极验4更新后forbidden，算法分析

url = aHR0cHM6Ly9ndDQuZ2VldGVzdC5jb20vZGVtb3Y0L2luZGV4LXpoLmh0bWw=

来到这个JY4的官网demo网站，这里以滑块拼图为例子，定位什么的就不说了，这里直接看加密参数：

enc_data = { "setLeft": 49, "passtime": 295, "userresponse": 50.710335869363526, "device_id": "", "lot_number": "0bc33ae753c24e1c88dfd2c95f711f5e", "pow_msg": "1|8|sha256|2025-12-29T18:02:26.845818+08:00|54088bb07d2df3c46b79f80300b0abbe|0bc33ae753c24e1c88dfd2c95f711f5e||aa1c54468f147d6d", "pow_sign": "00ccd83898e5646b9f8eaf6846d7fe8a6620d115313b87ae6d99e6ef96fcf446", "geetest": "captcha", "lang": "zh", "ep": "123", "biht": "1426265548", "gee_guard": { "roe": { "aup": "3", "sep": "3", "egp": "3", "auh": "3", "rew": "3", "snh": "3", "res": "3", "cdc": "3" } }, "TYSC": "opMx", "e1c33a": {"bc3711": {"d2c95f71": "e1c88d"}}, "em": {"ph": 0, "cp": 0, "ek": "11", "wd": 1, "nt": 0, "si": 0, "sc": 0} }

pow_msg就是"2025-12-29T18:02:26.845818+08:00"这个时间戳，前面接口返回的，拼接了captcha_id，这个也是前面接口返回的，再拼接了lot_number，也是前面接口返回的，最后拼接了一个16位的字符串，这个16为的字符串生成是这个函数，我这里解了混淆。

function i(_ᖗᖃᖁᕾ, _ᕶᕾᖚᖙ, _ᖈᕹᖙᕿ, _ᖚᕹᖈᕹ, _ᕷᖉᕴᖃ, _ᕵᖉᖃᖆ, _ᕾᕹᖃᖆ) { var a, _ = _ᕷᖉᕴᖃ % 4, u = parseInt(_ᕷᖉᕴᖃ / 4, 10), c = (a = "0", new Array(u + 1)["join"](a)), h = _ᖚᕹᖈᕹ + "|" + _ᕷᖉᕴᖃ + "|" + _ᖈᕹᖙᕿ + "|" + _ᕵᖉᖃᖆ + "|" + _ᕶᕾᖚᖙ + "|" + _ᖗᖃᖁᕾ + "|" + _ᕾᕹᖃᖆ + "|"; while (1) { var p = (0, _ᕺᖈᖀᕸ["guid"])(), l = h + p, f = void 0; switch (_ᖈᕹᖙᕿ) { case "md5": f = new _ᖄᖁᖄᕾ["default"]["MD5"]()["hex"](l); break; case "sha1": f = new _ᖄᖁᖄᕾ["default"]["SHA1"]()["hex"](l); break; case "sha256": f = new _ᖄᖁᖄᕾ["default"]["SHA256"]()["hex"](l); } if (0 == _) { if (0 === f["indexOf"](c)) return { pow_msg: h + p, pow_sign: f }; } else if (0 === f["indexOf"](c)) { var d = void 0, g = f[u]; switch (_) { case 1: d = 7; break; case 2: d = 3; break; case 3: d = 1; } if (g <= d) return { pow_msg: h + p, pow_sign: f }; } } }

pow_sign就是pow_msg进行SHA256加密，之前是MD5

然后就是加密算法和JY3没有区别，同样AES-CBC加密返回一个数组，然后JY4这里是直接转16进制的字符串，JY3是魔改的base64编码，最后都是拼接了RSA加密aes-key的字符串，长度是256位的。

_ᖗᖃᖁᕾ["arrayToHex"] = function (_ᕷᖉᕴᖃ) { for (var t = [], s = 0, n = 0; n < 2 * _ᕷᖉᕴᖃ["length"]; n += 2) t[n >>> 3] |= parseInt(_ᕷᖉᕴᖃ[s], 10) << 24 - n % 8 * 4, s++; for (var i = [], o = 0; o < _ᕷᖉᕴᖃ["length"]; o++) { var r = t[o >>> 2] >>> 24 - o % 4 * 8 & 255; i["push"]((r >>> 4)["toString"](16)), i["push"]((15 & r)["toString"](16)); } return i["join"](""); }

最后看一下纯python实现的效果

官网的滑块官网的一键过官网的文字点选官网的六宫格如有侵权，联系删除！！！

如有侵权，联系删除！！！