solve_turnstile.js 7.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178
  1. /**
  2. * Sentinel Turnstile VM executor.
  3. * Usage: node solve_turnstile.js <sentinel_response_json> <requirements_token>
  4. * Output: the "t" value on stdout.
  5. */
  6. const sentinelData = JSON.parse(process.argv[2]);
  7. const reqToken = process.argv[3];
  8. const dx = sentinelData.turnstile?.dx;
  9. if (!dx) { process.stdout.write(''); process.exit(0); }
  10. /* ---- browser shims ---- */
  11. global.window = global; global.self = global; global.top = global; global.parent = global;
  12. global.document = {
  13. createElement:()=>({style:{},src:'',async:!1,defer:!1,onload:null,onerror:null,innerHTML:'',nonce:'',appendChild:()=>{},getElementsByTagName:()=>[{appendChild:()=>{}}],addEventListener:(e,c)=>{if(e==='load')setTimeout(c,1)},height:1,width:1,contentWindow:{document:{createElement:()=>({innerHTML:'',nonce:''}),getElementsByTagName:()=>[{appendChild:()=>{}}]},postMessage:()=>{}}}),
  14. getElementsByTagName:()=>[{appendChild:(el)=>{if(el.onload)setTimeout(el.onload,1)}}],
  15. body:{appendChild:()=>{}},head:{appendChild:()=>{}},readyState:'complete',documentElement:{style:{}},
  16. scripts:[],querySelectorAll:()=>[],cookie:''
  17. };
  18. global.navigator={userAgent:'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',language:'en-US',languages:['en-US','en'],platform:'MacIntel',vendor:'Google Inc.',hardwareConcurrency:8,maxTouchPoints:0,cookieEnabled:true,doNotTrack:null,connection:{},plugins:{length:0},mimeTypes:{length:0},pdfViewerEnabled:true,webdriver:false,scheduling:{},userActivation:{},geolocation:{},credentials:{},mediaDevices:{},permissions:{},locks:{},ink:{},webkitTemporaryStorage:{},webkitPersistentStorage:{},productSub:'20030107',vendorSub:''};
  19. global.screen={width:1920,height:1080,colorDepth:24,pixelDepth:24,availWidth:1920,availHeight:1080};
  20. global.location={href:'https://auth.openai.com/create-account',origin:'https://auth.openai.com',pathname:'/create-account',search:'',hostname:'auth.openai.com',protocol:'https:'};
  21. global.history={length:2};
  22. global.localStorage={getItem:()=>null,setItem:()=>{},removeItem:()=>{},length:0};
  23. global.sessionStorage={getItem:()=>null,setItem:()=>{},removeItem:()=>{},length:0};
  24. const _ps=Date.now()-5000;
  25. global.performance={now:()=>Date.now()-_ps,timeOrigin:_ps};
  26. global.Reflect=Reflect;global.InstallTrigger=undefined;
  27. global.btoa=(s)=>Buffer.from(s,'binary').toString('base64');
  28. global.atob=(s)=>Buffer.from(s,'base64').toString('binary');
  29. global.fetch=async()=>({ok:true,json:async()=>({}),text:async()=>''});
  30. global.crypto={getRandomValues:(a)=>{for(let i=0;i<a.length;i++)a[i]=Math.floor(Math.random()*256);return a},subtle:{}};
  31. global.TextEncoder=TextEncoder;global.TextDecoder=TextDecoder;
  32. global.MutationObserver=class{observe(){}disconnect(){}};
  33. global.addEventListener=()=>{};global.removeEventListener=()=>{};global.postMessage=()=>{};
  34. global.requestAnimationFrame=(cb)=>setTimeout(cb,16);global.cancelAnimationFrame=clearTimeout;
  35. global.getComputedStyle=()=>new Proxy({},{get:()=>''});
  36. global.matchMedia=()=>({matches:false,addListener:()=>{},removeListener:()=>{}});
  37. global.Image=class{set src(v){}get src(){return''}};
  38. /* ---- helpers ---- */
  39. function Tn(a,b){let r='';for(let i=0;i<a.length;i++)r+=String.fromCharCode(a.charCodeAt(i)^b.charCodeAt(i%b.length));return r;}
  40. /* ---- decode instructions ---- */
  41. const instructions=JSON.parse(Tn(atob(dx),reqToken));
  42. /* ---- VM ---- */
  43. const bn=new Map();
  44. const Zt_key=9;
  45. let resolved=false, resolvedValue='', kn=0;
  46. // $t=0: initial empty value
  47. bn.set(0,'');
  48. // Ft=1: XOR
  49. bn.set(1,(n,e)=>bn.set(n,Tn(''+bn.get(n),''+bn.get(e))));
  50. // Lt=2: SET literal
  51. bn.set(2,(n,e)=>bn.set(n,e));
  52. // Jt=3: RESOLVE -> e(btoa(t))
  53. bn.set(3,(t)=>{if(!resolved){resolved=true;resolvedValue=btoa(''+t);}});
  54. // Gt=4: REJECT -> r(btoa(t))
  55. bn.set(4,(t)=>{if(!resolved){resolved=true;resolvedValue=btoa(''+t);}});
  56. // Wt=5: APPEND (array push or string concat)
  57. bn.set(5,(n,e)=>{const v=bn.get(n);if(Array.isArray(v))v.push(bn.get(e));else bn.set(n,v+bn.get(e));});
  58. // zt=6: INDEX -> bn.set(n, bn.get(e)[bn.get(r)])
  59. bn.set(6,(n,e,r)=>bn.set(n,bn.get(e)[bn.get(r)]));
  60. // Vt=7: CALL -> bn.get(n)(...args.map(x=>bn.get(x)))
  61. bn.set(7,(n,...e)=>bn.get(n)(...e.map(x=>bn.get(x))));
  62. // Bt=8: COPY
  63. bn.set(8,(n,e)=>bn.set(n,bn.get(e)));
  64. // Zt=9: instruction list
  65. bn.set(9,[]);
  66. // Kt=10: window
  67. bn.set(10,global.window);
  68. // Qt=11: find script by src
  69. bn.set(11,(n,e)=>{
  70. const p=bn.get(e);
  71. const s=Array.from(document.scripts||[]).filter(x=>x?.src?.search?.(p)>=0);
  72. bn.set(n,(s.map(x=>x?.nonce)?.[0]??[])?.[0]??null);
  73. });
  74. // Yt=12: get VM map
  75. bn.set(12,(n)=>bn.set(n,bn));
  76. // Xt=13: try-catch
  77. bn.set(13,(n,e,...r)=>{try{bn.get(e)(...r);}catch(err){bn.set(n,''+err);}});
  78. // tn=14: JSON.parse
  79. bn.set(14,(n,e)=>bn.set(n,JSON.parse(''+bn.get(e))));
  80. // nn=15: JSON.stringify
  81. bn.set(15,(n,e)=>bn.set(n,JSON.stringify(bn.get(e))));
  82. // en=16: XOR key (set to requirements token)
  83. bn.set(16,reqToken);
  84. // rn=17: async call with result
  85. bn.set(17,(n,e,...r)=>{
  86. try{
  87. const fn=bn.get(e);
  88. const res=typeof fn==='function'?fn(...r.map(x=>bn.get(x))):fn;
  89. if(res&&typeof res.then==='function')return res.then(v=>bn.set(n,v)).catch(err=>bn.set(n,''+err));
  90. bn.set(n,res);
  91. }catch(err){bn.set(n,''+err);}
  92. });
  93. // on=18: atob
  94. bn.set(18,(n)=>bn.set(n,atob(''+bn.get(n))));
  95. // cn=19: btoa
  96. bn.set(19,(n)=>bn.set(n,btoa(''+bn.get(n))));
  97. // un=20: conditional exec: if bn.get(n)===bn.get(e) then call bn.get(r)
  98. bn.set(20,(n,e,r,...o)=>{if(bn.get(n)===bn.get(e))return bn.get(r)(...o);});
  99. // an=21: abs comparison: Math.abs(bn.get(n)-bn.get(e))>bn.get(r) then call
  100. bn.set(21,(n,e,r,o,...i)=>{if(Math.abs(Number(bn.get(n))-Number(bn.get(e)))>Number(bn.get(r)))return bn.get(o)(...i);});
  101. // fn=22: execute sub-instructions
  102. bn.set(22,(n,e)=>{
  103. const saved=[...bn.get(Zt_key)];
  104. bn.set(Zt_key,[...e]);
  105. return executeVM().catch(err=>{bn.set(n,''+err);}).finally(()=>{bn.set(Zt_key,saved);});
  106. });
  107. // sn=23: void check + call: if bn.get(n)!==undefined then bn.get(e)(...r)
  108. bn.set(23,(n,e,...r)=>{if(void 0!==bn.get(n))return bn.get(e)(...r);});
  109. // Ht=24: property access + bind: bn.set(n, bn.get(e)[bn.get(r)].bind(bn.get(e)))
  110. bn.set(24,(n,e,r)=>{
  111. const obj=bn.get(e);
  112. const prop=bn.get(r);
  113. const val=obj?.[prop];
  114. bn.set(n,typeof val==='function'?val.bind(obj):val);
  115. });
  116. // ln=25: no-op
  117. bn.set(25,()=>{});
  118. // dn=26: no-op
  119. bn.set(26,()=>{});
  120. // hn=27: subtract/remove
  121. bn.set(27,(n,e)=>{const v=bn.get(n);if(Array.isArray(v)){v.splice(v.indexOf(bn.get(e)),1);}else bn.set(n,v-bn.get(e));});
  122. // pn=28: no-op
  123. bn.set(28,()=>{});
  124. // mn=29: less than
  125. bn.set(29,(n,e,r)=>bn.set(n,bn.get(e)<bn.get(r)));
  126. // gn=30: function def
  127. bn.set(30,(t,n,e,r)=>{
  128. const isArr=Array.isArray(r);
  129. const params=isArr?e:[];
  130. const body=(isArr?r:e)||[];
  131. bn.set(t,(...args)=>{
  132. if(resolved)return;
  133. const saved=[...bn.get(Zt_key)];
  134. if(isArr)for(let i=0;i<params.length;i++)bn.set(params[i],args[i]);
  135. bn.set(Zt_key,[...body]);
  136. return executeVM().then(()=>bn.get(n)).catch(e=>''+e).finally(()=>bn.set(Zt_key,saved));
  137. });
  138. });
  139. // wn=33: multiply
  140. bn.set(33,(n,e,r)=>bn.set(n,Number(bn.get(e))*Number(bn.get(r))));
  141. // yn=34: divide
  142. bn.set(34,(n,e,r)=>{const d=Number(bn.get(r));bn.set(n,d===0?0:Number(bn.get(e))/d);});
  143. // vn=35: (not common, maybe modulo)
  144. bn.set(35,(n,e,r)=>bn.set(n,Number(bn.get(e))%Number(bn.get(r))));
  145. // Load program
  146. bn.set(Zt_key,instructions);
  147. // VM executor
  148. async function executeVM(){
  149. let steps=0;
  150. const ip=bn.get(Zt_key);
  151. while(ip&&ip.length>0&&steps<200000&&!resolved){
  152. steps++;
  153. const [op,...args]=ip.shift();
  154. const h=bn.get(op);
  155. if(typeof h==='function'){
  156. try{const r=h(...args);if(r&&typeof r.then==='function')await r;}
  157. catch(e){/* silently continue */}
  158. }
  159. }
  160. }
  161. const timeout=setTimeout(()=>{if(!resolved){resolved=true;resolvedValue='';}},8000);
  162. executeVM().then(()=>{
  163. clearTimeout(timeout);
  164. process.stdout.write(resolvedValue||'');
  165. process.exit(0);
  166. }).catch(()=>{
  167. clearTimeout(timeout);
  168. process.stdout.write('');
  169. process.exit(0);
  170. });