瑞数6逆向#

1
delete __filename
2
delete __dirname

1
window = globalThis;
2
window.top = window
3
window.self = window

1
console.log(window.top.toString())
2
输出：[object global]
3
正常是 [object Window]

1
window.DOMParser = function(){}
2
window.XMLHttpRequest = function(){}
3
window.attachEvent=function(){}
4
//window上不该有的属性
5
window.clearImmediate=undefined
6
window.setImmediate=undefined

1
console.log("createElement设置了————",tagname)
2
        if(tagname==="div"){
3
            newdiv = new HTMLDivElement({
4
                style:watch(new CSSStyleDeclaration({},null,"fatdog"),'div————style'),
5
                addBehavior:undefined
6
            },null,'fatdog');
7
            return watch(newdiv,"createElement.div")
8
        }
9
        if(tagname==="script"){
10
            newscript = new HTMLScriptElement({
11
                parentElement: watch(new HTMLBodyElement({},null,'fatdog'),'script.parentElement')
12
            },null,"fatdog")
13
            return watch(newscript,"Document的createElement————script")
14
        }
15
        if(tagname==='media'){
16
            newmedia = new HTMLUnknownElement({},null,"fatdog")
17
            return watch(newmedia,"Document的createElement————media")
18
        }
19
        if(tagname==="canvas"){
20
            newcanvas = new HTMLCanvasElement({},null,"fatdog")
21
            return watch(newcanvas,"Document的createElement————canvas")
22
        }

1
getItem: function(key) {
2
        console.log('localStorage.getItem获取', key);
3
        if(key==="_$rc"){
4
            return  ".UKKtb.H2PscONI9xfCccezbS1Nca.q9cl2b8S_qE0DqrTPJ4xMjeFEmtZ9rhFa6nqIYgKpkoA55_BxyWVLCNTw3IN7AYgX5U7Jxy04Pwjiz3TbLGNN72ji8bl0Hf18X_rW_4O0FFjPEarj7WVOSQMpZ0_BhOUMieKWbcGEkVRYoVQydrKHfiIqZRGOxljGdxBw36SHGCjOMjpbf8hwzvcTxEvVP5NIXMiJzB96a.7qjFu.pvESgvQ2ps19Kf5s0jt2QdqNSTnPMVmD1MGxs6PnW5fN2zHiVXD4MhszlQ72B0NEiAN.xR5mxVltC6fbxuw1Rgr7q0h0cEQQxpUhxDNqR6rHd_cCDhFa70JrH.I3MW4GhOYNHKGODp1KGzIH8A7DR.VBf8QD8oyjZAHZnTkLBohlaODnLhST4lf9wqhU3Sh48vVhCbnOxje2zw8mN7p52fIwBPuYTQPp6kMxBfijLFwscFx7w5Nxpsx2JQCa055nm6w2hRuW1zLQ8LdDWfB3ctuqOaKDc.XDkdtx2HBy27rQ4IHCrE_T7W.O8infAVOiwIweip0MamzvSRqrbfVuvEO9t.X.mXGRu1keI_crdI0Klqa10rbMEUndJ5feDOzNZMI7gOLBa43DcafK5hkFLcEK9Plmob70q39N_WHlgASgs7ZWpsbSVt0ZqAgPfhSR9BZ7rYwnIQG9pw6Gls4rxDtejoQvj6xnVeGsOoXEQPuenJaaIY6TYbyox22Yt7ZTBmixbtcIq0OFAei0uV3Y_hq"
5
        }
6
        if(key==='$_YWTU'){
7
            return "Joe4xOav_FW3MoVBdxofXRWV7wZXvJLeKqGfP3J6mSq"
8
        }
9
        return this[key] || null;
10
    },
11
    setItem: function(key, value) {
12
        console.log('localStorage.setItem设置', key, value);
13
        this[key] = String(value);
14
    },
15
    removeItem: function(key) {
16
        console.log('localStorage.removeItem删除', key);
17
        // delete this._data[key];
18
        delete this[key];
19

20
    },

1
Document的getElementById访问———— K5MK4FPPNWrv
2
对象=>window,读取属性:__meta_content,值为:undefined,类型为:undefined

1
getElementById:function(id){
2
    console.log("Document的getElementById访问————",id)
3
    if(id==='K5MK4FPPNWrv'){
4
        return {
5
        tagName: 'META',
6
        nodeName: 'META',
7
        nodeType: 1,
8
        id: 'K5MK4FPPNWrv',
9

10

11
        getAttribute: function(name) {
12
            console.log('meta.getAttribute:', name);
13
            if (name === 'content') return window.__meta_content || '';
14
            if (name === 'r') return 'm';
15
            return null;
16
        },

1
对象=>window.location,读取属性:protocol,值为:http:,类型为:string
2
对象=>window.location,读取属性:port,值为:,类型为:string
3
对象=>window.location,读取属性:pathname,值为:/Index,类型为:string
4
对象=>window.location,读取属性:href,值为:http://epub.cnipa.go...,类型为:string
5
对象=>window.location,读取属性:hostname,值为:epub.cnipa.gov.cn,类型为:string
6
对象=>window.location,读取属性:host,值为:epub.cnipa.gov.cn,类型为:string
7
对象=>window.location,读取属性:hash,值为:,类型为:string

1
console.log(navigator.toString())
2
[object Object]
3

4
正常浏览器则是：
5
[object Navigator]

1
delete globalThis.navigator;
2
提前干掉再重写tostring

1
对象=>navigator.mimetypes,读取属性:Symbol(Symbol.toPrimitive),这是一个名为 value 的函数
2
对象=>window.navigator,读取属性:mimeTypes,值为:[MimeTypeArray Insta...,类型为:object
3
对象=>navigator.mimetypes,读取属性:application/x-shockwave-flash,值为:undefined,类型为:undefined

1
对象=>window,读取属性:history,值为:[History Instance],类型为:object

1
对象=>window,枚举属性,共 246 个属性:Object, Function, Ar...
2
对象=>window,读取属性:chrome,值为:[object Object],类型为:object
3
对象=>window,读取属性:innerHeight,值为:937,类型为:number
4
对象=>window,读取属性:innerWidth,值为:1920,类型为:number
5
对象=>window,读取属性:outerHeight,值为:1080,类型为:number
6
对象=>window,读取属性:outerWidth,值为:1920,类型为:number

1
from requests import session
2
import subprocess
3
from functools import partial
4
from lxml import etree
5
# 解决 Windows 编码问题
6
subprocess.Popen = partial(subprocess.Popen, encoding='utf-8')
7
import execjs
8
print(execjs.get().name)  # 确保能正常运行
9
session = session()
10

11
headers = {
12
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
13
    "Accept-Language": "zh-CN,zh;q=0.9",
14
    "Cache-Control": "no-cache",
15
    "Connection": "keep-alive",
16
    "Pragma": "no-cache",
17
    "Referer": "http://epub.cnipa.gov.cn/Index",
18
    "Upgrade-Insecure-Requests": "1",
19
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"
20
}
21
cookies = {
22
    ".AspNetCore.Antiforgery.VJ9V3gR6RkM": "CfDJ8GGednQOsIdApgbnJzxrfmpElwAs9LpOHnRvKT9pguad0a86F-_7Ely7LiH0-hqNexhyJvRoAd4N6wWRbLLLRMqN4DzjAfibTTyA8CZSReecclfaeTYjnZMuBKdOaMedO8NvAkgKh3EevB29uhuuIrQ",
23
    "WEB": "20111132",
24
    }
25
old_url ='http://epub.cnipa.gov.cn'
26
url = "http://epub.cnipa.gov.cn/Index"
27
response = session.get(url, headers=headers, cookies=cookies, verify=False)
28
html = response.text
29
# print(response.text)
30
print(response)
31
print("Session中的Cookie:", session.cookies.get_dict())
32
# 解析HTML
33
tree = etree.HTML(html)
34

35
code = ''
36
# ✅ 用XPath精确提取
37
content = tree.xpath('//meta[@id="K5MK4FPPNWrv"]/@content')
38
if content:
39
    content = content[0]
40
    # print("提取到content:", content)
41

42
# 找到包含 $_ts.cd 的script标签，提取全部文本内容
43
scripts = tree.xpath('//script[contains(text(), "$_ts.cd")]/text()')
44
if scripts:
45
    script_content = scripts[0]
46
    # print(script_content)
47
# 提取包含 "z5gPWiiwO6ht" 的script的src
48
js_src = tree.xpath('//script[contains(@src, "z5gPWiiwO6ht")]/@src')[0]
49
# print("JS src:", js_src)
50

51
# 拼接完整URL
52
full_js_url = old_url + js_src
53
print("完整URL:", full_js_url)
54

55
res = session.get(full_js_url, headers=headers, cookies=cookies, verify=False)
56
code=code+script_content+'\n'+res.text
57

58
# print(code)
59

60
with open('./main.js', 'r', encoding='utf-8') as f:
61
    js_code = f.read()
62
ctx = execjs.compile(js_code.replace('"{{meta_content}}"', f'"{content}"').replace('debugger;',code))
63
cookie_d = ctx.call('get_cookie')
64

65

66
parts = cookie_d.split(';')[0]  # "NOh8RTWx6K2dT=0HMyeuSMq..."
67
name, value = parts.split('=', 1)  # 只按第一个=分割
68

69

70
session.cookies.update({name: value})
71
response = session.get(url, headers=headers, cookies=cookies, verify=False)
72
# print(response.text)
73
print(response)