脚本1

前半部分是脚本后面是补的环境

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
function getEnvs(proxyObjs) {
    for (let i = 0; i < proxyObjs.length; i++) {
        const handler = `{
      get: function(target, property, receiver) {
        console.log("方法:", "get  ", "对象:", "${proxyObjs[i]}", "  属性:", property, "  属性类型：", typeof property, ", 属性值：", target[property], ", 属性值类型：", typeof target[property]);
        return target[property];
      },
      set: function(target, property, value, receiver) {
        console.log("方法:", "set  ", "对象:", "${proxyObjs[i]}", "  属性:", property, "  属性类型：", typeof property, ", 属性值：", value, ", 属性值类型：", typeof target[property]);
        return Reflect.set(...arguments);
      }
    }`;
        eval(`try {
            ${proxyObjs[i]};
            ${proxyObjs[i]} = new Proxy(${proxyObjs[i]}, ${handler});
        } catch (e) {
            ${proxyObjs[i]} = {};
            ${proxyObjs[i]} = new Proxy(${proxyObjs[i]}, ${handler});
        }`);
    }
}


window = global;
delete global;
delete Buffer;

proxyObjs = ['window', 'document', 'location', 'navigator', 'history', 'screen']
getEnvs(proxyObjs);
requestAnimationFrame = function requestAnimationFrame() {
}
// 分割线 #################################################################################
_sdkGlueVersionMap = {
    "sdkGlueVersion": "1.0.0.55",
    "bdmsVersion": "1.0.1.7",
    "captchaVersion": "4.0.2"
}
XMLHttpRequest = function XMLHttpRequest() {
}
fetch = function fetch() {
}

window.onwheelx = {
    "_Ax": "0X21"
}

navigator.vendorSubs = {
    "ink": 1734165618552
}

window.innerWidth = 1011
window.innerHeight = 959
window.outerWidth = 1920
window.outerHeight = 1020
window.screenX = -291
window.screenY = -1080
window.pageYOffset = 51
window.pageXOffset = 0

screen = {
    availHeight: 1040,
    availLeft: 0,
    availTop: 0,
    availWidth: 1920,
    colorDepth: 24,
    height: 1080,
    pixelWidth:24,
}
navigator.platform = "Win32"
navigator.userAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36'
document.referrer ='https://www.toutiao.com/'
document.cookie = '__ac_signature=_02B4Z6wo00f01W3Q6sQAAIDC0AAK3sXordlt8O5AADwtf8; gfkadpd=24,6457; ttcid=68bece3ff08a4cf98cfc9f0b60c9912716; x-web-secsdk-uid=be52d38f-1a5d-4b56-80d3-d8599adecf42; _ga=GA1.1.241337849.1734165486; s_v_web_id=verify_m4nxcsme_XjHXqzvc_dnFm_4lKs_8GO7_hr7PIRG4FwcP; tt_scid=SrPBXFP1aP94ytN4Xlr4qogO4YQ7lY8G465DusvN8idjEH0w1xir-uAz33YqVMfydbd7; local_city_cache=%E7%9F%B3%E5%AE%B6%E5%BA%84; csrftoken=09332eb9c5647c2fd30828b41b206d3a; _ga_QEHZPBE5HH=GS1.1.1734165485.1.0.1734165548.0.0.0'




脚本2：

引入了一个显示框架，中间部分是补的环境

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
// dy_env.js
debugger;
;
catvm = {}
catvm.memory = {log: []};

catvm.proxy = function (obj) {
    // Proxy 可以多层代理，即 a = new proxy(a); a = new proxy(a);第二次代理
    // 后代理的检测不到先代理的

    return new Proxy(obj, {
        set(target, property, value) {
            console.table([{"类型":"set-->","调用者":target,"调用属性":property,"设置值":value}]);
            catvm.memory.log.push({"类型":"set-->","调用者":target,"调用属性":property,"设置值":value});
            // console.log("set", target, property, value);
            return Reflect.set(...arguments); //这是一种反射语句，这种不会产生死循环问题
        },
        get(target, property, receiver) {
            console.table([{"类型":"get<--","调用者":target,"调用属性":property,"获取值":target[property]}]);
            catvm.memory.log.push({"类型":"get<--","调用者":target,"调用属性":property,"获取值":target[property]});
            // console.log("get", target, property, target[property]);
            return target[property];  // target中访问属性不会再被proxy拦截，所以不会死循环
        }
    });
}

// 以下开始补环境###############################################
window = global;
delete global;
delete Buffer;

requestAnimationFrame = function requestAnimationFrame() {
}
_sdkGlueVersionMap = {
    "sdkGlueVersion": "1.0.0.55",
    "bdmsVersion": "1.0.1.7",
    "captchaVersion": "4.0.2"
}
XMLHttpRequest = function XMLHttpRequest() {
}
onwheelx = {
    "_Ax": "0X21"
}
fetch = function fetch() {
}

window.innerWidth = 1011
window.innerHeight = 959
window.outerWidth = 1920
window.outerHeight = 1020
window.screenX = -291
window.screenY = -1080
window.pageYOffset = 51

screen = {
    availHeight: 1040,
    availLeft: 0,
    availTop: 0,
    availWidth: 1920,
    colorDepth: 24,
    height: 1080,
}


navigator = class navigator{}
navigator.platform = 'Win32'
navigator.userAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36'
document = class document{}

// 显示调用#########################
window = catvm.proxy(window)
navigator = catvm.proxy(navigator)
document = catvm.proxy(document)