目标网站aHR0cHM6Ly93d3cuY2VidXBhY2lmaWNhaXIuY29tL2VuLVBILw请求流程1.请求首页获取sbsd的js链接(不一定会带t参数)2.获取sbsd的js3.post 获取bm_sc为2的cookie4.再次请求首页 获取bm_sc为4的cookie环境分析打上xhr断点向上跟一栈就能找到环境数组以及生成发包参数的位置signals就是需要动态生成的值每份js的key名都会不同{ ver: uNry3nQXkQKRhp1qSf4g, signals: { Vl002: false, Vl032: false, Vl034: true, Vl036: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36, Vl045: 0,0,0, Vl047: 1,1,1,1,1,1, Vl048: [\zh-CN\,\zh\], Vl056: false, Vl072: bc60883952e829c2333c9ee93db52d8b0fb1e9da7de4c64ed667766cea87f2dc, Vl078: 1620450, Vl088: 0, Vl105: Asia/Shanghai, Vl129: Fri Jul 31 2026 14:33:17 GMT0800 (中国标准时间), Vl153: x86, Vl163: 1;1;1, Vl178: effdebb7-83, Vl186: s1:-90|s2:discrete|s3:0,1,1,0|s4:explicit|s5:2048,1024, Vl190: Asia/Shanghai, Vl198: 1785479595134, Vl214: true, Vl243: 0, Vl245: [{\brand\:\Chromium\,\version\:\150.0.7871.182\},{\brand\:\Google Chrome\,\version\:\150.0.7871.182\},{\brand\:\Not/A)Brand\,\version\:\99.0.0.0\}], Vl253: 32, Vl258: 1, Vl266: 0, Vl269: Google Inc. (Intel), Vl271: 24, Vl277: c:0, Vl306: 1, Vl319: 0, Vl334: x86, Vl336: 150.0.7871.182, Vl339: c:0, Vl341: [{\brand\:\Chromium\,\version\:\150\},{\brand\:\Google Chrome\,\version\:\150\},{\brand\:\Not/A)Brand\,\version\:\99\}], Vl368: 1, Vl370: true, Vl375: 10.00, Vl393: true, Vl406: [\zh-CN\,\zh\], Vl407: 4395630592,16915022,13988422,150, Vl410: 32, Vl412: 1, Vl424: true, Vl428: , Vl429: Windows, Vl430: https://www.cebupacificair.com/en-PH/, Vl431: 12, Vl436: 0;0, Vl445: 10.0.0, Vl469: 1;1;1, Vl471: true, Vl472: 0, Vl476: 0,0, Vl478: 00, Vl486: 10, Vl487: 0, Vl490: zh-CN, Vl491: [\4g\,-1,\null\], Vl492: true|, Vl496: true, Vl500: 3e0054cf, Vl502: 954069|772464|003253, Vl505: 2560, Vl507: Windows, Vl511: videoinput,audiooutput, Vl522: false, Vl523: 5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36, Vl533: 1,0,0,0, Vl534: google chrome, Vl540: zh-CN, Vl544: false, Vl547: ,0, Vl559: Google Inc. (Intel), Vl568: 24, Vl578: 4628, Vl601: 150.0.7871.182, Vl633: 0,wd, Vl639: ANGLE (Intel, Intel(R) UHD Graphics 730 (0x00004692) Direct3D11 vs_5_0 ps_5_0, D3D11), Vl643: true, Vl653: 5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36, Vl660: false, Vl669: true, Vl670: Google Inc. (Intel), Vl677: 0, Vl696: false, Vl720: , Vl741: 000, Vl742: 1, Vl751: null, Vl754: 80, Vl757: Fri Jul 31 2026 14:33:17 GMT0800 (中国标准时间), Vl762: true,false,true, Vl781: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36, Vl786: landscape-primary, Vl791: 0,0, Vl794: ANGLE (Intel, Intel(R) UHD Graphics 730 (0x00004692) Direct3D11 vs_5_0 ps_5_0, D3D11), Vl795: null, Vl816: fine,fine, Vl823: 0, Vl837: 2, Vl843: e6a6b62042f2333998b8357baa6fe8b776aaad3c0b1692df334f2afaf3954baf-22-19, Vl856: Win32, Vl867: 000000, Vl899: [{\brand\:\Chromium\,\version\:\150.0.7871.182\},{\brand\:\Google Chrome\,\version\:\150.0.7871.182\},{\brand\:\Not/A)Brand\,\version\:\99.0.0.0\}], Vl901: ANGLE (Intel, Intel(R) UHD Graphics 730 (0x00004692) Direct3D11 vs_5_0 ps_5_0, D3D11), Vl910: 1440, Vl916: [{\brand\:\Chromium\,\version\:\150\},{\brand\:\Google Chrome\,\version\:\150\},{\brand\:\Not/A)Brand\,\version\:\99\}], Vl921: Google Inc. (Intel), Vl928: 12, Vl932: d6c65638|s1:16|s2:30|s3:12|s4:1,1|s5:1,1024|s6:32767,32767|s7:16384|s8:24|s9:120|s10:-8, Vl937: 10.0.0, Vl954: [\4g\,-1,\null\], Vl956: fb16a83e, Vl957: true, Vl967: Win32, Vl968: true, Vl973: ANGLE (Intel, Intel(R) UHD Graphics 730 (0x00004692) Direct3D11 vs_5_0 ps_5_0, D3D11), Vl977: true, Vl981: 133742|251807|964836|954069|954069, Vl982: uNry3nQXkQKRhp1qSf4g, Vl674: 704284 }, perf: 2463, s: f, tid: ms8kgapaffsiyskjnvq }部分环境语义/* performance.getEntriesByType(resource) 取name属性做计算 跟abck和sbsd的链接有关 */ Vl981: 133742|251807|964836|954069|954069,// 音频OfflineAudioContext相关的api Vl956: fb16a83e,// speechSynthesis.getVoices() Vl843: e6a6b62042f2333998b8357baa6fe8b776aaad3c0b1692df334f2afaf3954baf-22-19,// (-1).toFixed(-1) — 传入负数抛出 RangeError。获取错误消息的长度Nj[message][length]Array的toatring()去掉函数名的长度 Vl754: 80,/* 创建audio和video元素调用canPlayType(),测浏览器是否支持音频格式 var HP [audio/mpeg, audio/mp4; codecs\mp4a.40.2\, audio/ogg; codecs\vorbis\, audio/webm; codecs\vorbis\]; var Hb [video/mp4; codecs\avc1.42E01E\, video/webm; codecs\vp8, vorbis\]; var D1 L[document][createElement](audio); var WJ L[document][createElement](video); */ Vl047: 1,1,1,1,1,1,// canvas 的todataurl() Vl072: bc60883952e829c2333c9ee93db52d8b0fb1e9da7de4c64ed667766cea87f2dc,// 获取navigator 自身拥有的属性名 Navigator.prototype 上的属性名然后对属性列表做哈希生成一个浏览器环境指纹。 Vl178: effdebb7-83,// jsHeapSizeLimittotalJSHeapSize usedJSHeapSize rtt Vl407: 4395630592,46080560,39398900,100,// L[console][groupEnd]()控制台检测 Vl660: false,以下是近期更新新增的环境检测一、检测原生Vl339: c:0, Vl277: c:0,检测两类对象Vl277:对象属性:navigatorwindow.screenCanvasRenderingContext2D.prototypeWebGLRenderingContext.prototypeOfflineAudioContext.prototypeVl339:函数/属性方法Function.prototype.toStringnavigator.permissions.querynavigator.webdrivernavigator.userAgentData.getHighEntropyValuesnavigator.deviceMemorynavigator.hardwareConcurrencynavigator.pluginsnavigator.mediaDevices.enumerateDevicesspeechSynthesis.getVoicesHTMLCanvasElement.prototype.toDataURLWebGLRenderingContext.prototype.getParameter/getExtensionIntl.DateTimeFormat.prototype.resolvedOptionsnavigator.userAgent/appCodeName/platform/languageswindow.devicePixelRatiowindow.matchMedia检测方式使用Object.getOwnPropertyNames()获取对象自身属性列表。遍历目标属性使用Object.getOwnPropertyDescriptor()获取属性描述符。如果当前对象没有则继续沿原型链查找。对属性进行分析如果存在get检测 getter 的toString()是否包含[native code]检测 getter 的name检测 getter 的prototype正常应为undefined如果没有get直接检测属性值或方法。函数检测内容主要检测函数是否为原生函数func.toString()是否类似function xxx(){ [native code] }函数名称func.name函数原型func.prototype正常浏览器内置方法通常undefined二、字体指纹Vl368: 1,创建 Canvas 测量字体宽度canvas document.createElement(canvas) ctx canvas.getContext(2d)设置基准字体ctx.font 72px serif测量基准文本ctx.measureText(mmmmmmmmmllllliii).width得到默认字体宽度Ut。检测指定字体是否存在定义Jj(fontName)逻辑设置字体ctx.font 72px 字体名, serif再测量ctx.measureText(text).width与默认 serif 宽度比较width ! Ut如果不同说明该字体生效认为该字体存在。检测字体列表依次检测字体用途Roboto / Droid Sans MonoAndroid / Chrome 常见字体Arimo / UbuntuLinux 字体特征Helvetica Neue / Geneva / -apple-system / BlinkMacSystemFontmacOS 字体特征Lucida Console / Cambria Math / Segoe UIWindows 字体特征根据字体组合判断系统环境优先级Lucida Console Cambria Math Segoe UI ↓ Helvetica Neue Geneva ↓ Arimo Ubuntu ↓ Roboto Droid Sans Mono根据哪个字体存在推断WindowsmacOSLinuxAndroid检测目的通过 CanvasmeasureText()测量字体渲染差异判断操作系统类型系统字体环境浏览器运行环境真实性三、webgl2参数能力指纹检测//检测webgl2属性MAX_VERTEX_TEXTURE_IMAGE_UNITS,MAX_VARYING_VECTORS,MAX_VERTEX_UNIFORM_BLOCKS,MAX_VERTEX_OUTPUT_COMPONENTS,MAX_VARYING_COMPONENTS,MAX_INTERLEAVED_COMPONENTS,ALIASED_LINE_WIDTH_RANGE,ALIASED_POINT_SIZE_RANGE,MAX_TEXTURE_IMAGE_UNITS,MAX_FRAGMENT_UNIFORM_BLOCKS,MAX_FRAGMENT_INPUT_COMPONENTS,MIN_PROGRAM_TEXEL_OFFSET,MAX_PROGRAM_TEXEL_OFFSET,MAX_VIEWPORT_DIMS,MAX_TEXTURE_SIZE,MAX_COMBINED_TEXTURE_IMAGE_UNITS,MAX_TEXTURE_LOD_BIAS,MAX_UNIFORM_BUFFER_BINDINGS,UNIFORM_BUFFER_OFFSET_ALIGNMENT,MAX_COMBINED_UNIFORM_BLOCKS Vl932:d6c65638|s1:16|s2:30|s3:12|s4:1,1|s5:1,1024|s6:32767,32767|s7:16384|s8:24|s9:120|s10:-8, //webgl2对象getExtension(WEBGL_compressed_texture_pvrtc/WEBKIT_WEBGL_compressed_texture_pvrtc) Vl791: 0,0,四、AudioContext 环境检测Vl186: s1:-90|s2:discrete|s3:0,1,1,0|s4:explicit|s5:2048,1024,创建音频上下文new AudioContext()获取浏览器音频处理环境。创建音频节点创建AnalyserNode检测频谱分析参数OscillatorNode生成振荡信号GainNode音量控制AudioDestinationNode音频输出设备流程OscillatorNode ↓ GainNode ↓ AudioDestinationNode采集关键参数检测字段含义minDecibels分析器最低分贝阈值channelInterpretation声道解释方式numberOfInputs节点输入数量numberOfOutputs节点输出数量channelCountMode声道计算模式fftSize频谱 FFT 大小生成音频指纹结果s1:-90 | s2:discrete | s3:0,1,1,0 | s4:explicit | s5:2048,1024验证