绕过web端定时操作检测

t0rjan · Jun 19, 2023 · 6f5ae16 · 6f5ae16
1 parent 72e25b5
commit 6f5ae16
Showing 1 changed file with 39 additions and 2 deletions.
diff --git a/BarrageGrab/Proxy/TitaniumProxy.cs b/BarrageGrab/Proxy/TitaniumProxy.cs
@@ -8,6 +8,7 @@
 using System.Security.Cryptography;
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
+using System.Text.RegularExpressions;
 using System.Threading.Tasks;
 using BarrageGrab.Proxy.ProxyEventArgs;
 using Microsoft.Win32;
@@ -47,7 +48,7 @@ public TitaniumProxy()
             proxyServer.AfterResponse += ProxyServer_AfterResponse;
 
             explicitEndPoint = new ExplicitProxyEndPoint(IPAddress.Any, ProxyPort, true);
-            explicitEndPoint.BeforeTunnelConnectRequest += ExplicitEndPoint_BeforeTunnelConnectRequest;
+            explicitEndPoint.BeforeTunnelConnectRequest += ExplicitEndPoint_BeforeTunnelConnectRequest;            
             proxyServer.AddEndPoint(explicitEndPoint);
         }
 
@@ -73,22 +74,58 @@ private Task ProxyServer_ServerCertificateValidationCallback(object sender, Cert
             if (e.SslPolicyErrors == SslPolicyErrors.None)
             {
                 e.IsValid = true;
-            }
+            }            
             return Task.CompletedTask;
         }
 
         private async Task ProxyServer_BeforeResponse(object sender, SessionEventArgs e)
         {
+            string uri = e.HttpClient.Request.RequestUri.ToString();
             string hostname = e.HttpClient.Request.RequestUri.Host;
             if (e.HttpClient.ConnectRequest?.TunnelType == TunnelType.Websocket)
             {
                 e.DataReceived += WebSocket_DataReceived;
             }
+
+            //判断响应内容是否为js application/javascript
+            if (e.HttpClient.Response.ContentType != null &&
+                e.HttpClient.Response.ContentType.Trim().ToLower().Contains("application/javascript") &&
+                hostname == "lf-cdn-tos.bytescm.com"
+                )
+            {
+                var js = await e.GetResponseBodyAsString();
+
+                //修改js,绕过页面无操作检测
+                var reg1 = new Regex(@"start\(\)\{Dt\.enable\(\),this\.tracker&&this\.tracker\.enable\(\)\}");
+                var match = reg1.Match(js);
+                if (match.Success)
+                {
+                    js = reg1.Replace(js, "start(){return;Dt.enable(),this.tracker&&this.tracker.enable()}");
+                    e.SetResponseBodyString(js);
+                    return;
+                }
+
+                var reg2 = new Regex(@"if\(!N.DJ\(\)&&(?<variable>\S).current\)\{");
+                match = reg2.Match(js);
+                if (match.Success)
+                {
+                    js = reg2.Replace(js, "if(!N.DJ()&&${variable}.current){return;");
+                    e.SetResponseBodyString(js);
+                    return;
+                }
+            }
         }
 
         private async Task ExplicitEndPoint_BeforeTunnelConnectRequest(object sender, TunnelConnectSessionEventArgs e)
         {
+            string url = e.HttpClient.Request.RequestUri.ToString();
             string hostname = e.HttpClient.Request.RequestUri.Host;
+            if (hostname == "lf-cdn-tos.bytescm.com")
+            {
+                e.DecryptSsl = true;
+                return;
+            }
+
             if (!CheckHost(hostname))
             {
                 e.DecryptSsl = false;