抖音a_bogus参数加密逆向#

window = global;
console_log = console.log;

// -------------------------- 第一步：函数Native伪装 --------------------------
(() => {
  'use strict';
  const $toString = Function.toString;
  // 随机生成Symbol，避免冲突
  const fakeNativeTag = Symbol('('.concat('', ')_', (Math.random() + '').toString(36)));

  // 自定义toString：优先返回伪造的native标签
  const myToString = function () {
    return (typeof this === 'function' && this[fakeNativeTag]) || $toString.call(this);
  };

  // 安全修改原型对象的工具函数
  function set_native(obj, key, value) {
    Object.defineProperty(obj, key, {
      enumerable: false,
      configurable: true,
      writable: true,
      value: value
    });
  }

  // 替换全局Function的toString
  delete Function.prototype['toString'];
  set_native(Function.prototype, 'toString', myToString);
  // 保护自定义toString本身不被检测
  set_native(Function.prototype.toString, fakeNativeTag, 'function toString() { [native code] }');

  // 导出「一键伪装原生函数」的工具
  globalThis.safefunction = (func) => {
    set_native(func, fakeNativeTag, `function ${func.name || ''}() { [native code] }`);
  };
}).call(globalThis);

// -------------------------- 第二步：补全基础全局API --------------------------
// 必须伪装的定时器/异步API
setInterval = function setInterval(){}; safefunction(setInterval);
setTimeout = function setTimeout(){}; safefunction(setTimeout);
window.requestAnimationFrame = function requestAnimationFrame(){}; safefunction(window.requestAnimationFrame);
window.addEventListener = function addEventListener(){}; safefunction(window.addEventListener);

// 窗口/屏幕尺寸（尽量匹配真实浏览器）
window.outerWidth = 1920;
window.outerHeight = 1040;
window.innerWidth = 1920;
window.innerHeight = 937;

// 字节跳动安全SDK版本信息
window._sdkGlueVersionMap = {
    "sdkGlueVersion": "1.0.0.64-fix.01",
    "bdmsVersion": "1.0.1.19-fix.01",
    "captchaVersion": "4.0.10"
};

// -------------------------- 第三步：补全DOM与第三方SDK --------------------------
// DOM基础元素
span = {classList: {}};
canvas = {getContext: function getContext(){}}; safefunction(canvas.getContext);
document = {
  createElement: function (tag) {
    if (tag === 'span') return span;
    if (tag === 'canvas') return canvas;
    console_log('未处理的DOM元素创建:', tag);
    return {};
  },
  documentElement: {},
  createEvent: function createEvent(){}, safefunction(document.createEvent),
  addEventListener: function addEventListener(){}, safefunction(document.addEventListener),
  all: {},
  location: {
    "ancestorOrigins": {},
    "href": "https://www.douyin.com/",
    "origin": "https://www.douyin.com",
    "protocol": "https:",
    "host": "www.douyin.com"
  }
};
safefunction(document.createElement);

// 第三方SDK模拟（抖音可能检测插件或开发环境）
window.CefSharp = { isMock: true, BindObjectAsync: () => Promise.resolve() };
window.eoapi = { mock: true, invoke: () => {} };

// -------------------------- 第四步：补全其他浏览器对象并伪装toStringTag --------------------------
location = document.location;
navigator = {
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
  "platform": "Win32",
  "storage": {}
};
history = {};
screen = {availWidth: 1920, availHeight: 1040, width: 1920, height: 1080, colorDepth: 24};
localStorage = {getItem: () => {}, setItem: () => {}}; safefunction(localStorage.getItem);
sessionStorage = {};

// 伪装Symbol.toStringTag，绕过Object.prototype.toString.call的检测
const fakeToStringTag = (obj, tag) => {
  Object.defineProperty(obj, Symbol.toStringTag, {
    value: tag,
    configurable: true,
    writable: true
  });
};
fakeToStringTag(document, 'HTMLDocument');
fakeToStringTag(location, 'Location');
fakeToStringTag(navigator, 'Navigator');
fakeToStringTag(history, 'History');
fakeToStringTag(screen, 'Screen');
fakeToStringTag(localStorage, 'Storage');
fakeToStringTag(sessionStorage, 'Storage');

// -------------------------- 第五步：动态代理兜底（按需补全bdms访问的属性） --------------------------
function createProxy(objName) {
  return new Proxy(window[objName] || {}, {
    get(target, prop) {
      console_log(`[GET] 对象: ${objName}, 属性: ${String(prop)}`);
      return Reflect.get(target, prop);
    },
    set(target, prop, val) {
      console_log(`[SET] 对象: ${objName}, 属性: ${String(prop)}, 值: ${JSON.stringify(val)}`);
      return Reflect.set(target, prop, val);
    }
  });
}
// 只代理核心被访问的对象，减少性能损耗
['window', 'document', 'location', 'navigator', 'screen'].forEach(name => {
  window[name] = createProxy(name);
});

// -------------------------- 第六步：注入bdms并初始化 --------------------------
require('./bdms'); // 从抖音页面提取的bdms代码保存为bdms.js
window.bdms.init({
  aid: 6383, // 抖音Web应用ID
  pageId: 6241, // 页面ID
  paths: ['^/webcast/', '^/aweme/v1/'], // 需要加密的接口路径
  boe: false,
  ddrt: 8.5,
  ic: 8.5
});

// -------------------------- 第七步：模拟XHR请求触发a_bogus生成 --------------------------
XMLHttpRequest = function XMLHttpRequest() {};
safefunction(XMLHttpRequest);
XMLHttpRequest.prototype.send = function send() {
  // 加密后a_bogus会挂载到window上
  console_log('触发XHR.send，等待加密...');
};
safefunction(XMLHttpRequest.prototype.send);

function get_ab(fullUrlWithParams) {
  const xhr = new XMLHttpRequest();
  // bdms会读取这两个数组获取请求信息
  xhr.bdmsInvokeList = [
    { args: ['GET', fullUrlWithParams, true] },
    { args: ['Accept', 'application/json, text/plain, */*'] }
  ];
  xhr.invokeList = [
    { name: 'addEventListener', args: ['load', null] },
    { name: 'addEventListener', args: ['error', null] }
  ];
  xhr.send(null);
  return window.a_bogus;
}