TheOne的个人博客

function myProxy(obj, name) {
        return new Proxy(obj, {
            //拦截对象属性的读取，比如proxy.foo和proxy['foo']。
            get(target, propKey, receiver) {
                let temp = Reflect.get(target, propKey, receiver)
                console.log(`${name} -> get ${propKey} return -> ${temp}`)
                if (typeof temp === 'object') {
                    temp = myProxy(temp, name + ' => ' + propKey)
                }
                return temp
            },
            //拦截对象属性的设置，比如proxy.foo = v或proxy['foo'] = v，返回一个布尔值。
            set(target, propKey, value, receiver) {
                const temp = Reflect.set(target, propKey, value, receiver)
                console.log(`${name} -> set ${propKey} value -> ${value}`)
                return temp
            },
            //拦截propKey in proxy的操作，返回一个布尔值。
            has(target, propKey) {
                const temp = Reflect.has(target, propKey)
                console.log(`${name} -> has ${propKey}`)
                return temp
            },
            //拦截delete proxy[propKey]的操作，返回一个布尔值。
            deleteProperty(target, propKey) {
                const temp = Reflect.defineProperty(target, propKey)
                return temp
            },
            //拦截Object.getOwnPropertyNames(proxy)、Object.getOwnPropertySymbols(proxy)、Object.keys(proxy)、for...in循环，返回一个数组。该方法返回目标对象所有自身的属性的属性名，而Object.keys()的返回结果仅包括目标对象自身的可遍历属性。
            ownKeys(target) {
                const temp = Reflect.ownKeys(target)
                return temp
            },
            //拦截Object.getOwnPropertyDescriptor(proxy, propKey)，返回属性的描述对象。
            getOwnPropertyDescriptor(target, propKey) {
                const temp = Reflect.getOwnPropertyDescriptor(target, propKey)
                return temp
            },
            //拦截Object.defineProperty(proxy, propKey, propDesc）、Object.defineProperties(proxy, propDescs)，返回一个布尔值。
            defineProperty(target, propKey, propDesc) {
                const temp = Reflect.defineProperty(target, propKey, propDesc)
                return temp
            },
            //拦截Object.preventExtensions(proxy)，返回一个布尔值。
            preventExtensions(target) {
                const temp = Reflect.preventExtensions(target)
                return temp
            },
            //拦截Object.getPrototypeOf(proxy)，返回一个对象。
            getPrototypeOf(target) {
                const temp = Reflect.getPrototypeOf(target)
                return temp
            },
            //拦截Object.isExtensible(proxy)，返回一个布尔值。
            isExtensible(target) {
                const temp = Reflect.isExtensible(target)
                return temp
            },
            //拦截Object.setPrototypeOf(proxy, proto)，返回一个布尔值。如果目标对象是函数，那么还有两种额外操作可以拦截。
            setPrototypeOf(target, proto) {
                const temp = Reflect.setPrototypeOf(target, proto)
                return temp
            },
            //拦截 Proxy 实例作为函数调用的操作，比如proxy(...args)、proxy.call(object, ...args)、proxy.apply(...)。
            apply(target, object, args) {
                const temp = Reflect.apply(target, object, args)
                return temp
            },
            //拦截 Proxy 实例作为构造函数调用的操作，比如new proxy(...args)。
            construct(target, args) {
                const temp = Reflect.construct(target, args)
                return temp
            }
        })
    }

window = globalThis
myProxy(window, 'window')

location = {}
location = myProxy(location, 'location')

document = {}
document = myProxy(document, 'document')

navigator = {}
navigator = myProxy(navigator, navigator)

screen = {}
screen = myProxy(screen, 'screen')

$ = function() {
    debugger
}

$.ajax = function() {
    console.log(arguments)
}

[Arguments] {
  '0': {
    url: '/match2025/topic/1_captcha_jpg',
    dataType: 'json',
    async: true,
    type: 'POST',
    data: {
      a: 'CmCnJajVa4Wc9zEWAWbvNXvOXdyZdGadFacxDoSAeG1k2UBsWjPzgFLvhSPbY2exvsT8D2t2sC3/bzK5Z4k9hA=='
    },
    success: [Function (anonymous)]
  }
}

function get_a(timestamp) {
  Date.now = function() {
      return timestamp
  }
  ...
}

window.Kf.apply(t0, t1)

$ = function (name) {
        if (name == "#captchaImg") {
            return {
                attr: function() {
                    console.log(arguments)
                }
            }
        }
        debugger
    }

// ==UserScript==
// @name         text_oninput
// @namespace    http://tampermonkey.net/
// @version      2025-06-11
// @description  try to take over the world!
// @author       theone
// @match        https://match2025.yuanrenxue.cn/match2025/topic/1
// @icon         https://www.google.com/s2/favicons?sz=64&domain=bilibili.com
// @grant        none
// @run-at       document-start
// ==/UserScript==

(function() {
    'use strict';
    Object.defineProperty(window, 'text_oninput', {
        set: function () {
            debugger
        }
    })
})();

text_oninput(myProxy({}, 'text_oninput'))

function hookMap() {
    var hashMap = Java.use('java.util.HashMap')
    hashMap.put.implementation = function (key, value) {
        console.log(`key: ${key}, value: ${value}`)
        return this.put(key, value)
    }
}

function hookJson() {
    var JSONObject = Java.use('org.json.JSONObject');
  // Hook JSONObject.put() 方法
    JSONObject.put.overload('java.lang.String', 'java.lang.Object').implementation = function (key, value) {
        console.log('Hooked JSONObject.put()');
        console.log('Key: ' + key.toString());
        console.log('Value: ' + value.toString());
        // 可在此处对参数进行修改或记录
        // 调用原始的put()方法
        return this.put(key, value);
    };
}

function hookStrBuilder() {
    var stringBuilderClass = Java.use("java.lang.StringBuilder");
    stringBuilderClass.toString.implementation = function () {
        var res = this.toString.apply(this, arguments)
        console.log('tostring is called ', res)
        return res
    }
}

function showStacks() {
    Java.perform(function () {
        console.log(Java.use("android.util.Log").getStackTraceString(
            Java.use("java.lang.Throwable").$new()
        ));
    })
}

function hookStrBuilder() {
    // 获取 StringBuilder 类并定义需要 Hook 的方法名
    var stringBuilderClass = Java.use("java.lang.StringBuilder");
    stringBuilderClass.toString.implementation = function () {
        var res = this.toString.apply(this, arguments)
        if (res.includes('zqkd_param')) {
            showStacks()
            console.log('tostring is called ', res)
        }
        // console.log('tostring is called ', res)
        return res
    }
}

function hookGetExtraParams() {
    let YouthNetworkInterceptor = Java.use("cn.youth.news.network.api.YouthNetworkInterceptor");
    YouthNetworkInterceptor["getExtraParams"].implementation = function (i) {
        console.log(`YouthNetworkInterceptor.getExtraParams is called: i=${i}`);
        let result = this["getExtraParams"](i);
        console.log(`YouthNetworkInterceptor.getExtraParams result=${result}`);
        var key = result.keySet() // 这一行获取了Map对象的键集合
        var it = key.iterator();
        var count = 0
        while (it.hasNext()) {
            var keystr = it.next()
            var valuestr = result.get(keystr)
            console.log(`${count + 1}. ${keystr}: ${valuestr}`)
            count++
        }
        return result;
    };
}

function hookEncryptDes() {
    let SecurityHelper = Java.use("cn.youth.news.utils.SecurityHelper");
    SecurityHelper["encryptDES"].implementation = function (str, str2) {
        console.log(`SecurityHelper.encryptDES is called: str=${str}, str2=${str2}`);
        let result = this["encryptDES"](str, str2);
        console.log(`SecurityHelper.encryptDES result=${result}`);
        return result;
    };
}

function hookSignature() {
    let YouthNetworkInterceptor = Java.use("cn.youth.news.network.api.YouthNetworkInterceptor");
    YouthNetworkInterceptor["signature"].implementation = function (map, i) {
        console.log(`YouthNetworkInterceptor.signature is called: map=${map}, i=${i}`);
        var key = map.keySet() // 这一行获取了Map对象的键集合
        var it = key.iterator();
        var count = 0
        while (it.hasNext()) {
            var keystr = it.next()
            var valuestr = map.get(keystr)
            console.log(`${count + 1}. ${keystr}: ${valuestr}`)
            count++
        }
        let result = this["signature"](map, i);
        console.log(`YouthNetworkInterceptor.signature result=${result}`);
        return result;
    };
}

function bytesToString(arr) {
    if (typeof arr === 'string') {
        return arr;
    }
    var str = '',
        _arr = arr;
    for (var i = 0; i < _arr.length; i++) {
        var one = _arr[i].toString(2),
            v = one.match(/^1+?(?=0)/);
        if (v && one.length == 8) {
            var bytesLength = v[0].length;
            var store = _arr[i].toString(2).slice(7 - bytesLength);
            for (var st = 1; st < bytesLength; st++) {
                store += _arr[st + i].toString(2).slice(2);
            }
            str += String.fromCharCode(parseInt(store, 2));
            i += bytesLength - 1;
        } else {
            str += String.fromCharCode(_arr[i]);
        }
    }
    return str;
}

function hookMd5() {
    let EncryptUtils = Java.use("cn.youth.news.utils.EncryptUtils");
    EncryptUtils["getMD5"].overload('[B').implementation = function (bArr) {
        console.log(`EncryptUtils.getMD5 is called: bArr=${bytesToString(bArr)}`);
        let result = this["getMD5"](bArr);
        console.log(`EncryptUtils.getMD5 result=${result}`);
        return result;
    };
}

function hook() {
    let RequestUtil = Java.use("com.dodonew.online.http.RequestUtil");
    RequestUtil["encodeDesMap"].overload('java.lang.String', 'java.lang.String', 'java.lang.String').implementation = function (data, desKey, desIV) {
        console.log(`RequestUtil.encodeDesMap is called: data=${data}, desKey=${desKey}, desIV=${desIV}`);
        let result = this["encodeDesMap"](data, desKey, desIV);
        console.log(`RequestUtil.encodeDesMap result=${result}`);
        return result;
    };
}

function main() {
    Java.perform(function () {
        hook()
    })
}

main()

function hook3() {
    let Utils = Java.use("com.dodonew.online.util.Utils");
    Utils["md5"].implementation = function (string) {
        console.log(`Utils.md5 is called: string=${string}`);
        let result = this["md5"](string);
        console.log(`Utils.md5 result=${result}`);
        return result;
    };
}

function main() {
    Java.perform(function () {
        hook3()
    })
}

main()

function main() {
    Java.perform(function () {
        let Utils = Java.use("com.dodonew.online.util.Utils");
        console.log(Utils["md5"]('1'));
    })
}

main()

// 打印结果：c4ca4238a0b923820dcc509a6f75849b

function hook2() {
    let RequestUtil = Java.use("com.dodonew.online.http.RequestUtil");
    RequestUtil["paraMap"].overload('java.util.Map', 'java.lang.String', 'java.lang.String').implementation = function (addMap, append, sign) {
        console.log(`RequestUtil.paraMap is called: append=${append}, sign=${sign}`);

        // 打印 Map 内容
        console.log("addMap content:");
        let entrySet = addMap.keySet();
        let iterator = entrySet.iterator();
        while (iterator.hasNext()) {
            var keyStr = iterator.next()
            var valueStr = addMap.get(keyStr)
            console.log(`    ${keyStr} => ${valueStr}`);
        }
        let result = this["paraMap"](addMap, append, sign);
        console.log(`RequestUtil.paraMap result=${result}`);
        return result;
    };
}

function main() {
    Java.perform(function () {
        hook2()
        // hook3()
        // hook()
    })
}

main()

OOO00OO['push'](Q0OQO0O[OQOQQ0Q]);

TypeError: Cannot read properties of undefined (reading 'ajax')

console.log(Q0OQO0O[OQOQQ0Q])
console.log(OQOQQ0Q)

$e = function() {

}
if (OQOQQ0Q === '$') {
    Q0OQO0O[OQOQQ0Q] = $e
 }
OOO00OO['push'](Q0OQO0O[OQOQQ0Q]);

function loadPage(page) {
    $.ajax({
        url: `/api/problem-detail/12/data/?page=${page}`,
        method: 'GET',
        dataType: 'json',
        success: function (data) {
            if (!data) {
                return
            }
            updatePageContent(data);
        },
        error: function (jqXHR, textStatus, errorThrown) {
            console.error('Error fetching problem details:', textStatus, errorThrown);
        }
    });
}

$e = function() {
    
}
window.$ = $e

QQO0OQ0 = [];
for (Q0OQO0Q = 0x0; QQ0OQOQ[OQQQ00Q(0x258, 'TUGE')](Q0OQO0Q, OQOQQ0Q); Q0OQO0Q++)
    QQO0OQ0[OQQQ00Q(0x31e, 'ck!W')](OOO00OO[OQQQ00Q(0x295, 'SEv2')]());
if (QQO0OQ0.length === 4) {
    window.url = QQO0OQ0[2]['url']
    return
}

function get_url(page) {
    loadPage(page)
    console.log(window.url)
}

get_url(process.argv[2])

function Person(name) {
    this.name = name;
}

Person.prototype.sayHello = function() {
    console.log('Hello, my name is ' + this.name);
};

let person1 = new Person('Alice');
let person2 = new Person('Bob');

person1.sayHello(); // Hello, my name is Alice
person2.sayHello(); // Hello, my name is Bob

const person = {
    name: "Alice",
    age: 30
};

console.log(person.hasOwnProperty('name')); // true
console.log(person.hasOwnProperty('age')); // true
console.log(person.hasOwnProperty('toString')); // false，因为 toString 是从 Object.prototype 继承来的

console.log(person1.__proto__ === Person.prototype); // true
console.log(Person.prototype.__proto__ === Object.prototype); // true
console.log(Object.prototype.__proto__ === null); // true

navightor = {}
navightor.userAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0'

navightor = {}
navightor.userAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0'
if (Object.hasOwnProperty(navigator, 'userAgent')) {
    return '错误的结果'
} else {
    return '正确的结果'
}
// hasOwnProperty方法是JavaScript中所有对象从 Object.prototype 继承而来的一个方法。它用于检查一个对象是否拥有指定的属性（该属性必须是对象自身的属性，而不是从原型链继承来的属性）。

Navigator = function () {
}
Navigator.prototype = {
    userAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 Edg/127.0.0.0'
}
navigator = new Navigator()
// 以上将userAgent属性补在了原型对象上面，符合真实的浏览器环境

// 浏览器里面执行
Object.getOwnPropertyDescriptor(navigator,'userAgent') // ---> undefined

// node环境执行
var navigator = {
    userAgent:"aaaaa"
}
Object.getOwnPropertyDescriptor(navigator,'userAgent')
// 输出{value: 'aaaaa',writable: true,enumerable: true,configurable: true}

// 第1种方式,直接通过navigator来补他的隐式原型
navigator = {}
navigator.__proto__.userAgent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36'

console.log(navigator.userAgent);
console.log(Object.getOwnPropertyDescriptor(navigator, 'userAgent'));

// 第2种方式, 通过navigator创建的类来补显式原型
var Navigator = function() {};
Navigator.prototype = {"userAgent": "123123123"};
navigator = new Navigator();
console.log(navigator.userAgent)
console.log(Object.getOwnPropertyDescriptor(navigator, 'userAgent'));

// 补方法
Document = function Document(){}
// Object.defineProperty 直接在一个对象上定义一个新属性，或修改其现有属性，并返回此对象。
Object.defineProperty(Document.prototype,'createElement',{
    configurable: true,
    enumerable: true,
    value: function createElement(){},
    writable: true,
})
HTMLDocument = function HTMLDocument(){}
//可以将一个指定对象的原型（即内部的隐式原型属性）设置为另一个对象
Object.setPrototypeOf(HTMLDocument.prototype,Document.prototype)
document = new HTMLDocument()

console.log(Object.getOwnPropertyDescriptor(document.__proto__.__proto__, 'createElement'));

Document = function Document(){}
Object.defineProperty(Document.prototype,'createElement',{
    configurable: true,
    enumerable: true,
    value: function createElement(){},
    writable: true,
})
HTMLDocument = function HTMLDocument(){}
Object.setPrototypeOf(HTMLDocument.prototype,Document.prototype)
document = new HTMLDocument()

console.log(document.toString());  --> 输出function createElement(){}

// 浏览器控制台输出  --> 'function createElement() { [native code] }'
// 这个时候如果检测了toString即使补原型链也无法通过
// 我们可以重写toString方法来达到目的
Document = function Document(){}
Object.defineProperty(Document.prototype,'createElement',{
    configurable: true,
    enumerable: true,
    value: function createElement(){},
    writable: true,
})

HTMLDocument = function HTMLDocument(){}
Object.setPrototypeOf(HTMLDocument.prototype,Document.prototype)
document = new HTMLDocument()
document.createElement.toString =  function(){return "function createElement() { [native code] }"}
console.log(document.createElement.toString());

const jsdom = require("jsdom");
const { JSDOM } = jsdom;
const dom = new JSDOM(`<div>Hello Wrold!</div>`);
title = dom.window.document.querySelector("div").textContent
console.log(title)

const jsdom = require("jsdom");
const { JSDOM } = jsdom;
const userAgent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'
const dom = new JSDOM(``, {
    url: "https://example.org/",
    referrer: "https://example.com/",
    userAgent: userAgent,
});
window = dom.window
console.log(window.navigator.userAgent)

const jsdom = require("jsdom");
const { JSDOM } = jsdom;
const dom = new JSDOM();
window = dom.window
navigator = window.navigator
navigator.userAgent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'
console.log(window.navigator.userAgent)

const jsdom = require("jsdom");
const { JSDOM } = jsdom;
const userAgent = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'
const resourceLoader = new jsdom.ResourceLoader({
  userAgent: userAgent
});
const dom = new JSDOM(``, {
    url: "https://example.org/",
    referrer: "https://example.com/",
    resources: resourceLoader,
});
window = dom.window
console.log(window.navigator.userAgent)