif","VENDOR","CAT_CANVAS","reduction","emit","getContext","uniform2f","webgl alpha bits:"]
var D = {"state":{"options":{"auto":true,"staticServer":"acstatic-dun.126.net","apiServer":"ac.dun.163yun.com","productNumber":"YD00001000091119","protocol":"https","domain":"","Ec":[""],"dc":[""],"buildVersion":"2.7.1_7c08033d","lastUsedVersion":"2.7.1_a02527b8","sConfig":"9ca170a1abeedba16ba1f2ac96ed26f3eafd9af866eebda18eae7ef2f1acc3af2aa2bdbbc3b92aa3bde285f866eeeffad4fc7faef2ad90f025b6eee183a128e2bca4c3b92ae2f4ee8ee867e2e6fbd1af2aafbba7c3b939f4f0e4c3e26faffef6d3b328e2bdab8aa132f1f000cda161a7b3eedbb43cf0fea586ec2afaed00d1af2aa6bba3c3b93af4f4ee87e863e2e6fdd1b328e2adab8ea132f2f0e4c3f26fabfef6d4b33cf0feab8be270e2e6aa82ef79a7f4ee86e579e2e6aa82ef79a7f4ee86f679e2e6aa82ef79a7f4ee93e880e2e6ffcda169afb2eedbb128e2bda7c3b93bf4f0e4c3ee80a7b3eedbb83cf0fea195e863e2e6fdd1b328e2b3bc86f02afaeb00cda167b8bba7c3b939f4f0e4c3f366e2e6eebac73cf4f000d2b33cf4f0f7d2b43bfbfee4c3e870a1fef695f17fa7f4ee83ef2afafeeecda163b6b0eedbb23cf4f000d1af2aa8acba91a132fceafcd1b33cf4f0e4c3f780adfef6d3b33cf4f4ee86e47fe2e6aa82ef79a7f4ee82e780e2e6fbd1af2aa7acadc3b96ea3b4bd86af2ab8bdbcc3b93cbf","configHash":"9ca170a1abeedba16ba1f2ac96ed26f3eafd9af866eebda18eae7ef2f1acc3af2aa2bdbbc3b92aa3bde285f866eeeffad4fc7faef2ad90f025b6eee183a128e2bca4c3b92ae2f4ee8ee867e2e6fbd1af2aafbba7c3b939f4f0e4c3e26faffef6d3b328e2bdab8aa132f1f000cda161a7b3eedbb43cf0fea586ec2afaed00d1af2aa6bba3c3b93af4f4ee87e863e2e6fdd1b328e2adab8ea132f2f0e4c3f26fabfef6d4b33cf0feab8be270e2e6aa82ef79a7f4ee86e579e2e6aa82ef79a7f4ee86f679e2e6aa82ef79a7f4ee93e880e2e6ffcda169afb2eedbb128e2bda7c3b93bf4f0e4c3ee80a7b3eedbb83cf0fea195e863e2e6fdd1b328e2b3bc86f02afaeb00cda167b8bba7c3b939f4f0e4c3f366e2e6eebac73cf4f000d2b33cf4f0f7d2b43bfbfee4c3e870a1fef695f17fa7f4ee83ef2afafeeecda163b6b0eedbb23cf4f000d1af2aa8acba91a132fceafcd1b33cf4f0e4c3f780adfef6d3b33cf4f4ee86e47fe2e6aa82ef79a7f4ee82e780e2e6fbd1af2aa7acadc3b96ea3b4bd86af2ab8bdbcc3b93cbf","merged":true,"hc":false,"ic":false,"oa":true,"oc":300000,"gc":86400000,"Ac":2000,"va":1,"moveMax":50,"moveInterval":300,"keydownMax":10,"keydownInterval":300,"clickMax":20,"clickInterval":300,"upMax":20,"upInterval":300,"downMax":20,"downInterval":300,"focusMax":20,"focusInterval":300,"blurMax":20,"blurInterval":300,"scrollMax":20,"scrollInterval":300,"orientationMax":50,"orientationInterval":3000,"motionMax":50,"motionInterval":3000,"__serverConfig__":{},"batteryMax":100,"batteryInterval":10},"wa":0,"$":[0,0,4,0,0,0]},"Mb":[],"ca":{},"ia":{}}
var ec = a[16], Ic = b[115], Jc = [c[45], c[47], c[110], c[40], c[45], c[106], c[108], c[37]], Kc = c[199], Mc = b[346], pb, wb, Ca, gc;
var nc = b[178],Fa=b[235],ra=b[288],oc=b[234],ob=b[209],pc=b[198],y=b[123],u=b[90],Z=b[182],A=b[131],H=k[32],Jb=b[349],Za=b[286],Kb=b[15];
var Ba = Date, ma=parseInt, Sc=toString, aa=encodeURIComponent, xa=setTimeout, cc=unescape;
var ca = {"Xb":{"c":0,"a":"STRING","e":3},"Ka":{"c":1,"a":"STRING","e":20},"La":{"c":2,"a":"STRING","e":32},"Ia":{"c":3,"a":"STRING","e":32},"yb":{"c":4,"a":"STRING","e":32},"Pb":{"c":5,"a":"NUMBER","e":4},"Gb":{"c":6,"a":"NUMBER","e":1},"Ub":{"c":7,"a":"STRING","e":32},"Ya":{"c":8,"a":"STRING","e":32},"Fb":{"c":9,"a":"STRING","e":32},"Yb":{"c":107,"a":"NUMBER","e":4},"_move":{"c":109,"a":"ARRAY","e":[2,4,1,4,4]},"_down":{"c":110,"a":"ARRAY","e":[2,4,1,2,4,4]},"_up":{"c":111,"a":"ARRAY","e":[2,4,1,4,4]},"_click":{"c":112,"a":"ARRAY","e":[2,4,1,4,4,20]},"_keydown":{"c":113,"a":"ARRAY","e":[2,4,1,20]},"_focus":{"c":114,"a":"ARRAY","e":[2,4,1,20]},"_blur":{"c":115,"a":"ARRAY","e":[2,4,1,20]},"_scroll":{"c":116,"a":"ARRAY","e":[2,4,1,4,4]},"_orientation":{"c":117,"a":"ARRAY","e":[2,4,4,4,4,1]},"_motion":{"c":118,"a":"ARRAY","e":[2,4,4,4,4,2]},"_battery":{"c":119,"a":"ARRAY","e":[2,4,1,1,4]},"Vb":{"c":200,"a":"STRING","e":400},"ub":{"c":201,"a":"STRING","e":20},"Pa":{"c":202,"a":"NUMBER","e":1},"Xa":{"c":203,"a":"NUMBER","e":1},"Qb":{"c":206,"a":"NUMBER","e":1},"Kb":{"c":207,"a":"BOOLEAN","e":1},"xb":{"c":208,"a":"BOOLEAN","e":1},"ob":{"c":209,"a":"BOOLEAN","e":1},"Aa":{"c":210,"a":"BOOLEAN","e":1},"Ab":{"c":211,"a":"BOOLEAN","e":1},"Ra":{"c":212,"a":"STRING","e":10},"Db":{"c":213,"a":"STRING","e":10},"Za":{"c":214,"a":"STRING","e":15},"Eb":{"c":215,"a":"HEX","e":16},"Ma":{"c":216,"a":"HEX","e":16},"Zb":{"c":217,"a":"HEX","e":16},"za":{"c":218,"a":"BOOLEAN","e":1},"kb":{"c":221,"a":"BOOLEAN","e":1},"jb":{"c":222,"a":"BOOLEAN","e":1},"Tb":{"c":223,"a":"BOOLEAN","e":1},"Hb":{"c":225,"a":"NUMBER","e":1},"Qa":{"c":228,"a":"BOOLEAN","e":1},"sb":{"c":229,"a":"BOOLEAN","e":1},"Ba":{"c":230,"a":"STRING","e":20},"Ca":{"c":231,"a":"STRING","e":10},"Da":{"c":232,"a":"STRING","e":20},"Ea":{"c":233,"a":"STRING","e":150},"vb":{"c":234,"a":"STRING","e":10},"Nb":{"c":235,"a":"STRING","e":10},"Wb":{"c":236,"a":"STRING","e":10},"Ja":{"c":237,"a":"STRING","e":10},"Bb":{"c":238,"a":"STRING","e":40},"$a":{"c":239,"a":"STRING","e":20},"eb":{"c":240,"a":"HEX","e":16},"cb":{"c":241,"a":"NUMBER","e":2},"Ib":{"c":242,"a":"ARRAY","e":[2,2,2,2]},"hb":{"c":243,"a":"NUMBER","e":1},"ib":{"c":401,"a":"BOOLEAN","e":1},"bb":{"c":402,"a":"STRING","e":10},"zb":{"c":403,"a":"NUMBER","e":1},"ab":{"c":404,"a":"NUMBER","e":1},"Lb":{"c":405,"a":"BOOLEAN","e":1},"Sb":{"c":450,"a":"NUMBER","e":1},"rb":{"c":451,"a":"BOOLEAN","e":1},"nb":{"c":701,"a":"NUMBER","e":1},"fb":{"c":702,"a":"NUMBER","e":1},"qb":{"c":703,"a":"NUMBER","e":1},"Jb":{"c":704,"a":"NUMBER","e":5},"lb":{"c":705,"a":"NUMBER","e":1},"Rb":{"c":706,"a":"STRING","e":10},"tb":{"c":707,"a":"STRING","e":16},"Ob":{"c":708,"a":"NUMBER","e":2},"mb":{"c":709,"a":"NUMBER","e":2},"pb":{"c":710,"a":"NUMBER","e":2},"gb":{"c":711,"a":"ARRAY","e":[3,3,3,3,3]},"Cb":{"c":712,"a":"ARRAY","e":[1,3,3]},"Oa":{"c":713,"a":"ARRAY","e":[4,4]},"Sa":{"c":800,"a":"STRING","e":8},"Ta":{"c":801,"a":"STRING","e":8},"Ua":{"c":802,"a":"STRING","e":8},"Va":{"c":803,"a":"STRING","e":8},"Wa":{"c":804,"a":"STRING","e":8},"Ha":{"c":327,"a":"STRING","e":32}}
var Hb = 0;
var tc=c[261],uc=k[61],vc=k[3],oa=b[281],wc=b[280],tb=b[279],ub=b[274],xc=b[271],vb=b[270],qb=b[269],yc=b[276],Sb=[c[142],c[71],c[114],c[66],c[82],c[50],c[126],c[74],c[77],c[80],c[137],c[87],c[48],c[146],c[91],c[79],c[47],c[90],c[118],c[68],c[110],c[37],c[125],c[65],c[73],c[40],c[45],c[34],c[69],c[84],c[121],c[81],c[92],c[143],c[64],c[106],c[122],c[67],c[124],c[26],c[104],c[128],c[32],c[36],c[139],c[140],c[148],c[135],c[113],c[89],c[117],c[42],c[86],c[51],c[76],c[119],c[61],c[38],c[60],c[108],c[94],c[78],c[115],c[102]],Vc=[c[60],c[61],c[64],c[65],c[66],c[67],c[68],c[69],c[71],c[73],c[74],c[76],c[77],c[78],c[79],c[80],c[81],c[82],c[84],c[86],c[87],c[89],c[90],c[91],c[92],c[94],c[102],c[104],c[106],c[108],c[110],c[113],c[114],c[115],c[117],c[118],c[119],c[121],c[122],c[124],c[125],c[126],c[128],c[131],c[135],c[137],c[139],c[140],c[142],c[143],c[146],c[148],c[36],c[37],c[38],c[40],c[42],c[45],c[47],c[48],c[50],c[51],c[26],c[34]],eb=c[131],Wc=c[54],Yc=[a[127],a[258],a[88],a[65],a[275],a[185],a[63],a[75],a[259],a[284],a[111],a[90],a[66],a[232],a[200],a[175],a[92],a[80],a[294],a[44],a[233],a[176],a[107],a[136],a[285],a[216],a[140],a[250],a[224],a[251],a[165],a[168],a[242],a[163],a[186],a[114],a[252],a[91],a[295],a[177],a[77],a[260],a[234],a[112],a[267],a[162],a[169],a[62],a[82],a[161],a[244],a[191],a[217],a[141],a[245],a[296],a[110],a[51],a[115],a[235],a[153],a[201],a[124],a[187],a[297],a[119],a[100],a[94],a[56],a[286],a[144],a[225],a[70],a[218],a[283],a[182],a[99],a[246],a[209],a[210],a[158],a[170],a[102],a[149],a[202],a[43],a[300],a[211],a[39],a[236],a[72],a[219],a[178],a[253],a[188],a[59],a[268],a[86],a[83],a[164],a[52],a[220],a[108],a[276],a[261],a[113],a[192],a[254],a[69],a[157],a[55],a[137],a[67],a[138],a[277],a[150],a[142],a[269],a[103],a[226],a[81],a[49],a[179],a[34],a[247],a[221],a[212],a[78],a[278],a[262],a[93],a[237],a[135],a[291],a[128],a[123],a[129],a[76],a[287],a[106],a[227],a[189],a[131],a[238],a[50],a[64],a[145],a[690],a[193],a[159],a[101],a[288],a[146],a[228],a[203],a[279],a[132],a[154],a[263],a[97],a[171],a[155],a[22],a[208],a[120],a[289],a[116],a[160],a[98],a[31],a[121],a[180],a[194],a[53],a[109],a[85],a[204],a[147],a[122],a[205],a[689],a[292],a[130],a[104],a[47],a[255],a[184],a[264],a[270],a[125],a[265],a[213],a[271],a[73],a[84],a[190],a[19],a[290],a[256],a[35],a[61],a[172],a[280],a[58],a[248],a[174],a[68],a[195],a[206],a[16],a[173],a[27],a[272],a[166],a[151],a[214],a[89],a[95],a[133],a[79],a[229],a[126],a[41],a[152],a[87],a[239],a[273],a[24],a[222],a[17],a[281],a[274],a[249],a[96],a[207],a[181],a[117],a[143],a[74],a[134],a[29],a[196],a[230],a[197],a[21],a[243],a[223],a[156],a[298],a[198],a[282],a[105],a[257],a[215],a[299],a[231]],T=a[166],kb=a[166],Ka=a[24],mb=a[24],zc=c[166],ba={};
var Wa = [{"a":"STRING","jc":"Vb","f":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36"},{"a":"STRING","jc":"ub","f":"zh-CN"},{"a":"NUMBER","jc":"Pa","f":24},{"a":"NUMBER","jc":"Xa","f":1},{"a":"NUMBER","jc":"Qb","f":Math[b[1]]((new Ba)[c[133]]()/a[157]*a[689]+a[56])},{"a":"BOOLEAN","jc":"Kb","f":true},{"a":"BOOLEAN","jc":"xb","f":true},{"a":"BOOLEAN","jc":"ob","f":true},{"a":"BOOLEAN","jc":"Aa","f":false},{"a":"BOOLEAN","jc":"Ab","f":true},{"a":"STRING","jc":"Ra","f":""},{"a":"STRING","jc":"Db","f":"Win32"},{"a":"STRING","jc":"Za","f":"unknown"},{"u":true,"a":"HEX","jc":"Eb","f":"4f520949d168f93a216a3e862fc69be9"},{"a":"HEX","u":true,"T":"CAT_CANVAS","jc":"Ma","f":"65e967974e47cb9f05606e6a32350fe8"},{"a":"BOOLEAN","u":true,"jc":"za","f":false},{"a":"BOOLEAN","jc":"kb","f":true},{"a":"BOOLEAN","jc":"jb","f":false},{"a":"BOOLEAN","jc":"Tb","f":false},{"a":"NUMBER","jc":"Hb","f":2},{"a":"BOOLEAN","jc":"Qa","f":true},{"a":"BOOLEAN","jc":"sb","f":false},{"a":"STRING","jc":"Ba","f":"Mozilla"},{"a":"STRING","jc":"Ca","f":""},{"a":"STRING","jc":"Da","f":"Netscape"},{"a":"STRING","jc":"Ea","f":"5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36"},{"a":"STRING","jc":"vb","f":["zh-CN","zh"]},{"a":"STRING","jc":"Nb","f":""},{"a":"STRING","jc":"Wb","f":""},{"a":"STRING","jc":"Ja","f":""},{"a":"STRING","jc":"Bb","f":""},{"a":"STRING","jc":"$a","f":"CSS1Compat"},{"a":"NUMBER","jc":"hb","f":4},{"a":"ARRAY","jc":"Ib","f":[1920,1080,1920,1040]},{"a":"STRING","Fa":true,"u":true,"jc":"Ha","f":"902f0fe98719b779ea37f27528dfb0aa"}]
var Gb = {
ib: {
f: function() {
// return !!Sa.wc
return true
},
a: A
},
bb: {
f: function() {
var a;
try {
null[0]()
} catch (e) {
a = e
}
return a && typeof a[c[2]] === b[144] ? [b[332], b[264], c[213], c[112], c[85]].filter(function(b) {
return ~a[c[2]].indexOf(b)
})[0] || c[0] : c[0]
},
a: u
},
zb: {
f: function() {
// for (var d = [b[64], b[103], b[181], b[295], c[0], c[0], k[37], c[1], k[7], b[257], {
// q: b[225],
// n: function() {
// try {
// return z[b[225]](c[211]) === a[494] && z[b[107]](z[b[225]](c[251]))
// } catch (d) {
// return !1
// }
// }
// }, {
// q: b[175],
// n: function() {
// try {
// return z[b[175]](b[55]) === a[283] && z[b[107]](z[b[225]](c[251]))
// } catch (d) {
// return !1
// }
// }
// }, {
// q: b[51],
// n: function() {
// try {
// return z[b[51]](c[273]) === c[14]
// } catch (a) {
// return !1
// }
// }
// }, {
// q: b[341],
// n: function() {
// try {
// return z[b[341]](c[279]) === c[18]
// } catch (a) {
// return !1
// }
// }
// }, {
// q: b[111],
// n: function() {
// try {
// return z[b[111]](c[14]) === c[273]
// } catch (a) {
// return !1
// }
// }
// }, {
// q: b[139],
// n: function() {
// try {
// return z[b[139]](c[18]) === c[279]
// } catch (a) {
// return !1
// }
// }
// }, {
// q: b[81],
// n: function() {
// try {
// return z[b[81]](c[18]) === c[279]
// } catch (a) {
// return !1
// }
// }
// }, {
// q: b[336],
// n: function() {
// try {
// return z[b[336]](c[279]) === c[18]
// } catch (a) {
// return !1
// }
// }
// }, {
// q: c[193],
// n: function() {
// try {
// return z[c[193]](b[16]) === a[283]
// } catch (d) {
// return !1
// }
// }
// }, b[183]], e = a[16], g = d.length; e < g; e++) {
// if (d[e].n)
// if (d[e].n())
// continue;
// else
// return e + a[690];
// if (d[e] && !z[d[e]])
// return e + a[690]
// }
// return a[16]
return 0
},
a: y
},
ab: {
f: function() {
var d;
// if (!(d = ka(jd, a[29], void 0)()))
// a: {
// for (var e in x)
// if (x[e]) {
// try {
// if (x[e][b[238]] && e[b[334]] && e[b[334]](/\$[a-z]dc_/)) {
// d = a[311];
// break a
// }
// } catch (g) {}
// d = a[16];
// break a
// }
// d = void 0
// }
// if (!d)
// try {
// d = z[c[192]] && ~z[c[192]].toString().indexOf(b[259]) && a[312]
// } catch (f) {
// d = a[16]
// }
// return d
return 0
},
a: y
},
Sb: {
f: function() {
// return z[c[209]][c[30]] || z[b[184]][c[30]] || a[16]
return 7
},
a: y
},
rb: {
f: function() {
// for (var d = !1, e = x[c[97]](c[280]), g = a[16], f = e.length; g < f; g++) {
// var h = e[g][b[6]];
// if (h && ~h.indexOf(c[244])) {
// d = !0;
// break
// }
// }
// return d
return true
},
a: A
}
}

var Ec = {
nb: {
f: function() {
return Ma(b[80])
},
a: y
},
fb: {
f: function() {
return Ma(c[242])
},
a: y
},
qb: {
f: function() {
return Ma(b[54])
},
a: y
},
Jb: {
f: function() {
return Ma(c[280])
},
a: y
},
lb: {
f: function() {
return z.history.length || a[16]
},
a: y
},
Rb: {
f: function() {
return x[c[215]] || c[0]
},
a: u
},
tb: {
f: function() {
return x.Gc || c[0]
},
a: u
},
Ob: {
f: function() {
return (x[b[141]][c[25]] || x[b[141]][c[15]]).length || a[16]
},
a: y
},
mb: {
f: function() {
return x[b[141]][b[262]].length || a[16]
},
a: y
},
pb: {
f: function() {
return D[b[41]].$[0]
},
a: y
},
gb: {
f: function() {
return D[b[41]].$.slice(a[690])
},
a: H
},
Cb: {
f: function() {
var d = z[b[343]];
if (d) {
var e = d[b[284]];
return [d[c[263]].type, e[b[337]] - e[b[36]], e[b[146]] - e[c[96]]]
}
return [a[16], a[16], a[16]]
},
a: H
},
Oa: {
f: function() {
return [z[k[57]] || x[k[39]][k[42]], z[b[124]] || x[k[39]][b[52]]]
},
a: H
},
Lb: {
f: function() {
return db() ? a[690] : a[17]
},
a: y
},
Yb: {
f: function() {
return D[b[41]][b[195]].Cc
},
a: y
}
}
function Ub(a) {
void 0 === a && (a = []);
return Tb(a, Vc, Wc)
}

function ib(d) {
void 0 === d && (d = c[0]);
d = typeof d === b[144] ? d : String(d);
for (var e = [], g = a[16], t = a[16], m = d.length / a[17]; g < m; g++) {
var h = ma(d.charAt(t++), a[65]) << a[24]
, l = ma(d.charAt(t++), a[65]);
e[g] = C(h + l)
}
return e
}

function ia(d, e) {
var c = (d & a[617]) + (e & a[617]);
return (d >> a[65]) + (e >> a[65]) + (c >> a[65]) << a[65] | c & a[617]
}
function I(d, e, c, b, m, h) {
d = ia(ia(e, d), ia(b, h));
return ia(d << m | d >>> a[98] - m, c)
}

function L(a, e, c, b, m, h, l) {
return I(e & b | c & ~b, a, e, m, h, l)
}

function K(a, e, c, b, m, h, l) {
return I(e & c | ~e & b, a, e, m, h, l)
}
function M(a, e, c, b, m, h, l) {
return I(c ^ (e | ~b), a, e, m, h, l)
}

function $b(d) {
var e, b = [];
b[(d.length >> a[17]) - a[690]] = void 0;
for (e = a[16]; e < b.length; e += a[690])
b[e] = a[16];
var t = d.length * a[43];
for (e = a[16]; e < t; e += a[43])
b[e >> a[29]] |= (d.charCodeAt(e / a[43]) & a[349]) << e % a[98];
d = d.length * a[43];
b[d >> a[29]] |= a[301] << d % a[98];
b[(d + a[166] >>> a[47] << a[24]) + a[61]] = d;
var m, h, l = a[423], p = a[432], f = a[28], k = a[514];
for (d = a[16]; d < b.length; d += a[65])
e = l,
t = p,
m = f,
h = k,
l = K(l, p, f, k, b[d], a[39], a[644]),
k = K(k, l, p, f, b[d + a[690]], a[56], a[698]),
f = K(f, k, l, p, b[d + a[17]], a[67], a[364]),
p = K(p, f, k, l, b[d + a[21]], a[78], a[507]),
l = K(l, p, f, k, b[d + a[24]], a[39], a[118]),
k = K(k, l, p, f, b[d + a[29]], a[56], a[578]),
f = K(f, k, l, p, b[d + a[34]], a[67], a[480]),
p = K(p, f, k, l, b[d + a[39]], a[78], a[599]),
l = K(l, p, f, k, b[d + a[43]], a[39], a[696]),
k = K(k, l, p, f, b[d + a[47]], a[56], a[642]),
f = K(f, k, l, p, b[d + a[50]], a[67], a[439]),
p = K(p, f, k, l, b[d + a[52]], a[78], a[486]),
l = K(l, p, f, k, b[d + a[56]], a[39], a[471]),
k = K(k, l, p, f, b[d + a[58]], a[56], a[522]),
f = K(f, k, l, p, b[d + a[61]], a[67], a[438]),
p = K(p, f, k, l, b[d + a[63]], a[78], a[394]),
l = L(l, p, f, k, b[d + a[690]], a[29], a[536]),
k = L(k, l, p, f, b[d + a[34]], a[47], a[556]),
f = L(f, k, l, p, b[d + a[52]], a[61], a[560]),
p = L(p, f, k, l, b[d], a[74], a[572]),
l = L(l, p, f, k, b[d + a[29]], a[29], a[71]),
k = L(k, l, p, f, b[d + a[50]], a[47], a[451]),
f = L(f, k, l, p, b[d + a[63]], a[61], a[465]),
p = L(p, f, k, l, b[d + a[24]], a[74], a[498]),
l = L(l, p, f, k, b[d + a[47]], a[29], a[539]),
k = L(k, l, p, f, b[d + a[61]], a[47], a[412]),
f = L(f, k, l, p, b[d + a[21]], a[61], a[547]),
p = L(p, f, k, l, b[d + a[43]], a[74], a[30]),
l = L(l, p, f, k, b[d + a[58]], a[29], a[26]),
k = L(k, l, p, f, b[d + a[17]], a[47], a[643]),
f = L(f, k, l, p, b[d + a[39]], a[61], a[240]),
p = L(p, f, k, l, b[d + a[56]], a[74], a[458]),
l = I(p ^ f ^ k, l, p, b[d + a[29]], a[24], a[688]),
k = I(l ^ p ^ f, k, l, b[d + a[43]], a[52], a[490]),
f = I(k ^ l ^ p, f, k, b[d + a[52]], a[65], a[529]),
p = I(f ^ k ^ l, p, f, b[d + a[61]], a[80], a[674]),
l = I(p ^ f ^ k, l, p, b[d + a[690]], a[24], a[574]),
k = I(l ^ p ^ f, k, l, b[d + a[24]], a[52], a[46]),
f = I(k ^ l ^ p, f, k, b[d + a[39]], a[65], a[421]),
p = I(f ^ k ^ l, p, f, b[d + a[50]], a[80], a[499]),
l = I(p ^ f ^ k, l, p, b[d + a[58]], a[24], a[651]),
k = I(l ^ p ^ f, k, l, b[d], a[52], a[477]),
f = I(k ^ l ^ p, f, k, b[d + a[21]], a[65], a[48]),
p = I(f ^ k ^ l, p, f, b[d + a[34]], a[80], a[516]),
l = I(p ^ f ^ k, l, p, b[d + a[47]], a[24], a[682]),
k = I(l ^ p ^ f, k, l, b[d + a[56]], a[52], a[603]),
f = I(k ^ l ^ p, f, k, b[d + a[63]], a[65], a[676]),
p = I(f ^ k ^ l, p, f, b[d + a[17]], a[80], a[487]),
l = M(l, p, f, k, b[d], a[34], a[40]),
k = M(k, l, p, f, b[d + a[39]], a[50], a[582]),
f = M(f, k, l, p, b[d + a[61]], a[63], a[474]),
p = M(p, f, k, l, b[d + a[29]], a[76], a[648]),
l = M(l, p, f, k, b[d + a[56]], a[34], a[680]),
k = M(k, l, p, f, b[d + a[21]], a[50], a[573]),
f = M(f, k, l, p, b[d + a[50]], a[63], a[584]),
p = M(p, f, k, l, b[d + a[690]], a[76], a[437]),
l = M(l, p, f, k, b[d + a[43]], a[34], a[20]),
k = M(k, l, p, f, b[d + a[63]], a[50], a[436]),
f = M(f, k, l, p, b[d + a[34]], a[63], a[479]),
p = M(p, f, k, l, b[d + a[58]], a[76], a[662]),
l = M(l, p, f, k, b[d + a[24]], a[34], a[403]),
k = M(k, l, p, f, b[d + a[52]], a[50], a[552]),
f = M(f, k, l, p, b[d + a[17]], a[63], a[666]),
p = M(p, f, k, l, b[d + a[47]], a[76], a[664]),
l = ia(l, e),
p = ia(p, t),
f = ia(f, m),
k = ia(k, h);
b = [l, p, f, k];
e = c[0];
t = b.length * a[98];
for (d = a[16]; d < t; d += a[43])
e += String.fromCharCode(b[d >> a[29]] >>> d % a[98] & a[349]);
return e
}

function ac(d) {
var e = b[291], g = c[0], f, m;
for (m = a[16]; m < d.length; m += a[690])
f = d.charCodeAt(m),
g += e.charAt(f >>> a[24] & a[63]) + e.charAt(f & a[63]);
return g
}

function bc() {
var d = (new Date)[c[205]]()
, e = Math[b[1]](d / a[520])
, g = d % a[520]
, d = Y(e)
, g = Y(g)
, e = [];
ha(d, a[16], e, a[16], a[24]);
ha(g, a[16], e, a[24], a[24]);
g = [];
for (d = a[16]; d < a[43]; d++)
g[d] = C(Math[b[1]](Math[c[220]]() * a[351]));
for (var d = [], f = a[16]; f < e.length * a[17]; f++) {
if (f % a[17] == a[16]) {
var m = f / a[17];
d[f] = d[f] | (g[m] & a[65]) >>> a[24] | (g[m] & a[98]) >>> a[21] | (g[m] & a[166]) >>> a[17] | (g[m] & a[301]) >>> a[690] | (e[m] & a[65]) >>> a[21] | (e[m] & a[98]) >>> a[17] | (e[m] & a[166]) >>> a[690] | (e[m] & a[301]) >>> a[16]
} else
m = Math[b[1]](f / a[17]),
d[f] = d[f] | (g[m] & a[690]) << a[16] | (g[m] & a[17]) << a[690] | (g[m] & a[24]) << a[17] | (g[m] & a[43]) << a[21] | (e[m] & a[690]) << a[690] | (e[m] & a[17]) << a[17] | (e[m] & a[24]) << a[21] | (e[m] & a[43]) << a[24];
d[f] = C(d[f])
}
e = hb(d);
e = ac($b(cc(aa(e + b[135]))));
e = ib(e.substring(a[16], a[65]));
return Ub(e.concat(d))
}

function Rb(d, e, g, b, m) {
void 0 === g && (g = a[16]);
void 0 === b && (b = Sb);
void 0 === m && (m = eb);
var h, l = [];
switch (g) {
case a[690]:
g = d[e];
h = a[16];
l.push(b[g >>> a[17] & a[161]], b[(g << a[24] & a[131]) + (h >>> a[24] & a[63])], m, m);
break;
case a[17]:
g = d[e];
h = d[e + a[690]];
d = a[16];
l.push(b[g >>> a[17] & a[161]], b[(g << a[24] & a[131]) + (h >>> a[24] & a[63])], b[(h << a[17] & a[157]) + (d >>> a[34] & a[21])], m);
break;
case a[21]:
g = d[e];
h = d[e + a[690]];
d = d[e + a[17]];
l.push(b[g >>> a[17] & a[161]], b[(g << a[24] & a[131]) + (h >>> a[24] & a[63])], b[(h << a[17] & a[157]) + (d >>> a[34] & a[21])], b[d & a[161]]);
break;
default:
throw Error(c[116]);
}
return l.join(c[0])
}

function Tb(d, e, g) {
void 0 === e && (e = []);
void 0 === g && (g = eb);
if (!d)
return null;
if (d.length === a[16])
return c[0];
var b = a[21];
try {
for (var m = [], h = a[16]; h < d.length; )
if (h + b <= d.length)
m.push(Rb(d, h, b, e, g)),
h += b;
else {
m.push(Rb(d, h, d.length - h, e, g));
break
}
return m.join(c[0])
} catch (l) {
throw Error(c[116]);
}
}

function Xb(d) {
void 0 === d && (d = []);
if (!d.length)
return [];
for (var e = [], c = a[16], b = d.length; c < b; c++) {
var m = d[c];
e[c] = Yc[(m >>> a[24] & a[63]) * a[65] + (m & a[63])]
}
return e
}

function Xc(a, e) {
return C(a + e)
}

function Zc(d, e) {
void 0 === d && (d = []);
if (!d.length)
return [];
e = C(e);
for (var c = [], b = a[16], m = d.length; b < m; b++)
c.push(fb(d[b], e));
return c
}

function ad(d, e) {
void 0 === d && (d = []);
if (!d.length)
return [];
e = C(e);
for (var c = [], b = a[16], m = d.length; b < m; b++)
c.push(Xc(d[b], e--));
return c
}

function $c(d, e) {
void 0 === d && (d = []);
if (!d.length)
return [];
e = C(e);
for (var c = [], b = a[16], m = d.length; b < m; b++)
c.push(fb(d[b], e--));
return c
}

function Yb(d, e) {
void 0 === d && (d = []);
if (!d.length)
return [];
e = C(e);
for (var c = [], b = a[16], m = d.length; b < m; b++)
c.push(C(d[b] + e));
return c
}

function bd(d) {
return [[Yb, a[174]], [$c, a[208]], [ad, a[157]], [Zc, a[69]], [Yb, a[250]]].reduce(function(a, d) {
return d[0](a, d[1])
}, d)
}

function fb(a, e) {
return C(C(a) ^ C(e))
}

function gb(d, e) {
void 0 === d && (d = []);
void 0 === e && (e = []);
if (d.length !== e.length)
return [];
for (var g = [], c = a[16], b = d.length; c < b; c++)
g[c] = fb(d[c], e[c]);
return g
}

function jb(d) {
void 0 === d && (d = []);
var e = [];
if (!d.length)
return Wb();
if (d.length >= kb) {
var e = a[16]
, g = kb;
void 0 === d && (d = []);
var b = [];
if (d.length) {
if (d.length < g)
throw Error(c[138]);
for (var m = a[16]; m < g; m++)
b[m] = d[e + m]
}
return b
}
for (g = a[16]; g < kb; g++)
e[g] = d[g % d.length];
return e
}

function Ha(a, e) {
for (var g in e)
!e.hasOwnProperty(g) || (a[g] = e[g]);
return a
}

function ha(d, e, g, b, m) {
void 0 === d && (d = []);
void 0 === g && (g = []);
if (d.length) {
if (d.length < m)
throw Error(c[138]);
for (var h = a[16]; h < m; h++)
g[b + h] = d[e + h]
}
}

function Vb(d) {
var e = [c[36], c[37], c[38], c[40], c[42], c[45], c[47], c[48], c[50], c[51], c[102], c[104], c[106], c[108], c[110], c[113]];
return c[0] + e[d >>> a[24] & a[63]] + e[d & a[63]]
}

function hb(a) {
void 0 === a && (a = []);
return a.map(function(a) {
return Vb(a)
}).join(c[0])
}

function lb(d) {
void 0 === d && (d = []);
var e = b[50], g;
g = [a[16], a[484], a[493], a[659], a[570], a[402], a[626], a[443], a[589], a[691], a[395], a[588], a[627], a[591], a[532], a[45], a[580], a[466], a[675], a[517], a[559], a[304], a[469], a[646], a[622], a[624], a[606], a[427], a[686], a[528], a[310], a[546], a[602], a[33], a[473], a[634], a[417], a[453], a[694], a[504], a[538], a[562], a[183], a[564], a[369], a[632], a[596], a[430], a[640], a[425], a[613], a[455], a[459], a[513], a[488], a[669], a[663], a[586], a[542], a[38], a[524], a[657], a[407], a[567], a[598], a[558], a[54], a[534], a[697], a[637], a[590], a[397], a[408], a[266], a[445], a[629], a[489], a[509], a[660], a[495], a[533], a[683], a[549], a[344], a[628], a[618], a[429], a[608], a[350], a[554], a[649], a[470], a[472], a[575], a[519], a[677], a[635], a[307], a[431], a[597], a[565], a[530], a[566], a[199], a[454], a[404], a[505], a[695], a[37], a[593], a[636], a[475], a[658], a[511], a[568], a[409], a[587], a[654], a[42], a[543], a[518], a[449], a[670], a[491], a[428], a[630], a[456], a[614], a[612], a[426], a[576], a[621], a[308], a[551], a[441], a[537], a[679], a[515], a[653], a[464], a[468], a[652], a[609], a[355], a[399], a[585], a[148], a[687], a[531], a[60], a[393], a[601], a[497], a[656], a[501], a[482], a[625], a[448], a[440], a[416], a[545], a[32], a[667], a[581], a[405], a[571], a[502], a[665], a[616], a[452], a[645], a[422], a[485], a[673], a[442], a[525], a[293], a[563], a[540], a[557], a[594], a[435], a[139], a[641], a[478], a[633], a[605], a[23], a[693], a[510], a[385], a[462], a[650], a[467], a[354], a[447], a[512], a[678], a[463], a[420], a[550], a[306], a[535], a[492], a[424], a[610], a[620], a[36], a[446], a[623], a[414], a[461], a[655], a[496], a[481], a[526], a[57], a[527], a[600], a[415], a[583], a[398], a[685], a[357], a[672], a[483], a[523], a[444], a[450], a[615], a[418], a[647], a[569], a[401], a[661], a[506], a[25], a[544], a[579], a[671], a[508], a[692], a[457], a[396], a[631], a[476], a[18], a[607], a[433], a[592], a[638], a[167], a[561], a[241], a[555], a[541]];
for (var t = a[521], m = a[16], h = d.length; m < h; m++)
t = t >>> a[43] ^ g[(t ^ d[m]) & a[349]];
g = hb(Y(t ^ a[521]));
t = za(g);
g = [];
ha(d, a[16], g, a[16], d.length);
ha(t, a[16], g, g.length, t.length);
d = za(e);
void 0 === g && (g = []);
t = [];
for (e = a[16]; e < mb; e++)
m = Math[c[220]]() * a[351],
m = Math[b[1]](m),
t[e] = C(m);
d = jb(d);
d = gb(d, jb(t));
e = d = jb(d);
var l = g;
void 0 === l && (l = []);
if (l.length) {
g = [];
m = l.length;
h = a[16];
h = m % T <= T - Ka ? T - m % T - Ka : T * a[17] - m % T - Ka;
ha(l, a[16], g, a[16], m);
for (l = a[16]; l < h; l++)
g[m + l] = a[16];
ha(Y(m), a[16], g, m + h, Ka)
} else
g = Wb();
m = g;
void 0 === m && (m = []);
if (m.length % T !== a[16])
throw Error(c[132]);
g = [];
for (var h = a[16], l = m.length / T, p = a[16]; p < l; p++) {
g[p] = [];
for (var f = a[16]; f < T; f++)
g[p][f] = m[h++]
}
m = [];
ha(t, a[16], m, a[16], mb);
t = a[16];
for (h = g.length; t < h; t++) {
l = bd(g[t]);
l = gb(l, d);
p = e;
void 0 === l && (l = []);
void 0 === p && (p = []);
for (var f = [], k = p.length, n = a[16], q = l.length; n < q; n++)
f[n] = C(l[n] + p[n % k]);
l = gb(f, e);
e = Xb(l);
e = Xb(e);
ha(e, a[16], m, t * T + mb, T)
}
return Tb(m, Sb, eb)
}

function ka(a, b, c) {
return function() {
var f, m, h;
c = c || this;
m = J();
f = a.apply(c, arguments);
h = J();
// D.j(qb, {
// cursor: b,
// value: h - m
// });
return f
}
}


// 生成f参数的f参数
function Mb(d) {
if (null === d || d.length === a[16])
return [];
d = typeof d === b[144] ? d : String(d);
for (var e = [], g = a[16], c = a[16], m = d.length / a[17]; c < m; c++) {
var h = ma(d.charAt(g++), a[65]) << a[24]
, l = ma(d.charAt(g++), a[65]);
e[c] = C(h + l)
}
return e
}


function W(){
var g = []
Wa.forEach(function(d) {
function b() {
function a(b, t) {
c[0];
g.push(wa(b, ca[d.jc], !!t));
}
try {
a(d.f)

} catch (t) {
a([], Error(k[64]))
}
}
b()
})
Xa = va(g).reduce(function(a, d) {
a.push.apply(a, d);
return a
}, [])

return Xa
}

function W2(a){
var c = [];
va(Object.keys(a.g)).forEach(function(g) {
N(a.g[g]) === b[315] && va(a.g[g]).forEach(function(a) {
return c.push.apply(c, a)
})
});
return c
}

// 生成h参数
function Fb(a) {
var e = a ? Gb : Ha(Gb, Ec)
, g = [];
try {
va(Object.keys(e)).forEach(function(a) {
var d = e[a].f();
c[0];
g.push.apply(g, wa(d, ca[a]))
})
} catch (b) {}
return g
}

// 生成e参数
function Y(d) {
var e = [];
e[0] = C(d >>> a[82] & a[349]);
e[1] = C(d >>> a[65] & a[349]);
e[2] = C(d >>> a[43] & a[349]);
e[3] = C(d & a[349]);
return e
}

function Nc(a) {
switch (N(a)) {
case b[144]:
return a.replace(/,/g, c[0]);
case k[44]:
return a();
case b[315]:
return a.join(c[0]);
default:
return a
}
}

function C(d) {
if (d < a[300])
return C(a[301] - (a[300] - d));
if (d >= a[300] && d <= a[292])
return d;
if (d > a[292])
return C(a[302] + d - a[292]);
throw Error(c[141]);
}

function fa(d, e) {
return N(d) === b[144] ? d.length > e ? d.slice(a[16], e) : d : N(d) === b[315] ? d.length > e ? d.slice(-e) : d : d
}

function za(d) {
if (null === d || void 0 === d)
return d;
d = aa(d);
for (var e = [], g = a[16], b = d.length; g < b; g++)
if (d.charAt(g) === c[17])
if (g + a[17] < b)
e.push(Mb(d.charAt(++g) + c[0] + d.charAt(++g))[0]);
else
throw Error(c[150]);
else
e.push(C(d.charCodeAt(g)));
return e
}

function wa(d, e, g) {
var t = e.a
, m = e.e
, v = [];
if (!g && (t === A && (v = fa(Y(d ? a[690] : a[17]), m)),
t === y && (v = fa(Y(d), m)),
t === Z && (v = fa(Mb(d), m)),
t === u && (v = za(fa(d, m))),
t === H))
for (g = a[16],
t = d.length; g < t; g++) {
var l = m[g]
, p = d[g];
N(d[g]) === c[262] && v.push.apply(v, fa(Y(p), l));
N(d[g]) === b[144] && v.push.apply(v, za(fa(p, l)))
}
d = fa(Y(e.c), a[17]);
e = fa(Y(v.length), a[17]);
return d.concat(e, v)
}

function N(d) {
return null == d ? String(d) : Sc.call(d).slice(a[43], a[689]).toLowerCase()
}

function va(a) {
for (var e = a.length, g, t; e; )
t = Math[b[1]](Math[c[220]]() * e--),
g = a[e],
a[e] = a[t],
a[t] = g;
return a
}

function Lc() {
return k[18]
}

function F(a) {
try {
return Nb[a]
} catch (e) {}
}

function J() {
return (new Ba)[c[205]]()
}

function Hc(d) {
void 0 === d && (d = a[16]);
d = (new Ba(d))[c[205]]();
return ma(d / a[392], a[50])
}

function Gc() {
var d = a[349];
return ec < d ? ++ec : d
}

function $a(e, g, la, m) {
var d = "YD00001000091119"
, e = e
, g = g
, t = la
, m = m
, d = "YD00001000091119" // d["productNumber"] // "YD00001000091119"
, v = {
Xb: k[58],
Gb: Gc(),
yb: ab(),
Pb: Hc(J() + (D[b[41]].wa || a[16])),
Ka: Ic,
La: t,
Ia: m,
Ub: e,
Ya: g,
Fb: d,
Sa: Jc,
Ta: Kc,
Ua: void 0,
Va: Lc,
Wa: Mc
}
, l = [];
va(Object.keys(v)).forEach(function(d) {
N(v[d]) !== b[232] && (ca[d].c >= a[386] && ca[d].c <= a[390] && (v[d] = Nc(v[d])),
c[0],
l.push.apply(l, wa(v[d], ca[d])))
});
return l
}

// 获取d的值
// d请求返回d_enc参数,但是d请求的请求参数的param_d 是这个获得 ka(lb, a[690], void 0)(e.concat(f, h));
// b请求校验,但是b请求的请求参数的param_d 是这个获得 ka(lb, a[690], void 0)(d.concat(z, x));
function d_param_ga(){
var e = $a("", "", "", "");
var h = Fb(!0);
var f = W();
var f = ka(lb, a[690], void 0)(e.concat(f, h));
return f
}

function b_param_ha(e, g){
var d = $a(e, g, "07e2387ab53a4d6f930b8d9a9be71bdf", bc());
var z = Fb();
var a = {
"g": {
"_move": [[0, 109, 0, 15, 0, 1, 0, 0, 0, 22, 2, 0, 0, 0, 56, 0, 0, 1, -73],
[0, 109, 0, 15, 0, 2, 0, 0, 0, 127, 2, 0, 0, 0, 92, 0, 0, 1, -73],
[0, 109, 0, 15, 0, 3, 0, 0, 0, -25, 2, 0, 0, 0, 112, 0, 0, 1, -73],
[0, 109, 0, 15, 0, 4, 0, 0, 1, 78, 2, 0, 0, 0, 126, 0, 0, 1, -75],
[0, 109, 0, 15, 0, 5, 0, 0, 1, -73, 2, 0, 0, 0, -122, 0, 0, 1, -76],
[0, 109, 0, 15, 0, 6, 0, 0, 2, 87, 2, 0, 0, 0, -112, 0, 0, 1, -76],
[0, 109, 0, 15, 0, 7, 0, 0, 2, -58, 2, 0, 0, 0, -107, 0, 0, 1, -76],
[0, 109, 0, 15, 0, 8, 0, 0, 3, 86, 2, 0, 0, 0, -103, 0, 0, 1, -76],
[0, 109, 0, 15, 0, 9, 0, 0, 3, -42, 2, 0, 0, 0, -98, 0, 0, 1, -76],
[0, 109, 0, 15, 0, 10, 0, 0, 4, -26, 2, 0, 0, 0, -96, 0, 0, 1, -76],
[0, 109, 0, 15, 0, 11, 0, 0, 6, 23, 2, 0, 0, 0, -92, 0, 0, 1, -77],
[0, 109, 0, 15, 0, 12, 0, 0, 6, 126, 2, 0, 0, 0, -89, 0, 0, 1, -78],
[0, 109, 0, 15, 0, 15, 0, 0, 10, 25, 2, 0, 0, 0, -89, 0, 0, 1, -78],
[0, 109, 0, 15, 0, 16, 0, 0, 10, 126, 2, 0, 0, 0, -90, 0, 0, 1, -75],
[0, 109, 0, 15, 0, 17, 0, 0, 11, 22, 2, 0, 0, 0, -94, 0, 0, 1, -70],
[0, 109, 0, 15, 0, 18, 0, 0, 12, 31, 2, 0, 0, 0, -93, 0, 0, 1, -68],
[0, 109, 0, 15, 0, 19, 0, 0, 12, -121, 2, 0, 0, 1, 86, 0, 0, 2, 21]],
"_motion": [],
"_orientation": [],
"_focus": [],
"_blur": [[0, 115, 0, 7, 0, 19, 0, 0, 33, 96, 2]],
"_down": [],
"_up": [[0, 111, 0, 15, 0, 13, 0, 0, 10, 17, 2, 0, 0, 0, -89, 0, 0, 1, -78]],
"_click": [[0, 112, 0, 15, 0, 14, 0, 0, 10, 24, 2, 0, 0, 0, -89, 0, 0, 1, -78]],
"_keydown": []
}
}
var x = W2(a);
var f = ka(lb, a[690], void 0)(d.concat(z, x));
return f
}


// 获取cb的随意值
function ab() {
return k[6].replace(/[xy]/g, function(d) {
var e = Math[c[220]]() * a[65] | a[16];
return (d === c[143] ? e : e & a[21] | a[43]).toString(a[65])
})
}

function get_dd_param(){
var a1 = {
"d": d_param_ga(),
"v": c[166],
"cb": "__wmjsonp_" + ab().slice(2, 9)
}
return a1
}

function get_bd_param(e, g){
var a1 = {
"d": b_param_ha(e, g),
"v": c[166],
"cb": "__wmjsonp_" + ab().slice(2, 9)
}
return a1
}
// console.log("dd_param", get_dd_param())
// console.log("bd_param", get_bd_param("Ghi97IPeOoRERFUAVBc/PbdrZp0F01bd", "AUx5Ub/I7x1AUEBFVEYvPKN/N41ExgbM"))

module.exports = {
Get_DDenc: get_dd_param, // 获取checkid的actoken参数,需传参d_enc
Get_BDenc: get_bd_param, // 获取checkid的actoken参数,需传参d_enc
}

上面b_param_ha方法是b请求的d参数的生成方法

var d = $a(e, g, "07e2387ab53a4d6f930b8d9a9be71bdf", bc());

这里的e、g分别是d请求返回的第3、4个参数值(索引是2、3),在调用时传入,而07e2387ab53a4d6f930b8d9a9be71bdfCaptchaId,与你的具体网站绑定的,不同的网站有不同的CaptchaId,这里使用时也要注意修改,或者也改成参数传入的形式。

a变量里面的”_move”、”_up”、”_click”,”_down”这些是滑动验证码时,你的鼠标做的一些其他操作,这里根据某一次滑动时产生的值来固定写死也是可用的,这个步骤目前还没有严格验证,如果有严格验证也可以搞清楚生成规则,自己写算法每生成随机值。

小结

上面内容比较多,我们来理一下主要的逻辑:

1、check请求的post参数有一个acToken,我们需要知道它是如何生成的;

2、我们通过调试发现,acToken的生成需要这样一个变量a,然后执行La方法生成;

1
2
3
4
5
6
var a = {
"r": 1,
"d": d_enc,
"b": bc()
}
return La(JSON["stringify"](a))

3、a变量有两个属性d和b,d属性是d请求返回结果索引为3的值,b属性是相关Js生成的值;

4、然后我们发现d请求有一个POST参数d,找出生成它的Js方法;

5、只执行完d请求就去生成acToken无法使用,经过观察发现还有一个与d请求很类似的b请求,正好也有一个d参数,其生成方式类似,只是多了一些鼠标验证,这里b和d请求类似一个双重验证,都很重要;

6、执行完d、b请求后就可以生成acToken,进行验证。

整个易盾破解总结

易盾验证码从请求到破解的完整流程代码(仅包含主函数)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
if __name__ == "__main__":
yd = JiangSu()
for _ in range(10):
# 首先发送d请求
d_res2, d_res3 = yd.execute_d_request()
print(d_res2, d_res3)

# 获取验证码链接,包括背景图和滑块
background_url, front_url = yd.get_captcha_url()
# 下载背景图
background_content = yd.download_captcha(background_url)
# 调用深度学习模型识别验证码
distance = yd.get_distance(background_content)
if not distance:
print("模型未识别出目标")
continue
print(distance)

# 然后发送b请求验证d请求
yd.execute_b_request(d_res2, d_res3)
# 生成actoken参数
actoken = yd.get_actoken(d_res3)

# 模拟生成轨迹
trace = yd.get_tracks(distance)
# trace = yd.get_trace_list(distance)
# 生成data参数
data = yd.generate_data(trace, distance)
# 发送验证请求
yd.check_captcha(data, actoken)

经过测试,十次的成功率一般都在九次以上。

关于易盾破解的js方面,一共写了三篇文章,分别讲了fpdatacbacToken的生成过程,以及一些调试、js文件替换和扣js的技巧,整个项目自己完整破解下来,提升很大。

关于图像识别这方面写了两篇文章,分别从传统像素处理角度和深度学习方面来尝试识别缺口位置,还插入了极验的图像破解方法,极验的验证码图片其实比较简单,通过传统像素值方式就可以解决,易盾的话有些图片可以通过模板匹配识别,但是更多的目前已经无法通过模板匹配识别了,所以我也是尝试了使用深度学习目标检测的方式破解,效果还不错。

另外补充一点,图像缺口距离的实际值、jigsaw_style_left以及trace数组的最大值,这三个值是三个独立的值,一开始可能会误让人以为jigsaw_style_left就是图像缺口距离的实际值,这样就会导致后续计算出错,导致成功率较低。这三个值的关系,每个网站可能都会有所不同,需要我们多去测试几组数据,来找到他们的关系。