步骤说明
- 首先找到这三个 bdms 的栈

- 找到这个位置,把代码全部扣下来

- 打上日志


- 在控制台看结果,可以看到这个结果是一个数组

- 搭建一个简单的框架

- 根据控制台的打印信息,在这个位置写上一个 if 判断

- 根据这三个 bdms 关键栈的前一个栈激活逆向值接口,这个点很关键的

抖音 a_bogus 参数逆向分析涉及定位关键栈帧、提取代码及搭建调试框架。核心步骤在于补全浏览器运行环境,包括 Window、Document、Navigator、Screen 等对象。通过 Proxy 监听属性访问追踪依赖,修复 createElement 等方法缺失。最终提供一套模拟构造函数和检测环境的 JavaScript 脚本,解决反爬检测中的环境校验问题,支持在 Python 环境中调用。










微信公众号「极客日志」,在微信中扫描左侧二维码关注。展示文案:极客日志 zeeklog
使用加密算法(如AES、TripleDES、Rabbit或RC4)加密和解密文本明文。 在线工具,加密/解密文本在线工具,online
查找任何按下的键的javascript键代码、代码、位置和修饰符。 在线工具,Keycode 信息在线工具,online
JavaScript 字符串转义/反转义;Java 风格 \uXXXX(Native2Ascii)编码与解码。 在线工具,Escape 与 Native 编解码在线工具,online
使用 Prettier 在浏览器内格式化 JavaScript 或 HTML 片段。 在线工具,JavaScript / HTML 格式化在线工具,online
Terser 压缩、变量名混淆,或 javascript-obfuscator 高强度混淆(体积会增大)。 在线工具,JavaScript 压缩与混淆在线工具,online
将字符串编码和解码为其 Base64 格式表示形式即可。 在线工具,Base64 字符串编码/解码在线工具,online


// 检测脚本 !(() => { const origin_log = console.log; ; // const origin_log = function () {}; logToConsole = function () { return origin_log(...arguments) // return } })(); watch = function (obj, name) { return new Proxy(obj, { get(target, p, receiver) { // 过滤没用的信息,不进行打印 if (name) if (p === "Math" || p === "Symbol" || p === "Proxy" || p === "Promise" || p === "Array" || p === "isNaN" || p === "encodeURI" || p === "Uint8Array" || p.toString().indexOf("Symbol(") != -1 || p === "_element") { var val = Reflect.get(...arguments); return val } else { var val = Reflect.get(...arguments); const lst = [] for (let i = 0; i < p.length; i++) { lst.push(p.charCodeAt(i)) } if (typeof val === 'function') { logToConsole(`取值:${name}.${p} => function`); } else { logToConsole(`取值:${name}.${p} =>`, val); } return val } }, set(target, p, value, receiver) { var val = Reflect.set(...arguments) if (typeof value === 'function') { logToConsole(`设置值:${name}.${p}=>function `,); } else { logToConsole(`设置值:${name}.${p}=> `, value); if (name === '环境数组' && p === '4') { debugger } } return val }, has(target, key) { logToConsole(`检查属性存在性:${name}.${key.toString()}`); return key in target; }, ownKeys(target) { logToConsole(`ownKeys 检测:${name}`); if (name === 'span_domtokenlist') { debugger } if (name === 'window') { const keys = [ "Object", "Function", "Array", "Number", "parseFloat", "parseInt", "Infinity", "NaN", "undefined", "Boolean", "String", "Symbol", "Date", "Promise", "RegExp", "Error", "AggregateError", "EvalError", "RangeError", "ReferenceError", "SyntaxError", "TypeError", "URIError", "globalThis", "JSON", "Math", "Intl", "ArrayBuffer", "Atomics", "Uint8Array", "Int8Array", "Uint16Array", "Int16Array", "Uint32Array", "Int32Array", "BigUint64Array", "BigInt64Array", "Uint8ClampedArray", "Float32Array", "Float64Array", "DataView", "Map", "BigInt", "Set", "WeakMap", "WeakSet", "Proxy", "Reflect", "FinalizationRegistry", "WeakRef", "decodeURI", "decodeURIComponent", "encodeURI", "encodeURIComponent", "escape", "unescape", "eval", "isFinite", "isNaN", "console", "Option", "Image", "Audio", "webkitURL", "webkitRTCPeerConnection", "webkitMediaStream", "WebKitMutationObserver", "WebKitCSSMatrix", "XSLTProcessor", "XPathResult", "XPathExpression", "XPathEvaluator", "XMLSerializer", "XMLHttpRequestUpload", "XMLHttpRequestEventTarget", "XMLHttpRequest", "XMLDocument", "WritableStreamDefaultWriter", "WritableStreamDefaultController", "WritableStream", "Worker", "WindowControlsOverlayGeometryChangeEvent", "WindowControlsOverlay", "Window", "WheelEvent", "WebSocket", "WebGLVertexArrayObject", "WebGLUniformLocation", "WebGLTransformFeedback", "WebGLTexture", "WebGLSync", "WebGLShaderPrecisionFormat", "WebGLShader", "WebGLSampler", "WebGLRenderingContext", "WebGLRenderbuffer", "WebGLQuery", "WebGLProgram", "WebGLObject", "WebGLFramebuffer", "WebGLContextEvent", "WebGLBuffer", "WebGLActiveInfo", "WebGL2RenderingContext", "WaveShaperNode", "VisualViewport", "VisibilityStateEntry", "VirtualKeyboardGeometryChangeEvent", "ViewTransitionTypeSet", "ViewTransition", "ViewTimeline", "VideoPlaybackQuality", "VideoFrame", "VideoColorSpace", "ValidityState", "VTTCue", "UserActivation", "URLSearchParams", "URLPattern", "URL", "UIEvent", "TrustedTypePolicyFactory", "TrustedTypePolicy", "TrustedScriptURL", "TrustedScript", "TrustedHTML", "TreeWalker", "TransitionEvent", "TransformStreamDefaultController", "TransformStream", "TrackEvent", "TouchList", "TouchEvent", "Touch", "ToggleEvent", "TimeRanges", "TextUpdateEvent", "TextTrackList", "TextTrackCueList", "TextTrackCue", "TextTrack", "TextMetrics", "TextFormatUpdateEvent", "TextFormat", "TextEvent", "TextEncoderStream", "TextEncoder", "TextDecoderStream", "TextDecoder", "Text", "TaskSignal", "TaskPriorityChangeEvent", "TaskController", "TaskAttributionTiming", "SyncManager", "SubmitEvent", "StyleSheetList", "StyleSheet", "StylePropertyMapReadOnly", "StylePropertyMap", "StorageEvent", "Storage", "StereoPannerNode", "StaticRange", "SourceBufferList", "SourceBuffer", "ShadowRoot", "Selection", "SecurityPolicyViolationEvent", "ScrollTimeline", "ScriptProcessorNode", "ScreenOrientation", "Screen", "Scheduling", "Scheduler", "SVGViewElement", "SVGUseElement", "SVGUnitTypes", "SVGTransformList", "SVGTransform", "SVGTitleElement", "SVGTextPositioningElement", "SVGTextPathElement", "SVGTextElement", "SVGTextContentElement", "SVGTSpanElement", "SVGSymbolElement", "SVGSwitchElement", "SVGStyleElement", "SVGStringList", "SVGStopElement", "SVGSetElement", "SVGScriptElement", "SVGSVGElement", "SVGRectElement", "SVGRect", "SVGRadialGradientElement", "SVGPreserveAspectRatio", "SVGPolylineElement", "SVGPolygonElement", "SVGPointList", "SVGPoint", "SVGPatternElement", "SVGPathElement", "SVGNumberList", "SVGNumber", "SVGMetadataElement", "SVGMatrix", "SVGMaskElement", "SVGMarkerElement", "SVGMPathElement", "SVGLinearGradientElement", "SVGLineElement", "SVGLengthList", "SVGLength", "SVGImageElement", "SVGGraphicsElement", "SVGGradientElement", "SVGGeometryElement", "SVGGElement", "SVGForeignObjectElement", "SVGFilterElement", "SVGFETurbulenceElement", "SVGFETileElement", "SVGFESpotLightElement", "SVGFESpecularLightingElement", "SVGFEPointLightElement", "SVGFEOffsetElement", "SVGFEMorphologyElement", "SVGFEMergeNodeElement", "SVGFEMergeElement", "SVGFEImageElement", "SVGFEGaussianBlurElement", "SVGFEFuncRElement", "SVGFEFuncGElement", "SVGFEFuncBElement", "SVGFEFuncAElement", "SVGFEFloodElement", "SVGFEDropShadowElement", "SVGFEDistantLightElement", "SVGFEDisplacementMapElement", "SVGFEDiffuseLightingElement", "SVGFEConvolveMatrixElement", "SVGFECompositeElement", "SVGFEComponentTransferElement", "SVGFEColorMatrixElement", "SVGFEBlendElement", "SVGEllipseElement", "SVGElement", "SVGDescElement", "SVGDefsElement", "SVGComponentTransferFunctionElement", "SVGClipPathElement", "SVGCircleElement", "SVGAnimationElement", "SVGAnimatedTransformList", "SVGAnimatedString", "SVGAnimatedRect", "SVGAnimatedPreserveAspectRatio", "SVGAnimatedNumberList", "SVGAnimatedNumber", "SVGAnimatedLengthList", "SVGAnimatedLength", "SVGAnimatedInteger", "SVGAnimatedEnumeration", "SVGAnimatedBoolean", "SVGAnimatedAngle", "SVGAnimateTransformElement", "SVGAnimateMotionElement", "SVGAnimateElement", "SVGAngle", "SVGAElement", "Response", "ResizeObserverSize", "ResizeObserverEntry", "ResizeObserver", "Request", "ReportingObserver", "ReportBody", "ReadableStreamDefaultReader", "ReadableStreamDefaultController", "ReadableStreamBYOBRequest", "ReadableStreamBYOBReader", "ReadableStream", "ReadableByteStreamController", "Range", "RadioNodeList", "RTCTrackEvent", "RTCStatsReport", "RTCSessionDescription", "RTCSctpTransport", "RTCRtpTransceiver", "RTCRtpSender", "RTCRtpReceiver", "RTCPeerConnectionIceEvent", "RTCPeerConnectionIceErrorEvent", "RTCPeerConnection", "RTCIceTransport", "RTCIceCandidate", "RTCErrorEvent", "RTCError", "RTCEncodedVideoFrame", "RTCEncodedAudioFrame", "RTCDtlsTransport", "RTCDataChannelEvent", "RTCDTMFToneChangeEvent", "RTCDTMFSender", "RTCCertificate", "PromiseRejectionEvent", "ProgressEvent", "Profiler", "ProcessingInstruction", "PopStateEvent", "PointerEvent", "PluginArray", "Plugin", "PictureInPictureWindow", "PictureInPictureEvent", "PeriodicWave", "PerformanceTiming", "PerformanceServerTiming", "PerformanceScriptTiming", "PerformanceResourceTiming", "PerformancePaintTiming", "PerformanceObserverEntryList", "PerformanceObserver", "PerformanceNavigationTiming", "PerformanceNavigation", "PerformanceMeasure", "PerformanceMark", "PerformanceLongTaskTiming", "PerformanceLongAnimationFrameTiming", "PerformanceEventTiming", "PerformanceEntry", "PerformanceElementTiming", "Performance", "Path2D", "PannerNode", "PageTransitionEvent", "OverconstrainedError", "OscillatorNode", "OffscreenCanvasRenderingContext2D", "OffscreenCanvas", "OfflineAudioContext", "OfflineAudioCompletionEvent", "NodeList", "NodeIterator", "NodeFilter", "Node", "NetworkInformation", "NavigatorUAData", "Navigator", "NavigationTransition", "NavigationHistoryEntry", "NavigationDestination", "NavigationCurrentEntryChangeEvent", "Navigation", "NavigateEvent", "NamedNodeMap", "MutationRecord", "MutationObserver", "MouseEvent", "MimeTypeArray", "MimeType", "MessagePort", "MessageEvent", "MessageChannel", "MediaStreamTrackVideoStats", "MediaStreamTrackProcessor", "MediaStreamTrackGenerator", "MediaStreamTrackEvent", "MediaStreamTrackAudioStats", "MediaStreamTrack", "MediaStreamEvent", "MediaStreamAudioSourceNode", "MediaStreamAudioDestinationNode", "MediaStream", "MediaSourceHandle", "MediaSource", "MediaRecorder", "MediaQueryListEvent", "MediaQueryList", "MediaList", "MediaError", "MediaEncryptedEvent", "MediaElementAudioSourceNode", "MediaCapabilities", "MathMLElement", "Location", "LayoutShiftAttribution", "LayoutShift", "LargestContentfulPaint", "KeyframeEffect", "KeyboardEvent", "IntersectionObserverEntry", "IntersectionObserver", "InputEvent", "InputDeviceInfo", "InputDeviceCapabilities", "Ink", "ImageData", "ImageCapture", "ImageBitmapRenderingContext", "ImageBitmap", "IdleDeadline", "IIRFilterNode", "IDBVersionChangeEvent", "IDBTransaction", "IDBRequest", "IDBOpenDBRequest", "IDBObjectStore", "IDBKeyRange", "IDBIndex", "IDBFactory", "IDBDatabase", "IDBCursorWithValue", "IDBCursor", "History", "HighlightRegistry", "Highlight", "Headers", "HashChangeEvent", "HTMLVideoElement", "HTMLUnknownElement", "HTMLUListElement", "HTMLTrackElement", "HTMLTitleElement", "HTMLTimeElement", "HTMLTextAreaElement", "HTMLTemplateElement", "HTMLTableSectionElement", "HTMLTableRowElement", "HTMLTableElement", "HTMLTableColElement", "HTMLTableCellElement", "HTMLTableCaptionElement", "HTMLStyleElement", "HTMLSpanElement", "HTMLSourceElement", "HTMLSlotElement", "HTMLSelectElement", "HTMLScriptElement", "HTMLQuoteElement", "HTMLProgressElement", "HTMLPreElement", "HTMLPictureElement", "HTMLParamElement", "HTMLParagraphElement", "HTMLOutputElement", "HTMLOptionsCollection", "HTMLOptionElement", "HTMLOptGroupElement", "HTMLObjectElement", "HTMLOListElement", "HTMLModElement", "HTMLMeterElement", "HTMLMetaElement", "HTMLMenuElement", "HTMLMediaElement", "HTMLMarqueeElement", "HTMLMapElement", "HTMLLinkElement", "HTMLLegendElement", "HTMLLabelElement", "HTMLLIElement", "HTMLInputElement", "HTMLImageElement", "HTMLIFrameElement", "HTMLHtmlElement", "HTMLHeadingElement", "HTMLHeadElement", "HTMLHRElement", "HTMLFrameSetElement", "HTMLFrameElement", "HTMLFormElement", "HTMLFormControlsCollection", "HTMLFontElement", "HTMLFieldSetElement", "HTMLEmbedElement", "HTMLElement", "HTMLDocument", "HTMLDivElement", "HTMLDirectoryElement", "HTMLDialogElement", "HTMLDetailsElement", "HTMLDataListElement", "HTMLDataElement", "HTMLDListElement", "HTMLCollection", "HTMLCanvasElement", "HTMLButtonElement", "HTMLBodyElement", "HTMLBaseElement", "HTMLBRElement", "HTMLAudioElement", "HTMLAreaElement", "HTMLAnchorElement", "HTMLAllCollection", "GeolocationPositionError", "GeolocationPosition", "GeolocationCoordinates", "Geolocation", "GamepadHapticActuator", "GamepadEvent", "GamepadButton", "Gamepad", "GainNode", "FormDataEvent", "FormData", "FontFaceSetLoadEvent", "FontFace", "FocusEvent", "FileReader", "FileList", "File", "FeaturePolicy", "External", "EventTarget", "EventSource", "EventCounts", "Event", "ErrorEvent", "EncodedVideoChunk", "EncodedAudioChunk", "ElementInternals", "Element", "EditContext", "DynamicsCompressorNode", "DragEvent", "DocumentType", "DocumentTimeline", "DocumentFragment", "Document", "DelegatedInkTrailPresenter", "DelayNode", "DecompressionStream", "DataTransferItemList", "DataTransferItem", "DataTransfer", "DOMTokenList", "DOMStringMap", "DOMStringList", "DOMRectReadOnly", "DOMRectList", "DOMRect", "DOMQuad", "DOMPointReadOnly", "DOMPoint", "DOMParser", "DOMMatrixReadOnly", "DOMMatrix", "DOMImplementation", "DOMException", "DOMError", "CustomStateSet", "CustomEvent", "CustomElementRegistry", "Crypto", "CountQueuingStrategy", "ConvolverNode", "ContentVisibilityAutoStateChangeEvent", "ConstantSourceNode", "CompressionStream", "CompositionEvent", "Comment", "CloseWatcher", "CloseEvent", "ClipboardEvent", "CharacterData", "CharacterBoundsUpdateEvent", "ChannelSplitterNode", "ChannelMergerNode", "CanvasRenderingContext2D", "CanvasPattern", "CanvasGradient", "CanvasCaptureMediaStreamTrack", "CSSVariableReferenceValue", "CSSUnparsedValue", "CSSUnitValue", "CSSTranslate", "CSSTransition", "CSSTransformValue", "CSSTransformComponent", "CSSSupportsRule", "CSSStyleValue", "CSSStyleSheet", "CSSStyleRule", "CSSStyleDeclaration", "CSSStartingStyleRule", "CSSSkewY", "CSSSkewX", "CSSSkew", "CSSScopeRule", "CSSScale", "CSSRuleList", "CSSRule", "CSSRotate", "CSSPropertyRule", "CSSPositionValue", "CSSPositionTryRule", "CSSPositionTryDescriptors", "CSSPerspective", "CSSPageRule", "CSSNumericValue", "CSSNumericArray", "CSSNestedDeclarations", "CSSNamespaceRule", "CSSMediaRule", "CSSMatrixComponent", "CSSMathValue", "CSSMathSum", "CSSMathProduct", "CSSMathNegate", "CSSMathMin", "CSSMathMax", "CSSMathInvert", "CSSMathClamp", "CSSLayerStatementRule", "CSSLayerBlockRule", "CSSKeywordValue", "CSSKeyframesRule", "CSSKeyframeRule", "CSSImportRule", "CSSImageValue", "CSSGroupingRule", "CSSFontPaletteValuesRule", "CSSFontFaceRule", "CSSCounterStyleRule", "CSSContainerRule", "CSSConditionRule", "CSSAnimation", "CSS", "CSPViolationReportBody", "CDATASection", "ByteLengthQueuingStrategy", "BrowserCaptureMediaStreamTrack", "BroadcastChannel", "BlobEvent", "Blob", "BiquadFilterNode", "BeforeUnloadEvent", "BeforeInstallPromptEvent", "BaseAudioContext", "BarProp", "AudioWorkletNode", "AudioSinkInfo", "AudioScheduledSourceNode", "AudioProcessingEvent", "AudioParamMap", "AudioParam", "AudioNode", "AudioListener", "AudioDestinationNode", "AudioData", "AudioContext", "AudioBufferSourceNode", "AudioBuffer", "Attr", "AnimationTimeline", "AnimationPlaybackEvent", "AnimationEvent", "AnimationEffect", "Animation", "AnalyserNode", "AbstractRange", "AbortSignal", "AbortController", "window", "self", "document", "name", "location", "customElements", "history", "navigation", "locationbar", "menubar", "personalbar", "scrollbars", "statusbar", "toolbar", "status", "closed", "frames", "length", "top", "opener", "parent", "frameElement", "navigator", "origin", "external", "screen", "innerWidth", "innerHeight", "scrollX", "pageXOffset", "scrollY", "pageYOffset", "visualViewport", "screenX", "screenY", "outerWidth", "outerHeight", "devicePixelRatio", "event", "clientInformation", "offscreenBuffering", "screenLeft", "screenTop", "styleMedia", "onsearch", "trustedTypes", "performance", "onappinstalled", "onbeforeinstallprompt", "crypto", "indexedDB", "sessionStorage", "localStorage", "onbeforexrselect", "onabort", "onbeforeinput", "onbeforematch", "onbeforetoggle", "onblur", "oncancel", "oncanplay", "oncanplaythrough", "onchange", "onclick", "onclose", "oncontentvisibilityautostatechange", "oncontextlost", "oncontextmenu", "oncontextrestored", "oncuechange", "ondblclick", "ondrag", "ondragend", "ondragenter", "ondragleave", "ondragover", "ondragstart", "ondrop", "ondurationchange", "onemptied", "onended", "onerror", "onfocus", "onformdata", "oninput", "oninvalid", "onkeydown", "onkeypress", "onkeyup", "onload", "onloadeddata", "onloadedmetadata", "onloadstart", "onmousedown", "onmouseenter", "onmouseleave", "onmousemove", "onmouseout", "onmouseover", "onmouseup", "onmousewheel", "onpause", "onplay", "onplaying", "onprogress", "onratechange", "onreset", "onresize", "onscroll", "onsecuritypolicyviolation", "onseeked", "onseeking", "onselect", "onslotchange", "onstalled", "onsubmit", "onsuspend", "ontimeupdate", "ontoggle", "onvolumechange", "onwaiting", "onwebkitanimationend", "onwebkitanimationiteration", "onwebkitanimationstart", "onwebkittransitionend", "onwheel", "onauxclick", "ongotpointercapture", "onlostpointercapture", "onpointerdown", "onpointermove", "onpointerrawupdate", "onpointerup", "onpointercancel", "onpointerover", "onpointerout", "onpointerenter", "onpointerleave", "onselectstart", "onselectionchange", "onanimationend", "onanimationiteration", "onanimationstart", "ontransitionrun", "ontransitionstart", "ontransitionend", "ontransitioncancel", "onafterprint", "onbeforeprint", "onbeforeunload", "onhashchange", "onlanguagechange", "onmessage", "onmessageerror", "onoffline", "ononline", "onpagehide", "onpageshow", "onpopstate", "onrejectionhandled", "onstorage", "onunhandledrejection", "onunload", "isSecureContext", "crossOriginIsolated", "scheduler", "alert", "atob", "blur", "btoa", "cancelAnimationFrame", "cancelIdleCallback", "captureEvents", "clearInterval", "clearTimeout", "close", "confirm", "createImageBitmap", "fetch", "find", "focus", "getComputedStyle", "getSelection", "matchMedia", "moveBy", "moveTo", "open", "postMessage", "print", "prompt", "queueMicrotask", "releaseEvents", "reportError", "requestAnimationFrame", "requestIdleCallback", "resizeBy", "resizeTo", "scroll", "scrollBy", "scrollTo", "setInterval", "setTimeout", "stop", "structuredClone", "webkitCancelAnimationFrame", "webkitRequestAnimationFrame", "Iterator", "chrome", "WebAssembly", "caches", "cookieStore", "ondevicemotion", "ondeviceorientation", "ondeviceorientationabsolute", "launchQueue", "sharedStorage", "documentPictureInPicture", "AICreateMonitor", "AbsoluteOrientationSensor", "Accelerometer", "AudioDecoder", "AudioEncoder", "AudioWorklet", "BatteryManager", "Cache", "CacheStorage", "Clipboard", "ClipboardItem", "CookieChangeEvent", "CookieStore", "CookieStoreManager", "Credential", "CredentialsContainer", "CryptoKey", "DeviceMotionEvent", "DeviceMotionEventAcceleration", "DeviceMotionEventRotationRate", "DeviceOrientationEvent", "FederatedCredential", "GPU", "GPUAdapter", "GPUAdapterInfo", "GPUBindGroup", "GPUBindGroupLayout", "GPUBuffer", "GPUBufferUsage", "GPUCanvasContext", "GPUColorWrite", "GPUCommandBuffer", "GPUCommandEncoder", "GPUCompilationInfo", "GPUCompilationMessage", "GPUComputePassEncoder", "GPUComputePipeline", "GPUDevice", "GPUDeviceLostInfo", "GPUError", "GPUExternalTexture", "GPUInternalError", "GPUMapMode", "GPUOutOfMemoryError", "GPUPipelineError", "GPUPipelineLayout", "GPUQuerySet", "GPUQueue", "GPURenderBundle", "GPURenderBundleEncoder", "GPURenderPassEncoder", "GPURenderPipeline", "GPUSampler", "GPUShaderModule", "GPUShaderStage", "GPUSupportedFeatures", "GPUSupportedLimits", "GPUTexture", "GPUTextureUsage", "GPUTextureView", "GPUUncapturedErrorEvent", "GPUValidationError", "GravitySensor", "Gyroscope", "IdleDetector", "ImageDecoder", "ImageTrack", "ImageTrackList", "Keyboard", "KeyboardLayoutMap", "LinearAccelerationSensor", "MIDIAccess", "MIDIConnectionEvent", "MIDIInput", "MIDIInputMap", "MIDIMessageEvent", "MIDIOutput", "MIDIOutputMap", "MIDIPort", "MediaDeviceInfo", "MediaDevices", "MediaKeyMessageEvent", "MediaKeySession", "MediaKeyStatusMap", "MediaKeySystemAccess", "MediaKeys", "NavigationPreloadManager", "NavigatorManagedData", "OrientationSensor", "PasswordCredential", "ProtectedAudience", "RelativeOrientationSensor", "ScreenDetailed", "ScreenDetails", "Sensor", "SensorErrorEvent", "ServiceWorker", "ServiceWorkerContainer", "ServiceWorkerRegistration", "StorageManager", "SubtleCrypto", "VideoDecoder", "VideoEncoder", "VirtualKeyboard", "WGSLLanguageFeatures", "WebTransport", "WebTransportBidirectionalStream", "WebTransportDatagramDuplexStream", "WebTransportError", "Worklet", "XRDOMOverlayState", "XRLayer", "XRWebGLBinding", "AuthenticatorAssertionResponse", "AuthenticatorAttestationResponse", "AuthenticatorResponse", "PublicKeyCredential", "Bluetooth", "BluetoothCharacteristicProperties", "BluetoothDevice", "BluetoothRemoteGATTCharacteristic", "BluetoothRemoteGATTDescriptor", "BluetoothRemoteGATTServer", "BluetoothRemoteGATTService", "CaptureController", "DevicePosture", "DocumentPictureInPicture", "EyeDropper", "FileSystemDirectoryHandle", "FileSystemFileHandle", "FileSystemHandle", "FileSystemWritableFileStream", "FileSystemObserver", "FontData", "FragmentDirective", "HID", "HIDConnectionEvent", "HIDDevice", "HIDInputReportEvent", "IdentityCredential", "IdentityProvider", "IdentityCredentialError", "LaunchParams", "LaunchQueue", "Lock", "LockManager", "NavigatorLogin", "NotRestoredReasonDetails", "NotRestoredReasons", "OTPCredential", "PaymentAddress", "PaymentRequest", "PaymentRequestUpdateEvent", "PaymentResponse", "PaymentManager", "PaymentMethodChangeEvent", "Presentation", "PresentationAvailability", "PresentationConnection", "PresentationConnectionAvailableEvent", "PresentationConnectionCloseEvent", "PresentationConnectionList", "PresentationReceiver", "PresentationRequest", "PressureObserver", "PressureRecord", "Serial", "SerialPort", "StorageBucket", "StorageBucketManager", "USB", "USBAlternateInterface", "USBConfiguration", "USBConnectionEvent", "USBDevice", "USBEndpoint", "USBInTransferResult", "USBInterface", "USBIsochronousInTransferPacket", "USBIsochronousInTransferResult", "USBIsochronousOutTransferPacket", "USBIsochronousOutTransferResult", "USBOutTransferResult", "WakeLock", "WakeLockSentinel", "XRAnchor", "XRAnchorSet", "XRBoundedReferenceSpace", "XRCPUDepthInformation", "XRCamera", "XRDepthInformation", "XRFrame", "XRHitTestResult", "XRHitTestSource", "XRInputSource", "XRInputSourceArray", "XRInputSourceEvent", "XRInputSourcesChangeEvent", "XRLightEstimate", "XRLightProbe", "XRPose", "XRRay", "XRReferenceSpace", "XRReferenceSpaceEvent", "XRRenderState", "XRRigidTransform", "XRSession", "XRSessionEvent", "XRSpace", "XRSystem", "XRTransientInputHitTestResult", "XRTransientInputHitTestSource", "XRView", "XRViewerPose", "XRViewport", "XRWebGLDepthInformation", "XRWebGLLayer", "XRHand", "XRJointPose", "XRJointSpace", "getScreenDetails", "queryLocalFonts", "showDirectoryPicker", "showOpenFilePicker", "showSaveFilePicker", "originAgentCluster", "onpageswap", "onpagereveal", "credentialless", "fence", "speechSynthesis", "onscrollend", "onscrollsnapchange", "onscrollsnapchanging", "BackgroundFetchManager", "BackgroundFetchRecord", "BackgroundFetchRegistration", "BluetoothUUID", "CSSMarginRule", "CSSViewTransitionRule", "CaretPosition", "ChapterInformation", "CropTarget", "DocumentPictureInPictureEvent", "Fence", "FencedFrameConfig", "HTMLFencedFrameElement", "MediaMetadata", "MediaSession", "NavigationActivation", "Notification", "PageRevealEvent", "PageSwapEvent", "PeriodicSyncManager", "PermissionStatus", "Permissions", "PushManager", "PushSubscription", "PushSubscriptionOptions", "RTCDataChannel", "RemotePlayback", "RestrictionTarget", "SharedStorage", "SharedStorageWorklet", "SharedWorker", "SnapEvent", "SpeechSynthesis", "SpeechSynthesisErrorEvent", "SpeechSynthesisEvent", "SpeechSynthesisUtterance", "SpeechSynthesisVoice", "WebSocketError", "WebSocketStream", "webkitSpeechGrammar", "webkitSpeechGrammarList", "webkitSpeechRecognition", "webkitSpeechRecognitionError", "webkitSpeechRecognitionEvent", "webkitRequestFileSystem", "webkitResolveLocalFileSystemURL", "PC_ITEM_CONFIG", "dra", "customPointEvent", "_risk_xhr", "__intercept__fetch__", "atobFill", "riskHandlerUtil", "ParamsSign", "__core-js_shared__", "regeneratorRuntime", "callbackName", "ajaxCount", "__JDWEBSIGNHELPER_$DATA__", "PSign", "SHA256", "bp_bizid", "_0x26e2b7", "_riskFpMode", "jdtRiskContext", "collectConfig", "jdtRiskUtil", "jdtRiskEncryptUtil", "JdtRiskFingerPrint", "jdtRiskCookieManager", "jdtLocalStorageManager", "jdtRiskStorageManager", "TDEnvCollector", "__getTkResult", "_0x37f5", "__callbackWrapper", "reportLog", "_0x1d73", "_globalState", "getJsToken", "getJdEid", "pageConfig", "is_sort_black_list", "jump_mobile", "apiHost", "commonAppId", "preloadArray", "seajsConfig", "login", "regist", "createCookie", "readCookie", "addToFavorite", "TrimPath", "$", "jQuery", "seajs", "define", "EventEmitterPcItem", "itemEventBus", "listenTabVisibileReport", "totouchbate", "hashTag", "href", "_0x3db2", "_0x3575", "ParamsSignMain" ] if (!keys.includes('$jsDebugIsRegistered')) { keys.push('$jsDebugIsRegistered'); } return keys } if (name === 'document') { return [ "location" ] } if (name === 'window' || name === 'document') debugger; return Reflect.ownKeys(...arguments) } }) }

运行代码后看结果

处理方案,直接注释这个

开启代理监听

运行代码后打印的信息是正常的

根据这个浏览器打印的结构,将 Window 和 window 建立关系,将大 Window 的原型链补齐


然后 window 的环境基本补齐了,现在监听 document。先在浏览器打印 document 的结构

根据浏览器打印的结构写出监听的代码


根据这个报错信息,先补 document.all 和 document.createElement,这两个元素是 HTMLDocument 里面的方法


根据浏览器页面的打印结构,这样补


根据打印的信息接着补

createElement 和 createEvent 是 Document 里面的方法,所以需要在 Document 里面补

根据上面的浏览器页面打印结构来补

运行代码看报错信息

说明 createElement 这个方法缺了 span 标签,可以返回一个 span 标签

再次运行,打印又是正常的结果了,说明 document 基本补完了

接下来浏览器的 8 大环境对象一个都不能少,还剩 location、navigator、screen,在浏览器一次性全部打印了

然后补上

运行代码结果就出来了

/**
* 创建具有特定属性和方法的构造函数
* 该函数主要用于浏览器环境模拟,可以创建具有严格访问控制、继承支持和原型方法的构造函数
* 通过外部数据存储和 Symbol 键实现实例数据隔离,提高安全性和防检测能力
*
* @param {string} constructorName - 构造函数的名称,将作为全局变量挂载到 window 对象上
* @param {boolean} enableStrictMode - 是否启用严格模式验证,启用后需要特定令牌才能调用构造函数
* @param {Array} [propertiesList=[]] - 属性定义列表,支持简单字符串属性或自定义属性描述符
* - 简单属性:字符串形式,如 "name"
* - 自定义属性:数组形式,如 ["all", {get: function() {...}}]
* @param {Object} [prototypeMethods={}] - 要添加到原型上的方法
* @param {string} [parentConstructorName=null] - 父构造函数的名称,用于实现继承
* @returns {Function} 返回新创建的构造函数,同时会挂载到 window 对象上
*
* @example
* // 创建简单的 Person 构造函数
* createConstructor("Person", true, ["name", "age"], {
* greet: function() { return `Hello, ${this.name}`; }
* });
*
* @example
* // 创建继承自 Animal 的 Dog 构造函数
* createConstructor("Dog", true, ["breed"], {
* bark: function() { return "Woof!"; }
* }, "Animal");
*/
// (1) 安全函数实现
const safeFunction = (function () {
let initialized = false;
let myFunction_toString_symbol;
const set_native = function set_native(func, key, value) {
Object.defineProperty(func, key, {
"enumerable": false,
"configurable": true,
"writable": true,
"value": value
});
};
return function safeFunction(func) {
if (!initialized) {
Function.prototype.$call = Function.prototype.call;
const $toString = Function.toString;
myFunction_toString_symbol = Symbol('functionToString');
const myToString = function myToString() {
return typeof this === 'function' && this[myFunction_toString_symbol] || $toString.$call(this);
};
delete Function.prototype.toString;
set_native(Function.prototype, "toString", myToString);
set_native(Function.prototype.toString, myFunction_toString_symbol, "function toString() { [native code] }");
initialized = true;
}
// 避免重复添加
if (!func.hasOwnProperty(myFunction_toString_symbol)) {
set_native(func, myFunction_toString_symbol, `function ${func.name || ''}() { [native code] }`);
}
return func;
};
})();
// (2) 构造函数(类构造器)
const CONSTRUCTOR_TOKEN = "constructor_token";
function createConstructor(constructorName, enableStrictMode, propertiesList = [], prototypeMethods = {}, parentConstructorName = null) {
const instancesData = {};
// 创建有名称的构造函数
const constructorFunction = function (element, propertySetter, validationToken) {
// 验证逻辑
if (enableStrictMode && !(validationToken && validationToken === CONSTRUCTOR_TOKEN)) {
throw new Error("Illegal constructor");
}
if (parentConstructorName && window[parentConstructorName]) {
window[parentConstructorName].call(this, element, null, CONSTRUCTOR_TOKEN);
}
if (propertySetter && typeof propertySetter === "function") {
propertySetter(this);
}
const instanceProperties = element && typeof element === "object" ? {...element} : {};
this._element = Symbol('_element');
instancesData[this._element] = instanceProperties;
if (element && typeof element === "object") {
Object.keys(element).forEach(key => {
if (!this[key]) {
this[key] = element[key];
}
});
}
};
// 设置函数名
Object.defineProperty(constructorFunction, 'name', {
value: constructorName,
writable: false,
enumerable: false,
configurable: true
});
// 设置继承关系
if (parentConstructorName && window[parentConstructorName]) {
constructorFunction.prototype = Object.create(window[parentConstructorName].prototype);
constructorFunction.prototype.constructor = constructorFunction;
Object.setPrototypeOf(constructorFunction, window[parentConstructorName]);
}
// 设置 toStringTag
Object.defineProperty(constructorFunction.prototype, Symbol.toStringTag, {
value: constructorName,
writable: false,
enumerable: false,
configurable: true
});
// 添加原型方法
Object.keys(prototypeMethods).forEach(methodName => {
constructorFunction.prototype[methodName] = prototypeMethods[methodName];
if (typeof constructorFunction.prototype[methodName] === "function") {
safeFunction(constructorFunction.prototype[methodName]);
}
});
// 保护构造函数
safeFunction(constructorFunction);
// 将构造函数挂载到全局对象
window[constructorName] = constructorFunction;
return constructorFunction;
}
Python 调用测试成功。