易盾逆向分析（滑块、点选、无感知）

以你之姓@ 2023-10-13 19:58 31阅读 0赞

易盾破解过两个版本，2.19.1和2.21.3，都是之前整过的，现在升级了，由于工作也不需要，就没有再整过了。2.19.1版本，无感知、滑块、点选都整了一遍，写成公共提供调用。

先看下JAVA代码

package com.xxxx.cccc.web;
    
    import lombok.extern.log4j.Log4j;
    import lombok.extern.log4j.Log4j2;
    
    import java.io.IOException;
    import java.util.HashMap;
    import java.util.Map;
    import java.util.UUID;
    
    import org.apache.http.HttpException;
    import org.jsoup.helper.StringUtil;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.util.StringUtils;
    import org.springframework.web.bind.annotation.RequestBody;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    import org.springframework.web.bind.annotation.RestController;
    
    import com.xxxx.cccc.model.CommonRequest;
    import com.xxxx.cccc.model.ResultModel;
    import com.xxxx.cccc.service.ProxyService;
    import com.xxxx.cccc.util.ExceptionUtil;
    import com.xxxx.cccc.util.YidunCheckRpcUtil;
    import com.xxxx.cccc.util.YidunCheckUtil;
    import com.xxxx.cccc.util.YidunCheckUtil2;
    import com.xxxx.cccc.util.YidunCheckUtil_2_19_1;
    import com.xxxx.cccc.util.YidunCheckUtil_2_21_3;
    //公共服务
    @RestController
    @RequestMapping("/common")
    @Log4j
    public class CommonController {
    	
    	@Autowired
    	ProxyService proxyService;
    	
    
    	/**
         * 易盾-获取滑块验证后的数据-点选
         * 
         * @param papercheckRequest
    	 * @return
         */
        @RequestMapping(value ="/yidun/getCheckData" , method = RequestMethod.POST)
        public ResultModel getCheckData(@RequestBody CommonRequest commonRequest){
        	
        	ResultModel resultModel = null;
        	
            try {
                log.info("易盾-获取滑块验证后的数据-点选,请求入参："+commonRequest);
                if(!commonRequest.checkParam()){
                	 return new ResultModel("-1","输入参数不完整");
                }
                
                int len = 1;//循环次数
                for(int i=0;i<len;i++){
                	log.info("yidun getCheckData 次数："+i);
                	
                	try {
                		resultModel = YidunCheckUtil_2_21_3.getCheckData(null,null);
    					if(resultModel != null && "0".equals(resultModel.getCode())){
    	            		return resultModel;
    	            	}
    				} catch (Exception e) {
    					log.error("error:"+e);
    					log.error(ExceptionUtil.getMessage(e));
    					if(i == 2){
    						return new ResultModel("-1","未知错误");
    					}
    				}
                	
                }
                
                return resultModel;
            } catch (Exception e) {
                log.error(ExceptionUtil.getMessage(e));
                return new ResultModel("-1","未知错误");
            }
        }
        
    	/**
         * 易盾-获取滑块验证后的数据-无感知
         * 
         * @param papercheckRequest
    	 * @return
         */
        @RequestMapping(value ="/yidun/getWgzData" , method = RequestMethod.POST)
        public ResultModel getWgzData(@RequestBody CommonRequest commonRequest){
        	
        	ResultModel resultModel = null;
        	
            try {
                log.info("易盾-获取滑块验证后的数据-无感知,请求入参："+commonRequest);
                if(!commonRequest.checkParam()){
                	 return new ResultModel("-1","输入参数不完整");
                }
                
                int len = 1;//循环次数
                for(int i=0;i<len;i++){
                	log.info("yidun getWgzData 次数："+i);
                	
                	try {
                		resultModel = YidunCheckUtil.getWgzData(proxyService);
    					if(resultModel != null && "0".equals(resultModel.getCode())){
    	            		return resultModel;
    	            	}
    				} catch (Exception e) {
    					log.error(ExceptionUtil.getMessage(e));
    					if(i == 2){
    						return new ResultModel("-1","未知错误");
    					}
    				}
                	
                }
                
                return resultModel;
            } catch (Exception e) {
                log.error(ExceptionUtil.getMessage(e));
                return new ResultModel("-1","未知错误");
            }
        }
        
    	/**
         * 易盾-获取滑块验证后的数据-滑块
         * 
         * @param papercheckRequest
    	 * @return
         */
        @RequestMapping(value ="/yidun/getHuaKuaiData" , method = RequestMethod.POST)
        public ResultModel getHuaKuaiData(@RequestBody CommonRequest commonRequest){
        	
        	ResultModel resultModel = null;
        	
            try {
                log.info("易盾-获取滑块验证后的数据-滑块,请求入参："+commonRequest);
                if(!commonRequest.checkParam()){
                	 return new ResultModel("-1","输入参数不完整");
                }
                
                int len = 1;//循环次数
                for(int i=0;i<len;i++){
                	log.info("yidun getHuaKuaiData 次数："+i);
                	
                	try {
                		resultModel = YidunCheckUtil.getHuaKuaiData(proxyService);
    					if(resultModel != null && "0".equals(resultModel.getCode())){
    	            		return resultModel;
    	            	}
    				} catch (Exception e) {
    					log.error(ExceptionUtil.getMessage(e));
    					if(i == 2){
    						return new ResultModel("-1","未知错误");
    					}
    				}
                	
                }
                
                return resultModel;
            } catch (Exception e) {
                log.error(ExceptionUtil.getMessage(e));
                return new ResultModel("-1","未知错误");
            }
        }
    
    }

import java.io.FileOutputStream;
    import java.net.URLDecoder;
    import java.net.URLEncoder;
    import java.util.ArrayList;
    import java.util.HashMap;
    import java.util.List;
    import java.util.Map;
    import java.util.UUID;
    
    import org.apache.commons.io.IOUtils;
    import org.apache.http.Header;
    import org.apache.http.HttpEntity;
    import org.apache.http.client.methods.CloseableHttpResponse;
    import org.apache.http.client.methods.HttpGet;
    import org.apache.http.impl.client.CloseableHttpClient;
    import org.apache.http.util.EntityUtils;
    import org.eclipse.jetty.util.StringUtil;
    import org.springframework.util.StringUtils;
    
    import com.alibaba.fastjson.JSONObject;
    import com.baidu.aip.util.Base64Util;
    
    import lombok.extern.log4j.Log4j;
    
    /**
     * version 2.17.4
     * 易盾-获取滑块验证后的数据
     * 1.获取图片的fp指纹参数存在浏览器环境校验，校验不过也会正常返回图片，但是会降低通过率，不到10%
     */
    @Log4j
    public class YidunCheckUtil {
    	
    	public static String userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36";
    	
    	public static String ipAddress = JsFrontConstants.nodejsUrl;
    	
    	public static String fpUrl = ipAddress+"/yidun/yzm/fp";
    	public static String cbUrl = ipAddress+"/yidun/yzm/cb";
    	
    	
    	
    	public static String callbackUrl = ipAddress+"/yidun/yzm/callback";
    	public static String getAcTokenUrl = ipAddress+"/yidun/yzm/getAcToken";
    	public static String getMUrl = ipAddress+"/yidun/yzm/getM";
    	public static String getPUrl = ipAddress+"/yidun/yzm/getP";
    	public static String getExtUrl = ipAddress+"/yidun/yzm/getExt";
    	public static String getDataUrl = ipAddress+"/yidun/yzm/getData";
    	public static String getDataForWgzUrl = ipAddress+"/yidun/yzm/getDataForWgz";
    	public static String getTraceUrl = ipAddress+"/yidun/yzm/getTrace";
    	public static String getTraceForWgzUrl = ipAddress+"/yidun/yzm/getTraceForWgz";
    	public static String getCn31StrUrl = ipAddress+"/yidun/yzm/getCn31Str";
    	
    	public static String getDataForHuaKuaiUrl = ipAddress+"/yidun/yzm/getDataForHuakuai";
    	
    	public static String getTraceForHuakuaiUrl = ipAddress+"/yidun/yzm/getTraceForHuakuai?zuobiao=";
    	
    	public static IOcr iOcr = new MachineOcr(); 
    				
        /**
         * 获取滑块验证后的数据-点选
         * @author xxx
         * @param 
         * @return
         */
    	public static ResultModel getCheckData(ProxyService proxyService,List<String> proxyList) throws Exception{
    		ResultModel resultModel = new ResultModel("0","处理成功");
    				
    		HttpClientWrapper hw = null;
    		HttpGet httpGet = null;
    		CloseableHttpResponse execute = null;
    		Header[] headers = null;
    		HttpEntity entity = null;
    		byte[] bytes = null;
    		String result = null;
    		//hw = new HttpClientWrapper(5000,5000, 5000);
    		if(proxyService == null){
    			//hw = new HttpClientWrapper(5000,5000, 5000);
    		}else{
    			log.info("YidunCheckUtil linshi shiong daili...");
    	
    			//hw = proxyService.getClientWithProxy(15000,15000,15000,proxyList);
    		}
    		
    		hw = new HttpClientWrapper(50000,50000, 50000,"127.0.0.1",8888);
    		
    		
    		CloseableHttpClient client = hw.getClient();
    		
    		//1.获取滑块图片地址
    		String fp = JiangsuTaxbureauUtil.getData(fpUrl);
    		
    		//fp = "R/9JR4ti/ydmwA6UEJ41QqUdudp/aeDHkOl44riYGdbc56uundMeNHaleXSyME7P0qAzlLc8IARE+pTmovebBp4hW2lPDq\\\\6olZp0QQx9kzO0wdzYD9214KL\\\\Dc+/KYtCSSvS0eMBqzZiAYONRBq0i09nxtXDf\\\\mDdh2U/ReM3ZZZKt+:1655391775324";
    		//fp = URLEncoder.encode(fp);
    		
    		
    		String cb = JiangsuTaxbureauUtil.getData(cbUrl);
    		String callback = JiangsuTaxbureauUtil.getData(callbackUrl);
    		String url = "https://c.dun.163.com/api/v2/get?referer=https%3A%2F%2Fetax.jiangsu.chinatax.gov.cn%2Fsso%2Flogin&zoneId=CN31&id=1a623022803d4cbc86fa157ec267bb36&fp="+fp+"&https=true&type=undefined&version=2.17.4&dpr=1&dev=1&cb="+cb+"&ipv6=false&runEnv=10&group=&scene=&lang=zh-CN&width=0&audio=false&token=&callback="+callback;
    				
    		httpGet = new HttpGet(url);
    		
    	    httpGet.setHeader("Host","c.dun.163.com");
    	    httpGet.setHeader("Referer","https://etax.jiangsu.chinatax.gov.cn/");
    	    httpGet.setHeader("User-Agent",userAgent);
    	    httpGet.setHeader("Accept","*/*");
    	    httpGet.setHeader("Accept-Encoding","gzip, deflate, br");
    	    httpGet.setHeader("Accept-Language","zh-CN,zh;q=0.9");
    	    httpGet.setHeader("Cache-Control","no-cache");
    	    httpGet.setHeader("Connection","keep-alive");
    	    httpGet.setHeader("Pragma","no-cache");
    	    httpGet.setHeader("sec-ch-ua","\"Chromium\";v=\"92\", \" Not A;Brand\";v=\"99\", \"Google Chrome\";v=\"92\"");
    	    httpGet.setHeader("sec-ch-ua-mobile","?0");
    	    httpGet.setHeader("Sec-Fetch-Dest","script");
    	    httpGet.setHeader("Sec-Fetch-Mode","no-cors");
    	    httpGet.setHeader("Sec-Fetch-Site","cross-site");
    	    
    	    
    		httpGet.setConfig(hw.getRequestConfig());
    		execute = client.execute(httpGet);
    	
    		entity = execute.getEntity();	
    		bytes = EntityUtils.toByteArray(entity);
    		result = new String(bytes,"UTF-8");
    		
    		if(StringUtils.isEmpty(result)){
    			return new ResultModel("-1","获取滑块失败");
    		}
    		
    		result = result.substring(result.indexOf("(")+1,result.indexOf(")"));
    		
    		log.info("YidunCheckUtil getCheckData getYzm result:"+result);
    		
    		JSONObject objJSon = JSONObject.parseObject(result);
    		
    		JSONObject dataJSon = objJSon.getJSONObject("data");
    		String bg = (String)dataJSon.getJSONArray("bg").get(0);//滑块图片
    		String front = dataJSon.getString("front");//点选文本
    		String token = dataJSon.getString("token");
    		String type = dataJSon.getString("type");
    		String zoneId = dataJSon.getString("zoneId");
    				
    		log.info("YidunCheckUtil getCheckData bg:"+bg);
    		log.info("YidunCheckUtil getCheckData front:"+front);
    		log.info("YidunCheckUtil getCheckData token:"+token);
    		
    		if(StringUtils.isEmpty(front)){
    			return new ResultModel("-1","获取滑块失败");
    		}
    		
    		//2.获取图片数据
    		httpGet = new HttpGet(bg);
    		httpGet.setConfig(hw.getRequestConfig());
    		execute = client.execute(httpGet);
    		entity = execute.getEntity();	
    	    bytes = EntityUtils.toByteArray(entity);
    
    		String zuobiao = "";
    		String guiji = "";
            
    		String baseImage = Base64Util.encode(bytes);
    		
    		if(StringUtils.isEmpty(baseImage)){
    			return new ResultModel("-1","获取滑块图片失败");
    		}
    		
    		//3.识别图片
    		String orcData = iOcr.getCodeNormal(baseImage, front);
    		
    		if(StringUtil.isBlank(orcData) || orcData.indexOf("500 Internal Server") >= 0) {
    			return new ResultModel("-1","识别滑块失败");
    		}
    		
    		JSONObject ocrJson = JSONObject.parseObject(orcData);
    		zuobiao = ocrJson.getString("points");
    		guiji = ocrJson.getString("track");
    	        
    	    log.info("YidunCheckUtil getCheckData zuobiao:"+zuobiao);
    	    log.info("YidunCheckUtil getCheckData guiji:"+guiji);
    	     
    	     
    	    //
    	    //调用自己的轨迹算法 测试发现自己的轨迹算法通过率高些
    	    guiji = JiangsuTaxbureauUtil.getData(getTraceUrl+"?urlKey="+zuobiao);
    	        
    	    //System.out.println("my guiji:"+guiji);
    	    
    	     
    	    if(StringUtils.isEmpty(zuobiao) || StringUtils.isEmpty(guiji)){
    			return new ResultModel("-1","识别滑块失败");
    		}
    	    
    	    
    	    url = "https://c.dun.163.com/api/v2/check?referer=https%3A%2F%2Fetax.jiangsu.chinatax.gov.cn%2Fsso%2Flogin&zoneId=CN31&id=1a623022803d4cbc86fa157ec267bb36&width=310&type=3&version=2.17.4&extraData=&bf=0&runEnv=10";
    
    	    httpGet = new HttpGet(url);
    	    
    	    Thread.sleep(100);//故意让程序慢些，避免反爬
    			
    	    //5.校验滑块
    	    url = url +"&token="+token;
    		url = url +"&callback="+JiangsuTaxbureauUtil.getData(callbackUrl);
    		url = url +"&acToken="+JiangsuTaxbureauUtil.getData(getAcTokenUrl);
    		url = url +"&cb="+JiangsuTaxbureauUtil.getData(cbUrl);
    		    
    		String data = JiangsuTaxbureauUtil.getData(getDataUrl+"?guiji="+guiji+"&token="+token+"&zuobiao="+zuobiao);
    		   		    
    		url = url +"&data="+data;
    		log.info("YidunCheckUtil getCheckData url:"+url);
    		    
    		httpGet = new HttpGet(url);
    		httpGet.setHeader("Accept","*/*");
    		httpGet.setHeader("Accept-Encoding","gzip, deflate, br");
    		httpGet.setHeader("Accept-Language","zh-CN,zh;q=0.9");
    	    httpGet.setHeader("Cache-Control","no-cache");
    	    httpGet.setHeader("Connection","keep-alive");
    	    httpGet.setHeader("Pragma","no-cache");
    	    httpGet.setHeader("Referer","https://etax.jiangsu.chinatax.gov.cn/");
    	    httpGet.setHeader("sec-ch-ua","\"Chromium\";v=\"92\", \" Not A;Brand\";v=\"99\", \"Google Chrome\";v=\"92\"");
    	    httpGet.setHeader("sec-ch-ua-mobile","?0");
    	    httpGet.setHeader("Sec-Fetch-Dest","script");
    	    httpGet.setHeader("Sec-Fetch-Mode","no-cors");
    	    httpGet.setHeader("Sec-Fetch-Site","cross-site");
    		httpGet.setHeader("Host","c.dun.163.com");
    		httpGet.setHeader("User-Agent",userAgent);
        
    		httpGet.setConfig(hw.getRequestConfig());
    		execute = client.execute(httpGet);
    		
    		entity = execute.getEntity();	
    	    bytes = EntityUtils.toByteArray(entity);
    	    result = new String(bytes,"UTF-8");
    			
    	    log.info("YidunCheckUtil getCheckData validate result:"+result);
    	    
    	    if(StringUtils.isEmpty(result)){
    			return new ResultModel("-1","校验点选返回为空");
    		}
    	    
    	    result = result.substring(result.indexOf("(")+1, result.indexOf(")"));
    	    JSONObject objJson = JSONObject.parseObject(result);
    	    JSONObject dataJson = objJson.getJSONObject("data");
    	    String validate = dataJson.getString("validate");
    	    if(StringUtils.isEmpty(validate)){
    	    	return new ResultModel("-1","校验点选失败");
    	    }
    	    
    		//3.获取CN31加密串	
        	Map map = new HashMap();
        	map.put("validate", validate);
        	map.put("fp", URLDecoder.decode(fp));
        	ResponseContent response = HttpHelper.postJsonEntity(getCn31StrUrl, JSONObject.toJSONString(map));
        	String cn31Str = response.getContent();
        	log.info("YidunCheckUtil getCheckData cn31Str:"+cn31Str);
    		resultModel.setData(cn31Str);
    		
    		if(StringUtils.isEmpty(cn31Str)){
    	    	return new ResultModel("-1","获取CN31失败");
    	    }
    	    
    		return resultModel;
    	}
    	
        /**
         * 获取滑块验证后的数据-无感知
         * @author bree
         * @param 
         * @return
         */
    	public static ResultModel getWgzData(ProxyService proxyService) throws Exception{
    		
    		ResultModel resultModel = new ResultModel("0","处理成功");
    		Map dataMap = new HashMap();
    		
    		HttpClientWrapper hw = null;
    		HttpGet httpGet = null;
    		CloseableHttpResponse execute = null;
    		Header[] headers = null;
    		HttpEntity entity = null;
    		byte[] bytes = null;
    		String res = null;
    		String result = null;
    		hw = new HttpClientWrapper(5000,5000, 5000);
    		
    		
    		CloseableHttpClient client = hw.getClient();
    		
    		//1.获取验证码
    		String url = "https://c.dun.163.com/api/v2/get?referer=%s&zoneId=CN31&id=cf15aac06ccf490181f29b72fe13c3d4&fp=%s&https=true&type=undefined&width=0&version=2.16.0&dpr=1.25&dev=1&cb=%s&ipv6=false&runEnv=10&group=&scene=&callback=%s";
    		String fp = JiangsuTaxbureauUtil.getData(fpUrl);
    		String cb = JiangsuTaxbureauUtil.getData(cbUrl);
    		String callback = JiangsuTaxbureauUtil.getData(callbackUrl);
    		String referer = "https%3A%2F%2Fetax.hunan.chinatax.gov.cn%2Fwsbs%2FtoLogin.do";
    		url = String.format(url, referer,fp,cb,callback);
    		
    		httpGet = new HttpGet(url);
    		
    	    httpGet.setHeader("Host","c.dun.163.com");
    	    httpGet.setHeader("Referer","https://etax.hunan.chinatax.gov.cn/");
    	    httpGet.setHeader("User-Agent","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36");
    	    httpGet.setHeader("Accept","*/*");
    	    httpGet.setHeader("Accept-Encoding","gzip, deflate, br");
    	    httpGet.setHeader("Accept-Language","zh-CN,zh;q=0.9");
    	    httpGet.setHeader("sec-ch-ua","\"Chromium\";v=\"92\", \" Not A;Brand\";v=\"99\", \"Google Chrome\";v=\"92\"");
    	    httpGet.setHeader("sec-ch-ua-mobile","?0");
    	    httpGet.setHeader("Sec-Fetch-Dest","*/*");
    	    httpGet.setHeader("Sec-Fetch-Mode","no-cors");
    	    httpGet.setHeader("Sec-Fetch-Site","cross-site");
    	    
    	    
    		httpGet.setConfig(hw.getRequestConfig());
    		execute = client.execute(httpGet);
    		
    		entity = execute.getEntity();	
    		bytes = EntityUtils.toByteArray(entity);
    		result = new String(bytes,"UTF-8");
    		
    		log.info("yidun wuganzhi get yzm code:"+result);
    		
    		if(StringUtils.isEmpty(result)){
    			return new ResultModel("-1","获取滑块失败");
    		}
    		
    		result = result.substring(result.indexOf("(")+1,result.indexOf(")"));
    		
    		JSONObject objJSon = JSONObject.parseObject(result);
    		JSONObject dataJSon = objJSon.getJSONObject("data");
    		String error = objJSon.getString("error");
    		String message = objJSon.getString("msg");
    		String token = dataJSon.getString("token");
    		
    		if(!"0".equals(error)){
    			return new ResultModel("-1",message);
    		}
    		
    		Thread.sleep(1000);
    		
    		//2.校验
    		url = "https://c.dun.163.com/api/v2/check?referer=%s&zoneId=CN31&id=cf15aac06ccf490181f29b72fe13c3d4&version=2.16.0&cb=%s&extraData=&bf=0&runEnv=10&token=%s&acToken=%s&type=5&width=438&data=%s&callback=%s";
    		cb = JiangsuTaxbureauUtil.getData(cbUrl);
    		callback = JiangsuTaxbureauUtil.getData(callbackUrl);
    		String acToken = JiangsuTaxbureauUtil.getData(getAcTokenUrl);
    		
    /*		List<String> list = new TraceUtil().getPAndTrace();
    		String zuobiao = list.get(0);
    		String guiji = list.get(1);*/
    		
    		
    		String str  = JiangsuTaxbureauUtil.getData(getTraceForWgzUrl);
    		JSONObject traceJson = JSONObject.parseObject(str);
    		String zuobiao = traceJson.getString("zuobiao");
    		String guiji = traceJson.getString("guiji");;
    		
    		
    	    String data = JiangsuTaxbureauUtil.getData(getDataForWgzUrl+"?guiji="+guiji+"&token="+token+"&zuobiao="+zuobiao);
    
    		url = String.format(url, referer,cb,token,acToken,data,callback);
    		
    		log.info("yidun wuganzhi zuobiao:"+zuobiao);
    		log.info("yidun wuganzhi guiji:"+guiji);
    		log.info("yidun wuganzhi url:"+url);
    		
    		httpGet = new HttpGet(url);
    		
    	    httpGet.setHeader("Host","c.dun.163.com");
    	    httpGet.setHeader("Referer","https://etax.hunan.chinatax.gov.cn/");
    	    httpGet.setHeader("User-Agent","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36");
    	    httpGet.setHeader("Accept","*/*");
    	    httpGet.setHeader("Accept-Encoding","gzip, deflate, br");
    	    httpGet.setHeader("Accept-Language","zh-CN,zh;q=0.9");
    	    httpGet.setHeader("sec-ch-ua","\"Chromium\";v=\"92\", \" Not A;Brand\";v=\"99\", \"Google Chrome\";v=\"92\"");
    	    httpGet.setHeader("sec-ch-ua-mobile","?0");
    	    httpGet.setHeader("Sec-Fetch-Dest","*/*");
    	    httpGet.setHeader("Sec-Fetch-Mode","no-cors");
    	    httpGet.setHeader("Sec-Fetch-Site","cross-site");
    	    httpGet.setHeader("Pragma","no-cache");
    	    
    		httpGet.setConfig(hw.getRequestConfig());
    		execute = client.execute(httpGet);
    		
    		entity = execute.getEntity();	
    		bytes = EntityUtils.toByteArray(entity);
    		result = new String(bytes,"UTF-8");
    		
    		result = result.substring(result.indexOf("(")+1,result.indexOf(")"));
    		
    		log.info("yidun wuganzhi check result:"+result);
    		
    		dataMap.put("checkResult", result);
    		
    		//3.获取CN31加密串			
    		objJSon = JSONObject.parseObject(result);
    		dataJSon = objJSon.getJSONObject("data");
    		boolean resultFlag = dataJSon.getBooleanValue("result");
    		if(resultFlag){
    			String validate = dataJSon.getString("validate");
    	    	Map map = new HashMap();
    	    	map.put("validate", validate);
    	    	map.put("fp", URLDecoder.decode(fp));
    	    	ResponseContent response = HttpHelper.postJsonEntity(getCn31StrUrl, JSONObject.toJSONString(map));
    	    	String cn31Str = response.getContent();
    	    	log.info("cn31Str:"+cn31Str);
    	    	dataMap.put("cn31Str", cn31Str);
    		}else{
    			return new ResultModel("-1","校验失败");
    		}
    		
    		resultModel.setData(dataMap);
    		
    		return resultModel;
    	}
    	
        /**
         * 获取滑块验证后的数据-滑块
         * @author bree
         * @param 
         * @return
         */
    	public static ResultModel getHuaKuaiData(ProxyService proxyService) throws Exception{
    		
    		ResultModel resultModel = new ResultModel("0","处理成功");
    		
    		HttpClientWrapper hw = null;
    		HttpGet httpGet = null;
    		CloseableHttpResponse execute = null;
    		Header[] headers = null;
    		HttpEntity entity = null;
    		byte[] bytes = null;
    		String res = null;
    		String result = null;
    		hw = new HttpClientWrapper(5000,5000, 5000);
    		
    		CloseableHttpClient client = hw.getClient();
    		
    		//1.获取验证码
    		String url = "https://c.dun.163.com/api/v2/get?referer=%s&zoneId=CN31&id=07e2387ab53a4d6f930b8d9a9be71bdf&fp=%s&https=true&type=2&version=2.16.0&dpr=1.25&dev=1&cb=%s&ipv6=false&runEnv=10&group=&scene=&lang=zh-CN&width=320&audio=false&token=&callback=%s";
    		String fp = JiangsuTaxbureauUtil.getData(fpUrl);
    		String cb = JiangsuTaxbureauUtil.getData(cbUrl);
    		String callback = JiangsuTaxbureauUtil.getData(callbackUrl);
    		String referer = "https%3A%2F%2Fdun.163.com%2Ftrial%2Fjigsaw";//如果网站应用了易盾，这里可能需要更改，这里是从官网测试的
    		url = String.format(url, referer,fp,cb,callback);
    		
    		httpGet = new HttpGet(url);
    		
    	    httpGet.setHeader("Host","c.dun.163.com");
    	    httpGet.setHeader("Referer","https://dun.163.com/");//如果网站应用了易盾，这里可能需要更改
    	    httpGet.setHeader("User-Agent","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36");
    	    httpGet.setHeader("Accept","*/*");
    	    httpGet.setHeader("Accept-Encoding","gzip, deflate, br");
    	    httpGet.setHeader("Accept-Language","zh-CN,zh;q=0.9");
    	    httpGet.setHeader("sec-ch-ua","\"Chromium\";v=\"92\", \" Not A;Brand\";v=\"99\", \"Google Chrome\";v=\"92\"");
    	    httpGet.setHeader("sec-ch-ua-mobile","?0");
    	    httpGet.setHeader("Sec-Fetch-Dest","script");
    	    httpGet.setHeader("Sec-Fetch-Mode","no-cors");
    	    httpGet.setHeader("Sec-Fetch-Site","same-site");
    	    
    	    
    		httpGet.setConfig(hw.getRequestConfig());
    		execute = client.execute(httpGet);
    		
    		entity = execute.getEntity();	
    		bytes = EntityUtils.toByteArray(entity);
    		result = new String(bytes,"UTF-8");
    		
    		if(StringUtils.isEmpty(result)){
    			return new ResultModel("-1","获取滑块失败");
    		}
    		
    		result = result.substring(result.indexOf("(")+1,result.indexOf(")"));
    		
    		log.info("yidun huakuai get yzm code:"+result);
    		
    		JSONObject objJSon = JSONObject.parseObject(result);
    		
    		JSONObject dataJSon = objJSon.getJSONObject("data");
    		String bg = (String)dataJSon.getJSONArray("bg").get(0);//滑块背景图片
    		String front = (String)dataJSon.getJSONArray("front").get(0);//缺口图片
    		String token = dataJSon.getString("token");
    		String type = dataJSon.getString("type");
    		String zoneId = dataJSon.getString("zoneId");
    		
    		if(StringUtils.isEmpty(token)){
    			return new ResultModel("-1","获取滑块失败");
    		}
    		
    		log.info("yidun huakuai bg:"+bg);		
    		log.info("yidun huakuai front:"+front);	
    		log.info("yidun huakuai token:"+token);
    		
    		
    		//2.获取配置
    		url = "https://c.dun.163.com/api/v2/getconf?referer=%s&zoneId=&id=07e2387ab53a4d6f930b8d9a9be71bdf&ipv6=false&runEnv=10&type=2&loadVersion=2.2.3&callback=%s";
    		callback = JiangsuTaxbureauUtil.getData(callbackUrl);
    		url = String.format(url,referer,callback);
    		
    		httpGet = new HttpGet(url);
    		
    	    httpGet.setHeader("Host","c.dun.163.com");
    	    httpGet.setHeader("Referer","https://dun.163.com/");//如果网站应用了易盾，这里可能需要更改
    	    httpGet.setHeader("User-Agent","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36");
    	    httpGet.setHeader("Accept","*/*");
    	    httpGet.setHeader("Accept-Encoding","gzip, deflate, br");
    	    httpGet.setHeader("Accept-Language","zh-CN,zh;q=0.9");
    	    httpGet.setHeader("sec-ch-ua","\"Chromium\";v=\"92\", \" Not A;Brand\";v=\"99\", \"Google Chrome\";v=\"92\"");
    	    httpGet.setHeader("sec-ch-ua-mobile","?0");
    	    httpGet.setHeader("Sec-Fetch-Dest","*/*");
    	    httpGet.setHeader("Sec-Fetch-Mode","no-cors");
    	    httpGet.setHeader("Sec-Fetch-Site","same-site");
    	    
    	    
    		httpGet.setConfig(hw.getRequestConfig());
    		execute = client.execute(httpGet);
    		
    		entity = execute.getEntity();	
    		bytes = EntityUtils.toByteArray(entity);
    		result = new String(bytes,"UTF-8");
    		
    		if(StringUtils.isEmpty(token)){
    			return new ResultModel("-1","获取配置失败");
    		}
    		
    		result = result.substring(result.indexOf("(")+1,result.indexOf(")"));
    		
    		log.info("yidun huakuai get config:"+result);		
    		
    		objJSon = JSONObject.parseObject(result);
    		
    		dataJSon = objJSon.getJSONObject("data");
    		JSONObject acJSon = dataJSon.getJSONObject("ac");
    		String acToken = acJSon.getString("token");
    		log.info("yidun huakuai acToken:"+acToken);		
    		
    		//3.获取图片数据
    		httpGet = new HttpGet(bg);
    		httpGet.setConfig(hw.getRequestConfig());
    		execute = client.execute(httpGet);
    		entity = execute.getEntity();	
    	    bytes = EntityUtils.toByteArray(entity);
            
    		String backImage = Base64Util.encode(bytes);
    		
    		httpGet = new HttpGet(front);
    		httpGet.setConfig(hw.getRequestConfig());
    		execute = client.execute(httpGet);
    		entity = execute.getEntity();	
    	    bytes = EntityUtils.toByteArray(entity);
            
    		String frontImage = Base64Util.encode(bytes);
    		
    		//4.识别图片
    		String zuobiao = "";
    		String guiji = "";
    		
    		zuobiao = iOcr.getX(backImage, frontImage);
    		
    		if(StringUtils.isEmpty(zuobiao)){
    			return new ResultModel("-1","识别坐标失败");
    		}
    		
    		log.info("yidun huakuai zuobiao:"+zuobiao);		
    		
    		//5.获取轨迹
    		String str  = JiangsuTaxbureauUtil.getData(getTraceForHuakuaiUrl+zuobiao);
    		JSONObject traceJson = JSONObject.parseObject(str);
    		guiji = traceJson.getString("guiji");
    		String zhZuobiao = traceJson.getString("zhZuobiao");//转换坐标
    		
    		log.info("yidun huakuai zhuanhuanhou zuobiao:"+zhZuobiao);		
    		log.info("yidun huakuai guiji:"+guiji);		
    		
    		Thread.sleep(1000);
    		
    		//6.校验
    		url = "https://c.dun.163.com/api/v2/check?referer=%s&zoneId=CN31&id=07e2387ab53a4d6f930b8d9a9be71bdf&token=%s&acToken=%s&data=%s&width=320&type=2&version=2.16.0&cb=%s&extraData=&bf=0&runEnv=10&callback=%s";
    		cb = JiangsuTaxbureauUtil.getData(cbUrl);
    		callback = JiangsuTaxbureauUtil.getData(callbackUrl);
    		//String acToken = JiangsuTaxbureauUtil.getData("http://127.0.0.1:7002/yidun/yzm/getAcToken");
    			
    	    String data = JiangsuTaxbureauUtil.getData(getDataForHuaKuaiUrl+"?guiji="+guiji+"&token="+token+"&zuobiao="+zuobiao);
    
    		url = String.format(url, referer,token,acToken,data,cb,callback);
    		
    		log.info("yidun huakuai request url:"+url);		
    		
    		httpGet = new HttpGet(url);
    		
    	    httpGet.setHeader("Host","c.dun.163.com");
    	    httpGet.setHeader("Referer","https://dun.163.com/trial/jigsaw");
    	    httpGet.setHeader("User-Agent","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36");
    	    httpGet.setHeader("Accept","*/*");
    	    httpGet.setHeader("Accept-Encoding","gzip, deflate, br");
    	    httpGet.setHeader("Accept-Language","zh-CN,zh;q=0.9");
    	    httpGet.setHeader("sec-ch-ua","\"Chromium\";v=\"92\", \" Not A;Brand\";v=\"99\", \"Google Chrome\";v=\"92\"");
    	    httpGet.setHeader("sec-ch-ua-mobile","?0");
    	    httpGet.setHeader("Sec-Fetch-Dest","*/*");
    	    httpGet.setHeader("Sec-Fetch-Mode","no-cors");
    	    httpGet.setHeader("Sec-Fetch-Site","cross-site");
    	    httpGet.setHeader("Pragma","no-cache");
    	    
    		httpGet.setConfig(hw.getRequestConfig());
    		execute = client.execute(httpGet);
    		
    		entity = execute.getEntity();	
    		bytes = EntityUtils.toByteArray(entity);
    		result = new String(bytes,"UTF-8");
    		
    		log.info("yidun huakuai check result:"+result);		
    		
    		result = result.substring(result.indexOf("(")+1,result.indexOf(")"));
    		
    		resultModel.setData(result);
    
    		return resultModel;
    	}
    	
    	public static String setCookie(String cookieStr,Header[] headers){
    		
    		for(Header header: headers){
    		    if("set-cookie".equals(header.getName().toLowerCase())){
    		    	 cookieStr += header.getValue() + "; ";
    		    }
    		}
    		
    		return cookieStr;
    	}
    }

签名破解使用了补环境方式，采用VM2执行

![a1c207e00a59451ab0426bb36347b105.png][]

补环境是在志远框架上进行了补充编写的。调用的服务层是自己编写。

如有问题，或者需要补环境改进版，请私信！

xObP8s/gudi/zrPMoaJKU7K5u7e+s7/Os8yhokpBVkHP4LnYv86zzMjn0OjSqtKyv8nS1MGqz7VRUaGjDQoNCtf31d8gUVEgNDA0NTQwMjI5

**纯技术交流，请勿用于非法用途,如有权益问题可以发私信联系我删除.**

[a1c207e00a59451ab0426bb36347b105.png]: https://img-blog.csdnimg.cn/a1c207e00a59451ab0426bb36347b105.png