听说最近破解vpn客户端很火？

//z7.j # public final Object p(Object obj)

            VpnNodeEncryptedResponse vpnNodeEncryptedResponse = (VpnNodeEncryptedResponse) obj;
            return new com.google.gson.j().b(e0.b(e0.G(vpnNodeEncryptedResponse.getKey()), vpnNodeEncryptedResponse.getData()), VpnServerNodesResponse.class);

// j5.e0
  public static String b(String var0, String var1) {
      e.m(var1, "sSrc");

      try {
         MessageDigest var4 = MessageDigest.getInstance("MD5");
         Charset var2 = a.a;
         byte[] var7 = var0.getBytes(var2);
         //e.l(var7, "this as java.lang.String).getBytes(charset)");
         SecretKeySpec var3 = new SecretKeySpec(var4.digest(var7), "AES");
         IvParameterSpec var11 = new IvParameterSpec(new byte[]{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15});
         Cipher var8 = Cipher.getInstance("AES/CBC/PKCS5Padding");
         var8.init(2, var3, var11);
         byte[] var9 = Base64.decode(var1, 0);
         byte[] var10 = var8.doFinal(var9, 0, var9.length);
         //e.l(var10, "doFinal(...)");
         var0 = new String(var10, var2);
      } catch (Exception var5) {
         var5.printStackTrace();
         var0 = var5.toString();
      }

      return var0;
   }

    public static String G(String var0) {
      e.m(var0, "data");
      byte[] var1 = Base64.decode(
         "MIIEogIBAAKCAQB/xKmjpGbc6MdYYp0v32JLpIaOvyTrhupgWWcQfRFyuk51p3fo\nf6Eh+M3qp00yQzHtP/MkRP6Ldc5DOP6D9b2s522s7vpzsG3LtBenZZ8xN4usMBuO\nTQzJTvLfCjfLl0gXBDJneKjHPKxLxaPmsFwTS1Mi3cZEMNoA8ns9hmdDwcsCLBAH\nzTjpNcfQN+EQw7mRbKK4n14lLzSfYjjScuE/Oj8WOpy5Wl0/UAoHRLbujPNU26hJ\nlpQa2S6ipvFIBZHjhaU4AesST55XBOLDmPNCaKQV9Nf9RJ2GABazioPAOo+Q7iEf\nEXysNcuhdP7q8gXJ0oNHdyJl6PAZZddiZyB7AgMBAAECggEASJMC8Orvasfmg7Pw\nKUMv6FuZ+vdkF0zZUMU3n8wK3yooavgnSi9E7bEP9hv143j7oRHUIGP4WmseMFzt\nZTNu/Amw6KwOIyyyESVI0lMM673rXnEtFdV6T9bCaiK5srFJx5kgsFl/NTyneZrY\nEK9YfbUpkgJ7HjzJeAREMJxph7h7FsSd2M+MB7m/J+6TGZ6fIsZFcy0vIQLjLSAI\nOuO5T1HEB+m7AFHyvXdAfR+BWKSTIs0pkC2wUgbE6CsMlzx3XvM1DnmUiDF478t0\nUFKEnpQKsnmRSweH7htbmhigiP9kHcidJ8+PNqojy+DGsCjuIoSiOqgGEs1+woYS\nw34pIQKBgQDPmwiPNYxM2OYP7onoBhsBKDmdxGSUnEFmUgmtPpEy5PssJDz/SEoV\nponyW/dPEycn8Bjc+6fnjUi0RuqE2e3JnpSWrhhLBEFhrd16bHVwaHA40IWM8UYs\ngUjmTPdt2DO9+M8ZW+UADUAAlARm/NSZo+Z4PzTBIjW4e4xhxm/2AwKBgQCdjUs4\nVC0qdMHT5ntE5IWIagrXxshacaE8rTAgjYOMaib0Skq593yqksb1kiIF3CeWZACd\nd6qk6Gah5Oc755K8wuixxXZY8vzwzLf5K3NqFkbAhxR251kZoQvmoP/OJDbBxO0Y\n86auuX7m498vIh7raoVWjzXKSHK2/ZyTfEw+KQKBgFH5r7mMtWeqxb1IvZ+muYcN\ncSLA585enNxgTH3iFMd570wQyx0qWEaQSiwu8EqDD5UPk2G+5R/jg+/biMMIooJY\nYefVurX0ajS9yJSMuxq1wopMnE94/fKY4kY94f23v0amNnCW/qe0k68mw04/S1uX\ngmu82YHhlkDQWDBLgO4tAoGAS6xv8rBLuVa3OoY7sw1oLetxJc7usLJfVXuB4EDY\nbHsYFsIQPl5m3K7/LThxawshYJTLztaJege+NAh0IEvMKSodBjXn8DVV1Hsf6mg6\nWTw144d+BtZ771lxE+dEtsiiHFPv5coxxz6Fe3T73/GtlDlnrfm/Rleh8c7Cg/xx\nynECgYEAkIj8otP2kFIqR+5tTl2u3wINlVyPONyWKT0GNWN9am80sUMpYYvI5TUm\nJ47+2709GgiYQWZxSsNCqVPuKM57u1czOo7iRqD2UavL3GiN4zmBbGQ+4TqwPJb1\nk2Y8dpIMwIGRKT9GWLexXYqBLK1JJV3TrJ4CjEA9A/Txy/HByZg=",
         0
      );
      e.l(var1, "decode(...)");
      PrivateKey var2 = KeyFactory.getInstance("RSA").generatePrivate(new PKCS8EncodedKeySpec(var1));
      Cipher var4 = Cipher.getInstance("RSA/ECB/OAEPWithSHA1AndMGF1Padding");
      var4.init(2, var2);
      byte[] var3 = var4.doFinal(Base64.decode(var0, 0));
      e.l(var3, "doFinal(...)");
      return new String(var3, a.a); //Charset.forName("UTF-8")
   }

lf.c var6 = new lf.c(); // 这通常是一个 HttpClient 或者是 HttpRequestBuilder
j0.b(var6.a, "https://api.fatvpn.pro/api/v2/vpnServerNodes?version=84");
pa.a.P(var6, new d("text", "plain", u.s)); // 设置 Content-Type 为 text/plain

var7 = mj.a.b; // Koin 注入检查
var10 = (Context)var7.e(...);
var10 = var10.getApplicationContext();

byte[] var18 = i.f(var10).toByteArray();
byte[] var19 = MessageDigest.getInstance("SHA1").digest(var18);

String var20 = i.a(var19);
var16 = var20.toUpperCase(Locale.getDefault());

String var21 = Base64.encodeToString((byte[])var28, 0);
String var22 = var21.substring(0, 16); // 截取前16位

oc1.u(var6, "Authorization", var22); // 写入 Header
oc1.u(var6, "Cache-Control", "no-cache");

k var23 = new k(var6, this.a);
var26.K = 1; // 状态机切换到 1
var28 = var23.b(var26); // 发起挂起请求（网络I/O）

b var24 = ((mf.c)var10).b();
var28 = x.b(VpnNodeEncryptedResponse.class); // 获取该类的反射信息
// ...
var26.K = 2; // 状态机切换到 2
var10 = (Context)var24.a((ag.a)var28, var26); // 反序列化

import base64
import hashlib
import json
import requests
from Crypto.Cipher import AES, PKCS1_OAEP
from Crypto.Hash import SHA1
from Crypto.PublicKey import RSA
from Crypto.Util.Padding import unpad

# 1. 填入你从反编译代码中拿到的硬编码 RSA 私钥 Base64
RSA_PRIVATE_KEY_B64 = """
MIIEogIBAAKCAQB/xKmjpGbc6MdYYp0v32JLpIaOvyTrhupgWWcQfRFyuk51p3fo
f6Eh+M3qp00yQzHtP/MkRP6Ldc5DOP6D9b2s522s7vpzsG3LtBenZZ8xN4usMBuO
TQzJTvLfCjfLl0gXBDJneKjHPKxLxaPmsFwTS1Mi3cZEMNoA8ns9hmdDwcsCLBAH
zTjpNcfQN+EQw7mRbKK4n14lLzSfYjjScuE/Oj8WOpy5Wl0/UAoHRLbujPNU26hJ
nlpQa2S6ipvFIBZHjhaU4AesST55XBOLDmPNCaKQV9Nf9RJ2GABazioPAOo+Q7iEf
EXysNcuhdP7q8gXJ0oNHdyJl6PAZZddiZyB7AgMBAAECggEASJMC8Orvasfmg7Pw
KUMv6FuZ+vdkF0zZUMU3n8wK3yooavgnSi9E7bEP9hv143j7oRHUIGP4WmseMFzt
ZTNu/Amw6KwOIyyyESVI0lMM673rXnEtFdV6T9bCaiK5srFJx5kgsFl/NTyneZrY
EK9YfbUpkgJ7HjzJeAREMJxph7h7FsSd2M+MB7m/J+6TGZ6fIsZFcy0vIQLjLSAI
OuO5T1HEB+m7AFHyvXdAfR+BWKSTIs0pkC2wUgbE6CsMlzx3XvM1DnmUiDF478t0
UFKEnpQKsnmRSweH7htbmhigiP9kHcidJ8+PNqojy+DGsCjuIoSiOqgGEs1+woYS
w34pIQKBgQDPmwiPNYxM2OYP7onoBhsBKDmdxGSUnEFmUgmtPpEy5PssJDz/SEoV
ponyW/dPEycn8Bjc+6fnjUi0RuqE2e3JnpSWrhhLBEFhrd16bHVwaHA40IWM8UYs
gUjmTPdt2DO9+M8ZW+UADUAAlARm/NSZo+Z4PzTBIjW4e4xhxm/2AwKBgQCdjUs4
VC0qdMHT5ntE5IWIagrXxshacaE8rTAgjYOMaib0Skq593yqksb1kiIF3CeWZACd
nd6qk6Gah5Oc755K8wuixxXZY8vzwzLf5K3NqFkbAhxR251kZoQvmoP/OJDbBxO0Y
86auuX7m498vIh7raoVWjzXKSHK2/ZyTfEw+KQKBgFH5r7mMtWeqxb1IvZ+muYcN
cSLA585enNxgTH3iFMd570wQyx0qWEaQSiwu8EqDD5UPk2G+5R/jg+/biMMIooJY
YefVurX0ajS9yJSMuxq1wopMnE94/fKY4kY94f23v0amNnCW/qe0k68mw04/S1uX
gmu82YHhlkDQWDBLgO4tAoGAS6xv8rBLuVa3OoY7sw1oLetxJc7usLJfVXuB4EDY
bHsYFsIQPl5m3K7/LThxawshYJTLztaJege+NAh0IEvMKSodBjXn8DVV1Hsf6mg6
WTw144d+BtZ771lxE+dEtsiiHFPv5coxxz6Fe3T73/GtlDlnrfm/Rleh8c7Cg/xx
ynECgYEAkIj8otP2kFIqR+5tTl2u3wINlVyPONyWKT0GNWN9am80sUMpYYvI5TUm
J47+2709GgiYQWZxSsNCqVPuKM57u1czOo7iRqD2UavL3GiN4zmBbGQ+4TqwPJb1
k2Y8dpIMwIGRKT9GWLexXYqBLK1JJV3TrJ4CjEA9A/Txy/HByZg="
"""

# 固定配置
AES_IV = bytes([0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15])
TARGET_URL = "https://api.fatvpn.pro/api/v2/vpnServerNodes?version=84"


def decrypt_rsa_key(encrypted_key_b64: str) -> str:
    """第一步：使用硬编码的 RSA 私钥解密出临时字符串密钥"""
    # 格式化私钥文本
    key_data = RSA_PRIVATE_KEY_B64.strip().replace("\n", "")
    private_key_bytes = base64.b64decode(key_data)

    # 导入私钥
    rsa_key = RSA.import_key(private_key_bytes)

    # 注意 Java 层的 Cipher.getInstance("RSA/ECB/OAEPWithSHA1AndMGF1Padding")
    # 对应 Crypto 库中需要显式指定 hashAlgo=SHA1
    cipher_rsa = PKCS1_OAEP.new(rsa_key, hashAlgo=SHA1)

    encrypted_bytes = base64.b64decode(encrypted_key_b64)
    decrypted_bytes = cipher_rsa.decrypt(encrypted_bytes)

    return decrypted_bytes.decode("utf-8")


def decrypt_aes_data(temp_key_str: str, encrypted_data_b64: str) -> str:
    """第二步：将临时密钥转成 MD5 作为 AES Key，用 AES-128-CBC 解密出真正数据"""
    # 1. 计算临时密钥字符串的 MD5
    md5_hash = hashlib.md5()
    md5_hash.update(temp_key_str.encode("utf-8"))
    aes_key = md5_hash.digest()  # 16字节的二进制，对应 AES-128

    # 2. 初始化 AES 解密器 (CBC 模式)
    cipher_aes = AES.new(aes_key, AES.MODE_CBC, AES_IV)

    # 3. 解密并移除 PKCS5/PKCS7 填充
    encrypted_bytes = base64.b64decode(encrypted_data_b64)
    decrypted_padded = cipher_aes.decrypt(encrypted_bytes)
    decrypted_bytes = unpad(decrypted_padded, AES.block_size)

    return decrypted_bytes.decode("utf-8")


def main():
    # 伪装请求头，避免被风控（Authorization 根据你前一步抓包或计算的结果填入）
    # 如果前面分析的 Authorization 生成无误，可以自行计算填入。这里假设你可以通过抓包拿到现成的，或者不需要
    headers = {
        "User-Agent": "Ktor client",
        "Cache-Control": "no-cache",
        "Content-Type": "text/plain",
        "Authorization": "N0Q6Q0Y6Nzg6RDE6"
    }

    print(f"正在请求接口: {TARGET_URL} ...")
    try:
        response = requests.get(TARGET_URL, headers=headers, timeout=15)
        if response.status_code != 200:
            print(f"请求失败，状态码: {response.status_code}")
            return

        # 拿到服务器返回的加密 JSON 对象 (包含 key 和 data 字段)
        encrypted_json = response.json()
        encrypted_key = encrypted_json.get("key")
        encrypted_data = encrypted_json.get("data")

        if not encrypted_key or not encrypted_data:
            print("返回的 JSON 数据结构不完整，未找到 key 或 data 字段。")
            return

        print("成功获取加密数据，开始执行 RSA 解密...")
        # 1. 解密出中间 key
        temp_key = decrypt_rsa_key(encrypted_key)

        print("RSA 解密成功，开始执行 AES 解密...")
        # 2. 用中间 key 解密出真正的明文 JSON
        clear_text_json_str = decrypt_aes_data(temp_key, encrypted_data)

        print("\n🎉 解密成功！标准的明文 JSON 如下：")
        # 格式化输出最终的 JSON
        final_json_object = json.loads(clear_text_json_str)
        print(json.dumps(final_json_object, indent=4, ensure_ascii=False))

    except Exception as e:
        print(f"解密过程中发生错误: {e}")


if __name__ == "__main__":
    main()

{
    "type": "https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-521/",
    "title": "Error 521: Web server is down",
    "status": 521,
    "detail": "Cloudflare attempted to connect to the origin web server, but the connection was refused. The origin is down, blocking Cloudflare IPs, or not accepting connections on the configured port.",
    "instance": "a050eeb8dfa3ba3c",
    "error_code": 521,
    "error_name": "origin_down",
    "error_category": "origin",
    "ray_id": "a050eeb8dfa3ba3c",
    "timestamp": "2026-06-01T20:22:48Z",
    "zone": "api.fatvpn.pro",
    "cloudflare_error": true,
    "retryable": true,
    "retry_after": 120,
    "owner_action_required": true,
    "what_you_should_do": "**Wait and retry.** Back off for at least 120 seconds. If the error persists, the origin is offline or blocking Cloudflare — the website operator must restart the origin or whitelist Cloudflare IPs.",
    "footer": "This error was generated by Cloudflare on behalf of the website owner."
}

GET https://app.bazhuayujiasu.cc:8700/7air2vr7ikiqzgvxz/api/v1/client/subscribe?token=26bdf16e3bbf55131c9ea517e5570a82&flag=clash

{
    "message": "token is error"
}

@Nullable
@POST("/netbarcloud/vpn/airportNode.do")
@Headers({"User-Agent: Octopus_Android"})
Object getAirportNode(@NotNull @QueryMap Map<String, String> map, @NotNull @Header("token") String str, @NotNull Continuation<? super SubscriptionRsp> continuation);